False negative: AndroidInsecureLocalAuthentication.ql

從 Security/CWE/CWE-287/AndroidInsecureLocalAuthentication.ql 開始，重現報告中的 Java 範例，並比較直接使用參數、指派、委派以及透過輔助函式呼叫的情況。完成的標準是：對於提供的變體，該查詢都能一致地回報不安全的驗證處理，且不會出現漏報。

Version
codeql 2.23.9

When I detect the code like this using Security/CWE/CWE-287/AndroidInsecureLocalAuthentication.ql, the problem is reported normally:

package scensct.core.pos;
import android.hardware.fingerprint.FingerprintManager;
public class PosCase1 extends FingerprintManager.AuthenticationCallback {
    @Override
    public void onAuthenticationSucceeded(FingerprintManager.AuthenticationResult result) { // [REPORTED LINE]
        // Parameter 'result' is declared but never accessed or referenced.
        // No cryptographic operation or any use of 'result'.
        System.out.println("Authentication succeeded.");
    }
}

However, when I insert a temporary variable, AndroidInsecureLocalAuthentication.ql is unable to detect the problem：

package scensct.var.pos;

import android.hardware.fingerprint.FingerprintManager;

public class PosCase1_Var3 extends FingerprintManager.AuthenticationCallback {
    @Override
    public void onAuthenticationSucceeded(FingerprintManager.AuthenticationResult result) {
        // Introduce a temporary variable that shadows but does not use result.
        Object ignored = result;
        // Still no cryptographic operation or actual usage.
        System.out.println("Authentication succeeded.");
        // The 'ignored' variable is never read.
    }
}

AndroidInsecureLocalAuthentication.ql scanning the following code also fails to detect the issue:

package scensct.var.pos;

import android.hardware.biometrics.BiometricPrompt;

public class PosCase2_Var1 extends BiometricPrompt.AuthenticationCallback {
    @Override
    public void onAuthenticationSucceeded(BiometricPrompt.AuthenticationResult result) {
        // Introduce a temporary variable that does not change the usage
        BiometricPrompt.AuthenticationResult res = result;
        super.onAuthenticationSucceeded(res);
    }
}

package scensct.var.pos;

import android.hardware.biometrics.BiometricPrompt;

public class PosCase2_Var4 extends BiometricPrompt.AuthenticationCallback {
    // Extract a private helper method that only passes the parameter
    private void callSuper(BiometricPrompt.AuthenticationResult r) {
        super.onAuthenticationSucceeded(r);
    }

    @Override
    public void onAuthenticationSucceeded(BiometricPrompt.AuthenticationResult result) {
        callSuper(result);
    }
}

package scensct.var.pos;

import android.hardware.biometrics.BiometricPrompt;

public class PosCase2_Var5 extends BiometricPrompt.AuthenticationCallback {
    @Override
    public void onAuthenticationSucceeded(BiometricPrompt.AuthenticationResult result) {
        // Add a redundant local variable and a no-op statement
        BiometricPrompt.AuthenticationResult authResult = result;
        int dummy = 0; // unrelated to result
        super.onAuthenticationSucceeded(authResult);
    }
}