An Empirical Analysis of CodeQL False Positives and Query Refinements for Java Vulnerabilities
Study of 167 Java CVE instances finds CodeQL false positives follow recurring patterns; query refinements remove 81.8% of reviewed ones.
Researchers ran CodeQL's Java security query suite on 167 CVE instances from 110 projects, manually reviewing 500 sampled false-positive paths and building a five-category taxonomy led by Missed Path Constraint or Sanitization (36.6%), Benign Execution Context (29.4%), and Missing Trust Boundary Modeling (27.6%). Guided by the taxonomy, query-level refinements removed 81.8% of reviewed false positives and 15.8% of reported paths across the selected queries while retaining 7 of 8 true positives. To address generalization, agentic coding tools given the refinement patterns as templates adapted them to new projects successfully in 56% and 62% of tasks, versus 28% without guidance.
- Top false-positive cause: missed path constraint or sanitization at 36.6% of reviewed cases
- Refinements removed 81.8% of reviewed false positives at the query level
- Overall removed 15.8% of reported paths while retaining 7 of 8 true positives
- Agentic tools adapted refinement templates in 56-62% of tasks versus 28% unaided
- Proposes refinement-oriented SAST workflow to reduce repeated triage
From the original article
1 min read at arxiv.orgStatic application security testing (SAST) tools help developers find vulnerabilities before deployment, but false positives create substantial triage effort. We study whether CodeQL false positives in Java security analysis form recurring, explainable patterns that can be reduced by refining the analysis.
By Amirali Sajadi · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.