Query pack updates (#108)

* update recommended query suite to include RoleTypeCorrectlyUsed

* update readme and qlpack version

* update suite files to require specific versions of codeql/cpp-queries

* update readme. update ql pack to use recommended suite as default

* update readme. update qlpacks

* fix typos

* fix typo

* rename files to fix build job

* more filename updates

* update qlpack version and readme

* fix typo causing query not to run

* fix typo causing query not to run

* readme updates

* Update README.md

Co-authored-by: NateD-MSFT <34494373+NateD-MSFT@users.noreply.github.com>
Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>

* Update README.md

Co-authored-by: NateD-MSFT <34494373+NateD-MSFT@users.noreply.github.com>
Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>

* Update README.md

Co-authored-by: NateD-MSFT <34494373+NateD-MSFT@users.noreply.github.com>
Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>

* Update README.md

Co-authored-by: NateD-MSFT <34494373+NateD-MSFT@users.noreply.github.com>
Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>

* Update README.md

Co-authored-by: NateD-MSFT <34494373+NateD-MSFT@users.noreply.github.com>
Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>

* Update README.md

Co-authored-by: NateD-MSFT <34494373+NateD-MSFT@users.noreply.github.com>
Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>

* readme updates

* remove duplicate text

* Update README.md

Co-authored-by: NateD-MSFT <34494373+NateD-MSFT@users.noreply.github.com>
Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>

---------

Signed-off-by: Jacob Ronstadt <147542405+jacob-ronstadt@users.noreply.github.com>
Co-authored-by: NateD-MSFT <34494373+NateD-MSFT@users.noreply.github.com>

Author: jacob-ronstadt

README.md

@@ -13,9 +13,9 @@ This repository contains open-source components for supplemental use in developi
 ### Windows Hardware Compatibility Program Release Version Matrix
 | Release                  | Branch to use | CodeQL CLI version |
 |--------------------------|---------------|--------------------|
-| Windows Server 2022      | WHCP_21H2     | 2.4.6              |
-| Windows 11               | WHCP_21H2     | 2.4.6              |
-| Windows 11, version 22H2 | WHCP_22H2     | 2.6.3              |
+| Windows Server 2022      | WHCP_21H2     | 2.4.6 or 2.15.4    |
+| Windows 11               | WHCP_21H2     | 2.4.6 or 2.15.4    |
+| Windows 11, version 22H2 | WHCP_22H2     | 2.6.3 or 2.15.4    |
 
 For general use, use the `main` branch along with [version 2.15.4 of the CodeQL CLI](https://github.com/github/codeql-cli-binaries/releases/tag/v2.15.4).
 
@@ -28,30 +28,15 @@ For general use, use the `main` branch along with [version 2.15.4 of the CodeQL
 
 1. Download the CodeQL CLI zip by selecting the asset associated with your OS and architecture (codeql-win64.zip, codeql-linux64.zip, etc.), then extract it to the directory you created in the previous step.
 
-    For the WHCP Program, use the CodeQL CLI version in accordance with the table above and Windows release you are certifying for: [version 2.4.6](https://github.com/github/codeql-cli-binaries/releases/tag/v2.4.6) or [version 2.6.3](https://github.com/github/codeql-cli-binaries/releases/tag/v2.6.3).
+    **NOTE** Visual Studio 17.8 broke compatibility with the older versions of CodeQL used in the WHCP_21H2 and WHCP_22H2 branches. [CodeQL CLI version 2.15.4](https://github.com/github/codeql-cli-binaries/releases/tag/v2.15.4) has been validated for use with WHCP 21H2 and WHCP 22H2 when using Visual Studio 17.8 or greater. 
+  
+    For the WHCP Program, use the CodeQL CLI version in accordance with the table above and Windows release you are certifying for: [version 2.4.6](https://github.com/github/codeql-cli-binaries/releases/tag/v2.4.6), [version 2.6.3](https://github.com/github/codeql-cli-binaries/releases/tag/v2.6.3), or [version 2.15.4](https://github.com/github/codeql-cli-binaries/releases/tag/v2.15.4).
+  
+  
 
     For general use with the `main` branch, use [CodeQL CLI version 2.15.4](https://github.com/github/codeql-cli-binaries/releases/tag/v2.15.4).
     
