C++: Convert qlref tests to inline expectations by owen-mc · Pull Request #22127 · github/codeql

owen-mc · 2026-07-05T19:47:31Z

Oops, there are still some things to fix. Sorry for taking it out of draft too early.

owen-mc · 2026-07-06T13:49:24Z

Rerun has been triggered: 2 restarted 🚀

owen-mc · 2026-07-07T08:16:08Z

Rerun has been triggered: 2 restarted 🚀

Copilot

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

jketema · 2026-07-07T08:27:25Z

Since I was looking at this already: I see quite some $ Alert // GOOD ... [FALSE POSITIVE] those need a "spurious". Bonus point for also updating // BAD ... [NOT DETECTED] with a missing alert annotation.

jketema

Got up to query-tests/Security, but need a break 😅

jketema · 2026-07-07T12:35:42Z

 	sys_somesystemcall(&p);

-	unsafe_put_user(123, &p); // BAD [NOT DETECTED]
+	unsafe_put_user(123, &p); // $ MISSING: Alert // $ MISSING: Alert // BAD [NOT DETECTED]


Suggested change

unsafe_put_user(123, &p); // $ MISSING: Alert // $ MISSING: Alert // BAD [NOT DETECTED]

unsafe_put_user(123, &p); // $ MISSING: Alert // BAD [NOT DETECTED]

jketema · 2026-07-07T12:35:56Z

 	sys_somesystemcall(&v);

-	unsafe_put_user(123, &v); // BAD [NOT DETECTED]
+	unsafe_put_user(123, &v); // $ MISSING: Alert // $ MISSING: Alert // BAD [NOT DETECTED]


Suggested change

unsafe_put_user(123, &v); // $ MISSING: Alert // $ MISSING: Alert // BAD [NOT DETECTED]

unsafe_put_user(123, &v); // $ MISSING: Alert // BAD [NOT DETECTED]

jketema · 2026-07-07T12:36:12Z

 	sys_somesystemcall(&myData);

-	unsafe_put_user(123, &(myData.x)); // BAD [NOT DETECTED]
+	unsafe_put_user(123, &(myData.x)); // $ MISSING: Alert // $ MISSING: Alert // BAD [NOT DETECTED]


Suggested change

unsafe_put_user(123, &(myData.x)); // $ MISSING: Alert // $ MISSING: Alert // BAD [NOT DETECTED]

unsafe_put_user(123, &(myData.x)); // $ MISSING: Alert // BAD [NOT DETECTED]

jketema · 2026-07-07T12:37:10Z

 	size_t size2 = x;
 	size2 *= y;
-	char *buffer6 = (char *)malloc(size2); // BAD [NOT DETECTED]
+	char *buffer6 = (char *)malloc(size2); // $ MISSING: Alert // $ MISSING: Alert // BAD [NOT DETECTED]


Suggested change

char *buffer6 = (char *)malloc(size2); // $ MISSING: Alert // $ MISSING: Alert // BAD [NOT DETECTED]

char *buffer6 = (char *)malloc(size2); // $ MISSING: Alert // BAD [NOT DETECTED]

jketema · 2026-07-07T12:38:37Z

+	curl_easy_setopt(curl.get(), CURLOPT_SSL_VERIFYPEER, 0); // $ Alert
+	curl_easy_setopt(curl.get(), CURLOPT_SSL_VERIFYHOST, 0);  // $ Alert


Suggested change

curl_easy_setopt(curl.get(), CURLOPT_SSL_VERIFYPEER, 0); // $ Alert

curl_easy_setopt(curl.get(), CURLOPT_SSL_VERIFYHOST, 0); // $ Alert

curl_easy_setopt(curl.get(), CURLOPT_SSL_VERIFYPEER, 0); // $ Alert

curl_easy_setopt(curl.get(), CURLOPT_SSL_VERIFYHOST, 0); // $ Alert

jketema · 2026-07-07T12:52:30Z


    // GOOD [FALSE POSITIVE]
-    printf("%d%d"
+    printf("%d%d" // $ Alert[cpp/wrong-number-format-arguments]


Suggested change

printf("%d%d" // $ Alert[cpp/wrong-number-format-arguments]

printf("%d%d" // $ SPURIOUS: Alert[cpp/wrong-number-format-arguments]

jketema · 2026-07-07T12:54:19Z

@@ -12,5 +12,5 @@ void test_PRI_macros() {
 	printf("my_u64 = %" PRIu64 "\n", my_u64); // GOOD
 	printf("my_u64 = %" PRIx64 "\n", my_u64); // GOOD
 	printf("my_u64 = %" PRIi64 "\n", my_u64); // BAD: uint64_t read as int64_t [NOT DETECTED]


