Add queries for Objects.deepEquals

Author: Marcono1234

codeql-custom-queries-java/queries/api-misuse/unnecessary-Objects-deepEquals-usage.ql

@@ -0,0 +1,38 @@
+/**
+ * Finds unnecessary usage of `Objects.deepEquals`. That method is mainly intended for
+ * `Object[]` or multi-dimensional arrays. For all other cases this method is not
+ * needed and there are other ways to check for equality, which also make the
+ * intention clearer:
+ * - If both arguments are primitive arrays, use one of the `Arrays.equals` methods,
+ *   such as `Arrays.equals(int[], int[])`
+ * - If both arguments are one-dimensional arrays with component type other than `Object`,
+ *   use `Arrays.equals(Object[], Object[])`
+ * - Otherwise use `Objects.equals(Object, Object)` if the arguments can be `null`,
+ *   or if not directly call `equals` on one of the arguments
+ * 
+ * @kind problem
+ */
+
+import java
+
+class DeepEqualsMethod extends Method {
+    DeepEqualsMethod() {
+        getDeclaringType().hasQualifiedName("java.util", "Objects")
+        and hasName("deepEquals")
+    }
+}
+
+from MethodAccess deepEqualsCall, Expr nonObjectArrayArg, Type argType
+where
+    deepEqualsCall.getMethod() instanceof DeepEqualsMethod
+    and nonObjectArrayArg = deepEqualsCall.getAnArgument()
+    and argType = nonObjectArrayArg.getType()
+    and not (
+        argType instanceof TypeObject
+        // Object[]
+        or argType.(Array).getComponentType() instanceof TypeObject
+        // Multi-dimensional array
+        or argType.(Array).getComponentType() instanceof Array
+    )
+select deepEqualsCall, "Unnecessary usage of `Objects.deepEquals` because $@ has neither type `Object` nor `Object[]`, nor is it a multi-dimensional array",
+    nonObjectArrayArg, "this argument"

codeql-custom-queries-java/queries/recommendations/Objects-deepEquals-instead-of-Arrays-deepEquals-for-Object-array.ql

@@ -0,0 +1,36 @@
+// Similar to unnecessary-Objects-deepEquals-usage.ql
+
+/**
+ * Finds usage of `Object.deepEquals` where `Arrays.deepEquals` could be used instead.
+ * Using `Arrays.deepEquals` makes the intention clearer and also provides slightly
+ * more type-safety because it requires that its arguments are actually arrays.
+ * 
+ * @kind problem
+ */
+
+import java
+
+class DeepEqualsMethod extends Method {
+    DeepEqualsMethod() {
+        getDeclaringType().hasQualifiedName("java.util", "Objects")
+        and hasName("deepEquals")
+    }
+}
+
+/**
+ * Type `Object[]`
+ */
+class ObjectArray extends Array {
+    ObjectArray() {
+        getComponentType() instanceof TypeObject
+    }
+}
+
+from MethodAccess deepEqualsCall
+where
+    deepEqualsCall.getMethod() instanceof DeepEqualsMethod
+    // Only cover the case where both arguments have type Object[]; other cases such as using String[]
+    // are covered by unnecessary-Objects-deepEquals-usage.ql
+    and deepEqualsCall.getArgument(0).getType() instanceof ObjectArray
+    and deepEqualsCall.getArgument(1).getType() instanceof ObjectArray
+select deepEqualsCall, "Could use `Arrays.deepEquals` instead"