You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/language/learn-ql/beginner/catch-the-fire-starter.rst
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -103,7 +103,7 @@ Now try applying ``isAllowedIn(string region)`` to a person ``p``. If ``p`` is n
103
103
104
104
You know that the fire starters live in the south *and* that they must have been able to travel to the north. Write a query to find the possible suspects. You could also extend the ``select`` clause to list the age of the suspects. That way you can clearly see that all the children have been excluded from the list.
105
105
106
-
➤ `See the answer in the query console <https://lgtm.com/query/2551838470440192723/>`__
106
+
➤ `See the answer in the query console on LGTM.com <https://lgtm.com/query/2551838470440192723/>`__
107
107
108
108
You can now continue to gather more clues and find out which of your suspects started the fire...
109
109
@@ -140,7 +140,7 @@ The predicate ``isBald`` is defined to take a ``Person``, so it can also take a
140
140
141
141
You can now write a query to select the bald southerners who are allowed into the north.
142
142
143
-
➤ `See the answer in the query console <https://lgtm.com/query/2572701606358725253/>`__
143
+
➤ `See the answer in the query console on LGTM.com <https://lgtm.com/query/2572701606358725253/>`__
144
144
145
145
You have found the two fire starters! They are arrested and the villagers are once again impressed with your work.
Copy file name to clipboardExpand all lines: docs/language/learn-ql/beginner/crown-the-rightful-heir.rst
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -127,7 +127,7 @@ Here is one way to define ``relativeOf()``:
127
127
128
128
Don't forget to use the predicate ``isDeceased()`` to find relatives that are still alive.
129
129
130
-
➤ `See the answer in the query console <https://lgtm.com/query/6710025057257064639/>`__
130
+
➤ `See the answer in the query console on LGTM.com <https://lgtm.com/query/6710025057257064639/>`__
131
131
132
132
Select the true heir
133
133
--------------------
@@ -140,7 +140,7 @@ To decide who should inherit the king's fortune, the villagers carefully read th
140
140
141
141
As your final challenge, define a predicate ``hasCriminalRecord`` so that ``hasCriminalRecord(p)`` holds if ``p`` is any of the criminals you unmasked earlier (in the :doc:`Find the thief <find-the-thief>` and :doc:`Catch the fire starter <catch-the-fire-starter>` tutorials).
142
142
143
-
➤ `See the answer in the query console <https://lgtm.com/query/1820692755164273290/>`__
143
+
➤ `See the answer in the query console on LGTM.com <https://lgtm.com/query/1820692755164273290/>`__
Copy file name to clipboardExpand all lines: docs/language/learn-ql/cpp/conversions-classes.rst
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -163,7 +163,7 @@ Our starting point for the query is pairs of a base class and a derived class, c
163
163
where derived.getABaseClass+() = base
164
164
select base, derived, "The second class is derived from the first."
165
165
166
-
➤ `See this in the query console <https://lgtm.com/query/1505902347211/>`__
166
+
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505902347211/>`__
167
167
168
168
Note that the transitive closure symbol ``+`` indicates that ``Class.getABaseClass()`` may be followed one or more times, rather than only accepting a direct base class.
169
169
@@ -175,7 +175,7 @@ A lot of the results are uninteresting template parameters. You can remove those
175
175
and not exists(base.getATemplateArgument())
176
176
and not exists(derived.getATemplateArgument())
177
177
178
-
➤ `See this in the query console <https://lgtm.com/query/1505907047251/>`__
178
+
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505907047251/>`__
179
179
180
180
Finding derived classes with destructors
181
181
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -194,7 +194,7 @@ Now we can extend the query to find derived classes with destructors, using the
194
194
and d2 = derived.getDestructor()
195
195
select base, derived, "The second class is derived from the first, and both have a destructor."
196
196
197
-
➤ `See this in the query console <https://lgtm.com/query/1505901767389/>`__
197
+
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505901767389/>`__
198
198
199
199
Notice that getting the destructor implicitly asserts that one exists. As a result, this version of the query returns fewer results than before.
200
200
@@ -214,7 +214,7 @@ Our last change is to use ``Function.isVirtual()`` to find cases where the base
214
214
and not d1.isVirtual()
215
215
select d1, "This destructor should probably be virtual."
216
216
217
-
➤ `See this in the query console <https://lgtm.com/query/1505908156827/>`__
217
+
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505908156827/>`__
218
218
219
219
That completes the query.
220
220
@@ -227,4 +227,4 @@ Further reading
227
227
- Take a look at the :doc:`Analyzing data flow in C and C++ <dataflow>` tutorial.
228
228
- Try the worked examples in the following topics: :doc:`Refining a query to account for edge cases <private-field-initialization>`, and :doc:`Detecting a potential buffer overflow <zero-space-terminator>`.
229
229
- Find out more about QL in the `QL language handbook <https://help.semmle.com/QL/ql-handbook/index.html>`__ and `QL language specification <https://help.semmle.com/QL/ql-spec/language.html>`__.
230
-
- Learn more about the query console in `Using the query console <https://lgtm.com/help/lgtm/using-query-console>`__.
230
+
- Learn more about the query console in `Using the query console <https://lgtm.com/help/lgtm/using-query-console>`__ on LGTM.com.
Copy file name to clipboardExpand all lines: docs/language/learn-ql/cpp/dataflow.rst
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -300,7 +300,7 @@ Further reading
300
300
301
301
- Try the worked examples in the following topics: :doc:`Refining a query to account for edge cases <private-field-initialization>` and :doc:`Detecting a potential buffer overflow <zero-space-terminator>`.
302
302
- Find out more about QL in the `QL language handbook <https://help.semmle.com/QL/ql-handbook/index.html>`__ and `QL language specification <https://help.semmle.com/QL/ql-spec/language.html>`__.
303
-
- Learn more about the query console in `Using the query console <https://lgtm.com/help/lgtm/using-query-console>`__.
303
+
- Learn more about the query console in `Using the query console <https://lgtm.com/help/lgtm/using-query-console>`__ on LGTM.com.
Copy file name to clipboardExpand all lines: docs/language/learn-ql/cpp/expressions-types.rst
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -21,7 +21,7 @@ In the following example we find instances of ``AssignExpr`` which assign the co
21
21
where e.getRValue().getValue().toInt() = 0
22
22
select e, "Assigning the value 0 to something."
23
23
24
-
➤ `See this in the query console <https://lgtm.com/query/1505908086530/>`__
24
+
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505908086530/>`__
25
25
26
26
The ``where`` clause in this example gets the expression on the right side of the assignment, ``getRValue()``, and compares it with zero. Notice that there are no checks to make sure that the right side of the assignment is an integer or that it has a value (that is, it is compile-time constant, rather than a variable). For expressions where either of these assumptions is wrong, the associated predicate simply does not return anything and the ``where`` clause will not produce a result. You could think of it as if there is an implicit ``exists(e.getRValue().getValue().toInt())`` at the beginning of this line.
27
27
@@ -47,7 +47,7 @@ We can make the query more specific by defining a condition for the left side of
47
47
and e.getLValue().getType().getUnspecifiedType() instanceof IntegralType
48
48
select e, "Assigning the value 0 to an integer."
49
49
50
-
➤ `See this in the query console <https://lgtm.com/query/1505906986578/>`__
50
+
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505906986578/>`__
51
51
52
52
This checks that the left side of the assignment has a type that is some kind of integer. Note the call to ``Type.getUnspecifiedType()``. This resolves ``typedef`` types to their underlying types so that the query finds assignments like this one:
53
53
@@ -107,7 +107,7 @@ Unfortunately this would not quite work, because the loop initialization is actu
107
107
and e.getLValue().getType().getUnspecifiedType() instanceof IntegralType
108
108
select e, "Assigning the value 0 to an integer, inside a for loop initialization."
109
109
110
-
➤ `See this in the query console <https://lgtm.com/query/1505909016965/>`__
110
+
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505909016965/>`__
111
111
112
112
Finding assignments of 0 within the loop body
113
113
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -125,7 +125,7 @@ We can find assignments inside the loop body using similar code with the predica
125
125
and e.getLValue().getType().getUnderlyingType() instanceof IntegralType
126
126
select e, "Assigning the value 0 to an integer, inside a for loop body."
127
127
128
-
➤ `See this in the query console <https://lgtm.com/query/1505901437190/>`__
128
+
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505901437190/>`__
129
129
130
130
Note that we replaced ``e.getEnclosingStmt()`` with ``e.getEnclosingStmt().getParentStmt*()``, to find an assignment expression that is deeply nested inside the loop body. The transitive closure modifier ``*`` here indicates that ``Stmt.getParentStmt()`` may be followed zero or more times, rather than just once, giving us the statement, its parent statement, its parent's parent statement etc.
131
131
@@ -135,4 +135,4 @@ Further reading
135
135
- Explore other ways of finding types and statements using examples from the C/C++ cookbook for `types <https://help.semmle.com/wiki/label/CBCPP/type>`__ and `statements <https://help.semmle.com/wiki/label/CBCPP/statement>`__.
136
136
- Take a look at the :doc:`Conversions and classes in C and C++ <conversions-classes>` and :doc:`Analyzing data flow in C and C++ <dataflow>` tutorials.
137
137
- Find out more about QL in the `QL language handbook <https://help.semmle.com/QL/ql-handbook/index.html>`__ and `QL language specification <https://help.semmle.com/QL/ql-spec/language.html>`__.
138
-
- Learn more about the query console in `Using the query console <https://lgtm.com/help/lgtm/using-query-console>`__.
138
+
- Learn more about the query console in `Using the query console <https://lgtm.com/help/lgtm/using-query-console>`__ on LGTM.com.
Copy file name to clipboardExpand all lines: docs/language/learn-ql/cpp/function-classes.rst
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -38,7 +38,7 @@ It might be more interesting to find functions that are not called, using the st
38
38
where not exists(FunctionCall fc | fc.getTarget() = f)
39
39
select f, "This function is never called."
40
40
41
-
➤ `See this in the query console <https://lgtm.com/query/1505891246456/>`__
41
+
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505891246456/>`__
42
42
43
43
The new query finds functions that are not the target of any ``FunctionCall``—in other words, functions that are never called. You may be surprised by how many results the query finds. However, if you examine the results, you can see that many of the functions it finds are used indirectly. To create a query that finds only unused functions, we need to refine the query and exclude other ways of using a function.
44
44
@@ -56,7 +56,7 @@ You can modify the query to remove functions where a function pointer is used to
56
56
and not exists(FunctionAccess fa | fa.getTarget() = f)
57
57
select f, "This function is never called, or referenced with a function pointer."
58
58
59
-
➤ `See this in the query console <https://lgtm.com/query/1505890446605/>`__
59
+
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505890446605/>`__
60
60
61
61
This query returns fewer results. However, if you examine the results then you can probably still find potential refinements.
62
62
@@ -78,7 +78,7 @@ This query uses ``Function`` and ``FunctionCall`` to find calls to the function
78
78
and not fc.getArgument(1) instanceof StringLiteral
79
79
select fc, "sprintf called with variable format string."
80
80
81
-
➤ `See this in the query console <https://lgtm.com/query/1505889506751/>`__
81
+
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505889506751/>`__
82
82
83
83
This uses:
84
84
@@ -95,4 +95,4 @@ Further reading
95
95
- Explore other ways of finding functions using examples from the `C/C++ cookbook <https://help.semmle.com/wiki/label/CBCPP/function>`__.
96
96
- Take a look at some other tutorials: :doc:`Expressions, types and statements in C and C++ <introduce-libraries-cpp>`, :doc:`Conversions and classes in C and C++ <conversions-classes>`, and :doc:`Analyzing data flow in C and C++ <dataflow>`.
97
97
- Find out more about QL in the `QL language handbook <https://help.semmle.com/QL/ql-handbook/index.html>`__ and `QL language specification <https://help.semmle.com/QL/ql-spec/language.html>`__.
98
-
- Learn more about the query console in `Using the query console <https://lgtm.com/help/lgtm/using-query-console>`__.
98
+
- Learn more about the query console in `Using the query console <https://lgtm.com/help/lgtm/using-query-console>`__ on LGTM.com.
Copy file name to clipboardExpand all lines: docs/language/learn-ql/cpp/introduce-libraries-cpp.rst
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -525,4 +525,4 @@ Further reading
525
525
526
526
- Experiment with the worked examples in the CodeQL for C/C++ topics: :doc:`Functions in C and C++ <function-classes>`, :doc:`Expressions, types, and statements in C and C++ <expressions-types>`, :doc:`Conversions and classes in C and C++ <conversions-classes>`, and :doc:`Analyzing data flow in C and C++ <dataflow>`.
527
527
- Find out more about QL in the `QL language handbook <https://help.semmle.com/QL/ql-handbook/index.html>`__ and `QL language specification <https://help.semmle.com/QL/ql-spec/language.html>`__.
528
-
- Learn more about the query console in `Using the query console <https://lgtm.com/help/lgtm/using-query-console>`__.
528
+
- Learn more about the query console in `Using the query console <https://lgtm.com/help/lgtm/using-query-console>`__ on LGTM.com.
Copy file name to clipboardExpand all lines: docs/language/learn-ql/cpp/private-field-initialization.rst
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -144,11 +144,11 @@ Finally we can simplify the query by using the transitive closure operator. In t
144
144
and exists(c.getBlock())
145
145
select c, "Constructor does not initialize fields $@.", f, f.getName()
146
146
147
-
➤ `See this in the query console <https://lgtm.com/query/1505896968215/>`__
147
+
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/1505896968215/>`__
148
148
149
149
Further reading
150
150
---------------
151
151
152
152
- Take a look at another example: :doc:`Detecting a potential buffer overflow <zero-space-terminator>`.
153
153
- Find out more about QL in the `QL language handbook <https://help.semmle.com/QL/ql-handbook/index.html>`__ and `QL language specification <https://help.semmle.com/QL/ql-spec/language.html>`__.
154
-
- Learn more about the query console in `Using the query console <https://lgtm.com/help/lgtm/using-query-console>`__.
154
+
- Learn more about the query console in `Using the query console <https://lgtm.com/help/lgtm/using-query-console>`__ on LGTM.com.
0 commit comments