Java: Add java/javautilconcurrentscheduledthreadpoolexecutor query for zero thread pool size

Author: tamasvajk

java/ql/src/Likely Bugs/Concurrency/ScheduledThreadPoolExecutorZeroThread.md

@@ -0,0 +1,28 @@
+# J-Q-002: Setting `java.util.concurrent.ScheduledThreadPoolExecutor` to have 0 threads serves no purpose
+
+Setting `java.util.concurrent.ScheduledThreadPoolExecutor` to have 0 threads serves no purpose and may indicate programmer error.
+
+## Overview
+
+According the Java documentation on `ScheduledThreadPoolExecutor`, it is not a good idea to set `corePoolSize` to zero, since doing so indicates the executor to keep 0 threads in its pool and the executor will serve no purpose.
+
+## Recommendation
+
+Set the `ScheduledThreadPoolExecutor` to have 1 or more threads in its thread pool and use the class's other methods to create a thread execution schedule.
+
+## Example
+
+```java
+public class Test {
+    void f() {
+        int i = 0;
+        ScheduledThreadPoolExecutor s = new ScheduledThreadPoolExecutor(1); // COMPLIANT
+        ScheduledThreadPoolExecutor s1 = new ScheduledThreadPoolExecutor(0); // NON_COMPLIANT
+        s.setCorePoolSize(0); // NON_COMPLIANT
+        s.setCorePoolSize(i); // NON_COMPLIANT
+    }
+}
+```
+
+## References
+- [ScheduledThreadPoolExecutor](https://docs.oracle.com/en/java/javase/20/docs/api/java.base/java/util/concurrent/ScheduledThreadPoolExecutor.html)

java/ql/src/Likely Bugs/Concurrency/ScheduledThreadPoolExecutorZeroThread.ql

@@ -0,0 +1,35 @@
+/**
+ * @id java/javautilconcurrentscheduledthreadpoolexecutor
+ * @name J-Q-002: Setting `java.util.concurrent.ScheduledThreadPoolExecutor` to have 0 threads serves no purpose
+ * @description Setting `java.util.concurrent.ScheduledThreadPoolExecutor` to have 0 threads serves
+ *              no purpose and may indicate programmer error.
+ * @kind problem
+ * @precision very-high
+ * @problem.severity recommendation
+ * @tags quality
+ *       reliability
+ *       correctness
+ *       concurrency
+ */
+
+import java
+import semmle.code.java.dataflow.DataFlow
+
+/**
+ * `Call`s that have the ability to set or modify the `corePoolSize` of the `java.util.concurrent.ScheduledThreadPoolExecutor` type
+ */
+class Sink extends Call {
+  Sink() {
+    this.getCallee()
+        .hasQualifiedName("java.util.concurrent", "ThreadPoolExecutor", "setCorePoolSize") or
+    this.getCallee()
+        .hasQualifiedName("java.util.concurrent", "ScheduledThreadPoolExecutor",
+          "ScheduledThreadPoolExecutor")
+  }
+}
+
+from IntegerLiteral zero, Sink set
+where
+  DataFlow::localFlow(DataFlow::exprNode(zero), DataFlow::exprNode(set.getArgument(0))) and
+  zero.getIntValue() = 0
+select set, "ScheduledThreadPoolExecutor.corePoolSize is set to have 0 threads."

java/ql/test/query-tests/ScheduledThreadPoolExecutorZeroThread/ScheduledThreadPoolExecutorZeroThread.expected

@@ -0,0 +1,3 @@
+| Test.java:7:42:7:75 | new ScheduledThreadPoolExecutor(...) | ScheduledThreadPoolExecutor.corePoolSize is set to have 0 threads. |
+| Test.java:8:9:8:28 | setCorePoolSize(...) | ScheduledThreadPoolExecutor.corePoolSize is set to have 0 threads. |
+| Test.java:9:9:9:28 | setCorePoolSize(...) | ScheduledThreadPoolExecutor.corePoolSize is set to have 0 threads. |

java/ql/test/query-tests/ScheduledThreadPoolExecutorZeroThread/ScheduledThreadPoolExecutorZeroThread.qlref

@@ -0,0 +1 @@
+Likely Bugs/Concurrency/ScheduledThreadPoolExecutorZeroThread.ql

java/ql/test/query-tests/ScheduledThreadPoolExecutorZeroThread/Test.java

@@ -0,0 +1,11 @@
+import java.util.concurrent.ScheduledThreadPoolExecutor;
+
+public class Test {
+    void f() {
+        int i = 0;
+        ScheduledThreadPoolExecutor s = new ScheduledThreadPoolExecutor(1); // COMPLIANT
+        ScheduledThreadPoolExecutor s1 = new ScheduledThreadPoolExecutor(0); // NON_COMPLIANT
+        s.setCorePoolSize(0); // NON_COMPLIANT
+        s.setCorePoolSize(i); // NON_COMPLIANT
+    }
+}