{"meta":{"title":"用于 CodeQL 分析的 C 和 C++ 查询","intro":"当您选择 default 或 security-extended 查询套件时，浏览 CodeQL 用于分析使用 C 或 C++ 编写的代码的查询。","product":"安全性和代码质量","breadcrumbs":[{"href":"/zh/code-security","title":"安全性和代码质量"},{"href":"/zh/code-security/reference","title":"Reference"},{"href":"/zh/code-security/reference/code-scanning","title":"代码扫描"},{"href":"/zh/code-security/reference/code-scanning/codeql","title":"CodeQL"},{"href":"/zh/code-security/reference/code-scanning/codeql/codeql-queries","title":"内置 CodeQL 查询"},{"href":"/zh/code-security/reference/code-scanning/codeql/codeql-queries/c-cpp-built-in-queries","title":"C 和C++查询"}],"documentType":"article"},"body":"# 用于 CodeQL 分析的 C 和 C++ 查询\n\n当您选择 default 或 security-extended 查询套件时，浏览 CodeQL 用于分析使用 C 或 C++ 编写的代码的查询。\n\nCodeQL 包含许多用来分析 C 或 C++ 代码的查询。 默认情况下，`default` 查询套件中的所有查询都会运行。 如果选择使用 `security-extended` 查询套件，则会运行其他查询。 有关详细信息，请参阅“[CodeQL 查询套件](/zh/code-security/code-scanning/managing-your-code-scanning-configuration/built-in-codeql-query-suites)”。\n\n## 用于 C 和 C++ 分析的内置查询\n\n下表列出了最新版本的 CodeQL 操作和 CodeQL CLI 的可用查询。 有关详细信息，请参阅 CodeQL 文档中的 [CodeQL 更改日志](https://codeql.github.com/docs/codeql-overview/codeql-changelog/)。\n\n
\n\n| 查询名称 | 相关的 CWE | 默认 | 延期 | Copilot自动修复 |\n| ----------------------------------------------------------------------------------------------------------------------------------- | --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| [对整数加法溢出的错误检查](https://codeql.github.com/codeql-query-help/cpp/cpp-bad-addition-overflow-check/) | 190、192 | | | |\n| [错误绑定的写入](https://codeql.github.com/codeql-query-help/cpp/cpp-badly-bounded-write/) | 120、787、805 | | | |\n| [可以删除对 `memset` 的调用](https://codeql.github.com/codeql-query-help/cpp/cpp-memset-may-be-deleted/) | 014 | | | |\n| [在循环内调用 alloca](https://codeql.github.com/codeql-query-help/cpp/cpp-alloca-in-loop/) | 770 | | | |\n| [以比所声明参数要少的参数调用函数](https://codeql.github.com/codeql-query-help/cpp/cpp-too-few-arguments/) | 234、685 | | | |\n| [在 HRESULT 与布尔类型之间强制转换](https://codeql.github.com/codeql-query-help/cpp/cpp-hresult-boolean-conversion/) | 253 | | | |\n| [从 char\\* 强制转换为 wchar\\_t\\*](https://codeql.github.com/codeql-query-help/cpp/cpp-incorrect-string-type-conversion/) | 704 | | | |\n| [CGI 脚本容易受到跨站脚本影响](https://codeql.github.com/codeql-query-help/cpp/cpp-cgi-xss/) | 079 | | | |\n| [文件内敏感信息的明文存储](https://codeql.github.com/codeql-query-help/cpp/cpp-cleartext-storage-file/) | 260、313 | | | |\n| [敏感信息明文传输](https://codeql.github.com/codeql-query-help/cpp/cpp-cleartext-transmission/) | 319、359 | | | |\n| [循环条件下窄类型与宽类型的比较](https://codeql.github.com/codeql-query-help/cpp/cpp-comparison-with-wider-type/) | 190、197、835 | | | |\n| [对“cin”的危险使用](https://codeql.github.com/codeql-query-help/cpp/cpp-dangerous-cin/) | 676 | | | |\n| [向未经授权的控制领域泄露系统数据](https://codeql.github.com/codeql-query-help/cpp/cpp-system-data-exposure/) | 