[BUG] TodoException: NewObjectExpression

[efwalter]

Describe the bug
Graph Engine identified your source and sink, but you must manually verify that you have a sanitizer in this path. Then, add an engine directive to skip the path. Next, create a Github issue for the Code Analyzer team that includes the error and stack trace. After we fix this issue, check the Code Analyzer release notes for more info. Error and stacktrace: TodoException: NewObjectExpression{properties={FirstChild=false, BeginLine=245, Type=KWLEG_Bills_Search.ElasticSearch, DefiningType_CaseSafe=kwleg_lwcmethods, LastChild=true, DefiningType=KWLEG_LWCMethods, EndLine=245, childIdx=1, BeginColumn=65}}: com.salesforce.graph.symbols.PathScopeVisitor.updateInvocableWithParametersVertex(PathScopeVisitor.java:1365);com.salesforce.graph.symbols.PathScopeVisitor.afterVisit(PathScopeVisitor.java:1326);com.salesforce.graph.symbols.InnerScope.afterVisit(InnerScope.java:62);com.salesforce.graph.symbols.DefaultSymbolProviderVertexVisitor.afterVisit(DefaultSymbolProviderVertexVisitor.java:784);com.salesforce.graph.vertex.NewObjectExpressionVertex.afterVisit(NewObjectExpressionVertex.java:52);com.salesforce.graph.ops.expander.ApexPathExpander.visit(ApexPathExpander.java:705)

Screenshots

Desktop (please complete the following information):

• Mac OS Ventura 13.1
• @salesforce/sfdx-scanner 3.10.0

Additional context
The line which is throwing the error is just a wrapper object

"Workaround":

"Urgency":

[rmohan20]

@efwalter Thanks for logging the bug and notifying us.
Can you please help us with more information:

1. Is the right-hand-side (kwbill.kwi.KnowWho.RequestOptions.Elastic) a type, or is it a static variable declared in another place?
2. Is the left-hand-side an inner class? What object is it a wrapper for?
3. Do these declarations live within the projectdir or are these references to dependencies in another namespace that's not available here?

If you could provide us with a mockup of how these classes/objects are set up and which ones are sObjects, our investigation can be sped up some more. Thank you!

[efwalter]

1. Is the right-hand-side (kwbill.kwi.KnowWho.RequestOptions.Elastic) a type, or is it a static variable declared in another place?
   Everything there is a DTO.

2. Is the left-hand-side an inner class? What object is it a wrapper for?
   dto

3. Do these declarations live within the projectdir or are these references to dependencies in another namespace that's not available here?
   yes, these do live within the same projecdir, same namespace.

[efwalter]

Any news? I'm facing a really similar problem in another project:

Describe the bug:

Graph Engine identified your source and sink, but you must manually verify that you have a sanitizer in this path. Then, add an engine directive to skip the path. Next, create a Github issue for the Code Analyzer team that includes the error and stack trace. After we fix this issue, check the Code Analyzer release notes for more info. Error and stacktrace: TodoException: NewObjectExpression{properties={FirstChild=false, BeginLine=97, Type=KWD_ZDM_Output.Customer, DefiningType_CaseSafe=kwd_authorizeapp, LastChild=true, DefiningType=KWD_AuthorizeApp, EndLine=97, childIdx=1, BeginColumn=29}}: com.salesforce.graph.symbols.PathScopeVisitor.updateInvocableWithParametersVertex(PathScopeVisitor.java:1365);com.salesforce.graph.symbols.PathScopeVisitor.afterVisit(PathScopeVisitor.java:1326);com.salesforce.graph.symbols.InnerScope.afterVisit(InnerScope.java:62);com.salesforce.graph.symbols.DefaultSymbolProviderVertexVisitor.afterVisit(DefaultSymbolProviderVertexVisitor.java:784);com.salesforce.graph.vertex.NewObjectExpressionVertex.afterVisit(NewObjectExpressionVertex.java:52);com.salesforce.graph.ops.expander.ApexPathExpander.performAfterVisit(ApexPathExpander.java:577)

The line 97 in the KWD_AuthorizeApp:

    kwJson.KnowWho.Customer = new KWD_ZDM_Output.Customer();

Both classes are DTOs

[jfeingold35]

@efwalter , sorry, no updates at this time. I understand your frustration, but unfortunately the team's bandwidth is currently extremely limited, and we're having to make some difficult choices about where to invest our time. We'll do our best to provide you an update in a timely manner, but we just can't make any promises right now.

[stephen-carter-at-sf]

Marking this as a duplicate of #1497