Skip to content

C++: Remove the BMN filter from some queries, but reduce precision to medium #20410

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
igfoo merged 3 commits into from
Sep 11, 2025
Merged

C++: Remove the BMN filter from some queries, but reduce precision to medium #20410

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b3f4c68
C++: Remove the BMN filter from some queries, but reduce precision to…
igfoo Sep 11, 2025
cc131a0
C++: Accept changes to cpp/ql/integration-tests/query-suite
igfoo Sep 11, 2025
050a9e1
C++: Add changenote for changes to some queries
igfoo Sep 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 0 additions & 4 deletions cpp/ql/integration-tests/query-suite/cpp-code-scanning.qls.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,12 +7,10 @@ ql/cpp/ql/src/Diagnostics/ExtractedFiles.ql
ql/cpp/ql/src/Diagnostics/ExtractionWarnings.ql
ql/cpp/ql/src/Diagnostics/FailedExtractorInvocations.ql
ql/cpp/ql/src/Likely Bugs/Arithmetic/BadAdditionOverflowCheck.ql
ql/cpp/ql/src/Likely Bugs/Arithmetic/IntMultToLong.ql
ql/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql
ql/cpp/ql/src/Likely Bugs/Conversion/CastArrayPointerArithmetic.ql
ql/cpp/ql/src/Likely Bugs/Format/SnprintfOverflow.ql
ql/cpp/ql/src/Likely Bugs/Format/WrongNumberOfFormatArguments.ql
ql/cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArguments.ql
ql/cpp/ql/src/Likely Bugs/Memory Management/AllocaInLoop.ql
ql/cpp/ql/src/Likely Bugs/Memory Management/PointerOverflow.ql
ql/cpp/ql/src/Likely Bugs/Memory Management/ReturnStackAllocatedMemory.ql
Expand All @@ -30,7 +28,6 @@ ql/cpp/ql/src/Security/CWE/CWE-120/VeryLikelyOverrunWrite.ql
ql/cpp/ql/src/Security/CWE/CWE-131/NoSpaceForZeroTerminator.ql
ql/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatString.ql
ql/cpp/ql/src/Security/CWE/CWE-190/ArithmeticUncontrolled.ql
ql/cpp/ql/src/Security/CWE/CWE-190/ComparisonWithWiderType.ql
ql/cpp/ql/src/Security/CWE/CWE-191/UnsignedDifferenceExpressionComparedZero.ql
ql/cpp/ql/src/Security/CWE/CWE-253/HResultBooleanConversion.ql
ql/cpp/ql/src/Security/CWE/CWE-311/CleartextFileWrite.ql
Expand All @@ -43,7 +40,6 @@ ql/cpp/ql/src/Security/CWE/CWE-367/TOCTOUFilesystemRace.ql
ql/cpp/ql/src/Security/CWE/CWE-416/IteratorToExpiredContainer.ql
ql/cpp/ql/src/Security/CWE/CWE-416/UseOfStringAfterLifetimeEnds.ql
ql/cpp/ql/src/Security/CWE/CWE-416/UseOfUniquePointerAfterLifetimeEnds.ql
ql/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql
ql/cpp/ql/src/Security/CWE/CWE-497/ExposedSystemData.ql
ql/cpp/ql/src/Security/CWE/CWE-611/XXE.ql
ql/cpp/ql/src/Security/CWE/CWE-676/DangerousFunctionOverflow.ql
Expand Down
3 changes: 1 addition & 2 deletions cpp/ql/src/Likely Bugs/Arithmetic/IntMultToLong.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
* @kind problem
* @problem.severity warning
* @security-severity 8.1
* @precision high
* @precision medium
* @id cpp/integer-multiplication-cast-to-long
* @tags reliability
* security
Expand Down Expand Up @@ -179,7 +179,6 @@ predicate overflows(MulExpr me, Type t) {

from MulExpr me, Type t1, Type t2
where
not any(Compilation c).buildModeNone() and
t1 = me.getType().getUnderlyingType() and
t2 = me.getConversion().getType().getUnderlyingType() and
t1.getSize() < t2.getSize() and
Expand Down
3 changes: 1 addition & 2 deletions cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArguments.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
* @kind problem
* @problem.severity error
* @security-severity 7.5
* @precision high
* @precision medium
* @id cpp/wrong-type-format-argument
* @tags reliability
* correctness
Expand Down Expand Up @@ -154,7 +154,6 @@ int sizeof_IntType() { exists(IntType it | result = it.getSize()) }

from FormattingFunctionCall ffc, int n, Expr arg, Type expected, Type actual
where
not any(Compilation c).buildModeNone() and
(
formattingFunctionCallExpectedType(ffc, n, expected) and
formattingFunctionCallActualType(ffc, n, arg, actual) and
Expand Down
3 changes: 1 addition & 2 deletions cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
* may lead to unpredictable behavior.
* @kind problem
* @problem.severity warning
* @precision high
* @precision medium
* @id cpp/implicit-function-declaration
* @tags correctness
* maintainability
Expand Down Expand Up @@ -38,7 +38,6 @@ predicate isCompiledAsC(File f) {

from FunctionDeclarationEntry fdeIm, FunctionCall fc
where
not any(Compilation c).buildModeNone() and
isCompiledAsC(fdeIm.getFile()) and
not isFromMacroDefinition(fc) and
fdeIm.isImplicit() and
Expand Down
3 changes: 1 addition & 2 deletions cpp/ql/src/Security/CWE/CWE-190/ComparisonWithWiderType.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
* @kind problem
* @problem.severity warning
* @security-severity 7.8
* @precision high
* @precision medium
* @tags reliability
* security
* external/cwe/cwe-190
Expand Down Expand Up @@ -51,7 +51,6 @@ int getComparisonSizeAdjustment(Expr e) {

from Loop l, RelationalOperation rel, VariableAccess small, Expr large
where
not any(Compilation c).buildModeNone() and
small = rel.getLesserOperand() and
large = rel.getGreaterOperand() and
rel = l.getCondition().getAChild*() and
Expand Down
3 changes: 1 addition & 2 deletions cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
* @kind problem
* @problem.severity warning
* @security-severity 8.8
* @precision high
* @precision medium
* @id cpp/suspicious-add-sizeof
* @tags security
* external/cwe/cwe-468
Expand All @@ -24,7 +24,6 @@ private predicate isCharSzPtrExpr(Expr e) {

from Expr sizeofExpr, Expr e
where
not any(Compilation c).buildModeNone() and
// If we see an addWithSizeof then we expect the type of
// the pointer expression to be `char*` or `void*`. Otherwise it
// is probably a mistake.
Expand Down
5 changes: 5 additions & 0 deletions cpp/ql/src/change-notes/2025-09-11-queries-demoted.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
category: majorAnalysis
---
* The queries `cpp/wrong-type-format-argument`, `cpp/comparison-with-wider-type`, `cpp/integer-multiplication-cast-to-long`, `cpp/implicit-function-declaration` and `cpp/suspicious-add-sizeof` have had their precisions reduced from `high` to `medium`. They will also now give alerts for projects built with `build-mode: none`.
* The queries `cpp/wrong-type-format-argument`, `cpp/comparison-with-wider-type`, `cpp/integer-multiplication-cast-to-long` and `cpp/suspicious-add-sizeof` are no longer included in the `code-scanning` suite.
Copy link

Copilot AI Sep 11, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The change note lists only 4 queries as being removed from the code-scanning suite, but the description mentions 5 queries total. The cpp/implicit-function-declaration query is missing from this list, though it appears this query was never in the code-scanning suite to begin with. Consider clarifying this discrepancy or adding a note that cpp/implicit-function-declaration was not previously included in the suite.

Suggested change
* The queries `cpp/wrong-type-format-argument`, `cpp/comparison-with-wider-type`, `cpp/integer-multiplication-cast-to-long` and `cpp/suspicious-add-sizeof` are no longer included in the `code-scanning` suite.
* The queries `cpp/wrong-type-format-argument`, `cpp/comparison-with-wider-type`, `cpp/integer-multiplication-cast-to-long` and `cpp/suspicious-add-sizeof` are no longer included in the `code-scanning` suite.
* Note: `cpp/implicit-function-declaration` was not previously included in the `code-scanning` suite.

Copilot uses AI. Check for mistakes.