497 | | | |\n| [未能使用 HTTPS URL](https://codeql.github.com/codeql-query-help/cpp/cpp-non-https-url/) | 319、345 | | | |\n| [使用 O\\_CREAT 标志打开，但不包含模式参数的文件](https://codeql.github.com/codeql-query-help/cpp/cpp-open-call-with-mode-argument/) | 732 | | | |\n| [“scanf”类似函数的返回值检查错误](https://codeql.github.com/codeql-query-help/cpp/cpp-incorrectly-checked-scanf/) | 253 | | | |\n| [迭代器至已过期的容器](https://codeql.github.com/codeql-query-help/cpp/cpp-iterator-to-expired-container/) | 416、664 | | | |\n| [可能出现写入溢出](https://codeql.github.com/codeql-query-help/cpp/cpp-very-likely-overrunning-write/) | 120、787、805 | | | |\n| [不匹配全新/免费或 malloc/delete](https://codeql.github.com/codeql-query-help/cpp/cpp-new-free-mismatch/) | 401 | | | |\n| [乘法结果转换为较大的类型](https://codeql.github.com/codeql-query-help/cpp/cpp-integer-multiplication-cast-to-long/) | 190、192、197、681 | | | |\n| [零终止符没有空间](https://codeql.github.com/codeql-query-help/cpp/cpp-no-space-for-terminator/) | 131、120、122 | | | |\n| [指针的溢出检查](https://codeql.github.com/codeql-query-help/cpp/cpp-pointer-overflow-check/) | 758 | | | |\n| [潜在的双重释放](https://codeql.github.com/codeql-query-help/cpp/cpp-double-free/) | 415 | | | |\n| [释放后可能使用](https://codeql.github.com/codeql-query-help/cpp/cpp-use-after-free/) | 416 | | | |\n| [对 snprintf 有可能的溢出调用](https://codeql.github.com/codeql-query-help/cpp/cpp-overflowing-snprintf/) | 190、253 | | | |\n| [对 strncat 有可能的不安全调用](https://codeql.github.com/codeql-query-help/cpp/cpp-unsafe-strncat/) | 788、676、119、251 | | | |\n| [由于之前取消引用的冗余 null 检查](https://codeql.github.com/codeql-query-help/cpp/cpp-redundant-null-check-simple/) | 476 | | | |\n| [返回堆栈分配内存](https://codeql.github.com/codeql-query-help/cpp/cpp-return-stack-allocated-memory/) | 825 | | | |\n| [在 SECURITY\\_DESCRIPTOR 中将 DACL 设置为 NULL](https://codeql.github.com/codeql-query-help/cpp/cpp-unsafe-dacl-security-descriptor/) | 732 | | | |\n| [签名的溢出检查](https://codeql.github.com/codeql-query-help/cpp/cpp-signed-overflow-check/) | 128、190 | | | |\n| [静态数组访问可能导致溢出](https://codeql.github.com/codeql-query-help/cpp/cpp-static-buffer-overflow/) | 119、131 | | | |\n| [带 sizeof 的可疑添加](https://codeql.github.com/codeql-query-help/cpp/cpp-suspicious-add-sizeof/) | 468 | | | |\n| [检查时间、使用时间文件系统争用条件](https://codeql.github.com/codeql-query-help/cpp/cpp-toctou-race-condition/) | 367 | | | |\n| [格式化函数的参数太少](https://codeql.github.com/codeql-query-help/cpp/cpp-wrong-number-format-arguments/) | 234、685 | | | |\n| [算术表达式中的不受控数据](https://codeql.github.com/codeql-query-help/cpp/cpp-uncontrolled-arithmetic/) | 190、191 | | | |\n| [SQL 查询中的未受控数据](https://codeql.github.com/codeql-query-help/cpp/cpp-sql-injection/) | 089 | | | |\n| [OS 命令中使用的不受控制数据](https://codeql.github.com/codeql-query-help/cpp/cpp-command-line-injection/) | 078、088 | | | |\n| [不受控制的格式字符串](https://codeql.github.com/codeql-query-help/cpp/cpp-tainted-format-string/) | 