Fix RULE-7-0-4 false positives for non-built-in operators

`InappropriateBitwiseOrShiftOperands.ql` reported operations that do not use
the built-in bitwise or shift operators, most notably the stream insertion and
extraction operators, e.g. `stream << value`.

Resolved calls to a user provided operator are modelled as `FunctionCall`s and
therefore never reach this query. The reported operations were instead the
syntactic `LShiftExpr`/`RShiftExpr` nodes emitted for uninstantiated template
bodies, where the operands are either unresolved (`unknown`, `auto &&`) or are
the non-dependent result of an already resolved overload, such as
`std::basic_ostream<char, std::char_traits<char>> &`.

The built-in bitwise and shift operators are only applicable to integral and
unscoped enumeration operands, so an operation with an operand of any other
type does not use them. The query now requires both operands to be of such a
type before reporting a violation.

This does not introduce false negatives for dependent operands, because the
template instantiations, in which the operand types are known, are still
reported.

Fixes #1177

Author: castler

change_notes/2026-08-20-fix-fp-rule-7-0-4-overloaded-operators.md

@@ -0,0 +1,7 @@
+- `RULE-7-0-4` - `InappropriateBitwiseOrShiftOperands.ql`:
+  - Fixes #FP - the rule no longer reports operations that do not use the built-in bitwise or shift
+    operators. The built-in operators are only applicable to integral and unscoped enumeration
+    operands, so operations with operands of any other type either call a user-provided
+    `operator`, such as the stream insertion and extraction operators, or are unresolved dependent
+    expressions in an uninstantiated template body. The latter are still reported through the
+    template instantiations, where the operand types are known.

cpp/misra/src/rules/RULE-7-0-4/InappropriateBitwiseOrShiftOperands.ql

@@ -22,6 +22,46 @@ predicate isConstantExpression(Expr e) {
   e.isConstant()
 }
 
+/**
+ * Gets the type `t` with any top-level typedefs, cv-qualifiers and reference stripped.
+ *
+ * Note that `getUnspecifiedType()` does not strip references, so the base type of a reference
+ * type has to be resolved explicitly.
+ */
+Type getStrippedOperandType(Type t) {
+  exists(Type unspecified | unspecified = t.getUnspecifiedType() |
+    if unspecified instanceof ReferenceType
+    then result = unspecified.(ReferenceType).getBaseType().getUnspecifiedType()
+    else result = unspecified
+  )
+}
+
+/**
+ * Holds if a built-in bitwise or shift operator can be applied to an operand of type `t`, i.e. `t`
+ * is an integral type or an unscoped enumeration type.
+ */
+predicate isBuiltInOperandType(Type t) {
+  exists(Type stripped | stripped = getStrippedOperandType(t) |
+    stripped instanceof IntegralType
+    or
+    stripped instanceof Enum and not stripped instanceof ScopedEnum
+  )
+}
+
+/**
+ * Holds if the operation with operands `left` and `right` uses the built-in bitwise or shift
+ * operator, rather than a user-provided overloaded operator.
+ *
+ * The built-in operators are only applicable to integral and unscoped enumeration operands. An
+ * operation with an operand of any other type either calls a user-provided `operator`, or is an
+ * unresolved dependent expression in an uninstantiated template body. The latter is reported
+ * through the template instantiations instead, where the operand types are known.
+ */
+predicate isBuiltInOperation(Expr left, Expr right) {
+  isBuiltInOperandType(left.getExplicitlyConverted().getType()) and
+  isBuiltInOperandType(right.getExplicitlyConverted().getType())
+}
+
 bindingset[right, leftType]
 pragma[inline_late]
 predicate isValidShiftConstantRange(Expr right, Type leftType) {
@@ -59,7 +99,8 @@ where
   (
     // Binary bitwise operators (excluding shift operations) - both operands must be unsigned
     exists(BinaryBitwiseOpOrAssignOp op, Type operandType |
-      not op instanceof BinaryShiftOpOrAssignOp
+      not op instanceof BinaryShiftOpOrAssignOp and
+      isBuiltInOperation(op.getLeftOperand(), op.getRightOperand())
     |
       x = op.getLeftOperand() and
       operandType = op.getLeftOperand().getExplicitlyConverted().getType() and
@@ -82,6 +123,7 @@ where
     exists(ComplementExpr comp, Type opType |
       x = comp.getOperand() and
       opType = comp.getOperand().getExplicitlyConverted().getType() and
+      isBuiltInOperandType(opType) and
       not MisraCpp23BuiltInTypes::isUnsignedType(opType) and
       message =
         "Bit complement operator '~' requires unsigned operand, but has type '" + opType + "'."
@@ -90,6 +132,7 @@ where
     // Shift operators - left operand must be unsigned
     exists(BinaryShiftOpOrAssignOp shift, Type leftType |
       x = shift.getLeftOperand() and
+      isBuiltInOperation(shift.getLeftOperand(), shift.getRightOperand()) and
       leftType = shift.getLeftOperand().getExplicitlyConverted().getType() and
       not MisraCpp23BuiltInTypes::isUnsignedType(leftType) and
       not isSignedConstantLeftShiftException(shift) and
@@ -102,6 +145,7 @@ where
     exists(BinaryShiftOpOrAssignOp shift, Expr right, Type rightType, Type leftType |
       right = shift.getRightOperand() and
       x = right and
+      isBuiltInOperation(shift.getLeftOperand(), right) and
       rightType = right.getExplicitlyConverted().getType() and
       leftType = shift.getLeftOperand().getExplicitlyConverted().getType()
     |

cpp/misra/test/rules/RULE-7-0-4/InappropriateBitwiseOrShiftOperands.expected

@@ -47,3 +47,4 @@
 | test.cpp:156:3:156:12 | 1073741824 | Shift operator '<<' requires unsigned left operand, but has type 'int'. |
 | test.cpp:162:3:162:5 | s32 | Shift operator '<<' requires unsigned left operand, but has type 'int32_t'. |
 | test.cpp:170:3:170:5 | s32 | Shift operator '>>' requires unsigned left operand, but has type 'int32_t'. |
+| test.cpp:201:3:201:7 | value | Shift operator '<<' requires unsigned left operand, but has type 'signed int'. |

cpp/misra/test/rules/RULE-7-0-4/test.cpp

@@ -168,4 +168,41 @@ void test_right_shift_signed_operands() {
 
   u32 >> 1U; // COMPLIANT
   s32 >> 1U; // NON_COMPLIANT
+}
+
+class TestStream {
+public:
+  TestStream &operator<<(std::int32_t value);
+  TestStream &operator>>(std::int32_t &value);
+};
+
+void test_overloaded_shift_operators() {
+  TestStream stream;
+  std::int32_t s32 = 1;
+
+  // User provided operators, not the built-in shift operators
+  stream << 1;   // COMPLIANT
+  stream << s32; // COMPLIANT
+  stream >> s32; // COMPLIANT
+}
+
+template <typename T>
+void test_overloaded_shift_operators_in_template(TestStream &stream,
+                                                 const T &value) {
+  // The left operand of the second `<<` is the `TestStream &` returned by the
+  // first one, and the right operand is dependent, so the operation is
+  // unresolved in the uninstantiated template body
+  stream << 1 << value; // COMPLIANT
+}
+
+template <typename T> void test_dependent_shift_operands(T value) {
+  // Dependent operands are unresolved in the uninstantiated template body, but
+  // reported through the instantiation below
+  value << 2; // NON_COMPLIANT
+}
+
+void test_template_instantiations() {
+  TestStream stream;
+  test_overloaded_shift_operators_in_template(stream, 1);
+  test_dependent_shift_operands<std::int32_t>(1);
 }