Skip to content

Fix unexpected results in unit tests #386

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Chanel (chanel-y) wants to merge 8 commits into
base: main
Choose a base branch
from
Open

Fix unexpected results in unit tests #386

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
73abf9c
Python: Annotate nested unresolved calls
chanel-y Jul 31, 2026
b6447fd
Ruby: Annotate array type-tracking results
chanel-y Jul 31, 2026
71ee319
Ruby: Annotate hash type-tracking results
chanel-y Jul 31, 2026
8aff1e5
Ruby: Document global type-tracking imprecision
chanel-y Jul 31, 2026
48656b4
C++: Correct leap-year inline query IDs
chanel-y Aug 3, 2026
f3eb153
PowerShell: Exclude pipeline parameters from command-line sources
chanel-y Aug 3, 2026
2084f84
Merge branch 'main' into fix-unexpected-results
chanel-y Aug 4, 2026
5ea8955
Revert incorrect Ruby dataflow test annotations
chanel-y Aug 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 0 additions & 44 deletions ...ar/UncheckedLeapYearAfterYearModification/UncheckedLeapYearAfterYearModification.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,47 +141,3 @@ nodes
| test.cpp:1697:2:1697:22 | ... += ... | semmle.label | ... += ... |
| test.cpp:1773:2:1773:22 | ... += ... | semmle.label | ... += ... |
subpaths
testFailures
| test.cpp:422:2:422:14 | ... += ... | Unexpected result: Alert |
| test.cpp:440:2:440:11 | ... ++ | Unexpected result: Alert |
| test.cpp:456:2:456:12 | ... ++ | Unexpected result: Alert |
| test.cpp:681:2:681:23 | ... += ... | Unexpected result: Alert |
| test.cpp:813:2:813:40 | ... = ... | Unexpected result: Alert |
| test.cpp:813:21:813:40 | ... + ... | Unexpected result: Alert |
| test.cpp:818:2:818:24 | ... = ... | Unexpected result: Alert |
| test.cpp:818:13:818:24 | ... + ... | Unexpected result: Alert |
| test.cpp:951:3:951:25 | ... = ... | Unexpected result: Alert |
| test.cpp:951:14:951:25 | ... + ... | Unexpected result: Alert |
| test.cpp:969:3:969:12 | ... ++ | Unexpected result: Alert |
| test.cpp:1051:2:1051:11 | ... ++ | Unexpected result: Alert |
| test.cpp:1071:16:1071:23 | increment_arg output argument | Unexpected result: Alert |
| test.cpp:1075:27:1075:35 | increment_arg_by_pointer output argument | Unexpected result: Alert |
| test.cpp:1129:2:1129:26 | ... = ... | Unexpected result: Alert |
| test.cpp:1129:14:1129:26 | ... - ... | Unexpected result: Alert |
| test.cpp:1180:2:1180:19 | ... = ... | Unexpected result: Alert |
| test.cpp:1219:2:1219:28 | ... = ... | Unexpected result: Alert |
| test.cpp:1219:16:1219:28 | ... + ... | Unexpected result: Alert |
| test.cpp:1234:2:1234:28 | ... = ... | Unexpected result: Alert |
| test.cpp:1234:16:1234:28 | ... + ... | Unexpected result: Alert |
| test.cpp:1248:2:1248:28 | ... = ... | Unexpected result: Alert |
| test.cpp:1248:16:1248:28 | ... + ... | Unexpected result: Alert |
| test.cpp:1262:2:1262:26 | ... = ... | Unexpected result: Alert |
| test.cpp:1262:14:1262:26 | ... + ... | Unexpected result: Alert |
| test.cpp:1276:2:1276:26 | ... = ... | Unexpected result: Alert |
| test.cpp:1276:14:1276:26 | ... + ... | Unexpected result: Alert |
| test.cpp:1282:2:1282:28 | ... = ... | Unexpected result: Alert |
| test.cpp:1282:16:1282:28 | ... + ... | Unexpected result: Alert |
| test.cpp:1294:2:1294:28 | ... = ... | Unexpected result: Alert |
| test.cpp:1294:16:1294:28 | ... + ... | Unexpected result: Alert |
| test.cpp:1307:2:1307:26 | ... = ... | Unexpected result: Alert |
| test.cpp:1307:14:1307:26 | ... + ... | Unexpected result: Alert |
| test.cpp:1319:2:1319:26 | ... = ... | Unexpected result: Alert |
| test.cpp:1319:14:1319:26 | ... + ... | Unexpected result: Alert |
| test.cpp:1361:2:1361:17 | ... = ... | Unexpected result: Alert |
| test.cpp:1535:2:1535:15 | ... = ... | Unexpected result: Alert |
| test.cpp:1565:2:1565:22 | ... += ... | Unexpected result: Alert |
| test.cpp:1573:2:1573:22 | ... += ... | Unexpected result: Alert |
| test.cpp:1652:2:1652:22 | ... += ... | Unexpected result: Alert |
| test.cpp:1664:2:1664:22 | ... += ... | Unexpected result: Alert |
| test.cpp:1697:2:1697:22 | ... += ... | Unexpected result: Alert |
| test.cpp:1773:2:1773:22 | ... += ... | Unexpected result: Alert |
82 changes: 41 additions & 41 deletions ...ql/test/query-tests/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearModification/test.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -419,10 +419,10 @@ void AntiPattern_unchecked_filetime_conversion2a()
GetSystemTime(&st);

