add ql/consistent-alert-message

Author: erik-krogh

ql/ql/src/queries/style/ConsistentAlertMessage.ql

@@ -0,0 +1,77 @@
+/**
+ * @name Consistent alert message
+ * @description The alert message should be consistent across languages.
+ * @kind problem
+ * @problem.severity warning
+ * @id ql/consistent-alert-message
+ * @tags correctness
+ * @precision very-high
+ */
+
+import ql
+
+/**
+ * Gets a string representation of the entire message in `sel`.
+ * Ignores everything that is not a string constant.
+ */
+string getMessage(Select sel) {
+  result =
+    strictconcat(String e, Location l |
+      // is child of an expression in the select (in an uneven position, that's where the message is)
+      e.getParent*() = sel.getExpr(any(int i | i % 2 = 1)) and l = e.getFullLocation()
+    |
+      e.getValue(), " | " order by l.getStartLine(), l.getStartColumn()
+    ).trim()
+}
+
+/**
+ * Gets a language agnostic fingerprint for a Select.
+ * The fingerPrint includes e.g. the query-id, the @kind of the query, and the number of expressions in the select.
+ *
+ * This fingerprint avoid false positives where two queries with the same ID behave differently (which is OK).
+ */
+string getSelectFingerPrint(Select sel) {
+  exists(File file, QLDoc doc |
+    sel.getLocation().getFile() = file and
+    any(TopLevel top | top.getLocation().getFile() = file).getQLDoc() = doc
+  |
+    result =
+      doc.getContents().regexpCapture("(?s).*@id (\\w+)/([\\w\\-]+)\\s.*", 2) // query ID (without lang)
+        + "-" + doc.getContents().regexpCapture("(?s).*@kind (\\w+)\\s.*", 1) // @kind
+        + "-" +
+        strictcount(String e | e.getParent*() = sel.getExpr(any(int i | i % 2 = 1))) // the number of string constants in the select
+        + "-" + count(sel.getExpr(_)) // and the total number of expressions in the select
+  )
+}
+
+/**
+ * Gets information about the select.
+ * The query-id (without language), the language, the message from the select, and a language agnostic fingerprint.
+ */
+Select parseSelect(string id, string lang, string msg, string fingerPrint) {
+  exists(File file, QLDoc doc | result.getLocation().getFile() = file |
+    any(TopLevel top | top.getLocation().getFile() = file).getQLDoc() = doc and
+    id = doc.getContents().regexpCapture("(?s).*@id (\\w+)/([\\w\\-]+)\\s.*", 2) and
+    lang = doc.getContents().regexpCapture("(?s).*@id (\\w+)/([\\w\\-]+)\\s.*", 1) and
+    fingerPrint = getSelectFingerPrint(result) and
+    msg = getMessage(result).toLowerCase() // case normalize, because some languages upper-case methods.
+  ) and
+  // excluding experimental
+  not result.getLocation().getFile().getRelativePath().matches("%/experimental/%") and
+  not lang = "ql" // excluding QL-for-QL
+}
+
+from Select sel, string id, string lang, string msg, string fingerPrint, string badLangs
+where
+  // for a select with a fingerprint
+  sel = parseSelect(id, lang, msg, fingerPrint) and
+  // there exists other languages with the same fingerprint, but other message
+  badLangs =
+    strictconcat(string bad |
+      bad != lang and
+      exists(parseSelect(id, bad, any(string otherMsg | otherMsg != msg), fingerPrint))
+    |
+      bad, ", "
+    )
+select sel,
+  "The " + lang + "/" + id + " query does not have the same alert message as " + badLangs + "."