Repository navigation
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
Property setter summaries currently lose taint carried by property names before iterator access.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Adds BlazingMQ bmqa taint-flow summaries for messages, payloads, properties, iterators, and events.
Changes:
- Models payload and property propagation through accessors, setters, copies, and serialization.
- Adds comprehensive external-model flow tests, including deliberate scalar no-flow cases.
- Adds a minor-analysis change note.
File summaries
| File | Description |
|---|---|
cpp/ql/lib/ext/bmqa.model.yml |
Defines BlazingMQ flow summaries. |
cpp/ql/lib/change-notes/2026-09-09-bmqa-models.md |
Documents the new models. |
cpp/ql/test/library-tests/dataflow/external-models/bmqa.cpp |
Adds model test cases. |
cpp/ql/test/library-tests/dataflow/external-models/flow.expected |
Updates expected flow results. |
cpp/ql/test/library-tests/dataflow/external-models/steps.expected |
Updates expected summary steps. |
cpp/ql/test/library-tests/dataflow/external-models/validatemodels.expected |
Updates model validation output. |
cpp/ql/test/library-tests/dataflow/taint-tests/test_mad-signatures.expected |
Updates recognized signatures. |
Review details
- Files reviewed: 7/7 changed files
- Comments generated: 1
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Add flow summaries for BloombergLP::bmqa: Message payload and properties, MessageProperties getters/setters, the property iterator, and the MessageEvent -> MessageIterator -> Message chain. Scalar property getters are deliberately not modelled.
7edbdbf to
d3a53bd
Compare
geoffw0
left a comment
geoffw0
left a comment
There was a problem hiding this comment.
LGTM, I will start CI...
|
All looks good, but there are conflicts with |
|
@copilot please could you fix the merge conflict on this pull request? |
|
@kumarak Copilot doesn't seem to be able to fix the merge conflict. Please could you merge latest |
Adds flow summaries for BlazingMQ public bmqa C++ client API, covering message payloads, properties, iterators, and message events. This allows taint from incoming messages and properties to continue through the corresponding accessors and copy operations.
Scalar property getters are deliberately not modeled, consistent with the treatment of scalar integer outputs, as documented by no-flow tests.