Skip to content

QL: more precise alert locations#8937

Merged
erik-krogh merged 1 commit into
github:mainfrom
erik-krogh:qlFocusedLocations
Jul 12, 2022
Merged

QL: more precise alert locations#8937
erik-krogh merged 1 commit into
github:mainfrom
erik-krogh:qlFocusedLocations

Conversation

@erik-krogh
Copy link
Copy Markdown
Contributor

@erik-krogh erik-krogh commented Apr 28, 2022

Ignore the code-scanning failure, that is just from the existing errors getting a new location.

Drive-by removal of the tools:latest workaround.
That one was required when some Action runners didn't have CodeQL 2.8.2 or later.
(The cached version seems to be 2.8.5 now).

@erik-krogh erik-krogh marked this pull request as ready for review April 28, 2022 10:52
@erik-krogh erik-krogh requested a review from a team as a code owner April 28, 2022 10:52
@calumgrant
Copy link
Copy Markdown
Contributor

The alternative approach would be to change getLocation() in the given types. getLocation() is supposed to give the natural location for reporting, and I wonder whether there are any uses/needs of the fuller location (that I'm guessing spans the entire class)? If not, consider overriding getLocation() instead.

If you still need the "full location" around for some reason, then consider adding it as a predicate on ASTNode. Location getLocation() { result = getFullLocation() } or something like that, then you can override it as needed instead of switching on type.

@erik-krogh
Copy link
Copy Markdown
Contributor Author

The alternative approach would be to change getLocation() in the given types. getLocation() is supposed to give the natural location for reporting

Is there any CodeQL language that does anything like that? All I've seen is that getLocation() returns a location that spans the entire node.
That is also the behavior that feels the most natural to me, so I think I would prefer an Location getFocusedLocation() instead of a Location getFullLocation().
But in the end that would do basically what I've done here, just spread out in each of the AST classes.

Do you know if we have any documentation on what getLocation() is supposed to do?
All I can find is information on what the structure of getLocation() should be.

@tausbn
Copy link
Copy Markdown
Contributor

tausbn commented May 5, 2022

Is there any CodeQL language that does anything like that? All I've seen is that getLocation() returns a location that spans the entire node.

This is not the exact same setup as what is being discussed here, but for many Python AST elements, the location (as emitted by the extractor) is not the same as what is spanned by the entire AST node.

An example of this is if-statements, where the "location" actually corresponds to the location of the condition that is being tested.

Suffice it to say, I'm not a fan of doing it in the extractor (there's a sizeable chunk of python.tsg devoted to "reapplying" these position hacks).

I like the idea of moving this into overrides on getLocation instead. I'll probably do that for Python the next time I clean up the parser.

@aschackmull
Copy link
Copy Markdown
Contributor

Is there any CodeQL language that does anything like that? All I've seen is that getLocation() returns a location that spans the entire node.

The location of Java classes are just the location of the class name rather than spanning the entire class definition, so there is at least some precedence.

@erik-krogh
Copy link
Copy Markdown
Contributor Author

erik-krogh commented May 10, 2022

The location of Java classes are just the location of the class name rather than spanning the entire class definition, so there is at least some precedence.

Hmmm.
OK. I'll try to do an approach where I have getLocation() return the "focused" location, and a getFullLocation() that returns a location that spans the entire AST node.
That also means that a QL-for-QL query writer don't have to remember to "focus" the location of e.g. classes when writing a new query.

@erik-krogh
Copy link
Copy Markdown
Contributor Author

OK. I'll try to do an approach where I have getLocation() return the "focused" location, and a getFullLocation() that returns a location that spans the entire AST node.

Done.
getFullLocation() is currently unused.
But I'm definitely going to use getFullLocation() in CodeQL-patch after this PR has been merged.

Copy link
Copy Markdown

@github-advanced-security github-advanced-security AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Found 3 vulnerabilities.

Comment thread ql/ql/src/codeql_ql/ast/Ast.qll Outdated
Comment thread ql/ql/src/codeql_ql/ast/Ast.qll Outdated
Comment thread ql/ql/src/codeql_ql/ast/Ast.qll Fixed
@erik-krogh erik-krogh force-pushed the qlFocusedLocations branch from 3bca02b to 73b657c Compare June 21, 2022 10:26
@erik-krogh
Copy link
Copy Markdown
Contributor Author

I rebased on main and squashed the history down to a single commit.

Copy link
Copy Markdown
Contributor

@tausbn tausbn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me. 👍

@erik-krogh erik-krogh merged commit e092cb0 into github:main Jul 12, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants