From 29208c9e087a6c2552650e941785a9c84ba78c1b Mon Sep 17 00:00:00 2001 From: "John L. Singleton" Date: Fri, 3 Mar 2023 11:07:32 -0500 Subject: [PATCH 1/3] fix compiler messages --- ...formFileOperationsOnDevices.expected.clang | 29 +++++++++++++++++++ ...erformFileOperationsOnDevices.expected.gcc | 29 +++++++++++++++++++ 2 files changed, 58 insertions(+) create mode 100644 c/cert/test/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.expected.clang create mode 100644 c/cert/test/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.expected.gcc diff --git a/c/cert/test/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.expected.clang b/c/cert/test/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.expected.clang new file mode 100644 index 0000000000..9eaacf30f4 --- /dev/null +++ b/c/cert/test/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.expected.clang @@ -0,0 +1,29 @@ +WARNING: Module TaintedWithPath has been deprecated and may be removed in future (/mnt/c/Projects/codeql-coding-standards/c/cert/src/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.ql:19,8-23) +edges +| test.c:20:15:20:23 | file_name | test.c:21:8:21:16 | (const char *)... | +| test.c:20:15:20:23 | file_name | test.c:21:8:21:16 | file_name | +| test.c:20:15:20:23 | file_name | test.c:21:8:21:16 | file_name indirection | +| test.c:20:15:20:23 | scanf output argument | test.c:21:8:21:16 | (const char *)... | +| test.c:20:15:20:23 | scanf output argument | test.c:21:8:21:16 | file_name | +| test.c:20:15:20:23 | scanf output argument | test.c:21:8:21:16 | file_name indirection | +| test.c:45:15:45:23 | file_name | test.c:46:29:46:37 | (LPCTSTR)... | +| test.c:45:15:45:23 | file_name | test.c:46:29:46:37 | file_name | +| test.c:45:15:45:23 | file_name | test.c:46:29:46:37 | file_name indirection | +| test.c:45:15:45:23 | scanf output argument | test.c:46:29:46:37 | (LPCTSTR)... | +| test.c:45:15:45:23 | scanf output argument | test.c:46:29:46:37 | file_name | +| test.c:45:15:45:23 | scanf output argument | test.c:46:29:46:37 | file_name indirection | +subpaths +nodes +| test.c:20:15:20:23 | file_name | semmle.label | file_name | +| test.c:20:15:20:23 | scanf output argument | semmle.label | scanf output argument | +| test.c:21:8:21:16 | (const char *)... | semmle.label | (const char *)... | +| test.c:21:8:21:16 | file_name | semmle.label | file_name | +| test.c:21:8:21:16 | file_name indirection | semmle.label | file_name indirection | +| test.c:45:15:45:23 | file_name | semmle.label | file_name | +| test.c:45:15:45:23 | scanf output argument | semmle.label | scanf output argument | +| test.c:46:29:46:37 | (LPCTSTR)... | semmle.label | (LPCTSTR)... | +| test.c:46:29:46:37 | file_name | semmle.label | file_name | +| test.c:46:29:46:37 | file_name indirection | semmle.label | file_name indirection | +#select +| test.c:21:8:21:16 | file_name | test.c:20:15:20:23 | file_name | test.c:21:8:21:16 | file_name | This argument to a file access function is derived from $@ and then passed to func(file_name), which calls fopen(__filename) | test.c:20:15:20:23 | file_name | user input (scanf) | +| test.c:46:29:46:37 | file_name | test.c:45:15:45:23 | file_name | test.c:46:29:46:37 | file_name | This argument to a file access function is derived from $@ and then passed to CreateFile(lpFileName) | test.c:45:15:45:23 | file_name | user input (scanf) | diff --git a/c/cert/test/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.expected.gcc b/c/cert/test/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.expected.gcc new file mode 100644 index 0000000000..9eaacf30f4 --- /dev/null +++ b/c/cert/test/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.expected.gcc @@ -0,0 +1,29 @@ +WARNING: Module TaintedWithPath has been deprecated and may be removed in future (/mnt/c/Projects/codeql-coding-standards/c/cert/src/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.ql:19,8-23) +edges +| test.c:20:15:20:23 | file_name | test.c:21:8:21:16 | (const char *)... | +| test.c:20:15:20:23 | file_name | test.c:21:8:21:16 | file_name | +| test.c:20:15:20:23 | file_name | test.c:21:8:21:16 | file_name indirection | +| test.c:20:15:20:23 | scanf output argument | test.c:21:8:21:16 | (const char *)... | +| test.c:20:15:20:23 | scanf output argument | test.c:21:8:21:16 | file_name | +| test.c:20:15:20:23 | scanf output argument | test.c:21:8:21:16 | file_name indirection | +| test.c:45:15:45:23 | file_name | test.c:46:29:46:37 | (LPCTSTR)... | +| test.c:45:15:45:23 | file_name | test.c:46:29:46:37 | file_name | +| test.c:45:15:45:23 | file_name | test.c:46:29:46:37 | file_name indirection | +| test.c:45:15:45:23 | scanf output argument | test.c:46:29:46:37 | (LPCTSTR)... | +| test.c:45:15:45:23 | scanf output argument | test.c:46:29:46:37 | file_name | +| test.c:45:15:45:23 | scanf output argument | test.c:46:29:46:37 | file_name indirection | +subpaths +nodes +| test.c:20:15:20:23 | file_name | semmle.label | file_name | +| test.c:20:15:20:23 | scanf output argument | semmle.label | scanf output argument | +| test.c:21:8:21:16 | (const char *)... | semmle.label | (const char *)... | +| test.c:21:8:21:16 | file_name | semmle.label | file_name | +| test.c:21:8:21:16 | file_name indirection | semmle.label | file_name indirection | +| test.c:45:15:45:23 | file_name | semmle.label | file_name | +| test.c:45:15:45:23 | scanf output argument | semmle.label | scanf output argument | +| test.c:46:29:46:37 | (LPCTSTR)... | semmle.label | (LPCTSTR)... | +| test.c:46:29:46:37 | file_name | semmle.label | file_name | +| test.c:46:29:46:37 | file_name indirection | semmle.label | file_name indirection | +#select +| test.c:21:8:21:16 | file_name | test.c:20:15:20:23 | file_name | test.c:21:8:21:16 | file_name | This argument to a file access function is derived from $@ and then passed to func(file_name), which calls fopen(__filename) | test.c:20:15:20:23 | file_name | user input (scanf) | +| test.c:46:29:46:37 | file_name | test.c:45:15:45:23 | file_name | test.c:46:29:46:37 | file_name | This argument to a file access function is derived from $@ and then passed to CreateFile(lpFileName) | test.c:45:15:45:23 | file_name | user input (scanf) | From 876eda1da284759623b5ef3d3c57f26f488d1513 Mon Sep 17 00:00:00 2001 From: "John L. Singleton" Date: Fri, 3 Mar 2023 11:32:19 -0500 Subject: [PATCH 2/3] fixes --- .../FIO32-C/DoNotPerformFileOperationsOnDevices.expected.clang | 2 -- .../FIO32-C/DoNotPerformFileOperationsOnDevices.expected.gcc | 2 -- 2 files changed, 4 deletions(-) diff --git a/c/cert/test/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.expected.clang b/c/cert/test/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.expected.clang index 9eaacf30f4..0e569b4d8a 100644 --- a/c/cert/test/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.expected.clang +++ b/c/cert/test/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.expected.clang @@ -1,5 +1,3 @@ -WARNING: Module TaintedWithPath has been deprecated and may be removed in future (/mnt/c/Projects/codeql-coding-standards/c/cert/src/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.ql:19,8-23) -edges | test.c:20:15:20:23 | file_name | test.c:21:8:21:16 | (const char *)... | | test.c:20:15:20:23 | file_name | test.c:21:8:21:16 | file_name | | test.c:20:15:20:23 | file_name | test.c:21:8:21:16 | file_name indirection | diff --git a/c/cert/test/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.expected.gcc b/c/cert/test/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.expected.gcc index 9eaacf30f4..0e569b4d8a 100644 --- a/c/cert/test/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.expected.gcc +++ b/c/cert/test/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.expected.gcc @@ -1,5 +1,3 @@ -WARNING: Module TaintedWithPath has been deprecated and may be removed in future (/mnt/c/Projects/codeql-coding-standards/c/cert/src/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.ql:19,8-23) -edges | test.c:20:15:20:23 | file_name | test.c:21:8:21:16 | (const char *)... | | test.c:20:15:20:23 | file_name | test.c:21:8:21:16 | file_name | | test.c:20:15:20:23 | file_name | test.c:21:8:21:16 | file_name indirection | From 87f737cf8d3c3e22d8b700d1fe397f195069490d Mon Sep 17 00:00:00 2001 From: "John L. Singleton" Date: Fri, 3 Mar 2023 11:49:33 -0500 Subject: [PATCH 3/3] fix --- ...NotPerformFileOperationsOnDevices.expected.clang | 13 +++++++++++++ ...DoNotPerformFileOperationsOnDevices.expected.gcc | 13 +++++++++++++ 2 files changed, 26 insertions(+) diff --git a/c/cert/test/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.expected.clang b/c/cert/test/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.expected.clang index 0e569b4d8a..d885a5b207 100644 --- a/c/cert/test/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.expected.clang +++ b/c/cert/test/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.expected.clang @@ -1,9 +1,16 @@ +edges +| test.c:20:15:20:23 | array to pointer conversion | test.c:21:8:21:16 | (const char *)... | +| test.c:20:15:20:23 | array to pointer conversion | test.c:21:8:21:16 | file_name | +| test.c:20:15:20:23 | array to pointer conversion | test.c:21:8:21:16 | file_name indirection | | test.c:20:15:20:23 | file_name | test.c:21:8:21:16 | (const char *)... | | test.c:20:15:20:23 | file_name | test.c:21:8:21:16 | file_name | | test.c:20:15:20:23 | file_name | test.c:21:8:21:16 | file_name indirection | | test.c:20:15:20:23 | scanf output argument | test.c:21:8:21:16 | (const char *)... | | test.c:20:15:20:23 | scanf output argument | test.c:21:8:21:16 | file_name | | test.c:20:15:20:23 | scanf output argument | test.c:21:8:21:16 | file_name indirection | +| test.c:45:15:45:23 | array to pointer conversion | test.c:46:29:46:37 | (LPCTSTR)... | +| test.c:45:15:45:23 | array to pointer conversion | test.c:46:29:46:37 | file_name | +| test.c:45:15:45:23 | array to pointer conversion | test.c:46:29:46:37 | file_name indirection | | test.c:45:15:45:23 | file_name | test.c:46:29:46:37 | (LPCTSTR)... | | test.c:45:15:45:23 | file_name | test.c:46:29:46:37 | file_name | | test.c:45:15:45:23 | file_name | test.c:46:29:46:37 | file_name indirection | @@ -12,16 +19,22 @@ | test.c:45:15:45:23 | scanf output argument | test.c:46:29:46:37 | file_name indirection | subpaths nodes +| test.c:20:15:20:23 | array to pointer conversion | semmle.label | array to pointer conversion | | test.c:20:15:20:23 | file_name | semmle.label | file_name | | test.c:20:15:20:23 | scanf output argument | semmle.label | scanf output argument | | test.c:21:8:21:16 | (const char *)... | semmle.label | (const char *)... | +| test.c:21:8:21:16 | (const char *)... | semmle.label | (const char *)... | | test.c:21:8:21:16 | file_name | semmle.label | file_name | | test.c:21:8:21:16 | file_name indirection | semmle.label | file_name indirection | +| test.c:21:8:21:16 | file_name indirection | semmle.label | file_name indirection | +| test.c:45:15:45:23 | array to pointer conversion | semmle.label | array to pointer conversion | | test.c:45:15:45:23 | file_name | semmle.label | file_name | | test.c:45:15:45:23 | scanf output argument | semmle.label | scanf output argument | | test.c:46:29:46:37 | (LPCTSTR)... | semmle.label | (LPCTSTR)... | +| test.c:46:29:46:37 | (LPCTSTR)... | semmle.label | (LPCTSTR)... | | test.c:46:29:46:37 | file_name | semmle.label | file_name | | test.c:46:29:46:37 | file_name indirection | semmle.label | file_name indirection | +| test.c:46:29:46:37 | file_name indirection | semmle.label | file_name indirection | #select | test.c:21:8:21:16 | file_name | test.c:20:15:20:23 | file_name | test.c:21:8:21:16 | file_name | This argument to a file access function is derived from $@ and then passed to func(file_name), which calls fopen(__filename) | test.c:20:15:20:23 | file_name | user input (scanf) | | test.c:46:29:46:37 | file_name | test.c:45:15:45:23 | file_name | test.c:46:29:46:37 | file_name | This argument to a file access function is derived from $@ and then passed to CreateFile(lpFileName) | test.c:45:15:45:23 | file_name | user input (scanf) | diff --git a/c/cert/test/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.expected.gcc b/c/cert/test/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.expected.gcc index 0e569b4d8a..d885a5b207 100644 --- a/c/cert/test/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.expected.gcc +++ b/c/cert/test/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.expected.gcc @@ -1,9 +1,16 @@ +edges +| test.c:20:15:20:23 | array to pointer conversion | test.c:21:8:21:16 | (const char *)... | +| test.c:20:15:20:23 | array to pointer conversion | test.c:21:8:21:16 | file_name | +| test.c:20:15:20:23 | array to pointer conversion | test.c:21:8:21:16 | file_name indirection | | test.c:20:15:20:23 | file_name | test.c:21:8:21:16 | (const char *)... | | test.c:20:15:20:23 | file_name | test.c:21:8:21:16 | file_name | | test.c:20:15:20:23 | file_name | test.c:21:8:21:16 | file_name indirection | | test.c:20:15:20:23 | scanf output argument | test.c:21:8:21:16 | (const char *)... | | test.c:20:15:20:23 | scanf output argument | test.c:21:8:21:16 | file_name | | test.c:20:15:20:23 | scanf output argument | test.c:21:8:21:16 | file_name indirection | +| test.c:45:15:45:23 | array to pointer conversion | test.c:46:29:46:37 | (LPCTSTR)... | +| test.c:45:15:45:23 | array to pointer conversion | test.c:46:29:46:37 | file_name | +| test.c:45:15:45:23 | array to pointer conversion | test.c:46:29:46:37 | file_name indirection | | test.c:45:15:45:23 | file_name | test.c:46:29:46:37 | (LPCTSTR)... | | test.c:45:15:45:23 | file_name | test.c:46:29:46:37 | file_name | | test.c:45:15:45:23 | file_name | test.c:46:29:46:37 | file_name indirection | @@ -12,16 +19,22 @@ | test.c:45:15:45:23 | scanf output argument | test.c:46:29:46:37 | file_name indirection | subpaths nodes +| test.c:20:15:20:23 | array to pointer conversion | semmle.label | array to pointer conversion | | test.c:20:15:20:23 | file_name | semmle.label | file_name | | test.c:20:15:20:23 | scanf output argument | semmle.label | scanf output argument | | test.c:21:8:21:16 | (const char *)... | semmle.label | (const char *)... | +| test.c:21:8:21:16 | (const char *)... | semmle.label | (const char *)... | | test.c:21:8:21:16 | file_name | semmle.label | file_name | | test.c:21:8:21:16 | file_name indirection | semmle.label | file_name indirection | +| test.c:21:8:21:16 | file_name indirection | semmle.label | file_name indirection | +| test.c:45:15:45:23 | array to pointer conversion | semmle.label | array to pointer conversion | | test.c:45:15:45:23 | file_name | semmle.label | file_name | | test.c:45:15:45:23 | scanf output argument | semmle.label | scanf output argument | | test.c:46:29:46:37 | (LPCTSTR)... | semmle.label | (LPCTSTR)... | +| test.c:46:29:46:37 | (LPCTSTR)... | semmle.label | (LPCTSTR)... | | test.c:46:29:46:37 | file_name | semmle.label | file_name | | test.c:46:29:46:37 | file_name indirection | semmle.label | file_name indirection | +| test.c:46:29:46:37 | file_name indirection | semmle.label | file_name indirection | #select | test.c:21:8:21:16 | file_name | test.c:20:15:20:23 | file_name | test.c:21:8:21:16 | file_name | This argument to a file access function is derived from $@ and then passed to func(file_name), which calls fopen(__filename) | test.c:20:15:20:23 | file_name | user input (scanf) | | test.c:46:29:46:37 | file_name | test.c:45:15:45:23 | file_name | test.c:46:29:46:37 | file_name | This argument to a file access function is derived from $@ and then passed to CreateFile(lpFileName) | test.c:45:15:45:23 | file_name | user input (scanf) |