Java: Detecting annotations on called library 3rd party

[JLLeitschuh]

Can CodeQL introspect on third party library code to detect if a method being called has an annotation on it?

For example, Google Guava has the @Beta annotation. The Guava authors use the @Beta annotation internally on their APIs to indicate that the API may change. Can I write a query that will detect if the caller's code is calling a method annotated by @Beta?

I can see that there is information on checking for the @Deprecated annotation, but I'm wondering if this information is captured and pulled from those third party libraries to be used as a part of the query language.
https://help.semmle.com/QL/learn-ql/java/annotations.html#example-finding-calls-to-deprecated-methods

[aschackmull]

I would think that such annotations are extracted and put in the database, but I didn't know off-hand, so I wrote a query to find out:

import java

from Annotation ann, Method m
where ann.getTarget() = m and not m.fromSource()
select m.getDeclaringType().getQualifiedName(), m, ann, ann.getType().getQualifiedName()

Indeed, this query has results, so it should just work 🎉

[intrigus-lgtm]

Yes, this works.
See here for the exact case you asked for.

The only thing that will obviously not work is the case of source annotation, i.e., @Retention(RetentionPolicy.SOURCE) because they will be discarded by the compiler.