False Negative：ArrayIndexOutOfBounds.ql

Likely Bugs/Collections/ArrayIndexOutOfBounds.ql から始め、直接的な配列アクセスと、ヘルパーメソッド、エイリアス、計算されたインデックスを使用するアクセスをどのように処理しているか比較します。Issue の Java の例を再現し、その後、負のインデックスを含む、範囲外の各アクセスを query が報告することを確認します。

Version
codeql 2.23.9

When I detect the code like this using Likely Bugs/Collections/ArrayIndexOutOfBounds.ql, the problem is reported normally:

package scensct.core.pos;
public class PosCase1 {
    public static void main(String[] args) {
        int[] arr = new int[5];
        int index = 10; // Unbounded index, no constraint check before access
        int value = arr[index]; // Direct access with potentially out-of-bounds index // [REPORTED LINE]
    }
}

However, when I use a mediator variable or call a mediator function, ArrayIndexOutOfBounds.ql fails to detect the problem:

package scensct.var.pos;

public class PosCase1_Var4 {
    public static void main(String[] args) {
        int[] arr = createArray();
        int index = getIndex();
        int value = arr[index]; // Access with index from method
    }

    private static int[] createArray() {
        return new int[5];
    }

    private static int getIndex() {
        return 10;
    }
}

package scensct.var.pos;

public class PosCase2_Var4 {
    public static void main(String[] args) {
        int[] arr = new int[5];
        int K = 5;
        // Introduce an alias reference
        int[] alias = arr;
        int index = K;
        int value = alias[index];
    }
}

package scensct.var.pos;

public class PosCase2_Var5 {
    private static int getIndex(int k) {
        return k;
    }

    public static void main(String[] args) {
        int[] arr = new int[5];
        int K = 5;
        // Move index computation to a helper method
        int index = getIndex(K);
        int value = arr[index];
    }
}

package scensct.core.pos;

public class PosCase3 {
    public static void main(String[] args) {
        int[] arr = new int[5];
        int K = -1; // Negative bound
        int index = K + 0; // Index bounded below by negative K
        int value = arr[index]; // Access with potentially negative index
    }
}