-
Notifications
You must be signed in to change notification settings - Fork 1.7k
QL: detect unqueryable code #8454
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
905c503
to
9a419d4
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't think we should deprecate code just because it doesn't have a use in our own set of queries. For instance, localExprFlow
isn't something we're likely to use ourselves, but I've frequently seen QL code "in the wild" that uses it.
cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't think we want the DataFlowUtil
changes for C++.
cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
Outdated
Show resolved
Hide resolved
cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
Outdated
Show resolved
Hide resolved
I reverted the
|
a45d535
to
5544750
Compare
ab78dc0
to
bd1f45e
Compare
bd1f45e
to
c4290ce
Compare
c2d3e80
to
0f57d94
Compare
result.(Module).getAMember().(ClasslessPredicate).getName() = "forceStage" or | ||
result.(ClasslessPredicate).getName() = "forceStage" or | ||
result.(Module).getAMember().(ClasslessPredicate).getName() = | ||
["forceStage", "forceCachingInSameStageforceCachingInSameStage"] or |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I feel like I'm seeing double. Should this be simply forceCachingInSameStage
?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
And the case was also redundant.
The below case in the disjunction already covered it.
8dee962
to
74b44f5
Compare
Similar to
ql/dead-code
, but does not consider public APIs as live.That means any code that doesn't affect any (known) query is flagged.
The query is therefore good at detecting untested code or code that could be deprecated (:eyes: Python).
Shared files where not all languages use all the features have a tendency to be flagged, so a bunch of those have been manually excluded.
There is a whole bunch of existing alerts where unused code exists for completeness, or where the code is only used by queries outside of the
github/codeql
repo.So even though there are plenty of results, most of the results should not be fixed.
I still think it's a nice query to have, as it has found some obvious bugs in e.g. JS and GO (see the PRs below).
PRs from this query:
Python: #10317
JS: #8422
Go: #10475
Ruby: #10476
Java: #10486
C: #10573
C#: #10584