github / github/codeql-cli-binaries

CodeQL: Make any() expression and exists() formula variable identifier optional

Open
#53 4 comments 0 reactions 0 assignees View on GitHub
CLI Engine: Compiler and Optimiser enhancement QLIP
Dominant language
No language data
Stars
1k
Forks
184
PR merge metrics
No merged PRs in 30d

Description

What do you think about making the variable identifiers of the CodeQL [`any(...)` expression](https://codeql.github.com/docs/ql-language-reference/expressions/#any) and [`exists(...)` formula](https://codeql.github.com/docs/ql-language-reference/formulas/#exists) optional if they do not have any formulas?
Currently the CodeQL language specification requires an identifier even though it is not used.

Examples:
```ql
exists(GadgetClass unused) // Check whether a vulnerable "gadget" class exists on the class path
and any(CustomMethodCall unused).getArgument(0) instanceof CustomArgument
```
Here in both cases it is currently necessary to specify a variable identifier (`unused`), even though it is not used.

For the `exists` formula this could lead to some ambiguity because it currently allows using expressions (e.g. `exists(call.getAnArgument())`), however because type names as part of variable declarations cannot contain a period, this should be unambiguous.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.