[BUG] Error and stacktrace: UnexpectedException: ApexValue(ApexSingleValue)

[efwalter]

Describe the bug

Graph Engine identified your source and sink, but you must manually verify that you have a sanitizer in this path. Then, add an engine directive to skip the path. Next, create a Github issue for the Code Analyzer team that includes the error and stack trace. After we fix this issue, check the Code Analyzer release notes for more info. Error and stacktrace: UnexpectedException: ApexValue(ApexSingleValue) {status=INDETERMINANT, declarationVertex=com.salesforce.graph.vertex.SyntheticTypedVertex@3efc6814, valueVertex=null, resolvedValues={}, returnedFrom=ApexValue(ApexListValue) {status=INITIALIZED, declarationVertex=VariableDeclaration{properties={FirstChild=false, BeginLine=56, Type=List<List>, DefiningType_CaseSafe=kwdata_packageidupgrade, LastChild=true, DefiningType=KWDATA_PackageIdUpgrade, EndLine=56, Name_CaseSafe=objectstoprocesslist, childIdx=1, BeginColumn=28, Name=objectsToProcessList}}, valueVertex=NewListInitExpression{properties={FirstChild=true, BeginLine=56, Type=List<List>, DefiningType_CaseSafe=kwdata_packageidupgrade, LastChild=false, DefiningType=KWDATA_PackageIdUpgrade, EndLine=56, childIdx=0, BeginColumn=51}}, resolvedValues={}, returnedFrom=null, invocableExpression=null, method=null}, invocableExpression=MethodCallExpressionVertex{fullMethodName=objectsToProcessList.remove, referenceVertex=LazyVertex{result=ReferenceExpression{properties={FirstChild=true, Names=[objectsToProcessList], BeginLine=206, DefiningType_CaseSafe=kwdata_authorizeapp, LastChild=false, DefiningType=KWDATA_AuthorizeApp, EndLine=206, Name_CaseSafe=objectstoprocesslist, childIdx=0, BeginColumn=49, ReferenceType=METHOD, Name=objectsToProcessList}}}, chainedNames=[objectsToProcessList], properties={FirstChild=true, FullMethodName=objectsToProcessList.remove, BeginLine=206, FullMethodName_CaseSafe=objectstoprocesslist.remove, DefiningType_CaseSafe=kwdata_authorizeapp, LastChild=false, DefiningType=KWDATA_AuthorizeApp, EndLine=206, MethodName_CaseSafe=remove, childIdx=0, BeginColumn=70, MethodName=remove}}, method=null}: com.salesforce.graph.symbols.PathScopeVisitor.getIndeterminantArrayLoadValue(PathScopeVisitor.java:874);com.salesforce.graph.symbols.PathScopeVisitor.afterVisit(PathScopeVisitor.java:790);com.salesforce.graph.symbols.DefaultSymbolProviderVertexVisitor.afterVisit(DefaultSymbolProviderVertexVisitor.java:686);com.salesforce.graph.vertex.ArrayLoadExpressionVertex.afterVisit(ArrayLoadExpressionVertex.java:58);com.salesforce.graph.ops.expander.ApexPathExpander.visit(ApexPathExpander.java:705);com.salesforce.graph.ops.expander.ApexPathExpander.visit(ApexPathExpander.java:544)

To Reproduce

Expected behavior

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

• Mac OS Ventura 13.1
• @salesforce/sfdx-scanner 3.10.0

Additional context

"Workaround":

"Urgency":

[rmohan20]

Hi @efwalter - thanks for reporting the issue.
Can you help us with more information to understand what's happening? Please feel free to create mocked-up data/object names to preserve anonymity.

1. What's in line 56 of KWDATA.PackageIdUpgrade? How is objectsToProcessList created and how's its value initialized?
2. In KWDATA.AuthorizeApp, could you confirm that objectsToProcessList.remove(...) is invoked? Is there any possibility that the list is empty when remove operation is invoked?

[git2gus]

This issue has been linked to a new work item: W-12947586

[efwalter]

Hi @rmohan20, sure:

1. List<List> objectsToProcessList = new List<List> ();
2. It is invoked and in theory it should not execute when is empty because we are verifying if is null and if has at least one element:

        KWDATA_PackageIdUpgrade kwIdBatchbatch = new KWDATA_PackageIdUpgrade();

        List<List<String>> objectsToProcessList = KWDATA_PackageIdUpgrade.getUpgradeList();

        if (objectsToProcessList != NULL && objectsToProcessList.size() > 0) {
            List<String> sObjecttoProcessTemp = objectsToProcessList.remove(objectsToProcessList.size() - 1);

[stephen-carter-at-sf]

Marking this as a duplicate of #1497

[jason-actico]

@rmohan20 @stephen-carter-at-sf

I'm facing this same issue and I need to submit for org for a security review this week. Should I go ahead and submit it or will this violation cause me to fail the security review?

[johnbelosf]

@jason-actico this is not a violation as such, but a limitation in Graph Engine. See #1497.

Please go ahead and submit for security review if this is the only pending issue. The security review team can, of course, still identify additional violations, but if you've done all you can at this point in time I'd recommend you to submit.