Skip to content

A18-0-1: Consider more than just the file name when identifying use of C standard libraries #7

Closed
@nicolaswill

Description

@nicolaswill

Affected rules

  • A18-0-1

Description

The query for this rule reports any use of headers with file names the same as a prohibited C standard library header. This can cause false positives if the included file is not from a C standard library implementation but just happens to have the same name as a C standard library header.

There's no certain way to determine whether an include is of a C Standard Library header file, because the files themselves are not universally distinguishable, so we will need to consider some heuristics for identification.

As an initial idea, we could only report cases where:

  • The #include specifies no file path (e.g. filename = i.getIncludeText().substring(1, i.getIncludeText().length() - 2))
  • And where the target file is not within the source location (e.g. not exists(i.getIncludedFile().getRelativePath())

Example

$ cat lib/example.h 
#ifndef LIB_EXAMPLE_H_
#define LIB_EXAMPLE_H_

#endif

$ cat test.cpp 
#include "lib/example.h"  // A18-0-1 reported here
#include <iostream>

Metadata

Metadata

Assignees

Labels

Difficulty-MediumA false positive or false negative report which is expected to take 1-5 days effort to addressImpact-Mediumfalse positive/false negativeAn issue related to observed false positives or false negatives.user-reportIssue reported by an end user of CodeQL Coding Standards

Type

No type

Projects

Status

Done

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions