mirror of
https://github.com/github/codeql.git
synced 2025-12-16 16:53:25 +01:00
C++: Remove the BMN filter from some queries, but reduce precision to medium
Remove the `not any(Compilation c).buildModeNone() and` clause from:
cpp/wrong-type-format-argument
cpp/comparison-with-wider-type
cpp/integer-multiplication-cast-to-long
cpp/implicit-function-declaration
cpp/suspicious-add-sizeof
but reduce their precision to `medium`.
This commit is contained in:
@@ -5,7 +5,7 @@
|
|||||||
* @kind problem
|
* @kind problem
|
||||||
* @problem.severity warning
|
* @problem.severity warning
|
||||||
* @security-severity 8.1
|
* @security-severity 8.1
|
||||||
* @precision high
|
* @precision medium
|
||||||
* @id cpp/integer-multiplication-cast-to-long
|
* @id cpp/integer-multiplication-cast-to-long
|
||||||
* @tags reliability
|
* @tags reliability
|
||||||
* security
|
* security
|
||||||
@@ -179,7 +179,6 @@ predicate overflows(MulExpr me, Type t) {
|
|||||||
|
|
||||||
from MulExpr me, Type t1, Type t2
|
from MulExpr me, Type t1, Type t2
|
||||||
where
|
where
|
||||||
not any(Compilation c).buildModeNone() and
|
|
||||||
t1 = me.getType().getUnderlyingType() and
|
t1 = me.getType().getUnderlyingType() and
|
||||||
t2 = me.getConversion().getType().getUnderlyingType() and
|
t2 = me.getConversion().getType().getUnderlyingType() and
|
||||||
t1.getSize() < t2.getSize() and
|
t1.getSize() < t2.getSize() and
|
||||||
|
|||||||
@@ -5,7 +5,7 @@
|
|||||||
* @kind problem
|
* @kind problem
|
||||||
* @problem.severity error
|
* @problem.severity error
|
||||||
* @security-severity 7.5
|
* @security-severity 7.5
|
||||||
* @precision high
|
* @precision medium
|
||||||
* @id cpp/wrong-type-format-argument
|
* @id cpp/wrong-type-format-argument
|
||||||
* @tags reliability
|
* @tags reliability
|
||||||
* correctness
|
* correctness
|
||||||
@@ -154,7 +154,6 @@ int sizeof_IntType() { exists(IntType it | result = it.getSize()) }
|
|||||||
|
|
||||||
from FormattingFunctionCall ffc, int n, Expr arg, Type expected, Type actual
|
from FormattingFunctionCall ffc, int n, Expr arg, Type expected, Type actual
|
||||||
where
|
where
|
||||||
not any(Compilation c).buildModeNone() and
|
|
||||||
(
|
(
|
||||||
formattingFunctionCallExpectedType(ffc, n, expected) and
|
formattingFunctionCallExpectedType(ffc, n, expected) and
|
||||||
formattingFunctionCallActualType(ffc, n, arg, actual) and
|
formattingFunctionCallActualType(ffc, n, arg, actual) and
|
||||||
|
|||||||
@@ -5,7 +5,7 @@
|
|||||||
* may lead to unpredictable behavior.
|
* may lead to unpredictable behavior.
|
||||||
* @kind problem
|
* @kind problem
|
||||||
* @problem.severity warning
|
* @problem.severity warning
|
||||||
* @precision high
|
* @precision medium
|
||||||
* @id cpp/implicit-function-declaration
|
* @id cpp/implicit-function-declaration
|
||||||
* @tags correctness
|
* @tags correctness
|
||||||
* maintainability
|
* maintainability
|
||||||
@@ -38,7 +38,6 @@ predicate isCompiledAsC(File f) {
|
|||||||
|
|
||||||
from FunctionDeclarationEntry fdeIm, FunctionCall fc
|
from FunctionDeclarationEntry fdeIm, FunctionCall fc
|
||||||
where
|
where
|
||||||
not any(Compilation c).buildModeNone() and
|
|
||||||
isCompiledAsC(fdeIm.getFile()) and
|
isCompiledAsC(fdeIm.getFile()) and
|
||||||
not isFromMacroDefinition(fc) and
|
not isFromMacroDefinition(fc) and
|
||||||
fdeIm.isImplicit() and
|
fdeIm.isImplicit() and
|
||||||
|
|||||||
@@ -6,7 +6,7 @@
|
|||||||
* @kind problem
|
* @kind problem
|
||||||
* @problem.severity warning
|
* @problem.severity warning
|
||||||
* @security-severity 7.8
|
* @security-severity 7.8
|
||||||
* @precision high
|
* @precision medium
|
||||||
* @tags reliability
|
* @tags reliability
|
||||||
* security
|
* security
|
||||||
* external/cwe/cwe-190
|
* external/cwe/cwe-190
|
||||||
@@ -51,7 +51,6 @@ int getComparisonSizeAdjustment(Expr e) {
|
|||||||
|
|
||||||
from Loop l, RelationalOperation rel, VariableAccess small, Expr large
|
from Loop l, RelationalOperation rel, VariableAccess small, Expr large
|
||||||
where
|
where
|
||||||
not any(Compilation c).buildModeNone() and
|
|
||||||
small = rel.getLesserOperand() and
|
small = rel.getLesserOperand() and
|
||||||
large = rel.getGreaterOperand() and
|
large = rel.getGreaterOperand() and
|
||||||
rel = l.getCondition().getAChild*() and
|
rel = l.getCondition().getAChild*() and
|
||||||
|
|||||||
@@ -6,7 +6,7 @@
|
|||||||
* @kind problem
|
* @kind problem
|
||||||
* @problem.severity warning
|
* @problem.severity warning
|
||||||
* @security-severity 8.8
|
* @security-severity 8.8
|
||||||
* @precision high
|
* @precision medium
|
||||||
* @id cpp/suspicious-add-sizeof
|
* @id cpp/suspicious-add-sizeof
|
||||||
* @tags security
|
* @tags security
|
||||||
* external/cwe/cwe-468
|
* external/cwe/cwe-468
|
||||||
@@ -24,7 +24,6 @@ private predicate isCharSzPtrExpr(Expr e) {
|
|||||||
|
|
||||||
from Expr sizeofExpr, Expr e
|
from Expr sizeofExpr, Expr e
|
||||||
where
|
where
|
||||||
not any(Compilation c).buildModeNone() and
|
|
||||||
// If we see an addWithSizeof then we expect the type of
|
// If we see an addWithSizeof then we expect the type of
|
||||||
// the pointer expression to be `char*` or `void*`. Otherwise it
|
// the pointer expression to be `char*` or `void*`. Otherwise it
|
||||||
// is probably a mistake.
|
// is probably a mistake.
|
||||||
|
|||||||
Reference in New Issue
Block a user