Merge branch 'main' into mabluda/fix576

Author: mbaluda

.github/workflows/dispatch-matrix-check.yml

@@ -1,8 +1,8 @@
-name: 🤖 Run Matrix Check 
+name: 🤖 Run Matrix Check
 
 on:
   pull_request_target:
-    types: [synchronize,opened]
+    types: [synchronize, opened]
     branches:
       - "matrix/**"
   workflow_dispatch:
@@ -11,29 +11,27 @@ jobs:
   dispatch-matrix-check:
     runs-on: ubuntu-22.04
     steps:
-
       - name: Test Variables
         shell: pwsh
         run: |
-          Write-Host "Running as: ${{github.actor}}"    
-    
+          Write-Host "Running as: ${{github.actor}}"
+
       - name: Dispatch Matrix Testing Job
-        if: ${{ contains(fromJSON('["jsinglet", "mbaluda", "lcartey", "rvermeulen", "ravikprasad", "jeongsoolee09", "hohn", "knewbury01", "kraiouchkine"]'), github.actor) }}
+        if: ${{ contains(fromJSON('["mbaluda", "lcartey", "rvermeulen", "ravikprasad", "jeongsoolee09", "hohn", "knewbury01", "nicolaswill"]'), github.actor) }}
         uses: peter-evans/repository-dispatch@v2
         with:
           token: ${{ secrets.RELEASE_ENGINEERING_TOKEN }}
           repository: github/codeql-coding-standards-release-engineering
           event-type: matrix-test
-          client-payload: '{"pr": "${{ github.event.number  }}"}'
-
+          client-payload: '{"pr": "${{ github.event.number }}"}'
 
       - uses: actions/github-script@v6
-        if: ${{ contains(fromJSON('["jsinglet", "mbaluda", "lcartey", "rvermeulen", "ravikprasad", "jeongsoolee09", "hohn", "knewbury01", "kraiouchkine"]'), github.actor) }}
+        if: ${{ contains(fromJSON('["mbaluda", "lcartey", "rvermeulen", "ravikprasad", "jeongsoolee09", "hohn", "knewbury01", "nicolaswill"]'), github.actor) }}
         with:
           script: |
             github.rest.issues.createComment({
               issue_number: context.issue.number,
               owner: context.repo.owner,
               repo: context.repo.repo,
               body: '🤖 Beep Boop! Matrix Testing for this PR has been initiated. Please check back later for results. <br><br> :bulb: If you do not hear back from me please check my status! **I will report even if this PR does not contain files eligible for matrix testing.**'
-            })
+            })

.github/workflows/dispatch-matrix-test-on-comment.yml

@@ -8,26 +8,23 @@ on:
       - "rc/**"
       - next
 
-
 jobs:
   dispatch-matrix-check:
     runs-on: ubuntu-22.04
     steps:
-
       - name: Test Variables
         shell: pwsh
         run: |
           Write-Host "Running as: ${{github.actor}}"    
 
           $actor = "${{github.actor}}"
 
-          $acl = @("jsinglet","mbaluda", "lcartey", "rvermeulen", "ravikprasad", "jeongsoolee09", "hohn", "knewbury01", "kraiouchkine") 
+          $acl = @("mbaluda", "lcartey", "rvermeulen", "ravikprasad", "jeongsoolee09", "hohn", "knewbury01", "nicolaswill") 
 
           if(-not ($actor -in $acl)){
             throw "Refusing to run workflow for user not in acl."
           }
 
-
       - name: Dispatch Matrix Testing Job
         if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/test-matrix') }}
         uses: peter-evans/repository-dispatch@v2

.github/workflows/dispatch-release-performance-check.yml

@@ -12,15 +12,14 @@ jobs:
   dispatch-matrix-check:
     runs-on: ubuntu-22.04
     steps:
-
       - name: Test Variables
         shell: pwsh
         run: |
           Write-Host "Running as: ${{github.actor}}"    
 
           $actor = "${{github.actor}}"
 
