-
Notifications
You must be signed in to change notification settings - Fork 68
Closed
Labels
Difficulty-MediumA false positive or false negative report which is expected to take 1-5 days effort to addressA false positive or false negative report which is expected to take 1-5 days effort to addressImpact-Mediumfalse positive/false negativeAn issue related to observed false positives or false negatives.An issue related to observed false positives or false negatives.user-reportIssue reported by an end user of CodeQL Coding StandardsIssue reported by an end user of CodeQL Coding Standards
Description
Affected rules
A18-0-1
Description
The query for this rule reports any use of headers with file names the same as a prohibited C standard library header. This can cause false positives if the included file is not from a C standard library implementation but just happens to have the same name as a C standard library header.
There's no certain way to determine whether an include is of a C Standard Library header file, because the files themselves are not universally distinguishable, so we will need to consider some heuristics for identification.
As an initial idea, we could only report cases where:
- The
#include
specifies no file path (e.g.filename = i.getIncludeText().substring(1, i.getIncludeText().length() - 2)
) - And where the target file is not within the source location (e.g.
not exists(i.getIncludedFile().getRelativePath())
Example
$ cat lib/example.h
#ifndef LIB_EXAMPLE_H_
#define LIB_EXAMPLE_H_
#endif
$ cat test.cpp
#include "lib/example.h" // A18-0-1 reported here
#include <iostream>
Metadata
Metadata
Assignees
Labels
Difficulty-MediumA false positive or false negative report which is expected to take 1-5 days effort to addressA false positive or false negative report which is expected to take 1-5 days effort to addressImpact-Mediumfalse positive/false negativeAn issue related to observed false positives or false negatives.An issue related to observed false positives or false negatives.user-reportIssue reported by an end user of CodeQL Coding StandardsIssue reported by an end user of CodeQL Coding Standards
Type
Projects
Status
Done