Repository navigation
java/print-array: an array appended to a string with += is not reported #23021
Description
Description of the issue
The query reports s + xs in PrintArraySeed.f(), where xs is an int[] that gets converted with Object.toString(). s += xs in PrintArrayVariant.f() does the same conversion (JLS 15.26.2 defines it as s = (String) (s + xs)) and gives the same [I@... text, but isn't reported.
Probably implicitToStringCall in StringFormat.qll. It covers an operand of a string-typed AddExpr, an argument of a print method and an argument of a formatting call, but s += xs is an AssignAddExpr. Error Prone's ArrayToString reports both forms.
Query: java/print-array (codeql/java-queries 1.1.10)
CodeQL CLI: 2.27.2
Code samples
seed/PrintArraySeed.java:
class PrintArraySeed {
String f(int[] xs) {
String s = "";
s = s + xs; // query fires here
return s;
}
}variant/PrintArrayVariant.java:
class PrintArrayVariant {
String f(int[] xs) {
String s = "";
s += xs; // the same conversion; query silent
return s;
}
}How to reproduce
codeql database create db --language=java --build-mode=none \
--source-root=<one directory> --overwrite
codeql database analyze db \
codeql/java-queries:codeql-suites/java-security-and-quality.qls \
--format=csv --output=out.csv
# one database per directory
Expected result
"Implicit conversion from Array to String." on xs in s += xs in PrintArrayVariant.f(), as on s + xs in PrintArraySeed.f().
Output of the commands above:
### CodeQL 2.27.2 query: java/print-array
### suite: java-security-and-quality.qls, --build-mode=none, per-file isolated databases
### extraction JDK: openjdk version "21.0.11" 2026-04-21 LTS
--- SEED -- expected: query fires (seed/)
"Implicit conversion from array to string","Directly printing an array, without first converting the array to
--- VARIANT -- expected: query fires, actual: not reported (the bug) (variant/)
(query reported nothing)
Activity
jketema commentedon Nov 5, 2026
Hi @MarkLee131,
Thanks for the report.
I see you've opened a number of issues in the last few days. May I ask where these are coming from? Are these flagged up by some kind of testing tool? Or are you encountering these in real-world code?
MarkLee131 commentedon Nov 10, 2026
Hi @jketema. Sorry for the late reply.
They come out of a research project on analyzer consistency. We collected the false-positive and false-negative issues that maintainers had confirmed on the trackers of several Java analyzers (SpotBugs, sonar-java, CodeQL's own), pulled out the recurring shapes behind them (a negated guard, a statement moved into a lambda, a parenthesised expression, a constant instead of a literal, that kind of thing), and checked which of the other analyzers have the same gap. The CodeQL issues are the cases where it does. Each one is a hand-minimised pair we ran through the CLI, and I checked the open issues before filing.
jketema commentedon Nov 10, 2026
@MarkLee131,
Thanks for your reply. Note that we generally tune our queries on real world code, so if there's no indication that these problems occur in practice, we're not going to prioritize fixing these.