Fix AlertReporting for nested macros

Nested macro invocations do not have getExpandedElements(), but
do have getAffectedElements().

Author: lcartey

cpp/common/src/codingstandards/cpp/AlertReporting.qll

@@ -14,15 +14,21 @@ module MacroUnwrapper<ResultType ResultElement> {
    * Gets a macro invocation that applies to the result element.
    */
   private MacroInvocation getAMacroInvocation(ResultElement re) {
-    result.getAnExpandedElement() = re
+    result.getAnAffectedElement() = re
   }
 
   /**
    * Gets the primary macro invocation that generated the result element.
+   *
+   * Does not hold for cases where the result element is located at a macro argument site.
    */
   MacroInvocation getPrimaryMacroInvocation(ResultElement re) {
     exists(MacroInvocation mi |
       mi = getAMacroInvocation(re) and
+      // Only report cases where the element is not located at the macro expansion site
+      // This means we'll report results in macro arguments in the macro argument
+      // location, not within the macro itself
+      mi.getLocation().getStartColumn() = re.getLocation().getStartColumn() and
       // No other more specific macro that expands to element
       not exists(MacroInvocation otherMi |
         otherMi = getAMacroInvocation(re) and otherMi.getParentInvocation() = mi