Implement package expressions2 by MichaelRFairhurst · Pull Request #906 · github/codeql-coding-standards

MichaelRFairhurst · 2025-06-03T22:06:36Z

Description

please enter the description of your change here

Change request type

Release or process automation (GitHub workflows, internal scripts)
Internal documentation
External documentation
Query files (.ql, .qll, .qls or unit tests)
External scripts (analysis report or other code shipped as part of a release)

Rules with added or modified queries

No rules added
Queries have been added for the following rules:
- RULE-8-0-1
- RULE-8-1-1
- RULE-8-1-2
- RULE-5-13-6
Queries have been modified for the following rules:
- RULE-18-9 (no visible changes expected)
- All rules involving suffixes

Release change checklist

A change note (development_handbook.md#change-notes) is required for any pull request which modifies:

The structure or layout of the release artifacts.
The evaluation performance (memory, execution time) of an existing query.
The results of an existing query in any circumstance.

If you are only adding new rule queries, a change note is not required.

Author: Is a change note required?

Yes
No

🚨🚨🚨
Reviewer: Confirm that format of shared queries (not the .qll file, the
.ql file that imports it) is valid by running them within VS Code.

Confirmed

Reviewer: Confirm that either a change note is not required or the change note is required and has been added.

Confirmed

Query development review checklist

For PRs that add new queries or modify existing queries, the following checklist should be completed by both the author and reviewer:

Author

Have all the relevant rule package description files been checked in?
Have you verified that the metadata properties of each new query is set appropriately?
Do all the unit tests contain both "COMPLIANT" and "NON_COMPLIANT" cases?
Are the alert messages properly formatted and consistent with the style guide?
Have you run the queries on OpenPilot and verified that the performance and results are acceptable?
As a rule of thumb, predicates specific to the query should take no more than 1 minute, and for simple queries be under 10 seconds. If this is not the case, this should be highlighted and agreed in the code review process.
Does the query have an appropriate level of in-query comments/documentation?
Have you considered/identified possible edge cases?
Does the query not reinvent features in the standard library?
Can the query be simplified further (not golfed!)

Reviewer

Have all the relevant rule package description files been checked in?
Have you verified that the metadata properties of each new query is set appropriately?
Do all the unit tests contain both "COMPLIANT" and "NON_COMPLIANT" cases?
Are the alert messages properly formatted and consistent with the style guide?
Have you run the queries on OpenPilot and verified that the performance and results are acceptable?
As a rule of thumb, predicates specific to the query should take no more than 1 minute, and for simple queries be under 10 seconds. If this is not the case, this should be highlighted and agreed in the code review process.
Does the query have an appropriate level of in-query comments/documentation?
Have you considered/identified possible edge cases?
Does the query not reinvent features in the standard library?
Can the query be simplified further (not golfed!)

Copilot

Pull Request Overview

This PR introduces the new “Expressions2” package by adding several MISRA-related CodeQL queries, refactoring expression support modules, and updating test headers to mock standard library facilities. Key changes include:

Addition of five new QLL queries enforcing MISRA rules RULE-8-1-2, RULE-8-1-1, RULE-8-0-1, and RULE-5-13-6.
Refactoring of Cpp14Literal and Expr modules to support integer suffix parsing and temporary-object flow steps.
Introduction of the Expressions2Package and updates to exclusions and rule metadata for the new queries.

Reviewed Changes

Copilot reviewed 36 out of 36 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
cpp/misra/src/rules/RULE-8-1-2/ImplicitCapturesDisallowedInNonTransientLambda.ql	New query for explicit captures in non-transient lambdas
cpp/misra/src/rules/RULE-8-1-1/NonTransientLambdaImplicitlyCapturesThis.ql	New query preventing implicit `this` captures
cpp/misra/src/rules/RULE-8-0-1/MissingSizeofOperatorParenthesis.ql	New query enforcing parentheses around `sizeof`
cpp/misra/src/rules/RULE-8-0-1/MissingPrecedenceClarifyingParenthesis.ql	New query enforcing clarifying parentheses
cpp/misra/src/rules/RULE-5-13-6/LongLongLiteralWithSingleLSuffix.ql	New query disallowing single `L` suffix on `long long` literals
cpp/common/src/codingstandards/cpp/graph/GraphPathStateSearch.qll	Added stateful graph search module
cpp/common/src/codingstandards/cpp/Expr.qll	Refactored expression module; extracted `temporaryObjectFlowStep`
cpp/common/src/codingstandards/cpp/Cpp14Literal.qll	Added `IntegerLiteralSuffix` class and `getSuffix()`
cpp/common/src/codingstandards/cpp/Scope.qll	Added `functionDefinedInTranslationUnit` predicate
cpp/common/src/codingstandards/cpp/exclusions/cpp/Expressions2.qll	New autogenerated exclusions for Expressions2
cpp/common/src/codingstandards/cpp/exclusions/cpp/RuleMetadata.qll	Imported `Expressions2` in rule metadata
cpp/common/test/includes/standard-library/utility.h	Provided definitions for `forward` overloads
cpp/common/test/includes/standard-library/functional.h	Updated `std::function` mock constructor

