Add basic single translation unit query suites #60
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR adds two new query suites for C++,
autosar-single-translation-unit.qls
andcert-single-translation-unit.qls
which are used to run queries which do not require a whole program analysis. Specifically, they can be run on a database representing a single compilation (i.e. translation unit) without introducing new false positives compared to a whole program analysis.To enable this information to be stored with the metadata for each query, I have added a new tag
scope/single-translation-unit
. In addition, I anticipate adding another tagscope/system
for queries which are confirmed as requiring a system wide program analysis. The terminology is copied from MISRA C 2012, which already specifies the scope for each rule.Unfortunately CERT C++ and AUTOSAR C++ do not provide such scoping information, so we will need to review queries individually to determine which are assigned to each scope. For the initial release of this query suite I have reviewed the following rule packages:
BannedFunctions
BannedLibraries
BannedSyntax
BannedTypes
I choose these packages as I believed they had a high likelihood of being single-translation-unit suitable. As it turned out, all 49 of the queries in these packages were
scope/single-translation-unit
.We will review additional rule packages in future releases to expand the set of queries included in this suite.
Change request type
.ql
,.qll
,.qls
or unit tests)Rules with added or modified queries
Release change checklist
A change note (development_handbook.md#change-notes) is required for any pull request which modifies:
If you are only adding new rule queries, a change note is not required.
Author: Is a change note required?
Reviewer: Confirm that either a change note is not required or the change note is required and has been added.
Query development review checklist
For PRs that add new queries or modify existing queries, the following checklist should be completed by both the author and reviewer:
Author
As a rule of thumb, predicates specific to the query should take no more than 1 minute, and for simple queries be under 10 seconds. If this is not the case, this should be highlighted and agreed in the code review process.
Reviewer
As a rule of thumb, predicates specific to the query should take no more than 1 minute, and for simple queries be under 10 seconds. If this is not the case, this should be highlighted and agreed in the code review process.