Reducing CodeQL alert noise in your project

["Sajadi,Amirali via dev" <de...@pdfbox.apache.org>]

Hi Apache PDFBox maintainers,

I'm Amirali Sajadi, a CS PhD candidate at Drexel University, working with my advisor Prof. Preetha Chatterjee at Drexel and Prof. Saikat Dutta at Cornell University. Our joint research explores reducing recurring false positives in CodeQL's Java analysis.

We analyzed Apache PDFBox at the following commit: https://github.com/apache/pdfbox/tree/bf37c60dfa43cb9fb21497b44a667d091d809084

For CodeQL's "Comparison of narrow type with wide type in loop condition" query (java/comparison-with-wider-type), the original query produced 5 alerts, while our refined version produced 4, removing 1 alert in this comparison.

Would you be interested in exploring whether this approach could make your CodeQL results easier to review? We can share the before-and-after findings and, if useful, prepare a small workflow patch for you to evaluate. We can also work with you on similar refinements for other categories of false-positive alerts.

Thank you for your time!

Best regards,
Amirali Sajadi
CS PhD candidate, Drexel University