You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/language/learn-ql/cpp/conversions-classes.rst
+9-9Lines changed: 9 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,12 +4,12 @@ Tutorial: Conversions and classes
4
4
Overview
5
5
--------
6
6
7
-
This topic contains worked examples of how to write queries using the standard QL library classes for C/C++ conversions and classes.
7
+
This topic contains worked examples of how to write queries using the CodeQL library classes for C/C++ conversions and classes.
8
8
9
9
Conversions
10
10
-----------
11
11
12
-
Let us take a look at the QL ``Conversion`` class in the standard library:
12
+
Let us take a look at the ``Conversion`` class in the standard library:
13
13
14
14
- ``Expr``
15
15
@@ -128,26 +128,26 @@ Unlike the earlier versions of the query, this query would return each side of t
128
128
129
129
Note
130
130
131
-
In general, QL predicates named ``getAXxx`` exploit the ability to return multiple results (multiple instances of ``Xxx``) whereas plain ``getXxx`` predicates usually return at most one specific instance of ``Xxx``.
131
+
In general, predicates named ``getAXxx`` exploit the ability to return multiple results (multiple instances of ``Xxx``) whereas plain ``getXxx`` predicates usually return at most one specific instance of ``Xxx``.
132
132
133
133
Classes
134
134
-------
135
135
136
-
Next we're going to look at C++ classes, using the following QL classes:
136
+
Next we're going to look at C++ classes, using the following CodeQL classes:
137
137
138
138
- ``Type``
139
139
140
-
- ``UserType``—includes classes, typedefs and enums
140
+
- ``UserType``—includes classes, typedefs, and enums
141
141
142
142
- ``Class``—a class or struct
143
143
144
-
- ``Struct``—a struct, which is treated as a subtype of Class in QL.
144
+
- ``Struct``—a struct, which is treated as a subtype of ``Class``
145
145
- ``TemplateClass``—a C++ class template
146
146
147
147
Finding derived classes
148
148
~~~~~~~~~~~~~~~~~~~~~~~
149
149
150
-
We want to create a query that checks for destructors that should be ``virtual``. Specifically, when a class and a class derived from it both have destructors, the base class destructor should generally be virtual. This ensures that the derived class destructor is always invoked. A ``Destructor`` in QL is a subtype of ``MemberFunction``:
150
+
We want to create a query that checks for destructors that should be ``virtual``. Specifically, when a class and a class derived from it both have destructors, the base class destructor should generally be virtual. This ensures that the derived class destructor is always invoked. In the CodeQL library, ``Destructor`` is a subtype of ``MemberFunction``:
151
151
152
152
- ``Function``
153
153
@@ -221,13 +221,13 @@ Our last change is to use ``Function.isVirtual()`` to find cases where the base
221
221
222
222
That completes the query.
223
223
224
-
There is a similar built-in LGTM `query <https://lgtm.com/rules/2158670642/>`__ that finds classes in a C/C++ project with virtual functions but no virtual destructor. You can take a look at the QL code for this query by clicking **Open in query console** at the top of that page.
224
+
There is a similar built-in LGTM `query <https://lgtm.com/rules/2158670642/>`__ that finds classes in a C/C++ project with virtual functions but no virtual destructor. You can take a look at the code for this query by clicking **Open in query console** at the top of that page.
225
225
226
226
What next?
227
227
----------
228
228
229
229
- Explore other ways of querying classes using examples from the `C/C++ cookbook <https://help.semmle.com/wiki/label/CBCPP/class>`__.
230
230
- Take a look at the :doc:`Analyzing data flow in C/C++ <dataflow>` tutorial.
231
-
- Try the worked examples in the following topics: :doc:`Example: Checking that constructors initialize all private fields <private-field-initialization>` and :doc:`Example: Checking for allocations equal to 'strlen(string)' without space for a null terminator <zero-space-terminator>`.
231
+
- Try the worked examples in the following topics: :doc:`Example: Checking that constructors initialize all private fields <private-field-initialization>`, and :doc:`Example: Checking for allocations equal to 'strlen(string)' without space for a null terminator <zero-space-terminator>`.
