Skip to content

Commit 5dc2b92

Browse files
authored
Update suppression library to use new query IDs. (#137)
* Update suppression IDs [in-progress] * Finish adding/updating suppression IDs. * Fix opaque query IDs for a few queies. * Clean up some accidental duplicates in Suppression.qll.
1 parent eddc6fd commit 5dc2b92

7 files changed

Lines changed: 61 additions & 53 deletions

File tree

src/drivers/general/queries/IrqlTooHigh/IrqlTooHigh.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,15 @@
22
// Licensed under the MIT license.
33
/**
44
* @id cpp/drivers/irql-too-high
5-
* @name IRQL too high (C28120)
5+
* @name IRQL too high (C28121)
66
* @description A function annotated with IRQL requirements was called at an IRQL too high for the requirements.
77
* @platform Desktop
88
* @security.severity Low
99
* @feature.area Multiple
1010
* @impact Exploitable Design
1111
* @repro.text The following function call is taking place at an IRQL too high for what the call target is annotated as.
1212
* @owner.email sdat@microsoft.com
13-
* @opaqueid CQLD-C28120
13+
* @opaqueid CQLD-C28121
1414
* @kind problem
1515
* @problem.severity warning
1616
* @precision medium

src/drivers/general/queries/IrqlTooHigh/IrqlTooHigh.sarif

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"driver" : {
77
"name" : "CodeQL",
88
"organization" : "GitHub",
9-
"semanticVersion" : "2.14.4",
9+
"semanticVersion" : "2.15.4",
1010
"notifications" : [ {
1111
"id" : "cpp/baseline/expected-extracted-files",
1212
"name" : "cpp/baseline/expected-extracted-files",
@@ -27,7 +27,7 @@
2727
"id" : "cpp/drivers/irql-too-high",
2828
"name" : "cpp/drivers/irql-too-high",
2929
"shortDescription" : {
30-
"text" : "IRQL too high (C28120)"
30+
"text" : "IRQL too high (C28121)"
3131
},
3232
"fullDescription" : {
3333
"text" : "A function annotated with IRQL requirements was called at an IRQL too high for the requirements."
@@ -43,8 +43,8 @@
4343
"id" : "cpp/drivers/irql-too-high",
4444
"impact" : "Exploitable Design",
4545
"kind" : "problem",
46-
"name" : "IRQL too high (C28120)",
47-
"opaqueid" : "CQLD-C28120",
46+
"name" : "IRQL too high (C28121)",
47+
"opaqueid" : "CQLD-C28121",
4848
"owner.email" : "sdat@microsoft.com",
4949
"platform" : "Desktop",
5050
"precision" : "medium",
@@ -58,7 +58,7 @@
5858
},
5959
"extensions" : [ {
6060
"name" : "microsoft/windows-drivers",
61-
"semanticVersion" : "0.2.0+4842fd4116871d3b47eede85c2c4497b43c34d57",
61+
"semanticVersion" : "1.1.0+2affc3c634804dac7504a483a378cc9ba22a0f0b",
6262
"locations" : [ {
6363
"uri" : "file:///C:/codeql-home/Windows-Driver-Developer-Supplemental-Tools/src/",
6464
"description" : {

src/drivers/general/queries/IrqlTooLow/IrqlTooLow.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,15 @@
22
// Licensed under the MIT license.
33
/**
44
* @id cpp/drivers/irql-too-low
5-
* @name IRQL too low (C28121)
5+
* @name IRQL too low (C28120)
66
* @description A function annotated with IRQL requirements was called at an IRQL too low for the requirements.
77
* @platform Desktop
88
* @security.severity Low
99
* @feature.area Multiple
1010
* @impact Exploitable Design
1111
* @repro.text The following function call is taking place at an IRQL too low for what the call target is annotated as.
1212
* @owner.email sdat@microsoft.com
13-
* @opaqueid CQLD-C28121
13+
* @opaqueid CQLD-C28120
1414
* @kind problem
1515
* @problem.severity warning
1616
* @precision medium

