Package Contracts5

[mbaluda]

Description

• ERR32-C
• ERR33-C

Change request type

• Release or process automation (GitHub workflows, internal scripts)
• Internal documentation
• External documentation
• Query files (.ql, .qll, .qls or unit tests)
• External scripts (analysis report or other code shipped as part of a release)

Rules with added or modified queries

• No rules added
• Queries have been added for the following rules:
  • ERR32-C
  • ERR33-C
• Queries have been modified for the following rules:
  • ERR30-C

Release change checklist

A change note (development_handbook.md#change-notes) is required for any pull request which modifies:

• The structure or layout of the release artifacts.
• The evaluation performance (memory, execution time) of an existing query.
• The results of an existing query in any circumstance.

If you are only adding new rule queries, a change note is not required.

Author: Is a change note required?

• Yes
• No

Reviewer: Confirm that either a change note is not required or the change note is required and has been added.

• Confirmed

Query development review checklist

For PRs that add new queries or modify existing queries, the following checklist should be completed by both the author and reviewer:

Author

• Have all the relevant rule package description files been checked in?
• Have you verified that the metadata properties of each new query is set appropriately?
• Do all the unit tests contain both "COMPLIANT" and "NON_COMPLIANT" cases?
• Are the alert messages properly formatted and consistent with the style guide?
• Have you run the queries on OpenPilot and verified that the performance and results are acceptable?
  As a rule of thumb, predicates specific to the query should take no more than 1 minute, and for simple queries be under 10 seconds. If this is not the case, this should be highlighted and agreed in the code review process.
• Does the query have an appropriate level of in-query comments/documentation?
• Have you considered/identified possible edge cases?
• Does the query not reinvent features in the standard library?
• Can the query be simplified further (not golfed!)

Reviewer

• Have all the relevant rule package description files been checked in?
• Have you verified that the metadata properties of each new query is set appropriately?
• Do all the unit tests contain both "COMPLIANT" and "NON_COMPLIANT" cases?
• Are the alert messages properly formatted and consistent with the style guide?
• Have you run the queries on OpenPilot and verified that the performance and results are acceptable?
  As a rule of thumb, predicates specific to the query should take no more than 1 minute, and for simple queries be under 10 seconds. If this is not the case, this should be highlighted and agreed in the code review process.
• Does the query have an appropriate level of in-query comments/documentation?
• Have you considered/identified possible edge cases?
• Does the query not reinvent features in the standard library?
• Can the query be simplified further (not golfed!)

[knewbury01]

Hey @mbaluda ! I've made some initial comments, will need to come back for a more deep look at implementation after you've had some thoughts on these comments :)

you always have the most "case heavy" rules it seems!

[mbaluda]

@knewbury01 I added the implementation for rule ERR32-C

[knewbury01]

ERR32-C reviewed! I was trying to be quite picky on edge cases but I am not totally sure if my testcase suggestions are realistic. otherwise looking good, these rules are very cool !

will submit a separate (re)review for ERR33-C

[mbaluda]

Rule ERR33-C was modified to improve the performance and to avoid false negatives arising when an expected error check expression is not present in the DB (see the added test)

[knewbury01]

@mbaluda both queries reviewed,
ERR33-C looks good to me !
2 minor questions on ERR32-C, but after those tiny things I think it will be good to go

[knewbury01]

I believe we have combed this PR over very thoroughly!

the only remaining note is this one but I do not see it as a requirement for this rule, and can be addressed as an enhancement if required.

good work @mbaluda :)