Skip to content

Must run query update #173

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 6 commits into from
May 9, 2025
Merged

Must run query update #173

merged 6 commits into from
May 9, 2025

Conversation

@jacob-ronstadt
Copy link
Contributor

@jacob-ronstadt jacob-ronstadt commented May 2, 2025

Checklist for Pull Requests

  • Description is filled out.
  • Only one query or related query group is in this pull request.
  • The version number on changed queries has been increased via the @version comment in the file header.
  • All unit tests have been run: (Test README.md).
  • Commands codeql database create and codeql database analyze have completed successfully.
  • A .qhelp file has been added for any new queries or updated if changes have been made to an existing query.

@jacob-ronstadt jacob-ronstadt requested a review from NateD-MSFT May 2, 2025 16:05
NateD-MSFT
NateD-MSFT approved these changes May 3, 2025
View reviewed changes
Copy link
Collaborator

@NateD-MSFT NateD-MSFT left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My questions are not blocking, but please do fill me in on the details of how we got here (you probably have told me before and it's just slipped my mind, apologies.)

@jacob-ronstadt jacob-ronstadt merged commit b62be55 into development May 9, 2025
6 checks passed
jacob-ronstadt added a commit that referenced this pull request Jul 14, 2025
@jacob-ronstadt @houha2 @NateD-MSFT
RI Development to main (#175)
d853571 
* Github actions updates (#139)

* Update build-codeql.yaml test codeql action

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml manual download

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml add back yest of build step

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml try all jobs

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml test all jobs

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml dvl tests

Signed-off-by: Jacob Ronstadt <[email protected]>

* Add files via upload

Signed-off-by: Jacob Ronstadt <[email protected]>

* Create readme

Signed-off-by: Jacob Ronstadt <[email protected]>

* restructure

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* add test projects

* Update dvl_tests.ps1

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update dvl_tests.ps1

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update dvl_tests.ps1

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update dvl_tests.ps1

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update dvl_tests.ps1

Signed-off-by: Jacob Ronstadt <[email protected]>

* update build_create_analyze_test.py to fail when different results are found

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* change when results get uploaded

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* fix exit code

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* update to use driver_snippet.c instead of other driver projects

* add template path variable

* fix path

* fix path

* test

* fix template path

* test

* update template project to have arm configuration

* fix msbuild command

* fix driver_snippet.c

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* print results location

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* fix sarif copy and compare sarif results

* add expected sarif results

* Delete src/drivers/test/dvl_tests/readme

Signed-off-by: Jacob Ronstadt <[email protected]>

---------

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml to allow publish step to fail for outside PRs

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml (#141)

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml (#142)

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* test secret condition without deleting secret

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml change condition back 

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml test env

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml test env

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml fail test-codeql-latest-vs-current if prev job fails

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

---------

Signed-off-by: Jacob Ronstadt <[email protected]>

* Initial Batch of Windows Filtering Platform Queries for Static Contracts (#110)

* init commit

* moved files around added the snippets

* I think this fixes the build

* update the WFP library to be more robust. Driver_snippets still need some edits

* Update the ID path

* fixes build issue

* attempt 2

* forgot () added them

* fix spelling

* updated ID path and hopefully fixed the last compile error

* I had another typo, this should fix it

* changes the id property

* lowercase letters

* synced the forked made name change to one query

* other name edit

---------

Co-authored-by: Elaine Houha <[email protected]>

* codeql port of C28648. TODO needs tests

* Revert "codeql port of C28648. TODO needs tests"

This reverts commit c282407.

* OperandAssignment: CodeQL Port of C28129 (#121)

* WIP C28129

* C28129

* add sarif file and update diff file

* update id and move out of experimental

* add query to ported ca checks suite

---------

Signed-off-by: Jacob Ronstadt <[email protected]>

* IoInitializeTimerCall: CodeQL port of C28133 (#123)

* C28133

* add query to ported ca checks suite

---------

Signed-off-by: Jacob Ronstadt <[email protected]>

* IrqlIllegalValue: CodeQL port of c28151 (#144)

* codeql port of c28151

* Update IrqlIllegalValue.ql

Signed-off-by: Jacob Ronstadt <[email protected]>

---------

Signed-off-by: Jacob Ronstadt <[email protected]>

* NullPointerCharacterAssignment: CodeQL port of C28730 (#146)

codeql port of C28730

* FloatSafeExit: CodeQL port of C28162 (#147)

Port of C28162

* FloatUnsafeExit: CodeQL port of C28161 (#148)

* WIP C28161

* port of C28161

* move from kmdf to wdm

* remove old files

* PointerVariableSize: CodeQL port of C28132 (#143)

* port of C28132

* update to remove false positives

* NtstatusExplicitCast3: CodeQL port of C28716 (#151)

* port of C28716

* add other bool types

* NtstatusExplicitCast2: CodeQL port of C29715 (#150)

* port of C29715

* add other bool types

* NtstatusExplicitCast: CodeQL port of C28714 (#149)

* port of C28714

* improve query

* add other bool types

* update name

* CurrentFunctionTypeNotCorrect: CodeQL port of C28101 (#124)

* C28101

* add query to ported ca checks suite

* specifically check for driver_initialize

---------

Signed-off-by: Jacob Ronstadt <[email protected]>

* InvalidFunctionPointerAnnotation: CodeQL port of C28165 (#145)

* codeql port of C28165

* update query to also work with typedef types and _use_decl_annotations_

* update sarif

* FloatHardwareStateProtection: CodeQL port of c28110 (#130)

* WIP FloatHardwareStateProtection

* FloatHardwareStateProtection.ql TODO test on samples

* add more control flow

* add query to ported ca checks suite

* move from kmdf to wdm. add sarif file.

* fix output message

* resolve todos

* DriverEntrySaveBuffer: Port of c28131 (#122)

* C28131

* updates to ql

* update id and move out of experimental

* add query to ported ca checks suite

* update to also check for local pointers to structs

---------

Signed-off-by: Jacob Ronstadt <[email protected]>

* IRPStackEntryCopy: CodeQL port of c28114 (#120)

* port of C28114, Copying a whole IRP stack entry

* update unit tests

* fix ql name

* update id and move out of experimental

* add query to ported ca checks suite

* fix sarif file

---------

Signed-off-by: Jacob Ronstadt <[email protected]>

* update ported_driver_ca_checks.qls with new queries

* fix typo

* updates to test script

* Driver isolation queries (#152)

* WIP driver isolation

* WIP driver isolation. add zw* using non-null rootdirectory

* add flow config for OK open reg key functions?

* query finds Zw* isolation function use where OBJECT_ATTRIBUTES has non-null RootDirectory AND the RootDirectory didn't come from allowed function

* WIP null rootdir

* WIP null rootdir

* WIP split into read/write accesses

* Preliminary query

* fix zwRead and zwWrite predicates

* fix null root dir

* bug fixes and add test cases

* query improvements and tests

* flow update

* add tests and small query improvements

* add exceptions

* add extra barriers to flow

* refactor query and fix barriers in dataflow

* update qhelp files and queries and tests

* fix comment

* query improvements

* WIP query updates

* bug fixes and improvements

* fix exception for SERIALCOMM to also match as prefix

* allow handles that are relative to handles obtained from approved ddi

* add recursive check for allowed handle source

* change @kind from path-problem for debugging to problem

* update select message

* update zw violation 2

* small fix

* add allowed handle source to driverisolation.qll and zwviolation2. update zwViolation1 to use lib

* improve query

* query updates

* update query to remove potential true results

* WIP wdf isolation

* move isolation queries to experimental

* update config file

* Update codeql-config.yml

Signed-off-by: Jacob Ronstadt <[email protected]>

* remove wdf WIP query for dev

* update version of qlpack

* update driver_snippet

---------

Signed-off-by: Jacob Ronstadt <[email protected]>

* update config file to include other isolation queries

* update build script

* update sarif files for isolation queries

* Update codeql-config.yml

Signed-off-by: Jacob Ronstadt <[email protected]>

* github action updates to get latest codeql version (#154)

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

---------

Signed-off-by: Jacob Ronstadt <[email protected]>

* minor updates

* fix compare issue with backslashes in latest codeql version

* Irql.qll updates to expand ability to detect function IRQL requirements (#153)

* updates to Irql.qll to add conditional macros within a _When_ macro

* Update Irql.qll

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update Irql.qll

Signed-off-by: Jacob Ronstadt <[email protected]>

* update IRQL library so that IRQL requirements for functions that are not annotated can be tracked by looking at the the functions implicit role type based on how it's used

* Update Irql.qll to remove test code

Signed-off-by: Jacob Ronstadt <[email protected]>

* irql updates

* bug fix in test script

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* bug fix

* bug fix

---------

Signed-off-by: Jacob Ronstadt <[email protected]>

* update uses of dataflow to use latest library (#155)

* update uses of dataflow to use latest library

* fix dataflow use

* bug fix

* Update build-codeql.yaml

Signed-off-by: Jacob Ronstadt <[email protected]>

* update pack versions to fix false positive

---------

Signed-off-by: Jacob Ronstadt <[email protected]>

* StaticInitializer: CodeQL port of C28651 (#156)

* WIP C28651

* Codeql port of C28651

* remove TODOs

* Add APIs to ExtendedDeprecatedApis for Codeql port of c28727 (#163)

add apis from C28727

* Driver apps framework (#165)

* framework for writing queries for apps that interact with drivers

* remove extra print

* IrqlFunctionNotAnnotated: codeql port of c28167 (#160)

codeql port of c28167

* IrqlLoweredImproperly: Codeql port of c28141 (#157)

* CodeQL port of C28141

* update sarif file

* IrqlFloatStateMismatch: CodeQL port of C28111 (#161)

* WIP port of C28111

* add sarif diff file

* Codeql port of C28111

* updates from review

* IrqlCancelRoutine: CodeQL port of c28144 (#162)

* CodeQL port of C28144

* updates from review

* IrqlAnnotationIssue: CodeQL port of c28153 (#158)

* CodeQL port of C28153

* Remove TODO comment

* updates from review

* IrqlInconsistentWithRequired: CodeQL port of C28166 (#159)

* CodeQL port of C28156

* updates from review

* AnnotationSyntax: CodeQL port of c28266 (#164)

* WIP c28266

* CodeQL port of C28266

* Remove commented-out code in AnnotationSyntax.ql

* updates from review

* CodeQL port of C28650

* add build_database_only option to build script

* update gitignore

* ImportantFunctionCallOptimizedOut: port of c28625 (#167)

* Codeql port of C28625

* Update src/drivers/general/queries/ImportantFunctionCallOptimizedOut/driver_snippet.c

Co-authored-by: NateD-MSFT <[email protected]>
Signed-off-by: Jacob Ronstadt <[email protected]>

---------

Signed-off-by: Jacob Ronstadt <[email protected]>
Co-authored-by: NateD-MSFT <[email protected]>

* InvalidFunctionClassTypedef: Codeql port of c28268 (#170)

* CodeQL port of C28268

* Add example to InvalidFunctionClassTypedef.qhelp

* StrictTypeMatch: Codeql port of c28139 (#169)

* WIP port of C28139

* CodeQL port of C28139

* Update src/drivers/general/queries/StrictTypeMatch/driver_snippet.c

Co-authored-by: NateD-MSFT <[email protected]>
Signed-off-by: Jacob Ronstadt <[email protected]>

* Fix parameter order in code samples

---------

Signed-off-by: Jacob Ronstadt <[email protected]>
Co-authored-by: NateD-MSFT <[email protected]>

* MultipleFunctionClassAnnotations: Port of C28177 (#168)

* Port of C28177

* Update src/drivers/general/queries/MultipleFunctionClassAnnotations/driver_snippet.c

Co-authored-by: NateD-MSFT <[email protected]>
Signed-off-by: Jacob Ronstadt <[email protected]>

* Update example description in qhelp file

---------

Signed-off-by: Jacob Ronstadt <[email protected]>
Co-authored-by: NateD-MSFT <[email protected]>

* UnsafeCallInGlobalinit: CodeQL port of C28637 (#166)

* CodeQL port of C28637

* move query to app folder

* update query

---------

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update opaqueid in ImproperNotOperatorOnZero.ql

Signed-off-by: Jacob Ronstadt <[email protected]>

* update build script and repo structure

* ported_driver_ca_checks.qls to use tag ca_ported and update ported ca rule queries with tag

* update dvl_tests.ps1

* update qlpack version and fix path error

* bug fix in AnnotationSyntax.ql

* update DriverEntrySaveBuffer.ql to only look at registrypath and not driverobject since that's what C28131 did

* remove false positives

* remove false positives

* remove false positives

* Add possible false positive note to DriverEntrySaveBuffer.qhelp

* remove non-SAL parameters due to false positives

* update message

* update test results to match query update

* fix query id

* Update codeql-config.yml

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update codeql-config.yml

Signed-off-by: Jacob Ronstadt <[email protected]>

* Query suite updates (#172)

* Suite updates to add additional queries

* update windows_driver_mustfix.qls

* update readme

* qlpack version update

* update query packs

* update github action

* update query suites with missing query

* update version

* sort query suites

* add missing queries

* Fix opaqueid fields. For some reason opaque-id causes issues with sarif reader.

* fix changed file

* Update codeql-config.yml

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update codeql-config.yml

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update codeql-config.yml

Signed-off-by: Jacob Ronstadt <[email protected]>

* Must run query update (#173)

* Revert must-fix to current requirements. Make recommended contain what next mustfix will. Make mustrun suite.

* update version

* remove old suite files

* update dependency versions. update dvl_tests.ps1 for changed mustfix suite name

* fix version number in suites

* update qlpack version

* Jacob ronstadt/mustrun (#174)

* Revert must-fix to current requirements. Make recommended contain what next mustfix will. Make mustrun suite.

* update version

* remove old suite files

* Updating documentation for new version

* update dependency versions. update dvl_tests.ps1 for changed mustfix suite name

* fix version number in suites

* update qlpack version

* update readme

* update qlpack dependency versions

---------

Signed-off-by: Jacob Ronstadt <[email protected]>

* Update README.md

Signed-off-by: Jacob Ronstadt <[email protected]>

* Actions azure file storage fix (#176)

* fixing azure file upload

* testing

* fix pack version check

* only compare detailed results

* bug fix

* use more threads with codeql

* save latest version if the results are the same

* testing

* add manual publish workflow

* Fix query health action (#177)

* suppress breaking change warning. NA because we don't get the output from set-azstoragefilecontent

* move float safe/unsafe queries to kmdf folder and fix output strings

* move float safe/unsafe queries to kmdf folder and fix output strings

* Improve recommendations in ExtendedDeprecatedApis for strlen (#179)

* Improve replacement recommendations in ExtendedDeprecatedApis

* Bump query version

---------

Signed-off-by: Jacob Ronstadt <[email protected]>
Co-authored-by: Elaine Houha <[email protected]>
Co-authored-by: Elaine Houha <[email protected]>
Co-authored-by: NateD-MSFT <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@NateD-MSFT NateD-MSFT NateD-MSFT approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@jacob-ronstadt @NateD-MSFT