hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-07-09 05:25:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add SPURIOUS: tags

Browse Source
This commit is contained in:
Owen Mansel-Chan
2026-07-07 10:54:11 +01:00
parent a2c5d4c818
commit 843ac7c6b0
34 changed files with 68 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/test.cpp
View File

@@ -16,7 +16,7 @@ void test()
if ((x <= 1000) && (y <= 1000))
{
char *buffer5 = (char *)malloc(x * y); // $ Alert // GOOD [FALSE POSITIVE]
char *buffer5 = (char *)malloc(x * y); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE]
}
size_t size1 = x * y; // $ Source

10
cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/test.cpp
View File

@@ -135,7 +135,7 @@ char testStrncmp2(char *arr) {
if(strncmp(arr, "<test>", 6) == 0) {
arr += 6; // $ Alert
}
return *arr; // $ Sink // GOOD [FALSE POSITIVE]
return *arr; // $ SPURIOUS: Sink // GOOD [FALSE POSITIVE]
}
void testStrncmp1() {
@@ -144,7 +144,7 @@ void testStrncmp1() {
}
void countdownBuf1(int **p) {
*--(*p) = 1; // $ Sink // GOOD [FALSE POSITIVE]
*--(*p) = 1; // $ SPURIOUS: Sink // GOOD [FALSE POSITIVE]
*--(*p) = 2; // GOOD
*--(*p) = 3; // GOOD
*--(*p) = 4; // GOOD
@@ -258,7 +258,7 @@ void call_use(unsigned char* p, int n) {
if(n == 3) {
unsigned char x = p[0];
unsigned char y = p[1];
unsigned char z = p[2]; // $ Alert // GOOD [FALSE POSITIVE]: `call_use(buffer2, 2)` won't reach this point.
unsigned char z = p[2]; // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE]: `call_use(buffer2, 2)` won't reach this point.
use(x, y, z);
}
}
@@ -296,7 +296,7 @@ int guardingCallee(int *arr, int size) {
int sum;
for (int i = 0; i < size; i++) {
sum += arr[i]; // $ Alert // GOOD [FALSE POSITIVE] - guarded by size
sum += arr[i]; // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] - guarded by size
}
return sum;
}
@@ -319,7 +319,7 @@ void correlatedCondition(int num) {
end = temp + 56;
}
else if (num < 64) {
end = temp + 64; // $ Alert // GOOD [FALSE POSITVE]
end = temp + 64; // $ SPURIOUS: Alert // GOOD [FALSE POSITVE]
}
char *temp2 = temp + num;
while(temp2 != end) { // $ Sink

2
cpp/ql/test/query-tests/Best Practices/Likely Errors/CommaBeforeMisleadingIndentation/test.cpp
View File

@@ -163,7 +163,7 @@ int Foo::test(int (*baz)(int))
if (1) foo(
i++
), j++; // $ Alert // GOOD? [FALSE POSITIVE]
), j++; // $ SPURIOUS: Alert // GOOD? [FALSE POSITIVE]
if (1) baz(
i++

2
cpp/ql/test/query-tests/Best Practices/Likely Errors/OffsetUseBeforeRangeCheck/test.cpp
View File

@@ -36,7 +36,7 @@ void test(char *buffer, int bufferSize)
// look for 'ab'
for (i = 0; i < bufferSize; i++) {
if ((buffer[i] == 'a') && (i < bufferSize - 1) && (buffer[i + 1] == 'b')) // $ Alert // GOOD [FALSE POSITIVE]
if ((buffer[i] == 'a') && (i < bufferSize - 1) && (buffer[i + 1] == 'b')) // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE]
break;
}

2
cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticVariables/test.cpp
View File

@@ -9,7 +9,7 @@ static int staticVar6 = 6; // $ Alert // BAD (unused)
static __attribute__((__unused__)) int staticVar7; // GOOD (unused but this is expected)
const int constVar8 = 8; // $ Alert // BAD (const defaults to static)
extern const int constVar9 = 9; // GOOD
static int staticVar10 = 10; // $ Alert // GOOD [FALSE POSITIVE] (referenced in a never instantiated template)
static int staticVar10 = 10; // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] (referenced in a never instantiated template)
void f()
{