// BUG - UncheckedLeapYearAfterYearModification
st.wYear += 2; // $ Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
st.wYear += 2; // $ Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]

// BUG - UncheckedReturnValueForTimeFunctions
SystemTimeToFileTime(&st, &ft); // $ Alert[cpp/leap-year/unchecked-return-value-for-time-conversion-function]
SystemTimeToFileTime(&st, &ft); // $ Alert[cpp/microsoft/public/leap-year/unchecked-return-value-for-time-conversion-function]
}

/**
Expand All @@ -437,10 +437,10 @@ void AntiPattern_unchecked_filetime_conversion2b()
GetSystemTime(&st);

// BUG - UncheckedLeapYearAfterYearModification
st.wYear++; // $ Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
st.wYear++; // $ Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]

// BUG - UncheckedReturnValueForTimeFunctions
SystemTimeToFileTime(&st, &ft); // $ Alert[cpp/leap-year/unchecked-return-value-for-time-conversion-function]
SystemTimeToFileTime(&st, &ft); // $ Alert[cpp/microsoft/public/leap-year/unchecked-return-value-for-time-conversion-function]
}

/**
Expand All @@ -453,10 +453,10 @@ void AntiPattern_unchecked_filetime_conversion2b(SYSTEMTIME* st)
FILETIME ft;

// BUG - UncheckedLeapYearAfterYearModification
st->wYear++; // $ Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
st->wYear++; // $ Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]

// BUG - UncheckedReturnValueForTimeFunctions
SystemTimeToFileTime(st, &ft); // $ Alert[cpp/leap-year/unchecked-return-value-for-time-conversion-function]
SystemTimeToFileTime(st, &ft); // $ Alert[cpp/microsoft/public/leap-year/unchecked-return-value-for-time-conversion-function]
}

/**
Expand Down Expand Up @@ -678,7 +678,7 @@ void AntiPattern_IncorrectGuard(int yearsToAdd)
GetSystemTime(&st);

// BUG - UncheckedLeapYearAfterYearModification
st.wYear += yearsToAdd; // $ Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
st.wYear += yearsToAdd; // $ Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]

// Incorrect Guard
if (st.wMonth == 2 && st.wDay == 29)
Expand Down Expand Up @@ -810,12 +810,12 @@ void test(int x)

// BUG - UncheckedLeapYearAfterYearModification
// Positive Case - Anti-pattern 1: [year +-n, month, day]
timeinfo.tm_year = x + timeinfo.tm_year; // $ Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
timeinfo.tm_year = x + timeinfo.tm_year; // $ Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]

st.wYear = x;
// BUG - UncheckedLeapYearAfterYearModification
// Positive Case - Anti-pattern 1: [year +-n, month, day]
st.wYear = x + st.wYear; // $ Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
st.wYear = x + st.wYear; // $ Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]
}

/**
Expand Down Expand Up @@ -948,9 +948,9 @@ void tp_intermediaryVar(struct timespec now, struct logtime &timestamp_remote)
GetSystemTime(&st);

// BUG - UncheckedLeapYearAfterYearModification
st.wYear = st.wYear + 1; // $ Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
st.wYear = st.wYear + 1; // $ Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]

SystemTimeToFileTime(&st, &ft); // $ Alert[cpp/leap-year/unchecked-return-value-for-time-conversion-function]
SystemTimeToFileTime(&st, &ft); // $ Alert[cpp/microsoft/public/leap-year/unchecked-return-value-for-time-conversion-function]
}

/**
Expand All @@ -966,9 +966,9 @@ void tp_intermediaryVar(struct timespec now, struct logtime &timestamp_remote)
GetSystemTime(&st);

// BUG - UncheckedLeapYearAfterYearModification
st.wYear++; // $ Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
st.wYear++; // $ Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]

SystemTimeToFileTime(&st, &ft); // $ Alert[cpp/leap-year/unchecked-return-value-for-time-conversion-function]
SystemTimeToFileTime(&st, &ft); // $ Alert[cpp/microsoft/public/leap-year/unchecked-return-value-for-time-conversion-function]
}

/**
Expand Down Expand Up @@ -1048,11 +1048,11 @@ void fp_daymonth_guard(){
// FALSE POSITIVE: year is incremented but month is checked and day corrected
// in a ternary operation. It may be possible to fix this with a more sophisticated
// data flow analysis.
st.wYear++; // $ SPURIOUS: Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
st.wYear++; // $ SPURIOUS: Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]

st.wDay = st.wMonth == 2 && st.wDay == 29 ? 28 : st.wDay;

SystemTimeToFileTime(&st, &ft); // $ Alert[cpp/leap-year/unchecked-return-value-for-time-conversion-function]
SystemTimeToFileTime(&st, &ft); // $ Alert[cpp/microsoft/public/leap-year/unchecked-return-value-for-time-conversion-function]
}

void increment_arg(WORD &x){
Expand All @@ -1068,11 +1068,11 @@ void fn_year_set_through_out_arg(){
SYSTEMTIME st;
GetSystemTime(&st);
// BAD, year incremented without check
increment_arg(st.wYear); // $ Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
increment_arg(st.wYear); // $ Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]

// GetSystemTime(&st);
// Bad, year incremented without check
increment_arg_by_pointer(&st.wYear); // $ Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
increment_arg_by_pointer(&st.wYear); // $ Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]
}


Expand Down Expand Up @@ -1126,7 +1126,7 @@ typedef struct _TIME_FIELDS {

void
tp_ptime(PTIME_FIELDS ptm){
ptm->Year = ptm->Year - 1; // $ Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
ptm->Year = ptm->Year - 1; // $ Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]
}


Expand Down Expand Up @@ -1177,7 +1177,7 @@ void leap_year_checked_raw_false_positive2(WORD year, WORD offset, WORD day){

year += offset; // $ Source

tmp.tm_year = year; // $ Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
tmp.tm_year = year; // $ Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]

}

Expand Down Expand Up @@ -1216,7 +1216,7 @@ void inverted_leap_year_check(WORD year, WORD offset, WORD day){
day = 28;
}

tmp.tm_year = year + offset; // $ Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
tmp.tm_year = year + offset; // $ Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]
}


Expand All @@ -1231,7 +1231,7 @@ void simplified_leap_year_check1(WORD year, WORD offset){
}

// Modified after check, could be dangerous
tmp.tm_year = year + offset; // $ Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
tmp.tm_year = year + offset; // $ Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]
}

void simplified_leap_year_check2(WORD year, WORD offset){
Expand All @@ -1245,7 +1245,7 @@ void simplified_leap_year_check2(WORD year, WORD offset){
}

// Modified after check, could be dangerous
tmp.tm_year = year + offset; // $ Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
tmp.tm_year = year + offset; // $ Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]
}

void simplified_leap_year_check3(WORD year, WORD offset){
Expand All @@ -1259,7 +1259,7 @@ void simplified_leap_year_check3(WORD year, WORD offset){
}

// Modified after check, could be dangerous
tmp.wYear = year + offset; // $ Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
tmp.wYear = year + offset; // $ Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]
}

void simplified_leap_year_check4(WORD year, WORD offset){
Expand All @@ -1273,13 +1273,13 @@ void simplified_leap_year_check4(WORD year, WORD offset){
}

// Modified after check, could be dangerous
tmp.wYear = year + offset; // $ Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
tmp.wYear = year + offset; // $ Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]
}

void bad_simplified_leap_year_check1(WORD year, WORD offset){
struct tm tmp;

tmp.tm_year = year + offset; // $ Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
tmp.tm_year = year + offset; // $ Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]

// incorrect logic, should negate the %4 result
bool isLeap = ((tmp.tm_year + 1900) % 4) && ((tmp.tm_year + 1900) % 100 || !((tmp.tm_year + 1900) % 400));
Expand All @@ -1291,7 +1291,7 @@ void bad_simplified_leap_year_check1(WORD year, WORD offset){
void bad_simplified_leap_year_check2(WORD year, WORD offset){
struct tm tmp;

tmp.tm_year = year + offset; // $ Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
tmp.tm_year = year + offset; // $ Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]


// incorrect logic, should not negate the %4 result
Expand All @@ -1304,7 +1304,7 @@ void bad_simplified_leap_year_check2(WORD year, WORD offset){
void bad_simplified_leap_year_check3(WORD year, WORD offset){
SYSTEMTIME tmp;

tmp.wYear = year + offset; // $ Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
tmp.wYear = year + offset; // $ Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]

// incorrect logic, should negate the %4 result
bool isLeap = (tmp.wYear % 4) && (tmp.wYear % 100 || !(tmp.wYear % 400));
Expand All @@ -1316,7 +1316,7 @@ void bad_simplified_leap_year_check3(WORD year, WORD offset){
void bad_simplified_leap_year_check4(WORD year, WORD offset){
SYSTEMTIME tmp;

tmp.wYear = year + offset; // $ Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
tmp.wYear = year + offset; // $ Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]


// incorrect logic, should not negate the %4 result
Expand Down Expand Up @@ -1358,7 +1358,7 @@ void indirect_time_conversion_check(WORD year, WORD offset){
void set_time(WORD year, WORD month, WORD day){
SYSTEMTIME tmp;

tmp.wYear = year; // $ Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
tmp.wYear = year; // $ Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]
tmp.wMonth = month;
tmp.wDay = day;
}
Expand Down Expand Up @@ -1492,7 +1492,7 @@ void modification_after_conversion1(tm timeinfo){
// and never reassigned to another struct.
WORD year = timeinfo.tm_year + 1900;

year += 1; // $ MISSING: Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
year += 1; // $ MISSING: Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]
}

WORD get_civil_year(tm timeinfo){
Expand All @@ -1504,7 +1504,7 @@ void modification_after_conversion2(tm timeinfo){
// This case shows a false negative where the year might be used and it is incorrectly modified,
// and never reassigned to another struct.
WORD year = get_civil_year(timeinfo);
year += 1; // $ MISSING: Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
year += 1; // $ MISSING: Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]
}

void modification_after_conversion_saved_to_other_time_struct1(tm timeinfo){
Expand All @@ -1518,7 +1518,7 @@ void modification_after_conversion_saved_to_other_time_struct1(tm timeinfo){
SYSTEMTIME s;
// FALSE NEGATIVE: missing this because the conversion happens locally before
// the year adjustment, which seems as though it is part of a conversion itself
s.wYear = year; // $ MISSING: Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
s.wYear = year; // $ MISSING: Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]
}


Expand All @@ -1532,7 +1532,7 @@ void modification_after_conversion_saved_to_other_time_struct2(tm timeinfo){
year += 1; // $ Source

SYSTEMTIME s;
s.wYear = year; // $ Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
s.wYear = year; // $ Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]
}

void modification_after_conversion_saved_to_other_time_struct3(tm timeinfo){
Expand All @@ -1546,7 +1546,7 @@ void modification_after_conversion_saved_to_other_time_struct3(tm timeinfo){
SYSTEMTIME s;
// FALSE NEGATIVE: missing this because the conversion happens locally before
// the year adjustment, which seems as though it is part of a conversion itself
s.wYear = year; // $ MISSING: Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
s.wYear = year; // $ MISSING: Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]
}


Expand All @@ -1558,19 +1558,19 @@ void year_saved_to_variable_then_modified1(tm timeinfo){
// NOTE: should we even try to detect cases like this?
// Our current rationale is that a year in a struct is more dangerous than a year in isolation
// A year in isolation is harder to interpret
year += 1; // MISSING: $ Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
year += 1; // MISSING: $ Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]
}

void modification_before_conversion1(tm timeinfo){
timeinfo.tm_year += 1; // $ Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
timeinfo.tm_year += 1; // $ Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]
// convert a tm year into a civil year, then modify after conversion
// This case shows a false negative where the year might be used and it is incorrectly modified,
// and never reassigned to another struct.
WORD year = timeinfo.tm_year + 1900;
}

void modification_before_conversion2(tm timeinfo){
timeinfo.tm_year += 1; // $ Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
timeinfo.tm_year += 1; // $ Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]
// convert a tm year into a civil year, then modify after conversion
// This case shows a false negative where the year might be used and it is incorrectly modified,
// and never reassigned to another struct.
Expand Down Expand Up @@ -1649,7 +1649,7 @@ void odd_leap_year_check1(tm timeinfo){
}

void odd_leap_year_check2(tm timeinfo){
timeinfo.tm_year += 1; // $ SPURIOUS: Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
timeinfo.tm_year += 1; // $ SPURIOUS: Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]

// Using an odd sytle of checking divisible by 4 presumably as an optimization trick
// but also check unrelated conditions on the year as an optimization to rule out irrelevant years
Expand All @@ -1661,7 +1661,7 @@ void odd_leap_year_check2(tm timeinfo){
}

void odd_leap_year_check3(tm timeinfo){
timeinfo.tm_year += 1; // $ SPURIOUS: Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
timeinfo.tm_year += 1; // $ SPURIOUS: Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]

// Using an odd sytle of checking divisible by 4 presumably as an optimization trick
// but also check unrelated conditions on the year as an optimization to rule out irrelevant years
Expand Down Expand Up @@ -1694,7 +1694,7 @@ void odd_leap_year_check5(tm timeinfo){


void date_adjusted_through_mkgmtime(tm timeinfo){
timeinfo.tm_year += 1; // $ SPURIOUS: Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
timeinfo.tm_year += 1; // $ SPURIOUS: Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]

// Using an odd sytle of checking divisible by 4 presumably as an optimization trick
// but also check unrelated conditions on the year as an optimization to rule out irrelevant years
Expand Down Expand Up @@ -1770,7 +1770,7 @@ void assumed_maketime_conversion1(tm timeinfo)


void bad_leap_year_check_logic1(tm timeinfo){
timeinfo.tm_year += 1; // $ Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification]
timeinfo.tm_year += 1; // $ Alert[cpp/microsoft/public/leap-year/unchecked-after-arithmetic-year-modification]

WORD year = get_civil_year(timeinfo);

Expand Down
6 changes: 5 additions & 1 deletion powershell/ql/lib/semmle/code/powershell/dataflow/flowsources/Local.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,11 @@ private class ExternalCommandLineArgumentSource extends CommandLineArgumentSourc
* A data flow source that represents the parameters of the `Main` method of a program.
*/
private class MainMethodArgumentSource extends CommandLineArgumentSource {
MainMethodArgumentSource() { this.asParameter().getFunction() instanceof TopLevelFunction }
MainMethodArgumentSource() {
this.asParameter().getFunction() instanceof TopLevelFunction and
not this.asParameter() instanceof PipelineParameter and
not this.asParameter() instanceof PipelineByPropertyNameParameter
}
Comment on lines +62 to +66

@MathiasVP Mathias Vorreiter Pedersen (MathiasVP) Aug 12, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! I've been meaning to fix that ❤️

}

/**
Expand Down
1 change: 0 additions & 1 deletion powershell/ql/test/library-tests/frameworks/system_net_sockets/test.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +0,0 @@
| test.ps1:1:1:43:0 | [synth] pipeline | Unexpected result: type="command line argument" |
Loading
Loading