diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/test.cpp index 2e907347436..40845e355e0 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/test.cpp @@ -16,7 +16,7 @@ void test() if ((x <= 1000) && (y <= 1000)) { - char *buffer5 = (char *)malloc(x * y); // $ Alert // GOOD [FALSE POSITIVE] + char *buffer5 = (char *)malloc(x * y); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] } size_t size1 = x * y; // $ Source diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/test.cpp index a91e14e5193..ccba2d22ffc 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/test.cpp @@ -135,7 +135,7 @@ char testStrncmp2(char *arr) { if(strncmp(arr, "", 6) == 0) { arr += 6; // $ Alert } - return *arr; // $ Sink // GOOD [FALSE POSITIVE] + return *arr; // $ SPURIOUS: Sink // GOOD [FALSE POSITIVE] } void testStrncmp1() { @@ -144,7 +144,7 @@ void testStrncmp1() { } void countdownBuf1(int **p) { - *--(*p) = 1; // $ Sink // GOOD [FALSE POSITIVE] + *--(*p) = 1; // $ SPURIOUS: Sink // GOOD [FALSE POSITIVE] *--(*p) = 2; // GOOD *--(*p) = 3; // GOOD *--(*p) = 4; // GOOD @@ -258,7 +258,7 @@ void call_use(unsigned char* p, int n) { if(n == 3) { unsigned char x = p[0]; unsigned char y = p[1]; - unsigned char z = p[2]; // $ Alert // GOOD [FALSE POSITIVE]: `call_use(buffer2, 2)` won't reach this point. + unsigned char z = p[2]; // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE]: `call_use(buffer2, 2)` won't reach this point. use(x, y, z); } } @@ -296,7 +296,7 @@ int guardingCallee(int *arr, int size) { int sum; for (int i = 0; i < size; i++) { - sum += arr[i]; // $ Alert // GOOD [FALSE POSITIVE] - guarded by size + sum += arr[i]; // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] - guarded by size } return sum; } @@ -319,7 +319,7 @@ void correlatedCondition(int num) { end = temp + 56; } else if (num < 64) { - end = temp + 64; // $ Alert // GOOD [FALSE POSITVE] + end = temp + 64; // $ SPURIOUS: Alert // GOOD [FALSE POSITVE] } char *temp2 = temp + num; while(temp2 != end) { // $ Sink diff --git a/cpp/ql/test/query-tests/Best Practices/Likely Errors/CommaBeforeMisleadingIndentation/test.cpp b/cpp/ql/test/query-tests/Best Practices/Likely Errors/CommaBeforeMisleadingIndentation/test.cpp index 7d13d1f2274..eaf539c5c8f 100644 --- a/cpp/ql/test/query-tests/Best Practices/Likely Errors/CommaBeforeMisleadingIndentation/test.cpp +++ b/cpp/ql/test/query-tests/Best Practices/Likely Errors/CommaBeforeMisleadingIndentation/test.cpp @@ -163,7 +163,7 @@ int Foo::test(int (*baz)(int)) if (1) foo( i++ - ), j++; // $ Alert // GOOD? [FALSE POSITIVE] + ), j++; // $ SPURIOUS: Alert // GOOD? [FALSE POSITIVE] if (1) baz( i++ diff --git a/cpp/ql/test/query-tests/Best Practices/Likely Errors/OffsetUseBeforeRangeCheck/test.cpp b/cpp/ql/test/query-tests/Best Practices/Likely Errors/OffsetUseBeforeRangeCheck/test.cpp index b12fd51c5dc..cc0a5616819 100644 --- a/cpp/ql/test/query-tests/Best Practices/Likely Errors/OffsetUseBeforeRangeCheck/test.cpp +++ b/cpp/ql/test/query-tests/Best Practices/Likely Errors/OffsetUseBeforeRangeCheck/test.cpp @@ -36,7 +36,7 @@ void test(char *buffer, int bufferSize) // look for 'ab' for (i = 0; i < bufferSize; i++) { - if ((buffer[i] == 'a') && (i < bufferSize - 1) && (buffer[i + 1] == 'b')) // $ Alert // GOOD [FALSE POSITIVE] + if ((buffer[i] == 'a') && (i < bufferSize - 1) && (buffer[i + 1] == 'b')) // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] break; } diff --git a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticVariables/test.cpp b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticVariables/test.cpp index c8d9eb222f8..3b60a4722d4 100644 --- a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticVariables/test.cpp +++ b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticVariables/test.cpp @@ -9,7 +9,7 @@ static int staticVar6 = 6; // $ Alert // BAD (unused) static __attribute__((__unused__)) int staticVar7; // GOOD (unused but this is expected) const int constVar8 = 8; // $ Alert // BAD (const defaults to static) extern const int constVar9 = 9; // GOOD -static int staticVar10 = 10; // $ Alert // GOOD [FALSE POSITIVE] (referenced in a never instantiated template) +static int staticVar10 = 10; // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] (referenced in a never instantiated template) void f() { diff --git a/cpp/ql/test/query-tests/Critical/MemoryFreed/my_auto_ptr.cpp b/cpp/ql/test/query-tests/Critical/MemoryFreed/my_auto_ptr.cpp index 50a4f950e86..93f39b5be5b 100644 --- a/cpp/ql/test/query-tests/Critical/MemoryFreed/my_auto_ptr.cpp +++ b/cpp/ql/test/query-tests/Critical/MemoryFreed/my_auto_ptr.cpp @@ -52,9 +52,9 @@ template class AutoContainer2 { public: - AutoContainer2() : v(new T) // $ Alert[cpp/memory-never-freed] // GOOD [FALSE POSITIVE] + AutoContainer2() : v(new T) // $ SPURIOUS: Alert[cpp/memory-never-freed] // GOOD [FALSE POSITIVE] { - ns::my_auto_ptr ap(new T); // $ Alert[cpp/memory-never-freed] // GOOD [FALSE POSITIVE] + ns::my_auto_ptr ap(new T); // $ SPURIOUS: Alert[cpp/memory-never-freed] // GOOD [FALSE POSITIVE] } ns::my_auto_ptr v; @@ -68,7 +68,7 @@ public: AutoCloner(AutoCloner &from) : val(from.val) {}; ns::my_auto_ptr clone() { - return ns::my_auto_ptr(new AutoCloner(*this)); // $ Alert[cpp/memory-never-freed] // GOOD [FALSE POSITIVE] + return ns::my_auto_ptr(new AutoCloner(*this)); // $ SPURIOUS: Alert[cpp/memory-never-freed] // GOOD [FALSE POSITIVE] } private: diff --git a/cpp/ql/test/query-tests/Critical/MemoryFreed/test_free.cpp b/cpp/ql/test/query-tests/Critical/MemoryFreed/test_free.cpp index 8eec079f0ef..c16127e18a6 100644 --- a/cpp/ql/test/query-tests/Critical/MemoryFreed/test_free.cpp +++ b/cpp/ql/test/query-tests/Critical/MemoryFreed/test_free.cpp @@ -233,17 +233,17 @@ void test_loop3(char ** a, char ** b) { free(*a); // $ Source[cpp/use-after-free] a++; } - use(*a); // $ Alert[cpp/use-after-free] // GOOD [FALSE POSITIVE] + use(*a); // $ SPURIOUS: Alert[cpp/use-after-free] // GOOD [FALSE POSITIVE] for (;*b; b++) { free(*b); // $ Source[cpp/use-after-free] } - use(*b); // $ Alert[cpp/use-after-free] // GOOD [FALSE POSITIVE] + use(*b); // $ SPURIOUS: Alert[cpp/use-after-free] // GOOD [FALSE POSITIVE] } void test_deref(char **a) { free(*a); // $ Source[cpp/use-after-free] - use(*a); // $ Alert[cpp/use-after-free] // GOOD [FALSE POSITIVE] + use(*a); // $ SPURIOUS: Alert[cpp/use-after-free] // GOOD [FALSE POSITIVE] } // Refs diff --git a/cpp/ql/test/query-tests/Critical/MissingCheckScanf/test.cpp b/cpp/ql/test/query-tests/Critical/MissingCheckScanf/test.cpp index abbce0e932d..ba79df57fee 100644 --- a/cpp/ql/test/query-tests/Critical/MissingCheckScanf/test.cpp +++ b/cpp/ql/test/query-tests/Critical/MissingCheckScanf/test.cpp @@ -269,7 +269,7 @@ int main() set_by_ref(i); scanf("%d", &i); // $ Source[cpp/missing-check-scanf] - use(i); // $ Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE] + use(i); // $ SPURIOUS: Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE] } { @@ -277,7 +277,7 @@ int main() set_by_ptr(&i); scanf("%d", &i); // $ Source[cpp/missing-check-scanf] - use(i); // $ Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE] + use(i); // $ SPURIOUS: Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE] } { @@ -401,7 +401,7 @@ char *my_string_copy() { for (int i = 0; i < len; i += 2) { unsigned int u; sscanf(src + i, "%2x", &u); // $ Source[cpp/missing-check-scanf] - *ptr++ = (char) u; // $ Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE]? src+i+{0,1} are always valid %x digits, so this should be OK. + *ptr++ = (char) u; // $ SPURIOUS: Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE]? src+i+{0,1} are always valid %x digits, so this should be OK. } *ptr++ = 0; return DST_STRING; @@ -413,14 +413,14 @@ void scan_and_write() { if (scanf("%d", &i) < 1) { // $ Source[cpp/missing-check-scanf] i = 0; } - use(i); // $ Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE]: variable is overwritten with a default value when scanf fails + use(i); // $ SPURIOUS: Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE]: variable is overwritten with a default value when scanf fails } { int i; if (scanf("%d", &i) != 1) { // $ Source[cpp/missing-check-scanf] i = 0; } - use(i); // $ Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE]: variable is overwritten with a default value when scanf fails + use(i); // $ SPURIOUS: Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE]: variable is overwritten with a default value when scanf fails } } @@ -481,7 +481,7 @@ void multiple_checks() { if (res >= 0) { if (res != 0) { - use(i); // $ Alert[cpp/missing-check-scanf] // GOOD: checks return value [FALSE POSITIVE] + use(i); // $ SPURIOUS: Alert[cpp/missing-check-scanf] // GOOD: checks return value [FALSE POSITIVE] } } } @@ -492,7 +492,7 @@ void multiple_checks() { if (res < 0) return; if (res != 0) { - use(i); // $ Alert[cpp/missing-check-scanf] // GOOD: checks return value [FALSE POSITIVE] + use(i); // $ SPURIOUS: Alert[cpp/missing-check-scanf] // GOOD: checks return value [FALSE POSITIVE] } } diff --git a/cpp/ql/test/query-tests/JPL_C/LOC-4/Rule 29/NonConstFunctionPointer/test.c b/cpp/ql/test/query-tests/JPL_C/LOC-4/Rule 29/NonConstFunctionPointer/test.c index c87226eba3d..825ba11029a 100644 --- a/cpp/ql/test/query-tests/JPL_C/LOC-4/Rule 29/NonConstFunctionPointer/test.c +++ b/cpp/ql/test/query-tests/JPL_C/LOC-4/Rule 29/NonConstFunctionPointer/test.c @@ -17,5 +17,5 @@ void test() funPtr1(); // $ Alert // BAD funPtr2(); // $ Alert // BAD - funPtr3(); // $ Alert // GOOD [FALSE POSITIVE] + funPtr3(); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/PointlessComparison.c b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/PointlessComparison.c index b024284751f..188aa46d790 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/PointlessComparison.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/PointlessComparison.c @@ -261,7 +261,7 @@ int overeager_wraparound(unsigned int u32bound, unsigned long long u64bound) { int negative_zero(double dbl) { if (dbl >= 0) { - return dbl >= -dbl; // $ Alert[cpp/constant-comparison] // GOOD [FALSE POSITIVE] + return dbl >= -dbl; // $ SPURIOUS: Alert[cpp/constant-comparison] // GOOD [FALSE POSITIVE] } return 0; } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/test.c b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/test.c index 3fa9e7f3377..f054f382c5f 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/test.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/test.c @@ -29,7 +29,7 @@ void test(int i, const char *str) printf("%2$*1$d", width); // $ Alert[cpp/wrong-number-format-arguments] // BAD (too few format arguments) printf("%1$*2$d", 0, num, width); // $ Alert[cpp/too-many-format-arguments] // BAD (too many format arguments) [INCORRECT MESSAGE] - printf("%1$*2$d", num, width); // $ Alert[cpp/too-many-format-arguments] // GOOD [FALSE POSITIVE] + printf("%1$*2$d", num, width); // $ SPURIOUS: Alert[cpp/too-many-format-arguments] // GOOD [FALSE POSITIVE] printf("%1$*2$d", width); // BAD (too few format arguments) [NOT DETECTED] } { @@ -37,7 +37,7 @@ void test(int i, const char *str) float num; printf("%2$.*4$f", 0, 0, num, 0, precision); // $ Alert[cpp/too-many-format-arguments] // BAD (too many format arguments) [INCORRECT MESSAGE] - printf("%2$.*4$f", 0, num, 0, precision); // $ Alert[cpp/too-many-format-arguments] // GOOD [FALSE POSITIVE] + printf("%2$.*4$f", 0, num, 0, precision); // $ SPURIOUS: Alert[cpp/too-many-format-arguments] // GOOD [FALSE POSITIVE] printf("%2$.*4$f", num, 0, precision); // $ Alert[cpp/too-many-format-arguments] // BAD (too few format arguments) [INCORRECT MESSAGE] } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Leap Year/Adding365DaysPerYear/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Leap Year/Adding365DaysPerYear/test.cpp index 0b22366e976..4d6e39f0fbc 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Leap Year/Adding365DaysPerYear/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Leap Year/Adding365DaysPerYear/test.cpp @@ -214,8 +214,8 @@ void checkedExample() qwLongTime += 365 * 24 * 60 * 60 * 10000000LLU; // copy back to a FILETIME - ft.dwLowDateTime = (DWORD)(qwLongTime & 0xFFFFFFFF); // $ Alert // GOOD [FALSE POSITIVE] - ft.dwHighDateTime = (DWORD)(qwLongTime >> 32); // $ Alert // GOOD [FALSE POSITIVE] + ft.dwLowDateTime = (DWORD)(qwLongTime & 0xFFFFFFFF); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] + ft.dwHighDateTime = (DWORD)(qwLongTime >> 32); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] // convert back to SYSTEMTIME for display or other usage if (FileTimeToSystemTime(&ft, &st) == 0) diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/BoundedLoop.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/BoundedLoop.cpp index d9cf7433892..b14dbbbb8de 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/BoundedLoop.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/BoundedLoop.cpp @@ -102,7 +102,7 @@ void incBefore() { int i = -1; i++; // not understood by data flow for (; i < 2; i++) { - alloca(100); // $ Alert // GOOD [FALSE POSITIVE] + alloca(100); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] } } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToMemset/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToMemset/test.cpp index fcc6fd98c05..92be81a5f03 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToMemset/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToMemset/test.cpp @@ -126,7 +126,7 @@ void myFunc(myStruct paramArray[80], myStruct &refStruct) memset(&localArray, 0, sizeof(localArray)); // GOOD memset(paramArray, 0, sizeof(myStruct) * 80); // GOOD - memset(paramArray, 0, sizeof(paramArray)); // $ Alert // GOOD [FALSE POSITIVE] + memset(paramArray, 0, sizeof(paramArray)); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] memset(¶mArray, 0, sizeof(myStruct) * 80); // $ Alert // BAD memset(¶mArray, 0, sizeof(paramArray)); // BAD [NOT DETECTED] diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/test.c b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/test.c index 03286e33f1b..b76482179ca 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/test.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/test.c @@ -88,7 +88,7 @@ void strncat_test6() { char dest[60]; dest[0] = '\0'; // Will write `dest[0 .. 5]` - strncat(dest, "small", sizeof(dest)); // $ Alert // GOOD [FALSE POSITIVE] + strncat(dest, "small", sizeof(dest)); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] } { @@ -96,6 +96,6 @@ void strncat_test6() { memset(dest, 'a', sizeof(dest)); dest[54] = '\0'; // Will write `dest[54 .. 59]` - strncat(dest, "small", sizeof(dest)); // $ Alert // GOOD [FALSE POSITIVE] + strncat(dest, "small", sizeof(dest)); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] } } diff --git a/cpp/ql/test/query-tests/Likely Bugs/ReturnConstType/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/ReturnConstType/test.cpp index f52accf2126..ca892be25ef 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/ReturnConstType/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/ReturnConstType/test.cpp @@ -43,10 +43,10 @@ template class myWrapper { myWrapper testTemplateClass{t: 'a'}; #define MYCHAR const char -MYCHAR getAMYCHAR(); // $ Alert // FALSE POSITIVE +MYCHAR getAMYCHAR(); // $ SPURIOUS: Alert // FALSE POSITIVE #define ID(T) T id_ (T x) {return x;} -ID(const char); // $ Alert // FALSE POSITIVE +ID(const char); // $ SPURIOUS: Alert // FALSE POSITIVE const float pi = 3.14159626f; const float &getPiRef() { return pi; } // GOOD diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/test.cpp index 52272d4dae3..a39c2bd47cf 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/test.cpp @@ -263,7 +263,7 @@ void test7(unsigned n) { if(!p) { p = (char*)malloc(++n); } - memset(p, 0, n); // $ Alert[cpp/overrun-write] // GOOD [FALSE POSITIVE] + memset(p, 0, n); // $ SPURIOUS: Alert[cpp/overrun-write] // GOOD [FALSE POSITIVE] } void test8(unsigned size, unsigned src_pos) diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/tests.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/tests.cpp index 5df613f8000..c3a27a2ddd8 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/tests.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/tests.cpp @@ -303,7 +303,7 @@ namespace CWE122_Heap_Based_Buffer_Overflow__cpp_CWE193_wchar_t_ncpy_01 wchar_t source[10+1] = SRC_STRING; /* Copy length + 1 to include NUL terminator from source */ /* POTENTIAL FLAW: data may not have enough space to hold source */ - wcsncpy(data, source, wcslen(source) + 1); // $ Alert[cpp/bad-strncpy-size] // [FALSE POSITIVE RESULT] (debatable) + wcsncpy(data, source, wcslen(source) + 1); // $ SPURIOUS: Alert[cpp/bad-strncpy-size] // [FALSE POSITIVE RESULT] (debatable) printWLine(data); delete [] data; } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.cpp index 9f717ad670b..20326533dd8 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.cpp @@ -62,7 +62,7 @@ unsigned int test_remainder_subtract_unsigned() unsigned int x = rand(); // $ Source unsigned int y = x % 100; // y <= x - return x - y; // $ Alert // GOOD (as y <= x) [FALSE POSITIVE] + return x - y; // $ SPURIOUS: Alert // GOOD (as y <= x) [FALSE POSITIVE] } typedef unsigned long size_t; @@ -143,7 +143,7 @@ int test_conditional_assignment_3() y = x; } - return y * c; // $ Alert // GOOD (as y <= 100) [FALSE POSITIVE] + return y * c; // $ SPURIOUS: Alert // GOOD (as y <= 100) [FALSE POSITIVE] } int test_underflow() @@ -193,7 +193,7 @@ void test_if_const_bounded() if (x < 1000) { x = x * 2; // GOOD - x = x * c; // $ Alert // GOOD [FALSE POSITIVE] + x = x * c; // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] } else { x = x * 2; // $ Alert // BAD x = x * c; // $ Alert // BAD @@ -205,7 +205,7 @@ void test_if_const_bounded() y = y * c; // $ Alert // BAD } else { y = y * 2; // GOOD - y = y * c; // $ Alert // GOOD [FALSE POSITIVE] + y = y * c; // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] } } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-191/UnsignedDifferenceExpressionComparedZero/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-191/UnsignedDifferenceExpressionComparedZero/test.cpp index 234248610b0..d04a31b78ee 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-191/UnsignedDifferenceExpressionComparedZero/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-191/UnsignedDifferenceExpressionComparedZero/test.cpp @@ -59,7 +59,7 @@ void test(unsigned x, unsigned y, bool unknown) { if(unknown) { ++y; } } - if(x - y > 0) { } // $ Alert // GOOD [FALSE POSITIVE] + if(x - y > 0) { } // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] x = y; while(cond()) { @@ -72,7 +72,7 @@ void test(unsigned x, unsigned y, bool unknown) { if (n > x - y) { n = x - y; } if (n > 0) { y += n; // NOTE: `n` is at most `x - y` at this point. - if (x - y > 0) {} // $ Alert // GOOD [FALSE POSITIVE] + if (x - y > 0) {} // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] } } @@ -179,7 +179,7 @@ void test9() { b = 0; } - if (a - b > 0) { // $ Alert // GOOD (as a >= b) [FALSE POSITIVE] + if (a - b > 0) { // $ SPURIOUS: Alert // GOOD (as a >= b) [FALSE POSITIVE] // ... } } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-193/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-193/test.cpp index f26d6773822..6d9fef227ac 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-193/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-193/test.cpp @@ -193,23 +193,23 @@ void test11(unsigned size) { void test12(unsigned len, unsigned index) { char* p = (char *)malloc(len); char* end = p + len; // $ alloc=L194 - + if(p + index > end) { return; } - + p[index] = '\0'; // $ MISSING: deref=L195->L201 // BAD [NOT DETECTED] } void test13(unsigned len, unsigned index) { char* p = (char *)malloc(len); // $ Source[cpp/invalid-pointer-deref]=r7 char* end = p + len; // $ alloc=L205 - + char* q = p + index; if(q > end) { return; } - + *q = '\0'; // $ deref=L206->L213 Alert[cpp/invalid-pointer-deref]=r7 // BAD } @@ -764,12 +764,12 @@ void test38(unsigned size) { case '0': if (n != 1) error(""); - char x = alloc[pos + 1]; // $ alloc=L754 deref=L767 Alert[cpp/invalid-pointer-deref]=r22 Alert[cpp/invalid-pointer-deref]=r23 // GOOD [FALSE POSITIVE] + char x = alloc[pos + 1]; // $ SPURIOUS: alloc=L754 deref=L767 Alert[cpp/invalid-pointer-deref]=r22 Alert[cpp/invalid-pointer-deref]=r23 // GOOD [FALSE POSITIVE] break; case '1': if (n != 2) error(""); - char a = alloc[pos + 1]; // $ alloc=L754 deref=L772 Alert[cpp/invalid-pointer-deref]=r24 Alert[cpp/invalid-pointer-deref]=r25 // GOOD [FALSE POSITIVE] + char a = alloc[pos + 1]; // $ SPURIOUS: alloc=L754 deref=L772 Alert[cpp/invalid-pointer-deref]=r24 Alert[cpp/invalid-pointer-deref]=r25 // GOOD [FALSE POSITIVE] char b = alloc[pos + 2]; break; } @@ -783,7 +783,7 @@ void test38_simple(unsigned size, unsigned pos, unsigned numParams) { if (pos < size) { if (pos + numParams < size) { if (numParams == 1) { - char x = p[pos + 1]; // $ alloc=L781 deref=L786 Alert[cpp/invalid-pointer-deref]=r26 // GOOD [FALSE POSITIVE] + char x = p[pos + 1]; // $ SPURIOUS: alloc=L781 deref=L786 Alert[cpp/invalid-pointer-deref]=r26 // GOOD [FALSE POSITIVE] } } } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp index 0f79301cded..4bc6fbe6773 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp @@ -417,7 +417,7 @@ void test_member_password() { packet p; - recv(val(), p.password, 256, val()); // $ Alert[cpp/cleartext-transmission] // GOOD: password is encrypted [FALSE POSITIVE] + recv(val(), p.password, 256, val()); // $ SPURIOUS: Alert[cpp/cleartext-transmission] // GOOD: password is encrypted [FALSE POSITIVE] decrypt_inplace(p.password); // proof that `password` was in fact encrypted } } @@ -428,7 +428,7 @@ void test_stdin_param(FILE *stream) { char password[128]; - fgets(password, 128, stream); // $ Alert[cpp/cleartext-transmission] // GOOD: from standard input (see call below) [FALSE POSITIVE] + fgets(password, 128, stream); // $ SPURIOUS: Alert[cpp/cleartext-transmission] // GOOD: from standard input (see call below) [FALSE POSITIVE] } void test_stdin() diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-367/semmle/test2.