Skip to content

C++: Remove FunctionWithWrappers from cpp/tainted-format-string#21863

Draft
MathiasVP wants to merge 7 commits into
github:mainfrom
MathiasVP:remove-function-with-wrappers-from-tainted-format-string
Draft

C++: Remove FunctionWithWrappers from cpp/tainted-format-string#21863
MathiasVP wants to merge 7 commits into
github:mainfrom
MathiasVP:remove-function-with-wrappers-from-tainted-format-string

Conversation

@MathiasVP
Copy link
Copy Markdown
Contributor

@MathiasVP MathiasVP commented May 18, 2026

We've previously discussed removing uses of FunctionWithWrappers because:

  1. It creates language discrepancies as it's only a library that exists for C/C++, and
  2. It tends to produce many alerts for "the same issue".

To see how point 2 arises (for this particular query) consider this code:

void printWrapper(char *data) {
  printf(data);
}

void test() {
  char* data = user_controlled_data();
  printWrapper(data); // (1)
  printWrapper(data); // (2)
}

with the current query this produces two separate alerts: one at (1) and another at (2).

When we remove the use of FunctionWithWrappers we get one alert with two paths, and the user (or Code Scanning) can choose how many of those to surface (for instance by tweaking the CLI's --max-paths argument).

Result investigation

Most alert changes are the result of moving an alert to the actual printf-like function instead of a wrapper. There are lots of new Samate results because we now properly track flow through function pointers (which we didn't do before because the wrapper detection library didn't track function pointers).

Why are there so many changes in this PR?

Unfortunately, I had to clamp together two sets of changes into one PR to prevent a regression:

  1. The first two commits removes the FunctionWithWrappers mechanism from the query, and
  2. The remaining commits add lots more formatting sinks.

I was planning on doing 2. in a separate PR first, but that resulted in result duplication. And if I did 1. first it resulted in missing results (in particular this result: https://github.com/lubomyr/bochs/blob/8e0b9abcd81cd24d4d9c68f7fdef2f53bc180d33/gui/siminterface.cc#L1541)

@github-actions github-actions Bot added the C++ label May 18, 2026
@MathiasVP MathiasVP added the depends on internal PR This PR should only be merged in sync with an internal Semmle PR label May 18, 2026
@MathiasVP MathiasVP force-pushed the remove-function-with-wrappers-from-tainted-format-string branch from f87ba8d to 18ec74a Compare May 19, 2026 18:26
@MathiasVP MathiasVP force-pushed the remove-function-with-wrappers-from-tainted-format-string branch from 18ec74a to 24bdc34 Compare May 22, 2026 12:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

C++ depends on internal PR This PR should only be merged in sync with an internal Semmle PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant