Merge remote-tracking branch 'origin/main' into js/quality/loop_shift

actions/ql/lib/codeql/actions/security/OutputClobberingQuery.qll

@@ -216,6 +216,8 @@ private module OutputClobberingConfig implements DataFlow::ConfigSig {
   }
 
   predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 /** Tracks flow of unsafe user input that is used to construct and evaluate an environment variable. */

actions/ql/lib/codeql/actions/security/RequestForgeryQuery.qll

@@ -18,6 +18,8 @@ private module RequestForgeryConfig implements DataFlow::ConfigSig {
   predicate isSink(DataFlow::Node sink) { sink instanceof RequestForgerySink }
 
   predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 /** Tracks flow of unsafe user input that is used to construct and evaluate a system command. */

actions/ql/lib/codeql/actions/security/SecretExfiltrationQuery.qll

@@ -17,6 +17,8 @@ private module SecretExfiltrationConfig implements DataFlow::ConfigSig {
   predicate isSink(DataFlow::Node sink) { sink instanceof SecretExfiltrationSink }
 
   predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 /** Tracks flow of unsafe user input that is used in a context where it may lead to a secret exfiltration. */

actions/ql/src/Models/CompositeActionsSinks.ql

@@ -26,6 +26,8 @@ private module MyConfig implements DataFlow::ConfigSig {
   }
 
   predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 module MyFlow = TaintTracking::Global<MyConfig>;

actions/ql/src/Models/CompositeActionsSources.ql

@@ -36,6 +36,8 @@ private module MyConfig implements DataFlow::ConfigSig {
   }
 
   predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 module MyFlow = TaintTracking::Global<MyConfig>;

actions/ql/src/Models/CompositeActionsSummaries.ql

@@ -27,6 +27,8 @@ private module MyConfig implements DataFlow::ConfigSig {
   }
 
   predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 module MyFlow = TaintTracking::Global<MyConfig>;

actions/ql/src/Models/ReusableWorkflowsSinks.ql

@@ -26,6 +26,8 @@ private module MyConfig implements DataFlow::ConfigSig {
   }
 
   predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 module MyFlow = TaintTracking::Global<MyConfig>;

actions/ql/src/Models/ReusableWorkflowsSources.ql

@@ -36,6 +36,8 @@ private module MyConfig implements DataFlow::ConfigSig {
   }
 
   predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 module MyFlow = TaintTracking::Global<MyConfig>;

actions/ql/src/Models/ReusableWorkflowsSummaries.ql

@@ -27,6 +27,8 @@ private module MyConfig implements DataFlow::ConfigSig {
   }
 
   predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 module MyFlow = TaintTracking::Global<MyConfig>;

cpp/ql/src/experimental/Security/CWE/CWE-078/WordexpTainted.ql

@@ -50,6 +50,8 @@ module WordexpTaintConfig implements DataFlow::ConfigSig {
   }
 
   predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSourceLocation(DataFlow::Node source) { none() }
 }
 
 module WordexpTaint = TaintTracking::Global<WordexpTaintConfig>;

csharp/ql/src/Security Features/CWE-327/DontInstallRootCert.ql

@@ -39,6 +39,8 @@ module AddCertToRootStoreConfig implements DataFlow::ConfigSig {
   }
 
   predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 module AddCertToRootStore = DataFlow::Global<AddCertToRootStoreConfig>;

docs/query-help-style-guide.md

@@ -20,7 +20,29 @@ Query help files must have the same base name as the query they describe and mus
 
 ### File structure and layout
 
-Query help files are written using a custom XML format, and stored in a file with a `.qhelp` extension. The basic structure is as follows:
+Query help files can be written in either a custom XML format (with a `.qhelp` extension) or in Markdown (with a `.md` extension). Both formats are supported by the CodeQL documentation tooling. There are a few minor differences, noted in the section `Differences between XML and markdown formats` below.
+
+#### Markdown query help files
+
+A Markdown query help file should use the following structure and section order (note that the `Implementation notes` section is optional):
+
+```
+## Overview
+
+## Recommendation
+
+## Example
+
+## Implementation notes
+
+## References
+```
+
+Each section should be clearly marked with the appropriate heading. See the other Markdown files in this repository for examples.
+
+#### XML query help files
+
+Query help files can also be written using a custom XML format, and stored in a file with a `.qhelp` extension. The basic structure is as follows:
 
 ```xml
 <!DOCTYPE qhelp SYSTEM "qhelp.dtd">
@@ -33,7 +55,7 @@ The header and single top-level `<qhelp>` element are both mandatory.
 
 ### Section-level elements
 
-Section-level elements are used to group the information within the query help file. All query help files should include at least the following section elements, in the order specified:
+Section-level elements are used to group the information within the query help file. For both Markdown and XML formats, the following sections should be included, in the order specified:
 
 1. `overview`—a short summary of the issue that the query identifies, including an explanation of how it could affect the behavior of the program.
 2. `recommendation`—information on how to fix the issue highlighted by the query.
@@ -42,10 +64,9 @@ Section-level elements are used to group the information within the query help f
 
 For further information about the other section-level, block, list and table elements supported by query help files, see [Query help files](https://codeql.github.com/docs/writing-codeql-queries/query-help-files/) on codeql.github.com.
 
-
 ## English style
 
-You should write the overview and recommendation elements in simple English that is easy to follow. You should:
+You should write the overview and recommendation sections in simple English that is easy to follow. You should:
 
 * Use simple sentence structures and avoid complex or academic language.
 * Avoid colloquialisms and contractions.
@@ -57,10 +78,11 @@ You should write the overview and recommendation elements in simple English that
 Whenever possible, you should include a code example that helps to explain the issue you are highlighting. Any code examples that you include should adhere to the following guidelines:
 
 * The example should be less than 20 lines, but it should still clearly illustrate the issue that the query identifies.  If appropriate, then the example may also be runnable.
-* Put the code example after the recommendation element where possible. Only include an example in the description element if absolutely necessary.
+* Put the code example after the recommendation section where possible. Only include an example in the description section if absolutely necessary.
 * If you are using an example to illustrate the solution to a problem, and the change required is minor, avoid repeating the whole example. It is preferable to either describe the change required or to include a smaller snippet of the corrected code.
 * Clearly indicate which of the samples is an example of bad coding practice and which is recommended practice.
-* Define the code examples in `src` files. The language is inferred from the file extension:
+* For Markdown files, use fenced code blocks with the appropriate language identifier (for example, <code> ```java </code>).
+* For XML files, define the code examples in `src` files. The language is inferred from the file extension:
 
   ```xml
   <example>
@@ -74,11 +96,11 @@ Whenever possible, you should include a code example that helps to explain the i
   </example>
   ```
 
-Note, if any code words are included in the `overview` and `recommendation` sections, they should be formatted with `<code> ... </code>` for emphasis.
+Note, if any code words are included in the `overview` and `recommendation` sections, in Markdown they should be formatted with backticks (<code>`...`</code>) and in XML they should be formatted with`<code> ... </code>` for emphasis.
 
 ## Including references
 
-You should include one or more references, list formatted with `<li> ... </li>` for each item, to provide further information about the problem that your query is designed to find. References can be of the following types:
+You should include one or more references, formatted as an unordered list (`- ...` or `* ...`) in Markdown or with `<li> ... </li>` for each item in XML, to provide further information about the problem that your query is designed to find. References can be of the following types:
 
 ### Books
 
@@ -90,7 +112,7 @@ For example:
 
 >W. C. Wake, _Refactoring Workbook_, pp. 93 – 94, Addison-Wesley Professional, 2004.
 
-Note, & symbols need to be replaced by \&amp;. The symbol will be displayed correctly in the HTML files generated from the query help files.
+Note, & symbols need to be replaced by \&amp; in XML. The symbol will be displayed correctly in the HTML files generated from the query help files.
 
 ### Academic papers
 
@@ -98,7 +120,6 @@ If you are citing an academic paper, we recommend adopting the reference style o
 
 >S. R. Chidamber and C. F. Kemerer, _A metrics suite for object-oriented design_. IEEE Transactions on Software Engineering, 20(6):476-493, 1994.
 
-
 ### Websites
 
 If you are citing a website, please use the following format, without breadcrumb trails:
@@ -111,28 +132,123 @@ For example:
 
 ### Referencing potential security weaknesses
 
-If your query checks code for a CWE weakness, you should use the `@tags` element in the query file to reference the associated CWEs, as explained [here](query-metadata-style-guide.md). When you use these tags, a link to the appropriate entry from the [MITRE.org](https://cwe.mitre.org/scoring/index.html) site will automatically appear as a reference in the output HTML file.
+If your query checks code for a CWE weakness, you should use the `@tags` element in the query file to reference the associated CWEs, as explained [here](query-metadata-style-guide.md). When you use these tags in a query help file in the custom XML format, a link to the appropriate entry from the [MITRE.org](https://cwe.mitre.org/scoring/index.html) site will automatically appear as a reference in the output HTML file.
 
-## Validating qhelp files
+## Validating query help files
 
-Before making a pull request, please ensure the `.qhelp` files are well-formed and can be generated without errors. This can be done locally with the CodeQL CLI, as shown in the following example:
+Before making a pull request, please ensure the `.qhelp` or `.md` files are well-formed and can be generated without errors. This can be done locally with the CodeQL CLI, as shown in the following example:
 
