From 3ab73c8552a3175420e85e9f8759aa0c625f8fed Mon Sep 17 00:00:00 2001
From: erik-krogh
Date: Thu, 4 Apr 2024 22:47:28 +0200
Subject: [PATCH 001/118] C++: Improve the cpp/path-injection qhelp
---
.../Security/CWE/CWE-022/TaintedPath.qhelp | 56 +++++++++++++------
.../CWE/CWE-022/{ => examples}/TaintedPath.c | 10 ----
.../CWE/CWE-022/examples/TaintedPathFolder.c | 26 +++++++++
.../CWE-022/examples/TaintedPathNormalize.c | 18 ++++++
.../Security/CWE/CWE-022/semmle/tests/test.c | 40 ++++++++++++-
5 files changed, 122 insertions(+), 28 deletions(-)
rename cpp/ql/src/Security/CWE/CWE-022/{ => examples}/TaintedPath.c (55%)
create mode 100644 cpp/ql/src/Security/CWE/CWE-022/examples/TaintedPathFolder.c
create mode 100644 cpp/ql/src/Security/CWE/CWE-022/examples/TaintedPathNormalize.c
diff --git a/cpp/ql/src/Security/CWE/CWE-022/TaintedPath.qhelp b/cpp/ql/src/Security/CWE/CWE-022/TaintedPath.qhelp
index eba2ede58f5..3b89b4a763e 100644
--- a/cpp/ql/src/Security/CWE/CWE-022/TaintedPath.qhelp
+++ b/cpp/ql/src/Security/CWE/CWE-022/TaintedPath.qhelp
@@ -3,36 +3,57 @@
"qhelp.dtd">
-Accessing paths controlled by users can allow an attacker to access unexpected resources. This
+
Accessing paths controlled by users can allow an attacker to access unexpected resources. This
can result in sensitive information being revealed or deleted, or an attacker being able to influence
behavior by modifying unexpected files.
-Paths that are naively constructed from data controlled by a user may contain unexpected special characters,
-such as "..". Such a path may potentially point to any directory on the filesystem.
+Paths that are naively constructed from data controlled by a user may be absolute paths, or may contain
+unexpected special characters such as "..". Such a path could point anywhere on the file system.
-Validate user input before using it to construct a filepath. Ideally, follow these rules:
+Validate user input before using it to construct a file path.
-
-- Do not allow more than a single "." character.
-- Do not allow directory separators such as "/" or "\" (depending on the filesystem).
-- Do not rely on simply replacing problematic sequences such as "../". For example, after applying this filter to
-".../...//" the resulting string would still be "../".
-- Ideally use a whitelist of known good patterns.
-
+Common validation methods include checking that the normalized path is relative and does not contain
+any ".." components, or checking that the path is contained within a safe folder. The method you should use depends
+on how the path is used in the application, and whether the path should be a single path component.
+
+
+If the path should be a single path component (such as a file name), you can check for the existence
+of any path separators ("/" or "\"), or ".." sequences in the input, and reject the input if any are found.
+
+
+
+Note that removing "../" sequences is not sufficient, since the input could still contain a path separator
+followed by "..". For example, the input ".../...//" would still result in the string "../" if only "../" sequences
+are removed.
+
+
+Finally, the simplest (but most restrictive) option is to use an allow list of safe patterns and make sure that
+the user input matches one of these patterns.
-In this example, a username and file are read from the arguments to main and then used to access a file in the
-user's home directory. However, a malicious user could enter a filename which contains special
-characters. For example, the string "../../etc/passwd" will result in the code reading the file located at
-"/home/[user]/../../etc/passwd", which is the system's password file. This could potentially allow them to
-access all the system's passwords.
+In this example, a file name is read from a user and then used to access a file.
+However, a malicious user could enter a file name anywhere on the file system,
+such as "/etc/passwd" or "../../../etc/passwd".
-
+
+
+
+If the input should only be a file name, you can check that it doesn't contain any path separators or ".." sequences.
+
+
+
+
+
+If the input should be within a specific directory, you can check that the resolved path
+is still contained within that directory.
+
+
+
@@ -41,6 +62,7 @@ access all the system's passwords.
OWASP:
Path Traversal.
+Rails: ActiveStorage::Filename#sanitized.
diff --git a/cpp/ql/src/Security/CWE/CWE-022/TaintedPath.c b/cpp/ql/src/Security/CWE/CWE-022/examples/TaintedPath.c
similarity index 55%
rename from cpp/ql/src/Security/CWE/CWE-022/TaintedPath.c
rename to cpp/ql/src/Security/CWE/CWE-022/examples/TaintedPath.c
index 63856888ebb..fe0f466713a 100644
--- a/cpp/ql/src/Security/CWE/CWE-022/TaintedPath.c
+++ b/cpp/ql/src/Security/CWE/CWE-022/examples/TaintedPath.c
@@ -9,14 +9,4 @@ int main(int argc, char** argv) {
// BAD: a string from the user is used in a filename
fopen(fileName, "wb+");
}
-
- {
- char fileBuffer[FILENAME_MAX] = "/home/";
- char *fileName = fileBuffer;
- size_t len = strlen(fileName);
- // GOOD: use a fixed file
- char* fixed = "jim/file.txt";
- strncat(fileName+len, fixed, FILENAME_MAX-len-1);
- fopen(fileName, "wb+");
- }
}
diff --git a/cpp/ql/src/Security/CWE/CWE-022/examples/TaintedPathFolder.c b/cpp/ql/src/Security/CWE/CWE-022/examples/TaintedPathFolder.c
new file mode 100644
index 00000000000..1461616f5dc
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-022/examples/TaintedPathFolder.c
@@ -0,0 +1,26 @@
+#include
+#include
+
+int main(int argc, char** argv) {
+ char *userAndFile = argv[2];
+ char baseDir[PATH_MAX] = "/home/user/public/";
+ char fullPath[PATH_MAX];
+ char resolvedPath[PATH_MAX];
+
+ // Attempt to concatenate the base directory and the user-supplied path
+ snprintf(fullPath, sizeof(fullPath), "%s%s", baseDir, userAndFile);
+
+ // Resolve the absolute path, normalizing any ".." or "."
+ if (realpath(fullPath, resolvedPath) == NULL) {
+ perror("Error resolving path");
+ return 1;
+ }
+
+ // Check if the resolved path starts with the base directory
+ if (strncmp(baseDir, resolvedPath, strlen(baseDir)) != 0) {
+ return 1;
+ }
+
+ // GOOD: Path is within the intended directory
+ FILE *file = fopen(resolvedPath, "wb+");
+}
\ No newline at end of file
diff --git a/cpp/ql/src/Security/CWE/CWE-022/examples/TaintedPathNormalize.c b/cpp/ql/src/Security/CWE/CWE-022/examples/TaintedPathNormalize.c
new file mode 100644
index 00000000000..f46e6d30a41
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-022/examples/TaintedPathNormalize.c
@@ -0,0 +1,18 @@
+#include
+#include
+
+int main(int argc, char** argv) {
+
+ char *userAndFile = argv[2];
+ // Check for invalid sequences in the user input
+ if (strstr(userAndFile, "..") || strchr(userAndFile, '/') || strchr(userAndFile, '\\')) {
+ printf("Invalid filename.\n");
+ return 1;
+ }
+
+ char fileBuffer[FILENAME_MAX] = "/home/user/files/";
+ // Ensure buffer overflow is prevented
+ strncat(fileBuffer, userAndFile, FILENAME_MAX - strlen(fileBuffer) - 1);
+ // GOOD: We know that the filename is safe and stays within the public folder
+ FILE *file = fopen(fileBuffer, "wb+");
+}
\ No newline at end of file
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-022/semmle/tests/test.c b/cpp/ql/test/query-tests/Security/CWE/CWE-022/semmle/tests/test.c
index 824db8f16ad..b01107ef090 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-022/semmle/tests/test.c
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-022/semmle/tests/test.c
@@ -2,7 +2,7 @@
// Associated with CWE-022: Improper Limitation of a Pathname to a Restricted Directory. http://cwe.mitre.org/data/definitions/22.html
#include "stdlib.h"
-
+#define PATH_MAX 4096
///// Test code /////
int main(int argc, char** argv) {
@@ -56,6 +56,44 @@ int main(int argc, char** argv) {
void read(const char *fileName);
read(argv[1]); // BAD
}
+
+ {
+ char *userAndFile = argv[2];
+ // Check for invalid sequences in the user input
+ if (strstr(userAndFile, "..") || strchr(userAndFile, '/') || strchr(userAndFile, '\\')) {
+ // printf("Invalid filename.\n");
+ return 1;
+ }
+
+ char fileBuffer[FILENAME_MAX] = "/home/user/files/";
+ // Ensure buffer overflow is prevented
+ strncat(fileBuffer, userAndFile, FILENAME_MAX - strlen(fileBuffer) - 1);
+ // GOOD: We know that the filename is safe and stays within the public folder. But we currently get an FP here.
+ FILE *file = fopen(fileBuffer, "wb+");
+ }
+
+ {
+ char *userAndFile = argv[2];
+ char baseDir[PATH_MAX] = "/home/user/public/";
+ char fullPath[PATH_MAX];
+ char resolvedPath[PATH_MAX];
+
+ // Attempt to concatenate the base directory and the user-supplied path
+ snprintf(fullPath, sizeof(fullPath), "%s%s", baseDir, userAndFile);
+
+ // Resolve the absolute path, normalizing any ".." or "."