232
232
- Find out more about QL in the `QL language handbook <https://help.semmle.com/QL/ql-handbook/index.html>`__ and `QL language specification <https://help.semmle.com/QL/ql-spec/language.html>`__.
233
233
- Learn more about the query console in `Using the query console <https://lgtm.com/help/lgtm/using-query-console>`__.
Copy file name to clipboardExpand all lines: docs/language/learn-ql/cpp/dataflow.rst
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,10 +4,10 @@ Analyzing data flow in C/C++
4
4
Overview
5
5
--------
6
6
7
-
This topic describes how data flow analysis is implemented in the QL for C/C++ library and includes examples to help you write your own data flow queries.
8
-
The following sections describe how to utilize the QL libraries for local data flow, global data flow and taint tracking.
7
+
This topic describes how data flow analysis is implemented in the CodeQL libraries for C/C++ and includes examples to help you write your own data flow queries.
8
+
The following sections describe how to utilize the libraries for local data flow, global data flow, and taint tracking.
9
9
10
-
For a more general introduction to modeling data flow in QL, see :doc:`Introduction to data flow analysis in QL<../intro-to-data-flow>`.
10
+
For a more general introduction to modeling data flow, see :doc:`Introduction to data flow analysis with CodeQL<../intro-to-data-flow>`.
Copy file name to clipboardExpand all lines: docs/language/learn-ql/cpp/expressions-types.rst
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,12 +4,12 @@ Tutorial: Expressions, types and statements
4
4
Overview
5
5
--------
6
6
7
-
This topic contains worked examples of how to write queries using the standard QL library classes for C/C++ expressions, types, and statements.
7
+
This topic contains worked examples of how to write queries using the standard CodeQL library classes for C/C++ expressions, types, and statements.
8
8
9
9
Expressions and types
10
10
---------------------
11
11
12
-
Each part of an expression in C becomes an instance of the QL ``Expr`` class. For example, the C code ``x = x + 1`` becomes an ``AssignExpr``, an ``AddExpr``, two instances of ``VariableAccess`` and a ``Literal``. All of these QL classes extend ``Expr``.
12
+
Each part of an expression in C becomes an instance of the ``Expr`` class. For example, the C code ``x = x + 1`` becomes an ``AssignExpr``, an ``AddExpr``, two instances of ``VariableAccess`` and a ``Literal``. All of these CodeQL classes extend ``Expr``.
13
13
14
14
Finding assignments to zero
15
15
~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -26,15 +26,15 @@ In the following example we find instances of ``AssignExpr`` which assign the co
26
26
27
27
➤ `See this in the query console <https://lgtm.com/query/1505908086530/>`__
28
28
29
-
The ``where`` clause in this example gets the expression on the right side of the assignment, ``getRValue()``, and compares it with zero. Notice that there are no checks to make sure that the right side of the assignment is an integer or that it has a value (that is, it is compile-time constant, rather than a variable). For expressions where either of these assumptions is wrong, the associated QL predicate simply does not return anything and the ``where`` clause will not produce a result. You could think of it as if there is an implicit ``exists(e.getRValue().getValue().toInt())`` at the beginning of this line.
29
+
The ``where`` clause in this example gets the expression on the right side of the assignment, ``getRValue()``, and compares it with zero. Notice that there are no checks to make sure that the right side of the assignment is an integer or that it has a value (that is, it is compile-time constant, rather than a variable). For expressions where either of these assumptions is wrong, the associated predicate simply does not return anything and the ``where`` clause will not produce a result. You could think of it as if there is an implicit ``exists(e.getRValue().getValue().toInt())`` at the beginning of this line.