-          $acl = @("jsinglet","mbaluda", "lcartey", "rvermeulen", "ravikprasad", "jeongsoolee09", "hohn", "knewbury01", "kraiouchkine") 
+          $acl = @("mbaluda", "lcartey", "rvermeulen", "ravikprasad", "jeongsoolee09", "hohn", "knewbury01", "nicolaswill") 
 
           if(-not ($actor -in $acl)){
             throw "Refusing to run workflow for user not in acl."
@@ -33,8 +32,7 @@ jobs:
           token: ${{ secrets.RELEASE_ENGINEERING_TOKEN }}
           repository: github/codeql-coding-standards-release-engineering
           event-type: performance-test
-          client-payload: '{"pr": "${{ github.event.issue.number  }}"}'
-
+          client-payload: '{"pr": "${{ github.event.issue.number }}"}'
 
       - uses: actions/github-script@v6
         if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/test-performance') }}
@@ -45,4 +43,4 @@ jobs:
               owner: context.repo.owner,
               repo: context.repo.repo,
               body: '🏁 Beep Boop! Performance testing for this PR has been initiated. Please check back later for results. Note that the query package generation step must complete before testing  will start so it might be a minute. <br><br> :bulb: If you do not hear back from me please check my status! **I will report even if I fail!**'
-            })
+            })

c/cert/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cert-c-coding-standards
-version: 2.33.0-dev
+version: 2.34.0-dev
 description: CERT C 2016
 suites: codeql-suites
 license: MIT

c/cert/src/rules/INT30-C/UnsignedIntegerOperationsWrapAround.ql

@@ -15,24 +15,11 @@
 
 import cpp
 import codingstandards.c.cert
-import codingstandards.cpp.Overflow
-import semmle.code.cpp.controlflow.Guards
-import semmle.code.cpp.valuenumbering.GlobalValueNumbering
+import codingstandards.cpp.rules.unsignedoperationwithconstantoperandswraps.UnsignedOperationWithConstantOperandsWraps
 
-from InterestingOverflowingOperation op
-where
-  not isExcluded(op, IntegerOverflowPackage::unsignedIntegerOperationsWrapAroundQuery()) and
-  op.getType().getUnderlyingType().(IntegralType).isUnsigned() and
-  // Not within a guard condition
-  not exists(GuardCondition gc | gc.getAChild*() = op) and
-  // Not guarded by a check, where the check is not an invalid overflow check
-  not op.hasValidPreCheck() and
-  // Is not checked after the operation
-  not op.hasValidPostCheck() and
-  // Permitted by exception 3
-  not op instanceof LShiftExpr and
-  // Permitted by exception 2 - zero case is handled in separate query
-  not op instanceof DivExpr and
-  not op instanceof RemExpr
-select op,
-  "Operation " + op.getOperator() + " of type " + op.getType().getUnderlyingType() + " may wrap."
+class UnsignedIntegerOperationsWrapAroundQuery extends UnsignedOperationWithConstantOperandsWrapsSharedQuery
+{
+  UnsignedIntegerOperationsWrapAroundQuery() {
+    this = IntegerOverflowPackage::unsignedIntegerOperationsWrapAroundQuery()
+  }
+}

c/cert/src/rules/PRE32-C/MacroOrFunctionArgsContainHashToken.ql

@@ -32,11 +32,38 @@ predicate isFunctionSuccessorLocation(ControlFlowNode node, File f, int endline)
 PreprocessorDirective isLocatedInAFunctionInvocation(FunctionCall c) {
   exists(PreprocessorDirective p, File f, int startCall, int endCall |
     isFunctionInvocationLocation(c, f, startCall, endCall) and
-    exists(int startLine, int endLine | isPreprocDirectiveLine(p, f, startLine, endLine) |
-      startCall < startLine and
-      startCall < endLine and
-      endLine <= endCall and
-      endLine <= endCall
+    exists(Expr arg, int preprocStartLine, int preprocEndLine |
+      c.getAnArgument() = arg and
+      isPreprocDirectiveLine(p, f, preprocStartLine, preprocEndLine) and
+      // function call begins before preprocessor directive
+      startCall < preprocStartLine and
+      (
+        // argument's location is after the preprocessor directive
+        arg.getLocation().getStartLine() > preprocStartLine
+        or
+        // arg's location is before an endif token that is part of a
+        // preprocessor directive defined before the argument.
+        // E.g.
+        // memcpy(dest, src,
+        // #ifdef SOMEMACRO
+        // 12
+        // #else
+        // 24 // 'arg' exists here
+        // #endif // endif after 'arg', but part of a preproc. branch before 'arg'
+        // );
+        p instanceof PreprocessorEndif and
+        // exists a preprocessor branch of which this is the endif
+        // and that preprocessor directive exists before
+        // the argument and after the function call begins.
+        exists(PreprocessorBranchDirective another |
+          another.getEndIf() = p and
+          another.getLocation().getFile() = f and
+          startCall < another.getLocation().getStartLine() and
+          arg.getLocation().getStartLine() > another.getLocation().getStartLine()
+        )
+      ) and
+      // function call ends after preprocessor directive
+      endCall > preprocEndLine
     ) and
     result = p
   )

c/cert/test/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cert-c-coding-standards-tests
-version: 2.33.0-dev
+version: 2.34.0-dev
 extractor: cpp
 license: MIT
 dependencies:

c/cert/test/rules/INT30-C/UnsignedIntegerOperationsWrapAround.expected

@@ -0,0 +1 @@
+c/common/test/rules/unsignedoperationwithconstantoperandswraps/UnsignedOperationWithConstantOperandsWraps.ql

c/cert/test/rules/INT30-C/UnsignedIntegerOperationsWrapAround.qlref

@@ -1 +1 @@
-cpp/common/test/rules/donotuserandforgeneratingpseudorandomnumbers/DoNotUseRandForGeneratingPseudorandomNumbers.ql
+c/common/test/rules/donotuserandforgeneratingpseudorandomnumbers/DoNotUseRandForGeneratingPseudorandomNumbers.ql

c/cert/test/rules/INT30-C/UnsignedIntegerOperationsWrapAround.testref

@@ -4,5 +4,3 @@
 | test.c:20:1:20:16 | #ifdef SOMEMACRO | Invocation of function memcpy includes a token "#ifdef SOMEMACRO" that could be confused for an argument preprocessor directive. |
 | test.c:22:1:22:5 | #else | Invocation of function memcpy includes a token "#else" that could be confused for an argument preprocessor directive. |
 | test.c:24:1:24:6 | #endif | Invocation of function memcpy includes a token "#endif" that could be confused for an argument preprocessor directive. |
-| test.c:27:1:27:8 | #if TEST | Invocation of function memcpy includes a token "#if TEST" that could be confused for an argument preprocessor directive. |
-| test.c:28:1:28:6 | #endif | Invocation of function memcpy includes a token "#endif" that could be confused for an argument preprocessor directive. |

c/cert/test/rules/MSC30-C/RandUsedForGeneratingPseudorandomNumbers.testref

@@ -24,6 +24,6 @@ void func(const char *src) {
 #endif // NON_COMPLIANT
   );
 
-#if TEST // COMPLIANT[FALSE_POSITIVE]
-#endif   // COMPLIANT[FALSE_POSITIVE]
-}
+#if TEST // COMPLIANT
+#endif   // COMPLIANT
+}

c/cert/test/rules/PRE32-C/MacroOrFunctionArgsContainHashToken.expected

@@ -1,5 +1,5 @@
 name: codeql/common-c-coding-standards
-version: 2.33.0-dev
+version: 2.34.0-dev
 license: MIT
 dependencies:
   codeql/common-cpp-coding-standards: '*'

c/cert/test/rules/PRE32-C/test.c

@@ -1,5 +1,5 @@
 name: codeql/common-c-coding-standards-tests
-version: 2.33.0-dev
+version: 2.34.0-dev
 extractor: cpp
 license: MIT
 dependencies:

c/common/src/codingstandards/c/Literals.qll

@@ -1,2 +1,2 @@
-| test.c:4:1:4:41 | #define BAD_MACRO_WITH_ARG(x) (x) + wow ## x | Macro BAD_MACRO_WITH_ARG contains use of parameter x used in multiple contexts. |
-| test.c:5:1:5:48 | #define BAD_MACRO_WITH_ARG_TWO(x,y) (x) + wow ## x | Macro BAD_MACRO_WITH_ARG_TWO contains use of parameter x used in multiple contexts. |
+| test.c:5:1:5:41 | #define BAD_MACRO_WITH_ARG(x) (x) + wow ## x | Macro BAD_MACRO_WITH_ARG contains use of parameter x used in multiple contexts. |
+| test.c:6:1:6:48 | #define BAD_MACRO_WITH_ARG_TWO(x,y) (x) + wow ## x | Macro BAD_MACRO_WITH_ARG_TWO contains use of parameter x used in multiple contexts. |

c/common/src/qlpack.yml

@@ -0,0 +1,4 @@
+// GENERATED FILE - DO NOT MODIFY
+import codingstandards.cpp.rules.amixedusemacroargumentsubjecttoexpansion.AMixedUseMacroArgumentSubjectToExpansion
+
+class TestFileQuery extends AMixedUseMacroArgumentSubjectToExpansionSharedQuery, TestQuery { }

c/common/test/qlpack.yml

@@ -0,0 +1,26 @@
+// NOTICE: THE TEST CASES BELOW ARE ALSO INCLUDED IN THE C++ TEST CASE AND
+// CHANGES SHOULD BE REFLECTED THERE AS WELL.
+#define GOOD_MACRO_WITH_ARG(X) ((X)*X##_scale) // COMPLIANT
+#define MACRO 1
+#define BAD_MACRO_WITH_ARG(x) (x) + wow##x        // NON_COMPLIANT
+#define BAD_MACRO_WITH_ARG_TWO(x, y) (x) + wow##x // NON_COMPLIANT
+#define MACROONE(x) #x                            // COMPLIANT
+#define MACROTWO(x) x *x                          // COMPLIANT
+#define MACROTHREE(x) "##\"\"'" + (x)             // COMPLIANT
+#define FOO(x) #x MACROONE(x) // COMPLIANT - no further arg expansion
+
+void f() {
+
+  int x;
+  int x_scale;
+  int y;
+  int wowMACRO = 0;
+
+  y = GOOD_MACRO_WITH_ARG(x);
+  wowMACRO = BAD_MACRO_WITH_ARG(MACRO);
+  wowMACRO = BAD_MACRO_WITH_ARG_TWO(MACRO, 1);
+  char s[] = MACROONE(MACRO);
+  y = MACROTWO(MACRO);
+  MACROTHREE(MACRO);
+  FOO(x);
+}

c/misra/test/rules/RULE-20-12/MacroParameterUsedAsHashOperand.expected renamed to c/common/test/rules/amixedusemacroargumentsubjecttoexpansion/AMixedUseMacroArgumentSubjectToExpansion.expected

@@ -0,0 +1,4 @@
+| test.c:8:14:8:17 | call to atof | Call to banned function atof. |
+| test.c:9:12:9:15 | call to atoi | Call to banned function atoi. |
+| test.c:10:13:10:16 | call to atol | Call to banned function atol. |
+| test.c:11:18:11:22 | call to atoll | Call to banned function atoll. |

c/common/test/rules/amixedusemacroargumentsubjecttoexpansion/AMixedUseMacroArgumentSubjectToExpansion.ql

@@ -0,0 +1,4 @@
+// GENERATED FILE - DO NOT MODIFY
+import codingstandards.cpp.rules.atofatoiatolandatollused.AtofAtoiAtolAndAtollUsed
+
+class TestFileQuery extends AtofAtoiAtolAndAtollUsedSharedQuery, TestQuery { }

c/common/test/rules/amixedusemacroargumentsubjecttoexpansion/test.c

@@ -0,0 +1,13 @@
+// NOTICE: THE TEST CASES BELOW ARE ALSO INCLUDED IN THE C++ TEST CASE AND
+// CHANGES SHOULD BE REFLECTED THERE AS WELL.
+#include <float.h>
+#include <stdlib.h>
+void f2();
+void f1() {
+  char l1[5] = "abcd";
+  float l2 = atof(l1);      // NON_COMLIANT
+  int l3 = atoi(l1);        // NON_COMPLIANT
+  long l4 = atol(l1);       // NON_COMPLIANT
+  long long l5 = atoll(l1); // NON_COMPLIANT
+  f2();                     // COMPLIANT
+}

c/common/test/rules/atofatoiatolandatollused/AtofAtoiAtolAndAtollUsed.expected

@@ -0,0 +1,4 @@
+| test.c:8:7:8:8 | x1 | Bit-field 'x1' is declared on type 'int'. |
+| test.c:12:15:12:16 | x5 | Bit-field 'x5' is declared on type 'signed long'. |
+| test.c:14:15:14:16 | x6 | Bit-field 'x6' is declared on type 'signed char'. |
+| test.c:16:14:16:15 | x7 | Bit-field 'x7' is declared on type 'Color'. |

c/common/test/rules/atofatoiatolandatollused/AtofAtoiAtolAndAtollUsed.ql

@@ -0,0 +1,4 @@
+// GENERATED FILE - DO NOT MODIFY
+import codingstandards.cpp.rules.bitfieldshallhaveanappropriatetype.BitFieldShallHaveAnAppropriateType
+
+class TestFileQuery extends BitFieldShallHaveAnAppropriateTypeSharedQuery, TestQuery { }

c/common/test/rules/atofatoiatolandatollused/test.c

@@ -0,0 +1,17 @@
+// NOTICE: THE TEST CASES BELOW ARE ALSO INCLUDED IN THE C++ TEST CASE AND
+// CHANGES SHOULD BE REFLECTED THERE AS WELL.
+typedef unsigned int UINT16;
+
+enum Color { R, G, B };
+
+struct SampleStruct {
+  int x1 : 2;          // NON_COMPLIANT - not explicitly signed or unsigned
+  unsigned int x2 : 2; // COMPLIANT - explicitly unsigned
+  signed int x3 : 2;   // COMPLIANT - explicitly signed
+  UINT16 x4 : 2;       // COMPLIANT - type alias resolves to a compliant type
+  signed long x5 : 2; // NON_COMPLIANT - cannot declare bit field for long, even
+                      // if it's signed
+  signed char x6 : 2; // NON_COMPLIANT - cannot declare bit field for char, even
+                      // if it's signed
+  enum Color x7 : 3;  // NON_COMPLIANT - cannot declare bit field for enum
+} sample_struct;

c/common/test/rules/bitfieldshallhaveanappropriatetype/BitFieldShallHaveAnAppropriateType.expected

@@ -1,20 +1,20 @@
 problems
-| test.c:8:8:8:12 | c_str | test.c:15:16:15:21 | call to getenv | test.c:8:8:8:12 | c_str | The object returned by the function getenv should not be modified. |
-| test.c:64:5:64:9 | conv4 | test.c:61:11:61:20 | call to localeconv | test.c:64:5:64:9 | conv4 | The object returned by the function localeconv should not be modified. |
-| test.c:73:5:73:8 | conv | test.c:69:25:69:34 | call to localeconv | test.c:73:5:73:8 | conv | The object returned by the function localeconv should not be modified. |
+| test.c:11:8:11:12 | c_str | test.c:18:16:18:21 | call to getenv | test.c:11:8:11:12 | c_str | The object returned by the function getenv should not be modified. |
+| test.c:67:5:67:9 | conv4 | test.c:64:11:64:20 | call to localeconv | test.c:67:5:67:9 | conv4 | The object returned by the function localeconv should not be modified. |
+| test.c:76:5:76:8 | conv | test.c:72:25:72:34 | call to localeconv | test.c:76:5:76:8 | conv | The object returned by the function localeconv should not be modified. |
 edges
-| test.c:5:18:5:22 | c_str | test.c:8:8:8:12 | c_str |
-| test.c:15:16:15:21 | call to getenv | test.c:21:9:21:12 | env1 |
-| test.c:21:9:21:12 | env1 | test.c:5:18:5:22 | c_str |
-| test.c:61:11:61:20 | call to localeconv | test.c:64:5:64:9 | conv4 |
-| test.c:69:25:69:34 | call to localeconv | test.c:73:5:73:8 | conv |
+| test.c:8:18:8:22 | c_str | test.c:11:8:11:12 | c_str |
+| test.c:18:16:18:21 | call to getenv | test.c:24:9:24:12 | env1 |
+| test.c:24:9:24:12 | env1 | test.c:8:18:8:22 | c_str |
+| test.c:64:11:64:20 | call to localeconv | test.c:67:5:67:9 | conv4 |
+| test.c:72:25:72:34 | call to localeconv | test.c:76:5:76:8 | conv |
 nodes
-| test.c:5:18:5:22 | c_str | semmle.label | c_str |
-| test.c:8:8:8:12 | c_str | semmle.label | c_str |
-| test.c:15:16:15:21 | call to getenv | semmle.label | call to getenv |
-| test.c:21:9:21:12 | env1 | semmle.label | env1 |
-| test.c:61:11:61:20 | call to localeconv | semmle.label | call to localeconv |
-| test.c:64:5:64:9 | conv4 | semmle.label | conv4 |
-| test.c:69:25:69:34 | call to localeconv | semmle.label | call to localeconv |
-| test.c:73:5:73:8 | conv | semmle.label | conv |
+| test.c:8:18:8:22 | c_str | semmle.label | c_str |
+| test.c:11:8:11:12 | c_str | semmle.label | c_str |
+| test.c:18:16:18:21 | call to getenv | semmle.label | call to getenv |
+| test.c:24:9:24:12 | env1 | semmle.label | env1 |
+| test.c:64:11:64:20 | call to localeconv | semmle.label | call to localeconv |
+| test.c:67:5:67:9 | conv4 | semmle.label | conv4 |
+| test.c:72:25:72:34 | call to localeconv | semmle.label | call to localeconv |
+| test.c:76:5:76:8 | conv | semmle.label | conv |
 subpaths

c/common/test/rules/bitfieldshallhaveanappropriatetype/BitFieldShallHaveAnAppropriateType.ql

@@ -1,4 +1,7 @@
+// NOTICE: THE TEST CASES BELOW ARE ALSO INCLUDED IN THE C++ TEST CASE AND
+// CHANGES SHOULD BE REFLECTED THERE AS WELL.
 #include <locale.h>
+#include <stddef.h>
 #include <stdlib.h>
 #include <string.h>
 

c/common/test/rules/bitfieldshallhaveanappropriatetype/test.c

@@ -0,0 +1,2 @@
+| test.c:8:1:8:25 | #define MACRO4(x) (x + 1) | Macro used instead of a function. |
+| test.c:13:1:13:48 | #define MACRO9() printf_custom("output = %d", 7) | Macro used instead of a function. |

c/common/test/rules/constlikereturnvalue/ConstLikeReturnValue.expected

@@ -0,0 +1,4 @@
+// GENERATED FILE - DO NOT MODIFY
+import codingstandards.cpp.rules.functionlikemacrosdefined.FunctionLikeMacrosDefined
+
+class TestFileQuery extends FunctionLikeMacrosDefinedSharedQuery, TestQuery { }