daandemeyer / rpms / systemd

Forked from rpms/systemd 2 years ago
Clone
4bff0a
From c9fdcd0693ac63bc4b7326e248854617d9573bd6 Mon Sep 17 00:00:00 2001
4bff0a
From: Evgeny Vereshchagin <evvers@ya.ru>
4bff0a
Date: Fri, 26 Oct 2018 09:19:09 +0000
4bff0a
Subject: [PATCH] lgtm: add a custom query for catching the use of fgets
4bff0a
4bff0a
As everybody knows, nodoby really reads CODING_STYLE (especially
4bff0a
the last paragraph :-)) so let's utilize LGTM to help us catch the
4bff0a
use of fgets.
4bff0a
4bff0a
(cherry picked from commit f86c1da28340f2a2afd34d72c9f416a2a94219a8)
4bff0a
---
4bff0a
 .lgtm/cpp-queries/fgets.ql | 23 +++++++++++++++++++++++
4bff0a
 1 file changed, 23 insertions(+)
4bff0a
 create mode 100644 .lgtm/cpp-queries/fgets.ql
4bff0a
4bff0a
diff --git a/.lgtm/cpp-queries/fgets.ql b/.lgtm/cpp-queries/fgets.ql
4bff0a
new file mode 100644
4bff0a
index 0000000000..82de8c4482
4bff0a
--- /dev/null
4bff0a
+++ b/.lgtm/cpp-queries/fgets.ql
4bff0a
@@ -0,0 +1,23 @@
4bff0a
+/**
4bff0a
+ * @name Use of fgets()
4bff0a
+ * @description fgets() is dangerous to call. Use read_line() instead.
4bff0a
+ * @kind problem
4bff0a
+ * @problem.severity error
4bff0a
+ * @precision high
4bff0a
+ * @id cpp/fgets
4bff0a
+ * @tags reliability
4bff0a
+ *       security
4bff0a
+ */
4bff0a
+import cpp
4bff0a
+
4bff0a
+
4bff0a
+predicate dangerousFunction(Function function) {
4bff0a
+  exists (string name | name = function.getQualifiedName() |
4bff0a
+    name = "fgets")
4bff0a
+}
4bff0a
+
4bff0a
+
4bff0a
+from FunctionCall call, Function target
4bff0a
+where call.getTarget() = target
4bff0a
+  and dangerousFunction(target)
4bff0a
+select call, target.getQualifiedName() + " is potentially dangerous"