30
30
31
31
It is also worth noting that the query above would find this C code:
32
32
33
33
.. code-block:: cpp
34
34
35
35
yPtr = NULL;
36
36
37
-
This is because the snapshot contains a representation of the code base after the preprocessor transforms have run (for more information, see `Database generation <https://lgtm.com/help/lgtm/generate-database>`__). This means that any macro invocations, such as the ``NULL`` define used here, are expanded during the creation of the snapshot. If you want to write queries about macros then there are some special library classes that have been designed specifically for this purpose (for example, the ``Macro``, ``MacroInvocation`` classes and predicates like ``Element.isInMacroExpansion()``). In this case, it is good that macros are expanded, but we do not want to find assignments to pointers.
37
+
This is because the database contains a representation of the code base after the preprocessor transforms have run (for more information, see `Database generation <https://lgtm.com/help/lgtm/generate-database>`__). This means that any macro invocations, such as the ``NULL`` define used here, are expanded during the creation of the database. If you want to write queries about macros then there are some special library classes that have been designed specifically for this purpose (for example, the ``Macro``, ``MacroInvocation`` classes and predicates like ``Element.isInMacroExpansion()``). In this case, it is good that macros are expanded, but we do not want to find assignments to pointers.
Copy file name to clipboardExpand all lines: docs/language/learn-ql/cpp/function-classes.rst
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,14 +4,14 @@ Tutorial: Function classes
4
4
Overview
5
5
--------
6
6
7
-
The standard QL library for C and C++ represents functions using the ``Function`` class (see :doc:`Introducing the C/C++ libraries <introduce-libraries-cpp>`).
7
+
The standard CodeQL library for C and C++ represents functions using the ``Function`` class (see :doc:`Introducing the C/C++ libraries <introduce-libraries-cpp>`).
8
8
9
9
The example queries in this topic explore some of the most useful library predicates for querying functions.
10
10
11
11
Finding all static functions
12
12
----------------------------
13
13
14
-
Using the member predicate ``Function.isStatic()`` we can list all of the static functions in a snapshot:
14
+
Using the member predicate ``Function.isStatic()`` we can list all the static functions in a database:
15
15
16
16
.. code-block:: ql
17
17
@@ -26,7 +26,7 @@ This query is very general, so there are probably too many results to be interes
26
26
Finding functions that are not called
27
27
-------------------------------------
28
28
29
-
It might be more interesting to find functions that are not called, using the standard QL ``FunctionCall`` class from the **abstract syntax tree** category (see :doc:`Introducing the C/C++ libraries <introduce-libraries-cpp>`). The ``FunctionCall`` class can be used to identify places where a function is actually used, and it is related to ``Function`` through the ``FunctionCall.getTarget()`` predicate.
29
+
It might be more interesting to find functions that are not called, using the standard CodeQL ``FunctionCall`` class from the **abstract syntax tree** category (see :doc:`Introducing the C/C++ libraries <introduce-libraries-cpp>`). The ``FunctionCall`` class can be used to identify places where a function is actually used, and it is related to ``Function`` through the ``FunctionCall.getTarget()`` predicate.
30
30
31
31
.. code-block:: ql
32
32
@@ -58,9 +58,9 @@ You can modify the query to remove functions where a function pointer is used to
58
58
59
59
This query returns fewer results. However, if you examine the results then you can probably still find potential refinements.
60
60
61
-
For example, there is a more complicated LGTM `query <https://lgtm.com/rules/2152580467/>`__ that finds unused static functions. To see the QL code for this query, click **Open in query console** at the top of the page.
61
+
For example, there is a more complicated LGTM `query <https://lgtm.com/rules/2152580467/>`__ that finds unused static functions. To see the code for this query, click **Open in query console** at the top of the page.
62
62
63
-
You can explore the definition of an element in the standard QL libraries and see what predicates are available. Use the keyboard **F3** button to open the definition of any element. Alternatively, hover over the element and click **Jump to definition** in the tooltip displayed. The library file is opened in a new tab with the definition highlighted.
63
+
You can explore the definition of an element in the standard libraries and see what predicates are available. Use the keyboard **F3** button to open the definition of any element. Alternatively, hover over the element and click **Jump to definition** in the tooltip displayed. The library file is opened in a new tab with the definition highlighted.
0 commit comments