Skip to content

C++: Refactor of UncheckedLeapYearAfterModification#21292

Open
bdrodes wants to merge 31 commits intogithub:mainfrom
microsoft:UncheckedLeaprYearAfterModification_Refactor_Upstream
Open

C++: Refactor of UncheckedLeapYearAfterModification#21292
bdrodes wants to merge 31 commits intogithub:mainfrom
microsoft:UncheckedLeaprYearAfterModification_Refactor_Upstream

Conversation

@bdrodes
Copy link
Contributor

@bdrodes bdrodes commented Feb 6, 2026

This PR addresses excessive false positive alerting from Likely Bugs/Leap Year/UncheckedLeapYearAfterYearModification.ql. In separate in-depth auditing, the number of alerts drops from 40,000 down to 2,000 with these changes, with a much higher rate of true positives, though still too high to be considered more than medium precision (~25% false positive rate remaining).

This PR is a complete refactor of the original query to address the false positives observed on production code. Some of the lessons learned here could be extrapolated into the LeapYear.qll library, but leaving changes like this for future PRs.

…cks (UncheckedLeapYearAfterYearModification). Switch to using 'postprocess' for unit tests.
…ion. Includes new logic for detecting leap year checks, new forms of leap year checks detected, and various heuristics to remove false postives. Move TimeConversionFunction into LeapYear.qll and refactored to separate conversion functions that are expected to be checked for failure from those that auto correct leap year dates if feb 29 is provided on a non-leap year. Increas the set of known TimeConversionFunctions.
…auto correct for leap year should be considered.
@bdrodes bdrodes requested a review from a team as a code owner February 6, 2026 21:23
Copilot AI review requested due to automatic review settings February 6, 2026 21:23
@github-actions github-actions bot added the C++ label Feb 6, 2026
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Refactors the UncheckedLeapYearAfterYearModification CodeQL query to significantly reduce false positives by introducing more precise flow/guard modeling and expanded heuristics around conversions and “ignorable” operations.

Changes:

  • Reworked UncheckedLeapYearAfterYearModification.ql into a path-problem with new taint/dataflow-based modeling and multiple false-positive suppression heuristics.
  • Centralized/expanded time conversion API modeling in LeapYear.qll and updated related query/tests/expected outputs accordingly.
  • Extended date/time type support (e.g., TIME_FIELDS) and added release change notes.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 6 comments.

Show a summary per file
File Description
cpp/ql/test/query-tests/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearModification/test.cpp Adds many new positive/negative/edge test scenarios for the refactored query.
cpp/ql/test/query-tests/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearModification/UncheckedReturnValueForTimeFunctions.expected Updates expected results to match new line numbers/coverage.
cpp/ql/test/query-tests/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearModification/UncheckedLeapYearAfterYearModification.qlref Switches to inline-expectations postprocessing.
cpp/ql/test/query-tests/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearModification/UncheckedLeapYearAfterYearModification.expected Updates expected results to reflect path-problem output and new test suite.
cpp/ql/src/Likely Bugs/Leap Year/UncheckedReturnValueForTimeFunctions.ql Refines conversion-return checking to exclude auto-leap-year-correcting APIs.
cpp/ql/src/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearModification.ql Full refactor: new flow configurations, guard recognition, and suppression heuristics.
cpp/ql/src/Likely Bugs/Leap Year/LeapYear.qll Moves/expands TimeConversionFunction modeling and adds auto-correcting classification.
cpp/ql/lib/semmle/code/cpp/commons/DateTime.qll Expands recognized unpacked time/date types and adds field-access classes for TIME_FIELDS.
cpp/ql/lib/change-notes/2026-02-06-UncheckedLeapYearAfterModification_Refactor Adds changelog entry documenting the refactor and alert reduction.

Copy link
Contributor

@geoffw0 geoffw0 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Initial review - lots of small comments, though little in particular I have strong feelings about. I'm happy to see this query get an overhaul, I'm very happy to see lots of test cases, though there is more query code than I'd like from a readability perspective. It would be nice to have some kind of diagram of how all the flows to fit together to aid understanding.

If you make whichever improvements you feel are most valuable, then I expect to approve this. I do also want to briefly check:

  • performance
  • real world (MRVA) result changes
  • CI

bdrodes and others added 11 commits February 12, 2026 09:36
…ification.ql

Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
…ication_Refactor.md

Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
…w steps for two similar flows into a common additional step predicate.
…ification.ql

Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
…ification.ql

Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
@bdrodes
Copy link
Contributor Author

bdrodes commented Feb 12, 2026

Initial review - lots of small comments, though little in particular I have strong feelings about. I'm happy to see this query get an overhaul, I'm very happy to see lots of test cases, though there is more query code than I'd like from a readability perspective. It would be nice to have some kind of diagram of how all the flows to fit together to aid understanding.

If you make whichever improvements you feel are most valuable, then I expect to approve this. I do also want to briefly check:

  • performance
  • real world (MRVA) result changes
  • CI

I think I've addressed all the comments. Are you able to run the DCA run? I'm not sure I have access to do so anymore.

@geoffw0
Copy link
Contributor

geoffw0 commented Feb 13, 2026

I've started a DCA run (though I'm not confident I remember the configuration that will work for CPP - we will see).

Copy link
Contributor

@geoffw0 geoffw0 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All of my comments have been addressed to my satisfaction. I believe so have the Copilot comments. 👍

@geoffw0
Copy link
Contributor

geoffw0 commented Feb 13, 2026

On the DCA run we gain 5 results and lose 38. To be honest I'm surprised this query had as many as 38 results given how narrow its purpose is, but there does seem to be a lot of date management code around. The new result set LGTM apart from a couple of FPs involving "magic numbers" 80 and 20, used to convert between various "zero" dates. The lost results are a wide assortment including many of the FP cases your changes cover. So good job!

There is an overall 2% analysis time regression, which appears to be likely caused by a slowdown in this query. It doesn't "explode" on any particular project, so there's no crisis here, but I plan to take a look at what the query's spending that time doing...

I also did a MRVA-100 run with similar results (if a less extreme improvement). There are a couple of FPs where we don't spot that tm_mday is (conditionally) set after updating the year, and another use of the conversion constant 80. If you don't mind making a late alteration to the query, I think adding 80 to the list of conversion constants would improve results a little further - but this will not block my approval.

@geoffw0
Copy link
Contributor

geoffw0 commented Feb 17, 2026

There is an overall 2% analysis time regression

I had a look at the query locally and I didn't get a consistent signal that anything is really wrong performance-wise. I've started a second DCA run to compare.

bdrodes and others added 2 commits February 17, 2026 10:13
…ification.ql

Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
…ification.ql

Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
@bdrodes
Copy link
Contributor Author

bdrodes commented Feb 17, 2026

On the DCA run we gain 5 results and lose 38. To be honest I'm surprised this query had as many as 38 results given how narrow its purpose is, but there does seem to be a lot of date management code around. The new result set LGTM apart from a couple of FPs involving "magic numbers" 80 and 20, used to convert between various "zero" dates. The lost results are a wide assortment including many of the FP cases your changes cover. So good job!

There is an overall 2% analysis time regression, which appears to be likely caused by a slowdown in this query. It doesn't "explode" on any particular project, so there's no crisis here, but I plan to take a look at what the query's spending that time doing...

I also did a MRVA-100 run with similar results (if a less extreme improvement). There are a couple of FPs where we don't spot that tm_mday is (conditionally) set after updating the year, and another use of the conversion constant 80. If you don't mind making a late alteration to the query, I think adding 80 to the list of conversion constants would improve results a little further - but this will not block my approval.

I could add that, but in the cases you are seeing, what does the magic number 80 correspond to? Happy to add new number filters but I like to document why it is removed, ideally if I can tie it to some specific conversion or some specific datatype.

Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
@geoffw0
Copy link
Contributor

geoffw0 commented Feb 17, 2026

in the cases you are seeing, what does the magic number 80 correspond to?

It seems to be about converting between "years since 1980" and "years since 1900" as best I can tell. e.g. here. I don't know how common "years since 1980" is but I did see this on another database as well.

The 2% analysis performance regression persisted in the second DCA run. It's not a total blocker but it does suggest something could be wrong - and might have a worse impact on databases we haven't tested. I will try and find time to have another look at what is causing this.

@jketema
Copy link
Contributor

jketema commented Feb 17, 2026

don't know how common "years since 1980" is but I did see this on another database as well.

1980/01/01 is the start of the epoch on e.g. DOS, similar to what 1970/01/01 is on Unix. See also https://en.wikipedia.org/wiki/System_time#Operating_systems.

@geoffw0
Copy link
Contributor

geoffw0 commented Feb 17, 2026

See also https://en.wikipedia.org/wiki/System_time#Operating_systems.

Thanks, great reference!

bdrodes and others added 2 commits February 17, 2026 12:35
…ification.ql

Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
…ification.ql

Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
@bdrodes
Copy link
Contributor Author

bdrodes commented Feb 17, 2026

don't know how common "years since 1980" is but I did see this on another database as well.

1980/01/01 is the start of the epoch on e.g. DOS, similar to what 1970/01/01 on Unix. See also https://en.wikipedia.org/wiki/System_time#Operating_systems.

Added to the filter set.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants