Test a threshold of 0

Make sure we get near-perfect recall (ATM-light) and bad precision.

cpp/ql/src/Likely Bugs/AmbiguouslySignedBitField.ql

@@ -26,6 +26,8 @@ where
   // At least for C programs on Windows, BOOL is a common typedef for a type
   // representing BoolType.
   not bf.getType().hasName("BOOL") and
+  // GLib's gboolean is a typedef for a type representing BoolType.
+  not bf.getType().hasName("gboolean") and
   // If this is true, then there cannot be unsigned sign extension or overflow.
   not bf.getDeclaredNumBits() = bf.getType().getSize() * 8 and
   not bf.isAnonymous() and

cpp/ql/src/change-notes/2021-12-30-ambiguously-signed-bit-field.md

@@ -0,0 +1,5 @@
+---
+category: minorAnalysis
+---
+* Added exception for GLib's gboolean to cpp/ambiguously-signed-bit-field.
+  This change reduces the number of false positives in the query.

javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/ATMConfig.qll

@@ -105,8 +105,8 @@ abstract class ATMConfig extends string {
    *
    * Specifies the default cut-off value that controls how many alerts are produced.
    * The cut-off value must be in the range [0,1].
-   * A cut-off value of 0 only produces alerts that are likely true-positives.
+   * A cut-off value of >~0.5 only produces alerts that are likely true-positives.
-   * A cut-off value of 1 produces all alerts including those that are likely false-positives.
+   * A cut-off value of 0 produces all alerts including those that are likely false-positives.
    */
-  float getScoreCutoff() { result = 0.0 }
+  float getScoreCutoff() { result = 0. }
 }

javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/EndpointScoring.qll

@@ -205,14 +205,8 @@ class EndpointScoringResults extends ScoringResults {
         exists(float sinkScore |
           ModelScoring::endpointScores(sink, getCfg().getASinkEndpointType().getEncoding(),
             sinkScore) and
-          // Include the endpoint if (a) the query endpoint type scores higher than all other
+          // Include the endpoint if the query endpoint type scores higher than a fixed threshold
-          // endpoint types, or (b) the query endpoint type scores at least
+          sinkScore >= getCfg().getScoreCutoff()
-          // 0.5 - (getCfg().getScoreCutoff() / 2).
-          sinkScore >=
-            [
-              max(float s | ModelScoring::endpointScores(sink, _, s)),
-              0.5 - getCfg().getScoreCutoff() / 2
-            ]
         )
       )
   }