C++: exclude uninitialized uses inside pure expression statements

[szsam]

This eliminates FPs such as casting a variable explicitly to void type. E.g.

   (void) x;

Developers use this cast to supress compiler warnings on unused variables.

[jketema]

This will still need some tests to show that only (void) x is picked up, and not things like x and x + y. The tests can be added to https://github.com/github/codeql/tree/main/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/tests

[MathiasVP]

Suggested change

	category: majorAnalysis
	category: minorAnalysis

I don't think this warrants a majorAnalysis tag. A majorAnalysis change bumps the minor version-number, which I think is a bit too much for this change.

[szsam]

@jketema
Variables are not considered actually used in the toplevel expression of an expression statement. For example, the x in x; is not considered used. The existing uninitialized-local query does not report them.

codeql/cpp/ql/lib/semmle/code/cpp/dataflow/EscapesTree.qll

Line 359 in 139585f

not e = any(ExprInVoidContext eivc | e = eivc.getConversion*())

codeql/cpp/ql/lib/semmle/code/cpp/commons/VoidContext.qll

Lines 14 to 22 in 139585f

	/**
	* An expression that occurs in a void context, i.e. either as the toplevel expression of
	* an expression statement or on the left hand side of the comma operator.
	*
	* Expressions that are explicitly cast to void are not considered to be in void context.
	*/
	class ExprInVoidContext extends Expr {
	ExprInVoidContext() { exprInVoidContext(this) }
	}

However, as stated in the above comment,

Expressions that are explicitly cast to void are not considered to be in void context.

Thus the existing query will treat (void)x; as an uninitialized use.

[jketema]

LGTM. Thanks for your contribution!