 ```bash
 # codeql generate query-help <path_to_your_qhelp_file> --format=<format>
 # For example:
 codeql generate query-help ./myCustomQuery.qhelp --format=markdown
+codeql generate query-help ./myCustomQuery.md --format=markdown
 ```
 
+Please include the query help files (and any associated code snippets) in your pull request, but do not commit the generated Markdown.
 
-Please include the `.qhelp` files (and any associated code snippets) in your pull request, but do not commit the generated Markdown.
+More information on how to test your query help files can be found [within the documentation](https://docs.github.com/en/code-security/codeql-cli/using-the-codeql-cli/testing-query-help-files)
 
-More information on how to test your `.qhelp` files can be found [within the documentation](https://docs.github.com/en/code-security/codeql-cli/using-the-codeql-cli/testing-query-help-files)
+## Differences between XML and markdown formats
+
+1. The XML format allows for the contents of other files to be included in the output generated by processing the file, as mentioned in the section `Code examples`. This is not possible with the Markdown format.
+2. When using the XML format, references are added to the output HTML file based on CWE tags, as mentioned in the section `Referencing potential security weaknesses`.
+3. For custom queries and custom query packs, only the Markdown format is supported.
 
 ## Query help example
 
-The following example is a query help file for a query from the standard query suite for Java:
+The following example is a query help file for a query from the standard query suite for Java, shown in both Markdown and XML formats.
 
-```xml
+### Markdown example
+
+````markdown
+# Overview
+
+A control structure (an `if` statement or a loop) has a body that is either a block
+of statements surrounded by curly braces or a single statement.
+
+If you omit braces, it is particularly important to ensure that the indentation of the code
+matches the control flow of the code.
+
+## Recommendation
+
+It is usually considered good practice to include braces for all control
+structures in Java. This is because it makes it easier to maintain the code
+later. For example, it's easy to see at a glance which part of the code is in the
+scope of an `if` statement, and adding more statements to the body of the `if`
+statement is less error-prone.
+
+You should also ensure that the indentation of the code is consistent with the actual flow of
+control, so that it does not confuse programmers.
+
+## Example
+
+In the example below, the original version of `Cart` is missing braces. This means
+that the code triggers a `NullPointerException` at runtime if `i`
+is `null`.
+
+```java
+class Cart {
+    Map<Integer, Integer> items = ...
+    public void addItem(Item i) {
+        // No braces and misleading indentation.
+        if (i != null)
+            log("Adding item: " + i);
+            // Indentation suggests that the following statements
+            // are in the body of the 'if'.
+            Integer curQuantity = items.get(i.getID());
+            if (curQuantity == null) curQuantity = 0;
+            items.put(i.getID(), curQuantity+1);
+    }
+}
+```
+
+The corrected version of `Cart` does include braces, so
+that the code executes as the indentation suggests.
+
+```java
+class Cart {
+    Map<Integer, Integer> items = ...
+    public void addItem(Item i) {
+        // Braces included.
+        if (i != null) {
+            log("Adding item: " + i);
+            Integer curQuantity = items.get(i.getID());
+            if (curQuantity == null) curQuantity = 0;
+            items.put(i.getID(), curQuantity+1);
+        }
+    }
+}
+```
+
+In the following example the indentation may or may not be misleading depending on your tab width
+settings. As such, mixing tabs and spaces in this way is not recommended, since what looks fine in
+one context can be very misleading in another.
+
+```java
+// Tab width 8
+        if (b)       // Indentation: 1 tab
+                f(); // Indentation: 2 tabs
+        g();         // Indentation: 8 spaces
+
+// Tab width 4
+    if (b)   // Indentation: 1 tab
+        f(); // Indentation: 2 tabs
+        g(); // Indentation: 8 spaces
+```
+
+If you mix tabs and spaces in this way, then you might get seemingly false positives, since your
+tab width settings cannot be taken into account.
+
+## References
+
+* Java SE Documentation: [Compound Statements](https://www.oracle.com/java/technologies/javase/codeconventions-statements.html#15395)
+* Wikipedia: [Indentation style](https://en.wikipedia.org/wiki/Indentation_style)
+````
+
+### XML example
+
+````xml
 <!DOCTYPE qhelp PUBLIC
   "-//Semmle//qhelp//EN"
   "qhelp.dtd">
@@ -198,4 +314,4 @@ tab width settings cannot be taken into account.
 
 </references>
 </qhelp>
-```
+````

docs/query-metadata-style-guide.md

@@ -151,12 +151,12 @@ When you tag a query like this, the associated CWE pages from [MITRE.org](https:
 
 #### Quality query sub-category `@tags`
 
+Each code quality related query should have **one** of these two "top-level" categories as a tag:
+
 * `@tags maintainability`–for queries that detect patterns that make it harder for developers to make changes to the code.
 * `@tags reliability`–for queries that detect issues that affect whether the code will perform as expected during execution.
 
-Software quality doesn't have as universally-agreed categorization method as security issues like CWE, so we will do our own categorization instead of using tags like CWE. 
-
-We'll use two "top-level" categories of quality queries, with sub-categories beneath:
+In addition to the "top-level" categories, we will also add sub-categories to further group code quality related queries:
 
 * `@tags maintainability`–for queries that detect patterns that make it harder for developers to make changes to the code.
   * `@tags readability`–for queries that detect confusing patterns that make it harder for developers to read the code.

go/ql/integration-tests/query-suite/go-code-quality-extended.qls.expected

@@ -1,6 +1,22 @@
+ql/go/ql/src/InconsistentCode/ConstantLengthComparison.ql
+ql/go/ql/src/InconsistentCode/InconsistentLoopOrientation.ql
 ql/go/ql/src/InconsistentCode/LengthComparisonOffByOne.ql
 ql/go/ql/src/InconsistentCode/MissingErrorCheck.ql
+ql/go/ql/src/InconsistentCode/MistypedExponentiation.ql
 ql/go/ql/src/InconsistentCode/UnhandledCloseWritableHandle.ql
+ql/go/ql/src/InconsistentCode/WhitespaceContradictsPrecedence.ql
 ql/go/ql/src/InconsistentCode/WrappedErrorAlwaysNil.ql
+ql/go/ql/src/RedundantCode/CompareIdenticalValues.ql
+ql/go/ql/src/RedundantCode/DeadStoreOfField.ql
+ql/go/ql/src/RedundantCode/DeadStoreOfLocal.ql
+ql/go/ql/src/RedundantCode/DuplicateBranches.ql
