C++: Fixes from Geoffrey's review round 2

jbj · jbj · commit c8725766bda2 · 2019-09-09T11:04:04.000+02:00
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 85.ql b/cpp/ql/src/jsf/4.10 Classes/AV Rule 85.ql
@@ -17,9 +17,12 @@ predicate oppositeOperators(string op1, string op2) {
   or oppositeOperators(op2, op1)
 }
 
-// whether op1 is implemented as the negation of op2
-/* this match is very syntactic: we simply check that op1 is defined as
-   !op2(_, _) */
+/**
+ * Holds if `op1` is implemented as the negation of `op2`.
+ *
+ * This match is very syntactic: we simply check that `op1` is defined as
+ * `!op2(_, _)`.
+ */
 predicate implementedAsNegationOf(Operator op1, Operator op2) {
   exists(Block b, ReturnStmt r, NotExpr n, Expr o |
     b = op1.getBlock() and
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 88.ql b/cpp/ql/src/jsf/4.10 Classes/AV Rule 88.ql
@@ -11,14 +11,17 @@
  */
 import cpp
 
-/*
-In the context of this rule, an interface is specified by a class which has the following properties:
-- it is intended to be an interface,
-- its public methods are pure virtual functions, and
-- it does not hold any data, unless those data items are small and function as part of the interface (e.g. a unique object identifier).
-
-An approximation of this definition is classes with pure virtual functions and less than 3 member variables.
-*/
+/**
+ * In the context of this rule, an interface is specified by a class which has
+ * the following properties:
+ * - it is intended to be an interface,
+ * - its public methods are pure virtual functions, and
+ * - it does not hold any data, unless those data items are small and function
+ *   as part of the interface (e.g. a unique object identifier).
+ *
+ * An approximation of this definition is classes with pure virtual functions
+ * and less than 3 member variables.
+ */
 class InterfaceClass extends Class {
   InterfaceClass() {
      exists(MemberFunction m | m.getDeclaringType() = this and not compgenerated(unresolveElement(m)))
diff --git a/cpp/ql/src/jsf/4.13 Functions/AV Rule 114.ql b/cpp/ql/src/jsf/4.13 Functions/AV Rule 114.ql
@@ -13,10 +13,10 @@
 import cpp
 
 /* This is slightly subtle: The extractor adds a dummy 'return;' statement for control paths
-   that fall off the end of a function. So we can simply look for non-void functions containing
-   a non-value carrying return. If the predecessor is a return statement it means that
-   the return did not return a value. (If that return was not added by the extractor but by the
-   programmer, we can flag it anyway, since this is arguably a bug.) */
+ * that fall off the end of a function. So we can simply look for non-void functions containing
+ * a non-value carrying return. If the predecessor is a return statement it means that
+ * the return did not return a value. (If that return was not added by the extractor but by the
+ * programmer, we can flag it anyway, since this is arguably a bug.) */
 
 predicate functionsMissingReturnStmt(Function f, ControlFlowNode blame) {
   f.fromSource() and
@@ -31,10 +31,10 @@ predicate functionsMissingReturnStmt(Function f, ControlFlowNode blame) {
   )
 }
 
-/* If a function has a value-carrying return statement, but the extractor hit a snag
-   whilst parsing the value, then the control flow graph will not include the value.
-   As such, to avoid embarrassing false positives, we exclude any function which
-   wasn't perfectly extracted. */
+/** If a function has a value-carrying return statement, but the extractor hit a snag
+ * whilst parsing the value, then the control flow graph will not include the value.
+ * As such, to avoid embarrassing false positives, we exclude any function which
+ * wasn't perfectly extracted. */
 predicate functionImperfectlyExtracted(Function f) {
   exists(CompilerError e | f.getBlock().getLocation().subsumes(e.getLocation()))
   or
diff --git a/cpp/ql/src/semmle/code/cpp/Compilation.qll b/cpp/ql/src/semmle/code/cpp/Compilation.qll
@@ -1,6 +1,6 @@
 import semmle.code.cpp.File
 
-/**
+/*
  * These two helper predicates are used to associate a unique integer with
  * each `@compilation`, for use in the `toString` method of `Compilation`.
  * These integers are not stable across trap imports, but stable across
diff --git a/cpp/ql/src/semmle/code/cpp/Print.qll b/cpp/ql/src/semmle/code/cpp/Print.qll
@@ -73,12 +73,12 @@ private class DumpType extends Type
    * This operation is very expensive, and should not be used in production queries.
    */
   final string getTypeIdentityString() {
-    /*
-      The identity string of a type is just the concatenation of the four components below. To create the type
-      identity for a derived type, insert the declarator of the derived type between the `getDeclaratorPrefix()` and
-      `getDeclaratorSuffixBeforeQualifiers()`. To create the type identity for a `SpecifiedType`, insert the qualifiers
-      after `getDeclaratorSuffixBeforeQualifiers()`.
-    */
+    // The identity string of a type is just the concatenation of the four
+    // components below. To create the type identity for a derived type, insert
+    // the declarator of the derived type between the `getDeclaratorPrefix()`
+    // and `getDeclaratorSuffixBeforeQualifiers()`. To create the type identity
+    // for a `SpecifiedType`, insert the qualifiers after
+    // `getDeclaratorSuffixBeforeQualifiers()`.
     result = getTypeSpecifier() + getDeclaratorPrefix() + getDeclaratorSuffixBeforeQualifiers() + getDeclaratorSuffix()
   }
 
diff --git a/cpp/ql/src/semmle/code/cpp/PrintAST.qll b/cpp/ql/src/semmle/code/cpp/PrintAST.qll
@@ -155,10 +155,12 @@ class PrintASTNode extends TPrintASTNode {
 /**
  * Retrieves the canonical QL class(es) for entity `el`
  */
-private string qlClass(ElementBase el) { result = "[" + concat(el.getCanonicalQLClass(), ",") + "] " }
+private string qlClass(ElementBase el) {
+  result = "[" + concat(el.getCanonicalQLClass(), ",") + "] "
+  // Alternative implementation -- do not delete. It is useful for QL class discovery.
+  //result = "["+ concat(el.getAQlClass(), ",") + "] "
+}
 
-// Do not delete this - it is useful for QL class discovery
-//private string qlClass(ElementBase el) { result = "["+ concat(el.getAQlClass(), ",") + "] " }
 
 /**
  * A node representing an AST node.
diff --git a/cpp/ql/src/semmle/code/cpp/Type.qll b/cpp/ql/src/semmle/code/cpp/Type.qll
@@ -969,9 +969,9 @@ class SpecifiedType extends DerivedType {
     result = this.getBaseType().getPointerIndirectionLevel()
   }
 
-  /** all the specifiers of this type as a string in a fixed order (the order
-      only depends on the specifiers, not on the source program). This is intended
-      for debugging queries only and is an expensive operation. */
+  /** Gets all the specifiers of this type as a string in a fixed order (the order
+    * only depends on the specifiers, not on the source program). This is intended
+    * for debugging queries only and is an expensive operation. */
   string getSpecifierString() {
     internalSpecString(this, result, 1)
   }
diff --git a/cpp/ql/src/semmle/code/cpp/UserType.qll b/cpp/ql/src/semmle/code/cpp/UserType.qll
@@ -85,9 +85,11 @@ class UserType extends Type, Declaration, NameQualifyingElement, AccessHolder, @
     exists(getEnclosingFunction())
   }
 
-  // Dummy implementations of inherited methods. This class must not be
-  // made abstract, because it is important that it captures the @usertype
-  // type exactly - but this is not apparent from its subclasses
+  /*
+   * Dummy implementations of inherited methods. This class must not be
+   * made abstract, because it is important that it captures the @usertype
+   * type exactly - but this is not apparent from its subclasses
+   */
 
   Declaration getADeclaration() { none() }
 
diff --git a/cpp/ql/src/semmle/code/cpp/commons/Assertions.qll b/cpp/ql/src/semmle/code/cpp/commons/Assertions.qll
@@ -69,7 +69,3 @@ class RecoverableAssert extends MacroInvocation, Assertion {
     not result.(Literal).getUnspecifiedType().(ArrayType).getBaseType() instanceof CharType
   }
 }
-
-/*
- * More assertion definitions go here.
- */
diff --git a/cpp/ql/src/semmle/code/cpp/commons/Dependency.qll b/cpp/ql/src/semmle/code/cpp/commons/Dependency.qll
@@ -105,11 +105,9 @@ cached predicate getDeclarationEntries(Declaration decl, DeclarationEntry de)
     decl.(Function).isConstructedFrom(de.getDeclaration()) or
     decl.(Class).isConstructedFrom(de.getDeclaration())
   ) and
-  /*
-   * ParameterDeclarationEntries are special, as (a) they can only be accessed
-   * from within the definition, and (b) non-definition PDEs may be commonly
-   * included. Thus, for PDEs, we point only to the definition.
-   */
+  // ParameterDeclarationEntries are special, as (a) they can only be accessed
+  // from within the definition, and (b) non-definition PDEs may be commonly
+  // included. Thus, for PDEs, we point only to the definition.
   (de instanceof ParameterDeclarationEntry implies de.isDefinition())
 }
 
diff --git a/cpp/ql/src/semmle/code/cpp/commons/Printf.qll b/cpp/ql/src/semmle/code/cpp/commons/Printf.qll
@@ -249,8 +249,11 @@ class FormatLiteral extends Literal {
     )
   }
 
-  // these predicates gets a regular expressions to match each individual
-  // parts of a conversion specifier.
+  /*
+   * Each of these predicates gets a regular expressions to match each individual
+   * parts of a conversion specifier.
+   */
+
   private string getParameterFieldRegexp() {
     // the parameter field is a posix extension, for example `%5$i` uses the fifth
     // parameter as an integer, regardless of the position of this substring in the
diff --git a/cpp/ql/src/semmle/code/cpp/controlflow/DefinitionsAndUses.qll b/cpp/ql/src/semmle/code/cpp/controlflow/DefinitionsAndUses.qll
@@ -247,16 +247,14 @@ predicate definitionBarrier(SemanticStackVariable v, ControlFlowNode barrier) {
   definition(v, barrier)
   or
   exists(VariableAccess va |
-    /* `va = barrier` does not work, as that could generate an
-     * incorrect use-use pair (a barrier must exist _between_
-     * uses):
-     * ```
-     * x = 0;
-     * int& y = x; // use1
-     * y = 1;
-     * use(x); // use2
-     * ```
-     */
+    // `va = barrier` does not work, as that could generate an
+    // incorrect use-use pair (a barrier must exist _between_
+    // uses):
+    //
+    //     x = 0;
+    //     int& y = x; // use1
+    //     y = 1;
+    //     use(x); // use2
     va.getASuccessor() = barrier and
     va.getTarget() = v and
     va.isAddressOfAccessNonConst() and
diff --git a/cpp/ql/src/semmle/code/cpp/controlflow/Guards.qll b/cpp/ql/src/semmle/code/cpp/controlflow/Guards.qll
@@ -40,8 +40,8 @@ class GuardCondition extends Expr {
      * true (for `&&`) or false (for `||`) branch.
      */
     cached predicate controls(BasicBlock controlled, boolean testIsTrue) {
-        /* This condition must determine the flow of control; that is, this
-         * node must be a top-level condition. */
+        // This condition must determine the flow of control; that is, this
+        // node must be a top-level condition.
         this.controlsBlock(controlled, testIsTrue)
         or
         exists (BinaryLogicalOperation binop, GuardCondition lhs, GuardCondition rhs
@@ -63,7 +63,7 @@ class GuardCondition extends Expr {
     }
 
     /** Holds if (determined by this guard) `left < right + k` must be `isLessThan` in `block`.
-        If `isLessThan = false` then this implies `left >= right + k`.  */
+      * If `isLessThan = false` then this implies `left >= right + k`.  */
     cached predicate ensuresLt(Expr left, Expr right, int k, BasicBlock block, boolean isLessThan) {
         exists(boolean testIsTrue |
             compares_lt(this, left, right, k, isLessThan, testIsTrue) and this.controls(block, testIsTrue)
@@ -76,7 +76,7 @@ class GuardCondition extends Expr {
     }
 
     /** Holds if (determined by this guard) `left == right + k` must be `areEqual` in `block`.
-        If `areEqual = false` then this implies `left != right + k`.  */
+      * If `areEqual = false` then this implies `left != right + k`.  */
     cached predicate ensuresEq(Expr left, Expr right, int k, BasicBlock block, boolean areEqual) {
         exists(boolean testIsTrue |
             compares_eq(this, left, right, k, areEqual, testIsTrue) and this.controls(block, testIsTrue)
@@ -162,8 +162,8 @@ private predicate complex_eq(ComparisonOperation cmp, Expr left, Expr right, int
 }
 
 
-/* left - x == right + c => left == right + (c+x)
-   left == (right - x) + c => left == right + (c-x) */
+// left - x == right + c => left == right + (c+x)
+// left == (right - x) + c => left == right + (c-x)
 private predicate sub_eq(ComparisonOperation cmp, Expr left, Expr right, int k, boolean areEqual, boolean testIsTrue) {
     exists(SubExpr lhs, int c, int x | compares_eq(cmp, lhs, right, c, areEqual, testIsTrue) and
                                 left = lhs.getLeftOperand() and x = int_value(lhs.getRightOperand())
@@ -176,8 +176,8 @@ private predicate sub_eq(ComparisonOperation cmp, Expr left, Expr right, int k,
     )
 }
 
-/* left + x == right + c => left == right + (c-x)
-   left == (right + x) + c => left == right + (c+x) */
+// left + x == right + c => left == right + (c-x)
+// left == (right + x) + c => left == right + (c+x)
 private predicate add_eq(ComparisonOperation cmp, Expr left, Expr right, int k, boolean areEqual, boolean testIsTrue) {
     exists(AddExpr lhs, int c, int x | compares_eq(cmp, lhs, right, c, areEqual, testIsTrue) and
                                 (left = lhs.getLeftOperand() and x = int_value(lhs.getRightOperand())
@@ -256,8 +256,8 @@ private predicate complex_lt(ComparisonOperation cmp, Expr left, Expr right, int
 }
 
 
-/* left - x < right + c => left < right + (c+x)
-   left < (right - x) + c => left < right + (c-x) */
+// left - x < right + c => left < right + (c+x)
+// left < (right - x) + c => left < right + (c-x)
 private predicate sub_lt(ComparisonOperation cmp, Expr left, Expr right, int k, boolean isLt, boolean testIsTrue) {
     exists(SubExpr lhs, int c, int x | compares_lt(cmp, lhs, right, c, isLt, testIsTrue) and
                                 left = lhs.getLeftOperand() and x = int_value(lhs.getRightOperand())
@@ -270,8 +270,8 @@ private predicate sub_lt(ComparisonOperation cmp, Expr left, Expr right, int k,
     )
 }
 
-/* left + x < right + c => left < right + (c-x)
-   left < (right + x) + c => left < right + (c+x) */
+// left + x < right + c => left < right + (c-x)
+// left < (right + x) + c => left < right + (c+x)
 private predicate add_lt(ComparisonOperation cmp, Expr left, Expr right, int k, boolean isLt, boolean testIsTrue) {
     exists(AddExpr lhs, int c, int x | compares_lt(cmp, lhs, right, c, isLt, testIsTrue) and
                                 (left = lhs.getLeftOperand() and x = int_value(lhs.getRightOperand())
diff --git a/cpp/ql/src/semmle/code/cpp/controlflow/IRGuards.qll b/cpp/ql/src/semmle/code/cpp/controlflow/IRGuards.qll
diff --git a/cpp/ql/src/semmle/code/cpp/controlflow/SSAUtils.qll b/cpp/ql/src/semmle/code/cpp/controlflow/SSAUtils.qll
diff --git a/cpp/ql/src/semmle/code/cpp/security/TaintTracking.qll b/cpp/ql/src/semmle/code/cpp/security/TaintTracking.qll

Original file line number	Diff line number	Diff line change
`@@ -969,9 +969,9 @@ class SpecifiedType extends DerivedType {`
`969`	`969`	`result = this.getBaseType().getPointerIndirectionLevel()`
`970`	`970`	`}`
`971`	`971`
`972`		`- /** all the specifiers of this type as a string in a fixed order (the order`
`973`		`- only depends on the specifiers, not on the source program). This is intended`
`974`		`- for debugging queries only and is an expensive operation. */`
	`972`	`+ /** Gets all the specifiers of this type as a string in a fixed order (the order`
	`973`	`+ * only depends on the specifiers, not on the source program). This is intended`
	`974`	`+ * for debugging queries only and is an expensive operation. */`
`975`	`975`	`string getSpecifierString() {`
`976`	`976`	`internalSpecString(this, result, 1)`
`977`	`977`	`}`
Original file line number	Diff line number	Diff line change
`@@ -69,7 +69,3 @@ class RecoverableAssert extends MacroInvocation, Assertion {`
`69`	`69`	`not result.(Literal).getUnspecifiedType().(ArrayType).getBaseType() instanceof CharType`
`70`	`70`	`}`
`71`	`71`	`}`
`72`		`-`
`73`		`-/*`
`74`		`- * More assertion definitions go here.`
`75`		`- */`