codeql-coding-standards icon indicating copy to clipboard operation
codeql-coding-standards copied to clipboard

`STR34-C`: Do not consider integer type aliases in templates

Open lcartey opened this issue 10 months ago • 0 comments

Affected rules

  • STR34-C

Description

This query identifies conversions from signed chars to larger signed integers. This is a C rule, however it is part of the collection of C rules that can be applied to C++. In the case of C++, we observe potential false positives where such conversions happen in a template.

This is because the query usually only reports cases where char or signed char are directly referenced. This is to avoid flagging code using typedefs of char which are intended to be used integer types, not char types. For example, it's common for int8_t to be typedef'd to char, and the rule wouldn't apply in this case because there's no developer confusion over the conversion. However, in template instantiations we see the fully resolved types, which means we would flag conversions if they occur in the template.

Example

template <typename S, typename T> S get(T t) {
   S s = t;  // FALSE_POSITIVE - for instantiation
  return s;
}

void test(int8_t c) {
  int32_t a = c; // COMPLIANT - conversion occurs, but type is not char
  int32_t b = get<int32_t, int8_t>(c); // triggers a false positive in the template
}

lcartey avatar May 01 '24 11:05 lcartey