From 109e3660f8d6912e3d98e8c729f77310b17ac8ba Mon Sep 17 00:00:00 2001
From: Owen Mansel-Chan <owen-mc@github.com>
Date: Mon, 1 Nov 2021 12:53:09 +0000
Subject: [PATCH] Split Incorrect Integer Conversion into query and lib files

This is in preparation for changing the tests to use inline
expectations
---
 .../IncorrectIntegerConversionLib.qll}        | 26 -----------------
 ... => IncorrectIntegerConversionQuery.qhelp} |  0
 .../IncorrectIntegerConversionQuery.ql        | 28 +++++++++++++++++++
 .../CWE-681/IncorrectIntegerConversion.qlref  |  2 +-
 4 files changed, 29 insertions(+), 27 deletions(-)
 rename ql/{src/Security/CWE-681/IncorrectIntegerConversion.ql => lib/semmle/go/security/IncorrectIntegerConversionLib.qll} (85%)
 rename ql/src/Security/CWE-681/{IncorrectIntegerConversion.qhelp => IncorrectIntegerConversionQuery.qhelp} (100%)
 create mode 100644 ql/src/Security/CWE-681/IncorrectIntegerConversionQuery.ql

diff --git a/ql/src/Security/CWE-681/IncorrectIntegerConversion.ql b/ql/lib/semmle/go/security/IncorrectIntegerConversionLib.qll
similarity index 85%
rename from ql/src/Security/CWE-681/IncorrectIntegerConversion.ql
rename to ql/lib/semmle/go/security/IncorrectIntegerConversionLib.qll
index 0959c2e1105..62760a0287f 100644
--- a/ql/src/Security/CWE-681/IncorrectIntegerConversion.ql
+++ b/ql/lib/semmle/go/security/IncorrectIntegerConversionLib.qll
@@ -1,20 +1,4 @@
-/**
- * @name Incorrect conversion between integer types
- * @description Converting the result of `strconv.Atoi`, `strconv.ParseInt`,
- *              and `strconv.ParseUint` to integer types of smaller bit size
- *              can produce unexpected values.
- * @kind path-problem
- * @problem.severity warning
- * @security-severity 8.1
- * @id go/incorrect-integer-conversion
- * @tags security
- *       external/cwe/cwe-190
- *       external/cwe/cwe-681
- * @precision very-high
- */
-
 import go
-import DataFlow::PathGraph
 
 /**
  * Gets the maximum value of an integer (signed if `isSigned`
@@ -192,13 +176,3 @@ string describeBitSize(int bitSize, int intTypeBitSize) {
         "a number with architecture-dependent bit-width, which is constrained to be " +
           intTypeBitSize + "-bit by build constraints,"
 }
-
-from
-  DataFlow::PathNode source, DataFlow::PathNode sink, ConversionWithoutBoundsCheckConfig cfg,
-  DataFlow::CallNode call
-where cfg.hasFlowPath(source, sink) and call.getResult(0) = source.getNode()
-select sink.getNode(), source, sink,
-  "Incorrect conversion of " +
-    describeBitSize(cfg.getSourceBitSize(), getIntTypeBitSize(source.getNode().getFile())) +
-    " from $@ to a lower bit size type " + sink.getNode().getType().getUnderlyingType().getName() +
-    " without an upper bound check.", source, call.getTarget().getQualifiedName()
diff --git a/ql/src/Security/CWE-681/IncorrectIntegerConversion.qhelp b/ql/src/Security/CWE-681/IncorrectIntegerConversionQuery.qhelp
similarity index 100%
rename from ql/src/Security/CWE-681/IncorrectIntegerConversion.qhelp
rename to ql/src/Security/CWE-681/IncorrectIntegerConversionQuery.qhelp
diff --git a/ql/src/Security/CWE-681/IncorrectIntegerConversionQuery.ql b/ql/src/Security/CWE-681/IncorrectIntegerConversionQuery.ql
new file mode 100644
index 00000000000..c710d135a65
--- /dev/null
+++ b/ql/src/Security/CWE-681/IncorrectIntegerConversionQuery.ql
@@ -0,0 +1,28 @@
+/**
+ * @name Incorrect conversion between integer types
+ * @description Converting the result of `strconv.Atoi`, `strconv.ParseInt`,
+ *              and `strconv.ParseUint` to integer types of smaller bit size
+ *              can produce unexpected values.
+ * @kind path-problem
+ * @problem.severity warning
+ * @security-severity 8.1
+ * @id go/incorrect-integer-conversion
+ * @tags security
+ *       external/cwe/cwe-190
+ *       external/cwe/cwe-681
+ * @precision very-high
+ */
+
+import go
+import DataFlow::PathGraph
+import semmle.go.security.IncorrectIntegerConversionLib
+
+from
+  DataFlow::PathNode source, DataFlow::PathNode sink, ConversionWithoutBoundsCheckConfig cfg,
+  DataFlow::CallNode call
+where cfg.hasFlowPath(source, sink) and call.getResult(0) = source.getNode()
+select sink.getNode(), source, sink,
+  "Incorrect conversion of " +
+    describeBitSize(cfg.getSourceBitSize(), getIntTypeBitSize(source.getNode().getFile())) +
+    " from $@ to a lower bit size type " + sink.getNode().getType().getUnderlyingType().getName() +
+    " without an upper bound check.", source, call.getTarget().getQualifiedName()
diff --git a/ql/test/query-tests/Security/CWE-681/IncorrectIntegerConversion.qlref b/ql/test/query-tests/Security/CWE-681/IncorrectIntegerConversion.qlref
index 47d8c34c0ee..a19de39834d 100644
--- a/ql/test/query-tests/Security/CWE-681/IncorrectIntegerConversion.qlref
+++ b/ql/test/query-tests/Security/CWE-681/IncorrectIntegerConversion.qlref
@@ -1 +1 @@
-Security/CWE-681/IncorrectIntegerConversion.ql
+Security/CWE-681/IncorrectIntegerConversionQuery.ql