You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/codeql/codeql-language-guides/codeql-for-cpp.rst
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -21,7 +21,7 @@ Experiment and learn how to write effective and efficient queries for CodeQL dat
21
21
hash-consing-and-value-numbering
22
22
23
23
24
-
- :doc:`Basic query for C and C++ code <basic-query-for-cpp-code>`: Learn to write and run a simple CodeQL query using LGTM.
24
+
- :doc:`Basic query for C and C++ code <basic-query-for-cpp-code>`: Learn to write and run a simple CodeQL query.
25
25
26
26
- :doc:`CodeQL library for C and C++ <codeql-library-for-cpp>`: When analyzing C or C++ code, you can use the large collection of classes in the CodeQL library for C and C++.
Copy file name to clipboardExpand all lines: docs/codeql/codeql-language-guides/codeql-for-csharp.rst
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,7 +12,7 @@ Experiment and learn how to write effective and efficient queries for CodeQL dat
12
12
codeql-library-for-csharp
13
13
analyzing-data-flow-in-csharp
14
14
15
-
- :doc:`Basic query for C# code <basic-query-for-csharp-code>`: Learn to write and run a simple CodeQL query using LGTM.
15
+
- :doc:`Basic query for C# code <basic-query-for-csharp-code>`: Learn to write and run a simple CodeQL query.
16
16
17
17
- :doc:`CodeQL library for C# <codeql-library-for-csharp>`: When you're analyzing a C# program, you can make use of the large collection of classes in the CodeQL library for C#.
- :doc:`Basic query for Go code <basic-query-for-go-code>`: Learn to write and run a simple CodeQL query using LGTM.
16
+
- :doc:`Basic query for Go code <basic-query-for-go-code>`: Learn to write and run a simple CodeQL query.
17
17
18
18
- :doc:`CodeQL library for Go <codeql-library-for-go>`: When you're analyzing a Go program, you can make use of the large collection of classes in the CodeQL library for Go.
Copy file name to clipboardExpand all lines: docs/codeql/codeql-language-guides/codeql-for-ruby.rst
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,7 +14,7 @@ Experiment and learn how to write effective and efficient queries for CodeQL dat
14
14
analyzing-data-flow-in-ruby
15
15
using-api-graphs-in-ruby
16
16
17
-
- :doc:`Basic query for Ruby code <basic-query-for-ruby-code>`: Learn to write and run a simple CodeQL query using LGTM.
17
+
- :doc:`Basic query for Ruby code <basic-query-for-ruby-code>`: Learn to write and run a simple CodeQL query.
18
18
19
19
- :doc:`CodeQL library for Ruby <codeql-library-for-ruby>`: When you're analyzing a Ruby program, you can make use of the large collection of classes in the CodeQL library for Ruby.
Copy file name to clipboardExpand all lines: docs/codeql/codeql-language-guides/conversions-and-classes-in-cpp.rst
+1-9Lines changed: 1 addition & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -165,8 +165,6 @@ Our starting point for the query is pairs of a base class and a derived class, c
165
165
where derived.getABaseClass+() = base
166
166
select base, derived, "The second class is derived from the first."
167
167
168
-
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505902347211/>`__
169
-
170
168
Note that the transitive closure symbol ``+`` indicates that ``Class.getABaseClass()`` may be followed one or more times, rather than only accepting a direct base class.
171
169
172
170
A lot of the results are uninteresting template parameters. You can remove those results by updating the ``where`` clause as follows:
@@ -177,8 +175,6 @@ A lot of the results are uninteresting template parameters. You can remove those
177
175
and not exists(base.getATemplateArgument())
178
176
and not exists(derived.getATemplateArgument())
179
177
180
-
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505907047251/>`__
181
-
182
178
Finding derived classes with destructors
183
179
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
184
180
@@ -196,8 +192,6 @@ Now we can extend the query to find derived classes with destructors, using the
196
192
and d2 = derived.getDestructor()
197
193
select base, derived, "The second class is derived from the first, and both have a destructor."
198
194
199
-
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505901767389/>`__
200
-
201
195
Notice that getting the destructor implicitly asserts that one exists. As a result, this version of the query returns fewer results than before.
202
196
203
197
Finding base classes where the destructor is not virtual
@@ -216,11 +210,9 @@ Our last change is to use ``Function.isVirtual()`` to find cases where the base
216
210
and not d1.isVirtual()
217
211
select d1, "This destructor should probably be virtual."
218
212
219
-
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505908156827/>`__
220
-
221
213
That completes the query.
222
214
223
-
There is a similar built-in `query <https://lgtm.com/rules/2158670642/>`__ on LGTM.com that finds classes in a C/C++ project with virtual functions but no virtual destructor. You can take a look at the code for this query by clicking **Open in query console** at the top of that page.
215
+
There is a similar standard query `Non-virtual destructor in base class <https://codeql.github.com/codeql-query-help/cpp/cpp-virtual-destructor/>`__ that finds classes in a C/C++ project with virtual functions but no virtual destructor.
Copy file name to clipboardExpand all lines: docs/codeql/codeql-language-guides/expressions-types-and-statements-in-cpp.rst
+1-9Lines changed: 1 addition & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -23,8 +23,6 @@ In the following example we find instances of ``AssignExpr`` which assign the co
23
23
where e.getRValue().getValue().toInt() = 0
24
24
select e, "Assigning the value 0 to something."
25
25
26
-
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505908086530/>`__
27
-
28
26
The ``where`` clause in this example gets the expression on the right side of the assignment, ``getRValue()``, and compares it with zero. Notice that there are no checks to make sure that the right side of the assignment is an integer or that it has a value (that is, it is compile-time constant, rather than a variable). For expressions where either of these assumptions is wrong, the associated predicate simply does not return anything and the ``where`` clause will not produce a result. You could think of it as if there is an implicit ``exists(e.getRValue().getValue().toInt())`` at the beginning of this line.
29
27
30
28
It is also worth noting that the query above would find this C code:
@@ -33,7 +31,7 @@ It is also worth noting that the query above would find this C code:
33
31
34
32
yPtr = NULL;
35
33
36
-
This is because the database contains a representation of the code base after the preprocessor transforms have run. This means that any macro invocations, such as the ``NULL`` define used here, are expanded during the creation of the database. If you want to write queries about macros then there are some special library classes that have been designed specifically for this purpose (for example, the ``Macro``, ``MacroInvocation`` classes and predicates like ``Element.isInMacroExpansion()``). In this case, it is good that macros are expanded, but we do not want to find assignments to pointers. For more information, see `Database generation<https://lgtm.com/help/lgtm/generate-database>`__ on LGTM.com.
34
+
This is because the database contains a representation of the code base after the preprocessor transforms have run. This means that any macro invocations, such as the ``NULL`` define used here, are expanded during the creation of the database. If you want to write queries about macros then there are some special library classes that have been designed specifically for this purpose (for example, the ``Macro``, ``MacroInvocation`` classes and predicates like ``Element.isInMacroExpansion()``). In this case, it is good that macros are expanded, but we do not want to find assignments to pointers. For more information, see `Database creation<https://codeql.github.com/docs/codeql-overview/about-codeql/#database-creation>`__.
37
35
38
36
Finding assignments of 0 to an integer
39
37
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -49,8 +47,6 @@ We can make the query more specific by defining a condition for the left side of
49
47
and e.getLValue().getType().getUnspecifiedType() instanceof IntegralType
50
48
select e, "Assigning the value 0 to an integer."
51
49
52
-
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505906986578/>`__
53
-
54
50
This checks that the left side of the assignment has a type that is some kind of integer. Note the call to ``Type.getUnspecifiedType()``. This resolves ``typedef`` types to their underlying types so that the query finds assignments like this one:
55
51
56
52
.. code-block:: cpp
@@ -109,8 +105,6 @@ Unfortunately this would not quite work, because the loop initialization is actu
109
105
and e.getLValue().getType().getUnspecifiedType() instanceof IntegralType
110
106
select e, "Assigning the value 0 to an integer, inside a for loop initialization."
111
107
112
-
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505909016965/>`__
113
-
114
108
Finding assignments of 0 within the loop body
115
109
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
116
110
@@ -127,8 +121,6 @@ We can find assignments inside the loop body using similar code with the predica
127
121
and e.getLValue().getType().getUnderlyingType() instanceof IntegralType
128
122
select e, "Assigning the value 0 to an integer, inside a for loop body."
129
123
130
-
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505901437190/>`__
131
-
132
124
Note that we replaced ``e.getEnclosingStmt()`` with ``e.getEnclosingStmt().getParentStmt*()``, to find an assignment expression that is deeply nested inside the loop body. The transitive closure modifier ``*`` here indicates that ``Stmt.getParentStmt()`` may be followed zero or more times, rather than just once, giving us the statement, its parent statement, its parent's parent statement etc.
Copy file name to clipboardExpand all lines: docs/codeql/codeql-language-guides/functions-in-cpp.rst
+3-9Lines changed: 3 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -40,8 +40,6 @@ It might be more interesting to find functions that are not called, using the st
40
40
where not exists(FunctionCall fc | fc.getTarget() = f)
41
41
select f, "This function is never called."
42
42
43
-
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505891246456/>`__
44
-
45
43
The new query finds functions that are not the target of any ``FunctionCall``—in other words, functions that are never called. You may be surprised by how many results the query finds. However, if you examine the results, you can see that many of the functions it finds are used indirectly. To create a query that finds only unused functions, we need to refine the query and exclude other ways of using a function.
46
44
47
45
Excluding functions that are referenced with a function pointer
@@ -58,13 +56,11 @@ You can modify the query to remove functions where a function pointer is used to
58
56
and not exists(FunctionAccess fa | fa.getTarget() = f)
59
57
select f, "This function is never called, or referenced with a function pointer."
60
58
61
-
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505890446605/>`__
62
-
63
59
This query returns fewer results. However, if you examine the results then you can probably still find potential refinements.
64
60
65
-
For example, there is a more complicated LGTM `query<https://lgtm.com/rules/2152580467/>`__ that finds unused static functions. To see the code for this query, click **Open in query console** at the top of the page.
61
+
For example, there is a more complicated standard query, `Unused static function <https://codeql.github.com/codeql-query-help/cpp/cpp-unused-static-function/>`__, that finds unused static functions.
66
62
67
-
You can explore the definition of an element in the standard libraries and see what predicates are available. Use the keyboard **F3** button to open the definition of any element. Alternatively, hover over the element and click **Jump to definition** in the tooltip displayed. The library file is opened in a new tab with the definition highlighted.
63
+
You can explore the definition of an element in the standard libraries and see what predicates are available. Right-click the element to display the context menu, and click **Go to Definition**. The library file is opened in a new tab with the definition of the element highlighted.
68
64
69
65
Finding a specific function
70
66
---------------------------
@@ -80,16 +76,14 @@ This query uses ``Function`` and ``FunctionCall`` to find calls to the function
80
76
and not fc.getArgument(1) instanceof StringLiteral
81
77
select fc, "sprintf called with variable format string."
82
78
83
-
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505889506751/>`__
84
-
85
79
This uses:
86
80
87
81
- ``Declaration.getQualifiedName()`` to identify calls to the specific function ``sprintf``.
88
82
- ``FunctionCall.getArgument(1)`` to fetch the format string argument.
89
83
90
84
Note that we could have used ``Declaration.getName()``, but ``Declaration.getQualifiedName()`` is a better choice because it includes the namespace. For example: ``getName()`` would return ``vector`` where ``getQualifiedName`` would return ``std::vector``.
91
85
92
-
The LGTM version of this query is considerably more complicated, but if you look carefully you will find that its structure is the same. See `Non-constant format string <https://lgtm.com/rules/2152810612/>`__ and click **Open in query console** at the top of the page.
86
+
The published version of this query is considerably more complicated, but if you look carefully you will find that its structure is the same. See `Non-constant format string <https://codeql.github.com/codeql-query-help/cpp/cpp-non-constant-format/>`__.
0 commit comments