github-advanced-security[bot] commented on code in PR #19818:
URL: https://github.com/apache/druid/pull/19818#discussion_r3684509310
##########
processing/src/main/java/org/apache/druid/segment/nested/NestedPathArrayElement.java:
##########
@@ -43,24 +43,24 @@
{
// handle lists or arrays because who knows what might end up here,
depending on how is created
if (input instanceof List) {
- List<?> currentList = (List<?>) input;
+ final List<?> currentList = (List<?>) input;
final int currentSize = currentList.size();
if (index < 0) {
- final int adjusted = currentSize + index;
- if (adjusted >= 0) {
- return currentList.get(adjusted);
+ final long adjusted = (long) currentSize + index;
+ if (adjusted >= 0 && adjusted < currentSize) {
+ return currentList.get((int) adjusted);
}
- } else if (currentList.size() > index) {
+ } else if (index < currentSize) {
return currentList.get(index);
}
} else if (input instanceof Object[]) {
- Object[] currentList = (Object[]) input;
+ final Object[] currentList = (Object[]) input;
if (index < 0) {
- final int adjusted = currentList.length + index;
- if (adjusted >= 0) {
- return currentList[adjusted];
+ final long adjusted = (long) currentList.length + index;
+ if (adjusted >= 0 && adjusted < currentList.length) {
Review Comment:
## CodeQL / Useless comparison test
Test is always true.
[Show more
details](https://github.com/apache/druid/security/code-scanning/11427)
##########
processing/src/main/java/org/apache/druid/segment/nested/NestedPathArrayElement.java:
##########
@@ -43,24 +43,24 @@
{
// handle lists or arrays because who knows what might end up here,
depending on how is created
if (input instanceof List) {
- List<?> currentList = (List<?>) input;
+ final List<?> currentList = (List<?>) input;
final int currentSize = currentList.size();
if (index < 0) {
- final int adjusted = currentSize + index;
- if (adjusted >= 0) {
- return currentList.get(adjusted);
+ final long adjusted = (long) currentSize + index;
+ if (adjusted >= 0 && adjusted < currentSize) {
Review Comment:
## CodeQL / Useless comparison test
Test is always true.
[Show more
details](https://github.com/apache/druid/security/code-scanning/11426)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
