Skip to content

Commit 114d337

Browse files
authored
Merge pull request github#11421 from github/felicitymay-8441-query-guides-c
LGTM deprecation: updates to CodeQL for C/C++ articles
2 parents ae40b0a + 85961f5 commit 114d337

8 files changed

+9
-33
lines changed

docs/codeql/codeql-language-guides/codeql-for-cpp.rst

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ Experiment and learn how to write effective and efficient queries for CodeQL dat
2121
hash-consing-and-value-numbering
2222

2323

24-
- :doc:`Basic query for C and C++ code <basic-query-for-cpp-code>`: Learn to write and run a simple CodeQL query using LGTM.
24+
- :doc:`Basic query for C and C++ code <basic-query-for-cpp-code>`: Learn to write and run a simple CodeQL query.
2525

2626
- :doc:`CodeQL library for C and C++ <codeql-library-for-cpp>`: When analyzing C or C++ code, you can use the large collection of classes in the CodeQL library for C and C++.
2727

docs/codeql/codeql-language-guides/codeql-for-csharp.rst

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ Experiment and learn how to write effective and efficient queries for CodeQL dat
1212
codeql-library-for-csharp
1313
analyzing-data-flow-in-csharp
1414

15-
- :doc:`Basic query for C# code <basic-query-for-csharp-code>`: Learn to write and run a simple CodeQL query using LGTM.
15+
- :doc:`Basic query for C# code <basic-query-for-csharp-code>`: Learn to write and run a simple CodeQL query.
1616

1717
- :doc:`CodeQL library for C# <codeql-library-for-csharp>`: When you're analyzing a C# program, you can make use of the large collection of classes in the CodeQL library for C#.
1818

docs/codeql/codeql-language-guides/codeql-for-go.rst

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ Experiment and learn how to write effective and efficient queries for CodeQL dat
1313
abstract-syntax-tree-classes-for-working-with-go-programs
1414
modeling-data-flow-in-go-libraries
1515

16-
- :doc:`Basic query for Go code <basic-query-for-go-code>`: Learn to write and run a simple CodeQL query using LGTM.
16+
- :doc:`Basic query for Go code <basic-query-for-go-code>`: Learn to write and run a simple CodeQL query.
1717

1818
- :doc:`CodeQL library for Go <codeql-library-for-go>`: When you're analyzing a Go program, you can make use of the large collection of classes in the CodeQL library for Go.
1919

docs/codeql/codeql-language-guides/codeql-for-ruby.rst

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ Experiment and learn how to write effective and efficient queries for CodeQL dat
1414
analyzing-data-flow-in-ruby
1515
using-api-graphs-in-ruby
1616

17-
- :doc:`Basic query for Ruby code <basic-query-for-ruby-code>`: Learn to write and run a simple CodeQL query using LGTM.
17+
- :doc:`Basic query for Ruby code <basic-query-for-ruby-code>`: Learn to write and run a simple CodeQL query.
1818

1919
- :doc:`CodeQL library for Ruby <codeql-library-for-ruby>`: When you're analyzing a Ruby program, you can make use of the large collection of classes in the CodeQL library for Ruby.
2020

docs/codeql/codeql-language-guides/conversions-and-classes-in-cpp.rst

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -165,8 +165,6 @@ Our starting point for the query is pairs of a base class and a derived class, c
165165
where derived.getABaseClass+() = base
166166
select base, derived, "The second class is derived from the first."
167167
168-
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505902347211/>`__
169-
170168
Note that the transitive closure symbol ``+`` indicates that ``Class.getABaseClass()`` may be followed one or more times, rather than only accepting a direct base class.
171169

172170
A lot of the results are uninteresting template parameters. You can remove those results by updating the ``where`` clause as follows:
@@ -177,8 +175,6 @@ A lot of the results are uninteresting template parameters. You can remove those
177175
and not exists(base.getATemplateArgument())
178176
and not exists(derived.getATemplateArgument())
179177
180-
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505907047251/>`__
181-
182178
Finding derived classes with destructors
183179
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
184180

@@ -196,8 +192,6 @@ Now we can extend the query to find derived classes with destructors, using the
196192
and d2 = derived.getDestructor()
197193
select base, derived, "The second class is derived from the first, and both have a destructor."
198194
199-
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505901767389/>`__
200-
201195
Notice that getting the destructor implicitly asserts that one exists. As a result, this version of the query returns fewer results than before.
202196

203197
Finding base classes where the destructor is not virtual
@@ -216,11 +210,9 @@ Our last change is to use ``Function.isVirtual()`` to find cases where the base
216210
and not d1.isVirtual()
217211
select d1, "This destructor should probably be virtual."
218212
219-
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505908156827/>`__
220-
221213
That completes the query.
222214

223-
There is a similar built-in `query <https://lgtm.com/rules/2158670642/>`__ on LGTM.com that finds classes in a C/C++ project with virtual functions but no virtual destructor. You can take a look at the code for this query by clicking **Open in query console** at the top of that page.
215+
There is a similar standard query `Non-virtual destructor in base class <https://codeql.github.com/codeql-query-help/cpp/cpp-virtual-destructor/>`__ that finds classes in a C/C++ project with virtual functions but no virtual destructor.
224216

225217
Further reading
226218
---------------

docs/codeql/codeql-language-guides/expressions-types-and-statements-in-cpp.rst

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,6 @@ In the following example we find instances of ``AssignExpr`` which assign the co
2323
where e.getRValue().getValue().toInt() = 0
2424
select e, "Assigning the value 0 to something."
2525
26-
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505908086530/>`__
27-
2826
The ``where`` clause in this example gets the expression on the right side of the assignment, ``getRValue()``, and compares it with zero. Notice that there are no checks to make sure that the right side of the assignment is an integer or that it has a value (that is, it is compile-time constant, rather than a variable). For expressions where either of these assumptions is wrong, the associated predicate simply does not return anything and the ``where`` clause will not produce a result. You could think of it as if there is an implicit ``exists(e.getRValue().getValue().toInt())`` at the beginning of this line.
2927

3028
It is also worth noting that the query above would find this C code:
@@ -33,7 +31,7 @@ It is also worth noting that the query above would find this C code:
3331
3432
yPtr = NULL;
3533
36-
This is because the database contains a representation of the code base after the preprocessor transforms have run. This means that any macro invocations, such as the ``NULL`` define used here, are expanded during the creation of the database. If you want to write queries about macros then there are some special library classes that have been designed specifically for this purpose (for example, the ``Macro``, ``MacroInvocation`` classes and predicates like ``Element.isInMacroExpansion()``). In this case, it is good that macros are expanded, but we do not want to find assignments to pointers. For more information, see `Database generation <https://lgtm.com/help/lgtm/generate-database>`__ on LGTM.com.
34+
This is because the database contains a representation of the code base after the preprocessor transforms have run. This means that any macro invocations, such as the ``NULL`` define used here, are expanded during the creation of the database. If you want to write queries about macros then there are some special library classes that have been designed specifically for this purpose (for example, the ``Macro``, ``MacroInvocation`` classes and predicates like ``Element.isInMacroExpansion()``). In this case, it is good that macros are expanded, but we do not want to find assignments to pointers. For more information, see `Database creation <https://codeql.github.com/docs/codeql-overview/about-codeql/#database-creation>`__.
3735

3836
Finding assignments of 0 to an integer
3937
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -49,8 +47,6 @@ We can make the query more specific by defining a condition for the left side of
4947
and e.getLValue().getType().getUnspecifiedType() instanceof IntegralType
5048
select e, "Assigning the value 0 to an integer."
5149
52-
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505906986578/>`__
53-
5450
This checks that the left side of the assignment has a type that is some kind of integer. Note the call to ``Type.getUnspecifiedType()``. This resolves ``typedef`` types to their underlying types so that the query finds assignments like this one:
5551

5652
.. code-block:: cpp
@@ -109,8 +105,6 @@ Unfortunately this would not quite work, because the loop initialization is actu
109105
and e.getLValue().getType().getUnspecifiedType() instanceof IntegralType
110106
select e, "Assigning the value 0 to an integer, inside a for loop initialization."
111107
112-
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505909016965/>`__
113-
114108
Finding assignments of 0 within the loop body
115109
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
116110

