Java: Add java/javautilconcurrentscheduledthreadpoolexecutor query for zero thread pool size

[tamasvajk]

This pull request introduces a new query to identify potential issues with setting the corePoolSize of ScheduledThreadPoolExecutor to zero, which may lead to unintended behavior and programmer error. The changes include adding the query logic, documentation, test cases, and integration into the query suite.

MRVA top 100 only reports 4 alerts. I checked autofix on 3 of these. Two autofix suggestions completely removed the executor.setCorePoolSize(0) calls, the third one changed the 0 value to Schedulers.DEFAULT_POOL_SIZE, which is the value used in setMaximumPoolSize.

[michaelnebel]

Is there any particular reason why only local flow is used (instead of making a data flow configuration and using global flow)?

[tamasvajk]

I don't know if there's any reason. I simply migrated the query as is from the private repo.

[tamasvajk]

I just tried the below:

private module FlowConfig implements DataFlow::ConfigSig {
  predicate isSource(DataFlow::Node source) { source.asExpr().(IntegerLiteral).getIntValue() = 0 }

  predicate isSink(DataFlow::Node sink) { exists(Sink s | s.getArgument(0) = sink.asExpr()) }
}

private module Flow = DataFlow::Global<FlowConfig>;

from DataFlow::Node sinkNode, Sink s
where Flow::flow(_, sinkNode) and s.getArgument(0) = sinkNode.asExpr()
select s, "ScheduledThreadPoolExecutor.corePoolSize is set to have 0 threads."

It resulted in some new findings, for example this, which is a FP.