Skip to content

Potential fix for code scanning alert no. 18: Implicit narrowing conversion in compound assignment#1013

Draft
Avery-Dunn wants to merge 1 commit intodevfrom
alert-autofix-18
Draft

Potential fix for code scanning alert no. 18: Implicit narrowing conversion in compound assignment#1013
Avery-Dunn wants to merge 1 commit intodevfrom
alert-autofix-18

Conversation

@Avery-Dunn
Copy link
Contributor

Potential fix for https://github.com/AzureAD/microsoft-authentication-library-for-java/security/code-scanning/18

In general, the fix is to ensure that the left-hand side of the compound assignment is at least as wide as the right-hand side expression. Here, the expression interval[1] - interval[0] is of type long, so sum should also be a long to avoid implicit narrowing when doing sum += ....

The best targeted fix is:

  • Change the type of sum from int to long.
  • Ensure that subsequent uses of sum (specifically in the division sum/list.size()) perform long arithmetic and then rely on Java’s automatic widening when concatenating with the string; no further changes are necessary there because sum being long is acceptable and safe.

Concretely, in msal4j-persistence-extension/src/test/java/com/microsoft/aad/msal4jextensions/CacheLockTestBase.java, inside validateLockUsageIntervals:

  • Update line 111 from int sum = 0; to long sum = 0L;.
    No new imports, methods, or definitions are required.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

…ersion in compound assignment

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant