codeql-coding-standards icon indicating copy to clipboard operation
codeql-coding-standards copied to clipboard

Detect compilations with no warnings when '-w' flag is present.

Open MichaelRFairhurst opened this issue 1 year ago • 1 comments

Description

Gcc may be compiled to auto include warnings such as -Wformat. However, passing in -w will suppress the enabled format warnings. The previous query would not raise an issue, as it saw the -Wformat flag etc, even though if -w was present, causing gcc to run with no warnings enabled.

Change request type

  • [ ] Release or process automation (GitHub workflows, internal scripts)
  • [ ] Internal documentation
  • [ ] External documentation
  • [x] Query files (.ql, .qll, .qls or unit tests)
  • [ ] External scripts (analysis report or other code shipped as part of a release)

Rules with added or modified queries

  • [ ] No rules added
  • [ ] Queries have been added for the following rules:
    • rule number here
  • [x] Queries have been modified for the following rules:
    • autosar A1-1-2

Release change checklist

A change note (development_handbook.md#change-notes) is required for any pull request which modifies:

  • The structure or layout of the release artifacts.
  • The evaluation performance (memory, execution time) of an existing query.
  • The results of an existing query in any circumstance.

If you are only adding new rule queries, a change note is not required.

Author: Is a change note required?

  • [x] Yes
  • [ ] No

🚨🚨🚨 Reviewer: Confirm that format of shared queries (not the .qll file, the .ql file that imports it) is valid by running them within VS Code.

  • [ ] Confirmed

Reviewer: Confirm that either a change note is not required or the change note is required and has been added.

  • [ ] Confirmed

Query development review checklist

For PRs that add new queries or modify existing queries, the following checklist should be completed by both the author and reviewer:

Author

  • [x] Have all the relevant rule package description files been checked in?
  • [x] Have you verified that the metadata properties of each new query is set appropriately?
  • [x] Do all the unit tests contain both "COMPLIANT" and "NON_COMPLIANT" cases?
  • [x] Are the alert messages properly formatted and consistent with the style guide?
  • [x] Have you run the queries on OpenPilot and verified that the performance and results are acceptable?
    As a rule of thumb, predicates specific to the query should take no more than 1 minute, and for simple queries be under 10 seconds. If this is not the case, this should be highlighted and agreed in the code review process.
  • [x] Does the query have an appropriate level of in-query comments/documentation?
  • [x] Have you considered/identified possible edge cases?
  • [x] Does the query not reinvent features in the standard library?
  • [x] Can the query be simplified further (not golfed!)

Reviewer

  • [ ] Have all the relevant rule package description files been checked in?
  • [ ] Have you verified that the metadata properties of each new query is set appropriately?
  • [ ] Do all the unit tests contain both "COMPLIANT" and "NON_COMPLIANT" cases?
  • [ ] Are the alert messages properly formatted and consistent with the style guide?
  • [ ] Have you run the queries on OpenPilot and verified that the performance and results are acceptable?
    As a rule of thumb, predicates specific to the query should take no more than 1 minute, and for simple queries be under 10 seconds. If this is not the case, this should be highlighted and agreed in the code review process.
  • [ ] Does the query have an appropriate level of in-query comments/documentation?
  • [ ] Have you considered/identified possible edge cases?
  • [ ] Does the query not reinvent features in the standard library?
  • [ ] Can the query be simplified further (not golfed!)

MichaelRFairhurst avatar Sep 17 '24 00:09 MichaelRFairhurst

This PR is blocked, codeql run test automatically adds a -w flag during extraction, therefore we cannot create a \\ COMPLIANT test case via codeql run test.

@lcartey Should we remove the "compliant" test cases for now, so we can fix this false negative? Or should we wait for a plan, either via changes to our test infra or to codeql run test, so that we can land this with both compliant & non-compliant test cases?

MichaelRFairhurst avatar Sep 17 '24 20:09 MichaelRFairhurst