GitHub CodeQL (formerly Semmle LGTM)

Here's the place for discussion related to coding in FreeCAD, C++ or Python. Design, interfaces and structures.
Forum rules
Be nice to others! Respect the FreeCAD code of conduct!
User avatar
saso
Veteran
Posts: 1920
Joined: Fri May 16, 2014 1:14 pm
Contact:

GitHub CodeQL (formerly Semmle LGTM)

Post by saso »

CodeQL
https://codeql.github.com/

Building blocks for scalable product security
https://www.youtube.com/watch?v=nY991AhhATw

Finding non-intuitive string manipulation vulnerabilities in C code
https://www.twitch.tv/videos/672848979

Welcoming Semmle to GitHub
https://github.blog/2019-09-18-github-welcomes-semmle/

Code scanning is now available!
https://github.blog/2020-09-30-code-sca ... available/

The next step for LGTM.com: GitHub code scanning!
https://github.blog/2022-08-15-the-next ... -scanning/

Make Memcpy Safe Again: CodeQL
https://www.cyberark.com/resources/thre ... ain-codeql

CodeQL zero to hero part 1: the fundamentals of static analysis for vulnerability research
https://github.blog/2023-03-31-codeql-z ... -research/

CodeQL zero to hero part 2: getting started with CodeQL
https://github.blog/2023-06-15-codeql-z ... th-codeql/

ICYMI: improved C++ vulnerability coverage and CodeQL support for Lombok
https://github.blog/2023-10-19-icymi-im ... or-lombok/

Security best practices for authors of GitHub Actions
https://github.blog/2023-11-16-security ... b-actions/

Addressing post-quantum cryptography with CodeQL
https://github.blog/2023-12-05-addressi ... th-codeql/

Found means fixed: Introducing code scanning autofix, powered by GitHub Copilot and CodeQL
https://github.blog/2024-03-20-found-me ... nd-codeql/

Publishing Trail of Bits’ CodeQL queries
https://blog.trailofbits.com/2023/12/06 ... l-queries/
https://appsec.guide/docs/static-analysis/codeql/
https://github.com/trailofbits/codeql-queries


A general post about the security and code quality tools https://forum.freecadweb.org/viewtopic. ... 02#p274069
Last edited by saso on Thu Mar 21, 2024 5:55 pm, edited 26 times in total.
User avatar
PrzemoF
Veteran
Posts: 3520
Joined: Fri Jul 25, 2014 4:52 pm
Contact:

Re: Code quality checker

Post by PrzemoF »

I did a spot check and it looks really good!

@bernd: you might be interested to take a look at it. (<-- does that @ work as expected?)
Jee-Bee
Veteran
Posts: 2566
Joined: Tue Jun 16, 2015 10:32 am
Location: Netherlands

Re: Code quality checker

Post by Jee-Bee »

Not that i know of

Code: Select all

[quote=bernd user_id=2069]
ping
[/quote]
Works (Don't forgot the user ID).
bernd wrote: ping
User avatar
bernd
Veteran
Posts: 12849
Joined: Sun Sep 08, 2013 8:07 pm
Location: Zürich, Switzerland
Contact:

Re: Code quality checker

Post by bernd »

Had a look at this, it finds some problems which are not found by pep8. It's great

https://lgtm.com/projects/g/FreeCAD/Fre ... de=heatmap
User avatar
bernd
Veteran
Posts: 12849
Joined: Sun Sep 08, 2013 8:07 pm
Location: Zürich, Switzerland
Contact:

Re: Code quality checker

Post by bernd »

It seams possible to exclude files from analysis ... https://lgtm.com/help/lgtm/customizing- ... sification

Zhis would make sense for the following file: https://github.com/FreeCAD/FreeCAD/blob ... sign.py#L1

It s autogenerated and has 881 allerts !!! https://lgtm.com/projects/g/FreeCAD/Fre ... de=heatmap
User avatar
saso
Veteran
Posts: 1920
Joined: Fri May 16, 2014 1:14 pm
Contact:

Re: Code quality checker

Post by saso »

I will look in to it when I will try to make it work for C++
User avatar
bernd
Veteran
Posts: 12849
Joined: Sun Sep 08, 2013 8:07 pm
Location: Zürich, Switzerland
Contact:

Re: Code quality checker

Post by bernd »

saso wrote: Sat Jul 06, 2019 12:36 pm I will look in to it when I will try to make it work for C++
That would be great!

BTW: Path and Fem really reduced lgtm alerts. I found some surprising bugs I would never ever have found without ...
User avatar
bernd
Veteran
Posts: 12849
Joined: Sun Sep 08, 2013 8:07 pm
Location: Zürich, Switzerland
Contact:

Re: Code quality checker

Post by bernd »

somehow lgtm is missing files in FEM ...


screen1.png
screen1.png (95.78 KiB) Viewed 4542 times

screen2.png
screen2.png (52.99 KiB) Viewed 4542 times
User avatar
saso
Veteran
Posts: 1920
Joined: Fri May 16, 2014 1:14 pm
Contact:

Re: Code quality checker

Post by saso »

bernd wrote: Mon Jul 08, 2019 7:51 am I found some surprising bugs I would never ever have found without ...
Great, this is what this tools are for... There are a few FEM related issues reported also in Coverity, if you maybe want to kill some more bugs ;)
Check the three posts I made here for some basic help on how to use it https://forum.freecadweb.org/viewtopic. ... 30#p210644
bernd wrote: Mon Jul 08, 2019 7:54 am somehow lgtm is missing files in FEM ...
There is an "show excluded files" checkbox at the top with some more information about this.
User avatar
bernd
Veteran
Posts: 12849
Joined: Sun Sep 08, 2013 8:07 pm
Location: Zürich, Switzerland
Contact:

Re: Code quality checker

Post by bernd »

ahh, ok. Would you move these files out of excluded files? They should be analysed as any other file in FEM.
Post Reply