Repository navigation
cpp: Model BlazingMQ bmqa message and property taint flow - #22820
Conversation
Add flow summaries for BloombergLP::bmqa: Message payload and properties, MessageProperties getters/setters, the property iterator, and the MessageEvent -> MessageIterator -> Message chain. Scalar property getters are deliberately not modelled.
Resolved conflicts in external-models flow.expected and steps.expected by regenerating them against latest main. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
🟡 Changes recommended
Chained uses of the Message&-returning setters currently lose taint flow through the returned reference.
2 open findings
What changed in this PR
Adds C++ taint-flow summaries for the BlazingMQ bmqa message and property APIs.
Changes:
- Models payload, property, iterator, copy, and serialization flows.
- Adds comprehensive external-model tests and regenerated expectations.
- Adds a library change note.
| File | Description |
|---|---|
cpp/ql/lib/ext/bmqa.model.yml |
Defines BlazingMQ flow summaries. |
cpp/ql/test/library-tests/dataflow/external-models/bmqa.cpp |
Exercises modeled API flows. |
cpp/ql/test/library-tests/dataflow/external-models/flow.expected |
Updates generated flow expectations. |
cpp/ql/test/library-tests/dataflow/external-models/steps.expected |
Updates generated summary-step expectations. |
cpp/ql/test/library-tests/dataflow/external-models/validatemodels.expected |
Updates model-validation expectations. |
cpp/ql/test/library-tests/dataflow/taint-tests/test_mad-signatures.expected |
Updates generated signature expectations. |
cpp/ql/lib/change-notes/2026-09-09-bmqa-models.md |
Documents the analysis improvement. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
I was going to rubber-stamp this for you, but there seems to be a genuine db-check failure on |
Accept Copilot suggestions. Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
I've also accepted a couple of Copilot suggestions now, which may affect the |
|
Fixed the DBCheck error. The issue was conflicting definitions with another test file in the same directory. Unfortunately the diff is harder to read now, but I kept the commit-by-commit view fairly clean. |
|
Thanks for the reviews. |
I had Copilot create this PR, a clone of #22538 but with the merge conflicts fixed (update: and a couple of Copilot suggestions accepted). I have reviewed and am happy, I'm just looking for approval from another person.
--- Copilot said ---
Supersedes #22538 (original work by @kumarak; contributor's commit preserved), with a merge of latest
mainon top.The only conflicts were in the generated
cpp/ql/test/library-tests/dataflow/external-models/{flow,steps}.expectedfiles; these were regenerated.external-modelsandtaint-testspass.