False negative: AndroidInsecureLocalAuthentication.ql

从 Security/CWE/CWE-287/AndroidInsecureLocalAuthentication.ql 开始，复现报告中的 Java 示例，并比较直接使用参数、赋值、委托以及通过辅助函数调用的情况。完成的标准是：对于提供的变体，该查询都能一致地报告不安全的身份验证处理，且不会出现漏报。

Version
codeql 2.23.9

When I detect the code like this using Security/CWE/CWE-287/AndroidInsecureLocalAuthentication.ql, the problem is reported normally:

package scensct.core.pos;
import android.hardware.fingerprint.FingerprintManager;
public class PosCase1 extends FingerprintManager.AuthenticationCallback {
    @Override
    public void onAuthenticationSucceeded(FingerprintManager.AuthenticationResult result) { // [REPORTED LINE]
        // Parameter 'result' is declared but never accessed or referenced.
        // No cryptographic operation or any use of 'result'.
        System.out.println("Authentication succeeded.");
    }
}

However, when I insert a temporary variable, AndroidInsecureLocalAuthentication.ql is unable to detect the problem：

package scensct.var.pos;

import android.hardware.fingerprint.FingerprintManager;

public class PosCase1_Var3 extends FingerprintManager.AuthenticationCallback {
    @Override
    public void onAuthenticationSucceeded(FingerprintManager.AuthenticationResult result) {
        // Introduce a temporary variable that shadows but does not use result.
        Object ignored = result;
        // Still no cryptographic operation or actual usage.
        System.out.println("Authentication succeeded.");
        // The 'ignored' variable is never read.
    }
}

AndroidInsecureLocalAuthentication.ql scanning the following code also fails to detect the issue:

package scensct.var.pos;

import android.hardware.biometrics.BiometricPrompt;

public class PosCase2_Var1 extends BiometricPrompt.AuthenticationCallback {
    @Override
    public void onAuthenticationSucceeded(BiometricPrompt.AuthenticationResult result) {
        // Introduce a temporary variable that does not change the usage
        BiometricPrompt.AuthenticationResult res = result;
        super.onAuthenticationSucceeded(res);
    }
}

package scensct.var.pos;

import android.hardware.biometrics.BiometricPrompt;

public class PosCase2_Var4 extends BiometricPrompt.AuthenticationCallback {
    // Extract a private helper method that only passes the parameter
    private void callSuper(BiometricPrompt.AuthenticationResult r) {
        super.onAuthenticationSucceeded(r);
    }

    @Override
    public void onAuthenticationSucceeded(BiometricPrompt.AuthenticationResult result) {
        callSuper(result);
    }
}

package scensct.var.pos;

import android.hardware.biometrics.BiometricPrompt;

public class PosCase2_Var5 extends BiometricPrompt.AuthenticationCallback {
    @Override
    public void onAuthenticationSucceeded(BiometricPrompt.AuthenticationResult result) {
        // Add a redundant local variable and a no-op statement
        BiometricPrompt.AuthenticationResult authResult = result;
        int dummy = 0; // unrelated to result
        super.onAuthenticationSucceeded(authResult);
    }
}