134 | | | |\n| [在构造函数中对此的不安全使用](https://codeql.github.com/codeql-query-help/cpp/cpp-unsafe-use-of-this/) | 670 | | | |\n| [与零相比的无符号差异表达式](https://codeql.github.com/codeql-query-help/cpp/cpp-unsigned-difference-expression-compared-zero/) | 191 | | | |\n| [指针算术中使用的向上转换数组](https://codeql.github.com/codeql-query-help/cpp/cpp-upcast-array-pointer-arithmetic/) | 119、843 | | | |\n| [使用已破解的或有风险的加密算法](https://codeql.github.com/codeql-query-help/cpp/cpp-weak-cryptographic-algorithm/) | 327 | | | |\n| [使用密钥大小不足的加密算法](https://codeql.github.com/codeql-query-help/cpp/cpp-insufficient-key-size/) | 326 | | | |\n| [将 OpenSSL 的一个版本与 Heartbleed 配合使用](https://codeql.github.com/codeql-query-help/cpp/cpp-openssl-heartbleed/) | 327、788 | | | |\n| [使用危险的函数](https://codeql.github.com/codeql-query-help/cpp/cpp-dangerous-function-overflow/) | 242、676 | | | |\n| [使用过期的堆栈地址](https://codeql.github.com/codeql-query-help/cpp/cpp-using-expired-stack-address/) | 825 | | | |\n| [在生存期结束后对字符串的使用](https://codeql.github.com/codeql-query-help/cpp/cpp-use-of-string-after-lifetime-ends/) | 416、664 | | | |\n| [在生存期结束后使用唯一指针](https://codeql.github.com/codeql-query-help/cpp/cpp-use-of-unique-pointer-after-lifetime-ends/) | 416、664 | | | |\n| [格式设置函数所用的参数类型错误](https://codeql.github.com/codeql-query-help/cpp/cpp-wrong-type-format-argument/) | 686 | | | |\n| [XML 外部实体扩展](https://codeql.github.com/codeql-query-help/cpp/cpp-external-entity-expansion/) | 611 | | | |\n| [范围检查之前使用的数组偏移量](https://codeql.github.com/codeql-query-help/cpp/cpp-offset-use-before-range-check/) | 120、125 | | | |\n| [通过欺骗来绕过身份验证](https://codeql.github.com/codeql-query-help/cpp/cpp-user-controlled-bypass/) | 290 | | | |\n| [boost::asio TLS 设置配置错误](https://codeql.github.com/codeql-query-help/cpp/cpp-boost-tls-settings-misconfiguration/) | 326 | | | |\n| [boost::asio 使用已弃用的硬编码协议](https://codeql.github.com/codeql-query-help/cpp/cpp-boost-use-of-deprecated-hardcoded-security-protocol/) | 327 | | | |\n| [调用内存访问函数可能导致缓冲区溢出](https://codeql.github.com/codeql-query-help/cpp/cpp-overflow-buffer/) | 119、121、122、126 | | | |\n| [证书未检查](https://codeql.github.com/codeql-query-help/cpp/cpp-certificate-not-checked/) | 295 | | | |\n| [证书结果合并](https://codeql.github.com/codeql-query-help/cpp/cpp-certificate-result-conflation/) | 295 | | | |\n| [SQLite 数据库中的敏感信息明文存储](https://codeql.github.com/codeql-query-help/cpp/cpp-cleartext-storage-database/) | 313 | | | |\n| [缓冲区内敏感信息的明文存储](https://codeql.github.com/codeql-query-help/cpp/cpp-cleartext-storage-buffer/) | 312 | | | |\n| [误导性缩进之前的逗号](https://codeql.github.com/codeql-query-help/cpp/cpp-comma-before-misleading-indentation/) | 1078、670 | | | |\n| [在未限制权限的情况下创建的文件](https://codeql.github.com/codeql-query-help/cpp/cpp-world-writable-file-creation/) | 732 | | | |\n| [不正确的“not”运算符使用情况](https://codeql.github.com/codeql-query-help/cpp/cpp-incorrect-not-operator-usage/) | 