Merge pull request #8385 from erik-krogh/orderByConst

QL: add query detecting ordering by a constant

Author: MathiasVP

ql/ql/src/queries/bugs/OrderByConst.ql

@@ -0,0 +1,28 @@
+/**
+ * @name Order by const
+ * @description Ordering by a constant has no effect, and is an indication is a misplaced order by clause.
+ * @kind problem
+ * @problem.severity warning
+ * @id ql/order-by-const
+ * @tags correctness
+ *       maintainability
+ * @precision medium
+ */
+
+import ql
+
+Expr getAnOrderBy(AstNode parent, string kind) {
+  result = parent.(FullAggregate).getOrderBy(_) and
+  kind = parent.(FullAggregate).getKind() + " aggregate"
+  or
+  result = parent.(Select).getOrderBy(_) and kind = "select"
+  or
+  result = parent.(ExprAggregate).getOrderBy(_) and
+  kind = parent.(ExprAggregate).getKind() + " aggregate"
+}
+
+from Expr orderBy, AstNode parent, string kind
+where
+  orderBy = getAnOrderBy(parent, kind) and
+  orderBy instanceof Literal
+select orderBy, "Ordering $@ by a constant.", parent, kind

ql/ql/test/queries/bugs/OrderByConst/Foo.qll

@@ -0,0 +1,10 @@
+string foo() {
+  result = concat(string x | x = [0 .. 10].toString() | x order by x desc, ", ") // BAD
+  or
+  result = concat(string x | x = [0 .. 10].toString() | x, ", " order by x desc) // GOOD
+}
+
+class Even extends int {
+  bindingset[this]
+  Even() { this % 2 = 0 }
+}

ql/ql/test/queries/bugs/OrderByConst/OrderByConst.expected

@@ -0,0 +1 @@
+| Foo.qll:2:76:2:79 | String | Ordering $@ by a constant. | Foo.qll:2:12:2:80 | FullAggregate[concat] | concat aggregate |

ql/ql/test/queries/bugs/OrderByConst/OrderByConst.qlref

@@ -0,0 +1 @@
+queries/bugs/OrderByConst.ql