SkiaSharp/CodeQL.yml at main · mono/SkiaSharp · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
# These file/rule exceptions require review and also apply to future findings.
# Re-review the rationale when the affected dependency or its consumers change.
# Reviewed locations and code below are evidence, not line-scoped exclusions.
# Status describes the specific file's use in supported SkiaSharp pipelines/runtime.
# Upstream or manual workflows may use files marked Unused.
queries:
  # ---------------------------------------------------------------------------
  # Used runtime code - reviewed exceptions
  # ---------------------------------------------------------------------------

  # Reviewed: externals/angle/src/libANGLE/ProgramExecutable.cpp:2995
  # Code: for (uint16_t arrayIndex = 0; arrayIndex < safeUniformCount; ++arrayIndex)
  # Status: Used
  # Built into WinUI's libEGL/libGLESv2 runtime.
  # safeUniformCount is clamped to the remaining uint16_t textureUnitsCount.
  # The loop exits before its uint16_t index can wrap; the wider comparison is bounded.
  - exclude:
      path:
        - "externals/angle/src/libANGLE/ProgramExecutable.cpp"
      opaqueid:
        - "SM01928"

  # Reviewed: externals/skia/src/core/SkDocument.cpp:48,57
  # L48: this->onEndPage();
  # L57: this->onClose(fStream);
  # Status: Used
  # Used by SKDocument PDF/XPS APIs.
  # Supported subclasses close in their destructors before base destruction.
  # The closed-state guard prevents both reported pure-virtual calls in the base.
  - exclude:
      path:
        - "externals/skia/src/core/SkDocument.cpp"
      opaqueid:
        - "SM03728"

  # Reviewed: externals/skia/third_party/externals/freetype/src/raster/ftraster.c:2524
  # Code: ras.sizeBuff = (&buffer)[1];
  # Status: Used
  # FreeType-backed font rendering includes monochrome glyphs.
  # The reported upstream expression forms a raster-pool end pointer, not a buffer read.
  # This is a vendor exception, not proof of strict-C conformance; re-review pool changes.
  - exclude:
      path:
        - "externals/skia/third_party/externals/freetype/src/raster/ftraster.c"
      opaqueid:
        - "SM01947"

  # ---------------------------------------------------------------------------
  # Unused upstream tools and tests - outside supported SkiaSharp execution
  # ---------------------------------------------------------------------------

  # Reviewed: externals/skia/infra/bots/recipes/compile.py:42
  # Code: short_name = hashlib.md5(long_name.encode('utf-8')).hexdigest()[:6]
  # Status: Unused
  # Native builds invoke GN/Ninja rather than this upstream bot recipe.
  # MD5 supplies a short builder/configuration directory name, not an integrity check.
  # Changing it changes build/cache paths and the recipe's expected output.
  - exclude:
      path:
        - "externals/skia/infra/bots/recipes/compile.py"
      opaqueid:
        - "SM02167"

  # Reviewed: externals/skia/infra/bots/zip_utils_test.py:30
  # Code: fw.write('a.txt', 0o777)
  # Status: Unused
  # Upstream infra/bots unit test; our Python workflows target other test directories.
  # Deliberately broad modes test ZIP permission preservation under a private temp root.
  # Reducing the fixture's modes would remove the behavior that the test verifies.
  - exclude:
      path:
        - "externals/skia/infra/bots/zip_utils_test.py"
      opaqueid:
        - "SM03150"

  # Reviewed: externals/skia/third_party/externals/brotli/scripts/dictionary/step-03-validate-bin.py:27,30
  # L27: hashlib.md5(data).hexdigest()
  # L30: hashlib.sha1(data).hexdigest()
  # Status: Unused
  # Upstream dictionary-maintenance script, separate from our native library target.
  # The Brotli C decoder is compiled; this Python step is not part of its GN target.
  # MD5/SHA1 are printed dictionary diagnostics alongside SHA256, not authentication.
  # Digest mismatches report diagnostics rather than granting access or trust.
  - exclude:
      path:
        - "externals/skia/third_party/externals/brotli/scripts/dictionary/step-03-validate-bin.py"
      opaqueid:
        - "SM02167"

  # Reviewed: externals/skia/third_party/externals/harfbuzz/test/fuzzing/hb_fuzzing_tools.py:308
  # Code: digest = hashlib.sha1(font_bytes).hexdigest()
  # Status: Unused
  # Upstream corpus-maintenance tool, separate from HarfBuzzSharp builds/tests.
  # Our library targets compile HarfBuzz's src sources, not test/fuzzing.
  # SHA1 is the documented fuzz-corpus seed filename, not font authentication.
  # Recorder consumers depend on the same naming convention.
  - exclude:
      path:
        - "externals/skia/third_party/externals/harfbuzz/test/fuzzing/hb_fuzzing_tools.py"
      opaqueid:
        - "SM02167"

  # Reviewed: externals/skia/third_party/externals/harfbuzz/test/shape/run-tests.py:209
  # Code: actual_hash = hashlib.sha1(ff.read()).hexdigest().strip()
  # Status: Unused
  # Upstream Python test runner, separate from our native library builds and .NET tests.
  # SHA1 identifies a system-font fixture version before comparing shaping results.
  # A mismatch skips that regression case; it does not authorize product input.
  - exclude:
      path:
        - "externals/skia/third_party/externals/harfbuzz/test/shape/run-tests.py"
      opaqueid:
        - "SM02167"

  # Reviewed: externals/skia/third_party/externals/spirv-cross/test_shaders.py:688
  # Code: md5 = hashlib.md5()
  # Status: Unused
  # Upstream regression script, separate from SkiaSharp's GN library targets.
  # Shader translation uses compiled SPIRV-Cross C++ when enabled, not this script.
  # MD5 compares newline-normalized generated shader/reflection text with test references.
  # It is regression-output equality, not authentication of an untrusted artifact.
  - exclude:
      path:
        - "externals/skia/third_party/externals/spirv-cross/test_shaders.py"
      opaqueid:
        - "SM02167"

  # Reviewed: externals/skia/tools/macsdk_dir.py:36
  # Code: return hashlib.md5(ws).hexdigest()
  # Status: Unused
  # Bazel helper, separate from SkiaSharp's GN/Xcode builds.
  # GN selects Apple SDKs through find_xcode_sysroot.py instead.
  # MD5 reproduces Bazel's workspace-cache directory format to locate SDK symlinks.
  # Replacing the algorithm would look in a different directory and break that contract.
  - exclude:
      path:
        - "externals/skia/tools/macsdk_dir.py"
      opaqueid:
        - "SM02167"

  # Reviewed: externals/skia/tools/run-wasm-gm-tests/run-wasm-gm-tests.js:175,190
  # L175: res.send(JSON.stringify(resourceListing))
  # L190: fs.writeFileSync(newFile, data, ...)
  # Status: Unused
  # Upstream CanvasKit/GM server, outside SkiaSharp's supported pipelines/runtime.
  # X-MD5-Hash identifies image results; it is not an authentication credential.
  # This unused-tool exception does not claim its HTTP routes are safe when the tool is run.
  - exclude:
      path:
        - "externals/skia/tools/run-wasm-gm-tests/run-wasm-gm-tests.js"
      opaqueid:
        - "SM02996"
        - "SM01514"