Suggested change

printf("my_u64 = %" PRIi64 "\n", my_u64); // BAD: uint64_t read as int64_t [NOT DETECTED]

printf("my_u64 = %" PRIi64 "\n", my_u64); // $ MISSING: Alert // BAD: uint64_t read as int64_t [NOT DETECTED]

There might be more of these, but this is clearly best-effort, so no need to go looking for more.

jketema · 2026-07-07T12:55:12Z

@@ -12,5 +12,5 @@ void test_PRI_macros() {
 	printf("my_u64 = %" PRIu64 "\n", my_u64); // GOOD
 	printf("my_u64 = %" PRIx64 "\n", my_u64); // GOOD
 	printf("my_u64 = %" PRIi64 "\n", my_u64); // BAD: uint64_t read as int64_t [NOT DETECTED]


Suggested change

printf("my_u64 = %" PRIi64 "\n", my_u64); // BAD: uint64_t read as int64_t [NOT DETECTED]

printf("my_u64 = %" PRIi64 "\n", my_u64); // $ MISSING: Alert // BAD: uint64_t read as int64_t [NOT DETECTED]

jketema · 2026-07-07T12:55:47Z

@@ -12,5 +12,5 @@ void test_PRI_macros() {
 	printf("my_u64 = %" PRIu64 "\n", my_u64); // GOOD
 	printf("my_u64 = %" PRIx64 "\n", my_u64); // GOOD
 	printf("my_u64 = %" PRIi64 "\n", my_u64); // BAD: uint64_t read as int64_t [NOT DETECTED]


Suggested change

printf("my_u64 = %" PRIi64 "\n", my_u64); // BAD: uint64_t read as int64_t [NOT DETECTED]

printf("my_u64 = %" PRIi64 "\n", my_u64); // $ MISSING: Alert // BAD: uint64_t read as int64_t [NOT DETECTED]

jketema · 2026-07-07T12:56:22Z

@@ -12,5 +12,5 @@ void test_PRI_macros() {
 	printf("my_u64 = %" PRIu64 "\n", my_u64); // GOOD
 	printf("my_u64 = %" PRIx64 "\n", my_u64); // GOOD
 	printf("my_u64 = %" PRIi64 "\n", my_u64); // BAD: uint64_t read as int64_t [NOT DETECTED]


Suggested change

printf("my_u64 = %" PRIi64 "\n", my_u64); // BAD: uint64_t read as int64_t [NOT DETECTED]

printf("my_u64 = %" PRIi64 "\n", my_u64); // $ MISSING: Alert // BAD: uint64_t read as int64_t [NOT DETECTED]

jketema

Final few comments.

I also came across a few lines that now look like:

... // $ ... // $ ...

So two inline expectations. Those probably need to be fixed up too, nut it seems more effective to find those through a grep on the codebase than me flagging them up here.

jketema · 2026-07-07T13:22:43Z

+    // $ MISSING: Alert // BAD -- Not allocating space for '\0' terminator [NOT DETECTED]
    char *buffer = (char *)malloc(strlen(str));


Suggested change

// $ MISSING: Alert // BAD -- Not allocating space for '\0' terminator [NOT DETECTED]

char *buffer = (char *)malloc(strlen(str));

// BAD -- Not allocating space for '\0' terminator [NOT DETECTED]

char *buffer = (char *)malloc(strlen(str)); // $ MISSING: Alert

jketema · 2026-07-07T13:23:19Z

+    // $ MISSING: Alert // BAD -- Not allocating space for '\0' terminator [NOT DETECTED]
    wchar_t *buffer = (wchar_t *)calloc(wcslen(str), sizeof(wchar_t));


Suggested change

// $ MISSING: Alert // BAD -- Not allocating space for '\0' terminator [NOT DETECTED]

wchar_t *buffer = (wchar_t *)calloc(wcslen(str), sizeof(wchar_t));

// BAD -- Not allocating space for '\0' terminator [NOT DETECTED]

wchar_t *buffer = (wchar_t *)calloc(wcslen(str), sizeof(wchar_t)); // $ MISSING: Alert

jketema · 2026-07-07T14:18:42Z

+     // $ MISSING: Alert // BAD (requires pointer analysis to catch) [NOT DETECTED]
     const char** userp = &currentUser;
     *userp = userName;
     if (!strcmp(currentUser, "admin")) {


Suggested change

// $ MISSING: Alert // BAD (requires pointer analysis to catch) [NOT DETECTED]

const char** userp = &currentUser;

*userp = userName;

if (!strcmp(currentUser, "admin")) {

// BAD (requires pointer analysis to catch) [NOT DETECTED]

const char** userp = &currentUser;

*userp = userName;

if (!strcmp(currentUser, "admin")) { // $ MISSING: Alert

github-actions Bot added the C++ label Jul 5, 2026

owen-mc force-pushed the cpp/convert-qlref-inline-expectations branch 2 times, most recently from 24aac89 to e1753ae Compare July 6, 2026 11:34

owen-mc marked this pull request as ready for review July 7, 2026 08:16

owen-mc requested a review from a team as a code owner July 7, 2026 08:16

Copilot AI review requested due to automatic review settings July 7, 2026 08:16

Copilot started reviewing on behalf of owen-mc July 7, 2026 08:16 View session

owen-mc marked this pull request as draft July 7, 2026 08:19

Copilot AI reviewed Jul 7, 2026

owen-mc added 3 commits July 7, 2026 09:49

C++: Convert qlref tests to inline expectations

a2c5d4c

Add SPURIOUS: tags

843ac7c

Add MISSING: tag

76d8ae8

owen-mc force-pushed the cpp/convert-qlref-inline-expectations branch from e1753ae to 76d8ae8 Compare July 7, 2026 09:59

Fix comments in one test

fa16728

owen-mc marked this pull request as ready for review July 7, 2026 12:31

owen-mc requested a review from jketema July 7, 2026 12:32

jketema reviewed Jul 7, 2026

View reviewed changes

	unsafe_put_user(123, &p); // $ MISSING: Alert // $ MISSING: Alert // BAD [NOT DETECTED]
	unsafe_put_user(123, &p); // $ MISSING: Alert // BAD [NOT DETECTED]

	unsafe_put_user(123, &v); // $ MISSING: Alert // $ MISSING: Alert // BAD [NOT DETECTED]
	unsafe_put_user(123, &v); // $ MISSING: Alert // BAD [NOT DETECTED]

	unsafe_put_user(123, &(myData.x)); // $ MISSING: Alert // $ MISSING: Alert // BAD [NOT DETECTED]
	unsafe_put_user(123, &(myData.x)); // $ MISSING: Alert // BAD [NOT DETECTED]

	char buffer6 = (char )malloc(size2); // $ MISSING: Alert // $ MISSING: Alert // BAD [NOT DETECTED]
	char buffer6 = (char )malloc(size2); // $ MISSING: Alert // BAD [NOT DETECTED]

		curl_easy_setopt(curl.get(), CURLOPT_SSL_VERIFYPEER, 0); // $ Alert
		curl_easy_setopt(curl.get(), CURLOPT_SSL_VERIFYHOST, 0); // $ Alert

	printf("%d%d" // $ Alert[cpp/wrong-number-format-arguments]
	printf("%d%d" // $ SPURIOUS: Alert[cpp/wrong-number-format-arguments]

	printf("my_u64 = %" PRIi64 "\n", my_u64); // BAD: uint64_t read as int64_t [NOT DETECTED]
	printf("my_u64 = %" PRIi64 "\n", my_u64); // $ MISSING: Alert // BAD: uint64_t read as int64_t [NOT DETECTED]

		// $ MISSING: Alert // BAD -- Not allocating space for '\0' terminator [NOT DETECTED]
		char buffer = (char )malloc(strlen(str));

		// $ MISSING: Alert // BAD -- Not allocating space for '\0' terminator [NOT DETECTED]
		wchar_t buffer = (wchar_t )calloc(wcslen(str), sizeof(wchar_t));

Uh oh!

Conversation

owen-mc commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

owen-mc commented Jul 6, 2026 • edited by codeql-ci Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

owen-mc commented Jul 7, 2026 • edited by codeql-ci Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

jketema commented Jul 7, 2026

Uh oh!

jketema left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jketema left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jketema Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jketema Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

owen-mc commented Jul 5, 2026 •

edited

Loading

owen-mc commented Jul 6, 2026 •

edited by codeql-ci

Loading

owen-mc commented Jul 7, 2026 •

edited by codeql-ci

Loading

jketema left a comment •

edited

Loading

jketema Jul 7, 2026 •

edited

Loading

jketema Jul 7, 2026 •

edited

Loading