fix(codeql): resolve and triage CodeQL findings by cuioss-oliver · Pull Request #209 · cuioss/cui-java-tools

cuioss-oliver · 2026-07-07T15:55:30Z

Summary

Addresses the open CodeQL findings for the repository. Structural Scorecard alerts (Branch-Protection, SAST, Fuzzing, etc.) are out of scope and left untouched.

Fixed in code (4)

Alert	Rule	File	Fix
39	`java/input-resource-leak`	`FileLoaderUtility`	Copy the input stream directly instead of wrapping it in an unclosed `BufferedInputStream`
14	`java/comparison-with-wider-type`	`TestDataGenerator`	Use a `long` loop counter to match the `long` bound
37	`java/inefficient-empty-string-test`	`CollectionLiteralsTest`	Use `String.isEmpty()` instead of comparing to `""`
15	`java/local-temp-file...-information-disclosure`	`FileSystemLoaderTest`	Create the temp file via `Files.createTempFile` (secure default permissions)

Dismissed via API (53)

False positive — Lombok-generated methods (17): java/missing-override-annotation and java/unknown-javadoc-parameter are reported against @Getter/@ToString/@EqualsAndHashCode-generated methods; @Override cannot be added to generated code and the class-level @param <T> javadoc is correct.
Used in tests (26): deliberate test doubles/fixtures preserving contract signatures (Proxy*/Null* streams, bean fixtures), tests of deprecated API, and null-argument precondition tests (java/unused-parameter, java/deprecated-call, java/uncaught-number-format-exception, java/dereferenced-expr-may-be-null).
Won't fix (10): java/confusing-method-signature on intentional public-API overloads that cannot be renamed without breaking the Maven Central API, and java/missing-clone-method on PartialArrayList which inherits Cloneable transitively from ArrayList and is not designed for cloning.

Verification

./mvnw -Ppre-commit clean verify — BUILD SUCCESS, 887 tests pass, clean tree.

Summary by CodeRabbit

Bug Fixes
- Improved temporary file handling during file loading for more reliable copy behavior.
Tests
- Updated file-system tests to use JUnit-managed temporary directories for cleaner, more stable test setup.
- Adjusted collection tests to better reflect empty-value filtering behavior.
- Minor test utility cleanup for clearer loop typing.

- FileLoaderUtility: copy input stream directly instead of wrapping in an unclosed BufferedInputStream (java/input-resource-leak) - TestDataGenerator: use long loop counter to avoid int/long comparison (java/comparison-with-wider-type) - CollectionLiteralsTest: use String.isEmpty() instead of comparing to "" (java/inefficient-empty-string-test) - FileSystemLoaderTest: create temp file via Files.createTempFile with secure default permissions (java/local-temp-file...-information-disclosure) Co-Authored-By: Claude <noreply@anthropic.com>

coderabbitai · 2026-07-07T15:55:40Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ef02ef1e-e279-403f-94fe-8d578b6fd9fb

📥 Commits

Reviewing files that changed from the base of the PR and between 2ef8ef8 and d25b9b0.

📒 Files selected for processing (4)

src/main/java/de/cuioss/tools/io/FileLoaderUtility.java
src/test/java/de/cuioss/tools/collect/CollectionLiteralsTest.java
src/test/java/de/cuioss/tools/io/FileSystemLoaderTest.java
src/test/java/de/cuioss/tools/support/TestDataGenerator.java

📝 Walkthrough

Walkthrough

This PR makes small, unrelated edits: removing BufferedInputStream wrapping in FileLoaderUtility's temp file copy, updating a test filter predicate in CollectionLiteralsTest, switching FileSystemLoaderTest to use JUnit's @TempDir, and changing a loop variable type in TestDataGenerator.

