github/codeql

False Negative: Unsafe hostname verification is under-modeled in anonymous classes, lambdas, and API variants.

#21556

· Carlson-JLQ opened

on Mar 23, 2026

False Negative: IterableIterator.ql misses `iterator() == this` implementations once the guard logic is hidden behind helpers or trivial control flow.

#21551

· Carlson-JLQ opened

on Mar 23, 2026

False Positive: IterableIterator.ql reports classes whose `hasNext()` still reliably disables iteration.

#21550

· Carlson-JLQ opened

on Mar 23, 2026

False Negative: ImproperWebViewCertificateValidation.ql misses unconditional `handler.proceed()` calls once they are hidden behind aliases or tiny wrappers.

#21549

· Carlson-JLQ opened

on Mar 23, 2026

False Negative: ImplicitPendingIntents.ql misses mutable implicit PendingIntents once they are stored, enriched, or sent through slightly noisier code paths.

#21548

· Carlson-JLQ opened

on Mar 23, 2026

False Negative: EqualsArray.ql misses array identity comparisons once the array is widened to `Object` or routed through helper APIs.

#21547

· Carlson-JLQ opened

on Mar 23, 2026

False Negative: DoubleCheckedLockingWithInitRace.ql misses initialization races once the double-checked pattern is split across helpers or early returns.

#21546

· Carlson-JLQ opened

on Mar 23, 2026

incorrect outofmemory death

#21543

· k4lizen opened

on Mar 22, 2026

False Negative: DoubleCheckedLocking.ql misses non-volatile lazy initialization once the null checks are split across locals, helpers, or early returns.

#21542

· Carlson-JLQ opened

on Mar 22, 2026

False Negative: ContradictoryTypeChecks.ql misses impossible subtype checks once the false branch is expressed through aliases or lambdas.

#21541

· Carlson-JLQ opened

on Mar 22, 2026

False Negative: ContinueInFalseLoop.ql misses `do ... while(false)` loops once `false` is stored in a local.

#21540

· Carlson-JLQ opened

on Mar 22, 2026

False Negative: ContainsTypeMismatch.ql misses mismatched collection lookups once the receiver is routed through a raw alias.

#21539

· Carlson-JLQ opened

on Mar 22, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

False Negative: Unsafe hostname verification is under-modeled in anonymous classes, lambdas, and API variants.

False Negative: IterableIterator.ql misses `iterator() == this` implementations once the guard logic is hidden behind helpers or trivial control flow.

False Positive: IterableIterator.ql reports classes whose `hasNext()` still reliably disables iteration.

False Negative: ImproperWebViewCertificateValidation.ql misses unconditional `handler.proceed()` calls once they are hidden behind aliases or tiny wrappers.

False Negative: ImplicitPendingIntents.ql misses mutable implicit PendingIntents once they are stored, enriched, or sent through slightly noisier code paths.

False Negative: EqualsArray.ql misses array identity comparisons once the array is widened to `Object` or routed through helper APIs.

False Negative: DoubleCheckedLockingWithInitRace.ql misses initialization races once the double-checked pattern is split across helpers or early returns.

incorrect outofmemory death

False Negative: DoubleCheckedLocking.ql misses non-volatile lazy initialization once the null checks are split across locals, helpers, or early returns.

False Negative: ContradictoryTypeChecks.ql misses impossible subtype checks once the false branch is expressed through aliases or lambdas.

False Negative: ContinueInFalseLoop.ql misses `do ... while(false)` loops once `false` is stored in a local.

False Negative: ContainsTypeMismatch.ql misses mismatched collection lookups once the receiver is routed through a raw alias.

Issues

Search results