qtil
advanced-security/qtil-swift 0.0.3
Search

Module QLFormat

A module to create queries that have a message format with parameters and placeholders, without worrying about the placeholder ordering.

Imagine implementing a query with the following types of results, where parenthesizes indicate placeholders with links.

  • “Variable (foo) is passed to function (bar) with constant value (-1).”
  • “Constant value (-1) is passed to function (bar).”
  • “Variable (foo) is unused with constant value (-1).”

In an ordinary “problem” query, this might be tedious and involve something like the following, before you can even start writing the query:

abstract class TypeOfProblem extends ... {
  Element getElement();
  string getMessage();
  Element getPlacolderElement1();
  string getPlaceholderString1();
  Element getPlacolderElement2();
  string getPlaceholderString2();
  Element getPlacolderElement3();
  string getPlaceholderString3();
}
...
from TypeOfProblem p where ...
select p.getElement(), p.getMessage(), p.getPlaceholderElement1(), p.getPlaceholderString1(),
  ...

By using this module, you can skip the boilerplate and go straight to defining the types of results your query will report:

import qtil.cpp.format.QLFormat
predicate problem(Element elem, Template msg) {
  ... and
  msg = tpl("Variable {var} is passed to function {func} with constant value {val}.")
      .link("var", var)
      .link("func", func)
      .link("val", val)
  or ... and
  msg = tpl("Constant value {val} is passed to function {func}.")
     .link("func", func)
     .link("val", val)
  or ...
}

import Problem<problem/2>::Query

Import path

import qtil.format.QLFormat

Modules

QlFormat

A module that offers a way of formatting CodeQL query messages in a consistent way, with varying numbers of placeholders, via a template-like syntax. This module is useful for writing more user-friendly messages for certain types of queries, with a cleaner query implementation.