Re: [edk2-devel] [PATCH v4 7/8] BaseTools/Plugin/CodeQL: Enable 30 queries

["Sean" <spbrogan@outlook.com>]

Reviewed-by: Sean Brogan <sean.brogan@microsoft.com>

On 11/2/2023 1:03 PM, Michael Kubacki wrote:
> From: Michael Kubacki <michael.kubacki@microsoft.com>
>
> Updates the CodeQL queries opted into by edk2 to a set of queries from
> the standard CodeQL query package `codeql/cpp-queries`.
>
> After testing a large number of queries the included set here were
> found to be the most useful with the least number of false positives.
> Some queries had a number of issues that led to them being placed on
> the exclusion list so that they are not considered in the future
> without the notes there being taken into account.
>
> General details about queries available in the pack are available here:
> https://codeql.github.com/codeql-query-help/cpp/
>
> The issues found by these queries will need to be fixed over time. In
> the meantime, the results will show to those that have permission in
> the repo's GitHub Code Scanning area. The build will not fail due to
> CodeQL issues (since they are not all fixed) but that can be enabled in
> the future.
>
> Cc: Bob Feng <bob.c.feng@intel.com>
> Cc: Liming Gao <gaoliming@byosoft.com.cn>
> Cc: Michael D Kinney <michael.d.kinney@intel.com>
> Cc: Rebecca Cran <rebecca@bsdio.com>
> Cc: Sean Brogan <sean.brogan@microsoft.com>
> Cc: Yuwei Chen <yuwei.chen@intel.com>
> Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
> Acked-by: Michael D Kinney <michael.d.kinney@intel.com>
> ---
>   BaseTools/Plugin/CodeQL/CodeQlQueries.qls | 57 +++++++++++++++++---
>   1 file changed, 50 insertions(+), 7 deletions(-)
>
> diff --git a/BaseTools/Plugin/CodeQL/CodeQlQueries.qls b/BaseTools/Plugin/CodeQL/CodeQlQueries.qls
> index 3f97bcd583d5..1a5098322193 100644
> --- a/BaseTools/Plugin/CodeQL/CodeQlQueries.qls
> +++ b/BaseTools/Plugin/CodeQL/CodeQlQueries.qls
> @@ -8,28 +8,71 @@
>   # Queries
>   ##########################################################################################
>   
> -## Enable When Time is Available to Fix Issues
> -# Hundreds of issues. Most appear valid. Type: Recommendation.
> -#- include:
> -#    id: cpp/missing-null-test
> -
>   ## Errors
>   - include:
> -    id: cpp/overrunning-write
> +    id: cpp/badoverflowguard
>   - include:
> -    id: cpp/overrunning-write-with-float
> +    id: cpp/infiniteloop
> +- include:
> +    id: cpp/likely-bugs/memory-management/v2/conditionally-uninitialized-variable
> +- include:
> +    id: cpp/missing-null-test
> +- include:
> +    id: cpp/missing-return
> +- include:
> +    id: cpp/no-space-for-terminator
>   - include:
>       id: cpp/pointer-overflow-check
> +- include:
> +    id: cpp/redundant-null-check-simple
> +- include:
> +    id: cpp/sizeof/const-int-argument
> +- include:
> +    id: cpp/sizeof/sizeof-or-operation-as-argument
> +- include:
> +    id: cpp/unguardednullreturndereferenc
>   - include:
>       id: cpp/very-likely-overrunning-write
>   
>   ## Warnings
> +- include:
> +    id: cpp/comparison-with-wider-type
>   - include:
>       id: cpp/conditionallyuninitializedvariable
> +- include:
> +    id: cpp/comparison-precedence
> +- include:
> +    id: cpp/implicit-bitfield-downcast
>   - include:
>       id: cpp/infinite-loop-with-unsatisfiable-exit-condition
> +- include:
> +    id: cpp/offset-use-before-range-check
>   - include:
>       id: cpp/overflow-buffer
> +- include:
> +    id: cpp/overflow-calculated
> +- include:
> +    id: cpp/overflow-destination
> +- include:
> +    id: cpp/paddingbyteinformationdisclosure
> +- include:
> +    id: cpp/return-stack-allocated-memory
> +- include:
> +    id: cpp/static-buffer-overflow
> +- include:
> +    id: cpp/unsigned-comparison-zero
> +- include:
> +    id: cpp/uselesstest
> +
> +## Recommendations
> +- include:
> +    id: cpp/missing-header-guard
> +- include:
> +    id: cpp/unused-local-variable
> +- include:
> +    id: cpp/unused-static-function
> +- include:
> +    id: cpp/unused-static-variable
>   
>   # Note: Some queries above are not active by default with the below filter.
>   #       Update the filter and run the queries again to get all results.


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#110774): https://edk2.groups.io/g/devel/message/110774
Mute This Topic: https://groups.io/mt/102350798/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-