-
-1. Clone and install the Windows Driver Developer Supplemental Tools repository which contains the CodeQL queries specific for drivers:
-
-   For WHCP BRANCHES use:
-   ```
-    D:\codeql-home\>git clone https://github.com/microsoft/Windows-Driver-Developer-Supplemental-Tools.git --recurse-submodules
-    ```
-   
-   For MAIN AND DEVELOPMENT BRANCHES use:
-   
-   ```
-    D:\codeql-home\>git clone https://github.com/microsoft/Windows-Driver-Developer-Supplemental-Tools.git
-    ```
-   
-    Now you should have:
-    ```
-        D:/codeql-home
-            |--- codeql
-            |--- Windows-Driver-Developer-Supplemental-Tools
-    ```
+  
 
 1. Verify CodeQL is installed correctly by checking the version:
     ```
@@ -64,15 +49,40 @@ For general use, use the `main` branch along with [version 2.15.4 of the CodeQL
         use 'codeql resolve qlpacks' and 'codeql resolve languages'.
     ```
 
-1. Install CodeQL Packages using `codeql pack install`
-
-   For WHCP BRANCHES: Skip this step.
+1. Install CodeQL Packages 
+    
+    For WHCP_21H2 and WHCP_22H2 branches:
+ 
+    1. If using Visual Studio 2022 17.8 or greater with WHCP_21H2 or WHCP_22H2 and CodeQL CLI version 2.15.4:
 
-   For MAIN AND DEVELOPMENT BRANCHES use:
+        Follow the steps for "ALL OTHER BRANCHES." **Make sure to remove the CodeQL submodule if you still have an old version of the repo cloned.** CodeQL might try to use the queries in the submodule by default which will cause errors because of mismatched versions.
 
-   ```
-    D:\codeql-home\codeql>codeql pack install D:\codeql-home\Windows-Driver-Developer-Supplemental-Tools\src
+    1. If using Visual Studio version 17.7 or below **AND** either WHCP_21H2 or WHCP_22H2 **AND** CodeQL VLI version 2.4.6 or 2.6.3:
+    
+        Follow special instructions for WHCP_21H2 and WHCP_22H2 using VS17.7 at the end of this readme
+ 
+    
+    **For ALL OTHER BRANCHES:**
+    
+    **Note:** It is no longer necessary to clone the Windows-Driver-Developer-Supplemental-Tools repo to use the queries for certification.
+    
+	Download the latest version of the microsoft/windows-drivers pack:
     ```
+    codeql pack download microsoft/windows-drivers
+	```
+	CodeQL will install the microsoft/windows-drivers pack to the default directory `C:\Users\<current user>\.codeql\packages\microsoft\windows-drivers\<downloaded version>\`. Do not change this directory or move the installed pack.
+	
+	<!-- Resolve dependencies for the pack:
+	```
+	codeql pack resolve-dependencies C:\Users\<current user>\.codeql\packages\microsoft\windows-drivers\1.0.2\ --no-strict-mode
+	```
+	
+	Install dependencies for the pack:
+	```
+    codeql pack install C:\Users\<current user>\.codeql\packages\microsoft\windows-drivers\1.0.2\
+    ```
+	 -->
+    
 
 1. Build your CodeQL database:
 
@@ -88,14 +98,27 @@ For general use, use the `main` branch along with [version 2.15.4 of the CodeQL
 1. Analyze your CodeQL database:
     