+ if (realpath(fullPath, resolvedPath) == 0) {
+ return 1;
+ }
+
+ // Check if the resolved path starts with the base directory
+ if (strncmp(baseDir, resolvedPath, strlen(baseDir)) != 0) {
+ return 1;
+ }
+
+ // GOOD: Path is within the intended directory
+ FILE *file = fopen(resolvedPath, "wb+");
+ }
}
void read(char *fileName) {
From 6d3244d01c0598d1c5af2993d9951bfaf08f3727 Mon Sep 17 00:00:00 2001
From: erik-krogh
Date: Fri, 5 Apr 2024 09:36:09 +0200
Subject: [PATCH 002/118] update expected outputs with an FP
---
.../Security/CWE/CWE-022/semmle/tests/TaintedPath.expected | 3 +++
1 file changed, 3 insertions(+)
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-022/semmle/tests/TaintedPath.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-022/semmle/tests/TaintedPath.expected
index 3b34718d954..2d8f0863f40 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-022/semmle/tests/TaintedPath.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-022/semmle/tests/TaintedPath.expected
@@ -2,6 +2,7 @@ edges
| test.c:8:27:8:30 | **argv | test.c:17:11:17:18 | *fileName | provenance | |
| test.c:8:27:8:30 | **argv | test.c:32:11:32:18 | *fileName | provenance | |
| test.c:8:27:8:30 | **argv | test.c:57:10:57:16 | *access to array | provenance | |
+| test.c:8:27:8:30 | **argv | test.c:72:24:72:33 | *fileBuffer | provenance | |
| test.c:37:17:37:24 | scanf output argument | test.c:38:11:38:18 | *fileName | provenance | |
| test.c:43:17:43:24 | scanf output argument | test.c:44:11:44:18 | *fileName | provenance | |
nodes
@@ -13,6 +14,7 @@ nodes
| test.c:43:17:43:24 | scanf output argument | semmle.label | scanf output argument |
| test.c:44:11:44:18 | *fileName | semmle.label | *fileName |
| test.c:57:10:57:16 | *access to array | semmle.label | *access to array |
+| test.c:72:24:72:33 | *fileBuffer | semmle.label | *fileBuffer |
subpaths
#select
| test.c:17:11:17:18 | fileName | test.c:8:27:8:30 | **argv | test.c:17:11:17:18 | *fileName | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:8:27:8:30 | **argv | user input (a command-line argument) |
@@ -20,3 +22,4 @@ subpaths
| test.c:38:11:38:18 | fileName | test.c:37:17:37:24 | scanf output argument | test.c:38:11:38:18 | *fileName | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:37:17:37:24 | scanf output argument | user input (value read by scanf) |
| test.c:44:11:44:18 | fileName | test.c:43:17:43:24 | scanf output argument | test.c:44:11:44:18 | *fileName | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:43:17:43:24 | scanf output argument | user input (value read by scanf) |
| test.c:57:10:57:16 | access to array | test.c:8:27:8:30 | **argv | test.c:57:10:57:16 | *access to array | This argument to a file access function is derived from $@ and then passed to read(fileName), which calls fopen(filename). | test.c:8:27:8:30 | **argv | user input (a command-line argument) |
+| test.c:72:24:72:33 | fileBuffer | test.c:8:27:8:30 | **argv | test.c:72:24:72:33 | *fileBuffer | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:8:27:8:30 | **argv | user input (a command-line argument) |
From 393f6b76664ee13517cd9c9cee918867f3432d1b Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Wed, 24 Apr 2024 17:04:57 +0200
Subject: [PATCH 003/118] Go: add gazelle-generated `BUILD` files
---
.pre-commit-config.yaml | 7 +++++
MODULE.bazel | 7 +++++
go/extractor/.gitattributes | 1 +
go/extractor/BUILD.bazel | 23 ++++++++++++++++
go/extractor/autobuilder/BUILD.bazel | 24 +++++++++++++++++
go/extractor/cli/go-autobuilder/BUILD.bazel | 22 +++++++++++++++
go/extractor/cli/go-bootstrap/BUILD.bazel | 14 ++++++++++
go/extractor/cli/go-build-runner/BUILD.bazel | 18 +++++++++++++
go/extractor/cli/go-extractor/BUILD.bazel | 18 +++++++++++++
go/extractor/cli/go-gen-dbscheme/BUILD.bazel | 15 +++++++++++
go/extractor/cli/go-tokenizer/BUILD.bazel | 14 ++++++++++
go/extractor/dbscheme/BUILD.bazel | 15 +++++++++++
go/extractor/diagnostics/BUILD.bazel | 8 ++++++
go/extractor/project/BUILD.bazel | 21 +++++++++++++++
go/extractor/srcarchive/BUILD.bazel | 17 ++++++++++++
go/extractor/toolchain/BUILD.bazel | 18 +++++++++++++
go/extractor/trap/BUILD.bazel | 23 ++++++++++++++++
go/extractor/util/BUILD.bazel | 14 ++++++++++
.../x/mod/internal/lazyregexp/BUILD.bazel | 9 +++++++
.../golang.org/x/mod/modfile/BUILD.bazel | 19 +++++++++++++
.../golang.org/x/mod/module/BUILD.bazel | 16 +++++++++++
.../golang.org/x/mod/semver/BUILD.bazel | 9 +++++++
.../x/tools/go/gcexportdata/BUILD.bazel | 13 +++++++++
.../go/internal/packagesdriver/BUILD.bazel | 10 +++++++
.../x/tools/go/packages/BUILD.bazel | 25 +++++++++++++++++
.../x/tools/go/types/objectpath/BUILD.bazel | 10 +++++++
.../x/tools/internal/event/BUILD.bazel | 17 ++++++++++++
.../x/tools/internal/event/core/BUILD.bazel | 17 ++++++++++++
.../x/tools/internal/event/keys/BUILD.bazel | 14 ++++++++++
.../x/tools/internal/event/label/BUILD.bazel | 9 +++++++
.../x/tools/internal/event/tag/BUILD.bazel | 10 +++++++
.../x/tools/internal/gcimporter/BUILD.bazel | 27 +++++++++++++++++++
.../x/tools/internal/gocommand/BUILD.bazel | 20 ++++++++++++++
.../internal/packagesinternal/BUILD.bazel | 9 +++++++
.../x/tools/internal/pkgbits/BUILD.bazel | 21 +++++++++++++++
.../tools/internal/tokeninternal/BUILD.bazel | 9 +++++++
.../x/tools/internal/typeparams/BUILD.bazel | 15 +++++++++++
.../tools/internal/typesinternal/BUILD.bazel | 14 ++++++++++
.../x/tools/internal/versions/BUILD.bazel | 15 +++++++++++
go/gazelle/BUILD.bazel | 8 ++++++
go/rules.bzl | 0
41 files changed, 595 insertions(+)
create mode 100644 go/extractor/.gitattributes
create mode 100644 go/extractor/BUILD.bazel
create mode 100644 go/extractor/autobuilder/BUILD.bazel
create mode 100644 go/extractor/cli/go-autobuilder/BUILD.bazel
create mode 100644 go/extractor/cli/go-bootstrap/BUILD.bazel
create mode 100644 go/extractor/cli/go-build-runner/BUILD.bazel
create mode 100644 go/extractor/cli/go-extractor/BUILD.bazel
create mode 100644 go/extractor/cli/go-gen-dbscheme/BUILD.bazel
create mode 100644 go/extractor/cli/go-tokenizer/BUILD.bazel
create mode 100644 go/extractor/dbscheme/BUILD.bazel
create mode 100644 go/extractor/diagnostics/BUILD.bazel
create mode 100644 go/extractor/project/BUILD.bazel
create mode 100644 go/extractor/srcarchive/BUILD.bazel
create mode 100644 go/extractor/toolchain/BUILD.bazel
create mode 100644 go/extractor/trap/BUILD.bazel
create mode 100644 go/extractor/util/BUILD.bazel
create mode 100644 go/extractor/vendor/golang.org/x/mod/internal/lazyregexp/BUILD.bazel
create mode 100644 go/extractor/vendor/golang.org/x/mod/modfile/BUILD.bazel
create mode 100644 go/extractor/vendor/golang.org/x/mod/module/BUILD.bazel
create mode 100644 go/extractor/vendor/golang.org/x/mod/semver/BUILD.bazel
create mode 100644 go/extractor/vendor/golang.org/x/tools/go/gcexportdata/BUILD.bazel
create mode 100644 go/extractor/vendor/golang.org/x/tools/go/internal/packagesdriver/BUILD.bazel
create mode 100644 go/extractor/vendor/golang.org/x/tools/go/packages/BUILD.bazel
create mode 100644 go/extractor/vendor/golang.org/x/tools/go/types/objectpath/BUILD.bazel
create mode 100644 go/extractor/vendor/golang.org/x/tools/internal/event/BUILD.bazel
create mode 100644 go/extractor/vendor/golang.org/x/tools/internal/event/core/BUILD.bazel
create mode 100644 go/extractor/vendor/golang.org/x/tools/internal/event/keys/BUILD.bazel
create mode 100644 go/extractor/vendor/golang.org/x/tools/internal/event/label/BUILD.bazel
create mode 100644 go/extractor/vendor/golang.org/x/tools/internal/event/tag/BUILD.bazel
create mode 100644 go/extractor/vendor/golang.org/x/tools/internal/gcimporter/BUILD.bazel
create mode 100644 go/extractor/vendor/golang.org/x/tools/internal/gocommand/BUILD.bazel
create mode 100644 go/extractor/vendor/golang.org/x/tools/internal/packagesinternal/BUILD.bazel
create mode 100644 go/extractor/vendor/golang.org/x/tools/internal/pkgbits/BUILD.bazel
create mode 100644 go/extractor/vendor/golang.org/x/tools/internal/tokeninternal/BUILD.bazel
create mode 100644 go/extractor/vendor/golang.org/x/tools/internal/typeparams/BUILD.bazel
create mode 100644 go/extractor/vendor/golang.org/x/tools/internal/typesinternal/BUILD.bazel
create mode 100644 go/extractor/vendor/golang.org/x/tools/internal/versions/BUILD.bazel
create mode 100644 go/gazelle/BUILD.bazel
create mode 100644 go/rules.bzl
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 383bc110383..4e81bcc7711 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -27,6 +27,13 @@ repos:
- repo: local
hooks:
+ - id: gazelle
+ name: Check gazelle-generated BUILD files
+ files: go/extractor/.*
+ language: system
+ entry: bazel run //go/gazelle
+ pass_filenames: false
+
- id: codeql-format
name: Fix QL file formatting
files: \.qll?$
diff --git a/MODULE.bazel b/MODULE.bazel
index 4e1fe0d9f7c..2dc9dd0a7bb 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -14,6 +14,7 @@ local_path_override(
# see https://registry.bazel.build/ for a list of available packages
bazel_dep(name = "platforms", version = "0.0.8")
+bazel_dep(name = "rules_go", version = "0.47.0")
bazel_dep(name = "rules_pkg", version = "0.10.1")
bazel_dep(name = "rules_nodejs", version = "6.0.3")
bazel_dep(name = "rules_python", version = "0.31.0")
@@ -22,6 +23,8 @@ bazel_dep(name = "abseil-cpp", version = "20240116.0", repo_name = "absl")
bazel_dep(name = "nlohmann_json", version = "3.11.3", repo_name = "json")
bazel_dep(name = "fmt", version = "10.0.0")
+bazel_dep(name = "gazelle", version = "0.36.0", dev_dependency = True)
+
pip = use_extension("@rules_python//python/extensions:pip.bzl", "pip")
pip.parse(
hub_name = "codegen_deps",
@@ -50,6 +53,10 @@ node.toolchain(
)
use_repo(node, "nodejs", "nodejs_toolchains")
+go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")
+go_sdk.download(version = "1.22.2")
+go_sdk.host()
+
register_toolchains(
"@nodejs_toolchains//:all",
)
diff --git a/go/extractor/.gitattributes b/go/extractor/.gitattributes
new file mode 100644
index 00000000000..e406d413677
--- /dev/null
+++ b/go/extractor/.gitattributes
@@ -0,0 +1 @@
+/*/**/BUILD.bazel linguist-generated=true
diff --git a/go/extractor/BUILD.bazel b/go/extractor/BUILD.bazel
new file mode 100644
index 00000000000..ea99340e7d7
--- /dev/null
+++ b/go/extractor/BUILD.bazel
@@ -0,0 +1,23 @@
+load("@rules_go//go:def.bzl", "go_library")
+
+# gazelle:prefix github.com/github/codeql-go/extractor
+
+go_library(
+ name = "extractor",
+ srcs = [
+ "extractor.go",
+ "gomodextractor.go",
+ "semaphore.go",
+ ],
+ importpath = "github.com/github/codeql-go/extractor",
+ visibility = ["//visibility:public"],
+ deps = [
+ "//go/extractor/dbscheme",
+ "//go/extractor/diagnostics",
+ "//go/extractor/srcarchive",
+ "//go/extractor/trap",
+ "//go/extractor/util",
+ "//go/extractor/vendor/golang.org/x/mod/modfile",
+ "//go/extractor/vendor/golang.org/x/tools/go/packages",
+ ],
+)
diff --git a/go/extractor/autobuilder/BUILD.bazel b/go/extractor/autobuilder/BUILD.bazel
new file mode 100644
index 00000000000..b81b15816aa
--- /dev/null
+++ b/go/extractor/autobuilder/BUILD.bazel
@@ -0,0 +1,24 @@
+load("@rules_go//go:def.bzl", "go_library", "go_test")
+
+go_library(
+ name = "autobuilder",
+ srcs = [
+ "autobuilder.go",
+ "build-environment.go",
+ ],
+ importpath = "github.com/github/codeql-go/extractor/autobuilder",
+ visibility = ["//visibility:public"],
+ deps = [
+ "//go/extractor/diagnostics",
+ "//go/extractor/project",
+ "//go/extractor/toolchain",
+ "//go/extractor/util",
+ "//go/extractor/vendor/golang.org/x/mod/semver",
+ ],
+)
+
+go_test(
+ name = "autobuilder_test",
+ srcs = ["build-environment_test.go"],
+ embed = [":autobuilder"],
+)
diff --git a/go/extractor/cli/go-autobuilder/BUILD.bazel b/go/extractor/cli/go-autobuilder/BUILD.bazel
new file mode 100644
index 00000000000..b53227b9f1b
--- /dev/null
+++ b/go/extractor/cli/go-autobuilder/BUILD.bazel
@@ -0,0 +1,22 @@
+load("@rules_go//go:def.bzl", "go_binary", "go_library")
+
+go_library(
+ name = "go-autobuilder_lib",
+ srcs = ["go-autobuilder.go"],
+ importpath = "github.com/github/codeql-go/extractor/cli/go-autobuilder",
+ visibility = ["//visibility:private"],
+ deps = [
+ "//go/extractor/autobuilder",
+ "//go/extractor/diagnostics",
+ "//go/extractor/project",
+ "//go/extractor/toolchain",
+ "//go/extractor/util",
+ "//go/extractor/vendor/golang.org/x/mod/semver",
+ ],
+)
+
+go_binary(
+ name = "go-autobuilder",
+ embed = [":go-autobuilder_lib"],
+ visibility = ["//visibility:public"],
+)
diff --git a/go/extractor/cli/go-bootstrap/BUILD.bazel b/go/extractor/cli/go-bootstrap/BUILD.bazel
new file mode 100644
index 00000000000..15255227f9a
--- /dev/null
+++ b/go/extractor/cli/go-bootstrap/BUILD.bazel
@@ -0,0 +1,14 @@
+load("@rules_go//go:def.bzl", "go_binary", "go_library")
+
+go_library(
+ name = "go-bootstrap_lib",
+ srcs = ["go-bootstrap.go"],
+ importpath = "github.com/github/codeql-go/extractor/cli/go-bootstrap",
+ visibility = ["//visibility:private"],
+)
+
+go_binary(
+ name = "go-bootstrap",
+ embed = [":go-bootstrap_lib"],
+ visibility = ["//visibility:public"],
+)
diff --git a/go/extractor/cli/go-build-runner/BUILD.bazel b/go/extractor/cli/go-build-runner/BUILD.bazel
new file mode 100644
index 00000000000..fc407c3e172
--- /dev/null
+++ b/go/extractor/cli/go-build-runner/BUILD.bazel
@@ -0,0 +1,18 @@
+load("@rules_go//go:def.bzl", "go_binary", "go_library")
+
+go_library(
+ name = "go-build-runner_lib",
+ srcs = ["go-build-runner.go"],
+ importpath = "github.com/github/codeql-go/extractor/cli/go-build-runner",
+ visibility = ["//visibility:private"],
+ deps = [
+ "//go/extractor/autobuilder",
+ "//go/extractor/util",
+ ],
+)
+
+go_binary(
+ name = "go-build-runner",
+ embed = [":go-build-runner_lib"],
+ visibility = ["//visibility:public"],
+)
diff --git a/go/extractor/cli/go-extractor/BUILD.bazel b/go/extractor/cli/go-extractor/BUILD.bazel
new file mode 100644
index 00000000000..9419c6f8ba9
--- /dev/null
+++ b/go/extractor/cli/go-extractor/BUILD.bazel
@@ -0,0 +1,18 @@
+load("@rules_go//go:def.bzl", "go_binary", "go_library")
+
+go_library(
+ name = "go-extractor_lib",
+ srcs = ["go-extractor.go"],
+ importpath = "github.com/github/codeql-go/extractor/cli/go-extractor",
+ visibility = ["//visibility:private"],
+ deps = [
+ "//go/extractor",
+ "//go/extractor/diagnostics",
+ ],
+)
+
+go_binary(
+ name = "go-extractor",
+ embed = [":go-extractor_lib"],
+ visibility = ["//visibility:public"],
+)
diff --git a/go/extractor/cli/go-gen-dbscheme/BUILD.bazel b/go/extractor/cli/go-gen-dbscheme/BUILD.bazel
new file mode 100644
index 00000000000..1fbd75998c2
--- /dev/null
+++ b/go/extractor/cli/go-gen-dbscheme/BUILD.bazel
@@ -0,0 +1,15 @@
+load("@rules_go//go:def.bzl", "go_binary", "go_library")
+
+go_library(
+ name = "go-gen-dbscheme_lib",
+ srcs = ["go-gen-dbscheme.go"],
+ importpath = "github.com/github/codeql-go/extractor/cli/go-gen-dbscheme",
+ visibility = ["//visibility:private"],
+ deps = ["//go/extractor/dbscheme"],
+)
+
+go_binary(
+ name = "go-gen-dbscheme",
+ embed = [":go-gen-dbscheme_lib"],
+ visibility = ["//visibility:public"],
+)
diff --git a/go/extractor/cli/go-tokenizer/BUILD.bazel b/go/extractor/cli/go-tokenizer/BUILD.bazel
new file mode 100644
index 00000000000..f55baecc69f
--- /dev/null
+++ b/go/extractor/cli/go-tokenizer/BUILD.bazel
@@ -0,0 +1,14 @@
+load("@rules_go//go:def.bzl", "go_binary", "go_library")
+
+go_library(
+ name = "go-tokenizer_lib",
+ srcs = ["go-tokenizer.go"],
+ importpath = "github.com/github/codeql-go/extractor/cli/go-tokenizer",
+ visibility = ["//visibility:private"],
+)
+
+go_binary(
+ name = "go-tokenizer",
+ embed = [":go-tokenizer_lib"],
+ visibility = ["//visibility:public"],
+)
diff --git a/go/extractor/dbscheme/BUILD.bazel b/go/extractor/dbscheme/BUILD.bazel
new file mode 100644
index 00000000000..efaf51684d7
--- /dev/null
+++ b/go/extractor/dbscheme/BUILD.bazel
@@ -0,0 +1,15 @@
+load("@rules_go//go:def.bzl", "go_library")
+
+go_library(
+ name = "dbscheme",
+ srcs = [
+ "dbscheme.go",
+ "tables.go",
+ ],
+ importpath = "github.com/github/codeql-go/extractor/dbscheme",
+ visibility = ["//visibility:public"],
+ deps = [
+ "//go/extractor/trap",
+ "//go/extractor/vendor/golang.org/x/tools/go/packages",
+ ],
+)
diff --git a/go/extractor/diagnostics/BUILD.bazel b/go/extractor/diagnostics/BUILD.bazel
new file mode 100644
index 00000000000..8b218dc1317
--- /dev/null
+++ b/go/extractor/diagnostics/BUILD.bazel
@@ -0,0 +1,8 @@
+load("@rules_go//go:def.bzl", "go_library")
+
+go_library(
+ name = "diagnostics",
+ srcs = ["diagnostics.go"],
+ importpath = "github.com/github/codeql-go/extractor/diagnostics",
+ visibility = ["//visibility:public"],
+)
diff --git a/go/extractor/project/BUILD.bazel b/go/extractor/project/BUILD.bazel
new file mode 100644
index 00000000000..dd49b3b320f
--- /dev/null
+++ b/go/extractor/project/BUILD.bazel
@@ -0,0 +1,21 @@
+load("@rules_go//go:def.bzl", "go_library", "go_test")
+
+go_library(
+ name = "project",
+ srcs = ["project.go"],
+ importpath = "github.com/github/codeql-go/extractor/project",
+ visibility = ["//visibility:public"],
+ deps = [
+ "//go/extractor/diagnostics",
+ "//go/extractor/toolchain",
+ "//go/extractor/util",
+ "//go/extractor/vendor/golang.org/x/mod/modfile",
+ "//go/extractor/vendor/golang.org/x/mod/semver",
+ ],
+)
+
+go_test(
+ name = "project_test",
+ srcs = ["project_test.go"],
+ embed = [":project"],
+)
diff --git a/go/extractor/srcarchive/BUILD.bazel b/go/extractor/srcarchive/BUILD.bazel
new file mode 100644
index 00000000000..90664c90190
--- /dev/null
+++ b/go/extractor/srcarchive/BUILD.bazel
@@ -0,0 +1,17 @@
+load("@rules_go//go:def.bzl", "go_library", "go_test")
+
+go_library(
+ name = "srcarchive",
+ srcs = [
+ "projectlayout.go",
+ "srcarchive.go",
+ ],
+ importpath = "github.com/github/codeql-go/extractor/srcarchive",
+ visibility = ["//visibility:public"],
+)
+
+go_test(
+ name = "srcarchive_test",
+ srcs = ["projectlayout_test.go"],
+ embed = [":srcarchive"],
+)
diff --git a/go/extractor/toolchain/BUILD.bazel b/go/extractor/toolchain/BUILD.bazel
new file mode 100644
index 00000000000..d1ce09c2632
--- /dev/null
+++ b/go/extractor/toolchain/BUILD.bazel
@@ -0,0 +1,18 @@
+load("@rules_go//go:def.bzl", "go_library", "go_test")
+
+go_library(
+ name = "toolchain",
+ srcs = ["toolchain.go"],
+ importpath = "github.com/github/codeql-go/extractor/toolchain",
+ visibility = ["//visibility:public"],
+ deps = [
+ "//go/extractor/util",
+ "//go/extractor/vendor/golang.org/x/mod/semver",
+ ],
+)
+
+go_test(
+ name = "toolchain_test",
+ srcs = ["toolchain_test.go"],
+ embed = [":toolchain"],
+)
diff --git a/go/extractor/trap/BUILD.bazel b/go/extractor/trap/BUILD.bazel
new file mode 100644
index 00000000000..6c3f67b3247
--- /dev/null
+++ b/go/extractor/trap/BUILD.bazel
@@ -0,0 +1,23 @@
+load("@rules_go//go:def.bzl", "go_library", "go_test")
+
+go_library(
+ name = "trap",
+ srcs = [
+ "labels.go",
+ "trapwriter.go",
+ "util.go",
+ ],
+ importpath = "github.com/github/codeql-go/extractor/trap",
+ visibility = ["//visibility:public"],
+ deps = [
+ "//go/extractor/srcarchive",
+ "//go/extractor/util",
+ "//go/extractor/vendor/golang.org/x/tools/go/packages",
+ ],
+)
+
+go_test(
+ name = "trap_test",
+ srcs = ["trapwriter_test.go"],
+ embed = [":trap"],
+)
diff --git a/go/extractor/util/BUILD.bazel b/go/extractor/util/BUILD.bazel
new file mode 100644
index 00000000000..787a627b5bc
--- /dev/null
+++ b/go/extractor/util/BUILD.bazel
@@ -0,0 +1,14 @@
+load("@rules_go//go:def.bzl", "go_library", "go_test")
+
+go_library(
+ name = "util",
+ srcs = ["util.go"],
+ importpath = "github.com/github/codeql-go/extractor/util",
+ visibility = ["//visibility:public"],
+)
+
+go_test(
+ name = "util_test",
+ srcs = ["util_test.go"],
+ embed = [":util"],
+)
diff --git a/go/extractor/vendor/golang.org/x/mod/internal/lazyregexp/BUILD.bazel b/go/extractor/vendor/golang.org/x/mod/internal/lazyregexp/BUILD.bazel
new file mode 100644
index 00000000000..33c06c34bec
--- /dev/null
+++ b/go/extractor/vendor/golang.org/x/mod/internal/lazyregexp/BUILD.bazel
@@ -0,0 +1,9 @@
+load("@rules_go//go:def.bzl", "go_library")
+
+go_library(
+ name = "lazyregexp",
+ srcs = ["lazyre.go"],
+ importmap = "github.com/github/codeql-go/extractor/vendor/golang.org/x/mod/internal/lazyregexp",
+ importpath = "golang.org/x/mod/internal/lazyregexp",
+ visibility = ["//go/extractor/vendor/golang.org/x/mod:__subpackages__"],
+)
diff --git a/go/extractor/vendor/golang.org/x/mod/modfile/BUILD.bazel b/go/extractor/vendor/golang.org/x/mod/modfile/BUILD.bazel
new file mode 100644
index 00000000000..7b5a78d785c
--- /dev/null
+++ b/go/extractor/vendor/golang.org/x/mod/modfile/BUILD.bazel
@@ -0,0 +1,19 @@
+load("@rules_go//go:def.bzl", "go_library")
+
+go_library(
+ name = "modfile",
+ srcs = [
+ "print.go",
+ "read.go",
+ "rule.go",
+ "work.go",
+ ],
+ importmap = "github.com/github/codeql-go/extractor/vendor/golang.org/x/mod/modfile",
+ importpath = "golang.org/x/mod/modfile",
+ visibility = ["//visibility:public"],
+ deps = [
+ "//go/extractor/vendor/golang.org/x/mod/internal/lazyregexp",
+ "//go/extractor/vendor/golang.org/x/mod/module",
+ "//go/extractor/vendor/golang.org/x/mod/semver",
+ ],
+)
diff --git a/go/extractor/vendor/golang.org/x/mod/module/BUILD.bazel b/go/extractor/vendor/golang.org/x/mod/module/BUILD.bazel
new file mode 100644
index 00000000000..46ff4dbb7d1
--- /dev/null
+++ b/go/extractor/vendor/golang.org/x/mod/module/BUILD.bazel
@@ -0,0 +1,16 @@
+load("@rules_go//go:def.bzl", "go_library")
+
+go_library(
+ name = "module",
+ srcs = [
+ "module.go",
+ "pseudo.go",
+ ],
+ importmap = "github.com/github/codeql-go/extractor/vendor/golang.org/x/mod/module",
+ importpath = "golang.org/x/mod/module",
+ visibility = ["//visibility:public"],
+ deps = [
+ "//go/extractor/vendor/golang.org/x/mod/internal/lazyregexp",
+ "//go/extractor/vendor/golang.org/x/mod/semver",
+ ],
+)
diff --git a/go/extractor/vendor/golang.org/x/mod/semver/BUILD.bazel b/go/extractor/vendor/golang.org/x/mod/semver/BUILD.bazel
new file mode 100644
index 00000000000..5b54efe1981
--- /dev/null
+++ b/go/extractor/vendor/golang.org/x/mod/semver/BUILD.bazel
@@ -0,0 +1,9 @@
+load("@rules_go//go:def.bzl", "go_library")
+
+go_library(
+ name = "semver",
+ srcs = ["semver.go"],
+ importmap = "github.com/github/codeql-go/extractor/vendor/golang.org/x/mod/semver",
+ importpath = "golang.org/x/mod/semver",
+ visibility = ["//visibility:public"],
+)
diff --git a/go/extractor/vendor/golang.org/x/tools/go/gcexportdata/BUILD.bazel b/go/extractor/vendor/golang.org/x/tools/go/gcexportdata/BUILD.bazel
new file mode 100644
index 00000000000..57f503f1cb2
--- /dev/null
+++ b/go/extractor/vendor/golang.org/x/tools/go/gcexportdata/BUILD.bazel
@@ -0,0 +1,13 @@
+load("@rules_go//go:def.bzl", "go_library")
+
+go_library(
+ name = "gcexportdata",
+ srcs = [
+ "gcexportdata.go",
+ "importer.go",
+ ],
+ importmap = "github.com/github/codeql-go/extractor/vendor/golang.org/x/tools/go/gcexportdata",
+ importpath = "golang.org/x/tools/go/gcexportdata",
+ visibility = ["//visibility:public"],
+ deps = ["//go/extractor/vendor/golang.org/x/tools/internal/gcimporter"],
+)
diff --git a/go/extractor/vendor/golang.org/x/tools/go/internal/packagesdriver/BUILD.bazel b/go/extractor/vendor/golang.org/x/tools/go/internal/packagesdriver/BUILD.bazel
new file mode 100644
index 00000000000..962442de1e0
--- /dev/null
+++ b/go/extractor/vendor/golang.org/x/tools/go/internal/packagesdriver/BUILD.bazel
@@ -0,0 +1,10 @@
+load("@rules_go//go:def.bzl", "go_library")
+
+go_library(
+ name = "packagesdriver",
+ srcs = ["sizes.go"],
+ importmap = "github.com/github/codeql-go/extractor/vendor/golang.org/x/tools/go/internal/packagesdriver",
+ importpath = "golang.org/x/tools/go/internal/packagesdriver",
+ visibility = ["//go/extractor/vendor/golang.org/x/tools/go:__subpackages__"],
+ deps = ["//go/extractor/vendor/golang.org/x/tools/internal/gocommand"],
+)
diff --git a/go/extractor/vendor/golang.org/x/tools/go/packages/BUILD.bazel b/go/extractor/vendor/golang.org/x/tools/go/packages/BUILD.bazel
new file mode 100644
index 00000000000..1cad8baca98
--- /dev/null
+++ b/go/extractor/vendor/golang.org/x/tools/go/packages/BUILD.bazel
@@ -0,0 +1,25 @@
+load("@rules_go//go:def.bzl", "go_library")
+
+go_library(
+ name = "packages",
+ srcs = [
+ "doc.go",
+ "external.go",
+ "golist.go",
+ "golist_overlay.go",
+ "loadmode_string.go",
+ "packages.go",
+ "visit.go",
+ ],
+ importmap = "github.com/github/codeql-go/extractor/vendor/golang.org/x/tools/go/packages",
+ importpath = "golang.org/x/tools/go/packages",
+ visibility = ["//visibility:public"],
+ deps = [
+ "//go/extractor/vendor/golang.org/x/tools/go/gcexportdata",
+ "//go/extractor/vendor/golang.org/x/tools/go/internal/packagesdriver",
+ "//go/extractor/vendor/golang.org/x/tools/internal/gocommand",
+ "//go/extractor/vendor/golang.org/x/tools/internal/packagesinternal",
+ "//go/extractor/vendor/golang.org/x/tools/internal/typesinternal",
+ "//go/extractor/vendor/golang.org/x/tools/internal/versions",
+ ],
+)
diff --git a/go/extractor/vendor/golang.org/x/tools/go/types/objectpath/BUILD.bazel b/go/extractor/vendor/golang.org/x/tools/go/types/objectpath/BUILD.bazel
new file mode 100644
index 00000000000..1029221f434
--- /dev/null
+++ b/go/extractor/vendor/golang.org/x/tools/go/types/objectpath/BUILD.bazel
@@ -0,0 +1,10 @@
+load("@rules_go//go:def.bzl", "go_library")
+
+go_library(
+ name = "objectpath",
+ srcs = ["objectpath.go"],
+ importmap = "github.com/github/codeql-go/extractor/vendor/golang.org/x/tools/go/types/objectpath",
+ importpath = "golang.org/x/tools/go/types/objectpath",
+ visibility = ["//visibility:public"],
+ deps = ["//go/extractor/vendor/golang.org/x/tools/internal/typeparams"],
+)
diff --git a/go/extractor/vendor/golang.org/x/tools/internal/event/BUILD.bazel b/go/extractor/vendor/golang.org/x/tools/internal/event/BUILD.bazel
new file mode 100644
index 00000000000..b882fef0d8c
--- /dev/null
+++ b/go/extractor/vendor/golang.org/x/tools/internal/event/BUILD.bazel
@@ -0,0 +1,17 @@
+load("@rules_go//go:def.bzl", "go_library")
+
+go_library(
+ name = "event",
+ srcs = [
+ "doc.go",
+ "event.go",
+ ],
+ importmap = "github.com/github/codeql-go/extractor/vendor/golang.org/x/tools/internal/event",
+ importpath = "golang.org/x/tools/internal/event",
+ visibility = ["//go/extractor/vendor/golang.org/x/tools:__subpackages__"],
+ deps = [
+ "//go/extractor/vendor/golang.org/x/tools/internal/event/core",
+ "//go/extractor/vendor/golang.org/x/tools/internal/event/keys",
+ "//go/extractor/vendor/golang.org/x/tools/internal/event/label",
+ ],
+)
diff --git a/go/extractor/vendor/golang.org/x/tools/internal/event/core/BUILD.bazel b/go/extractor/vendor/golang.org/x/tools/internal/event/core/BUILD.bazel
new file mode 100644
index 00000000000..36bd68eed9f
--- /dev/null
+++ b/go/extractor/vendor/golang.org/x/tools/internal/event/core/BUILD.bazel
@@ -0,0 +1,17 @@
+load("@rules_go//go:def.bzl", "go_library")
+
+go_library(
+ name = "core",
+ srcs = [
+ "event.go",
+ "export.go",
+ "fast.go",
+ ],
+ importmap = "github.com/github/codeql-go/extractor/vendor/golang.org/x/tools/internal/event/core",
+ importpath = "golang.org/x/tools/internal/event/core",
+ visibility = ["//go/extractor/vendor/golang.org/x/tools:__subpackages__"],
+ deps = [
+ "//go/extractor/vendor/golang.org/x/tools/internal/event/keys",
+ "//go/extractor/vendor/golang.org/x/tools/internal/event/label",
+ ],
+)
diff --git a/go/extractor/vendor/golang.org/x/tools/internal/event/keys/BUILD.bazel b/go/extractor/vendor/golang.org/x/tools/internal/event/keys/BUILD.bazel
new file mode 100644
index 00000000000..f1674735052
--- /dev/null
+++ b/go/extractor/vendor/golang.org/x/tools/internal/event/keys/BUILD.bazel
@@ -0,0 +1,14 @@
+load("@rules_go//go:def.bzl", "go_library")
+
+go_library(
+ name = "keys",
+ srcs = [
+ "keys.go",
+ "standard.go",
+ "util.go",
+ ],
+ importmap = "github.com/github/codeql-go/extractor/vendor/golang.org/x/tools/internal/event/keys",
+ importpath = "golang.org/x/tools/internal/event/keys",
+ visibility = ["//go/extractor/vendor/golang.org/x/tools:__subpackages__"],
+ deps = ["//go/extractor/vendor/golang.org/x/tools/internal/event/label"],
+)
diff --git a/go/extractor/vendor/golang.org/x/tools/internal/event/label/BUILD.bazel b/go/extractor/vendor/golang.org/x/tools/internal/event/label/BUILD.bazel
new file mode 100644
index 00000000000..2329754d6cf
--- /dev/null
+++ b/go/extractor/vendor/golang.org/x/tools/internal/event/label/BUILD.bazel
@@ -0,0 +1,9 @@
+load("@rules_go//go:def.bzl", "go_library")
+
+go_library(
+ name = "label",
+ srcs = ["label.go"],
+ importmap = "github.com/github/codeql-go/extractor/vendor/golang.org/x/tools/internal/event/label",
+ importpath = "golang.org/x/tools/internal/event/label",
+ visibility = ["//go/extractor/vendor/golang.org/x/tools:__subpackages__"],
+)
diff --git a/go/extractor/vendor/golang.org/x/tools/internal/event/tag/BUILD.bazel b/go/extractor/vendor/golang.org/x/tools/internal/event/tag/BUILD.bazel
new file mode 100644
index 00000000000..276dc5f4489
--- /dev/null
+++ b/go/extractor/vendor/golang.org/x/tools/internal/event/tag/BUILD.bazel
@@ -0,0 +1,10 @@
+load("@rules_go//go:def.bzl", "go_library")
+
+go_library(
+ name = "tag",
+ srcs = ["tag.go"],
+ importmap = "github.com/github/codeql-go/extractor/vendor/golang.org/x/tools/internal/event/tag",
+ importpath = "golang.org/x/tools/internal/event/tag",
+ visibility = ["//go/extractor/vendor/golang.org/x/tools:__subpackages__"],
+ deps = ["//go/extractor/vendor/golang.org/x/tools/internal/event/keys"],
+)
diff --git a/go/extractor/vendor/golang.org/x/tools/internal/gcimporter/BUILD.bazel b/go/extractor/vendor/golang.org/x/tools/internal/gcimporter/BUILD.bazel
new file mode 100644
index 00000000000..1879fe0dadf
--- /dev/null
+++ b/go/extractor/vendor/golang.org/x/tools/internal/gcimporter/BUILD.bazel
@@ -0,0 +1,27 @@
+load("@rules_go//go:def.bzl", "go_library")
+
+go_library(
+ name = "gcimporter",
+ srcs = [
+ "bimport.go",
+ "exportdata.go",
+ "gcimporter.go",
+ "iexport.go",
+ "iimport.go",
+ "newInterface10.go",
+ "newInterface11.go",
+ "support_go117.go",
+ "support_go118.go",
+ "unified_no.go",
+ "ureader_no.go",
+ "ureader_yes.go",
+ ],
+ importmap = "github.com/github/codeql-go/extractor/vendor/golang.org/x/tools/internal/gcimporter",
+ importpath = "golang.org/x/tools/internal/gcimporter",
+ visibility = ["//go/extractor/vendor/golang.org/x/tools:__subpackages__"],
+ deps = [
+ "//go/extractor/vendor/golang.org/x/tools/go/types/objectpath",
+ "//go/extractor/vendor/golang.org/x/tools/internal/pkgbits",
+ "//go/extractor/vendor/golang.org/x/tools/internal/tokeninternal",
+ ],
+)
diff --git a/go/extractor/vendor/golang.org/x/tools/internal/gocommand/BUILD.bazel b/go/extractor/vendor/golang.org/x/tools/internal/gocommand/BUILD.bazel
new file mode 100644
index 00000000000..58f7091b49c
--- /dev/null
+++ b/go/extractor/vendor/golang.org/x/tools/internal/gocommand/BUILD.bazel
@@ -0,0 +1,20 @@
+load("@rules_go//go:def.bzl", "go_library")
+
+go_library(
+ name = "gocommand",
+ srcs = [
+ "invoke.go",
+ "vendor.go",
+ "version.go",
+ ],
+ importmap = "github.com/github/codeql-go/extractor/vendor/golang.org/x/tools/internal/gocommand",
+ importpath = "golang.org/x/tools/internal/gocommand",
+ visibility = ["//go/extractor/vendor/golang.org/x/tools:__subpackages__"],
+ deps = [
+ "//go/extractor/vendor/golang.org/x/mod/semver",
+ "//go/extractor/vendor/golang.org/x/tools/internal/event",
+ "//go/extractor/vendor/golang.org/x/tools/internal/event/keys",
+ "//go/extractor/vendor/golang.org/x/tools/internal/event/label",
+ "//go/extractor/vendor/golang.org/x/tools/internal/event/tag",
+ ],
+)
diff --git a/go/extractor/vendor/golang.org/x/tools/internal/packagesinternal/BUILD.bazel b/go/extractor/vendor/golang.org/x/tools/internal/packagesinternal/BUILD.bazel
new file mode 100644
index 00000000000..3ed918c9489
--- /dev/null
+++ b/go/extractor/vendor/golang.org/x/tools/internal/packagesinternal/BUILD.bazel
@@ -0,0 +1,9 @@
+load("@rules_go//go:def.bzl", "go_library")
+
+go_library(
+ name = "packagesinternal",
+ srcs = ["packages.go"],
+ importmap = "github.com/github/codeql-go/extractor/vendor/golang.org/x/tools/internal/packagesinternal",
+ importpath = "golang.org/x/tools/internal/packagesinternal",
+ visibility = ["//go/extractor/vendor/golang.org/x/tools:__subpackages__"],
+)
diff --git a/go/extractor/vendor/golang.org/x/tools/internal/pkgbits/BUILD.bazel b/go/extractor/vendor/golang.org/x/tools/internal/pkgbits/BUILD.bazel
new file mode 100644
index 00000000000..820e8f04c9b
--- /dev/null
+++ b/go/extractor/vendor/golang.org/x/tools/internal/pkgbits/BUILD.bazel
@@ -0,0 +1,21 @@
+load("@rules_go//go:def.bzl", "go_library")
+
+go_library(
+ name = "pkgbits",
+ srcs = [
+ "codes.go",
+ "decoder.go",
+ "doc.go",
+ "encoder.go",
+ "flags.go",
+ "frames_go1.go",
+ "frames_go17.go",
+ "reloc.go",
+ "support.go",
+ "sync.go",
+ "syncmarker_string.go",
+ ],
+ importmap = "github.com/github/codeql-go/extractor/vendor/golang.org/x/tools/internal/pkgbits",
+ importpath = "golang.org/x/tools/internal/pkgbits",
+ visibility = ["//go/extractor/vendor/golang.org/x/tools:__subpackages__"],
+)
diff --git a/go/extractor/vendor/golang.org/x/tools/internal/tokeninternal/BUILD.bazel b/go/extractor/vendor/golang.org/x/tools/internal/tokeninternal/BUILD.bazel
new file mode 100644
index 00000000000..ff66085dbdb
--- /dev/null
+++ b/go/extractor/vendor/golang.org/x/tools/internal/tokeninternal/BUILD.bazel
@@ -0,0 +1,9 @@
+load("@rules_go//go:def.bzl", "go_library")
+
+go_library(
+ name = "tokeninternal",
+ srcs = ["tokeninternal.go"],
+ importmap = "github.com/github/codeql-go/extractor/vendor/golang.org/x/tools/internal/tokeninternal",
+ importpath = "golang.org/x/tools/internal/tokeninternal",
+ visibility = ["//go/extractor/vendor/golang.org/x/tools:__subpackages__"],
+)
diff --git a/go/extractor/vendor/golang.org/x/tools/internal/typeparams/BUILD.bazel b/go/extractor/vendor/golang.org/x/tools/internal/typeparams/BUILD.bazel