@@ -127,8 +121,6 @@ We can find assignments inside the loop body using similar code with the predica
127121
and e.getLValue().getType().getUnderlyingType() instanceof IntegralType
128122
select e, "Assigning the value 0 to an integer, inside a for loop body."
129123
130-
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505901437190/>`__
131-
132124
Note that we replaced ``e.getEnclosingStmt()`` with ``e.getEnclosingStmt().getParentStmt*()``, to find an assignment expression that is deeply nested inside the loop body. The transitive closure modifier ``*`` here indicates that ``Stmt.getParentStmt()`` may be followed zero or more times, rather than just once, giving us the statement, its parent statement, its parent's parent statement etc.
133125

134126
Further reading

docs/codeql/codeql-language-guides/functions-in-cpp.rst

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,6 @@ It might be more interesting to find functions that are not called, using the st
4040
where not exists(FunctionCall fc | fc.getTarget() = f)
4141
select f, "This function is never called."
4242
43-
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505891246456/>`__
44-
4543
The new query finds functions that are not the target of any ``FunctionCall``—in other words, functions that are never called. You may be surprised by how many results the query finds. However, if you examine the results, you can see that many of the functions it finds are used indirectly. To create a query that finds only unused functions, we need to refine the query and exclude other ways of using a function.
4644

4745
Excluding functions that are referenced with a function pointer
@@ -58,13 +56,11 @@ You can modify the query to remove functions where a function pointer is used to
5856
and not exists(FunctionAccess fa | fa.getTarget() = f)
5957
select f, "This function is never called, or referenced with a function pointer."
6058
61-
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505890446605/>`__
62-
6359
This query returns fewer results. However, if you examine the results then you can probably still find potential refinements.
6460

65-
For example, there is a more complicated LGTM `query <https://lgtm.com/rules/2152580467/>`__ that finds unused static functions. To see the code for this query, click **Open in query console** at the top of the page.
61+
For example, there is a more complicated standard query, `Unused static function <https://codeql.github.com/codeql-query-help/cpp/cpp-unused-static-function/>`__, that finds unused static functions.
6662

67-
You can explore the definition of an element in the standard libraries and see what predicates are available. Use the keyboard **F3** button to open the definition of any element. Alternatively, hover over the element and click **Jump to definition** in the tooltip displayed. The library file is opened in a new tab with the definition highlighted.
63+
You can explore the definition of an element in the standard libraries and see what predicates are available. Right-click the element to display the context menu, and click **Go to Definition**. The library file is opened in a new tab with the definition of the element highlighted.
6864

6965
Finding a specific function
7066
---------------------------
@@ -80,16 +76,14 @@ This query uses ``Function`` and ``FunctionCall`` to find calls to the function
8076
and not fc.getArgument(1) instanceof StringLiteral
8177
select fc, "sprintf called with variable format string."
8278
83-
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505889506751/>`__
84-
8579
This uses:
8680

8781
- ``Declaration.getQualifiedName()`` to identify calls to the specific function ``sprintf``.
8882
- ``FunctionCall.getArgument(1)`` to fetch the format string argument.
8983

9084
Note that we could have used ``Declaration.getName()``, but ``Declaration.getQualifiedName()`` is a better choice because it includes the namespace. For example: ``getName()`` would return ``vector`` where ``getQualifiedName`` would return ``std::vector``.
9185

92-
The LGTM version of this query is considerably more complicated, but if you look carefully you will find that its structure is the same. See `Non-constant format string <https://lgtm.com/rules/2152810612/>`__ and click **Open in query console** at the top of the page.
86+
The published version of this query is considerably more complicated, but if you look carefully you will find that its structure is the same. See `Non-constant format string <https://codeql.github.com/codeql-query-help/cpp/cpp-non-constant-format/>`__.
9387

9488
Further reading
9589
---------------

docs/codeql/codeql-language-guides/refining-a-query-to-account-for-edge-cases.rst

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -146,8 +146,6 @@ Finally we can simplify the query by using the transitive closure operator. In t
146146
and exists(c.getBlock())
147147
select c, "Constructor does not initialize fields $@.", f, f.getName()
148148
149-
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505896968215/>`__
150-
151149
Further reading
152150
---------------
153151

0 commit comments

Comments
 (0)