CodeQL library for C/C++
codeql/cpp-all 0.12.11 (changelog, source)
Search

Class FormatLiteral

A class to represent format strings that occur as arguments to invocations of formatting functions.

Import path

import cpp

Direct supertypes

Indirect supertypes

Predicates

getConstantPart

Gets the constant part of the format string just before the nth conversion specifier. If n is zero, this will be the constant prefix before the 0th specifier, otherwise it is the string between the end of the n-1th specifier and the nth specifier. Has no result if n is negative or not strictly less than the number of conversion specifiers.

getConstantSuffix

Gets the constant part of the format string after the last conversion specifier.

getConvSpec

Gets the nth conversion specifier (including the initial %).

getConvSpecOffset

Gets the position in the string at which the nth conversion specifier starts.

getConvSpecRegexp

Gets a regular expression used for matching a whole conversion specifier.

getConversionChar

Gets the conversion character of the nth conversion specifier.

getConversionType

Gets the argument type required by the nth conversion specifier.

getConversionTypeAlternate

Gets an alternate argument type that would be required by the nth conversion specifier on a Microsoft or non-Microsoft platform, opposite to that of the snapshot. This may be useful for answering ‘what might happen’ questions.

getDefaultCharType

Gets the default character type expected for %s by this format literal. Typically char or wchar_t.

getFlags

Gets the flags of the nth conversion specifier.

getFloatingPointConversion

Gets the family of floating point types required by the nth conversion specifier’s length flag.

getFormat

Gets the format string, with ‘%%’ and ‘%@’ replaced by ‘_’ (to avoid processing them as format specifiers).

getFormatArgumentIndexFor

Gets the computed format argument index for the nth conversion specifier of this format string (if mode = 2), it’s minimum field width (if mode = 0) or it’s precision (if mode = 1). Has no result if that element is not present. Does not account for positional arguments ($).

getIntegralConversion

Gets the family of integral types required by the nth conversion specifier’s length flag.

getIntegralDisplayType

Gets the family of integral types output / displayed by the nth conversion specifier’s length flag.

getLength

Gets the length flag of the nth conversion specifier.

getMaxConvertedLength

Gets the maximum length of the string that can be produced by this format string. Has no result if this cannot be determined.

getMaxConvertedLength

Gets the maximum length of the string that can be produced by the nth conversion specifier of this format string; has no result if this cannot be determined.

getMaxConvertedLength

Gets the maximum length of the string that can be produced by the nth conversion specifier of this format string, specifying the estimation reason; has no result if this cannot be determined.

getMaxConvertedLengthLimited

Gets the maximum length of the string that can be produced by this format string, except that float to string conversions are assumed to be 8 characters. This is helpful for determining whether a buffer overflow is caused by long float to string conversions.

getMaxConvertedLengthLimited

Gets the maximum length of the string that can be produced by the nth conversion specifier of this format string, except that float to string conversions are assumed to be 8 characters. This is helpful for determining whether a buffer overflow is caused by long float to string conversions.

getMaxConvertedLengthLimited

Gets the maximum length of the string that can be produced by the nth conversion specifier of this format string, specifying the reason for the estimation, except that float to string conversions are assumed to be 8 characters. This is helpful for determining whether a buffer overflow is caused by long float to string conversions.

getMaxConvertedLengthLimitedWithReason

Gets the maximum length of the string that can be produced by this format string, specifying the reason for the estimate, except that float to string conversions are assumed to be 8 characters. This is helpful for determining whether a buffer overflow is caused by long float to string conversions.

getMaxConvertedLengthWithReason

Gets the maximum length of the string that can be produced by this format string, specifying the reason for the estimate. Has no result if no estimate can be found.

getMinFieldWidth

Gets the minimum field width of the nth conversion specifier.

getMinFieldWidthOpt

Gets the minimum field width of the nth conversion specifier (empty string if none is given).

getMinFieldWidthParameterFieldValue

Gets the zero-based parameter number of the minimum field width of the nth conversion specifier, if it is implicit and uses a parameter field (such as *1$).

getNonDefaultCharType

Gets the non-default character type expected for %S by this format literal. Typically wchar_t or char. On some snapshots there may be multiple results where we can’t tell which is correct for a particular function.

getNumArgNeeded

Gets the number of arguments needed by this format string.

getNumArgNeeded

Gets the number of arguments required by the nth conversion specifier of this format string.

getNumConvSpec

Gets the number of conversion specifiers (not counting %%)

getParameterField

Gets the parameter field of the nth conversion specifier (for example, 1$).

getParameterFieldValue

Gets the parameter field of the nth conversion specifier (if it has one) as a zero-based number.

getPrecision

Gets the precision of the nth conversion specifier.

getPrecisionOpt

Gets the precision of the nth conversion specifier (empty string if none is given).

getPrecisionParameterFieldValue

Gets the zero-based parameter number of the precision of the nth conversion specifier, if it is implicit and uses a parameter field (such as *1$).

getStorePointerConversion

Gets the family of pointer types required by the nth conversion specifier’s length flag.

getUse

Gets the function call where this format string is used.

getWideCharType

Gets the wide character type for this format literal. This is usually wchar_t. On some snapshots there may be multiple results where we can’t tell which is correct for a particular function.

hasAlternateFlag

Holds if the nth conversion specifier has alternate flag (“#”).

hasAlternativeDigits

Holds if the nth conversion specifier has the alternative digits flag (“I”).

hasBlank

Holds if the nth conversion specifier has the blank flag (" ").

hasExplicitMinFieldWidth

Holds if the nth conversion specifier has an explicitly given minimum field width.

hasExplicitPrecision

Holds if the nth conversion specifier has an explicitly given precision.

hasImplicitMinFieldWidth

Holds if the nth conversion specifier has an implicitly given minimum field width (either “*” or “*i$” for some number i).

hasImplicitPrecision

Holds if the nth conversion specifier has an implicitly given precision (either “*” or “*i$” for some number i).

hasMinFieldWidth

Holds if the nth conversion specifier has a minimum field width.

hasPrecision

Holds if the nth conversion specifier has a precision.

hasSign

Holds if the nth conversion specifier has the explicit sign flag (“+”).

hasThousandsGrouping

Holds if the nth conversion specifier has the thousands grouping flag (“’”).

isLeftAdjusted

Holds if the nth conversion specifier has flag left adjustment flag (“-”). Note that this overrides the zero padding flag.

isMicrosoft

Holds if this FormatLiteral is in a context that supports Microsoft rules and extensions.

isZeroPadded

Holds if the nth conversion specifier has zero padding flag (“0”).

parseConvSpec

Holds if the arguments are a parsing of a conversion specifier to this format string, where n is which conversion specifier to parse, spec is the whole conversion specifier, params is the argument to be converted in case it’s not positional, flags contains additional format flags, width is the maximum width option of this input, len is the length flag of this input, and conv is the conversion character of this input.

specsAreKnown

Holds if all conversion specifiers of this format string have been parsed by the library (this does not hold if one or more unrecognized format specifiers are present in the format string).

Inherited predicates

findRootCause

Gets the source of this element: either itself or a macro that expanded to this element.

from Element
fromSource

Holds if this element may be from source. This predicate holds for all elements, except for those in the dummy file, whose name is the empty string. The dummy file contains declarations that are built directly into the compiler.

from Element
getAChild

Gets a child of this expression.

from Expr
getAFalseSuccessor

Gets a node such that the control-flow edge (this, result) may be taken when this expression is false.

from ControlFlowNode
getAPredecessor

Gets a direct predecessor of this control-flow node, if any.

from ControlFlowNode
getAPrimaryQlClass

Gets the name of a primary CodeQL class to which this element belongs.

from Literal
getASuccessor

Gets a direct successor of this control-flow node, if any.

from ControlFlowNode
getATrueSuccessor

Gets a node such that the control-flow edge (this, result) may be taken when this expression is true.

from ControlFlowNode
getActualType

Gets the type of this expression, after any implicit conversions and explicit casts, and after resolving typedefs.

from Expr
getAnImplicitDestructorCall

Gets a compiler-generated destructor call that is performed after this expression.

from Expr
getBasicBlock

Gets the BasicBlock containing this control-flow node.

from ControlFlowNode
getChild

Gets the nth child of this expression.

from Expr
getControlFlowScope

Gets the function containing this control-flow node.

from Expr
getConversion

Gets the conversion associated with this expression, if any.

from Expr
getConversionString

Gets a string describing the conversion associated with this expression, or "" if there is none.

from Expr
getEnclosingBlock

Gets the nearest enclosing set of curly braces around this expression in the source, if any.

from Expr
getEnclosingDeclaration

Gets the enclosing variable or function of this expression.

from Expr
getEnclosingElement

Gets the closest Element enclosing this one.

from Element
getEnclosingFunction

Gets the enclosing function of this expression, if any.

from Expr
getEnclosingStmt

Gets the smallest statement containing this control-flow node.

from Expr
getEnclosingVariable

Gets the enclosing variable of this expression, if any.

from Expr
getExplicitlyConverted

Gets this expression with all of its explicit casts, but none of its implicit casts. More precisely this takes conversions up to the last explicit cast (there may be implicit conversions along the way), but does not include conversions after the last explicit cast.

from Expr
getFile

Gets the primary file where this element occurs.

from Element
getFullyConverted

Gets the fully converted form of this expression, including all type casts and other conversions.

from Expr
getImplicitDestructorCall

Gets the nth compiler-generated destructor call that is performed after this expression, in order of destruction.

from Expr
getImplicitlyConverted

Gets this expression with all of its initial implicit casts, but none of its explicit casts. More precisely, this takes all implicit conversions up to (but not including) the first explicit cast (if any).

from Expr
getLocation

Gets the location of this expression.

from Expr
getNumChild

Gets the number of direct children of this expression.

from Expr
getParent

Gets the parent of this expression, if any.

from Expr
getParentScope

Gets the parent scope of this Element, if any. A scope is a Type (Class / Enum), a Namespace, a BlockStmt, a Function, or certain kinds of Statement.

from Element
getParentWithConversions

Gets the parent of this expression, if any, in an alternative syntax tree that has Conversions as part of the tree.

from Expr
getPrecedence

Gets the precedence of the main operator of this expression; higher precedence binds tighter.

from Expr
getPrimaryQlClasses

Gets a comma-separated list of the names of the primary CodeQL classes to which this element belongs.

from ElementBase
getType

Gets the type of this expression.

from Expr
getUnconverted

Gets the unique non-Conversion expression e for which this = e.getConversion*().

from Expr
getUnderlyingType

Gets the type of this expression after typedefs have been resolved.

from Expr
getUnspecifiedType

Gets the type of this expression after specifiers have been deeply stripped and typedefs have been resolved.

from Expr
getValue

Gets the value of this expression, if it is a constant.

from Expr
getValueCategoryString

Gets a string representation of the value category of the expression. This is intended only for debugging. The possible values are:

from Expr
getValueText

Gets the source text for the value of this expression, if it is a constant.

from Expr
hasChild

Holds if e is the nth child of this expression.

from Expr
hasConversion

Holds if this expression has a conversion.

from Expr
hasExplicitConversion

Holds if this expression has an explicit conversion.

from Expr
hasImplicitConversion

Holds if this expression has an implicit conversion.

from Expr
hasLValueToRValueConversion

Holds if this expression has undergone an lvalue-to-rvalue conversion to extract its value. for example: y = x; The VariableAccess for x is a prvalue, and hasLValueToRValueConversion() holds because the value of x was loaded from the location of x. The VariableAccess for y is an lvalue, and hasLValueToRValueConversion() does not hold because the value of y was not extracted.

from Expr
isAffectedByMacro

Holds if this element is affected in any way by a macro. All elements that are totally or partially generated by a macro are included, so this is a super-set of isInMacroExpansion.

from Element
isCompilerGenerated

Holds if this is an auxiliary expression generated by the compiler.

from Expr
isCondition

Holds if this node is the top-level expression of a conditional statement, meaning that this.getATrueSuccessor() or this.getAFalseSuccessor() will have a result.

from ControlFlowNode
isConstant

Holds if this expression has a value that can be determined at compile time.

from Expr
isFromTemplateInstantiation

Holds if this Element is a part of a template instantiation (but not the template itself).

from Element
isFromUninstantiatedTemplate

Holds if this Element is part of a template template (not if it is part of an instantiation of template). This means it is represented in the database purely as syntax and without guarantees on the presence or correctness of type-based operations such as implicit conversions.

from Element
isGLValueCategory

Holds if this expression is a glvalue. A glvalue is either an lvalue or an xvalue.

from Expr
isInMacroExpansion

Holds if this element comes from a macro expansion. Only elements that are entirely generated by a macro are included - for elements that partially come from a macro, see isAffectedByMacro.

from Element
isLValue

Holds if this expression is an lvalue, in the sense of having an address.

from Expr
isLValueCategory

Holds if this expression is an lvalue. An lvalue is an expression that represents a location, rather than a value. See [basic.lval] for more about lvalues.

from Expr
isPRValueCategory

Holds if this expression is a prvalue. A prvalue is an expression that represents a value, rather than a location. See [basic.lval] for more about prvalues.

from Expr
isParenthesised

Holds if this expression is parenthesised.

from Expr
isPure

Holds if this expression is side-effect free (conservative approximation). This predicate cannot be overridden; override mayBeImpure() instead.

from Expr
isRValueCategory

Holds if this expression is an rvalue. An rvalue is either a prvalue or an xvalue.

from Expr
isUnevaluated

Holds if this expression will not be evaluated because of its context, such as an expression inside a sizeof.

from Expr
isXValueCategory

Holds if this expression is an xvalue. An xvalue is a location whose lifetime is about to end (e.g. an rvalue reference returned from a function call). See [basic.lval] for more about xvalues.

from Expr
mayBeGloballyImpure

Holds if it is possible that the expression may be impure. If we are not sure, then it holds. Unlike mayBeImpure(), this predicate does not consider modifications to temporary local variables to be impure. If you call a function in which nothing may be globally impure then the function as a whole will have no side-effects, even if it mutates its own fresh stack variables.

from Literal
mayBeImpure

Holds if it is possible that the expression may be impure. If we are not sure, then it holds.

from Literal
toString

Gets a textual representation of this literal.

from Literal

Charpred