FilesExpand file tree

main

/

UnreachableStatement.ql

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

125 lines (115 loc) · 3.93 KB

main

/

UnreachableStatement.ql

Copy path

Top

File metadata and controls

• Code
• Blame

125 lines (115 loc) · 3.93 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

/**

* @name Unreachable statement

* @description Unreachable statements are often indicative of missing code or latent bugs

* and should be avoided.

* @kind problem

* @problem.severity warning

* @id go/unreachable-statement

* @tags quality

* reliability

* correctness

* external/cwe/cwe-561

* @precision very-high

*/

import go

/**

* Holds if `s` is reachable, that is, the control-flow graph contains a node for it.

*

* The shared control-flow library does not create control-flow nodes for dead code, so an

* unreachable statement has no first control-flow node.

*/

predicate isReachable(Stmt s) { exists(s.getFirstControlFlowNode()) }

/** Gets the statement immediately preceding `s` in a statement list, if any. */

Stmt getPreviousStmt(Stmt s) {

exists(BlockStmt b, int i | s = b.getStmt(i) and result = b.getStmt(i - 1))

or

exists(CaseClause c, int i | s = c.getStmt(i) and result = c.getStmt(i - 1))

or

exists(CommClause c, int i | s = c.getStmt(i) and result = c.getStmt(i - 1))

}

/**

* Holds if `s` is unreachable but the code that would precede it in the control-flow graph is

* reachable, so that `s` is the first unreachable statement in a run of dead code.

*/

predicate firstUnreachableStmt(Stmt s) {

not isReachable(s) and

(

// a statement whose preceding statement in the same list is reachable

isReachable(getPreviousStmt(s))

or

// the post statement of a `for` loop whose body is entered

exists(ForStmt f | s = f.getPost() and isReachable(f.getBody().getAStmt()))

)

}

/** Holds if `s` is in a run of unreachable statements following a constant condition. */

predicate isInUnreachableRunAfterConstantCondition(Stmt s) {

not isReachable(s) and

(

exists(getPreviousStmt(s).(IfStmt).getCondition().getBoolValue())

or

isInUnreachableRunAfterConstantCondition(getPreviousStmt(s))

)

}

/**

* Matches if `retval` is a constant or a struct composed wholly of constants.

*/

predicate isAllowedReturnValue(Expr retval) {

exprRefersToNil(retval)

or

retval = Builtin::true_().getAReference()

or

retval = Builtin::false_().getAReference()

or

retval instanceof BasicLit

or

// Allow -1 (which parses as unary-minus-of-literal) or !true, but not &somestruct,

// for which we would usually prefer `return nil`

isAllowedReturnValue(retval.(UnaryExpr).getOperand()) and

not retval.getType().getUnderlyingType() instanceof PointerType

or

// Allow structs composed of allowed values

retval instanceof StructLit and

forall(Expr element | element = retval.(StructLit).getAnElement() | isAllowedReturnValue(element))

or

// Allow anything of type `error`, as `abort(); return constructError(...);`

// is preferable to insisting on a misleading `return nil` that suggests

// successful return:

retval.getType().getEntity() = Builtin::error()

}

/**

* Matches if `s` is an allowed unreachable statement.

*/

predicate allowlist(Stmt s) {

s instanceof EmptyStmt

or

// `panic("unreachable")` and similar

exists(CallExpr ce | ce = s.(ExprStmt).getExpr() or ce = s.(ReturnStmt).getExpr() |

ce.getTarget().mustPanic() or ce.getCalleeName().toLowerCase() = "error"

)

or

// `return nil` and similar

exists(ReturnStmt ret | ret = s |

forall(Expr retval | retval = ret.getAnExpr() | isAllowedReturnValue(retval))

)

}

Stmt firstNonAllowlisted(Stmt s) {

not isReachable(s) and

(

not allowlist(s) and result = s

or

allowlist(s) and

exists(Stmt next | getPreviousStmt(next) = s | result = firstNonAllowlisted(next))

)

}

/** Holds if `s` is the first non-allowlisted statement in a run of unreachable statements. */

predicate firstNonAllowlistedUnreachableStmt(Stmt s) {

exists(Stmt unreachable |

firstUnreachableStmt(unreachable) and

s = firstNonAllowlisted(unreachable)

)

}

from Stmt s

where

firstNonAllowlistedUnreachableStmt(s) and

not isInUnreachableRunAfterConstantCondition(s)

select s, "This statement is unreachable."