Reviewing files that changed from the base of the PR and between f6f63a8 and 1991bb3.

• rules/c/security/return-c-str-c.yml (0 hunks)
• rules/cpp/security/return-c-str-cpp.yml (1 hunks)
• rules/cpp/security/std-return-data-cpp.yml (1 hunks)
• rules/cpp/security/std-vector-invalidation-cpp.yml (1 hunks)
• tests/__snapshots__/std-return-data-cpp-snapshot.yml (1 hunks)
• tests/__snapshots__/std-vector-invalidation-cpp-snapshot.yml (1 hunks)
• tests/cpp/std-return-data-cpp-test.yml (1 hunks)
• tests/cpp/std-vector-invalidation-cpp-test.yml (1 hunks)

• rules/c/security/return-c-str-c.yml

tests/__snapshots__/std-return-data-cpp-snapshot.yml (1)

1-7: Snapshot Definition Validity
The snapshot correctly captures the problematic pattern of returning a pointer to a local vector’s data in the function return_vector_data(). Please verify that the defined start/end positions (offsets) accurately match the intended snippet.

tests/cpp/std-return-data-cpp-test.yml (2)

1-9: Valid Scenario Test Coverage
The valid test case using the Wrapper class is well defined and correctly returns the data pointer from the member vector. This demonstrates proper usage that should not trigger the error rule.

🧰 Tools

🪛 YAMLlint (1.35.1)

[error] 8-8: trailing spaces

(trailing-spaces)

---

10-15: Invalid Scenario Test Coverage
The invalid test case—where a function returns a pointer to the data of a locally defined vector—is correctly highlighted. This scenario is expected to trigger the use-after-free rule.

tests/__snapshots__/std-vector-invalidation-cpp-snapshot.yml (1)

1-3: Snapshot for Vector Invalidation Patterns
The snapshot includes a diverse set of loop variants that expose unsafe operations (e.g., erasing an element during iteration). This robust set of examples will greatly aid in testing the new vector invalidation rule.

rules/cpp/security/return-c-str-cpp.yml (3)

1-7: Rule Metadata Clarity
The metadata—including the rule ID, language, severity, and the descriptive warning message—is clearly defined. The message uses placeholders ($FUNC and $STR) appropriately. Verify that these placeholders are substituted correctly during analysis.

---

8-14: Reference Information Provided
The note section effectively includes CWE references and documentation links, which will help developers understand the potential use-after-free risk when returning internal string pointers.

---

120-124: Constraint Definitions Verification
The constraints that restrict the allowed methods (c_str and data) and the string types are correctly formulated, reducing the chance of false positives. Please double-check the regex patterns for any edge case scenarios.

rules/cpp/security/std-return-data-cpp.yml (1)

8-13: Additional Context Provided
The note section effectively provides context regarding the CWE-416 issue and includes references for further reading. This additional context is valuable for developers addressing the warning.

rules/cpp/security/std-vector-invalidation-cpp.yml (2)

1-3: Rule Metadata is Clear and Correct

The header containing the rule ID, language, and severity follows the expected schema and naming conventions.

---

15-151: Comprehensive AST Pattern Definitions

The AST pattern definitions are thorough and cover various iterator initialization and update scenarios—including both forward and reverse iterations—while also filtering out safe cases (e.g., when a for_statement includes break, continue, return, or goto). For maintainability, you might consider adding inline comments to explain the more complex nested conditions.

tests/cpp/std-vector-invalidation-cpp-test.yml (2)

27-91: Invalid Test Cases Effectively Demonstrate Iterator Invalidation

The invalid test cases for functions loop_variant_5 through loop_variant_12 clearly illustrate unsafe iterator practices, such as:

• Not updating the iterator after calling erase (e.g., in loop_variant_5, loop_variant_6, and loop_variant_9–loop_variant_10).
• Incorrect usage of reverse iterators (e.g., in loop_variant_7, loop_variant_8, loop_variant_11, and loop_variant_12) when passed directly to erase, which expects a forward iterator.

These examples will help ensure that the static analysis rule triggers as expected. Just ensure that these snapshots remain in sync with the rule’s intent.

🧰 Tools

🪛 YAMLlint (1.35.1)

[error] 91-91: trailing spaces

(trailing-spaces)

---

92-103: Correct Cross-Container Modification Example

The function:

void f(std::vector<int> &vec, std::vector<int> &other_vec) {
  for(std::vector<int>::iterator it = vec.begin(); it != vec.end(); it++) {
    if (foo()) {
      // ruleid: std-vector-invalidation
      vec.push_back(0);

      // Modifying a different container is OK
      // ok: std-vector-invalidation
      other_vec.push_back(0);
    }
  }
}

demonstrates that modifying a different container (other_vec) while iterating over vec does not raise the vector invalidation error. This example is clear and aligns well with the rule’s intent.