Skip to content

Commit 96caa68

Browse files
committed
AlertFiltering: add restrictAlertsToExactLocation
This commit introduces a new extensible predicate restrictAlertsToExactLocation, which is similar to the existing restrictAlertsTo predicate but matches alert locations exactly.
1 parent b9b9394 commit 96caa68

File tree

2 files changed

+52
-1
lines changed

2 files changed

+52
-1
lines changed

shared/util/codeql/util/AlertFiltering.qll

Lines changed: 46 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,15 +29,54 @@ private import codeql.util.Location
2929
*
3030
* A query should either perform no alert filtering, or adhere to all the filtering rules in this
3131
* module and return all and only the accepted alerts.
32+
*
33+
* This predicate is suitable for situations where we want to filter alerts at line granularity,
34+
* such as based on the pull request diff.
35+
*
36+
* See also: `restrictAlertsToExactLocation`.
3237
*/
3338
extensible predicate restrictAlertsTo(string filePath, int startLineStart, int startLineEnd);
3439

40+
/**
41+
* Holds if the query should produce alerts that match the given locations.
42+
*
43+
* This predicate is active if and only if it is nonempty. If this predicate is inactive, it has no
44+
* effect. If it is active, it accepts any alert that has at least one matching location.
45+
*
46+
* Note that an alert that is not accepted by this filtering predicate may still be included in the
47+
* query results if it is accepted by another active filtering predicate in this module. An alert is
48+
* excluded from the query results if only if (1) there is at least one active filtering predicate,
49+
* and (2) it is not accepted by any active filtering predicate.
50+
*
51+
* An alert location is a match if it matches a row in this predicate. Each row specifies an exact
52+
* location: an alert location is a match if its file path matches `filePath`, its start line and
53+
* column match `startLine` and `startColumn`, and its end line and column match `endLine` and
54+
* `endColumn`.
55+
*
56+
* - filePath: alert location file path (absolute).
57+
* - startLine: alert location start line number (1-based).
58+
* - startColumn: alert location start column number (1-based).
59+
* - endLine: alert location end line number (1-based).
60+
* - endColumn: alert location end column number (1-based).
61+
*
62+
* A query should either perform no alert filtering, or adhere to all the filtering rules in this
63+
* module and return all and only the accepted alerts.
64+
*
65+
* This predicate is suitable for situations where we want to filter by the exact alert location,
66+
* distinguishing between alerts on the same line.
67+
*
68+
* See also: `restrictAlertsTo`.
69+
*/
70+
extensible predicate restrictAlertsToExactLocation(
71+
string filePath, int startLine, int startColumn, int endLine, int endColumn
72+
);
73+
3574
/** Module for applying alert location filtering. */
3675
module AlertFilteringImpl<LocationSig Location> {
3776
/** Applies alert filtering to the given location. */
3877
bindingset[location]
3978
predicate filterByLocation(Location location) {
40-
not restrictAlertsTo(_, _, _)
79+
not restrictAlertsTo(_, _, _) and not restrictAlertsToExactLocation(_, _, _, _, _)
4180
or
4281
exists(string filePath, int startLineStart, int startLineEnd |
4382
restrictAlertsTo(filePath, startLineStart, startLineEnd)
@@ -48,5 +87,11 @@ module AlertFilteringImpl<LocationSig Location> {
4887
or
4988
location.hasLocationInfo(filePath, [startLineStart .. startLineEnd], _, _, _)
5089
)
90+
or
91+
exists(string filePath, int startLine, int startColumn, int endLine, int endColumn |
92+
restrictAlertsToExactLocation(filePath, startLine, startColumn, endLine, endColumn)
93+
|
94+
location.hasLocationInfo(filePath, startLine, startColumn, endLine, endColumn)
95+
)
5196
}
5297
}

shared/util/ext/default-alert-filter.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,9 @@ extensions:
55
extensible: restrictAlertsTo
66
# Empty predicate means no restrictions on alert locations
77
data: []
8+
9+
- addsTo:
10+
pack: codeql/util
11+
extensible: restrictAlertsToExactLocation
12+
# Empty predicate means no restrictions on alert locations
13+
data: []

0 commit comments

Comments
 (0)