Java: Static member type of generic declaring type reports raw type as `getDeclaringType()`

[Marcono1234]

Description

Similar to #5593

For a static member type of a generic declaring type, getDeclaringType() reports the raw type. This is incorrect and also pretty problematic because raw types have a <> suffix in their name; therefore queries checking for a specific qualified name will most likely not match, causing false negatives. The most prominent example is probably java.util.Map.Entry; CodeQL currently reports the qualified name as java.util.Map<>$Entry.

This only affects static member types, non-static member types correctly report the generic type as getDeclaringType().

Example

class Generic<T> {
    // BAD: Reports Generic<> (raw) as declaring type
    static class Nested {}
    // BAD: Reports Generic<> (raw) as declaring type
    interface NestedInterface {}

    // GOOD: Reports Generic as declaring type
    class Inner {}
}

CodeQL query:

import java

from Member m
where
    m.fromSource()
    and m instanceof RefType
select m, m.getDeclaringType()

[aschackmull]

I agree that having the qualified name java.util.Map$Entry would be better and more intuitive. I do, however, worry that such a change could silently break things in a number of places. It would certainly need a change note at the very least. @yo-h @lcartey Do you think it would be worth it and/or feasible to make this change?

[yo-h]

I agree that having the qualified name java.util.Map$Entry would be better and more intuitive. I do, however, worry that such a change could silently break things in a number of places. It would certainly need a change note at the very least.

Agreed.

Do you think it would be worth it and/or feasible to make this change?

It seems worth to create a branch for this change and to run it through our various tests to determine the extent of any visible consequences.

[yo-h]

@Marcono1234, as a general comment, I just wanted to extend our thanks for the many detailed and thoughtful issues you have been filing. We very much appreciate your input. Apologies if we are not able to address everything immediately, but we intend to respond and/or address the issues as soon as time permits - please bear with us.

[Marcono1234]

@yo-h thanks to you and the other team members for these kind words!

Apologies if we are not able to address everything immediately

That is not a problem at all, in fact it is the opposite. If you think at some point that my issues or pull requests are not useful or too minor, don't hesitate to let me know, or label the issues or pull requests accordingly.
Similarly if you are uncomfortable with the amount or frequency of me creating them (or their quality), please let me know as well. Even though it might be useful to be aware of bugs or problems within a project, a large number of such reports can slow down development and might reduce motivation; I would like to avoid such situation.

Also, please let me know if I should stop interacting with pull requests (or reduce interaction there); especially for new contributors I can understand if you might want to treat them differently, or if you would like to perform the initial review.

[yo-h]

@Marcono1234 thank you for being so considerate, and please keep contributing as you have been. There have been several comments internally on the team regarding the high quality of your contributions, both on issues and pull requests, so I wanted to pass that on as an encouragement to keep contributing!

[smowton]

@aschackmull candidate fix: #6059

[smowton]

Fix merged; will be visible as of the next CLI / extractor release

[Marcono1234]

Thanks!

[yo-h]

By the way, @Marcono1234, in case you are not already aware of it, you may be interested in joining us on the GitHub Security Lab Slack (see link at https://securitylab.github.com/get-involved/ to receive an invite). Other contributors are active there.

[Marcono1234]

Sorry for not having responded earlier @yo-h, I did not mean to be rude. Thanks a lot for asking me to join the GitHub Security Lab! At the moment I am a bit busy so I have not requested an invite yet. But it definitely sounds interesting and I might consider it in the future.