     CodeQL's analysis output is provided in the form of a SARIF log file. For a human readable format, drop the SARIF file into [SARIF Viewer Website](https://microsoft.github.io/sarif-web-component/). (If there are violations, they will show up. If not, the page will not update.)
+
+    CodeQL query suites are provided in the suites directory and contain the sets of all recommended and mustfix queries. The desired query suite file should be downloaded/copied locally.
+    
+    1. Create a local copy of the desired query suite file:
+       
+        * windows_all_mustfix.qls 
+        * windows_all_recommended.qls
+
+    2. To analyze a CodeQL database run the following command:
     ```
-    D:\codeql-home\codeql>codeql database analyze <path to database> --format=sarifv2.1.0 --output=<"path to output file".sarif> <path to query/suite to run>
+	codeql database analyze --download <path to database> <path to query suite .qls file> --format=sarifv2.1.0 --output=<outputname>.sarif
     ```
-    Example: `codeql database analyze D:\DriverDatabase --format=sarifv2.1.0 --output=D:\DriverAnalysis1.sarif D:\codeql-home\Windows-driver-developer-supplemental-tools\src\suites\windows_driver_mustfix.qls`
+    **NOTE** The "--download" flag tells CodeQL to download dependencies before running the queries. 
+    
+    Specific versions, queries, or suites can be specified using the format `codeql database analyze <database> <scope>/<pack>@x.x.x:<path>`. For futher information, see the [CodeQL documentation](https://docs.github.com/en/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/publishing-and-using-codeql-packs#using-a-codeql-pack-to-analyze-a-codeql-database).
+
+        
+    Example: `codeql database analyze --download D:\DriverDatabase suites/windows-all-recommended.qls --format=sarifv2.1.0 --output=D:\DriverAnalysis1.sarif `
 
-    _(Parameters: path to new database, format, output sarif file, path to CodeQL query or query suite to use in analysis.)_
+    _(Parameters: path to new database, query pack, format, output sarif file)_
 
-    **Note**: Be sure to check the path to the suite or query you want to run, not every branch has the same file structure.
 
 1. ***For WHCP Users Only***: Prepare to Create a Driver Verification Log (DVL):
 
@@ -111,7 +134,9 @@ Windows drivers queries are in the `src/drivers` directory.
 
 Non-driver Microsoft-specific queries provided by Microsoft are in the `src/microsoft` directory.
 
-Query suites are located in the `src/suites` directory and contain the Must-Fix and Recommended-Fix suites used by the WHCP Program.
+Query suites are located in the `suites` directory and contain the Must-Fix and Recommended-Fix suites used by the WHCP Program.
+
+
 
 ## Contributing
 This project welcomes contributions, feedback, and suggestions!
@@ -146,3 +171,35 @@ trademarks or logos is subject to and must follow
 [Microsoft's Trademark & Brand Guidelines](https://www.microsoft.com/en-us/legal/intellectualproperty/trademarks/usage/general).
 Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship.
 Any use of third-party trademarks or logos are subject to those third-party's policies.
+
+
+## Special instructions for WHCP_21H2 and WHCP_22H2 using VS17.7 or below
+These instructions only apply when using both Visual Studio 17.7 or below along with CodeQL 2.6.3 or 2.4.6
+
+
+1. Install CodeQL version as indicated in above steps.
+
+1. 
+    Clone and install the Windows Driver Developer Supplemental Tools repository which contains the CodeQL queries specific for drivers:
+
+    ```
+    git clone https://github.com/microsoft/Windows-Driver-Developer-Supplemental-Tools.git --recurse-submodules
+    ```
+
+        Now you should have:
+
+        D:/codeql-home
+            |--- codeql
+            |--- Windows-Driver-Developer-Supplemental-Tools
+1. Analyze your CodeQL database
+    ```
+    codeql database analyze <path to database> --format=sarifv2.1.0 --output=<"path to output file".sarif> <path to query/suite to run>
+    ```
+    Example: `codeql database analyze D:\DriverDatabase --format=sarifv2.1.0 --output=D:\DriverAnalysis1.sarif D:\codeql-home\Windows-driver-developer-supplemental-tools\src\suites\windows_driver_mustfix.qls`
+
+    (Parameters: path to new database, format, output sarif file, path to CodeQL query or query suite to use in analysis.)
+
+    **Note:** Be sure to check the path to the suite or query you want to run, not every branch has the same file structure.
+
+
+    

