Merge pull request #15254 from github/post-release-prep/codeql-cli-2.16.0

Post-release preparation for codeql-cli-2.16.0

cpp/ql/lib/CHANGELOG.md

@@ -1,3 +1,24 @@
+## 0.12.3
+
+### Deprecated APIs
+
+* The `isUserInput`, `userInputArgument`, and `userInputReturned` predicates from `SecurityOptions` have been deprecated. Use `FlowSource` instead.
+
+### New Features
+
+* `UserDefineLiteral` and `DeductionGuide` classes have been added, representing C++11 user defined literals and C++17 deduction guides.
+
+### Minor Analysis Improvements
+
+* Changed the output of `Node.toString` to better reflect how many indirections a given dataflow node has.
+* Added a new predicate `Node.asDefinition` on `DataFlow::Node`s for selecting the dataflow node corresponding to a particular definition.
+* The deprecated `DefaultTaintTracking` library has been removed.
+* The `Guards` library has been replaced with the API-compatible `IRGuards` implementation, which has better precision in some cases.
+
+### Bug Fixes
+
+* Under certain circumstances a function declaration that is not also a definition could be associated with a `Function` that did not have the definition as a `FunctionDeclarationEntry`. This is now fixed when only one definition exists, and a unique `Function` will exist that has both the declaration and the definition as a `FunctionDeclarationEntry`.
+
 ## 0.12.2
 
 No user-facing changes.

cpp/ql/lib/change-notes/2022-11-21-ir-guards-replacement.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The `Guards` library has been replaced with the API-compatible `IRGuards` implementation, which has better precision in some cases.

cpp/ql/lib/change-notes/2023-11-25-default-taint-tracking-removal.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The deprecated `DefaultTaintTracking` library has been removed.

cpp/ql/lib/change-notes/2023-11-30-as-definition.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Added a new predicate `Node.asDefinition` on `DataFlow::Node`s for selecting the dataflow node corresponding to a particular definition.

cpp/ql/lib/change-notes/2023-12-08-ususerinput-deprecation.md

@@ -1,4 +0,0 @@
----
-category: deprecated
----
-* The `isUserInput`, `userInputArgument`, and `userInputReturned` predicates from `SecurityOptions` have been deprecated. Use `FlowSource` instead.

cpp/ql/lib/change-notes/2023-12-14-dataflow-tostring.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Changed the output of `Node.toString` to better reflect how many indirections a given dataflow node has.

cpp/ql/lib/change-notes/2023-12-22-unique-function.md

@@ -1,4 +0,0 @@
----
-category: fix
----
-* Under certain circumstances a function declaration that is not also a definition could be associated with a `Function` that did not have the definition as a `FunctionDeclarationEntry`. This is now fixed when only one definition exists, and a unique `Function` will exist that has both the declaration and the definition as a `FunctionDeclarationEntry`.

cpp/ql/lib/change-notes/2024-01-02-function-types.md

@@ -1,4 +0,0 @@
----
-category: feature
----
-* `UserDefineLiteral` and `DeductionGuide` classes have been added, representing C++11 user defined literals and C++17 deduction guides.

cpp/ql/lib/change-notes/released/0.12.3.md

@@ -0,0 +1,20 @@
+## 0.12.3
+
+### Deprecated APIs
+
+* The `isUserInput`, `userInputArgument`, and `userInputReturned` predicates from `SecurityOptions` have been deprecated. Use `FlowSource` instead.
+
+### New Features
+
+* `UserDefineLiteral` and `DeductionGuide` classes have been added, representing C++11 user defined literals and C++17 deduction guides.
+
+### Minor Analysis Improvements
+
+* Changed the output of `Node.toString` to better reflect how many indirections a given dataflow node has.
+* Added a new predicate `Node.asDefinition` on `DataFlow::Node`s for selecting the dataflow node corresponding to a particular definition.
+* The deprecated `DefaultTaintTracking` library has been removed.
+* The `Guards` library has been replaced with the API-compatible `IRGuards` implementation, which has better precision in some cases.
+
+### Bug Fixes
+
+* Under certain circumstances a function declaration that is not also a definition could be associated with a `Function` that did not have the definition as a `FunctionDeclarationEntry`. This is now fixed when only one definition exists, and a unique `Function` will exist that has both the declaration and the definition as a `FunctionDeclarationEntry`.

cpp/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.12.2
+lastReleaseVersion: 0.12.3

cpp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 0.12.3-dev
+version: 0.12.4-dev
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp

cpp/ql/lib/semmle/code/cpp/Element.qll

@@ -7,7 +7,6 @@ import semmle.code.cpp.Location
 private import semmle.code.cpp.Enclosing
 private import semmle.code.cpp.internal.ResolveClass
 private import semmle.code.cpp.internal.ResolveGlobalVariable
-private import semmle.code.cpp.internal.ResolveFunction
 
 /**
  * Get the `Element` that represents this `@element`.
@@ -31,14 +30,11 @@ pragma[inline]
 @element unresolveElement(Element e) {
   not result instanceof @usertype and
   not result instanceof @variable and
-  not result instanceof @function and
   result = e
   or
   e = resolveClass(result)
   or
   e = resolveGlobalVariable(result)
-  or
-  e = resolveFunction(result)
 }
 
 /**

cpp/ql/lib/semmle/code/cpp/Function.qll

@@ -9,7 +9,6 @@ import semmle.code.cpp.exprs.Call
 import semmle.code.cpp.metrics.MetricFunction
 import semmle.code.cpp.Linkage
 private import semmle.code.cpp.internal.ResolveClass
-private import semmle.code.cpp.internal.ResolveFunction
 
 /**
  * A C/C++ function [N4140 8.3.5]. Both member functions and non-member
@@ -26,8 +25,6 @@ private import semmle.code.cpp.internal.ResolveFunction
  * in more detail in `Declaration.qll`.
  */
 class Function extends Declaration, ControlFlowNode, AccessHolder, @function {
-  Function() { isFunction(underlyingElement(this)) }
-
   override string getName() { functions(underlyingElement(this), result, _) }
 
   /**

cpp/ql/lib/semmle/code/cpp/internal/ResolveFunction.qll

@@ -1,57 +0,0 @@
-private predicate hasDefinition(@function f) {
-  exists(@fun_decl fd | fun_decls(fd, f, _, _, _) | fun_def(fd))
-}
-
-private predicate onlyOneCompleteFunctionExistsWithMangledName(@mangledname name) {
-  strictcount(@function f | hasDefinition(f) and mangled_name(f, name)) = 1
-}
-
-/** Holds if `f` is a unique function with a definition named `name`. */
-private predicate isFunctionWithMangledNameAndWithDefinition(@mangledname name, @function f) {
-  hasDefinition(f) and
-  mangled_name(f, name) and
-  onlyOneCompleteFunctionExistsWithMangledName(name)
-}
-
-/** Holds if `f` is a function without a definition named `name`. */
-private predicate isFunctionWithMangledNameAndWithoutDefinition(@mangledname name, @function f) {
-  not hasDefinition(f) and
-  mangled_name(f, name)
-}
-
-/**
- * Holds if `incomplete` is a function without a definition, and there exists
- * a unique function `complete` with the same name that does have a definition.
- */
-private predicate hasTwinWithDefinition(@function incomplete, @function complete) {
-  not function_instantiation(incomplete, complete) and
-  (
-    not compgenerated(incomplete) or
-    not compgenerated(complete)
-  ) and
-  exists(@mangledname name |
-    isFunctionWithMangledNameAndWithoutDefinition(name, incomplete) and
-    isFunctionWithMangledNameAndWithDefinition(name, complete)
-  )
-}
-
-import Cached
-
-cached
-private module Cached {
-  /**
-   * If `f` is a function without a definition, and there exists a unique
-   * function with the same name that does have a definition, then the
-   * result is that unique function. Otherwise, the result is `f`.
-   */
-  cached
-  @function resolveFunction(@function f) {
-    hasTwinWithDefinition(f, result)
-    or
-    not hasTwinWithDefinition(f, _) and
-    result = f
-  }
-
-  cached
-  predicate isFunction(@function f) { f = resolveFunction(_) }
-}

cpp/ql/src/CHANGELOG.md

@@ -1,3 +1,14 @@
+## 0.9.2
+
+### New Queries
+
+* Added a new query, `cpp/use-of-unique-pointer-after-lifetime-ends`, to detect uses of the contents unique pointers that will be destroyed immediately.
+* The `cpp/incorrectly-checked-scanf` query has been added. This finds results where the return value of scanf is not checked correctly. Some of these were previously found by `cpp/missing-check-scanf` and will no longer be reported there.
+
+### Minor Analysis Improvements
+
+* The `cpp/badly-bounded-write` query could report false positives when a pointer was first initialized with a literal and later assigned a dynamically allocated array. These false positives now no longer occur.
+
 ## 0.9.1
 
 No user-facing changes.

cpp/ql/src/change-notes/2023-12-04-incorrectly-checked-scanf.md

@@ -1,4 +0,0 @@
----
-category: newQuery
----
-* The `cpp/incorrectly-checked-scanf` query has been added. This finds results where the return value of scanf is not checked correctly. Some of these were previously found by `cpp/missing-check-scanf` and will no longer be reported there.

cpp/ql/src/change-notes/2023-12-12-use-of-unique-pointer-after-lifetime-ends.md

@@ -1,4 +0,0 @@
----
-category: newQuery
----
-* Added a new query, `cpp/use-of-unique-pointer-after-lifetime-ends`, to detect uses of the contents unique pointers that will be destroyed immediately.

cpp/ql/src/change-notes/2023-12-15-badly-bounded-write.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The `cpp/badly-bounded-write` query could report false positives when a pointer was first initialized with a literal and later assigned a dynamically allocated array. These false positives now no longer occur.

cpp/ql/src/change-notes/released/0.9.2.md

@@ -0,0 +1,10 @@
+## 0.9.2
+
+### New Queries
+
+* Added a new query, `cpp/use-of-unique-pointer-after-lifetime-ends`, to detect uses of the contents unique pointers that will be destroyed immediately.
+* The `cpp/incorrectly-checked-scanf` query has been added. This finds results where the return value of scanf is not checked correctly. Some of these were previously found by `cpp/missing-check-scanf` and will no longer be reported there.
+
+### Minor Analysis Improvements
+
+* The `cpp/badly-bounded-write` query could report false positives when a pointer was first initialized with a literal and later assigned a dynamically allocated array. These false positives now no longer occur.

cpp/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.9.1
+lastReleaseVersion: 0.9.2

cpp/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-queries
-version: 0.9.2-dev
+version: 0.9.3-dev
 groups:
   - cpp
   - queries