From c1085a2bd3ea5fee5dc25facdc23c6c1ea619b89 Mon Sep 17 00:00:00 2001 From: Kamil Patryk Kozakowski Date: Mon, 13 Jul 2026 21:24:08 +0200 Subject: [PATCH] Fail closed when call-graph heuristic lacks class info Tighten CallGraphPathFinder heuristic matching to avoid cross-class linking when only method names are available and class ownership is unknown. Co-authored-by: Cursor --- .../analysis/service/CallGraphPathFinder.java | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/state_machine_exporter/src/main/java/click/kamil/springstatemachineexporter/analysis/service/CallGraphPathFinder.java b/state_machine_exporter/src/main/java/click/kamil/springstatemachineexporter/analysis/service/CallGraphPathFinder.java index 72cabc8..ba33933 100644 --- a/state_machine_exporter/src/main/java/click/kamil/springstatemachineexporter/analysis/service/CallGraphPathFinder.java +++ b/state_machine_exporter/src/main/java/click/kamil/springstatemachineexporter/analysis/service/CallGraphPathFinder.java @@ -388,8 +388,10 @@ public class CallGraphPathFinder { if (simpleClassNeighbor.equals("this") || simpleClassNeighbor.equals("super")) return true; return false; } - - return true; + + // If we have no class ownership information for either side, we can't prove a match beyond the + // method name. Fail closed to avoid accidental cross-class linking. + return false; } private boolean isFullyQualifiedMethod(String methodFqn) {