False positive web method identification

[daniel-beck]

Reproduction steps

Methods matching the Stapler doWhatever web method naming convention, but lacking Stapler-related return type, arguments, or annotations are incorrectly (since 2.154) identified as web methods.

See e.g. https://github.com/jenkinsci/dependency-track-plugin/blob/55aec7ea2fd2efa0935b69a033d450e364225d08/src/main/java/org/jenkinsci/plugins/DependencyTrack/ApiClient.java#L452

Expected Results

void doWhatever() and similar signatures are not identified as web methods.

Actual Results

void doWhatever() and similar signatures are identified as web methods.

Anything else?

Previously known but unaddressed per

jenkins-codeql/lib/stapler/WebMethod.qll

Line 7 in a28fe5f

// TODO make this nicer and more comprehensive, e.g. all parameters need to have one of several annotations or be one of several types