Enhancement: add support for suppressing CodeQL alerts on the next line
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
Research direction
No files or tests are named. Start by locating the handling of code-identifier deviation comments and the CodeQL alert suppression logic; compare how clang-tidy's NOLINTNEXTLINE behavior is represented. Done means a documented next-line suppression syntax works for the proposed example without breaking existing same-line comments, with coverage for both forms.
Written by the indexing model from the issue text.
Description
Currently code-identifier comments of a deviation are required to be on the same line as the CodeQL alert it refers to, which can cause code-formatters (clang-format etc.) to break very long lines into multiple lines that may require further position adjustment from the user for the deviation comments.
Therefore, a feature for suppressing CodeQL alerts on the NEXT line would be inevitable in the future, similar to clang-tidys NOLINTNEXTLINE` feature.
Current State:
Lets say there is a function with a return type that generates a CodeQL alert which should be ignored by a deviation comment:
ReturnTypeGeneratesAnAlert MyLongFunction(ParamType1 p1, ParamType2 p2, ParamType3 p3) { // DeviationCommentForReturnType
...
}
Due to the line length limit, clang-format may reformat the line into:
ReturnTypeGeneratesAnAlert
MyLongFunction(ParamType1 p1, ParamType2 p2, ParamType3 p3) { // DeviationCommentForReturnType
...
}
which needs to be manually repositioned to the following way by the user (otherwise the CodeQL alert will be re-triggered):
ReturnTypeGeneratesAnAlert // DeviationCommentForReturnType
MyLongFunction(ParamType1 p1, ParamType2 p2, ParamType3 p3) {
...
}
Proposed Solution:
Introduce NOCODEQLNEXTLINE or similar feature for suppressing CodeQL alerts on the next line:
// NOCODEQLNEXTLINE(DeviationCommentForReturnType)
ReturnTypeGeneratesAnAlert MyLongFunction(ParamType1 p1, ParamType2 p2, ParamType3 p3) {
...
}- Dominant language
- CodeQL
- Stars
- 227
- Forks
- 82
- Avg merge
- 6d 7h
- Merged PRs (30d)
- 9
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from github/codeql-coding-standards
-
false positive/false negative Stardard-MISRA-C++
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
github/codeql-coding-standards#1172 ·
-
Difficulty-Low false positive/false negative false-negative Impact-Low Standard-MISRA-C
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty-Medium false positive/false negative false-positive Impact-Medium Standard-CERT-C
Difficulty 4/5 3-5 days Newbie friendliness 48/100
github/codeql-coding-standards#1200 ·
-
`RULE-0-0-1`: "unreachable statement" false positives due to over-pruning of the control-flow graph Openfalse positive/false negative
Difficulty 4/5 3-5 days Newbie friendliness 48/100
github/codeql-coding-standards#1190 ·
-
false positive/false negative
Difficulty 3/5 1-2 days Newbie friendliness 65/100
github/codeql-coding-standards#1175 ·
All issues in github/codeql-coding-standards
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
sipyourdrink-ltd/bernstein#6191 ·
-
security severity:low track:open-source
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
[addtool] DeepZero Open
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
gwen001/offsectools_www#2055 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
WalletConnect/actions#112 ·