Want way to audit C/C++ code against CERT-PRE01-C
- Ngôn ngữ chính
- CodeQL
- Star
- 10.1k
- Fork
- 2.1k
- Merge trung bình
- 2 ngày 15 giờ
- Pull request đã merge (30 ngày)
- 141
Mô tả
I do not see any way to use the macro library to write a query that finds violations of CERT-PRE01-C:
https://wiki.sei.cmu.edu/confluence/display/c/PRE01-C.+Use+parentheses+within+macros+around+parameter+names
https://codeql.github.com/codeql-standard-libraries/cpp/semmle/code/cpp/Macro.qll/module.Macro.html
An example of a violation would be `#define DOUBLE(x) 2 * x`, which does not parenthesize x, such that `DOUBLE(1 + 1)` would be 3 rather than 4.
CodeQL is powerful enough to check for the analog in functions, although doing so is pointless:
```
/**
* @name Unparenthesized function parameter usage
* @description Finds instances where function parameters are used without parentheses in the function body.
* @kind problem
* @severity recommendation
* @id cpp/unparenthesized-function-parameter-usage
*/
import cpp
from Parameter param, VariableAccess va, Function f
where
f = param.getFunction() and
va.getTarget() = param and
va.getEnclosingFunction() = f and
not va.getParent() instanceof ParenthesisExpr
select va, "The parameter '" + param.getName() + "' is used without parentheses in the function '" + f.getName() + "'."
```
I cannot figure out how to do the equivalent for macros. Is there is no way or did I miss something?
Hướng dẫn đóng góp
Đánh giá
Issue này chưa được đánh giá.