480 | | | |\n| [分配错误处理有误](https://codeql.github.com/codeql-query-help/cpp/cpp-incorrect-allocation-error-handling/) | 570、252、755 | | | |\n| [无效指针取消引用](https://codeql.github.com/codeql-query-help/cpp/cpp-invalid-pointer-deref/) | 119、125、193、787 | | | |\n| [“scanf”类似函数的返回值检查缺失](https://codeql.github.com/codeql-query-help/cpp/cpp-missing-check-scanf/) | 252、253 | | | |\n| [非常数格式字符串](https://codeql.github.com/codeql-query-help/cpp/cpp-non-constant-format/) | 134 | | | |\n| [指针类型数组的内存分配不足](https://codeql.github.com/codeql-query-help/cpp/cpp-suspicious-allocation-size/) | 131、122 | | | |\n| [指针类型的内存分配不足](https://codeql.github.com/codeql-query-help/cpp/cpp-allocation-too-small/) | 131、122 | | | |\n| [调用 CreateProcess 时存在未加引号路径的 NULL 应用程序名称](https://codeql.github.com/codeql-query-help/cpp/cpp-unsafe-create-process-call/) | 428 | | | |\n| [写入溢出](https://codeql.github.com/codeql-query-help/cpp/cpp-overrun-write/) | 119、131 | | | |\n| [字符串复制可能存在错误的缓冲区大小](https://codeql.github.com/codeql-query-help/cpp/cpp-bad-strncpy-size/) | 676、119、251 | | | |\n| [可能向未经授权的控制领域泄露系统数据](https://codeql.github.com/codeql-query-help/cpp/cpp-potential-system-data-exposure/) | 497 | | | |\n| [可能的溢出写入](https://codeql.github.com/codeql-query-help/cpp/cpp-overrunning-write/) | 120、787、805 | | | |\n| [使用 float 到字符串转换的可能溢出写入](https://codeql.github.com/codeql-query-help/cpp/cpp-overrunning-write-with-float/) | 120、787、805 | | | |\n| [可能未初始化的局部变量](https://codeql.github.com/codeql-query-help/cpp/cpp-uninitialized-local/) | 665、457 | | | |\n| [对 strcat 有可能的不安全使用](https://codeql.github.com/codeql-query-help/cpp/cpp-unsafe-strcat/) | 676、120、251 | | | |\n| [“sizeof”的可疑使用](https://codeql.github.com/codeql-query-help/cpp/cpp-suspicious-sizeof/) | 467 | | | |\n| [可疑的指针缩放](https://codeql.github.com/codeql-query-help/cpp/cpp-suspicious-pointer-scaling/) | 468 | | | |\n| [可疑的指针缩放到失效](https://codeql.github.com/codeql-query-help/cpp/cpp-suspicious-pointer-scaling-void/) | 468 | | | |\n| [类型混淆](https://codeql.github.com/codeql-query-help/cpp/cpp-type-confusion/) | 8:43 | | | |\n| [未绑定写入](https://codeql.github.com/codeql-query-help/cpp/cpp-unbounded-write/) | 120、787、805 | | | |\n| [不受控制的分配大小](https://codeql.github.com/codeql-query-help/cpp/cpp-uncontrolled-allocation-size/) | 190、789 | | | |\n| [路径表达式中使用的不受控数据](https://codeql.github.com/codeql-query-help/cpp/cpp-path-injection/) | 022、023、036、073 | | | |\n| [不受控流程操作](https://codeql.github.com/codeql-query-help/cpp/cpp-uncontrolled-process-operation/) | 114 | | | |\n| [未终止的可变调用](https://codeql.github.com/codeql-query-help/cpp/cpp-unterminated-variadic-call/) | 121 | | | |\n| [条件不受信任的输入](https://codeql.github.com/codeql-query-help/cpp/cpp-tainted-permissions-check/) | 807 | | | |\n| [使用具有潜在危险的函数](https://codeql.github.com/codeql-query-help/cpp/cpp-potentially-dangerous-function/) | 676 | | | |\n\n
"}