java/unused-reference-type and java/unused-container: silenced by any annotation, even an empty one

未關閉
  • 哪裡不對？
#22,984 1 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視

維護者通常 1 天內回覆

還沒有人認領這個 Issue。

評估

難度
4/5
預估耗時
3-5 天
新手友好度
35/100
Issue 類型
缺陷
描述清晰度
描述清楚
活躍度
活躍
技術堆疊
java
領域
devtools

研究方向

Start with the java/unused-reference-type query and the ReflectiveAccessAnnotation check it uses, which treats any annotation other than Override, Deprecated, SuppressWarnings and SafeVarargs as reflective access. Reproduce with the seed/ and variant/ samples in the issue, one database per directory. Done means an empty, program-declared annotation no longer silences the unused-class and container alerts, or the help pages document the exemption.

由索引模型根據 Issue 內容生成。

描述

Java

Description of the issue

seed/WRAnnotatedType.java declares an unused private nested class and seed/WRAnnotatedContainer.java a private list that's only written to, and the queries report both. Each file also declares an empty annotation type @interface Tag {}, with no retention and no meaning to any framework. Putting @Tag on the class and on the list (variant/) silences both alerts, though nothing else changed.

The queries treat every annotation except Override, Deprecated, SuppressWarnings and SafeVarargs as a sign of reflective access (ReflectiveAccessAnnotation), even one the program declares itself and nothing reads. The help pages don't mention any annotation exemption.

Query: java/unused-reference-type (codeql/java-queries 1.1.10)

CodeQL CLI: 2.27.2

Code samples

seed/WRAnnotatedContainer.java:

import java.util.ArrayList;
import java.util.List;

class WRAnnotatedContainer {
    @interface Tag {
    }

    private List<String> names = new ArrayList<>();

    void m() {
        names.add("x");
    }
}

seed/WRAnnotatedType.java:

class WRAnnotatedType {
    @interface Tag {
    }

    private class Unused {
    }

    void m() {
    }
}

variant/WRAnnotatedContainer.java:

import java.util.ArrayList;
import java.util.List;

class WRAnnotatedContainer {
    @interface Tag {
    }

    @Tag
    private List<String> names = new ArrayList<>();

    void m() {
        names.add("x");
    }
}

variant/WRAnnotatedType.java:

class WRAnnotatedType {
    @interface Tag {
    }

    @Tag
    private class Unused {
    }

    void m() {
    }
}

How to reproduce

codeql database create db --language=java --build-mode=none \
    --source-root=<one directory> --overwrite
codeql database analyze db \
    codeql/java-queries:codeql-suites/java-security-and-quality.qls \
    --format=csv --output=out.csv
# one database per directory

Expected result

"Unused class" on the annotated Unused in variant/WRAnnotatedType.java and "The contents of this container are never accessed" on names in variant/WRAnnotatedContainer.java, as on the seed/ files. Or, if any annotation is meant to be an exemption, the help pages should say so.

Output of the commands above:

### CodeQL 2.27.2  query: java/unused-reference-type
### suite: java-security-and-quality.qls, --build-mode=none, per-file isolated databases
### extraction JDK: openjdk version "21.0.11" 2026-04-21 LTS

--- SEED -- expected: query fires (seed/)
"Unused classes and interfaces","A non-public class or interface that is not used anywhere in the program wast
"Unused classes and interfaces","A non-public class or interface that is not used anywhere in the program wast
"Unused classes and interfaces","A non-public class or interface that is not used anywhere in the program wast
"Container contents are never accessed","A collection or map whose contents are never queried or accessed is u

--- VARIANT -- expected: query fires, actual: not reported (the bug) (variant/)
    (query reported nothing)
主要語言
CodeQL
星號
10.3k
分支
2.1k
平均合併
2 天 6 小時
30 天內合併 PR
137

環境準備

在 Codespaces 中開啟

在瀏覽器裡用你自己的 GitHub 帳號啟動這個專案的開發容器。

  • 沒有 Dockerfile 或 Docker Compose 檔案
  • 沒有 Pull Request 範本
  • 閱讀貢獻指南

從這裡開始

  1. 先讀完整個 Issue，再讀專案的貢獻指南。
  2. 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
  3. Fork 儲存庫，在一個分支上完成修改。
  4. 送出 Pull Request，並在描述裡引用這個 Issue 編號。

github/codeql 的其他 Issue

查看 github/codeql 的全部 Issue

相似的 Issue

更多 DevTools Issue

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。