Comments suppressed due to low confidence (1)

cpp/common/test/includes/standard-library/utility.h:11

The move function is declared but not defined. Consider providing a definition like:

template <class T>
constexpr remove_reference_t<T>&& move(T&& t) noexcept {
    return static_cast<remove_reference_t<T>&&>(t);
}

template <class T> constexpr remove_reference_t<T> &&move(T &&t) noexcept;

cpp/common/src/codingstandards/cpp/graph/GraphPathStateSearch.qll

cpp/common/src/codingstandards/cpp/Scope.qll

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…ons2

mbaluda

Immense work!
General points:

should we use @problem.severity warning for advisory rules? (8-0-1, RULE-8-1-2)
some tests fail extraction due to utility.h

mbaluda · 2026-02-20T10:16:13Z

cpp/common/src/codingstandards/cpp/Scope.qll

+bindingset[f, tu]
+pragma[inline_late]
+predicate functionDefinedInTranslationUnit(Function f, TranslationUnit tu) {
+  exists(FunctionDeclarationEntry fde | fde = f.getDefinition() |


Suggested change

exists(FunctionDeclarationEntry fde | fde = f.getDefinition() |

exists(FunctionDeclarationEntry fde |

mbaluda · 2026-02-20T11:46:31Z

cpp/misra/test/rules/RULE-8-1-2/test.cpp

+  [&]() { return l1; }();          // COMPLIANT
+  [l1]() { return l1; }();         // COMPLIANT
+  [&, l1]() { return l1; }();      // COMPLIANT
+  [&, l1]() { return l1 + l2; }(); // NON_COMPLIANT


Missing in the expected fille

Suggested change

[&, l1]() { return l1 + l2; }(); // NON_COMPLIANT

[&, l1]() { return l1 + l2; }(); // COMPLIANT

mbaluda · 2026-02-20T12:36:04Z

cpp/misra/src/rules/RULE-8-0-1/MissingPrecedenceClarifyingParenthesis.ql

+import codingstandards.cpp.misra
+import codingstandards.cpp.AlertReporting
+
+class MisraPrecedenceExpr instanceof Expr {


Can you document how the MISRA precedence differs from the standard Expr.getPrecedence()?

mbaluda · 2026-02-20T12:43:43Z

cpp/misra/test/rules/RULE-8-0-1/test.cpp

+}
+
+// Test macros
+#define UNSAFE_MACRO(x, y, z) x + y *z  // NON_COMPLIANT macro definition


This alert is missing in the expected file

Suggested change

#define UNSAFE_MACRO(x, y, z) x + y *z // NON_COMPLIANT macro definition

#define UNSAFE_MACRO(x, y, z) x + y *z // NON_COMPLIANT[FALSE_NEGATIVE] macro definition

Implement package expressions2

ff5cbe9

Copilot AI review requested due to automatic review settings June 3, 2025 22:06

Copilot AI reviewed Jun 3, 2025

View reviewed changes

cpp/common/src/codingstandards/cpp/graph/GraphPathStateSearch.qll Outdated Show resolved Hide resolved

cpp/common/src/codingstandards/cpp/Scope.qll Show resolved Hide resolved

Changes to satisfy ci/cd: different format versions and paths

ec2c9ab

MichaelRFairhurst closed this Jun 4, 2025

MichaelRFairhurst reopened this Jun 4, 2025

Remove unnecessary include that was breaking test

22ef3ff

MichaelRFairhurst requested a review from lcartey June 4, 2025 20:55

MichaelRFairhurst requested review from jeongsoolee09 and removed request for lcartey September 24, 2025 21:12

MichaelRFairhurst requested review from mbaluda February 9, 2026 21:21

mbaluda and others added 3 commits February 20, 2026 11:15

Update cpp/common/src/codingstandards/cpp/graph/GraphPathStateSearch.qll

729554b

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Merge branch 'main' into michaelrfairhurst/implement-package-expressi…

1064217

…ons2

Update expected file

4239c90

mbaluda approved these changes Feb 20, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Implement package expressions2#906

Implement package expressions2#906
MichaelRFairhurst wants to merge 6 commits intomainfrom
michaelrfairhurst/implement-package-expressions2

MichaelRFairhurst commented Jun 3, 2025 •

edited by mbaluda

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

mbaluda left a comment •

edited

Loading

Uh oh!

mbaluda Feb 20, 2026

Uh oh!

mbaluda Feb 20, 2026

Uh oh!

mbaluda Feb 20, 2026

Uh oh!

mbaluda Feb 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Comments

	exists(FunctionDeclarationEntry fde \| fde = f.getDefinition() \|
	exists(FunctionDeclarationEntry fde \|

	[&, l1]() { return l1 + l2; }(); // NON_COMPLIANT
	[&, l1]() { return l1 + l2; }(); // COMPLIANT

	#define UNSAFE_MACRO(x, y, z) x + y *z // NON_COMPLIANT macro definition
	#define UNSAFE_MACRO(x, y, z) x + y *z // NON_COMPLIANT[FALSE_NEGATIVE] macro definition

Conversation

MichaelRFairhurst commented Jun 3, 2025 • edited by mbaluda Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Change request type

Rules with added or modified queries

Release change checklist

Query development review checklist

Author

Reviewer

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

mbaluda left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mbaluda Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

mbaluda Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

mbaluda Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

mbaluda Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Comments

MichaelRFairhurst commented Jun 3, 2025 •

edited by mbaluda

Loading

mbaluda left a comment •

edited

Loading