Shared support for alert filtering

cklin · cklin · commit ff78bebf19d0 · 2024-09-11T13:18:26.000-07:00
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl1.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl1.qll
@@ -283,6 +283,14 @@ deprecated private module Config implements FullStateConfigSig {
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
+
+  predicate filterForSourceOrSinkAlerts() { none() }
+
+  predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
+
+  predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
+
+  predicate isFilteredSink(Node sink) { isSink(sink) }
 }
 
 deprecated private import Impl<Config> as I
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll
@@ -283,6 +283,14 @@ deprecated private module Config implements FullStateConfigSig {
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
+
+  predicate filterForSourceOrSinkAlerts() { none() }
+
+  predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
+
+  predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
+
+  predicate isFilteredSink(Node sink) { isSink(sink) }
 }
 
 deprecated private import Impl<Config> as I
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll
@@ -283,6 +283,14 @@ deprecated private module Config implements FullStateConfigSig {
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
+
+  predicate filterForSourceOrSinkAlerts() { none() }
+
+  predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
+
+  predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
+
+  predicate isFilteredSink(Node sink) { isSink(sink) }
 }
 
 deprecated private import Impl<Config> as I
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll
@@ -283,6 +283,14 @@ deprecated private module Config implements FullStateConfigSig {
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
+
+  predicate filterForSourceOrSinkAlerts() { none() }
+
+  predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
+
+  predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
+
+  predicate isFilteredSink(Node sink) { isSink(sink) }
 }
 
 deprecated private import Impl<Config> as I
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll
@@ -283,6 +283,14 @@ deprecated private module Config implements FullStateConfigSig {
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
+
+  predicate filterForSourceOrSinkAlerts() { none() }
+
+  predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
+
+  predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
+
+  predicate isFilteredSink(Node sink) { isSink(sink) }
 }
 
 deprecated private import Impl<Config> as I
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl1.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl1.qll
@@ -283,6 +283,14 @@ deprecated private module Config implements FullStateConfigSig {
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
+
+  predicate filterForSourceOrSinkAlerts() { none() }
+
+  predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
+
+  predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
+
+  predicate isFilteredSink(Node sink) { isSink(sink) }
 }
 
 deprecated private import Impl<Config> as I
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll
@@ -283,6 +283,14 @@ deprecated private module Config implements FullStateConfigSig {
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
+
+  predicate filterForSourceOrSinkAlerts() { none() }
+
+  predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
+
+  predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
+
+  predicate isFilteredSink(Node sink) { isSink(sink) }
 }
 
 deprecated private import Impl<Config> as I
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll
@@ -283,6 +283,14 @@ deprecated private module Config implements FullStateConfigSig {
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
+
+  predicate filterForSourceOrSinkAlerts() { none() }
+
+  predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
+
+  predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
+
+  predicate isFilteredSink(Node sink) { isSink(sink) }
 }
 
 deprecated private import Impl<Config> as I
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll
@@ -283,6 +283,14 @@ deprecated private module Config implements FullStateConfigSig {
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
+
+  predicate filterForSourceOrSinkAlerts() { none() }
+
+  predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
+
+  predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
+
+  predicate isFilteredSink(Node sink) { isSink(sink) }
 }
 
 deprecated private import Impl<Config> as I
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl1.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl1.qll
@@ -283,6 +283,14 @@ deprecated private module Config implements FullStateConfigSig {
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
+
+  predicate filterForSourceOrSinkAlerts() { none() }
+
+  predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
+
+  predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
+
+  predicate isFilteredSink(Node sink) { isSink(sink) }
 }
 
 deprecated private import Impl<Config> as I
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll
@@ -283,6 +283,14 @@ deprecated private module Config implements FullStateConfigSig {
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
+
+  predicate filterForSourceOrSinkAlerts() { none() }
+
+  predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
+
+  predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
+
+  predicate isFilteredSink(Node sink) { isSink(sink) }
 }
 
 deprecated private import Impl<Config> as I
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll
@@ -283,6 +283,14 @@ deprecated private module Config implements FullStateConfigSig {
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
+
+  predicate filterForSourceOrSinkAlerts() { none() }
+
+  predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
+
+  predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
+
+  predicate isFilteredSink(Node sink) { isSink(sink) }
 }
 
 deprecated private import Impl<Config> as I
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll
@@ -283,6 +283,14 @@ deprecated private module Config implements FullStateConfigSig {
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
+
+  predicate filterForSourceOrSinkAlerts() { none() }
+
+  predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
+
+  predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
+
+  predicate isFilteredSink(Node sink) { isSink(sink) }
 }
 
 deprecated private import Impl<Config> as I
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll
@@ -283,6 +283,14 @@ deprecated private module Config implements FullStateConfigSig {
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
+
+  predicate filterForSourceOrSinkAlerts() { none() }
+
+  predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
+
+  predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
+
+  predicate isFilteredSink(Node sink) { isSink(sink) }
 }
 
 deprecated private import Impl<Config> as I
diff --git a/go/ql/lib/semmle/go/dataflow/internal/DataFlowImpl1.qll b/go/ql/lib/semmle/go/dataflow/internal/DataFlowImpl1.qll
@@ -283,6 +283,14 @@ deprecated private module Config implements FullStateConfigSig {
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
+
+  predicate filterForSourceOrSinkAlerts() { none() }
+
+  predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
+
+  predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
+
+  predicate isFilteredSink(Node sink) { isSink(sink) }
 }
 
