Update precision java concatenated command line#19723
Conversation
This query is generating False positives with hard coded strings declared within the function - issue reported by customer. We had a discussion on code_scanning channel on 6/5/25 and the team agreed upon reducing its precision to Medium.
There was a problem hiding this comment.
Pull Request Overview
This PR lowers the precision of the java/concatenated-command-line query from high to medium to reduce false positives with hard-coded strings.
- Updated change note documenting the precision adjustment.
- Modified the
@precisiontag in the QL rule file.
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| java/ql/src/change-notes/2025-06-10-reduce-precision-for-building-cmdline-with-string-concatenation.md | Added a note about lowering precision due to hard-coded string false positives. |
| java/ql/src/Security/CWE/CWE-078/ExecUnescaped.ql | Changed @precision from high to medium in metadata. |
owen-mc
left a comment
owen-mc
left a comment
There was a problem hiding this comment.
Looks good except the typo that copilot spotted. Will approve when that is fixed.
|
If the precision is changed the query will be removed from the |
|
@michaelnebel Since we don't have the time to work on this now, I suggest we accept the lower precision and make an issue to improve the precision in future. |
…ing-cmdline-with-string-concatenation.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
…ing-cmdline-with-string-concatenation.md Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com>
|
We recently added integration tests to make it harder to accidentally change what is included in the codeql query suites without realising it. You need to edit |
removing line once this query precision is changed to Medium
|
hey @owen-mc all checks have passed now, do I have your approval now? |
I realise that this was already discussed in Slack and the decision is to lower the precision for now and then perhaps improve the query in the future 😄 |
Updated precision to medium because this query is producing false positives when hard coded strings are used in the concatenated string of the command line.