Merge remote-tracking branch 'origin/main' into michaelrfairhurst/preconditions-rule-22-3-1-no-asserts-on-constants

Author: MichaelRFairhurst

.github/copilot-instructions.md

@@ -55,5 +55,6 @@ When reviewing tests, it is critical to:
 - Check that there are no `.expected` rows that refer to test code cases marked as `COMPLIANT`, or with no comment
 - Note that it is OK if the locations of the comment are not precisely aligned with the alert 
 - Check that the alert message and placeholders are accurate and understandable.
+- Check that the locations do not refer to files in the standard library, as these have issues in GitHub's Code Scanning UI and complicate our compiler compatibility tests.
 - Consider the "test coverage" of the query, are each of its logical statements effectively exercised  individually, collectively? The test should neither be overly bloated nor under specified.
 - Consider the edge cases of the language itself, will the analysis work in non-trivial cases, are all relevant language concepts tested here? This doesn't need to be exhaustive, but it should be thoughfully thorough.

c/common/src/codingstandards/c/Objects.qll

@@ -1,5 +1,5 @@
 import cpp
-import codingstandards.c.StorageDuration
+import codingstandards.cpp.lifetimes.StorageDuration
 import codingstandards.c.IdentifierLinkage
 import semmle.code.cpp.valuenumbering.HashCons
 import codingstandards.cpp.Clvalues

change_notes/2026-01-31-move-iterators-shared-library.md

@@ -0,0 +1,4 @@
+- `A-23-0-1`, `A-23-0-2`, `CTR-51-CPP`, `CTR-52-CPP`, `CTR-53-CPP`, `CTR-54-CPP`, `CTR-55-CPP`, `STR-52-CPP` - `IteratorImplicitlyConvertedToConstIterator.ql`, `ValidContainerElementAccess.ql`, `UsesValidContainerElementAccess.ql`, `GuaranteeGenericCppLibraryFunctionsDoNotOverflow.ql`, `UseValidIteratorRanges.ql`, `DoNotSubtractIteratorsForDifferentContainers.ql`, `DoNotUseAnAdditiveOperatorOnAnIterator.ql`, `UseValidReferencesForElementsOfString.ql`:
+  - Iterator access methods `rbegin`, `rend`, `crbegin`, `crend` are now recognized on containers.
+  - Shared library `Iterators.qll` has been refactored by splitting out container type logic into a separate library and add logic to differentiate types of containers, such as associative, indexed, and strings.
+  - Shared library `Iterators.qll`, used by many queries, has been moved.

cpp/autosar/src/rules/A23-0-1/IteratorImplicitlyConvertedToConstIterator.ql

@@ -13,7 +13,7 @@
 
 import cpp
 import codingstandards.cpp.autosar
-import codingstandards.cpp.Iterators
+import codingstandards.cpp.standardlibrary.Iterators
 
 /*
  *  Due to inconsistent typedefs across STL containers the way this is parsed

cpp/autosar/test/rules/A23-0-1/IteratorImplicitlyConvertedToConstIterator.expected

@@ -1,8 +1,8 @@
 | test.cpp:10:39:10:48 | call to __iterator | Non-const version of container call immediately converted to a `const_iterator`. |
 | test.cpp:13:38:13:42 | call to begin | Non-const version of container call immediately converted to a `const_iterator`. |
 | test.cpp:16:44:16:48 | call to begin | Non-const version of container call immediately converted to a `const_iterator`. |
-| test.cpp:19:43:19:47 | call to begin | Non-const version of container call immediately converted to a `const_iterator`. |
-| test.cpp:22:50:22:54 | call to begin | Non-const version of container call immediately converted to a `const_iterator`. |
+| test.cpp:19:41:19:50 | call to __iterator | Non-const version of container call immediately converted to a `const_iterator`. |
+| test.cpp:22:47:22:57 | call to __iterator | Non-const version of container call immediately converted to a `const_iterator`. |
 | test.cpp:25:8:25:16 | call to __iterator | Non-const version of container call immediately converted to a `const_iterator`. |
 | test.cpp:27:10:27:14 | call to begin | Non-const version of container call immediately converted to a `const_iterator`. |
 | test.cpp:29:11:29:15 | call to begin | Non-const version of container call immediately converted to a `const_iterator`. |

cpp/cert/src/rules/CTR52-CPP/GuaranteeGenericCppLibraryFunctionsDoNotOverflow.ql

@@ -18,7 +18,7 @@
 
 import cpp
 import codingstandards.cpp.cert
-import codingstandards.cpp.Iterators
+import codingstandards.cpp.standardlibrary.Iterators
 import codingstandards.cpp.rules.containeraccesswithoutrangecheck.ContainerAccessWithoutRangeCheck as ContainerAccessWithoutRangeCheck
 import semmle.code.cpp.controlflow.Guards
 import semmle.code.cpp.dataflow.TaintTracking

cpp/cert/src/rules/CTR53-CPP/UseValidIteratorRanges.ql

@@ -18,7 +18,7 @@
 
 import cpp
 import codingstandards.cpp.cert
-import codingstandards.cpp.Iterators
+import codingstandards.cpp.standardlibrary.Iterators
 import semmle.code.cpp.dataflow.DataFlow
 
 predicate startEndArgumentsDoNotPointToTheSameContainer(

cpp/cert/src/rules/CTR54-CPP/DoNotSubtractIteratorsForDifferentContainers.ql

@@ -18,7 +18,7 @@
 
 import cpp
 import codingstandards.cpp.cert
-import codingstandards.cpp.Iterators
+import codingstandards.cpp.standardlibrary.Iterators
 
 /** Models the subtraction operator */
 class SubtractionOperator extends Function {

cpp/cert/src/rules/CTR55-CPP/DoNotUseAnAdditiveOperatorOnAnIterator.ql

@@ -18,7 +18,7 @@
 
 import cpp
 import codingstandards.cpp.cert
-import codingstandards.cpp.Iterators
+import codingstandards.cpp.standardlibrary.Iterators
 import semmle.code.cpp.controlflow.Dominance
 import semmle.code.cpp.dataflow.DataFlow
 

cpp/common/src/codingstandards/cpp/Iterators.qll

@@ -252,78 +252,6 @@ class AdditiveOperatorFunctionCall extends FunctionCall {
   }
 }
 
-/**
- * Models a collection of STL container classes.
- */
-class STLContainer extends Class {
-  STLContainer() {
-    getNamespace() instanceof StdNS and
-    getSimpleName() in [
-        "vector", "list", "deque", "set", "multiset", "map", "multimap", "stack", "queue",
-        "priority_queue", "string", "forward_list", "unordered_set", "unordered_multiset",
-        "unordered_map", "unordered_multimap", "valarray", "string", "basic_string"
-      ]
-    or
-    getSimpleName() = "string"
-    or
-    getSimpleName() = "basic_string"
-  }
-
-  /**
-   * Get a call to a named function of this class.
-   */
-  FunctionCall getACallTo(string name) {
-    exists(Function f |
-      f = getAMemberFunction() and
-      f.hasName(name) and
-      result = f.getACallToThisFunction()
-    )
-  }
-
-  /**
-   * Gets all calls to all functions of this class.
-   */
-  FunctionCall getACallToAFunction() {
-    exists(Function f |
-      f = getAMemberFunction() and
-      result = f.getACallToThisFunction()
-    )
-  }
-
-  FunctionCall getACallToSize() { result = getACallTo("size") }
-
-  FunctionCall getANonConstIteratorBeginFunctionCall() { result = getACallTo("begin") }
-
-  IteratorSource getAConstIteratorBeginFunctionCall() { result = getACallTo("cbegin") }
-
-  IteratorSource getANonConstIteratorEndFunctionCall() { result = getACallTo("end") }
-
-  IteratorSource getAConstIteratorEndFunctionCall() { result = getACallTo("cend") }
-
-  IteratorSource getANonConstIteratorFunctionCall() {
-    result = getACallToAFunction() and
-    result.getTarget().getType() instanceof NonConstIteratorType
-  }
-
-  IteratorSource getAConstIteratorFunctionCall() {
-    result = getACallToAFunction() and
-    result.getTarget().getType() instanceof ConstIteratorType
-  }
-
-  IteratorSource getAnIteratorFunctionCall() {
-    result = getANonConstIteratorFunctionCall() or result = getAConstIteratorFunctionCall()
-  }
-
-  IteratorSource getAnIteratorBeginFunctionCall() {
-    result = getANonConstIteratorBeginFunctionCall() or
-    result = getAConstIteratorBeginFunctionCall()
-  }
-
-  IteratorSource getAnIteratorEndFunctionCall() {
-    result = getANonConstIteratorEndFunctionCall() or result = getAConstIteratorEndFunctionCall()
-  }
-}
-
 /**
  * Models the set of iterator sources. Useful for encapsulating dataflow coming
  * from a function call producing an iterator.
@@ -338,13 +266,6 @@ class IteratorSource extends FunctionCall {
   Variable getOwner() { result = getQualifier().(VariableAccess).getTarget() }
 }
 
-/**
- * Models a variable that is a `STLContainer`
- */
-class STLContainerVariable extends Variable {
-  STLContainerVariable() { getType() instanceof STLContainer }
-}
-
 /**
  * Usually an iterator range consists of two sequential iterator arguments, for
  * example, the start and end. However, there are exceptions to this rule so