Skip to content

False Positive: DoNotCallFinalize.ql cannot detect 'finalize()' in the function call chain. #21394

@Carlson-JLQ

Description

@Carlson-JLQ

Version
2.23.9

Description of the false positive

When I use java/Violations of Best Practice/Undesirable Calls/DoNotCallFinalize.ql to detect the code as below, it passes normally.

public class NegCase2 {
    @Override
    protected void finalize() throws Throwable {
        // Override of finalize with super.finalize call is allowed.
        super.finalize();
    }
}

However, when I put "super.finalize();" into another function for calling, DoNotCallFinalize.ql reported a problem.

public class NegCase2_Var3 {
    // Helper method to encapsulate the call
    private void callSuperFinalize() throws Throwable {
        super.finalize(); // [REPORTED LINE]
    }
    @Override
    protected void finalize() throws Throwable {
        // Delegate to helper
        callSuperFinalize();
    }
}

These two code snippets are essentially the same and should both pass the test.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions