Repository navigation
Conversation
Contributor
Author
|
Ready for review. |
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Six quality queries have category tags that conflict with the documented taxonomy.
1 open issue
What changed in this PR
Populates the existing C/C++ code-quality suites using existing queries, without changing query logic.
Changes:
- Tags 44 additional queries with
quality, bringing both quality suites to 45 queries. - Freezes legacy non-security membership while retaining automatic security-query selection.
- Updates suite expectations and adds a change note.
| File | Description |
|---|---|
cpp/ql/src/Likely Bugs/Underspecified Functions/TooManyArguments.ql |
Adds quality tag. |
cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql |
Adds quality tag. |
cpp/ql/src/Likely Bugs/ReturnConstTypeMember.ql |
Adds quality and useless-code tags. |
cpp/ql/src/Likely Bugs/OO/ThrowInDestructor.ql |
Updates quality and reliability classification. |
cpp/ql/src/Likely Bugs/OO/NonVirtualDestructorInBaseClass.ql |
Updates quality and correctness tags. |
cpp/ql/src/Likely Bugs/OO/IncorrectConstructorDelegation.ql |
Reclassifies under quality and reliability. |
cpp/ql/src/Likely Bugs/Memory Management/ReturnCstrOfLocalStdString.ql |
Adds quality tag. |
cpp/ql/src/Likely Bugs/Likely Typos/UsingStrcpyAsBoolean.ql |
Adds quality and reliability tags. |
cpp/ql/src/Likely Bugs/Likely Typos/ShortCircuitBitMask.ql |
Adds quality tag. |
cpp/ql/src/Likely Bugs/Likely Typos/inconsistentLoopDirection.ql |
Adds quality and reliability tags. |
cpp/ql/src/Likely Bugs/Likely Typos/FutileConditional.ql |
Adds quality tag. |
cpp/ql/src/Likely Bugs/Likely Typos/DubiousNullCheck.ql |
Adds quality tag. |
cpp/ql/src/Likely Bugs/Likely Typos/CompareWhereAssignMeant.ql |
Adds quality tag. |
cpp/ql/src/Likely Bugs/Likely Typos/AssignWhereCompareMeant.ql |
Adds quality tag. |
cpp/ql/src/Likely Bugs/Format/TooManyFormatArguments.ql |
Adds quality tag. |
cpp/ql/src/Likely Bugs/Conversion/ImplicitDowncastFromBitfield.ql |
Adds quality tag. |
cpp/ql/src/Likely Bugs/Conversion/ArrayArgSizeMismatch.ql |
Adds quality and correctness tags. |
cpp/ql/src/Likely Bugs/ContinueInFalseLoop.ql |
Adds quality and reliability tags. |
cpp/ql/src/Likely Bugs/Arithmetic/UnsignedGEZero.ql |
Reclassifies under quality and reliability. |
cpp/ql/src/Likely Bugs/Arithmetic/PointlessSelfComparison.ql |
Adds quality tag. |
cpp/ql/src/Likely Bugs/Arithmetic/FloatComparison.ql |
Adds quality tag. |
cpp/ql/src/Likely Bugs/Arithmetic/ComparisonPrecedence.ql |
Adds quality tag. |
cpp/ql/src/Likely Bugs/Arithmetic/BitwiseSignCheck.ql |
Adds quality tag. |
cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 197.ql |
Adds quality tag. |
cpp/ql/src/jsf/4.10 Classes/AV Rule 79.ql |
Adds quality and reliability tags. |
cpp/ql/src/jsf/4.10 Classes/AV Rule 71.1.ql |
Adds quality and correctness tags. |
cpp/ql/src/jsf/4.07 Header Files/AV Rule 35.ql |
Adds quality tag. |
cpp/ql/src/Header Cleanup/Cleanup-DuplicateIncludeGuard.ql |
Uses quality and maintainability classification. |
cpp/ql/src/Documentation/FixmeComments.ql |
Adds quality tag. |
cpp/ql/src/Critical/NewDeleteArrayMismatch.ql |
Adds quality and correctness tags. |
cpp/ql/src/Critical/NewArrayDeleteMismatch.ql |
Adds quality and correctness tags. |
cpp/ql/src/Critical/LargeParameter.ql |
Adds quality, reliability, and performance tags. |
cpp/ql/src/codeql-suites/cpp-security-and-quality.qls |
Freezes legacy quality-query membership. |
cpp/ql/src/change-notes/2026-10-12-cpp-code-quality-suite.md |
Announces the quality suite. |
cpp/ql/src/Best Practices/UseOfGoto.ql |
Adds quality and complexity tags. |
cpp/ql/src/Best Practices/RuleOfTwo.ql |
Adds quality tag. |
cpp/ql/src/Best Practices/Likely Errors/Slicing.ql |
Adds quality tag. |
cpp/ql/src/Best Practices/Hiding/DeclarationHidesVariable.ql |
Adds quality tag. |
cpp/ql/src/Best Practices/Hiding/DeclarationHidesParameter.ql |
Adds quality tag. |
cpp/ql/src/Best Practices/GuardedFree.ql |
Adds quality and useless-code tags. |
cpp/ql/src/Best Practices/Exceptions/ThrowingPointers.ql |
Adds quality, reliability, and error-handling tags. |
cpp/ql/src/Best Practices/Exceptions/LeakyCatch.ql |
Adds quality, reliability, and error-handling tags. |
cpp/ql/src/Best Practices/Exceptions/CatchingByValue.ql |
Adds quality, reliability, and error-handling tags. |
cpp/ql/src/Best Practices/Exceptions/AccidentalRethrow.ql |
Adds quality and error-handling tags. |
cpp/ql/src/Best Practices/ComplexCondition.ql |
Adds quality and complexity tags. |
cpp/ql/src/Best Practices/BlockWithTooManyStatements.ql |
Adds quality and complexity tags. |
cpp/ql/integration-tests/query-suite/cpp-code-quality.qls.expected |
Records 45 selected queries. |
cpp/ql/integration-tests/query-suite/cpp-code-quality-extended.qls.expected |
Records 45 selected queries. |
Review effort: Max
| * @precision very-high | ||
| * @id cpp/futile-params | ||
| * @tags correctness | ||
| * @tags quality |
Contributor
Author
There was a problem hiding this comment.
I presume this comment is referring to:
You may use sub-categories from both top-level categories on the same query. However, if you only use sub-categories from a single top-level category, then you must also tag the query with that top-level category.
In five of the six cases (all but cpp/resource-not-released-in-destructor), the only change was to add the quality tag, nothing else has changed. Nevertheless I will review those existing tags, though I think it's more important that the sub-tags accurately reflect the query than that they strictly follow the rule cited above.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Create's a C/C++ quality query suite
cpp-code-quality.qls. Technically this already existed, as didcpp-code-quality-extended.qls, but they didn't have any queries in them. This pull request tags4544 appropriate and tested queries withqualityto populate the suites (... in fact a single query did get added incidentally with thequalitytag a few weeks ago -cpp/ambiguous-assignment-of-comparison- that's preserved as well, for a total of4645 queries).In addition some of the sub-tags have been updated, so that each
qualityquery has eithermaintainabilityorreliability(exactly one required), and in many cases other descriptive sub-tags have been added / updated as well (these are optional).The existing / older
cpp-security-and-quality.qlssuite has been "frozen" so that these and future tag changes don't affect what queries are in there (to be more precise, the quality half of the suite is frozen to a fixed list of queries matching the non-security queries in it before this pull request, while the security queries in it are still picked algorithmically; this is the same approach as was taken in Java and I believe other languages).Draft PR, pending discussion with interested parties.Ready for review.