Bug report
The query codeql-custom-queries-java/spring/avoid-unpaginated-repository-access.ql may produce a false positive because it matches any supertype named Repository:
call.getQualifier().getType().(RefType).getASupertype*().getName() = "Repository"
This only checks the simple type name, not whether the type actually belongs to Spring Data.
If a project defines its own Repository interface/class, unrelated to Spring, the query may still flag findAll() calls in a Spring endpoint as if they were Spring repository accesses.
Expected behavior
Only Spring Data repository types should be matched.
Suggested fix
Use fully qualified type matching, or otherwise restrict the detection to known Spring repository interfaces (org.springframework.stereotype.Repository)
Bug report
The query
codeql-custom-queries-java/spring/avoid-unpaginated-repository-access.qlmay produce a false positive because it matches any supertype namedRepository:This only checks the simple type name, not whether the type actually belongs to Spring Data.
If a project defines its own
Repositoryinterface/class, unrelated to Spring, the query may still flagfindAll()calls in a Spring endpoint as if they were Spring repository accesses.Expected behavior
Only Spring Data repository types should be matched.
Suggested fix
Use fully qualified type matching, or otherwise restrict the detection to known Spring repository interfaces (
org.springframework.stereotype.Repository)