src/drivers/general/queries/IrqlTooLow/IrqlTooLow.sarif

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"driver" : {
77
"name" : "CodeQL",
88
"organization" : "GitHub",
9-
"semanticVersion" : "2.14.4",
9+
"semanticVersion" : "2.15.4",
1010
"notifications" : [ {
1111
"id" : "cpp/baseline/expected-extracted-files",
1212
"name" : "cpp/baseline/expected-extracted-files",
@@ -27,7 +27,7 @@
2727
"id" : "cpp/drivers/irql-too-low",
2828
"name" : "cpp/drivers/irql-too-low",
2929
"shortDescription" : {
30-
"text" : "IRQL too low (C28121)"
30+
"text" : "IRQL too low (C28120)"
3131
},
3232
"fullDescription" : {
3333
"text" : "A function annotated with IRQL requirements was called at an IRQL too low for the requirements."
@@ -43,8 +43,8 @@
4343
"id" : "cpp/drivers/irql-too-low",
4444
"impact" : "Exploitable Design",
4545
"kind" : "problem",
46-
"name" : "IRQL too low (C28121)",
47-
"opaqueid" : "CQLD-C28121",
46+
"name" : "IRQL too low (C28120)",
47+
"opaqueid" : "CQLD-C28120",
4848
"owner.email" : "sdat@microsoft.com",
4949
"platform" : "Desktop",
5050
"precision" : "medium",
@@ -58,7 +58,7 @@
5858
},
5959
"extensions" : [ {
6060
"name" : "microsoft/windows-drivers",
61-
"semanticVersion" : "0.2.0+4842fd4116871d3b47eede85c2c4497b43c34d57",
61+
"semanticVersion" : "1.1.0+2affc3c634804dac7504a483a378cc9ba22a0f0b",
6262
"locations" : [ {
6363
"uri" : "file:///C:/codeql-home/Windows-Driver-Developer-Supplemental-Tools/src/",
6464
"description" : {

src/drivers/general/queries/RoleTypeCorrectlyUsed/RoleTypeCorrectlyUsed.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
* @impact Insecure Coding Practice
1111
* @repro.text
1212
* @owner.email: sdat@microsoft.com
13-
* @opaqueid CQLD-C28158
13+
* @opaqueid CQLD-D0007
1414
* @problem.severity warning
1515
* @precision medium
1616
* @tags correctness

src/drivers/general/queries/RoleTypeCorrectlyUsed/RoleTypeCorrectlyUsed.sarif

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -44,27 +44,27 @@
4444
"impact" : "Insecure Coding Practice",
4545
"kind" : "problem",
4646
"name" : "Incorrect Role Type Use",
47-
"opaqueid" : "CQLD-C28158",
47+
"opaqueid" : "CQLD-D0007",
4848
"owner.email:" : "sdat@microsoft.com",
4949
"platform" : "Desktop",
5050
"precision" : "medium",
5151
"problem.severity" : "warning",
52-
"query-version" : "v1",
52+
"query-version" : "v2",
5353
"repro.text" : "",
5454
"scope" : "domainspecific"
5555
}
5656
} ]
5757
},
5858
"extensions" : [ {
5959
"name" : "microsoft/windows-drivers",
60-
"semanticVersion" : "1.0.12+54db165bcee31f7827c56bf2bb9a408d8a4db4fe",
60+
"semanticVersion" : "1.1.0+2affc3c634804dac7504a483a378cc9ba22a0f0b",
6161
"locations" : [ {
62-
"uri" : "file:///C:/codeql-home/WDDST/src/",
62+
"uri" : "file:///C:/codeql-home/Windows-Driver-Developer-Supplemental-Tools/src/",
6363
"description" : {
6464
"text" : "The QL pack root directory."
6565
}
6666
}, {
67-
"uri" : "file:///C:/codeql-home/WDDST/src/qlpack.yml",
67+
"uri" : "file:///C:/codeql-home/Windows-Driver-Developer-Supplemental-Tools/src/qlpack.yml",
6868
"description" : {
6969
"text" : "The QL pack definition file."
7070
}
@@ -76,9 +76,9 @@
7676
"locations" : [ {
7777
"physicalLocation" : {
7878
"artifactLocation" : {
79-
"uri" : "driver/driver_snippet.c",
79+
"uri" : "driver/fail_driver1.c",
8080
"uriBaseId" : "%SRCROOT%",
81-
"index" : 0
81+
"index" : 1
8282
}
8383
}
8484
} ],
@@ -99,9 +99,9 @@
9999
"locations" : [ {
100100
"physicalLocation" : {
101101
"artifactLocation" : {
102-
"uri" : "driver/fail_driver1.c",
102+
"uri" : "driver/driver_snippet.c",
103103
"uriBaseId" : "%SRCROOT%",
104-
"index" : 1
104+
"index" : 0
105105
}
106106
}
107107
} ],

src/drivers/libraries/Suppression.qll

Lines changed: 37 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,17 @@
11
import cpp
22

