C++: Refactor of UncheckedLeapYearAfterModification

[bdrodes]

This PR addresses excessive false positive alerting from Likely Bugs/Leap Year/UncheckedLeapYearAfterYearModification.ql. In separate in-depth auditing, the number of alerts drops from 40,000 down to 2,000 with these changes, with a much higher rate of true positives, though still too high to be considered more than medium precision (~25% false positive rate remaining).

This PR is a complete refactor of the original query to address the false positives observed on production code. Some of the lessons learned here could be extrapolated into the LeapYear.qll library, but leaving changes like this for future PRs.

[Copilot]

Pull request overview

Refactors the UncheckedLeapYearAfterYearModification CodeQL query to significantly reduce false positives by introducing more precise flow/guard modeling and expanded heuristics around conversions and “ignorable” operations.

Changes:

• Reworked UncheckedLeapYearAfterYearModification.ql into a path-problem with new taint/dataflow-based modeling and multiple false-positive suppression heuristics.
• Centralized/expanded time conversion API modeling in LeapYear.qll and updated related query/tests/expected outputs accordingly.
• Extended date/time type support (e.g., TIME_FIELDS) and added release change notes.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
cpp/ql/test/query-tests/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearModification/test.cpp	Adds many new positive/negative/edge test scenarios for the refactored query.
cpp/ql/test/query-tests/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearModification/UncheckedReturnValueForTimeFunctions.expected	Updates expected results to match new line numbers/coverage.
cpp/ql/test/query-tests/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearModification/UncheckedLeapYearAfterYearModification.qlref	Switches to inline-expectations postprocessing.
cpp/ql/test/query-tests/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearModification/UncheckedLeapYearAfterYearModification.expected	Updates expected results to reflect path-problem output and new test suite.
cpp/ql/src/Likely Bugs/Leap Year/UncheckedReturnValueForTimeFunctions.ql	Refines conversion-return checking to exclude auto-leap-year-correcting APIs.
cpp/ql/src/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearModification.ql	Full refactor: new flow configurations, guard recognition, and suppression heuristics.
cpp/ql/src/Likely Bugs/Leap Year/LeapYear.qll	Moves/expands TimeConversionFunction modeling and adds auto-correcting classification.
cpp/ql/lib/semmle/code/cpp/commons/DateTime.qll	Expands recognized unpacked time/date types and adds field-access classes for TIME_FIELDS.
cpp/ql/lib/change-notes/2026-02-06-UncheckedLeapYearAfterModification_Refactor	Adds changelog entry documenting the refactor and alert reduction.

[geoffw0]

Initial review - lots of small comments, though little in particular I have strong feelings about. I'm happy to see this query get an overhaul, I'm very happy to see lots of test cases, though there is more query code than I'd like from a readability perspective. It would be nice to have some kind of diagram of how all the flows to fit together to aid understanding.

If you make whichever improvements you feel are most valuable, then I expect to approve this. I do also want to briefly check:

• performance
• real world (MRVA) result changes
• CI

[bdrodes]

Initial review - lots of small comments, though little in particular I have strong feelings about. I'm happy to see this query get an overhaul, I'm very happy to see lots of test cases, though there is more query code than I'd like from a readability perspective. It would be nice to have some kind of diagram of how all the flows to fit together to aid understanding.

If you make whichever improvements you feel are most valuable, then I expect to approve this. I do also want to briefly check:

• performance
• real world (MRVA) result changes
• CI

I think I've addressed all the comments. Are you able to run the DCA run? I'm not sure I have access to do so anymore.