Description

In this repo there are a handful of old-style "lgtm" suppressions for issues raised by CodeQL. As we use it at Microsoft in internal tooling for Time Travel Debugging, this code goes through internal security scanning, and this issue was raised up with these suppressions.

The policy that was violated requires having a justification on all such suppressions. This justification needs to use the new format \\ CodeQL[id] Justification goes here which needs to be in its own line just above the line that had the issue. And the justification needs to be at least 25 characters long.

The issue we're having is specifically with lexer.hpp:

    token_type scan_number()  // lgtm [cpp/use-of-goto]

A possible solution (untested as I write this - I can't run the policy scan locally):

    // CodeQL [cpp/use-of-goto] `goto` is used here safely to implement a simple lexer's winding control flow
    token_type scan_number()

That might not be the best justification. Ideally this would be provided by the person who wrote the scan_number function.

Note that I failed to find any actual documentation for the format of CodeQL suppressions. I opened an issue there too: microsoft/codeql#63

Reproduction steps

This seems to be a new internal security policy over here, so I don't particularly have repro steps to give.

Expected vs. actual results

Expected: we can use this wonderful library without triggering security policies.
Actual: we trigger a security policy.

Minimal code example

No response

Error messages

No response

Compiler and operating system

Microsoft Visual C++, Visual Studio 2022 17.10, C++20

Library version

Used via vcpkg, with commit 0ca0fe433eb70cea0d5761079c0c5b47b736565b

Validation

• The bug also occurs if the latest version from the develop branch is used.
• I can successfully compile and run the unit tests.