Add lombok-EqualsAndHashCode-calls-Object-super.ql

Author: Marcono1234

codeql-custom-queries-java/queries/likely-bugs/lombok-EqualsAndHashCode-calls-Object-super.ql

@@ -0,0 +1,42 @@
+/**
+ * Finds usages of Lombok's `@EqualsAndHashCode(callSuper = true)` where
+ * none of the superclasses override `equals` or `hashCode`. This means the
+ * methods generated by Lombok will call `Object.equals` or `Object.hashCode`,
+ * which is likely not desired since they check for object identity.
+ *
+ * Lombok can detect this issue itself and aborts compilation, but only when
+ * `Object` is the direct superclass (respectively when no superclass is specified).
+ * In other cases Lombok cannot detect this issue yet.
+ *
+ * @kind problem
+ */
+
+// TODO: This query might be redundant; the CodeQL Java extractor seems to process the
+// code generated by Lombok, so the errors detected by this query are also detected
+// by `equals-hashCode-calling-Object-super.ql`
+
+import java
+
+from RefType annotated, Annotation annotation, string notOverridden
+where
+  annotation = annotated.getAnAnnotation() and
+  annotation.getType().hasQualifiedName("lombok", "EqualsAndHashCode") and
+  annotation.getBooleanValue("callSuper") = true and
+  (
+    // No superclass overrides `equals`
+    notOverridden = "equals" and
+    not exists(Class superclass |
+      superclass = annotated.getASourceSupertype+() and
+      not superclass instanceof TypeObject and
+      superclass.getAMethod() instanceof EqualsMethod
+    )
+    or
+    // Or no superclass overrides `hashCode`
+    notOverridden = "hashCode" and
+    not exists(Class superclass |
+      superclass = annotated.getASourceSupertype+() and
+      not superclass instanceof TypeObject and
+      superclass.getAMethod() instanceof HashCodeMethod
+    )
+  )
+select annotation, "Specifies `callSuper=true` but superclasses don't override `" + notOverridden + "`"