src/codeql-pack.lock.yml

@@ -3,16 +3,12 @@ lockVersion: 1.0.0
 dependencies:
   codeql/cpp-all:
     version: 0.12.1
-  codeql/cpp-queries:
-    version: 0.9.0
   codeql/dataflow:
     version: 0.1.4
   codeql/rangeanalysis:
     version: 0.0.3
   codeql/ssa:
     version: 0.2.4
-  codeql/suite-helpers:
-    version: 0.7.4
   codeql/tutorial:
     version: 0.2.4
   codeql/typetracking:

src/microsoft/codeql-pack.lock.yml

@@ -2,11 +2,11 @@
 # Licensed under the MIT license.
 
 name: microsoft/windows-drivers
-version: 0.2.0
+version: 1.0.12
 dependencies:
-    codeql/cpp-queries: 0.9.0
     codeql/cpp-all: 0.12.1
-suites: suites
+suites: windows-driver-suites
+defaultSuiteFile: windows-driver-suites/windows_driver_recommended.qls
 extractor: cpp
 licenses: MIT
 description: CodeQL queries designed for Windows device driver development.

src/qlpack.yml

@@ -1,35 +1,35 @@
-# Query Suite for ported CA checks
-
-- description: Ported CA checks
-- queries: .
-  from: microsoft/windows-drivers
-- include:
-    query path: 
-      - drivers/general/experimental/DefaultPoolTagExtended/DefaultPoolTagExtended.ql
-      - drivers/general/queries/DefaultPoolTag/DefaultPoolTag.ql
-      - drivers/general/queries/ExtendedDeprecatedApis/ExtendedDeprecatedApis.ql
-      - drivers/general/queries/IrqlNotSaved/IrqlNotSaved.ql
-      - drivers/general/queries/IrqlNotUsed/IrqlNotUsed.ql
-      - drivers/general/queries/RoutineFunctionTypeNotExpected/RoutineFunctionTypeNotExpected.ql
-      - drivers/general/queries/PoolTagIntegral/PoolTagIntegral.ql
-      - drivers/general/queries/WdkDeprecatedApis/wdk-deprecated-api.ql
-      - drivers/kmdf/queries/StrSafe/StrSafe.ql
-      - drivers/general/queries/experimental/IrqlTooHigh/IrqlTooHigh.ql
-      - drivers/general/queries/experimental/IrqlTooLow/IrqlTooLow.ql
-      - drivers/general/queries/experimental/IrqlSetTooHigh/IrqlSetTooHigh.ql
-      - drivers/general/queries/experimental/IrqlSetTooLow/IrqlSetTooLow.ql
-      - drivers/wdm/queries/ExaminedValue/ExaminedValue.ql
-      - drivers/wdm/queries/IllegalFieldAccess/IllegalFieldAccess.ql
-      - drivers/wdm/queries/IllegalFieldAccess2/IllegalFieldAccess2.ql
-      - drivers/wdm/queries/IllegalFieldWrite/IllegalFieldWrite.ql
-      - drivers/wdm/queries/InitNotCleared/InitNotCleared.ql
-      - drivers/wdm/queries/KeWaitLocal/KeWaitLocal.ql
-      - drivers/wdm/queries/MultiplePagedCode/MultiplePagedCode.ql
-      - drivers/wdm/queries/NoPagedCode/NoPagedCode.ql
-      - drivers/wdm/queries/NoPagingSegment/NoPagingSegment.ql
-      - drivers/wdm/queries/ObReferenceMode/ObReferenceMode.ql
-      - drivers/wdm/queries/OpaqueMdlUse/OpaqueMdlUse.ql
-      - drivers/wdm/queries/OpaqueMdlWrite/OpaqueMdlWrite.ql
-      - drivers/wdm/queries/PendingStatusError/PendingStatusError.ql
-      - drivers/wdm/queries/WrongDispatchTableAssignment/WrongDispatchTableAssignment.ql
+# Query Suite for ported CA checks
+
+- description: Ported CA checks
+- queries: .
+  from: microsoft/windows-drivers
+- include:
+    query path: 
+      - drivers/general/experimental/DefaultPoolTagExtended/DefaultPoolTagExtended.ql
+      - drivers/general/queries/DefaultPoolTag/DefaultPoolTag.ql
+      - drivers/general/queries/ExtendedDeprecatedApis/ExtendedDeprecatedApis.ql
+      - drivers/general/queries/IrqlNotSaved/IrqlNotSaved.ql
+      - drivers/general/queries/IrqlNotUsed/IrqlNotUsed.ql
+      - drivers/general/queries/RoutineFunctionTypeNotExpected/RoutineFunctionTypeNotExpected.ql
+      - drivers/general/queries/PoolTagIntegral/PoolTagIntegral.ql
+      - drivers/general/queries/WdkDeprecatedApis/wdk-deprecated-api.ql
+      - drivers/kmdf/queries/StrSafe/StrSafe.ql
+      - drivers/general/queries/experimental/IrqlTooHigh/IrqlTooHigh.ql
+      - drivers/general/queries/experimental/IrqlTooLow/IrqlTooLow.ql
+      - drivers/general/queries/experimental/IrqlSetTooHigh/IrqlSetTooHigh.ql
+      - drivers/general/queries/experimental/IrqlSetTooLow/IrqlSetTooLow.ql
+      - drivers/wdm/queries/ExaminedValue/ExaminedValue.ql
+      - drivers/wdm/queries/IllegalFieldAccess/IllegalFieldAccess.ql
+      - drivers/wdm/queries/IllegalFieldAccess2/IllegalFieldAccess2.ql
+      - drivers/wdm/queries/IllegalFieldWrite/IllegalFieldWrite.ql
+      - drivers/wdm/queries/InitNotCleared/InitNotCleared.ql
+      - drivers/wdm/queries/KeWaitLocal/KeWaitLocal.ql
+      - drivers/wdm/queries/MultiplePagedCode/MultiplePagedCode.ql
+      - drivers/wdm/queries/NoPagedCode/NoPagedCode.ql
+      - drivers/wdm/queries/NoPagingSegment/NoPagingSegment.ql
+      - drivers/wdm/queries/ObReferenceMode/ObReferenceMode.ql
+      - drivers/wdm/queries/OpaqueMdlUse/OpaqueMdlUse.ql
+      - drivers/wdm/queries/OpaqueMdlWrite/OpaqueMdlWrite.ql
+      - drivers/wdm/queries/PendingStatusError/PendingStatusError.ql
+      - drivers/wdm/queries/WrongDispatchTableAssignment/WrongDispatchTableAssignment.ql
 

src/suites/ported_driver_ca_checks.qls …river-suites/ported_driver_ca_checks.qlssrc/suites/ported_driver_ca_checks.qls renamed to src/windows-driver-suites/ported_driver_ca_checks.qls src/suites/ported_driver_ca_checks.qls renamed to src/windows-driver-suites/ported_driver_ca_checks.qls

@@ -0,0 +1,10 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+- description: Security queries required to fix when certifying Windows Drivers
+- queries: .
+  from: microsoft/windows-drivers
+- include:
+    query path: 
+      - drivers/general/queries/WdkDeprecatedApis/wdk-deprecated-api.ql
+      - microsoft/Security/CWE/CWE-704/WcharCharConversionLimited.ql

src/windows-driver-suites/windows_driver_mustfix.qls

@@ -0,0 +1,17 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+- description: Recommended and required queries for Windows Drivers.
+- import: windows-driver-suites/windows_driver_mustfix.qls
+- queries: .
+  from: microsoft/windows-drivers
+- include:
+    query path: 
+      - microsoft/Likely Bugs/Boundary Violations/PaddingByteInformationDisclosure.ql
+      - microsoft/Likely Bugs/Conversion/BadOverflowGuard.ql
+      - microsoft/Likely Bugs/Conversion/InfiniteLoop.ql
+      - microsoft/Likely Bugs/Memory Management/UseAfterFree/UseAfterFree.ql
+      - microsoft/Likely Bugs/UninitializedPtrField.ql
+      - microsoft/Security/Crytpography/HardcodedIVCNG.ql
+      - drivers/general/queries/KeSetEventPageable/KeSetEventPageable.ql
+      - drivers/general/queries/RoleTypeCorrectlyUsed/RoleTypeCorrectlyUsed.ql

src/windows-driver-suites/windows_driver_recommended.qls

@@ -4,16 +4,13 @@
 - description: Security queries required to fix when certifying Windows Drivers
 - queries: . 
   from: codeql/cpp-queries
+  version: 0.9.0
 - include:
     query path: 
       - Likely Bugs/Arithmetic/BadAdditionOverflowCheck.ql
       - Likely Bugs/Memory Management/PointerOverflow.ql
       - Likely Bugs/Underspecified Functions/TooFewArguments.ql
       - Security/CWE/CWE-190/ComparisonWithWiderType.ql
       - Security/CWE/CWE-253/HResultBooleanConversion.ql
-- queries: .
+- import: windows-driver-suites/windows_driver_mustfix.qls
   from: microsoft/windows-drivers
-- include:
-    query path: 
-      - drivers/general/queries/WdkDeprecatedApis/wdk-deprecated-api.ql
-      - microsoft/Security/CWE/CWE-704/WcharCharConversionLimited.ql

src/suites/windows_driver_mustfix.qls suites/windows_all_mustfix.qlssrc/suites/windows_driver_mustfix.qls renamed to suites/windows_all_mustfix.qls

@@ -2,9 +2,13 @@
 # Licensed under the MIT license.
 
 - description: Recommended and required queries for Windows Drivers.
-- import: suites/windows_driver_mustfix.qls
+- import: windows-driver-suites/windows_driver_mustfix.qls
+  from: microsoft/windows-drivers
+- import: windows-driver-suites/windows_driver_recommended.qls
+  from: microsoft/windows-drivers
 - queries: . 
   from: codeql/cpp-queries
+  version: 0.9.0
 - include:
     query path: 
       - Best Practices/Likely Errors/OffsetUseBeforeRangeCheck.ql
@@ -21,14 +25,8 @@
       - Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql
       - Security/CWE/CWE-676/PotentiallyDangerousFunction.ql
       - Security/CWE/CWE-704/WcharCharConversion.ql
-- queries: .
-  from: microsoft/windows-drivers
-- include:
-    query path: 
-      - microsoft/Likely Bugs/Boundary Violations/PaddingByteInformationDisclosure.ql
-      - microsoft/Likely Bugs/Conversion/BadOverflowGuard.ql
-      - microsoft/Likely Bugs/Conversion/InfiniteLoop.ql
-      - microsoft/Likely Bugs/Memory Management/UseAfterFree/UseAfterFree.ql
-      - microsoft/Likely Bugs/UninitializedPtrField.ql
-      - microsoft/Security/Crytpography/HardcodedIVCNG.ql
-      - drivers/general/queries/KeSetEventPaged/KeSetEventPageable.ql
+      - Likely Bugs/Arithmetic/BadAdditionOverflowCheck.ql
+      - Likely Bugs/Memory Management/PointerOverflow.ql
+      - Likely Bugs/Underspecified Functions/TooFewArguments.ql
+      - Security/CWE/CWE-190/ComparisonWithWiderType.ql
+      - Security/CWE/CWE-253/HResultBooleanConversion.ql