 deprecated private import Impl<Config> as I
diff --git a/go/ql/lib/semmle/go/dataflow/internal/DataFlowImpl2.qll b/go/ql/lib/semmle/go/dataflow/internal/DataFlowImpl2.qll
@@ -283,6 +283,14 @@ deprecated private module Config implements FullStateConfigSig {
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
+
+  predicate filterForSourceOrSinkAlerts() { none() }
+
+  predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
+
+  predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
+
+  predicate isFilteredSink(Node sink) { isSink(sink) }
 }
 
 deprecated private import Impl<Config> as I
diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl1.qll b/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl1.qll
@@ -283,6 +283,14 @@ deprecated private module Config implements FullStateConfigSig {
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
+
+  predicate filterForSourceOrSinkAlerts() { none() }
+
+  predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
+
+  predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
+
+  predicate isFilteredSink(Node sink) { isSink(sink) }
 }
 
 deprecated private import Impl<Config> as I
diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl2.qll b/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl2.qll
@@ -283,6 +283,14 @@ deprecated private module Config implements FullStateConfigSig {
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
+
+  predicate filterForSourceOrSinkAlerts() { none() }
+
+  predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
+
+  predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
+
+  predicate isFilteredSink(Node sink) { isSink(sink) }
 }
 
 deprecated private import Impl<Config> as I
diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl3.qll b/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl3.qll
@@ -283,6 +283,14 @@ deprecated private module Config implements FullStateConfigSig {
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
+
+  predicate filterForSourceOrSinkAlerts() { none() }
+
+  predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
+
+  predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
+
+  predicate isFilteredSink(Node sink) { isSink(sink) }
 }
 
 deprecated private import Impl<Config> as I
diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl4.qll b/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl4.qll
@@ -283,6 +283,14 @@ deprecated private module Config implements FullStateConfigSig {
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
+
+  predicate filterForSourceOrSinkAlerts() { none() }
+
+  predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
+
+  predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
+
+  predicate isFilteredSink(Node sink) { isSink(sink) }
 }
 
 deprecated private import Impl<Config> as I
diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl5.qll b/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl5.qll
@@ -283,6 +283,14 @@ deprecated private module Config implements FullStateConfigSig {
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
+
+  predicate filterForSourceOrSinkAlerts() { none() }
+
+  predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
+
+  predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
+
+  predicate isFilteredSink(Node sink) { isSink(sink) }
 }
 
 deprecated private import Impl<Config> as I
diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl6.qll b/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl6.qll
@@ -283,6 +283,14 @@ deprecated private module Config implements FullStateConfigSig {
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
+
+  predicate filterForSourceOrSinkAlerts() { none() }
+
+  predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
+
+  predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
+
+  predicate isFilteredSink(Node sink) { isSink(sink) }
 }
 
 deprecated private import Impl<Config> as I
diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl1.qll b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl1.qll
@@ -283,6 +283,14 @@ deprecated private module Config implements FullStateConfigSig {
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
+
+  predicate filterForSourceOrSinkAlerts() { none() }
+
+  predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
+
+  predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
+
+  predicate isFilteredSink(Node sink) { isSink(sink) }
 }
 
 deprecated private import Impl<Config> as I
diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl2.qll b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl2.qll
@@ -283,6 +283,14 @@ deprecated private module Config implements FullStateConfigSig {
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
+
+  predicate filterForSourceOrSinkAlerts() { none() }
+
+  predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
+
+  predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
+
+  predicate isFilteredSink(Node sink) { isSink(sink) }
 }
 
 deprecated private import Impl<Config> as I
diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl3.qll b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl3.qll
@@ -283,6 +283,14 @@ deprecated private module Config implements FullStateConfigSig {
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
+
+  predicate filterForSourceOrSinkAlerts() { none() }
+
+  predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
+
+  predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
+
+  predicate isFilteredSink(Node sink) { isSink(sink) }
 }
 
 deprecated private import Impl<Config> as I
diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl4.qll b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl4.qll
@@ -283,6 +283,14 @@ deprecated private module Config implements FullStateConfigSig {
   FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
 
   predicate includeHiddenNodes() { any(Configuration config).includeHiddenNodes() }
+
+  predicate filterForSourceOrSinkAlerts() { none() }
+
+  predicate isFilteredSource(Node source, FlowState state) { isSource(source, state) }
+
+  predicate isFilteredSink(Node sink, FlowState state) { isSink(sink, state) }
+
+  predicate isFilteredSink(Node sink) { isSink(sink) }
 }
 
 deprecated private import Impl<Config> as I
diff --git a/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl1.qll b/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl1.qll
diff --git a/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl2.qll b/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl2.qll
diff --git a/shared/dataflow/codeql/dataflow/DataFlow.qll b/shared/dataflow/codeql/dataflow/DataFlow.qll
diff --git a/shared/dataflow/codeql/dataflow/TaintTracking.qll b/shared/dataflow/codeql/dataflow/TaintTracking.qll
diff --git a/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll b/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll
diff --git a/shared/util/codeql/util/AlertFiltering.qll b/shared/util/codeql/util/AlertFiltering.qll
diff --git a/shared/util/ext/default-alert-filter.yml b/shared/util/ext/default-alert-filter.yml
diff --git a/shared/util/qlpack.yml b/shared/util/qlpack.yml
diff --git a/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowImpl1.qll b/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowImpl1.qll