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-367/semmle/test2.cpp index febab29186a..e8e0161e1e7 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-367/semmle/test2.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-367/semmle/test2.cpp @@ -206,7 +206,7 @@ void test2_11(const char *path, int arg) if (stat(path, &buf)) { - f = open(path, arg); // $ Alert // GOOD (here stat is just a redundant check that the file exists / path is valid, confirmed by the return value of open) [FALSE POSITIVE] + f = open(path, arg); // $ SPURIOUS: Alert // GOOD (here stat is just a redundant check that the file exists / path is valid, confirmed by the return value of open) [FALSE POSITIVE] if (f == -1) { // handle error diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/test.cpp index 1a671983761..ae217188c62 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/test.cpp @@ -854,7 +854,7 @@ struct PlusPlusReturnByValueIterator void test7() { PlusPlusReturnByValueIterator it; - it.operator++(); // $ Alert // GOOD [FALSE POSITIVE] + it.operator++(); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] it.begin(); } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree/test.cpp index fde729331ce..7dd80687e9c 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree/test.cpp @@ -194,7 +194,7 @@ void test13() { data = NULL; } - use(data); // $ Alert // GOOD [FALSE POSITIVE] + use(data); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] } void test14() @@ -245,12 +245,12 @@ void malloc_after_free(myStruct *s) { if (s->i1.data == 0) { return; } - use(s->i1.data); // $ Alert // GOOD [FALSE POSITIVE] + use(s->i1.data); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] free(s->i2->data); // $ Source s->i2->data = (char *)malloc(100*sizeof(char)); if (s->i2->data == 0) { return; } - use(s->i2->data); // $ Alert // GOOD [FALSE POSITIVE] + use(s->i2->data); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests.cpp index c6253a56bdf..13bbe6b4e0b 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests.cpp @@ -101,7 +101,7 @@ void test9(InputSource &data) { XercesDOMParser &q = *p; p->setDisableDefaultEntityResolution(true); - q.parse(data); // $ Alert // GOOD [FALSE POSITIVE] + q.parse(data); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] } } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests3.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests3.cpp index 9c3911dde7b..9a55e1e5ea4 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests3.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests3.cpp @@ -53,7 +53,7 @@ void test3_5_init() { void test3_5(InputSource &data) { test3_5_init(); - p_3_5->parse(data); // $ Alert // GOOD [FALSE POSITIVE] + p_3_5->parse(data); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] } void test3_6(InputSource &data) { diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/test.cpp index 4d0f833c4eb..6e5271066ff 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/test.cpp @@ -300,7 +300,7 @@ void interproc_test_09() { void test_10() { std::mutex mtx; - if (!mtx.try_lock()) { // $ Alert[cpp/unreleased-lock] // [FALSE POSITIVE] + if (!mtx.try_lock()) { // $ SPURIOUS: Alert[cpp/unreleased-lock] // [FALSE POSITIVE] } else { mtx.unlock(); } @@ -310,7 +310,7 @@ void test_10() void test_11() { std::mutex mtx; - if (!mtx.try_lock()) { // $ Alert[cpp/unreleased-lock] // [FALSE POSITIVE] + if (!mtx.try_lock()) { // $ SPURIOUS: Alert[cpp/unreleased-lock] // [FALSE POSITIVE] return; } @@ -439,7 +439,7 @@ struct data_t { bool test_mutex(data_t *data) { - CHECK(mutex_lock(&(data->mutex))); // $ Alert[cpp/unreleased-lock] // GOOD [FALSE POSITIVE] + CHECK(mutex_lock(&(data->mutex))); // $ SPURIOUS: Alert[cpp/unreleased-lock] // GOOD [FALSE POSITIVE] data->val = 1; CHECK(mutex_unlock(&(data->mutex))); diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp index 632deabecab..5d03c1fef85 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp @@ -156,7 +156,7 @@ void test13(bool b, Cat* c) { // because we don't find a flow path from `a = c` to `static_cast(a)` because // the "source" (i.e., `a = c`) doesn't have an allocation. if(b) { - Cat* d = static_cast(a); // $ Alert // GOOD [FALSE POSITIVE] + Cat* d = static_cast(a); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] } } diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 73/original.cpp b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 73/original.cpp index f5a6afd7e1d..c0d8399a575 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 73/original.cpp +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 73/original.cpp @@ -73,7 +73,7 @@ public: char getChar(); }; -AlsoGood::AlsoGood() // $ Alert // compliant [FALSE POSITIVE] +AlsoGood::AlsoGood() // $ SPURIOUS: Alert // compliant [FALSE POSITIVE] { cp = 0; } diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/ListDelete.cpp b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/ListDelete.cpp index 31686ad60e6..bca36a174b5 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/ListDelete.cpp +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/ListDelete.cpp @@ -18,7 +18,7 @@ class MyThingColection { public: MyThingColection() { - first = new MyThing; // $ Alert // GOOD (all deleted in destructor) [FALSE POSITIVE] + first = new MyThing; // $ SPURIOUS: Alert // GOOD (all deleted in destructor) [FALSE POSITIVE] first->next = new MyThing; // GOOD (all deleted in destructor) diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/Variants.cpp b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/Variants.cpp index 3b49556e37d..e44985e534e 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/Variants.cpp +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/Variants.cpp @@ -23,7 +23,7 @@ public: c = d = new int; // GOOD (d is deleted) e = local = new int; // BAD (e is not deleted) [NOT REPORTED] - f = new int; // $ Alert // GOOD (ID(f) is deleted) [FALSE POSITIVE] + f = new int; // $ SPURIOUS: Alert // GOOD (ID(f) is deleted) [FALSE POSITIVE] g = ID(new int); // GOOD (g is deleted) } diff --git a/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 114/test.cpp b/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 114/test.cpp index 6101e4ca103..bac7bf85df6 100644 --- a/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 114/test.cpp +++ b/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 114/test.cpp @@ -186,7 +186,7 @@ int g22() { } int g23() { - Aborting().a(); // $ Alert // GOOD [FALSE POSITIVE] + Aborting().a(); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] } [[__noreturn__]] diff --git a/cpp/ql/test/query-tests/jsf/4.28 Portable Code/AV Rule 210/AV Rule 210.c b/cpp/ql/test/query-tests/jsf/4.28 Portable Code/AV Rule 210/AV Rule 210.c index 516c8d25426..fba29f65343 100644 --- a/cpp/ql/test/query-tests/jsf/4.28 Portable Code/AV Rule 210/AV Rule 210.c +++ b/cpp/ql/test/query-tests/jsf/4.28 Portable Code/AV Rule 210/AV Rule 210.c @@ -26,7 +26,7 @@ void test1(int *myIntPtr) return 0; } -union myUnion4 { // $ Alert // GOOD? [FALSE POSITIVE] +union myUnion4 { // $ SPURIOUS: Alert // GOOD? [FALSE POSITIVE] char myChar; int myInt; };