René's URL Explorer Experiment


Title: Java: Add new quality query to detect `finalize` calls by jcogs33 · Pull Request #19075 · github/codeql · GitHub

Open Graph Title: Java: Add new quality query to detect `finalize` calls by jcogs33 · Pull Request #19075 · github/codeql

X Title: Java: Add new quality query to detect `finalize` calls by jcogs33 · Pull Request #19075 · github/codeql

Description: Description Adds a new quality query to detect finalize calls. This query is migrated from the advance security team's quality queries. Consideration Changes from original query. Let me know if you disagree with any of these changes: The query only alerts on finalize calls now. Alerts for runFinalizersOnExit and gc will continue to be reported on the pre-existing queries java/run-finalizers-on-exit and java/garbage-collection, respectively. I will make follow-up PRs updating these pre-existing queries if needed. Added an exclusion for super.finalize calls that occur within a callable that overrides finalize since the Java doc for finalize states: "If a subclass overrides finalize it must invoke the superclass finalizer explicitly", and alerting on these calls would contradict our pre-existing java/missing-super-finalize query. This exclusion reduces the number of alerts on the MRVA top-100 from 66 to 24 and on the MRVA top-1000 from 954 to 115. Added an exclusion for calls to overloads of finalize. My understanding is that the JVM will not call overloads of finalize when handling garbage collection, but will only call finalize() and overrides of finalize(). So I don't think overloads are relevant for alerts. Let me know if you disagree. This exclusion further reduces the number of alerts on the MRVA top-100 from 24 to 5 and on the MRVA top-1000 from 115 to 40. Other Notes: Autofixes look okay. Successfully removes the finalize call then attempts to use AutoCloseable as suggested in the QHelp. DCA looks good

Open Graph Description: Description Adds a new quality query to detect finalize calls. This query is migrated from the advance security team's quality queries. Consideration Changes from original query. Let me know if...

X Description: Description Adds a new quality query to detect finalize calls. This query is migrated from the advance security team's quality queries. Consideration Changes from original query. Let me kno...

Opengraph URL: https://github.com/github/codeql/pull/19075

X: @github

direct link

Domain: github.com

route-pattern/:user_id/:repository/pull/:id/files(.:format)
route-controllerpull_requests
route-actionfiles
fetch-noncev2:cebcea06-6fbf-28f2-1a18-cd0a6d669e13
current-catalog-service-hashae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b
request-idD888:377895:B3BC0:F8B58:6A4D1C00
html-safe-nonce489c6645899bdd9d52e9e82f48e311d6cb4002727341874f704c402c14c7d626
visitor-payloadeyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJEODg4OjM3Nzg5NTpCM0JDMDpGOEI1ODo2QTREMUMwMCIsInZpc2l0b3JfaWQiOiI5MDY0OTIzMzkzNjQ0MzcwOTQ0IiwicmVnaW9uX2VkZ2UiOiJpYWQiLCJyZWdpb25fcmVuZGVyIjoiaWFkIn0=
visitor-hmaca8e76c07189010446c5e5f8f56e758727673e9e44bb1014b2c45aee7536c47b9
hovercard-subject-tagpull_request:2406812269
github-keyboard-shortcutsrepository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot
google-site-verificationApib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I
octolytics-urlhttps://collector.github.com/github/collect
analytics-location///pull_requests/show/files
fb:app_id1401488693436528
apple-itunes-appapp-id=1477376905, app-argument=https://github.com/github/codeql/pull/19075/files
twitter:imagehttps://avatars.githubusercontent.com/u/57204504?s=400&v=4
twitter:cardsummary_large_image
og:imagehttps://avatars.githubusercontent.com/u/57204504?s=400&v=4
og:image:altDescription Adds a new quality query to detect finalize calls. This query is migrated from the advance security team's quality queries. Consideration Changes from original query. Let me know if...
og:site_nameGitHub
og:typeobject
hostnamegithub.com
expected-hostnamegithub.com
Nonebcb4661e6fb4fe8b394c51ea02ccdb2236d40dc59afc75a3bbba50bf6517134c
turbo-cache-controlno-preview
diff-viewunified
go-importgithub.com/github/codeql git https://github.com/github/codeql.git
octolytics-dimension-user_id9919
octolytics-dimension-user_logingithub
octolytics-dimension-repository_id143040428
octolytics-dimension-repository_nwogithub/codeql
octolytics-dimension-repository_publictrue
octolytics-dimension-repository_is_forkfalse
octolytics-dimension-repository_network_root_id143040428
octolytics-dimension-repository_network_root_nwogithub/codeql
turbo-body-classeslogged-out env-production page-responsive full-width
disable-turbotrue
browser-stats-urlhttps://api.github.com/_private/browser/stats
browser-errors-urlhttps://api.github.com/_private/browser/errors
releasefb70bd3c4b2bec429781b65419e912c66e2d5581
ui-targetfull
theme-color#1e2327
color-schemelight dark

Links:

Skip to contenthttps://github.com/github/codeql/pull/19075/files#start-of-content
https://github.com/
Sign in https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fgithub%2Fcodeql%2Fpull%2F19075%2Ffiles
GitHub CopilotWrite better code with AIhttps://github.com/features/copilot
GitHub Copilot appDirect agents from issue to mergehttps://github.com/features/ai/github-app
MCP RegistryNewIntegrate external toolshttps://github.com/mcp
ActionsAutomate any workflowhttps://github.com/features/actions
CodespacesInstant dev environmentshttps://github.com/features/codespaces
IssuesPlan and track workhttps://github.com/features/issues
Code ReviewManage code changeshttps://github.com/features/code-review
GitHub Advanced SecurityFind and fix vulnerabilitieshttps://github.com/security/advanced-security
Code securitySecure your code as you buildhttps://github.com/security/advanced-security/code-security
Secret protectionStop leaks before they starthttps://github.com/security/advanced-security/secret-protection
Why GitHubhttps://github.com/why-github
Documentationhttps://docs.github.com
Bloghttps://github.blog
Changeloghttps://github.blog/changelog
Marketplacehttps://github.com/marketplace
View all featureshttps://github.com/features
Enterpriseshttps://github.com/enterprise
Small and medium teamshttps://github.com/team
Startupshttps://github.com/enterprise/startups
Nonprofitshttps://github.com/solutions/industry/nonprofits
App Modernizationhttps://github.com/solutions/use-case/app-modernization
DevSecOpshttps://github.com/solutions/use-case/devsecops
DevOpshttps://github.com/solutions/use-case/devops
CI/CDhttps://github.com/solutions/use-case/ci-cd
View all use caseshttps://github.com/solutions/use-case
Healthcarehttps://github.com/solutions/industry/healthcare
Financial serviceshttps://github.com/solutions/industry/financial-services
Manufacturinghttps://github.com/solutions/industry/manufacturing
Governmenthttps://github.com/solutions/industry/government
View all industrieshttps://github.com/solutions/industry
View all solutionshttps://github.com/solutions
AIhttps://github.com/resources/articles?topic=ai
Software Developmenthttps://github.com/resources/articles?topic=software-development
DevOpshttps://github.com/resources/articles?topic=devops
Securityhttps://github.com/resources/articles?topic=security
View all topicshttps://github.com/resources/articles
Customer storieshttps://github.com/customer-stories
Events & webinarshttps://github.com/resources/events
Ebooks & reportshttps://github.com/resources/whitepapers
Business insightshttps://github.com/solutions/executive-insights
GitHub Skillshttps://skills.github.com
Documentationhttps://docs.github.com
Customer supporthttps://support.github.com
Community forumhttps://github.com/orgs/community/discussions
Trust centerhttps://github.com/trust-center
Partnershttps://github.com/partners
View all resourceshttps://github.com/resources
GitHub SponsorsFund open source developershttps://github.com/sponsors
Security Labhttps://securitylab.github.com
Maintainer Communityhttps://maintainers.github.com
Acceleratorhttps://github.com/accelerator
GitHub Starshttps://stars.github.com
Archive Programhttps://archiveprogram.github.com
Topicshttps://github.com/topics
Trendinghttps://github.com/trending
Collectionshttps://github.com/collections
Enterprise platformAI-powered developer platformhttps://github.com/enterprise
GitHub Advanced SecurityEnterprise-grade security featureshttps://github.com/security/advanced-security
Copilot for BusinessEnterprise-grade AI featureshttps://github.com/features/copilot/copilot-business
Premium SupportEnterprise-grade 24/7 supporthttps://github.com/premium-support
Pricinghttps://github.com/pricing
Search syntax tipshttps://docs.github.com/search-github/github-code-search/understanding-github-code-search-syntax
documentationhttps://docs.github.com/search-github/github-code-search/understanding-github-code-search-syntax
Sign in https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fgithub%2Fcodeql%2Fpull%2F19075%2Ffiles
Sign up https://github.com/signup?ref_cta=Sign+up&ref_loc=header+logged+out&ref_page=%2F%3Cuser-name%3E%2F%3Crepo-name%3E%2Fpull_requests%2Fshow%2Ffiles&source=header-repo&source_repo=github%2Fcodeql
Reloadhttps://github.com/github/codeql/pull/19075/files
Reloadhttps://github.com/github/codeql/pull/19075/files
Reloadhttps://github.com/github/codeql/pull/19075/files
Please reload this pagehttps://github.com/github/codeql/pull/19075/files
github https://github.com/github
codeqlhttps://github.com/github/codeql
Notifications https://github.com/login?return_to=%2Fgithub%2Fcodeql
Fork 2k https://github.com/login?return_to=%2Fgithub%2Fcodeql
Star 9.8k https://github.com/login?return_to=%2Fgithub%2Fcodeql
Code https://github.com/github/codeql
Issues 987 https://github.com/github/codeql/issues
Pull requests 424 https://github.com/github/codeql/pulls
Discussions https://github.com/github/codeql/discussions
Actions https://github.com/github/codeql/actions
Projects https://github.com/github/codeql/projects
Models https://github.com/github/codeql/models
Security and quality 0 https://github.com/github/codeql/security
Insights https://github.com/github/codeql/pulse
Code https://github.com/github/codeql
Issues https://github.com/github/codeql/issues
Pull requests https://github.com/github/codeql/pulls
Discussions https://github.com/github/codeql/discussions
Actions https://github.com/github/codeql/actions
Projects https://github.com/github/codeql/projects
Models https://github.com/github/codeql/models
Security and quality https://github.com/github/codeql/security
Insights https://github.com/github/codeql/pulse
Sign up for GitHub https://github.com/signup?return_to=%2Fgithub%2Fcodeql%2Fissues%2Fnew%2Fchoose
terms of servicehttps://docs.github.com/terms
privacy statementhttps://docs.github.com/privacy
Sign inhttps://github.com/login?return_to=%2Fgithub%2Fcodeql%2Fissues%2Fnew%2Fchoose
jcogs33https://github.com/jcogs33
github:mainhttps://github.com/github/codeql/tree/main
jcogs33:jcogs33/java/do-not-use-finalizershttps://github.com/jcogs33/codeql/tree/jcogs33/java/do-not-use-finalizers
Conversation 20 https://github.com/github/codeql/pull/19075
Findings https://github.com/github/codeql/pull/19075/findings
Commits 22 https://github.com/github/codeql/pull/19075/commits
Checks 0 https://github.com/github/codeql/pull/19075/checks
Files changed https://github.com/github/codeql/pull/19075/files
Please reload this pagehttps://github.com/github/codeql/pull/19075/files
Java: Add new quality query to detect finalize calls https://github.com/github/codeql/pull/19075/files#top
Show all changes 22 commits https://github.com/github/codeql/pull/19075/files
56ea9b6 Java: move original files Mar 20, 2025 https://github.com/github/codeql/pull/19075/commits/56ea9b65234d68f3c74dc4611967b1695d6020a8
9a6e241 Java: update to only find 'finalize' calls and add 'super.finalize' e… Mar 20, 2025 https://github.com/github/codeql/pull/19075/commits/9a6e241f540021744dca8154c0939a7a4b5a6f4f
d9482ae Java: update tests to use inline expectations Mar 20, 2025 https://github.com/github/codeql/pull/19075/commits/d9482ae334f2ed817507f310a5aa637f72f0f389
c689a0e Java: add more test cases Mar 21, 2025 https://github.com/github/codeql/pull/19075/commits/c689a0e9b718ff14fd5923e25c0b57224badf64b
dd57d1a Java: add quality tag Mar 21, 2025 https://github.com/github/codeql/pull/19075/commits/dd57d1aec6c2a8de30d6b70e790cb5e93208f6ec
44445db Java: minor refactor Mar 21, 2025 https://github.com/github/codeql/pull/19075/commits/44445dbeb8230e7a93c531e249e9dd95846e76d0
2e25498 Java: add change note Mar 21, 2025 https://github.com/github/codeql/pull/19075/commits/2e254981437cb42799c46611ef72f1a1e918e41f
f73eda0 Java: add previous-id and change 'use' to 'call' Mar 27, 2025 https://github.com/github/codeql/pull/19075/commits/f73eda0c38ab9c02407d9d2f1ce380d42a653401
ed22a16 Java: exclude overloads of finalize Mar 27, 2025 https://github.com/github/codeql/pull/19075/commits/ed22a16f32dfb1ba5c940dece2a1dfb105dd88cb
3631df0 Java: add to code-quality suite Mar 27, 2025 https://github.com/github/codeql/pull/19075/commits/3631df03c7faec4d2d4371f73217a783164cfb3f
caf21a8 Java: update qhelp and add 'performace' tag Mar 28, 2025 https://github.com/github/codeql/pull/19075/commits/caf21a8202c3055273d5955e2fc273c58881fe82
416643c Java: update qhelp recommendation and example Apr 1, 2025 https://github.com/github/codeql/pull/19075/commits/416643ce3906480834d6592b19a5fb1f3aaab37e
e621f9f Java: update comments in tests Apr 1, 2025 https://github.com/github/codeql/pull/19075/commits/e621f9fd4903d60ca266e87afbd8f9969955bddc
c4b8396 fix typo in query description jcogs33 Apr 1, 2025 https://github.com/github/codeql/pull/19075/commits/c4b83963334bb29137d921e3dbf4bf5a221bee01
1a2c34d Java: update qhelp implementation notes for clarity Apr 1, 2025 https://github.com/github/codeql/pull/19075/commits/1a2c34dd28d25eba9d1c214af07bf569f6c6a492
05d7b9a Java: add reliability tag Apr 2, 2025 https://github.com/github/codeql/pull/19075/commits/05d7b9a19a1e84266fbb5f46505c3a577b7f99f8
0380279 Java: update qhelp implementation notes for more clarity Apr 2, 2025 https://github.com/github/codeql/pull/19075/commits/0380279c39079c713a1d64a412669b18abccee7a
fc21abc Java: update qhelp implementation notes to say 'method declarations' Apr 3, 2025 https://github.com/github/codeql/pull/19075/commits/fc21abc7e4af6b6b1045c5b3e25e8a7114126680
798907d Java: remove change note Apr 4, 2025 https://github.com/github/codeql/pull/19075/commits/798907dc5045d644d67e15ac2130a5f48c4f66fe
2b91605 Apply docs review suggestion jcogs33 Apr 21, 2025 https://github.com/github/codeql/pull/19075/commits/2b9160526a7bccc904f5108a10a302aefbc4a119
72d49f2 Merge branch 'main' into jcogs33/java/do-not-use-finalizers jcogs33 Apr 21, 2025 https://github.com/github/codeql/pull/19075/commits/72d49f21eea03667b5333c7c993d9a384b850234
3aa6b49 Java: Add new query to java-code-quality.qls.expected Apr 21, 2025 https://github.com/github/codeql/pull/19075/commits/3aa6b49204d2acd38ba026de88afa9b202f91ee5
Clear filters https://github.com/github/codeql/pull/19075/files
Please reload this pagehttps://github.com/github/codeql/pull/19075/files
Please reload this pagehttps://github.com/github/codeql/pull/19075/files
java-code-quality.qls.expected https://github.com/github/codeql/pull/19075/files#diff-03a9af5c514eaf7e16db2534ab5986a2ba831f2f7a6a23bbbbb0d09d94023d0b
DoNotCallFinalize.md https://github.com/github/codeql/pull/19075/files#diff-e37ff344e2307b09e8407978de67cf16864c5157c8b9801da2625e63b8b32216
DoNotCallFinalize.ql https://github.com/github/codeql/pull/19075/files#diff-8bb69669abb96341cad7267be96a3f264b22a5d7335c8c0d9b81cd7409eb7ec9
java-code-quality.qls https://github.com/github/codeql/pull/19075/files#diff-dde72e9d48b3e4bcc8440ef33de3706f3cc908cc16c98508523ea3acaaac6490
DoNotCallFinalize.expected https://github.com/github/codeql/pull/19075/files#diff-1cf6f0b491639fde82825eda0ba54e9b018b06124cfc53715a2d247e30074df2
DoNotCallFinalize.qlref https://github.com/github/codeql/pull/19075/files#diff-220568373ab80d12dcb99a5cf447bb4d21652acb5fe694502fc39a8572fc05cb
Test.java https://github.com/github/codeql/pull/19075/files#diff-5b9ede1bbe893ac873b9fccb9050da84987ed2fd35171c30612c1e9ebc860b4d
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/integration-tests/java/query-suite/java-code-quality.qls.expectedhttps://github.com/github/codeql/pull/19075/files#diff-03a9af5c514eaf7e16db2534ab5986a2ba831f2f7a6a23bbbbb0d09d94023d0b
