Reference the supplied format arguments (CodeQL java/unused-format-argument)#235
Open
vharseko wants to merge 2 commits into
Open
Reference the supplied format arguments (CodeQL java/unused-format-argument)#235vharseko wants to merge 2 commits into
vharseko wants to merge 2 commits into
Conversation
…gument)
Ten format/log calls passed arguments that the format string never referenced,
so the values were silently dropped from the message. Add the missing
placeholders so the arguments actually appear:
- SLF4JErrorReporter.warning/error: the format string was empty ("") while
five values (message, sourceName, line, lineSource, lineOffset) were passed,
so nothing about the script error was logged. Use a message with five {}
placeholders.
- Util.rangeCheck (int/long/float): the "Value must be between %d and %d,
inclusive: " message ended after the colon and dropped the offending value.
Append the matching specifier so the value is shown.
- FieldStorageSchemeImpl.fieldMatches: three logger.error calls had no {}
placeholder, dropping the stored field (and, on the two-arg calls, keeping
the exception as the trailing throwable). Add a {} for the stored field.
- OpenAMSessionModule.onValidateSuccess/onUserResponse: two LOG.error calls
dropped the non-2xx response body. Add a {} so the body is logged.
Behaviour is otherwise unchanged; only the previously discarded values now
reach the message.
maximthomas
approved these changes
Jul 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves all ten open
java/unused-format-argumentCodeQL alerts. Every flaggedsite supplied arguments that the format string never referenced, so those values
were silently dropped from the log line / exception message. The fix adds the
missing placeholders so the arguments are actually rendered.
SLF4JErrorReporter.javalogger.warn("", {5 args})/logger.error("", {5 args}){}placeholdersUtil.java"Value must be between %d and %d, inclusive: "+value%d/%fspecifierFieldStorageSchemeImpl.javalogger.error("…", storedField[, e])with no{}: {}for the stored fieldOpenAMSessionModule.javaLOG.error("…non HTTP 200 response", body): {}for the response bodyWhy these are real
SLF4JErrorReporter— the format string was the empty string, so theJavaScript error's message, source, line, line-source and offset were never
logged. Now all five are rendered.
Util.rangeCheck— the "between" message ended right afterinclusive:and dropped the actual out-of-range value, unlike the sibling "less than" /
"greater than" messages which do print it. The value is now shown.
FieldStorageSchemeImpl— the threelogger.errorcalls had no{}, sothe stored field never appeared. On the two-argument calls the trailing
Throwableis still logged as the exception (SLF4J trailing-throwablehandling); only the stored-field placeholder was missing.
OpenAMSessionModule— the non-2xx REST validation response body waspassed but not referenced, so the diagnostic body was lost.
No behavioural change beyond the previously discarded values now reaching the
message.
Testing
mvn -o -pl script/javascript,persistit/core,commons/selfservice/core,commons/auth-filters/authn-filter/jaspi-modules/openam-session-module compile— each module builds (BUILD SUCCESS).