github / github/codeql

Want way to audit C/C++ code against CERT-PRE01-C

Ouverte
#15,430 1 commentaire 0 réactions 0 personnes assignées Voir sur GitHub
question
Langage dominant
CodeQL
Étoiles
10.1k
Forks
2.1k
Merge moyen
2 j 15 h
PR mergées (30 j)
141

Description

I do not see any way to use the macro library to write a query that finds violations of CERT-PRE01-C:

https://wiki.sei.cmu.edu/confluence/display/c/PRE01-C.+Use+parentheses+within+macros+around+parameter+names

https://codeql.github.com/codeql-standard-libraries/cpp/semmle/code/cpp/Macro.qll/module.Macro.html

An example of a violation would be `#define DOUBLE(x) 2 * x`, which does not parenthesize x, such that `DOUBLE(1 + 1)` would be 3 rather than 4.

CodeQL is powerful enough to check for the analog in functions, although doing so is pointless:

```
/**
* @name Unparenthesized function parameter usage
* @description Finds instances where function parameters are used without parentheses in the function body.
* @kind problem
* @severity recommendation
* @id cpp/unparenthesized-function-parameter-usage
*/

import cpp

from Parameter param, VariableAccess va, Function f
where
f = param.getFunction() and
va.getTarget() = param and
va.getEnclosingFunction() = f and
not va.getParent() instanceof ParenthesisExpr
select va, "The parameter '" + param.getName() + "' is used without parentheses in the function '" + f.getName() + "'."
```

I cannot figure out how to do the equivalent for macros. Is there is no way or did I miss something?

Guide de contribution

Ouvrir le guide de contribution

Évaluation

Cette issue n'a pas encore été évaluée.

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.