github / codeql

CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security
https://codeql.github.com
MIT License
7.53k stars 1.5k forks source link

Suggestion: toHex method for int #4145

Open sad-dev opened 4 years ago

sad-dev commented 4 years ago

Description of the issue

Many values are much easier to understand when converted to hexadecimal e,g, flags, bounds, enums, constants. It is probably more performant to have toHex native to codeql rather than to express it in terms of a predicate.

p0 commented 4 years ago

You're right that values that should be interpreted as bitsets are most easily read in hex (or octal, for file modes). We could certainly consider adding a built-in predicate on int (perhaps even as a string toString(int base)), though I don't expect performance to be a problem in practice compared to native QL implementations.

For the record, here are some sample implementations of toHex and fromHex:


bindingset[i]
string toHex(int i) {
  result =
    "0x" +
      strictconcat(int digit |
        digit in [0 .. 7]
      |
        "0123456789ABCDEF".charAt(i.bitShiftRight(4 * digit).bitAnd(15)) order by digit desc
      )
}

bindingset[s]
int fromHex(string s) {
  exists(string digits | s.toUpperCase() = "0X" + digits |
    result =
      sum(int i |
        |
        "0123456789ABCDEF".indexOf(digits.charAt(i)).bitShiftLeft((digits.length() - i - 1) * 4)
      )
  )
}
Marcono1234 commented 11 months ago

While there still does not seem to be a 'native' toHex predicate, there is now the module codeql.util.Numbers which is apparently shared between all languages, and contains the predicates toHex(int) and parseHexInt(string).

For example:

import codeql.util.Numbers

select toHex(255), parseHexInt("FF")

It seems this module is public supported API (at least it is publicly accessible).