6
cpp/ql/test/query-tests/Critical/MemoryFreed/my_auto_ptr.cpp
View File

@@ -52,9 +52,9 @@ template<class T>
class AutoContainer2
{
public:
AutoContainer2() : v(new T) // $ Alert[cpp/memory-never-freed] // GOOD [FALSE POSITIVE]
AutoContainer2() : v(new T) // $ SPURIOUS: Alert[cpp/memory-never-freed] // GOOD [FALSE POSITIVE]
{
ns::my_auto_ptr<T> ap(new T); // $ Alert[cpp/memory-never-freed] // GOOD [FALSE POSITIVE]
ns::my_auto_ptr<T> ap(new T); // $ SPURIOUS: Alert[cpp/memory-never-freed] // GOOD [FALSE POSITIVE]
}
ns::my_auto_ptr<T> v;
@@ -68,7 +68,7 @@ public:
AutoCloner(AutoCloner &from) : val(from.val) {};
ns::my_auto_ptr<AutoCloner> clone() {
return ns::my_auto_ptr<AutoCloner>(new AutoCloner(*this)); // $ Alert[cpp/memory-never-freed] // GOOD [FALSE POSITIVE]
return ns::my_auto_ptr<AutoCloner>(new AutoCloner(*this)); // $ SPURIOUS: Alert[cpp/memory-never-freed] // GOOD [FALSE POSITIVE]
}
private:

6
cpp/ql/test/query-tests/Critical/MemoryFreed/test_free.cpp
View File

@@ -233,17 +233,17 @@ void test_loop3(char ** a, char ** b) {
free(*a); // $ Source[cpp/use-after-free]
a++;
}
use(*a); // $ Alert[cpp/use-after-free] // GOOD [FALSE POSITIVE]
use(*a); // $ SPURIOUS: Alert[cpp/use-after-free] // GOOD [FALSE POSITIVE]
for (;*b; b++) {
free(*b); // $ Source[cpp/use-after-free]
}
use(*b); // $ Alert[cpp/use-after-free] // GOOD [FALSE POSITIVE]
use(*b); // $ SPURIOUS: Alert[cpp/use-after-free] // GOOD [FALSE POSITIVE]
}
void test_deref(char **a) {
free(*a); // $ Source[cpp/use-after-free]
use(*a); // $ Alert[cpp/use-after-free] // GOOD [FALSE POSITIVE]
use(*a); // $ SPURIOUS: Alert[cpp/use-after-free] // GOOD [FALSE POSITIVE]
}
// Refs

14
cpp/ql/test/query-tests/Critical/MissingCheckScanf/test.cpp
View File

@@ -269,7 +269,7 @@ int main()
set_by_ref(i);
scanf("%d", &i); // $ Source[cpp/missing-check-scanf]
use(i); // $ Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE]
use(i); // $ SPURIOUS: Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE]
}
{
@@ -277,7 +277,7 @@ int main()
set_by_ptr(&i);
scanf("%d", &i); // $ Source[cpp/missing-check-scanf]
use(i); // $ Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE]
use(i); // $ SPURIOUS: Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE]
}
{
@@ -401,7 +401,7 @@ char *my_string_copy() {
for (int i = 0; i < len; i += 2) {
unsigned int u;
sscanf(src + i, "%2x", &u); // $ Source[cpp/missing-check-scanf]
*ptr++ = (char) u; // $ Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE]? src+i+{0,1} are always valid %x digits, so this should be OK.
*ptr++ = (char) u; // $ SPURIOUS: Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE]? src+i+{0,1} are always valid %x digits, so this should be OK.
}
*ptr++ = 0;
return DST_STRING;
@@ -413,14 +413,14 @@ void scan_and_write() {
if (scanf("%d", &i) < 1) { // $ Source[cpp/missing-check-scanf]
i = 0;
}
use(i); // $ Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE]: variable is overwritten with a default value when scanf fails
use(i); // $ SPURIOUS: Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE]: variable is overwritten with a default value when scanf fails
}
{
int i;
if (scanf("%d", &i) != 1) { // $ Source[cpp/missing-check-scanf]
i = 0;
}
use(i); // $ Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE]: variable is overwritten with a default value when scanf fails
use(i); // $ SPURIOUS: Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE]: variable is overwritten with a default value when scanf fails
}
}
@@ -481,7 +481,7 @@ void multiple_checks() {
if (res >= 0) {
if (res != 0) {
use(i); // $ Alert[cpp/missing-check-scanf] // GOOD: checks return value [FALSE POSITIVE]
use(i); // $ SPURIOUS: Alert[cpp/missing-check-scanf] // GOOD: checks return value [FALSE POSITIVE]
}
}
}
@@ -492,7 +492,7 @@ void multiple_checks() {
if (res < 0) return;
if (res != 0) {
use(i); // $ Alert[cpp/missing-check-scanf] // GOOD: checks return value [FALSE POSITIVE]
use(i); // $ SPURIOUS: Alert[cpp/missing-check-scanf] // GOOD: checks return value [FALSE POSITIVE]
}
}

