False Negative：ArrayIndexOutOfBounds.ql

從 Likely Bugs/Collections/ArrayIndexOutOfBounds.ql 開始，比較它如何處理直接陣列存取與使用輔助方法、別名和計算索引的存取。重現 issue 中的 Java 範例，然後驗證 query 是否回報每個超出範圍的存取，包括負索引。

Version
codeql 2.23.9

When I detect the code like this using Likely Bugs/Collections/ArrayIndexOutOfBounds.ql, the problem is reported normally:

package scensct.core.pos;
public class PosCase1 {
    public static void main(String[] args) {
        int[] arr = new int[5];
        int index = 10; // Unbounded index, no constraint check before access
        int value = arr[index]; // Direct access with potentially out-of-bounds index // [REPORTED LINE]
    }
}

However, when I use a mediator variable or call a mediator function, ArrayIndexOutOfBounds.ql fails to detect the problem:

package scensct.var.pos;

public class PosCase1_Var4 {
    public static void main(String[] args) {
        int[] arr = createArray();
        int index = getIndex();
        int value = arr[index]; // Access with index from method
    }

    private static int[] createArray() {
        return new int[5];
    }

    private static int getIndex() {
        return 10;
    }
}

package scensct.var.pos;

public class PosCase2_Var4 {
    public static void main(String[] args) {
        int[] arr = new int[5];
        int K = 5;
        // Introduce an alias reference
        int[] alias = arr;
        int index = K;
        int value = alias[index];
    }
}

package scensct.var.pos;

public class PosCase2_Var5 {
    private static int getIndex(int k) {
        return k;
    }

    public static void main(String[] args) {
        int[] arr = new int[5];
        int K = 5;
        // Move index computation to a helper method
        int index = getIndex(K);
        int value = arr[index];
    }
}

package scensct.core.pos;

public class PosCase3 {
    public static void main(String[] args) {
        int[] arr = new int[5];
        int K = -1; // Negative bound
        int index = K + 0; // Index bounded below by negative K
        int value = arr[index]; // Access with potentially negative index
    }
}