Changes

Miscellaneous small fixes

Layer / File(s)	Summary
Remove BufferedInputStream wrapping in temp file copy `src/main/java/de/cuioss/tools/io/FileLoaderUtility.java`	Copy logic now passes the input stream directly to `Files.copy` instead of wrapping it in `BufferedInputStream`; the unused import is removed.
Use JUnit TempDir for writable file test `src/test/java/de/cuioss/tools/io/FileSystemLoaderTest.java`	The writable-file test now accepts `@TempDir Path tempDir` and creates the temp file via `Files.createFile(...)` instead of `File.createTempFile`/`deleteOnExit`, with new imports added.
Test predicate and loop type adjustments `src/test/java/de/cuioss/tools/collect/CollectionLiteralsTest.java`, `src/test/java/de/cuioss/tools/support/TestDataGenerator.java`	The map-filtering predicate now uses `entry.getValue().isEmpty()`, and a loop variable's type is changed from `var` to explicit `long`.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the PR’s main goal of fixing and triaging CodeQL findings.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/codeql-findings

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

gemini-code-assist

Code Review

This pull request simplifies stream copying in FileLoaderUtility by removing redundant BufferedInputStream wrapping, improves string emptiness checks in CollectionLiteralsTest, updates temporary file creation in FileSystemLoaderTest to use Files.createTempFile, and fixes a potential type mismatch in TestDataGenerator by changing the loop variable type to long. The reviewer suggested using JUnit 5's @tempdir annotation in FileSystemLoaderTest to manage temporary file lifecycles more robustly instead of relying on deleteOnExit().

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

gemini-code-assist · 2026-07-07T15:57:00Z

+        File tempFile = Files.createTempFile("test", ".txt").toFile();
        tempFile.deleteOnExit();


Instead of manually creating a temporary file and registering it with deleteOnExit(), which can lead to resource leaks if the JVM crashes or memory accumulation in large test suites, prefer using JUnit 5's @TempDir annotation. This allows JUnit to automatically manage the lifecycle and cleanup of the temporary directory and its contents.

Example:

@Test void shouldHandleOutputStreamForWritableFile(@org.junit.jupiter.api.io.TempDir java.nio.file.Path tempDir) throws Exception { File tempFile = tempDir.resolve("test.txt").toFile(); // ... }

Address PR review: replace manual createTempFile + deleteOnExit with a JUnit-managed @tempdir so the temp file lifecycle is handled automatically. Co-Authored-By: Claude <noreply@anthropic.com>

cuioss-oliver · 2026-07-07T16:01:51Z

Applied in d25b9b0 — replaced the manual createTempFile + deleteOnExit() with a JUnit-managed @TempDir. The file is created inside the managed directory (so FileSystemLoader.isWritable() still sees an existing file) and JUnit handles cleanup automatically. Thanks!

gemini-code-assist Bot reviewed Jul 7, 2026

View reviewed changes

test(io): use JUnit @tempdir for writable-file test

d25b9b0

Address PR review: replace manual createTempFile + deleteOnExit with a JUnit-managed @tempdir so the temp file lifecycle is handled automatically. Co-Authored-By: Claude <noreply@anthropic.com>

cuioss-oliver merged commit 2274873 into main Jul 7, 2026
21 checks passed

cuioss-oliver deleted the fix/codeql-findings branch July 7, 2026 16:06

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(codeql): resolve and triage CodeQL findings#209

fix(codeql): resolve and triage CodeQL findings#209
cuioss-oliver merged 2 commits into
mainfrom
fix/codeql-findings

cuioss-oliver commented Jul 7, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 7, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Jul 7, 2026

Uh oh!

cuioss-oliver commented Jul 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		File tempFile = Files.createTempFile("test", ".txt").toFile();
		tempFile.deleteOnExit();

Uh oh!

Conversation

cuioss-oliver commented Jul 7, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Fixed in code (4)

Dismissed via API (53)

Verification

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Jul 7, 2026

Choose a reason for hiding this comment

Uh oh!

cuioss-oliver commented Jul 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

cuioss-oliver commented Jul 7, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 7, 2026 •

edited

Loading