2
cpp/ql/test/query-tests/JPL_C/LOC-4/Rule 29/NonConstFunctionPointer/test.c
View File

@@ -17,5 +17,5 @@ void test()
funPtr1(); // $ Alert // BAD
funPtr2(); // $ Alert // BAD
funPtr3(); // $ Alert // GOOD [FALSE POSITIVE]
funPtr3(); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE]
}

2
cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/PointlessComparison.c
View File

@@ -261,7 +261,7 @@ int overeager_wraparound(unsigned int u32bound, unsigned long long u64bound) {
int negative_zero(double dbl) {
if (dbl >= 0) {
return dbl >= -dbl; // $ Alert[cpp/constant-comparison] // GOOD [FALSE POSITIVE]
return dbl >= -dbl; // $ SPURIOUS: Alert[cpp/constant-comparison] // GOOD [FALSE POSITIVE]
}
return 0;
}

4
cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/test.c
View File

@@ -29,7 +29,7 @@ void test(int i, const char *str)
printf("%2$*1$d", width); // $ Alert[cpp/wrong-number-format-arguments] // BAD (too few format arguments)
printf("%1$*2$d", 0, num, width); // $ Alert[cpp/too-many-format-arguments] // BAD (too many format arguments) [INCORRECT MESSAGE]
printf("%1$*2$d", num, width); // $ Alert[cpp/too-many-format-arguments] // GOOD [FALSE POSITIVE]
printf("%1$*2$d", num, width); // $ SPURIOUS: Alert[cpp/too-many-format-arguments] // GOOD [FALSE POSITIVE]
printf("%1$*2$d", width); // BAD (too few format arguments) [NOT DETECTED]
}
{
@@ -37,7 +37,7 @@ void test(int i, const char *str)
float num;
printf("%2$.*4$f", 0, 0, num, 0, precision); // $ Alert[cpp/too-many-format-arguments] // BAD (too many format arguments) [INCORRECT MESSAGE]
printf("%2$.*4$f", 0, num, 0, precision); // $ Alert[cpp/too-many-format-arguments] // GOOD [FALSE POSITIVE]
printf("%2$.*4$f", 0, num, 0, precision); // $ SPURIOUS: Alert[cpp/too-many-format-arguments] // GOOD [FALSE POSITIVE]
printf("%2$.*4$f", num, 0, precision); // $ Alert[cpp/too-many-format-arguments] // BAD (too few format arguments) [INCORRECT MESSAGE]
}

4
cpp/ql/test/query-tests/Likely Bugs/Leap Year/Adding365DaysPerYear/test.cpp
View File

