Fix False Positives of M5-0-12

[jeongsoolee09]

Description

Fix false positives of M5-0-12 (Closes #541).

Change request type

• Release or process automation (GitHub workflows, internal scripts)
• Internal documentation
• External documentation
• Query files (.ql, .qll, .qls or unit tests)
• External scripts (analysis report or other code shipped as part of a release)

Rules with added or modified queries

• No rules added
• Queries have been added for the following rules:
  • rule number here
• Queries have been modified for the following rules:
  • rule number here

Release change checklist

A change note (development_handbook.md#change-notes) is required for any pull request which modifies:

• The structure or layout of the release artifacts.
• The evaluation performance (memory, execution time) of an existing query.
• The results of an existing query in any circumstance.

If you are only adding new rule queries, a change note is not required.

Author: Is a change note required?

• Yes
• No

🚨🚨🚨
Reviewer: Confirm that format of shared queries (not the .qll file, the
.ql file that imports it) is valid by running them within VS Code.

• Confirmed

Reviewer: Confirm that either a change note is not required or the change note is required and has been added.

• Confirmed

Query development review checklist

For PRs that add new queries or modify existing queries, the following checklist should be completed by both the author and reviewer:

Author

• Have all the relevant rule package description files been checked in?
• Have you verified that the metadata properties of each new query is set appropriately?
• Do all the unit tests contain both "COMPLIANT" and "NON_COMPLIANT" cases?
• Are the alert messages properly formatted and consistent with the style guide?
• Have you run the queries on OpenPilot and verified that the performance and results are acceptable?
  As a rule of thumb, predicates specific to the query should take no more than 1 minute, and for simple queries be under 10 seconds. If this is not the case, this should be highlighted and agreed in the code review process.
• Does the query have an appropriate level of in-query comments/documentation?
• Have you considered/identified possible edge cases?
• Does the query not reinvent features in the standard library?
• Can the query be simplified further (not golfed!)

Reviewer

• Have all the relevant rule package description files been checked in?
• Have you verified that the metadata properties of each new query is set appropriately?
• Do all the unit tests contain both "COMPLIANT" and "NON_COMPLIANT" cases?
• Are the alert messages properly formatted and consistent with the style guide?
• Have you run the queries on OpenPilot and verified that the performance and results are acceptable?
  As a rule of thumb, predicates specific to the query should take no more than 1 minute, and for simple queries be under 10 seconds. If this is not the case, this should be highlighted and agreed in the code review process.
• Does the query have an appropriate level of in-query comments/documentation?
• Have you considered/identified possible edge cases?
• Does the query not reinvent features in the standard library?
• Can the query be simplified further (not golfed!)

[jeongsoolee09]

This query runs on openpilot-72d1744 in 17 seconds (on an M1 Max MacBook), and produces one true positive result.

[Copilot]

Pull Request Overview

This PR fixes false positives in rule M5-0-12 by improving the detection of implicit conversions from plain char to explicitly signed/unsigned char types. The fix addresses scenarios involving templates and provides more accurate reporting of where violations occur.

Key Changes:

• Complete rewrite of the query logic to handle template instantiations properly
• Enhanced test coverage with comprehensive template scenarios
• Updated expected results to reflect accurate violation detection

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
SignedCharAndUnsignedCharTypeShallOnlyBeUsedForTheStorageAndUseOfNumericValues.ql	Complete rewrite with new classes to handle template instantiations and implicit conversions
test.cpp	Extensive expansion of test cases covering templates, function calls, and various char type scenarios
SignedCharAndUnsignedCharTypeShallOnlyBeUsedForTheStorageAndUseOfNumericValues.expected	Updated expected results reflecting the improved detection logic

Comments suppressed due to low confidence (2)

cpp/autosar/test/rules/M5-0-12/test.cpp:92

• [nitpick] The variable names 'v1' and 'v2' are not descriptive. Consider using more meaningful names like 'templateVarUnsigned' and 'templateVarSigned'.

  v1<unsigned char> =

[MichaelRFairhurst]

Nice!!

[jeongsoolee09]

I have reduced the scope of this query to only deal with cases that does not involve templates, as templates are difficult topic and deserves a discussion of its own. Subsequently, both the test cases and the results are trimmed down.

[MichaelRFairhurst]

Looks great!

If you're so inclined, it could be a good idea to add tests for const types and typedefs:

typedef char char_t;
typedef unsigned char uchar_t;

const char x1 = 'a'; // compliant
const signed char x2 = x1; // non-compliant
char_t x3 = x1; // compliant
uchar_t x4 = x3; // non-compliant
// etc

It looks like the code already handles these cases correctly, since it uses getUnspecifiedType, so I don't think it should block the PR.