Test a threshold of 0

Make sure we get near-perfect recall (ATM-light) and bad precision.

cpp/ql/src/Likely Bugs/AmbiguouslySignedBitField.ql

@@ -26,6 +26,8 @@ where
   // At least for C programs on Windows, BOOL is a common typedef for a type
   // representing BoolType.
   not bf.getType().hasName("BOOL") and
+  // GLib's gboolean is a typedef for a type representing BoolType.
+  not bf.getType().hasName("gboolean") and
   // If this is true, then there cannot be unsigned sign extension or overflow.
   not bf.getDeclaredNumBits() = bf.getType().getSize() * 8 and
   not bf.isAnonymous() and

cpp/ql/src/change-notes/2021-12-30-ambiguously-signed-bit-field.md

@@ -0,0 +1,5 @@
+---
+category: minorAnalysis
+---
+* Added exception for GLib's gboolean to cpp/ambiguously-signed-bit-field.
+  This change reduces the number of false positives in the query.

javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/ATMConfig.qll

@@ -105,8 +105,8 @@ abstract class ATMConfig extends string {
    *
    * Specifies the default cut-off value that controls how many alerts are produced.
    * The cut-off value must be in the range [0,1].
-   * A cut-off value of 0 only produces alerts that are likely true-positives.
+   * A cut-off value of >~0.5 only produces alerts that are likely true-positives.
-   * A cut-off value of 1 produces all alerts including those that are likely false-positives.
+   * A cut-off value of 0 produces all alerts including those that are likely false-positives.
    */
-  float getScoreCutoff() { result = 0.0 }
+  float getScoreCutoff() { result = 0. }
 }

javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/EndpointScoring.qll

@@ -205,14 +205,8 @@ class EndpointScoringResults extends ScoringResults {
         exists(float sinkScore |
           ModelScoring::endpointScores(sink, getCfg().getASinkEndpointType().getEncoding(),
             sinkScore) and
-          // Include the endpoint if (a) the query endpoint type scores higher than all other
+          // Include the endpoint if the query endpoint type scores higher than a fixed threshold
-          // endpoint types, or (b) the query endpoint type scores at least
+          sinkScore >= getCfg().getScoreCutoff()
-          // 0.5 - (getCfg().getScoreCutoff() / 2).
-          sinkScore >=
-            [
-              max(float s | ModelScoring::endpointScores(sink, _, s)),
-              0.5 - getCfg().getScoreCutoff() / 2
-            ]
         )
       )
   }

python/ql/lib/semmle/python/Comparisons.qll

@@ -514,7 +514,7 @@ class ComparisonControlBlock extends ConditionBlock {
 
   Comparison getTest() { this.getLastNode() = result }
 
-  /** Whether this conditional guard implies that, in block `b`,  the result of `that` is `thatIsTrue` */
+  /** Whether this conditional guard implies that, in block `b`, the result of `that` is `thatIsTrue` */
   predicate impliesThat(BasicBlock b, Comparison that, boolean thatIsTrue) {
     exists(boolean controlSense |
       this.controls(b, controlSense) and

python/ql/lib/semmle/python/Operations.qll

@@ -98,7 +98,7 @@ class LShift extends LShift_ {
   override string getSpecialMethodName() { result = "__lshift__" }
 }
 
-/** A modulo (`%`) binary operator, which includes  string formatting */
+/** A modulo (`%`) binary operator, which includes string formatting */
 class Mod extends Mod_ {
   override string getSpecialMethodName() { result = "__mod__" }
 }

python/ql/lib/semmle/python/essa/Essa.qll

@@ -8,7 +8,7 @@ import semmle.python.essa.Definitions
 
 /** An (enhanced) SSA variable derived from `SsaSourceVariable`. */
 class EssaVariable extends TEssaDefinition {
-  /** Gets the (unique) definition of this  variable. */
+  /** Gets the (unique) definition of this variable. */
   EssaDefinition getDefinition() { this = result }
 
   /**

python/ql/lib/semmle/python/essa/SsaDefinitions.qll

@@ -127,7 +127,7 @@ module SsaSource {
     not test_contains(_, call)
   }
 
-  /** Holds if an attribute is deleted  at `def` and `use` is the use of `v` for that deletion */
+  /** Holds if an attribute is deleted at `def` and `use` is the use of `v` for that deletion */
   cached
   predicate attribute_deletion_refinement(Variable v, NameNode use, DeletionNode def) {
     use.uses(v) and

python/ql/src/Security/CWE-327/TlsLibraryModel.qll

@@ -88,7 +88,7 @@ abstract class TlsLibrary extends string {
   /** The name of a specific protocol version. */
   abstract string specific_version_name(ProtocolVersion version);
 
-  /** Gets a name, which is a member of `version_constants`,  that can be used to specify the protocol family `family`. */
+  /** Gets a name, which is a member of `version_constants`, that can be used to specify the protocol family `family`. */
   abstract string unspecific_version_name(ProtocolFamily family);
 
   /** Gets an API node representing the module or class holding the version constants. */