33
// Reference: https://learn.microsoft.com/en-us/cpp/preprocessor/warning?view=msvc-170
4-
5-
/** Represents a Code Analysis-style suppression using #pragma commands.
6-
*
4+
/**
5+
* Represents a Code Analysis-style suppression using #pragma commands.
6+
*
77
* In this library we support two styles:
88
* #pragma prefast (suppress:XXXX) which suppresses rule XXXX on the following line of code, and
99
* #pragma prefast (disable:XXXX) which suppresses rule XXXX until the pragma stack is adjusted using #pragma (push/pop).
10-
*
10+
*
1111
* More details can be found at https://learn.microsoft.com/en-us/cpp/preprocessor/warning?view=msvc-170.
1212
* Please note that at present, pragma commands combining disable and suppress commands in a single line are
1313
* not supported.
14-
*/
14+
*/
1515
abstract class CASuppression extends PreprocessorPragma {
1616
abstract predicate matchesRuleName(string name);
1717

@@ -34,15 +34,11 @@ abstract class CASuppression extends PreprocessorPragma {
3434
"__WARNING_BANNED_API_USAGE_LSTRLEN", "28750"
3535
]
3636
) and
37-
result = "lgtm[cpp/windows/drivers/queries/extended-deprecated-apis]"
37+
result = "lgtm[cpp/drivers/extended-deprecated-apis]"
3838
or
3939
this.getRuleName() = any(["__WARNING_UNHELPFUL_TAG", "28147"]) and
4040
result =
41-
any([
42-
"lgtm[cpp/windows/drivers/queries/default-pool-tag]",
43-
"lgtm[cpp/windows/drivers/queries/default-pool-tag-extended]"
44-
]
45-
)
41+
any(["lgtm[cpp/drivers/default-pool-tag]", "lgtm[cpp/drivers/default-pool-tag-extended]"])
4642
or
4743
this.getRuleName() = any(["__WARNING_IRQL_NOT_SET", "28158"]) and
4844
result = "lgtm[cpp/drivers/irql-not-saved]"
@@ -51,56 +47,68 @@ abstract class CASuppression extends PreprocessorPragma {
5147
result = "lgtm[cpp/drivers/irql-not-used]"
5248
or
5349
this.getRuleName() = any(["__WARNING_POOL_TAG", "28134"]) and
54-
result = "lgtm[cpp/windows/drivers/queries/pool-tag-integral]"
50+
result = "lgtm[cpp/drivers/pool-tag-integral]"
5551
or
5652
this.getRuleName() = any(["__WARNING_STRSAFE_H", "28146"]) and
57-
result = "lgtm[cpp/portedqueries/str-safe]"
53+
result = "lgtm[cpp/drivers/str-safe]"
5854
or
5955
this.getRuleName() = any(["__WARNING_MUST_USE", "28193"]) and
60-
result = "lgtm[cpp/portedqueries/examined-value]"
61-
or
62-
this.getRuleName() = any(["__WARNING_IRQ_TOO_LOW", "28120"]) and
63-
result = "lgtm[cpp/portedqueries/irq-too-low]"
56+
result = "lgtm[cpp/drivers/examined-value]"
6457
or
6558
this.getRuleName() = any(["__WARNING_IRQ_TOO_HIGH", "28121"]) and
66-
result = "lgtm[cpp/portedqueries/irq-too-high]"
59+
result = "lgtm[cpp/drivers/irql-too-high]"
60+
or
61+
this.getRuleName() = any(["__WARNING_IRQ_TOO_LOW", "28120"]) and
62+
result = "lgtm[cpp/drivers/irql-too-low]"
6763
or
6864
this.getRuleName() = any(["__WARNING_FUNCTION_ASSIGNMENT", "28128"]) and
69-
result = "lgtm[cpp/windows/drivers/queries/illegal-field-access]"
65+
result = "lgtm[cpp/drivers/illegal-field-access]"
7066
or
7167
this.getRuleName() = any(["__WARNING_INACCESSIBLE_MEMBER", "28175"]) and
72-
result = "lgtm[cpp/windows/drivers/queries/illegal-field-access-2]"
68+
result = "lgtm[cpp/drivers/illegal-field-access-2]"
7369
or
7470
this.getRuleName() = any(["__WARNING_READ_ONLY_MEMBER", "28176"]) and
75-
result = "lgtm[cpp/windows/drivers/queries/illegal-field-write]"
71+
result = "lgtm[cpp/drivers/illegal-field-write]"
7672
or
7773
this.getRuleName() = any(["__WARNING_INIT_NOT_CLEARED", "28152"]) and
78-
result = "lgtm[cpp/windows/drivers/queries/init-not-cleared]"
74+
result = "lgtm[cpp/drivers/init-not-cleared]"
7975
or
8076
this.getRuleName() = any(["__WARNING_KE_WAIT_LOCAL", "28135"]) and
8177
result = "lgtm[cpp/drivers/kewaitlocal-requires-kernel-mode]"
8278
or
8379
this.getRuleName() = any(["__WARNING_MULTIPLE_PAGED_CODE", "28171"]) and
84-
result = "lgtm[cpp/portedqueries/multiple-paged-code]"
80+
result = "lgtm[cpp/drivers/multiple-paged-code]"
8581
or
8682
this.getRuleName() = any(["__WARNING_NO_PAGED_CODE", "28170"]) and
87-
result = "lgtm[cpp/portedqueries/no-paged-code]"
83+
result = "lgtm[cpp/drivers/no-paged-code]"
8884
or
8985
this.getRuleName() = any(["__WARNING_NO_PAGING_SEGMENT", "28172"]) and
90-
result = "lgtm[cpp/portedqueries/no-paging-segment]"
86+
result = "lgtm[cpp/drivers/no-paging-segment]"
9187
or
9288
this.getRuleName() = any(["__WARNING_OBJ_REFERENCE_MODE", "28126"]) and
93-
result = "lgtm[cpp/windows/drivers/queries/ob-reference-mode]"
89+
result = "lgtm[cpp/drivers/ob-reference-mode]"
9490
or
9591
this.getRuleName() = any(["__WARNING_MODIFYING_MDL", "28145"]) and
96-
result = "lgtm[cpp/windows/drivers/queries/opaquemdlwrite]"
92+
result = "lgtm[cpp/drivers/opaque-mdl-write]"
9793
or
9894
this.getRuleName() = any(["__WARNING_PENDING_STATUS_ERROR", "28143"]) and
99-
result = "lgtm[cpp/portedqueries/pending-status-error]"
95+
result = "lgtm[cpp/drivers/pending-status-error]"
10096
or
10197
this.getRuleName() =
10298
any(["__WARNING_DISPATCH_MISMATCH", "28168", "__WARNING_DISPATCH_MISSING", "28169"]) and
103-
result = "lgtm[cpp/portedqueries/wrong-dispatch-table-assignment]"
99+
result = "lgtm[cpp/drivers/wrong-dispatch-table-assignment]"
100+
or
101+
this.getRuleName() = any(["__WARNING_IRQ_SET_TOO_HIGH", "28150"]) and
102+
result = "lgtm[cpp/drivers/irql-set-too-high]"
103+
or
104+
this.getRuleName() = any(["__WARNING_IRQ_SET_TOO_LOW", "28124"]) and
105+
result = "lgtm[cpp/drivers/irql-set-too-low]"
106+
or
107+
this.getRuleName() = any(["__WARNING_INTERLOCKEDDECREMENT_MISUSE1", "28616"]) and
108+
result = "lgtm[cpp/drivers/multithreaded-av-condition]"
109+
or
110+
this.getRuleName() = any(["__WARNING_PROTOTYPE_MISMATCH", "28127"]) and
111+
result = "lgtm[cpp/drivers/routine-function-type-not-expected]"
104112
or
105113
result = "lgtm[" + this.getRuleName() + "]"
106114
}

0 commit comments

Comments
 (0)