+ql/go/ql/src/RedundantCode/DuplicateCondition.ql
+ql/go/ql/src/RedundantCode/DuplicateSwitchCase.ql
+ql/go/ql/src/RedundantCode/ExprHasNoEffect.ql
+ql/go/ql/src/RedundantCode/ImpossibleInterfaceNilCheck.ql
 ql/go/ql/src/RedundantCode/NegativeLengthCheck.ql
+ql/go/ql/src/RedundantCode/RedundantExpr.ql
 ql/go/ql/src/RedundantCode/RedundantRecover.ql
+ql/go/ql/src/RedundantCode/SelfAssignment.ql
+ql/go/ql/src/RedundantCode/ShiftOutOfRange.ql
+ql/go/ql/src/RedundantCode/UnreachableStatement.ql

go/ql/integration-tests/query-suite/go-code-quality.qls.expected

@@ -1,6 +1,22 @@
+ql/go/ql/src/InconsistentCode/ConstantLengthComparison.ql
+ql/go/ql/src/InconsistentCode/InconsistentLoopOrientation.ql
 ql/go/ql/src/InconsistentCode/LengthComparisonOffByOne.ql
 ql/go/ql/src/InconsistentCode/MissingErrorCheck.ql
+ql/go/ql/src/InconsistentCode/MistypedExponentiation.ql
 ql/go/ql/src/InconsistentCode/UnhandledCloseWritableHandle.ql
+ql/go/ql/src/InconsistentCode/WhitespaceContradictsPrecedence.ql
 ql/go/ql/src/InconsistentCode/WrappedErrorAlwaysNil.ql
+ql/go/ql/src/RedundantCode/CompareIdenticalValues.ql
+ql/go/ql/src/RedundantCode/DeadStoreOfField.ql
+ql/go/ql/src/RedundantCode/DeadStoreOfLocal.ql
+ql/go/ql/src/RedundantCode/DuplicateBranches.ql
+ql/go/ql/src/RedundantCode/DuplicateCondition.ql
+ql/go/ql/src/RedundantCode/DuplicateSwitchCase.ql
+ql/go/ql/src/RedundantCode/ExprHasNoEffect.ql
+ql/go/ql/src/RedundantCode/ImpossibleInterfaceNilCheck.ql
 ql/go/ql/src/RedundantCode/NegativeLengthCheck.ql
+ql/go/ql/src/RedundantCode/RedundantExpr.ql
 ql/go/ql/src/RedundantCode/RedundantRecover.ql
+ql/go/ql/src/RedundantCode/SelfAssignment.ql
+ql/go/ql/src/RedundantCode/ShiftOutOfRange.ql
+ql/go/ql/src/RedundantCode/UnreachableStatement.ql

go/ql/src/InconsistentCode/ConstantLengthComparison.ql

@@ -5,7 +5,10 @@
  * @kind problem
  * @problem.severity warning
  * @id go/constant-length-comparison
- * @tags correctness
+ * @tags quality
+ *       reliability
+ *       correctness
+ *       external/cwe/cwe-129
  * @precision high
  */
 

go/ql/src/InconsistentCode/InconsistentLoopOrientation.ql

@@ -8,7 +8,9 @@
  * @kind problem
  * @problem.severity error
  * @id go/inconsistent-loop-direction
- * @tags correctness
+ * @tags quality
+ *       reliability
+ *       correctness
  *       external/cwe/cwe-835
  * @precision very-high
  */

go/ql/src/InconsistentCode/LengthComparisonOffByOne.ql

@@ -5,10 +5,9 @@
  * @kind problem
  * @problem.severity error
  * @id go/index-out-of-bounds
- * @tags reliability
+ * @tags quality
+ *       reliability
  *       correctness
- *       logic
- *       quality
  *       external/cwe/cwe-193
  * @precision high
  */

go/ql/src/InconsistentCode/MissingErrorCheck.ql

@@ -5,10 +5,10 @@
  * @kind problem
  * @problem.severity warning
  * @id go/missing-error-check
- * @tags reliability
- *       correctness
- *       logic
- *       quality
+ * @tags quality
+ *       reliability
+ *       error-handling
+ *       external/cwe/cwe-252
  * @precision high
  */
 

go/ql/src/InconsistentCode/MistypedExponentiation.ql

@@ -4,7 +4,10 @@
  * @kind problem
  * @problem.severity warning
  * @id go/mistyped-exponentiation
- * @tags correctness
+ * @tags quality
+ *       reliability
+ *       correctness
+ *       external/cwe/cwe-480
  * @precision high
  */
 

go/ql/src/InconsistentCode/UnhandledCloseWritableHandle.ql

@@ -7,11 +7,10 @@
  * @problem.severity warning
  * @precision high
  * @id go/unhandled-writable-file-close
- * @tags maintainability
- *  correctness
- *  call
- *  defer
- *  quality
+ * @tags quality
+ *       reliability
+ *       error-handling
+ *       external/cwe/cwe-252
  */
 
 import go

go/ql/src/InconsistentCode/WhitespaceContradictsPrecedence.ql

@@ -1,11 +1,12 @@
 /**
  * @name Whitespace contradicts operator precedence
  * @description Nested expressions where the formatting contradicts the grouping enforced by operator precedence
- *              are difficult to read and may even indicate a bug.
+ *              are difficult to read and may indicate a bug.
  * @kind problem
  * @problem.severity warning
  * @id go/whitespace-contradicts-precedence
- * @tags maintainability
+ * @tags quality
+ *       reliability
  *       correctness
  *       external/cwe/cwe-783
  * @precision very-high

go/ql/src/InconsistentCode/WrappedErrorAlwaysNil.ql

@@ -4,10 +4,9 @@
  * @kind problem
  * @problem.severity warning
  * @id go/unexpected-nil-value
- * @tags reliability
- *       correctness
- *       logic
- *       quality
+ * @tags quality
+ *       reliability
+ *       error-handling
  * @precision high
  */
 

go/ql/src/RedundantCode/CompareIdenticalValues.ql

@@ -5,7 +5,9 @@
  * @kind problem
  * @problem.severity warning
  * @id go/comparison-of-identical-expressions
- * @tags correctness
+ * @tags quality
+ *       reliability
+ *       correctness
  *       external/cwe/cwe-570
  *       external/cwe/cwe-571
  * @precision very-high

go/ql/src/RedundantCode/DeadStoreOfField.ql

@@ -4,7 +4,9 @@
  * @kind problem
  * @problem.severity warning
  * @id go/useless-assignment-to-field
- * @tags maintainability
+ * @tags quality
+ *       maintainability
+ *       useless-code
  *       external/cwe/cwe-563
  * @precision very-high
  */

go/ql/src/RedundantCode/DeadStoreOfLocal.ql

@@ -5,7 +5,9 @@
  * @kind problem
  * @problem.severity warning
  * @id go/useless-assignment-to-local
- * @tags maintainability
+ * @tags quality
+ *       maintainability
+ *       useless-code
  *       external/cwe/cwe-563
  * @precision very-high
  */

go/ql/src/RedundantCode/DuplicateBranches.ql

@@ -6,7 +6,8 @@
  * @problem.severity warning
  * @precision very-high
  * @id go/duplicate-branches
- * @tags maintainability
+ * @tags quality
+ *       reliability
  *       correctness
  *       external/cwe/cwe-561
  */

go/ql/src/RedundantCode/DuplicateCondition.ql

@@ -5,7 +5,8 @@
  * @kind problem
  * @problem.severity error
  * @id go/duplicate-condition
- * @tags maintainability
+ * @tags quality
+ *       reliability
  *       correctness
  *       external/cwe/cwe-561
  * @precision very-high

go/ql/src/RedundantCode/DuplicateSwitchCase.ql

@@ -5,7 +5,8 @@
  * @kind problem
  * @problem.severity error
  * @id go/duplicate-switch-case
- * @tags maintainability
+ * @tags quality
+ *       reliability
  *       correctness
  *       external/cwe/cwe-561
  * @precision very-high

go/ql/src/RedundantCode/ExprHasNoEffect.ql

@@ -5,7 +5,8 @@
  * @kind problem
  * @problem.severity warning
  * @id go/useless-expression
- * @tags maintainability
+ * @tags quality
+ *       reliability
  *       correctness
  *       external/cwe/cwe-480
  *       external/cwe/cwe-561

go/ql/src/RedundantCode/ImpossibleInterfaceNilCheck.ql

@@ -4,7 +4,10 @@
  * @kind problem
  * @problem.severity warning
  * @id go/impossible-interface-nil-check
- * @tags correctness
+ * @tags quality
+ *       reliability
+ *       correctness
+ *       external/cwe/cwe-570
  * @precision high
  */
 

go/ql/src/RedundantCode/NegativeLengthCheck.ql

@@ -8,8 +8,10 @@
  * @problem.severity warning
  * @precision very-high
  * @id go/negative-length-check
- * @tags correctness
- *       quality
+ * @tags quality
+ *       reliability
+ *       correctness
+ *       external/cwe/cwe-571
  */
 
 import go

go/ql/src/RedundantCode/RedundantExpr.ql

@@ -6,7 +6,9 @@
  * @kind problem
  * @problem.severity warning
  * @id go/redundant-operation
- * @tags correctness
+ * @tags quality
+ *       reliability
+ *       correctness
  *       external/cwe/cwe-480
  *       external/cwe/cwe-561
  * @precision very-high

go/ql/src/RedundantCode/RedundantRecover.ql

@@ -6,9 +6,10 @@
  * @kind problem
  * @problem.severity warning
  * @id go/redundant-recover
- * @tags maintainability
+ * @tags quality
+ *       reliability
  *       correctness
- *       quality
+ *       external/cwe/cwe-248
  * @precision high
  */
 

go/ql/src/RedundantCode/SelfAssignment.ql

@@ -4,7 +4,9 @@
  * @kind problem
  * @problem.severity warning
  * @id go/redundant-assignment
- * @tags correctness
+ * @tags quality
+ *       reliability
+ *       correctness
  *       external/cwe/cwe-480
  *       external/cwe/cwe-561
  * @precision high

go/ql/src/RedundantCode/ShiftOutOfRange.ql

@@ -6,7 +6,9 @@
  * @problem.severity warning
  * @id go/shift-out-of-range
  * @precision very-high
- * @tags correctness
+ * @tags quality
+ *       reliability
+ *       correctness
  *       external/cwe/cwe-197
  */
 

go/ql/src/RedundantCode/UnreachableStatement.ql

@@ -5,7 +5,8 @@
  * @kind problem
  * @problem.severity warning
  * @id go/unreachable-statement
- * @tags maintainability
+ * @tags quality
+ *       reliability
  *       correctness
  *       external/cwe/cwe-561
  * @precision very-high

go/ql/src/Security/CWE-020/MissingRegexpAnchor.ql

@@ -74,6 +74,8 @@ module Config implements DataFlow::ConfigSig {
   predicate isSink(DataFlow::Node sink) { sink instanceof RegexpPattern }
 
   predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSinkLocation(DataFlow::Node sink) { none() }
 }
 
 module Flow = DataFlow::Global<Config>;

go/ql/src/Security/CWE-079/HtmlTemplateEscapingBypassXss.ql

@@ -101,6 +101,8 @@ module UntrustedToTemplateExecWithConversionConfig implements DataFlow::StateCon
       conversion.getType().getUnderlyingType*() = unescapedType
     )
   }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }
 
 module UntrustedToTemplateExecWithConversionFlow =

go/ql/src/Security/CWE-326/InsufficientKeySize.ql

@@ -27,6 +27,8 @@ module Config implements DataFlow::ConfigSig {
   }
 
   predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 /**

go/ql/src/change-notes/2025-06-13-add-tags-to-quality-queries.md

@@ -0,0 +1,22 @@
+---
+category: queryMetadata
+---
+* The tag `quality` has been added to multiple Go quality queries for consistency. They have all been given a tag for one of the two top-level categories `reliability` or `maintainability`, and a tag for a sub-category. See [Query file metadata and alert message style guide](https://github.com/github/codeql/blob/main/docs/query-metadata-style-guide.md#quality-query-sub-category-tags) for more information about these categories.
+* The tag `external/cwe/cwe-129` has been added to `go/constant-length-comparison`.
+* The tag `external/cwe/cwe-193` has been added to `go/index-out-of-bounds`.
+* The tag `external/cwe/cwe-197` has been added to `go/shift-out-of-range`.
+* The tag `external/cwe/cwe-248` has been added to `go/redundant-recover`.
+* The tag `external/cwe/cwe-252` has been added to `go/missing-error-check` and `go/unhandled-writable-file-close`.
+* The tag `external/cwe/cwe-480` has been added to `go/mistyped-exponentiation`.
+* The tag `external/cwe/cwe-570` has been added to `go/impossible-interface-nil-check` and `go/comparison-of-identical-expressions`.
+* The tag `external/cwe/cwe-571` has been added to `go/negative-length-check` and `go/comparison-of-identical-expressions`.
+* The tag `external/cwe/cwe-783` has been added to `go/whitespace-contradicts-precedence`.
+* The tag `external/cwe/cwe-835` has been added to `go/inconsistent-loop-direction`.
+* The tag `error-handling` has been added to `go/missing-error-check`, `go/unhandled-writable-file-close`, and `go/unexpected-nil-value`.
+* The tag `useless-code` has been added to `go/useless-assignment-to-field`, `go/useless-assignment-to-local`, `go/useless-expression`, and `go/unreachable-statement`.
+* The tag `logic` has been removed from `go/index-out-of-bounds` and `go/unexpected-nil-value`.
+* The tags `call` and `defer` have been removed from `go/unhandled-writable-file-close`.
+* The tags `correctness` and `quality` have been reordered in `go/missing-error-check` and `go/unhandled-writable-file-close`.
+* The tag `maintainability` has been changed to `reliability` for `go/unhandled-writable-file-close`.
+* The tag order has been standardized to have `quality` first, followed by the top-level category (`reliability` or `maintainability`), then sub-category tags, and finally CWE tags.
+* The description text has been updated in `go/whitespace-contradicts-precedence` to change "may even indicate" to "may indicate".

go/ql/src/experimental/CWE-285/PamAuthBypass.ql

@@ -44,6 +44,8 @@ module PamStartToAcctMgmtConfig implements DataFlow::ConfigSig {
   }
 
   predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSinkLocation(DataFlow::Node sink) { none() }
 }
 
 module PamStartToAcctMgmtFlow = TaintTracking::Global<PamStartToAcctMgmtConfig>;
@@ -59,6 +61,8 @@ module PamStartToAuthenticateConfig implements DataFlow::ConfigSig {
   }
 
   predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSinkLocation(DataFlow::Node sink) { none() }
 }
 
 module PamStartToAuthenticateFlow = TaintTracking::Global<PamStartToAuthenticateConfig>;

go/ql/src/experimental/CWE-369/DivideByZero.ql

@@ -47,6 +47,8 @@ module Config implements DataFlow::ConfigSig {
   }
 
   predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 /**

java/ql/integration-tests/java/query-suite/java-code-quality-extended.qls.expected

@@ -1,15 +1,83 @@
+ql/java/ql/src/Advisory/Declarations/MissingOverrideAnnotation.ql
+ql/java/ql/src/Advisory/Deprecated Code/AvoidDeprecatedCallableAccess.ql
+ql/java/ql/src/Advisory/Documentation/ImpossibleJavadocThrows.ql
+ql/java/ql/src/Advisory/Documentation/SpuriousJavadocParam.ql
+ql/java/ql/src/Compatibility/JDK9/JdkInternalAccess.ql
+ql/java/ql/src/Compatibility/JDK9/UnderscoreIdentifier.ql
+ql/java/ql/src/DeadCode/UselessParameter.ql
 ql/java/ql/src/Language Abuse/EmptyMethod.ql
+ql/java/ql/src/Language Abuse/IterableIterator.ql