@@ -214,8 +214,8 @@ void checkedExample()
qwLongTime += 365 * 24 * 60 * 60 * 10000000LLU;
// copy back to a FILETIME
ft.dwLowDateTime = (DWORD)(qwLongTime & 0xFFFFFFFF); // $ Alert // GOOD [FALSE POSITIVE]
ft.dwHighDateTime = (DWORD)(qwLongTime >> 32); // $ Alert // GOOD [FALSE POSITIVE]
ft.dwLowDateTime = (DWORD)(qwLongTime & 0xFFFFFFFF); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE]
ft.dwHighDateTime = (DWORD)(qwLongTime >> 32); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE]
// convert back to SYSTEMTIME for display or other usage
if (FileTimeToSystemTime(&ft, &st) == 0)

2
cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/BoundedLoop.cpp
View File

@@ -102,7 +102,7 @@ void incBefore() {
int i = -1;
i++; // not understood by data flow
for (; i < 2; i++) {
alloca(100); // $ Alert // GOOD [FALSE POSITIVE]
alloca(100); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE]
}
}

2
cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToMemset/test.cpp
View File

@@ -126,7 +126,7 @@ void myFunc(myStruct paramArray[80], myStruct &refStruct)
memset(&localArray, 0, sizeof(localArray)); // GOOD
memset(paramArray, 0, sizeof(myStruct) * 80); // GOOD
memset(paramArray, 0, sizeof(paramArray)); // $ Alert // GOOD [FALSE POSITIVE]
memset(paramArray, 0, sizeof(paramArray)); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE]
memset(&paramArray, 0, sizeof(myStruct) * 80); // $ Alert // BAD
memset(&paramArray, 0, sizeof(paramArray)); // BAD [NOT DETECTED]

4
cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/test.c
View File

@@ -88,7 +88,7 @@ void strncat_test6() {
char dest[60];
dest[0] = '\0';
// Will write `dest[0 .. 5]`
strncat(dest, "small", sizeof(dest)); // $ Alert // GOOD [FALSE POSITIVE]
strncat(dest, "small", sizeof(dest)); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE]
}
{
@@ -96,6 +96,6 @@ void strncat_test6() {
memset(dest, 'a', sizeof(dest));
dest[54] = '\0';
// Will write `dest[54 .. 59]`
strncat(dest, "small", sizeof(dest)); // $ Alert // GOOD [FALSE POSITIVE]
strncat(dest, "small", sizeof(dest)); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE]
}
}

4
cpp/ql/test/query-tests/Likely Bugs/ReturnConstType/test.cpp
View File

@@ -43,10 +43,10 @@ template<typename T> class myWrapper {
myWrapper<const char> testTemplateClass{t: 'a'};
#define MYCHAR const char
MYCHAR getAMYCHAR(); // $ Alert // FALSE POSITIVE
MYCHAR getAMYCHAR(); // $ SPURIOUS: Alert // FALSE POSITIVE
#define ID(T) T id_ (T x) {return x;}
ID(const char); // $ Alert // FALSE POSITIVE
ID(const char); // $ SPURIOUS: Alert // FALSE POSITIVE
const float pi = 3.14159626f;
const float &getPiRef() { return pi; } // GOOD

2
cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/test.cpp
View File

@@ -263,7 +263,7 @@ void test7(unsigned n) {
if(!p) {
p = (char*)malloc(++n);
}
memset(p, 0, n); // $ Alert[cpp/overrun-write] // GOOD [FALSE POSITIVE]
memset(p, 0, n); // $ SPURIOUS: Alert[cpp/overrun-write] // GOOD [FALSE POSITIVE]
}
void test8(unsigned size, unsigned src_pos)

2
cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/tests.cpp
View File

@@ -303,7 +303,7 @@ namespace CWE122_Heap_Based_Buffer_Overflow__cpp_CWE193_wchar_t_ncpy_01
wchar_t source[10+1] = SRC_STRING;
/* Copy length + 1 to include NUL terminator from source */
/* POTENTIAL FLAW: data may not have enough space to hold source */
wcsncpy(data, source, wcslen(source) + 1); // $ Alert[cpp/bad-strncpy-size] // [FALSE POSITIVE RESULT] (debatable)
wcsncpy(data, source, wcslen(source) + 1); // $ SPURIOUS: Alert[cpp/bad-strncpy-size] // [FALSE POSITIVE RESULT] (debatable)
printWLine(data);
delete [] data;
}