View file https://github.com/jcogs33/codeql/blob/3aa6b49204d2acd38ba026de88afa9b202f91ee5/java/ql/integration-tests/java/query-suite/java-code-quality.qls.expected
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/19075/{{ revealButtonHref }}
https://github.com/github/codeql/pull/19075/files#diff-03a9af5c514eaf7e16db2534ab5986a2ba831f2f7a6a23bbbbb0d09d94023d0b
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/src/Violations of Best Practice/Undesirable Calls/DoNotCallFinalize.mdhttps://github.com/github/codeql/pull/19075/files#diff-e37ff344e2307b09e8407978de67cf16864c5157c8b9801da2625e63b8b32216
View file https://github.com/jcogs33/codeql/blob/3aa6b49204d2acd38ba026de88afa9b202f91ee5/java/ql/src/Violations%20of%20Best%20Practice/Undesirable%20Calls/DoNotCallFinalize.md
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/19075/{{ revealButtonHref }}
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/src/Violations of Best Practice/Undesirable Calls/DoNotCallFinalize.qlhttps://github.com/github/codeql/pull/19075/files#diff-8bb69669abb96341cad7267be96a3f264b22a5d7335c8c0d9b81cd7409eb7ec9
View file https://github.com/jcogs33/codeql/blob/3aa6b49204d2acd38ba026de88afa9b202f91ee5/java/ql/src/Violations%20of%20Best%20Practice/Undesirable%20Calls/DoNotCallFinalize.ql
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/19075/{{ revealButtonHref }}
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/src/codeql-suites/java-code-quality.qlshttps://github.com/github/codeql/pull/19075/files#diff-dde72e9d48b3e4bcc8440ef33de3706f3cc908cc16c98508523ea3acaaac6490
View file https://github.com/jcogs33/codeql/blob/3aa6b49204d2acd38ba026de88afa9b202f91ee5/java/ql/src/codeql-suites/java-code-quality.qls
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/19075/{{ revealButtonHref }}
https://github.com/github/codeql/pull/19075/files#diff-dde72e9d48b3e4bcc8440ef33de3706f3cc908cc16c98508523ea3acaaac6490
https://github.com/github/codeql/pull/19075/files#diff-dde72e9d48b3e4bcc8440ef33de3706f3cc908cc16c98508523ea3acaaac6490
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/test/query-tests/DoNotCallFinalize/DoNotCallFinalize.expectedhttps://github.com/github/codeql/pull/19075/files#diff-1cf6f0b491639fde82825eda0ba54e9b018b06124cfc53715a2d247e30074df2
View file https://github.com/jcogs33/codeql/blob/3aa6b49204d2acd38ba026de88afa9b202f91ee5/java/ql/test/query-tests/DoNotCallFinalize/DoNotCallFinalize.expected
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/19075/{{ revealButtonHref }}
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/test/query-tests/DoNotCallFinalize/DoNotCallFinalize.qlrefhttps://github.com/github/codeql/pull/19075/files#diff-220568373ab80d12dcb99a5cf447bb4d21652acb5fe694502fc39a8572fc05cb
View file https://github.com/jcogs33/codeql/blob/3aa6b49204d2acd38ba026de88afa9b202f91ee5/java/ql/test/query-tests/DoNotCallFinalize/DoNotCallFinalize.qlref
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/19075/{{ revealButtonHref }}
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/test/query-tests/DoNotCallFinalize/Test.javahttps://github.com/github/codeql/pull/19075/files#diff-5b9ede1bbe893ac873b9fccb9050da84987ed2fd35171c30612c1e9ebc860b4d
View file https://github.com/jcogs33/codeql/blob/3aa6b49204d2acd38ba026de88afa9b202f91ee5/java/ql/test/query-tests/DoNotCallFinalize/Test.java
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/19075/{{ revealButtonHref }}
https://github.com
Termshttps://docs.github.com/site-policy/github-terms/github-terms-of-service
Privacyhttps://docs.github.com/site-policy/privacy-policies/github-privacy-statement
Securityhttps://github.com/security
Statushttps://www.githubstatus.com/
Communityhttps://github.community/
Docshttps://docs.github.com/
Contacthttps://support.github.com?tags=dotcom-footer

Viewport: width=device-width

URLs of crawlers that visited me.