 ql/java/ql/src/Language Abuse/TypeVariableHidesType.ql
+ql/java/ql/src/Language Abuse/UselessNullCheck.ql
+ql/java/ql/src/Language Abuse/UselessTypeTest.ql
+ql/java/ql/src/Language Abuse/WrappedIterator.ql
+ql/java/ql/src/Likely Bugs/Arithmetic/ConstantExpAppearsNonConstant.ql
 ql/java/ql/src/Likely Bugs/Arithmetic/IntMultToLong.ql
+ql/java/ql/src/Likely Bugs/Arithmetic/LShiftLargerThanTypeWidth.ql
+ql/java/ql/src/Likely Bugs/Arithmetic/WhitespaceContradictsPrecedence.ql
+ql/java/ql/src/Likely Bugs/Collections/ArrayIndexOutOfBounds.ql
+ql/java/ql/src/Likely Bugs/Collections/ContainsTypeMismatch.ql
+ql/java/ql/src/Likely Bugs/Collections/ReadOnlyContainer.ql
+ql/java/ql/src/Likely Bugs/Collections/RemoveTypeMismatch.ql
 ql/java/ql/src/Likely Bugs/Collections/WriteOnlyContainer.ql
+ql/java/ql/src/Likely Bugs/Comparison/CompareIdenticalValues.ql
+ql/java/ql/src/Likely Bugs/Comparison/EqualsArray.ql
+ql/java/ql/src/Likely Bugs/Comparison/HashedButNoHash.ql
 ql/java/ql/src/Likely Bugs/Comparison/IncomparableEquals.ql
 ql/java/ql/src/Likely Bugs/Comparison/InconsistentEqualsHashCode.ql
 ql/java/ql/src/Likely Bugs/Comparison/MissingInstanceofInEquals.ql
 ql/java/ql/src/Likely Bugs/Comparison/RefEqBoxed.ql
+ql/java/ql/src/Likely Bugs/Comparison/UselessComparisonTest.ql
+ql/java/ql/src/Likely Bugs/Comparison/WrongNanComparison.ql
+ql/java/ql/src/Likely Bugs/Concurrency/CallsToRunnableRun.ql
+ql/java/ql/src/Likely Bugs/Concurrency/DoubleCheckedLocking.ql
+ql/java/ql/src/Likely Bugs/Concurrency/DoubleCheckedLockingWithInitRace.ql
+ql/java/ql/src/Likely Bugs/Concurrency/NonSynchronizedOverride.ql
+ql/java/ql/src/Likely Bugs/Concurrency/SynchOnBoxedType.ql
+ql/java/ql/src/Likely Bugs/Concurrency/SynchSetUnsynchGet.ql
 ql/java/ql/src/Likely Bugs/Frameworks/JUnit/JUnit5MissingNestedAnnotation.ql
+ql/java/ql/src/Likely Bugs/Inheritance/NoNonFinalInConstructor.ql
+ql/java/ql/src/Likely Bugs/Likely Typos/ContainerSizeCmpZero.ql
 ql/java/ql/src/Likely Bugs/Likely Typos/ContradictoryTypeChecks.ql
+ql/java/ql/src/Likely Bugs/Likely Typos/MissingFormatArg.ql
+ql/java/ql/src/Likely Bugs/Likely Typos/MissingSpaceTypo.ql
+ql/java/ql/src/Likely Bugs/Likely Typos/SelfAssignment.ql
+ql/java/ql/src/Likely Bugs/Likely Typos/StringBufferCharInit.ql
 ql/java/ql/src/Likely Bugs/Likely Typos/SuspiciousDateFormat.ql
+ql/java/ql/src/Likely Bugs/Likely Typos/UnusedFormatArg.ql
+ql/java/ql/src/Likely Bugs/Nullness/NullAlways.ql
+ql/java/ql/src/Likely Bugs/Nullness/NullExprDeref.ql
+ql/java/ql/src/Likely Bugs/Nullness/NullMaybe.ql
 ql/java/ql/src/Likely Bugs/Resource Leaks/CloseReader.ql
+ql/java/ql/src/Likely Bugs/Resource Leaks/CloseSql.ql
 ql/java/ql/src/Likely Bugs/Resource Leaks/CloseWriter.ql
+ql/java/ql/src/Likely Bugs/Statements/ContinueInFalseLoop.ql
+ql/java/ql/src/Likely Bugs/Statements/PartiallyMaskedCatch.ql
+ql/java/ql/src/Likely Bugs/Statements/UseBraces.ql
+ql/java/ql/src/Likely Bugs/Termination/ConstantLoopCondition.ql
+ql/java/ql/src/Performance/InefficientEmptyStringTest.ql
+ql/java/ql/src/Performance/InefficientKeySetIterator.ql
+ql/java/ql/src/Performance/InefficientOutputStream.ql
+ql/java/ql/src/Performance/InefficientPrimConstructor.ql
+ql/java/ql/src/Performance/InnerClassCouldBeStatic.ql
+ql/java/ql/src/Performance/NewStringString.ql
 ql/java/ql/src/Performance/StringReplaceAllWithNonRegex.ql
+ql/java/ql/src/Violations of Best Practice/Boxed Types/BoxedVariable.ql
+ql/java/ql/src/Violations of Best Practice/Dead Code/DeadRefTypes.ql
+ql/java/ql/src/Violations of Best Practice/Dead Code/InterfaceCannotBeImplemented.ql
+ql/java/ql/src/Violations of Best Practice/Dead Code/UnreadLocal.ql
+ql/java/ql/src/Violations of Best Practice/Dead Code/UnusedLabel.ql
+ql/java/ql/src/Violations of Best Practice/Declarations/NoConstantsOnly.ql
+ql/java/ql/src/Violations of Best Practice/Exception Handling/IgnoreExceptionalReturn.ql
+ql/java/ql/src/Violations of Best Practice/Exception Handling/NumberFormatException.ql
+ql/java/ql/src/Violations of Best Practice/Implementation Hiding/AbstractToConcreteCollection.ql
+ql/java/ql/src/Violations of Best Practice/Implementation Hiding/ExposeRepresentation.ql
+ql/java/ql/src/Violations of Best Practice/Naming Conventions/AmbiguousOuterSuper.ql
+ql/java/ql/src/Violations of Best Practice/Naming Conventions/ConfusingMethodNames.ql
+ql/java/ql/src/Violations of Best Practice/Naming Conventions/ConfusingOverloading.ql
+ql/java/ql/src/Violations of Best Practice/Naming Conventions/LocalShadowsFieldConfusing.ql
+ql/java/ql/src/Violations of Best Practice/Naming Conventions/SameNameAsSuper.ql
+ql/java/ql/src/Violations of Best Practice/Undesirable Calls/CallsToStringToString.ql
+ql/java/ql/src/Violations of Best Practice/Undesirable Calls/DefaultToString.ql
 ql/java/ql/src/Violations of Best Practice/Undesirable Calls/DoNotCallFinalize.ql
+ql/java/ql/src/Violations of Best Practice/Undesirable Calls/PrintLnArray.ql

java/ql/integration-tests/java/query-suite/java-code-quality.qls.expected

@@ -1,13 +1,81 @@
+ql/java/ql/src/Advisory/Declarations/MissingOverrideAnnotation.ql
+ql/java/ql/src/Advisory/Deprecated Code/AvoidDeprecatedCallableAccess.ql
+ql/java/ql/src/Advisory/Documentation/ImpossibleJavadocThrows.ql
+ql/java/ql/src/Advisory/Documentation/SpuriousJavadocParam.ql
+ql/java/ql/src/Compatibility/JDK9/JdkInternalAccess.ql
+ql/java/ql/src/Compatibility/JDK9/UnderscoreIdentifier.ql
+ql/java/ql/src/DeadCode/UselessParameter.ql
+ql/java/ql/src/Language Abuse/IterableIterator.ql
+ql/java/ql/src/Language Abuse/UselessNullCheck.ql
+ql/java/ql/src/Language Abuse/UselessTypeTest.ql
+ql/java/ql/src/Language Abuse/WrappedIterator.ql
+ql/java/ql/src/Likely Bugs/Arithmetic/ConstantExpAppearsNonConstant.ql
 ql/java/ql/src/Likely Bugs/Arithmetic/IntMultToLong.ql
+ql/java/ql/src/Likely Bugs/Arithmetic/LShiftLargerThanTypeWidth.ql
+ql/java/ql/src/Likely Bugs/Arithmetic/WhitespaceContradictsPrecedence.ql
+ql/java/ql/src/Likely Bugs/Collections/ArrayIndexOutOfBounds.ql
+ql/java/ql/src/Likely Bugs/Collections/ContainsTypeMismatch.ql
+ql/java/ql/src/Likely Bugs/Collections/ReadOnlyContainer.ql
+ql/java/ql/src/Likely Bugs/Collections/RemoveTypeMismatch.ql
 ql/java/ql/src/Likely Bugs/Collections/WriteOnlyContainer.ql
+ql/java/ql/src/Likely Bugs/Comparison/CompareIdenticalValues.ql
+ql/java/ql/src/Likely Bugs/Comparison/EqualsArray.ql
+ql/java/ql/src/Likely Bugs/Comparison/HashedButNoHash.ql
 ql/java/ql/src/Likely Bugs/Comparison/IncomparableEquals.ql
 ql/java/ql/src/Likely Bugs/Comparison/InconsistentEqualsHashCode.ql
 ql/java/ql/src/Likely Bugs/Comparison/MissingInstanceofInEquals.ql
 ql/java/ql/src/Likely Bugs/Comparison/RefEqBoxed.ql
+ql/java/ql/src/Likely Bugs/Comparison/UselessComparisonTest.ql
+ql/java/ql/src/Likely Bugs/Comparison/WrongNanComparison.ql
+ql/java/ql/src/Likely Bugs/Concurrency/CallsToRunnableRun.ql
+ql/java/ql/src/Likely Bugs/Concurrency/DoubleCheckedLocking.ql
+ql/java/ql/src/Likely Bugs/Concurrency/DoubleCheckedLockingWithInitRace.ql
+ql/java/ql/src/Likely Bugs/Concurrency/NonSynchronizedOverride.ql
+ql/java/ql/src/Likely Bugs/Concurrency/SynchOnBoxedType.ql
+ql/java/ql/src/Likely Bugs/Concurrency/SynchSetUnsynchGet.ql
 ql/java/ql/src/Likely Bugs/Frameworks/JUnit/JUnit5MissingNestedAnnotation.ql
+ql/java/ql/src/Likely Bugs/Inheritance/NoNonFinalInConstructor.ql
+ql/java/ql/src/Likely Bugs/Likely Typos/ContainerSizeCmpZero.ql
 ql/java/ql/src/Likely Bugs/Likely Typos/ContradictoryTypeChecks.ql
+ql/java/ql/src/Likely Bugs/Likely Typos/MissingFormatArg.ql
+ql/java/ql/src/Likely Bugs/Likely Typos/MissingSpaceTypo.ql
+ql/java/ql/src/Likely Bugs/Likely Typos/SelfAssignment.ql
+ql/java/ql/src/Likely Bugs/Likely Typos/StringBufferCharInit.ql
 ql/java/ql/src/Likely Bugs/Likely Typos/SuspiciousDateFormat.ql
+ql/java/ql/src/Likely Bugs/Likely Typos/UnusedFormatArg.ql
+ql/java/ql/src/Likely Bugs/Nullness/NullAlways.ql
+ql/java/ql/src/Likely Bugs/Nullness/NullExprDeref.ql
+ql/java/ql/src/Likely Bugs/Nullness/NullMaybe.ql
 ql/java/ql/src/Likely Bugs/Resource Leaks/CloseReader.ql
+ql/java/ql/src/Likely Bugs/Resource Leaks/CloseSql.ql
 ql/java/ql/src/Likely Bugs/Resource Leaks/CloseWriter.ql
+ql/java/ql/src/Likely Bugs/Statements/ContinueInFalseLoop.ql
+ql/java/ql/src/Likely Bugs/Statements/PartiallyMaskedCatch.ql
+ql/java/ql/src/Likely Bugs/Statements/UseBraces.ql
+ql/java/ql/src/Likely Bugs/Termination/ConstantLoopCondition.ql
+ql/java/ql/src/Performance/InefficientEmptyStringTest.ql
+ql/java/ql/src/Performance/InefficientKeySetIterator.ql
+ql/java/ql/src/Performance/InefficientOutputStream.ql
+ql/java/ql/src/Performance/InefficientPrimConstructor.ql
+ql/java/ql/src/Performance/InnerClassCouldBeStatic.ql
+ql/java/ql/src/Performance/NewStringString.ql
 ql/java/ql/src/Performance/StringReplaceAllWithNonRegex.ql
+ql/java/ql/src/Violations of Best Practice/Boxed Types/BoxedVariable.ql
+ql/java/ql/src/Violations of Best Practice/Dead Code/DeadRefTypes.ql
+ql/java/ql/src/Violations of Best Practice/Dead Code/InterfaceCannotBeImplemented.ql
+ql/java/ql/src/Violations of Best Practice/Dead Code/UnreadLocal.ql
+ql/java/ql/src/Violations of Best Practice/Dead Code/UnusedLabel.ql
+ql/java/ql/src/Violations of Best Practice/Declarations/NoConstantsOnly.ql
+ql/java/ql/src/Violations of Best Practice/Exception Handling/IgnoreExceptionalReturn.ql
+ql/java/ql/src/Violations of Best Practice/Exception Handling/NumberFormatException.ql
+ql/java/ql/src/Violations of Best Practice/Implementation Hiding/AbstractToConcreteCollection.ql
+ql/java/ql/src/Violations of Best Practice/Implementation Hiding/ExposeRepresentation.ql
+ql/java/ql/src/Violations of Best Practice/Naming Conventions/AmbiguousOuterSuper.ql
+ql/java/ql/src/Violations of Best Practice/Naming Conventions/ConfusingMethodNames.ql
+ql/java/ql/src/Violations of Best Practice/Naming Conventions/ConfusingOverloading.ql
+ql/java/ql/src/Violations of Best Practice/Naming Conventions/LocalShadowsFieldConfusing.ql
+ql/java/ql/src/Violations of Best Practice/Naming Conventions/SameNameAsSuper.ql
+ql/java/ql/src/Violations of Best Practice/Undesirable Calls/CallsToStringToString.ql
+ql/java/ql/src/Violations of Best Practice/Undesirable Calls/DefaultToString.ql
 ql/java/ql/src/Violations of Best Practice/Undesirable Calls/DoNotCallFinalize.ql
+ql/java/ql/src/Violations of Best Practice/Undesirable Calls/PrintLnArray.ql

java/ql/lib/semmle/code/java/security/ArbitraryApkInstallationQuery.qll

@@ -23,6 +23,10 @@ module ApkInstallationConfig implements DataFlow::ConfigSig {
       )
     )
   }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 module ApkInstallationFlow = DataFlow::Global<ApkInstallationConfig>;

java/ql/lib/semmle/code/java/security/HardcodedCredentialsApiCallQuery.qll

@@ -49,6 +49,8 @@ module HardcodedCredentialApiCallConfig implements DataFlow::ConfigSig {
   predicate isBarrier(DataFlow::Node n) {
     n.asExpr().(MethodCall).getMethod() instanceof MethodSystemGetenv
   }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }
 
 /**

java/ql/lib/semmle/code/java/security/HardcodedCredentialsSourceCallQuery.qll

@@ -14,6 +14,8 @@ module HardcodedCredentialSourceCallConfig implements DataFlow::ConfigSig {
   predicate isSource(DataFlow::Node n) { n.asExpr() instanceof HardcodedExpr }
 
   predicate isSink(DataFlow::Node n) { n.asExpr() instanceof FinalCredentialsSourceSink }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }
 
 /**

java/ql/lib/semmle/code/java/security/HttpsUrlsQuery.qll

@@ -19,6 +19,8 @@ module HttpStringToUrlOpenMethodFlowConfig implements DataFlow::ConfigSig {
   }
 
   predicate isBarrier(DataFlow::Node node) { node instanceof SimpleTypeSanitizer }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }
 
 /**

java/ql/lib/semmle/code/java/security/InsecureBasicAuthQuery.qll

@@ -17,6 +17,8 @@ module BasicAuthFlowConfig implements DataFlow::ConfigSig {
   predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
     any(HttpUrlsAdditionalTaintStep c).step(node1, node2)
   }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }
 
 /**

java/ql/lib/semmle/code/java/security/SensitiveUiQuery.qll

@@ -19,6 +19,8 @@ private module NotificationTrackingConfig implements DataFlow::ConfigSig {
   }
 
   predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }
 
 /** Taint tracking flow for sensitive data flowing to system notifications. */
@@ -75,6 +77,8 @@ private module TextFieldTrackingConfig implements DataFlow::ConfigSig {
   predicate isBarrier(DataFlow::Node node) { node instanceof SimpleTypeSanitizer }
 
   predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }
 
 /** A local flow step that also flows through access to fields containing `View`s */

java/ql/lib/semmle/code/java/security/UnsafeAndroidAccessQuery.qll

@@ -15,6 +15,8 @@ module FetchUntrustedResourceConfig implements DataFlow::ConfigSig {
   predicate isSink(DataFlow::Node sink) { sink instanceof UrlResourceSink }
 
   predicate isBarrier(DataFlow::Node sanitizer) { sanitizer instanceof RequestForgerySanitizer }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }
 
 /**

java/ql/src/Advisory/Declarations/MissingOverrideAnnotation.ql

@@ -6,7 +6,9 @@
  * @problem.severity recommendation
  * @precision high
  * @id java/missing-override-annotation
- * @tags maintainability
+ * @tags quality
+ *       maintainability
+ *       readability
  */
 
 import java

java/ql/src/Advisory/Deprecated Code/AvoidDeprecatedCallableAccess.ql

@@ -6,7 +6,9 @@
  * @problem.severity recommendation
  * @precision high
  * @id java/deprecated-call
- * @tags maintainability
+ * @tags quality
+ *       maintainability
+ *       readability