8
cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.cpp
View File

@@ -62,7 +62,7 @@ unsigned int test_remainder_subtract_unsigned()
unsigned int x = rand(); // $ Source
unsigned int y = x % 100; // y <= x
return x - y; // $ Alert // GOOD (as y <= x) [FALSE POSITIVE]
return x - y; // $ SPURIOUS: Alert // GOOD (as y <= x) [FALSE POSITIVE]
}
typedef unsigned long size_t;
@@ -143,7 +143,7 @@ int test_conditional_assignment_3()
y = x;
}
return y * c; // $ Alert // GOOD (as y <= 100) [FALSE POSITIVE]
return y * c; // $ SPURIOUS: Alert // GOOD (as y <= 100) [FALSE POSITIVE]
}
int test_underflow()
@@ -193,7 +193,7 @@ void test_if_const_bounded()
if (x < 1000)
{
x = x * 2; // GOOD
x = x * c; // $ Alert // GOOD [FALSE POSITIVE]
x = x * c; // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE]
} else {
x = x * 2; // $ Alert // BAD
x = x * c; // $ Alert // BAD
@@ -205,7 +205,7 @@ void test_if_const_bounded()
y = y * c; // $ Alert // BAD
} else {
y = y * 2; // GOOD
y = y * c; // $ Alert // GOOD [FALSE POSITIVE]
y = y * c; // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE]
}
}

6
cpp/ql/test/query-tests/Security/CWE/CWE-191/UnsignedDifferenceExpressionComparedZero/test.cpp
View File

@@ -59,7 +59,7 @@ void test(unsigned x, unsigned y, bool unknown) {
if(unknown) { ++y; }
}
if(x - y > 0) { } // $ Alert // GOOD [FALSE POSITIVE]
if(x - y > 0) { } // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE]
x = y;
while(cond()) {
@@ -72,7 +72,7 @@ void test(unsigned x, unsigned y, bool unknown) {
if (n > x - y) { n = x - y; }
if (n > 0) {
y += n; // NOTE: `n` is at most `x - y` at this point.
if (x - y > 0) {} // $ Alert // GOOD [FALSE POSITIVE]
if (x - y > 0) {} // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE]
}
}
@@ -179,7 +179,7 @@ void test9() {
b = 0;
}
if (a - b > 0) { // $ Alert // GOOD (as a >= b) [FALSE POSITIVE]
if (a - b > 0) { // $ SPURIOUS: Alert // GOOD (as a >= b) [FALSE POSITIVE]
// ...
}
}

14
cpp/ql/test/query-tests/Security/CWE/CWE-193/test.cpp
View File

@@ -193,23 +193,23 @@ void test11(unsigned size) {
void test12(unsigned len, unsigned index) {
char* p = (char *)malloc(len);
char* end = p + len; // $ alloc=L194
if(p + index > end) {
return;
}
p[index] = '\0'; // $ MISSING: deref=L195->L201 // BAD [NOT DETECTED]
}
void test13(unsigned len, unsigned index) {
char* p = (char *)malloc(len); // $ Source[cpp/invalid-pointer-deref]=r7
char* end = p + len; // $ alloc=L205
char* q = p + index;
if(q > end) {
return;
}
*q = '\0'; // $ deref=L206->L213 Alert[cpp/invalid-pointer-deref]=r7 // BAD
}
@@ -764,12 +764,12 @@ void test38(unsigned size) {
case '0':
if (n != 1)
error("");
char x = alloc[pos + 1]; // $ alloc=L754 deref=L767 Alert[cpp/invalid-pointer-deref]=r22 Alert[cpp/invalid-pointer-deref]=r23 // GOOD [FALSE POSITIVE]
char x = alloc[pos + 1]; // $ SPURIOUS: alloc=L754 deref=L767 Alert[cpp/invalid-pointer-deref]=r22 Alert[cpp/invalid-pointer-deref]=r23 // GOOD [FALSE POSITIVE]
break;
case '1':
if (n != 2)
error("");
char a = alloc[pos + 1]; // $ alloc=L754 deref=L772 Alert[cpp/invalid-pointer-deref]=r24 Alert[cpp/invalid-pointer-deref]=r25 // GOOD [FALSE POSITIVE]
char a = alloc[pos + 1]; // $ SPURIOUS: alloc=L754 deref=L772 Alert[cpp/invalid-pointer-deref]=r24 Alert[cpp/invalid-pointer-deref]=r25 // GOOD [FALSE POSITIVE]
char b = alloc[pos + 2];
break;
}
@@ -783,7 +783,7 @@ void test38_simple(unsigned size, unsigned pos, unsigned numParams) {
if (pos < size) {
if (pos + numParams < size) {
if (numParams == 1) {
char x = p[pos + 1]; // $ alloc=L781 deref=L786 Alert[cpp/invalid-pointer-deref]=r26 // GOOD [FALSE POSITIVE]
char x = p[pos + 1]; // $ SPURIOUS: alloc=L781 deref=L786 Alert[cpp/invalid-pointer-deref]=r26 // GOOD [FALSE POSITIVE]
}
}
}

4
cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp
View File

@@ -417,7 +417,7 @@ void test_member_password()
{
packet p;
recv(val(), p.password, 256, val()); // $ Alert[cpp/cleartext-transmission] // GOOD: password is encrypted [FALSE POSITIVE]
recv(val(), p.password, 256, val()); // $ SPURIOUS: Alert[cpp/cleartext-transmission] // GOOD: password is encrypted [FALSE POSITIVE]
decrypt_inplace(p.password); // proof that `password` was in fact encrypted
}
}
@@ -428,7 +428,7 @@ void test_stdin_param(FILE *stream)
{
char password[128];
fgets(password, 128, stream); // $ Alert[cpp/cleartext-transmission] // GOOD: from standard input (see call below) [FALSE POSITIVE]
fgets(password, 128, stream); // $ SPURIOUS: Alert[cpp/cleartext-transmission] // GOOD: from standard input (see call below) [FALSE POSITIVE]
}
void test_stdin()

2
cpp/ql/test/query-tests/Security/CWE/CWE-367/semmle/test2.cpp
View File

@@ -206,7 +206,7 @@ void test2_11(const char *path, int arg)
if (stat(path, &buf))
{
f = open(path, arg); // $ Alert // GOOD (here stat is just a redundant check that the file exists / path is valid, confirmed by the return value of open) [FALSE POSITIVE]
f = open(path, arg); // $ SPURIOUS: Alert // GOOD (here stat is just a redundant check that the file exists / path is valid, confirmed by the return value of open) [FALSE POSITIVE]
if (f == -1)
{
// handle error

2
cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/test.cpp
View File

@@ -854,7 +854,7 @@ struct PlusPlusReturnByValueIterator
void test7()
{
PlusPlusReturnByValueIterator it;
it.operator++(); // $ Alert // GOOD [FALSE POSITIVE]
it.operator++(); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE]
it.begin();
}

6
cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree/test.cpp
View File

@@ -194,7 +194,7 @@ void test13()
{
data = NULL;
}
use(data); // $ Alert // GOOD [FALSE POSITIVE]
use(data); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE]
}
void test14()
@@ -245,12 +245,12 @@ void malloc_after_free(myStruct *s) {
if (s->i1.data == 0) {
return;
}
use(s->i1.data); // $ Alert // GOOD [FALSE POSITIVE]
use(s->i1.data); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE]
free(s->i2->data); // $ Source
s->i2->data = (char *)malloc(100*sizeof(char));
if (s->i2->data == 0) {
return;
}
use(s->i2->data); // $ Alert // GOOD [FALSE POSITIVE]
use(s->i2->data); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE]
}

2
cpp/ql/test/query-tests/Security/CWE/CWE-611/tests.cpp
View File

@@ -101,7 +101,7 @@ void test9(InputSource &data) {
XercesDOMParser &q = *p;
p->setDisableDefaultEntityResolution(true);
q.parse(data); // $ Alert // GOOD [FALSE POSITIVE]
q.parse(data); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE]
}
}

2
cpp/ql/test/query-tests/Security/CWE/CWE-611/tests3.cpp
View File

@@ -53,7 +53,7 @@ void test3_5_init() {
void test3_5(InputSource &data) {
test3_5_init();
p_3_5->parse(data); // $ Alert // GOOD [FALSE POSITIVE]
p_3_5->parse(data); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE]
}
void test3_6(InputSource &data) {

6
cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/test.cpp
View File

@@ -300,7 +300,7 @@ void interproc_test_09() {
void test_10()
{
std::mutex mtx;
if (!mtx.try_lock()) { // $ Alert[cpp/unreleased-lock] // [FALSE POSITIVE]
if (!mtx.try_lock()) { // $ SPURIOUS: Alert[cpp/unreleased-lock] // [FALSE POSITIVE]
} else {
mtx.unlock();
}
@@ -310,7 +310,7 @@ void test_10()
void test_11()
{
std::mutex mtx;
if (!mtx.try_lock()) { // $ Alert[cpp/unreleased-lock] // [FALSE POSITIVE]
if (!mtx.try_lock()) { // $ SPURIOUS: Alert[cpp/unreleased-lock] // [FALSE POSITIVE]
return;
}
@@ -439,7 +439,7 @@ struct data_t {
bool test_mutex(data_t *data)
{
CHECK(mutex_lock(&(data->mutex))); // $ Alert[cpp/unreleased-lock] // GOOD [FALSE POSITIVE]
CHECK(mutex_lock(&(data->mutex))); // $ SPURIOUS: Alert[cpp/unreleased-lock] // GOOD [FALSE POSITIVE]
data->val = 1;
CHECK(mutex_unlock(&(data->mutex)));

2
cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
View File

@@ -156,7 +156,7 @@ void test13(bool b, Cat* c) {
// because we don't find a flow path from `a = c` to `static_cast<Cat*>(a)` because
// the "source" (i.e., `a = c`) doesn't have an allocation.
if(b) {
Cat* d = static_cast<Cat*>(a); // $ Alert // GOOD [FALSE POSITIVE]
Cat* d = static_cast<Cat*>(a); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE]
}
}

2
cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 73/original.cpp
View File

@@ -73,7 +73,7 @@ public:
char getChar();
};
AlsoGood::AlsoGood() // $ Alert // compliant [FALSE POSITIVE]
AlsoGood::AlsoGood() // $ SPURIOUS: Alert // compliant [FALSE POSITIVE]
{
cp = 0;
}

2
cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/ListDelete.cpp
View File

@@ -18,7 +18,7 @@ class MyThingColection
{
public:
MyThingColection() {
first = new MyThing; // $ Alert // GOOD (all deleted in destructor) [FALSE POSITIVE]
first = new MyThing; // $ SPURIOUS: Alert // GOOD (all deleted in destructor) [FALSE POSITIVE]
first->next = new MyThing; // GOOD (all deleted in destructor)

2
cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/Variants.cpp
View File

@@ -23,7 +23,7 @@ public:
c = d = new int; // GOOD (d is deleted)
e = local = new int; // BAD (e is not deleted) [NOT REPORTED]
f = new int; // $ Alert // GOOD (ID(f) is deleted) [FALSE POSITIVE]
f = new int; // $ SPURIOUS: Alert // GOOD (ID(f) is deleted) [FALSE POSITIVE]
g = ID(new int); // GOOD (g is deleted)
}

2
cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 114/test.cpp
View File

@@ -186,7 +186,7 @@ int g22() {
}
int g23() {
Aborting().a(); // $ Alert // GOOD [FALSE POSITIVE]
Aborting().a(); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE]
}
[[__noreturn__]]

2
cpp/ql/test/query-tests/jsf/4.28 Portable Code/AV Rule 210/AV Rule 210.c
View File

@@ -26,7 +26,7 @@ void test1(int *myIntPtr)
return 0;
}
union myUnion4 { // $ Alert // GOOD? [FALSE POSITIVE]
union myUnion4 { // $ SPURIOUS: Alert // GOOD? [FALSE POSITIVE]
char myChar;
int myInt;
};