github / github/codeql

cpp/memory-may-not-be-freed is not in security-and-quality suite

未關閉
#14,955 1 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
question
主要語言
CodeQL
星號
10.1k
分支
2.1k
平均合併
2 天 15 小時
30 天內合併 PR
141

描述

**Description of the issue**

The rule cpp/memory-may-not-be-freed in [cpp/ql/src/Critical/MemoryMayNotBeFreed.ql](https://github.com/github/codeql/blob/fefc02d65052619e13dc245c1db219b1b0897d99/cpp/ql/src/Critical/MemoryMayNotBeFreed.ql) (and many other rules in the same directory) is not in the security-and-quality suite.

This is surprising as it is in the Critical/ directory and detects an important kind of security vulnerability. I would expect it in the security-extended or security-and-quality suite.

cpp/memory-may-not-be-freed lacks the property `@precision`. I believe that is the reason why it is not selected in security-and-quality suite.
https://github.com/github/codeql/blob/fefc02d65052619e13dc245c1db219b1b0897d99/misc/suite-helpers/security-and-quality-selectors.yml#L1-L16

貢獻指南

開啟貢獻指南

研究方向

Read cpp/ql/src/Critical/MemoryMayNotBeFreed.ql and misc/suite-helpers/security-and-quality-selectors.yml, especially the selector entries linked in the issue. Confirm how the missing @precision property affects suite selection, then verify that the rule is included in the security-and-quality suite when the issue is resolved.

由索引模型根據 Issue 內容生成。

評估

技術堆疊
cpp
領域
security
Issue 類型
缺陷
難度
2/5
預估耗時
1-3 小時
活躍度
停滯
描述清晰度
描述清楚
新手友好度
45/100

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。