  *       non-attributable
  *       external/cwe/cwe-477
  */

java/ql/src/Advisory/Documentation/ImpossibleJavadocThrows.ql

@@ -6,7 +6,9 @@
  * @problem.severity recommendation
  * @precision high
  * @id java/inconsistent-javadoc-throws
- * @tags maintainability
+ * @tags quality
+ *       maintainability
+ *       readability
  */
 
 import java

java/ql/src/Advisory/Documentation/SpuriousJavadocParam.ql

@@ -6,7 +6,9 @@
  * @problem.severity recommendation
  * @precision very-high
  * @id java/unknown-javadoc-parameter
- * @tags maintainability
+ * @tags quality
+ *       maintainability
+ *       readability
  */
 
 import java

java/ql/src/Compatibility/JDK9/JdkInternalAccess.ql

@@ -6,7 +6,9 @@
  * @problem.severity recommendation
  * @precision high
  * @id java/jdk-internal-api-access
- * @tags maintainability
+ * @tags quality
+ *       maintainability
+ *       readability
  */
 
 import java

java/ql/src/Compatibility/JDK9/UnderscoreIdentifier.ql

@@ -6,7 +6,9 @@
  * @problem.severity recommendation
  * @precision high
  * @id java/underscore-identifier
- * @tags maintainability
+ * @tags quality
+ *       maintainability
+ *       readability
  */
 
 import java

java/ql/src/DeadCode/UselessParameter.ql

@@ -5,7 +5,8 @@
  * @problem.severity recommendation
  * @precision high
  * @id java/unused-parameter
- * @tags maintainability
+ * @tags quality
+ *       maintainability
  *       useless-code
  *       external/cwe/cwe-561
  */

java/ql/src/Language Abuse/ChainedInstanceof.ql

@@ -6,6 +6,7 @@
  * @precision high
  * @id java/chained-type-tests
  * @tags maintainability
+ *       complexity
  *       language-features
  */
 

java/ql/src/Language Abuse/IterableIterator.ql

@@ -7,8 +7,9 @@
  * @problem.severity warning
  * @precision very-high
  * @id java/iterator-implements-iterable
- * @tags correctness
+ * @tags quality
  *       reliability
+ *       correctness
  */
 
 import java

java/ql/src/Language Abuse/UselessNullCheck.ql

@@ -6,7 +6,8 @@
  * @problem.severity warning
  * @precision very-high
  * @id java/useless-null-check
- * @tags maintainability
+ * @tags quality
+ *       maintainability
  *       useless-code
  *       external/cwe/cwe-561
  */

java/ql/src/Language Abuse/UselessTypeTest.ql

@@ -5,7 +5,9 @@
  * @problem.severity warning
  * @precision very-high
  * @id java/useless-type-test
- * @tags maintainability
+ * @tags quality
+ *       maintainability
+ *       useless-code
  *       language-features
  *       external/cwe/cwe-561
  */

java/ql/src/Language Abuse/WrappedIterator.ql

@@ -6,8 +6,9 @@
  * @problem.severity warning
  * @precision very-high
  * @id java/iterable-wraps-iterator
- * @tags correctness
+ * @tags quality
  *       reliability
+ *       correctness
  */
 
 import java

java/ql/src/Likely Bugs/Arithmetic/ConstantExpAppearsNonConstant.ql

@@ -5,8 +5,9 @@
  * @problem.severity warning
  * @precision very-high
  * @id java/evaluation-to-constant
- * @tags maintainability
- *       useless-code
+ * @tags quality
+ *       reliability
+ *       correctness
  */
 
 import java

java/ql/src/Likely Bugs/Arithmetic/IntMultToLong.ql

@@ -6,10 +6,10 @@
  * @problem.severity warning
  * @precision very-high
  * @id java/integer-multiplication-cast-to-long
- * @tags reliability
+ * @tags quality
+ *       reliability
  *       correctness
  *       types
- *       quality
  *       external/cwe/cwe-190
  *       external/cwe/cwe-192
  *       external/cwe/cwe-197

java/ql/src/Likely Bugs/Arithmetic/LShiftLargerThanTypeWidth.ql

@@ -5,7 +5,9 @@
  * @problem.severity warning
  * @precision very-high
  * @id java/lshift-larger-than-type-width
- * @tags correctness
+ * @tags quality
+ *       reliability
+ *       correctness
  */
 
 import java

java/ql/src/Likely Bugs/Arithmetic/WhitespaceContradictsPrecedence.ql

@@ -6,8 +6,9 @@
  * @problem.severity warning
  * @precision very-high
  * @id java/whitespace-contradicts-precedence
- * @tags maintainability
- *       readability
+ * @tags quality
+ *       reliability
+ *       correctness
  *       external/cwe/cwe-783
  */
 

java/ql/src/Likely Bugs/Collections/ArrayIndexOutOfBounds.ql

@@ -6,7 +6,8 @@
  * @problem.severity error
  * @precision high
  * @id java/index-out-of-bounds
- * @tags reliability
+ * @tags quality
+ *       reliability
  *       correctness
  *       exceptions
  *       external/cwe/cwe-193

java/ql/src/Likely Bugs/Collections/ContainsTypeMismatch.ql

@@ -7,7 +7,8 @@
  * @problem.severity error
  * @precision very-high
  * @id java/type-mismatch-access
- * @tags reliability
+ * @tags quality
+ *       reliability
  *       correctness
  *       logic
  */

java/ql/src/Likely Bugs/Collections/ReadOnlyContainer.ql

@@ -5,9 +5,9 @@
  * @problem.severity error
  * @precision very-high
  * @id java/empty-container
- * @tags reliability
- *       maintainability
- *       useless-code
+ * @tags quality
+ *       reliability
+ *       correctness
  *       external/cwe/cwe-561
  */
 

java/ql/src/Likely Bugs/Collections/RemoveTypeMismatch.ql

@@ -7,7 +7,8 @@
  * @problem.severity error
  * @precision very-high
  * @id java/type-mismatch-modification
- * @tags reliability
+ * @tags quality
+ *       reliability
  *       correctness
  *       logic
  */

java/ql/src/Likely Bugs/Collections/WriteOnlyContainer.ql

@@ -5,9 +5,9 @@
  * @problem.severity error
  * @precision very-high
  * @id java/unused-container
- * @tags maintainability
+ * @tags quality
+ *       maintainability
  *       useless-code
- *       quality
  *       external/cwe/cwe-561
  */
 

java/ql/src/Likely Bugs/Comparison/CompareIdenticalValues.ql

@@ -6,7 +6,8 @@
  * @problem.severity error
  * @precision very-high
  * @id java/comparison-of-identical-expressions
- * @tags reliability
+ * @tags quality
+ *       reliability
  *       correctness
  *       logic
  */

java/ql/src/Likely Bugs/Comparison/EqualsArray.ql

@@ -6,7 +6,8 @@
  * @problem.severity error
  * @precision very-high
  * @id java/equals-on-arrays
- * @tags reliability
+ * @tags quality
+ *       reliability
  *       correctness
  */
 

java/ql/src/Likely Bugs/Comparison/HashedButNoHash.ql

@@ -6,7 +6,8 @@
  * @problem.severity error
  * @precision very-high
  * @id java/hashing-without-hashcode
- * @tags reliability
+ * @tags quality
+ *       reliability
  *       correctness
  */
 

java/ql/src/Likely Bugs/Comparison/IncomparableEquals.ql

@@ -6,9 +6,10 @@
  * @problem.severity error
  * @precision very-high
  * @id java/equals-on-unrelated-types
- * @tags reliability
+ * @tags quality
+ *       reliability
  *       correctness
- *       quality
+ *       external/cwe/cwe-571
  */
 
 import java

java/ql/src/Likely Bugs/Comparison/InconsistentEqualsHashCode.ql

@@ -6,9 +6,9 @@
  * @problem.severity error
  * @precision very-high
  * @id java/inconsistent-equals-and-hashcode
- * @tags reliability
+ * @tags quality
+ *       reliability
  *       correctness
- *       quality
  *       external/cwe/cwe-581
  */
 

java/ql/src/Likely Bugs/Comparison/MissingInstanceofInEquals.ql

@@ -6,9 +6,9 @@
  * @problem.severity error
  * @precision high
  * @id java/unchecked-cast-in-equals
- * @tags reliability
+ * @tags quality
+ *       reliability
  *       correctness
- *       quality
  */
 
 import java

java/ql/src/Likely Bugs/Comparison/RefEqBoxed.ql

@@ -6,9 +6,9 @@
  * @problem.severity error
  * @precision very-high
  * @id java/reference-equality-of-boxed-types
- * @tags reliability
+ * @tags quality
+ *       reliability
  *       correctness
- *       quality
  *       external/cwe/cwe-595
  */
 

java/ql/src/Likely Bugs/Comparison/UselessComparisonTest.ql

@@ -7,7 +7,9 @@
  * @problem.severity warning
  * @precision very-high
  * @id java/constant-comparison
- * @tags correctness
+ * @tags quality
+ *       reliability
+ *       correctness
  *       logic
  *       external/cwe/cwe-570
  *       external/cwe/cwe-571

java/ql/src/Likely Bugs/Comparison/WrongNanComparison.ql

@@ -6,7 +6,9 @@
  * @problem.severity error
  * @precision very-high
  * @id java/comparison-with-nan
- * @tags correctness
+ * @tags quality
+ *       reliability
+ *       correctness
  */
 
 import java

java/ql/src/Likely Bugs/Concurrency/CallsToRunnableRun.ql

@@ -6,8 +6,8 @@
  * @problem.severity recommendation
  * @precision high
  * @id java/call-to-thread-run
- * @tags reliability
- *       correctness
+ * @tags quality
+ *       reliability
  *       concurrency
  *       external/cwe/cwe-572
  */

java/ql/src/Likely Bugs/Concurrency/DoubleCheckedLocking.ql

@@ -6,8 +6,8 @@
  * @problem.severity error
  * @precision high
  * @id java/unsafe-double-checked-locking
- * @tags reliability
- *       correctness
+ * @tags quality
+ *       reliability
  *       concurrency
  *       external/cwe/cwe-609
  */

java/ql/src/Likely Bugs/Concurrency/DoubleCheckedLockingWithInitRace.ql

@@ -8,8 +8,8 @@
  * @problem.severity warning
  * @precision high
  * @id java/unsafe-double-checked-locking-init-order
- * @tags reliability
- *       correctness
+ * @tags quality
+ *       reliability
  *       concurrency
  *       external/cwe/cwe-609
  */

java/ql/src/Likely Bugs/Concurrency/NonSynchronizedOverride.ql

@@ -6,8 +6,8 @@
  * @problem.severity warning
  * @precision very-high
  * @id java/non-sync-override
- * @tags reliability
- *       correctness
+ * @tags quality
+ *       reliability
  *       concurrency
  *       language-features
  *       external/cwe/cwe-820

java/ql/src/Likely Bugs/Concurrency/SynchOnBoxedType.ql

@@ -7,8 +7,8 @@
  * @problem.severity error
  * @precision very-high
  * @id java/sync-on-boxed-types
- * @tags reliability
- *       correctness
+ * @tags quality
+ *       reliability
  *       concurrency
  *       language-features
  *       external/cwe/cwe-662

java/ql/src/Likely Bugs/Concurrency/SynchSetUnsynchGet.ql

@@ -7,8 +7,8 @@
  * @problem.severity error
  * @precision very-high
  * @id java/unsynchronized-getter
- * @tags reliability
- *       correctness
+ * @tags quality
+ *       reliability
  *       concurrency
  *       language-features
  *       external/cwe/cwe-413

java/ql/src/Likely Bugs/Inheritance/NoNonFinalInConstructor.ql

@@ -6,7 +6,8 @@
  * @problem.severity error
  * @precision very-high
  * @id java/non-final-call-in-constructor
- * @tags reliability
+ * @tags quality
+ *       reliability
  *       correctness
  *       logic
  */

java/ql/src/Likely Bugs/Likely Typos/ContainerSizeCmpZero.ql

@@ -5,7 +5,8 @@
  * @problem.severity warning
  * @precision very-high
  * @id java/test-for-negative-container-size
- * @tags reliability
+ * @tags quality
+ *       reliability
  *       correctness
  *       logic
  */

java/ql/src/Likely Bugs/Likely Typos/ContradictoryTypeChecks.ql

@@ -7,9 +7,10 @@
  * @problem.severity error
  * @precision very-high
  * @id java/contradictory-type-checks
- * @tags correctness
+ * @tags quality
+ *       reliability
+ *       correctness
  *       logic
- *       quality
  */
 
 import java

java/ql/src/Likely Bugs/Likely Typos/MissingFormatArg.ql

@@ -6,7 +6,9 @@
  * @problem.severity error
  * @precision very-high
  * @id java/missing-format-argument
- * @tags correctness
+ * @tags quality
+ *       reliability
+ *       correctness
  *       external/cwe/cwe-685
  */
 

java/ql/src/Likely Bugs/Likely Typos/MissingSpaceTypo.ql

@@ -7,7 +7,9 @@
  * @problem.severity recommendation
  * @precision very-high
  * @id java/missing-space-in-concatenation
- * @tags readability
+ * @tags quality
+ *       maintainability
+ *       readability
  */
 
 import java

java/ql/src/Likely Bugs/Likely Typos/SelfAssignment.ql

@@ -5,7 +5,8 @@
  * @problem.severity error
  * @precision very-high
  * @id java/redundant-assignment
- * @tags reliability
+ * @tags quality
+ *       reliability
  *       correctness
  *       logic
  */

java/ql/src/Likely Bugs/Likely Typos/StringBufferCharInit.ql

@@ -6,8 +6,9 @@
  * @problem.severity error
  * @precision very-high
  * @id java/string-buffer-char-init
- * @tags reliability
- *       maintainability
+ * @tags quality
+ *       reliability
+ *       correctness
  */
 
 import java

java/ql/src/Likely Bugs/Likely Typos/SuspiciousDateFormat.ql

@@ -5,8 +5,9 @@
  * @problem.severity warning
  * @precision high
  * @id java/suspicious-date-format
- * @tags correctness
- *       quality
+ * @tags quality
+ *       reliability
+ *       correctness
  */
 
 import java

java/ql/src/Likely Bugs/Likely Typos/UnusedFormatArg.ql

@@ -7,7 +7,8 @@
  * @problem.severity warning
  * @precision very-high
  * @id java/unused-format-argument
- * @tags maintainability
+ * @tags quality
+ *       maintainability
  *       useless-code
  *       external/cwe/cwe-685
  */

java/ql/src/Likely Bugs/Nullness/NullAlways.ql

@@ -5,7 +5,8 @@
  * @problem.severity error
  * @precision very-high
  * @id java/dereferenced-value-is-always-null
- * @tags reliability
+ * @tags quality
+ *       reliability
  *       correctness
  *       exceptions
  *       external/cwe/cwe-476

java/ql/src/Likely Bugs/Nullness/NullExprDeref.ql

@@ -6,7 +6,8 @@
  * @problem.severity warning
  * @precision high
  * @id java/dereferenced-expr-may-be-null
- * @tags reliability
+ * @tags quality
+ *       reliability
  *       correctness
  *       exceptions
  *       external/cwe/cwe-476

java/ql/src/Likely Bugs/Nullness/NullMaybe.ql

@@ -6,7 +6,8 @@
  * @problem.severity warning
  * @precision high
  * @id java/dereferenced-value-may-be-null
- * @tags reliability
+ * @tags quality
+ *       reliability
  *       correctness
  *       exceptions
  *       external/cwe/cwe-476