False Negative: ConstantExpAppearsNonConstant.ql misses expressions that stay constant after trivial local rewrites.

從 Likely Bugs/Arithmetic/ConstantExpAppearsNonConstant.ql 開始，檢查它如何透過區域變數和重寫後的表達式傳播常數結果。查看 PosCase1.java、PosCase3_Var1.java 和 PosCase3_Var2.java，作為受影響的範例。完成的標準是查詢能夠辨識所描述的常數表達式，同時不遺失現有的偵測行為。

Version
codeql 2.24.3

Checker

• Checker id: Likely Bugs/Arithmetic/ConstantExpAppearsNonConstant.ql
• Checker description: This checker detects expressions that always evaluate to the same constant value but are not recognized as compile-time constants by the compiler, often due to containing non-constant sub-expressions that don't affect the final result.

Description of the false negative

These cases still reduce to a constant result at runtime. One multiplies by zero. The others use true || condition, which is still always true regardless of the non-constant boolean input.

The only change is that the constant-looking behavior is expressed through locals or a slightly different spelling.

Affected test cases

PosCase1.java

nonConstant * 0 still evaluates to zero regardless of the non-constant operand.

PosCase3_Var1.java and PosCase3_Var2.java

Both variants are still logical constants. Boolean.TRUE || condition and alwaysTrue || condition should both be recognized as always true.

Cause analysis

This looks like a propagation gap. Likely Bugs/Arithmetic/ConstantExpAppearsNonConstant.ql appears to lose the constant result once the expression is one step less direct, even though the same algebraic reasoning still applies.

That makes the query miss a kind of bug it should be well suited to catch.

Reproduction code

PosCase1.java

// Multiplication by zero with integer literal zero operand should be flagged as always evaluating to zero.
package scensct.core.pos;

public class PosCase1 {
    public PosCase1() {
        int nonConstant = getNonConstant(); // Non-constant subexpression
        int result = nonConstant * 0; // Multiplication by zero, always zero
        // Use result in a conditional to emphasize constant evaluation
        if (result == 0) {
            // This branch is always taken
            System.out.println("Always zero");
        }
    }

    private int getNonConstant() {
        return (int) (Math.random() * 100); // Non-constant value
    }
}

References

None known.