add comments for FPs

Author: am0o0

java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/Zip4jHandler.java

@@ -33,7 +33,7 @@ public static void zip4jZipInputStreamSafe(InputStream inputStream) throws IOExc
                 File extractedFile = new File(localFileHeader.getFileName());
                 try (OutputStream outputStream = new FileOutputStream(extractedFile)) {
                     int totallRead = 0;
-                    while ((readLen = zipInputStream.read(readBuffer)) != -1) { // $ hasTaintFlow="zipInputStream"
+                    while ((readLen = zipInputStream.read(readBuffer)) != -1) { // $ hasTaintFlow="zipInputStream"  "this test gives a FP"
                         totallRead += readLen;
                         if (totallRead > 1024 * 1024 * 4) {
                             System.out.println("potential Bomb");

java/ql/test/experimental/query-tests/security/CWE-522-DecompressionBombs/ZipHandler.java

@@ -38,7 +38,7 @@ public static void ZipInputStreamSafe(InputStream inputStream) throws IOExceptio
                 }
                 FileOutputStream fos = new FileOutputStream("/tmp/tmptmp");
                 BufferedOutputStream dest = new BufferedOutputStream(fos, BUFFER);
-                while (total + BUFFER <= TOOBIG && (count = zis.read(data, 0, BUFFER)) != -1) { // $ hasTaintFlow="zis"
+                while (total + BUFFER <= TOOBIG && (count = zis.read(data, 0, BUFFER)) != -1) { // $ hasTaintFlow="zis" "this test gives a FP"
                     dest.write(data, 0, count);
                     total += count;
                 }
@@ -78,7 +78,7 @@ public static void ZipInputStreamSafe2(InputStream inputStream) throws IOExcepti
                 }
                 FileOutputStream fos = new FileOutputStream(entry.getName());
                 BufferedOutputStream dest = new BufferedOutputStream(fos, BUFFER);
-                while ((count = zis.read(data, 0, BUFFER)) != -1) { // $ hasTaintFlow="zis"
+                while ((count = zis.read(data, 0, BUFFER)) != -1) { // $ hasTaintFlow="zis"  "this test gives a FP"
                     dest.write(data, 0, count);
                 }
                 dest.flush();
@@ -100,7 +100,7 @@ public static void ZipInputStreamUnsafe(InputStream inputStream) throws IOExcept
                 // Write the files to the disk
                 FileOutputStream fos = new FileOutputStream(entry.getName()); 
                 BufferedOutputStream dest = new BufferedOutputStream(fos, BUFFER);
-                while ((count = zis.read(data, 0, BUFFER)) != -1) { // $ hasTaintFlow="zis"
+                while ((count = zis.read(data, 0, BUFFER)) != -1) { // $ hasTaintFlow="zis" 
                     dest.write(data, 0, count);
                 }
                 dest.flush();