|
 |
3d3dc8 |
From 8b60932555141e1fe61a343863eae7655c2449a9 Mon Sep 17 00:00:00 2001
|
|
|
3d3dc8 |
From: Lennart Poettering <lennart@poettering.net>
|
|
|
3d3dc8 |
Date: Tue, 2 Apr 2019 12:43:47 +0200
|
|
|
3d3dc8 |
Subject: [PATCH] lgtm: beef up list of dangerous/questionnable API calls not
|
|
|
3d3dc8 |
to make
|
|
|
3d3dc8 |
|
|
|
3d3dc8 |
(cherry picked from commit 9b4805421eb2a7319f6507a26febfb9d2cdc3a93)
|
|
|
3d3dc8 |
|
|
|
3d3dc8 |
Related: #2017033
|
|
|
3d3dc8 |
---
|
|
|
3d3dc8 |
.../PotentiallyDangerousFunction.ql | 22 +++++++++++++++++--
|
|
|
3d3dc8 |
1 file changed, 20 insertions(+), 2 deletions(-)
|
|
|
3d3dc8 |
|
|
|
3d3dc8 |
diff --git a/.lgtm/cpp-queries/PotentiallyDangerousFunction.ql b/.lgtm/cpp-queries/PotentiallyDangerousFunction.ql
|
|
|
3d3dc8 |
index ba80f4ad8c..cd0284b37a 100644
|
|
|
3d3dc8 |
--- a/.lgtm/cpp-queries/PotentiallyDangerousFunction.ql
|
|
|
3d3dc8 |
+++ b/.lgtm/cpp-queries/PotentiallyDangerousFunction.ql
|
|
|
3d3dc8 |
@@ -16,10 +16,28 @@ import cpp
|
|
|
3d3dc8 |
predicate potentiallyDangerousFunction(Function f, string message) {
|
|
|
3d3dc8 |
(
|
|
|
3d3dc8 |
f.getQualifiedName() = "fgets" and
|
|
|
3d3dc8 |
- message = "Call to fgets is potentially dangerous. Use read_line() instead."
|
|
|
3d3dc8 |
+ message = "Call to fgets() is potentially dangerous. Use read_line() instead."
|
|
|
3d3dc8 |
) or (
|
|
|
3d3dc8 |
f.getQualifiedName() = "strtok" and
|
|
|
3d3dc8 |
- message = "Call to strtok is potentially dangerous. Use extract_first_word() instead."
|
|
|
3d3dc8 |
+ message = "Call to strtok() is potentially dangerous. Use extract_first_word() instead."
|
|
|
3d3dc8 |
+ ) or (
|
|
|
3d3dc8 |
+ f.getQualifiedName() = "strsep" and
|
|
|
3d3dc8 |
+ message = "Call to strsep() is potentially dangerous. Use extract_first_word() instead."
|
|
|
3d3dc8 |
+ ) or (
|
|
|
3d3dc8 |
+ f.getQualifiedName() = "dup" and
|
|
|
3d3dc8 |
+ message = "Call to dup() is potentially dangerous. Use fcntl(fd, FD_DUPFD_CLOEXEC, 3) instead."
|
|
|
3d3dc8 |
+ ) or (
|
|
|
3d3dc8 |
+ f.getQualifiedName() = "htonl" and
|
|
|
3d3dc8 |
+ message = "Call to htonl() is confusing. Use htobe32() instead."
|
|
|
3d3dc8 |
+ ) or (
|
|
|
3d3dc8 |
+ f.getQualifiedName() = "htons" and
|
|
|
3d3dc8 |
+ message = "Call to htons() is confusing. Use htobe16() instead."
|
|
|
3d3dc8 |
+ ) or (
|
|
|
3d3dc8 |
+ f.getQualifiedName() = "ntohl" and
|
|
|
3d3dc8 |
+ message = "Call to ntohl() is confusing. Use be32toh() instead."
|
|
|
3d3dc8 |
+ ) or (
|
|
|
3d3dc8 |
+ f.getQualifiedName() = "ntohs" and
|
|
|
3d3dc8 |
+ message = "Call to ntohs() is confusing. Use be16toh() instead."
|
|
|
3d3dc8 |
)
|
|
|
3d3dc8 |
}
|
|
|
3d3dc8 |
|