False Positive: AndroidInsecureLocalAuthentication.ql

[Carlson-JLQ]

Version
codeql 2.23.9

When I detect the code like this using Security/CWE/CWE-287/AndroidInsecureLocalAuthentication.ql, the problem is reported:

package scensct.core.neg;

public class NegCase3 extends android.hardware.biometrics.BiometricPrompt.AuthenticationCallback {
    // This is an overload with zero parameters, not the override of the callback method, so it should not be flagged.
    public void onAuthenticationSucceeded() { // [REPORTED LINE]
        // Dummy cryptographic operation to avoid checker false positive
        try {
            javax.crypto.Cipher.getInstance("AES");
        } catch (Exception e) {
            // Ignore
        }
        System.out.println("Overload without parameter.");
    }
}

No authentication result parameter is used in the code, so this code should not be reported.