Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

C++: Diff-informed queries: phase 3 (non-trivial locations)#20073

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Open
d10c wants to merge26 commits intogithub:main
base:main
Choose a base branch
Loading
fromd10c:d10c/diff-informed-phase-3-cpp

Conversation

d10c
Copy link
Contributor

This PR enables diff-informed mode on queries that select a location other than dataflow source or sink. This entails adding a non-trivial location override that returns the locations that are actually selected.

Prior work includes PRs like#19663,#19759, and#19817. This PR uses the same patch script as those PRs to find candidate queries to convert to diff-enabled. This is the final step in mass-enabling diff-informed queries on all the languages.

Commit-by-commit reviewing is recommended.

  • I have split the commits that add/modify tests from the ones that enable/disable diff-informed queries.
  • If the commit modifies a .qll file, in the commit message I've included links to the queries that depend on that .qll for easier reviewing.
  • Feel free to delegate parts of the review to others who may be more specialized in certain languages.

Potentially tricky cases:

d10c added26 commitsJuly 17, 2025 10:54
@d10cd10c added the no-change-note-requiredThis PR does not need a change note labelJul 17, 2025
@d10cd10c requested a review frommichaelnebelJuly 17, 2025 13:40
@d10cd10c marked this pull request as ready for reviewJuly 17, 2025 13:40
@CopilotCopilotAI review requested due to automatic review settingsJuly 17, 2025 13:40
@d10cd10c requested a review froma team as acode ownerJuly 17, 2025 13:40
Copy link
Contributor

@CopilotCopilotAI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Pull Request Overview

This PR enables diff-informed mode on C++ security queries that select locations other than dataflow source or sink. The changes add location override predicates to allow these queries to work with diff-informed analysis, which is part of the final phase of mass-enabling diff-informed queries across all languages.

Key changes include:

  • Addition ofobserveDiffInformedIncrementalMode() predicates to enable diff-informed mode
  • Implementation ofgetASelectedSourceLocation() andgetASelectedSinkLocation() predicates to specify relevant locations
  • Creation of test files for CWE-020 (External API) and CWE-313 (Cleartext SQLite Database) queries

Reviewed Changes

Copilot reviewed 41 out of 43 changed files in this pull request and generated no comments.

FileDescription
Multiple security query filesAdded diff-informed mode configuration with location override predicates
CleartextSqliteDatabase test filesAdded comprehensive test case with SQLite security vulnerabilities
ExternalAPI test filesAdded test infrastructure for external API queries
ExternalAPIsSpecific.qll filesDisabled diff-informed mode for library code used by multiple queries

Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment
Reviewers

Copilot code reviewCopilotCopilot left review comments

@michaelnebelmichaelnebelAwaiting requested review from michaelnebel

At least 1 approving review is required to merge this pull request.

Assignees
No one assigned
Labels
C++no-change-note-requiredThis PR does not need a change note
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

1 participant
@d10c

[8]ページ先頭

©2009-2025 Movatter.jp