Want way to audit C/C++ code against CERT-PRE01-C

[ryao]

I do not see any way to use the macro library to write a query that finds violations of CERT-PRE01-C:

https://wiki.sei.cmu.edu/confluence/display/c/PRE01-C.+Use+parentheses+within+macros+around+parameter+names

https://codeql.github.com/codeql-standard-libraries/cpp/semmle/code/cpp/Macro.qll/module.Macro.html

An example of a violation would be #define DOUBLE(x) 2 * x, which does not parenthesize x, such that DOUBLE(1 + 1) would be 3 rather than 4.

CodeQL is powerful enough to check for the analog in functions, although doing so is pointless:

/**
 * @name Unparenthesized function parameter usage
 * @description Finds instances where function parameters are used without parentheses in the function body.
 * @kind problem
 * @severity recommendation
 * @id cpp/unparenthesized-function-parameter-usage
 */

import cpp

from Parameter param, VariableAccess va, Function f
where
  f = param.getFunction() and
  va.getTarget() = param and
  va.getEnclosingFunction() = f and
  not va.getParent() instanceof ParenthesisExpr
select va, "The parameter '" + param.getName() + "' is used without parentheses in the function '" + f.getName() + "'."

I cannot figure out how to do the equivalent for macros. Is there is no way or did I miss something?

[ginsbach]

You are not missing something: there are no VariableAccess, Parameter, etc syntax nodes within macros. This is because macros in C/C++ code are textually replaced by the preprocessor and therefore are not fully represented in the AST.

However, you do have access to getHead() and getBody() methods on Macro, both of which return raw strings. You should be able to get your desired result with some regexes along these lines:

from string param, int accessOffset, Macro f
where
  // split the signature of the macro to get the parameter names
  param = f.getHead().splitAt("(", 1).splitAt(")", 0).splitAt(",").trim() and
  // check with regex whether the parameter name occurs without parentheses
  exists(
    f.getBody()
        .regexpFind("(^|[^a-zA-Z0-9_\\(]\\s*)" + param + "\\s*($|[^a-zA-Z0-9_\\)])", _, accessOffset)
  )
select f,
  "The parameter '" + param + "' is used without parentheses in the macro '" + f.getName() + "'."