new file mode 100644
index 00000000000..266816d9ea2
--- /dev/null
+++ b/go/extractor/vendor/golang.org/x/tools/internal/typeparams/BUILD.bazel
@@ -0,0 +1,15 @@
+load("@rules_go//go:def.bzl", "go_library")
+
+go_library(
+ name = "typeparams",
+ srcs = [
+ "common.go",
+ "coretype.go",
+ "normalize.go",
+ "termlist.go",
+ "typeterm.go",
+ ],
+ importmap = "github.com/github/codeql-go/extractor/vendor/golang.org/x/tools/internal/typeparams",
+ importpath = "golang.org/x/tools/internal/typeparams",
+ visibility = ["//go/extractor/vendor/golang.org/x/tools:__subpackages__"],
+)
diff --git a/go/extractor/vendor/golang.org/x/tools/internal/typesinternal/BUILD.bazel b/go/extractor/vendor/golang.org/x/tools/internal/typesinternal/BUILD.bazel
new file mode 100644
index 00000000000..c03b8a36ef7
--- /dev/null
+++ b/go/extractor/vendor/golang.org/x/tools/internal/typesinternal/BUILD.bazel
@@ -0,0 +1,14 @@
+load("@rules_go//go:def.bzl", "go_library")
+
+go_library(
+ name = "typesinternal",
+ srcs = [
+ "errorcode.go",
+ "errorcode_string.go",
+ "types.go",
+ "types_118.go",
+ ],
+ importmap = "github.com/github/codeql-go/extractor/vendor/golang.org/x/tools/internal/typesinternal",
+ importpath = "golang.org/x/tools/internal/typesinternal",
+ visibility = ["//go/extractor/vendor/golang.org/x/tools:__subpackages__"],
+)
diff --git a/go/extractor/vendor/golang.org/x/tools/internal/versions/BUILD.bazel b/go/extractor/vendor/golang.org/x/tools/internal/versions/BUILD.bazel
new file mode 100644
index 00000000000..6d7ffd0ac68
--- /dev/null
+++ b/go/extractor/vendor/golang.org/x/tools/internal/versions/BUILD.bazel
@@ -0,0 +1,15 @@
+load("@rules_go//go:def.bzl", "go_library")
+
+go_library(
+ name = "versions",
+ srcs = [
+ "gover.go",
+ "types.go",
+ "types_go121.go",
+ "types_go122.go",
+ "versions.go",
+ ],
+ importmap = "github.com/github/codeql-go/extractor/vendor/golang.org/x/tools/internal/versions",
+ importpath = "golang.org/x/tools/internal/versions",
+ visibility = ["//go/extractor/vendor/golang.org/x/tools:__subpackages__"],
+)
diff --git a/go/gazelle/BUILD.bazel b/go/gazelle/BUILD.bazel
new file mode 100644
index 00000000000..7c9b34edb3a
--- /dev/null
+++ b/go/gazelle/BUILD.bazel
@@ -0,0 +1,8 @@
+load("@gazelle//:def.bzl", "gazelle")
+
+gazelle(
+ name = "gazelle",
+ extra_args = [
+ "go/extractor",
+ ],
+)
diff --git a/go/rules.bzl b/go/rules.bzl
new file mode 100644
index 00000000000..e69de29bb2d
From 4ca8faa9c944faa1005046c2c5cef3f6d68131b3 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Thu, 25 Apr 2024 09:14:59 +0200
Subject: [PATCH 004/118] Go: introduce universal binaries on macOS
---
MODULE.bazel | 3 ++-
go/BUILD.bazel | 0
go/extractor/BUILD.bazel | 1 +
go/extractor/cli/go-autobuilder/BUILD.bazel | 5 ++--
go/extractor/cli/go-bootstrap/BUILD.bazel | 5 ++--
go/extractor/cli/go-build-runner/BUILD.bazel | 5 ++--
go/extractor/cli/go-extractor/BUILD.bazel | 5 ++--
go/extractor/cli/go-gen-dbscheme/BUILD.bazel | 5 ++--
go/extractor/cli/go-tokenizer/BUILD.bazel | 5 ++--
go/rules.bzl | 5 ++++
misc/bazel/universal_binary.bzl | 24 ++++++++++++++++++++
11 files changed, 50 insertions(+), 13 deletions(-)
create mode 100644 go/BUILD.bazel
create mode 100644 misc/bazel/universal_binary.bzl
diff --git a/MODULE.bazel b/MODULE.bazel
index 2dc9dd0a7bb..7a85ab51a96 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -13,7 +13,8 @@ local_path_override(
# see https://registry.bazel.build/ for a list of available packages
-bazel_dep(name = "platforms", version = "0.0.8")
+bazel_dep(name = "apple_support", version = "1.15.1")
+bazel_dep(name = "platforms", version = "0.0.9")
bazel_dep(name = "rules_go", version = "0.47.0")
bazel_dep(name = "rules_pkg", version = "0.10.1")
bazel_dep(name = "rules_nodejs", version = "6.0.3")
diff --git a/go/BUILD.bazel b/go/BUILD.bazel
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/go/extractor/BUILD.bazel b/go/extractor/BUILD.bazel
index ea99340e7d7..040b4227314 100644
--- a/go/extractor/BUILD.bazel
+++ b/go/extractor/BUILD.bazel
@@ -1,6 +1,7 @@
load("@rules_go//go:def.bzl", "go_library")
# gazelle:prefix github.com/github/codeql-go/extractor
+# gazelle:map_kind go_binary codeql_go_binary //go:rules.bzl
go_library(
name = "extractor",
diff --git a/go/extractor/cli/go-autobuilder/BUILD.bazel b/go/extractor/cli/go-autobuilder/BUILD.bazel
index b53227b9f1b..bf1235b33aa 100644
--- a/go/extractor/cli/go-autobuilder/BUILD.bazel
+++ b/go/extractor/cli/go-autobuilder/BUILD.bazel
@@ -1,4 +1,5 @@
-load("@rules_go//go:def.bzl", "go_binary", "go_library")
+load("@rules_go//go:def.bzl", "go_library")
+load("//go:rules.bzl", "codeql_go_binary")
go_library(
name = "go-autobuilder_lib",
@@ -15,7 +16,7 @@ go_library(
],
)
-go_binary(
+codeql_go_binary(
name = "go-autobuilder",
embed = [":go-autobuilder_lib"],
visibility = ["//visibility:public"],
diff --git a/go/extractor/cli/go-bootstrap/BUILD.bazel b/go/extractor/cli/go-bootstrap/BUILD.bazel
index 15255227f9a..7bdd6d6e70f 100644
--- a/go/extractor/cli/go-bootstrap/BUILD.bazel
+++ b/go/extractor/cli/go-bootstrap/BUILD.bazel
@@ -1,4 +1,5 @@
-load("@rules_go//go:def.bzl", "go_binary", "go_library")
+load("@rules_go//go:def.bzl", "go_library")
+load("//go:rules.bzl", "codeql_go_binary")
go_library(
name = "go-bootstrap_lib",
@@ -7,7 +8,7 @@ go_library(
visibility = ["//visibility:private"],
)
-go_binary(
+codeql_go_binary(
name = "go-bootstrap",
embed = [":go-bootstrap_lib"],
visibility = ["//visibility:public"],
diff --git a/go/extractor/cli/go-build-runner/BUILD.bazel b/go/extractor/cli/go-build-runner/BUILD.bazel
index fc407c3e172..15557d751cf 100644
--- a/go/extractor/cli/go-build-runner/BUILD.bazel
+++ b/go/extractor/cli/go-build-runner/BUILD.bazel
@@ -1,4 +1,5 @@
-load("@rules_go//go:def.bzl", "go_binary", "go_library")
+load("@rules_go//go:def.bzl", "go_library")
+load("//go:rules.bzl", "codeql_go_binary")
go_library(
name = "go-build-runner_lib",
@@ -11,7 +12,7 @@ go_library(
],
)
-go_binary(
+codeql_go_binary(
name = "go-build-runner",
embed = [":go-build-runner_lib"],
visibility = ["//visibility:public"],
diff --git a/go/extractor/cli/go-extractor/BUILD.bazel b/go/extractor/cli/go-extractor/BUILD.bazel
index 9419c6f8ba9..be426331868 100644
--- a/go/extractor/cli/go-extractor/BUILD.bazel
+++ b/go/extractor/cli/go-extractor/BUILD.bazel
@@ -1,4 +1,5 @@
-load("@rules_go//go:def.bzl", "go_binary", "go_library")
+load("@rules_go//go:def.bzl", "go_library")
+load("//go:rules.bzl", "codeql_go_binary")
go_library(
name = "go-extractor_lib",
@@ -11,7 +12,7 @@ go_library(
],
)
-go_binary(
+codeql_go_binary(
name = "go-extractor",
embed = [":go-extractor_lib"],
visibility = ["//visibility:public"],
diff --git a/go/extractor/cli/go-gen-dbscheme/BUILD.bazel b/go/extractor/cli/go-gen-dbscheme/BUILD.bazel
index 1fbd75998c2..06c0d0f61f1 100644
--- a/go/extractor/cli/go-gen-dbscheme/BUILD.bazel
+++ b/go/extractor/cli/go-gen-dbscheme/BUILD.bazel
@@ -1,4 +1,5 @@
-load("@rules_go//go:def.bzl", "go_binary", "go_library")
+load("@rules_go//go:def.bzl", "go_library")
+load("//go:rules.bzl", "codeql_go_binary")
go_library(
name = "go-gen-dbscheme_lib",
@@ -8,7 +9,7 @@ go_library(
deps = ["//go/extractor/dbscheme"],
)
-go_binary(
+codeql_go_binary(
name = "go-gen-dbscheme",
embed = [":go-gen-dbscheme_lib"],
visibility = ["//visibility:public"],
diff --git a/go/extractor/cli/go-tokenizer/BUILD.bazel b/go/extractor/cli/go-tokenizer/BUILD.bazel
index f55baecc69f..3fc5b464c7c 100644
--- a/go/extractor/cli/go-tokenizer/BUILD.bazel
+++ b/go/extractor/cli/go-tokenizer/BUILD.bazel
@@ -1,4 +1,5 @@
-load("@rules_go//go:def.bzl", "go_binary", "go_library")
+load("@rules_go//go:def.bzl", "go_library")
+load("//go:rules.bzl", "codeql_go_binary")
go_library(
name = "go-tokenizer_lib",
@@ -7,7 +8,7 @@ go_library(
visibility = ["//visibility:private"],
)
-go_binary(
+codeql_go_binary(
name = "go-tokenizer",
embed = [":go-tokenizer_lib"],
visibility = ["//visibility:public"],
diff --git a/go/rules.bzl b/go/rules.bzl
index e69de29bb2d..4ef798001d2 100644
--- a/go/rules.bzl
+++ b/go/rules.bzl
@@ -0,0 +1,5 @@
+load("@rules_go//go:def.bzl", "go_binary")
+load("//misc/bazel:universal_binary.bzl", "wrap_as_universal_binary")
+
+def codeql_go_binary(**kwargs):
+ wrap_as_universal_binary(go_binary, **kwargs)
diff --git a/misc/bazel/universal_binary.bzl b/misc/bazel/universal_binary.bzl
new file mode 100644
index 00000000000..85881356d0e
--- /dev/null
+++ b/misc/bazel/universal_binary.bzl
@@ -0,0 +1,24 @@
+load("@apple_support//rules:universal_binary.bzl", _universal_binary = "universal_binary")
+
+def wrap_as_universal_binary(rule, *, name, visibility = None, **kwargs):
+ internal_name = "internal/%s" % name
+ universal_name = "universal/%s" % name
+ rule(
+ name = internal_name,
+ visibility = ["//visibility:private"],
+ **kwargs
+ )
+ _universal_binary(
+ name = universal_name,
+ target_compatible_with = ["@platforms//os:macos"],
+ binary = internal_name,
+ visibility = ["//visibility:private"],
+ )
+ native.alias(
+ name = name,
+ actual = select({
+ "@platforms//os:macos": universal_name,
+ "//conditions:default": internal_name,
+ }),
+ visibility = visibility,
+ )
From 8cba276b87e17fa3bfbbef3522dd9e863eaa7487 Mon Sep 17 00:00:00 2001
From: Ben Ahmady <32935794+subatoi@users.noreply.github.com>
Date: Thu, 25 Apr 2024 07:59:33 +0000
Subject: [PATCH 005/118] Deprecate the CodeQL for VS Code docs in favour of
docs.github.com version
---
CONTRIBUTING.md | 4 +++-
README.md | 2 +-
.../about-codeql-for-visual-studio-code.rst | 2 ++
.../about-telemetry-in-codeql-for-visual-studio-code.rst | 2 ++
.../analyzing-your-projects.rst | 2 ++
.../codeql-for-visual-studio-code/customizing-settings.rst | 2 ++
.../exploring-data-flow-with-path-queries.rst | 2 ++
.../exploring-the-structure-of-your-source-code.rst | 2 ++
docs/codeql/codeql-for-visual-studio-code/index.rst | 2 ++
.../running-codeql-queries-at-scale-with-mrva.rst | 2 ++
.../setting-up-codeql-in-visual-studio-code.rst | 2 ++
.../testing-codeql-queries-in-visual-studio-code.rst | 2 ++
.../troubleshooting-codeql-for-visual-studio-code.rst | 2 ++
.../troubleshooting-variant-analysis.rst | 2 ++
.../using-the-codeql-model-editor.rst | 2 ++
.../working-with-codeql-packs-in-visual-studio-code.rst | 2 ++
.../codeql-language-guides/codeql-library-for-ruby.rst | 2 +-
docs/codeql/codeql-overview/about-codeql.rst | 4 ++--
.../codeql-overview/codeql-changelog/codeql-cli-2.8.1.rst | 2 +-
docs/codeql/codeql-overview/codeql-tools.rst | 4 ++--
docs/codeql/ql-training/cpp/bad-overflow-guard.rst | 2 +-
docs/codeql/ql-training/cpp/control-flow-cpp.rst | 2 +-
docs/codeql/ql-training/cpp/data-flow-cpp.rst | 2 +-
docs/codeql/ql-training/cpp/global-data-flow-cpp.rst | 2 +-
docs/codeql/ql-training/cpp/intro-ql-cpp.rst | 2 +-
docs/codeql/ql-training/cpp/snprintf.rst | 2 +-
docs/codeql/ql-training/java/apache-struts-java.rst | 2 +-
docs/codeql/ql-training/java/data-flow-java.rst | 2 +-
docs/codeql/ql-training/java/global-data-flow-java.rst | 2 +-
docs/codeql/ql-training/java/intro-ql-java.rst | 2 +-
docs/codeql/ql-training/java/query-injection-java.rst | 2 +-
docs/codeql/ql-training/template.rst | 2 +-
docs/codeql/reusables/deprecation-note.rst | 6 ++++++
.../codeql/writing-codeql-queries/creating-path-queries.rst | 4 ++--
.../defining-the-results-of-a-query.rst | 2 +-
docs/codeql/writing-codeql-queries/introduction-to-ql.rst | 4 ++--
.../writing-codeql-queries/metadata-for-codeql-queries.rst | 2 +-
docs/ql-style-guide.md | 2 +-
docs/supported-queries.md | 2 +-
go/CONTRIBUTING.md | 2 +-
go/ql/docs/experimental.md | 2 +-
python/ql/src/CHANGELOG.md | 2 +-
python/ql/src/change-notes/released/0.0.9.md | 2 +-
43 files changed, 68 insertions(+), 32 deletions(-)
create mode 100644 docs/codeql/reusables/deprecation-note.rst
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 5324ac8f301..a0efca6dec9 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -4,6 +4,8 @@ We welcome contributions to our CodeQL libraries and queries. Got an idea for a
There is lots of useful documentation to help you write queries, ranging from information about query file structure to tutorials for specific target languages. For more information on the documentation available, see [CodeQL queries](https://codeql.github.com/docs/writing-codeql-queries/codeql-queries) on [codeql.github.com](https://codeql.github.com).
+Note that the CodeQL for Visual Studio Code documentation has been migrated to https://docs.github.com/en/code-security/codeql-for-vs-code/, but you can still contribute to it via a different repository. For more information, see [Contributing to GitHub Docs documentation](https://docs.github.com/en/contributing)."
+
## Change notes
Any nontrivial user-visible change to a query pack or library pack should have a change note. For details on how to add a change note for your change, see [this guide](docs/change-notes.md).
@@ -43,7 +45,7 @@ If you have an idea for a query that you would like to share with other CodeQL u
3. **Formatting**
- - The queries and libraries must be autoformatted, for example using the "Format Document" command in [CodeQL for Visual Studio Code](https://codeql.github.com/docs/codeql-for-visual-studio-code/about-codeql-for-visual-studio-code).
+ - The queries and libraries must be autoformatted, for example using the "Format Document" command in [CodeQL for Visual Studio Code](https://docs.github.com/en/code-security/codeql-for-vs-code/).
If you prefer, you can either:
1. install the [pre-commit framework](https://pre-commit.com/) and install the configured hooks on this repo via `pre-commit install`, or
diff --git a/README.md b/README.md
index 57ecf54486c..42382b1d834 100644
--- a/README.md
+++ b/README.md
@@ -4,7 +4,7 @@ This open source repository contains the standard CodeQL libraries and queries t
## How do I learn CodeQL and run queries?
-There is [extensive documentation](https://codeql.github.com/docs/) on getting started with writing CodeQL using the [CodeQL extension for Visual Studio Code](https://codeql.github.com/docs/codeql-for-visual-studio-code/) and the [CodeQL CLI](https://codeql.github.com/docs/codeql-cli/).
+There is [extensive documentation](https://codeql.github.com/docs/) on getting started with writing CodeQL using the [CodeQL extension for Visual Studio Code](https://docs.github.com/en/code-security/codeql-for-vs-code/) and the [CodeQL CLI](https://codeql.github.com/docs/codeql-cli/).
## Contributing
diff --git a/docs/codeql/codeql-for-visual-studio-code/about-codeql-for-visual-studio-code.rst b/docs/codeql/codeql-for-visual-studio-code/about-codeql-for-visual-studio-code.rst
index 72e2756ea5c..f0dfbe29017 100644
--- a/docs/codeql/codeql-for-visual-studio-code/about-codeql-for-visual-studio-code.rst
+++ b/docs/codeql/codeql-for-visual-studio-code/about-codeql-for-visual-studio-code.rst
@@ -5,6 +5,8 @@
About CodeQL for Visual Studio Code
=================================================
+.. include:: ../reusables/deprecation-note.rst
+
CodeQL for Visual Studio Code is an extension that lets you write, run, and test CodeQL queries in Visual Studio Code.
Features
diff --git a/docs/codeql/codeql-for-visual-studio-code/about-telemetry-in-codeql-for-visual-studio-code.rst b/docs/codeql/codeql-for-visual-studio-code/about-telemetry-in-codeql-for-visual-studio-code.rst
index f3258e013f7..832e6d4e856 100644
--- a/docs/codeql/codeql-for-visual-studio-code/about-telemetry-in-codeql-for-visual-studio-code.rst
+++ b/docs/codeql/codeql-for-visual-studio-code/about-telemetry-in-codeql-for-visual-studio-code.rst
@@ -5,6 +5,8 @@
About telemetry in CodeQL for Visual Studio Code
=================================================
+.. include:: ../reusables/deprecation-note.rst
+
If you specifically opt in to permit GitHub to do so, GitHub will collect usage data and metrics for the purposes of helping the core developers to improve the CodeQL extension for VS Code.
This data will not be shared with any parties outside of GitHub. IP addresses and installation IDs will be retained for a maximum of 30 days. Anonymous data will be retained for a maximum of 180 days.
diff --git a/docs/codeql/codeql-for-visual-studio-code/analyzing-your-projects.rst b/docs/codeql/codeql-for-visual-studio-code/analyzing-your-projects.rst
index 62d48c6fbd8..dea8007c460 100644
--- a/docs/codeql/codeql-for-visual-studio-code/analyzing-your-projects.rst
+++ b/docs/codeql/codeql-for-visual-studio-code/analyzing-your-projects.rst
@@ -5,6 +5,8 @@
Analyzing your projects
=================================================
+.. include:: ../reusables/deprecation-note.rst
+
You can run queries on CodeQL databases and view the results in Visual Studio Code. This article explains how to get a CodeQL database and analyze it on your local machine. For information on running analysis at scale across many CodeQL databases, see ":ref:`Running CodeQL queries at scale with multi-repository variant analysis `."
Choosing a database
diff --git a/docs/codeql/codeql-for-visual-studio-code/customizing-settings.rst b/docs/codeql/codeql-for-visual-studio-code/customizing-settings.rst
index 88ad273a3d6..737024861a6 100644
--- a/docs/codeql/codeql-for-visual-studio-code/customizing-settings.rst
+++ b/docs/codeql/codeql-for-visual-studio-code/customizing-settings.rst
@@ -5,6 +5,8 @@
Customizing settings
====================
+.. include:: ../reusables/deprecation-note.rst
+
You can edit the settings for the CodeQL extension to suit your needs.
About CodeQL extension settings
diff --git a/docs/codeql/codeql-for-visual-studio-code/exploring-data-flow-with-path-queries.rst b/docs/codeql/codeql-for-visual-studio-code/exploring-data-flow-with-path-queries.rst
index dec599829ed..9975d06b0eb 100644
--- a/docs/codeql/codeql-for-visual-studio-code/exploring-data-flow-with-path-queries.rst
+++ b/docs/codeql/codeql-for-visual-studio-code/exploring-data-flow-with-path-queries.rst
@@ -5,6 +5,8 @@
Exploring data flow with path queries
=====================================
+.. include:: ../reusables/deprecation-note.rst
+
You can run CodeQL queries in VS Code to help you track the flow of data through a program, highlighting areas that are potential security vulnerabilities.
About path queries
diff --git a/docs/codeql/codeql-for-visual-studio-code/exploring-the-structure-of-your-source-code.rst b/docs/codeql/codeql-for-visual-studio-code/exploring-the-structure-of-your-source-code.rst
index 708b2f0cc0c..9494902d24e 100644
--- a/docs/codeql/codeql-for-visual-studio-code/exploring-the-structure-of-your-source-code.rst
+++ b/docs/codeql/codeql-for-visual-studio-code/exploring-the-structure-of-your-source-code.rst
@@ -5,6 +5,8 @@
Exploring the structure of your source code
=================================================
+.. include:: ../reusables/deprecation-note.rst
+
You can use the AST viewer to display the abstract syntax tree of a CodeQL database.
About the abstract syntax tree
diff --git a/docs/codeql/codeql-for-visual-studio-code/index.rst b/docs/codeql/codeql-for-visual-studio-code/index.rst
index fc615f932f8..6207d37b286 100644
--- a/docs/codeql/codeql-for-visual-studio-code/index.rst
+++ b/docs/codeql/codeql-for-visual-studio-code/index.rst
@@ -3,6 +3,8 @@
CodeQL for Visual Studio Code
=============================
+.. include:: ../reusables/deprecation-note.rst
+
The CodeQL extension for Visual Studio Code adds rich language support for CodeQL and allows you to easily find problems in codebases.
- :doc:`About CodeQL for Visual Studio Code
diff --git a/docs/codeql/codeql-for-visual-studio-code/running-codeql-queries-at-scale-with-mrva.rst b/docs/codeql/codeql-for-visual-studio-code/running-codeql-queries-at-scale-with-mrva.rst
index dad191274de..2c591c68948 100644
--- a/docs/codeql/codeql-for-visual-studio-code/running-codeql-queries-at-scale-with-mrva.rst
+++ b/docs/codeql/codeql-for-visual-studio-code/running-codeql-queries-at-scale-with-mrva.rst
@@ -5,6 +5,8 @@
Running CodeQL queries at scale with multi-repository variant analysis
======================================================================
+.. include:: ../reusables/deprecation-note.rst
+
.. include:: ../reusables/beta-note-mrva.rst
About multi-repository variant analysis
diff --git a/docs/codeql/codeql-for-visual-studio-code/setting-up-codeql-in-visual-studio-code.rst b/docs/codeql/codeql-for-visual-studio-code/setting-up-codeql-in-visual-studio-code.rst
index ac67d31afde..fd553d49ab9 100644
--- a/docs/codeql/codeql-for-visual-studio-code/setting-up-codeql-in-visual-studio-code.rst
+++ b/docs/codeql/codeql-for-visual-studio-code/setting-up-codeql-in-visual-studio-code.rst
@@ -5,6 +5,8 @@
Setting up CodeQL in Visual Studio Code
=================================================
+.. include:: ../reusables/deprecation-note.rst
+
You can install and configure the CodeQL extension in Visual Studio Code.
.. include:: ../reusables/license-note.rst
diff --git a/docs/codeql/codeql-for-visual-studio-code/testing-codeql-queries-in-visual-studio-code.rst b/docs/codeql/codeql-for-visual-studio-code/testing-codeql-queries-in-visual-studio-code.rst
index 7e19e78bd42..8f77e0110bc 100644
--- a/docs/codeql/codeql-for-visual-studio-code/testing-codeql-queries-in-visual-studio-code.rst
+++ b/docs/codeql/codeql-for-visual-studio-code/testing-codeql-queries-in-visual-studio-code.rst
@@ -5,6 +5,8 @@
Testing CodeQL queries in Visual Studio Code
============================================
+.. include:: ../reusables/deprecation-note.rst
+
You can run unit tests for CodeQL queries using the Visual Studio Code extension. When you are sure that your query finds the results you want to identify, you can use variant analysis to run it at scale. For information on running analysis at scale across many CodeQL databases, see ":ref:`Running CodeQL queries at scale with multi-repository variant analysis `."
About testing queries in VS Code
diff --git a/docs/codeql/codeql-for-visual-studio-code/troubleshooting-codeql-for-visual-studio-code.rst b/docs/codeql/codeql-for-visual-studio-code/troubleshooting-codeql-for-visual-studio-code.rst
index 2eecc28f0fb..cdd6579b6aa 100644
--- a/docs/codeql/codeql-for-visual-studio-code/troubleshooting-codeql-for-visual-studio-code.rst
+++ b/docs/codeql/codeql-for-visual-studio-code/troubleshooting-codeql-for-visual-studio-code.rst
@@ -5,6 +5,8 @@
Troubleshooting CodeQL for Visual Studio Code
=============================================
+.. include:: ../reusables/deprecation-note.rst
+
This article explains how to debug problems with the analysis of CodeQL databases that are stored on your local
machine. For information on troubleshooting variant analysis, which runs on GitHub.com, see
":ref:`Troubleshooting variant analysis `."
diff --git a/docs/codeql/codeql-for-visual-studio-code/troubleshooting-variant-analysis.rst b/docs/codeql/codeql-for-visual-studio-code/troubleshooting-variant-analysis.rst
index 5d9137dee5c..f052bb1722c 100644
--- a/docs/codeql/codeql-for-visual-studio-code/troubleshooting-variant-analysis.rst
+++ b/docs/codeql/codeql-for-visual-studio-code/troubleshooting-variant-analysis.rst
@@ -5,6 +5,8 @@
Troubleshooting variant analysis
================================
+.. include:: ../reusables/deprecation-note.rst
+
.. include:: ../reusables/beta-note-mrva.rst
This article explains how to debug problems with variant analysis, that is, analysis run using GitHub Actions
diff --git a/docs/codeql/codeql-for-visual-studio-code/using-the-codeql-model-editor.rst b/docs/codeql/codeql-for-visual-studio-code/using-the-codeql-model-editor.rst
index d1dce1a6771..5c61e780da5 100644
--- a/docs/codeql/codeql-for-visual-studio-code/using-the-codeql-model-editor.rst
+++ b/docs/codeql/codeql-for-visual-studio-code/using-the-codeql-model-editor.rst
@@ -5,6 +5,8 @@
Using the CodeQL model editor
=============================
+.. include:: ../reusables/deprecation-note.rst
+
.. include:: ../reusables/beta-note-model-pack-editor-vsc.rst
You can view, write, and edit CodeQL packs in Visual Studio Code using the CodeQL extension. The model editor is designed to help you model external dependencies of your codebase that are not supported by the standard CodeQL Libraries.
diff --git a/docs/codeql/codeql-for-visual-studio-code/working-with-codeql-packs-in-visual-studio-code.rst b/docs/codeql/codeql-for-visual-studio-code/working-with-codeql-packs-in-visual-studio-code.rst
index fe1e9a0bbdd..a652021b1c3 100644
--- a/docs/codeql/codeql-for-visual-studio-code/working-with-codeql-packs-in-visual-studio-code.rst
+++ b/docs/codeql/codeql-for-visual-studio-code/working-with-codeql-packs-in-visual-studio-code.rst
@@ -5,6 +5,8 @@
Working with CodeQL packs in Visual Studio Code
===============================================
+.. include:: ../reusables/deprecation-note.rst
+
.. include:: ../reusables/beta-note-package-management.rst
You can view, write, and edit all types of CodeQL packs in Visual Studio Code using the CodeQL extension.
diff --git a/docs/codeql/codeql-language-guides/codeql-library-for-ruby.rst b/docs/codeql/codeql-language-guides/codeql-library-for-ruby.rst
index 7db0028eb03..9d8f218edca 100644
--- a/docs/codeql/codeql-language-guides/codeql-library-for-ruby.rst
+++ b/docs/codeql/codeql-language-guides/codeql-library-for-ruby.rst
@@ -73,7 +73,7 @@ The CodeQL examples in this article are only excerpts and are not meant to repre
Abstract syntax
---------------
-The abstract syntax tree (AST) represents the elements of the source code organized into a tree. The `AST viewer `__
+The abstract syntax tree (AST) represents the elements of the source code organized into a tree. The `AST viewer `__
in Visual Studio Code shows the AST nodes, including the relevant CodeQL classes and predicates.
All CodeQL AST classes inherit from the `AstNode` class, which provides the following member predicates
diff --git a/docs/codeql/codeql-overview/about-codeql.rst b/docs/codeql/codeql-overview/about-codeql.rst
index 1392e1c7330..db48990e96c 100644
--- a/docs/codeql/codeql-overview/about-codeql.rst
+++ b/docs/codeql/codeql-overview/about-codeql.rst
@@ -70,8 +70,8 @@ Query execution
After you've created a CodeQL database, one or more queries are executed
against it. CodeQL queries are written in a specially-designed object-oriented
query language called QL. You can run the queries checked out from the CodeQL
-repo (or custom queries that you've written yourself) using the :ref:`CodeQL
-for VS Code extension ` or the `CodeQL CLI
+repo (or custom queries that you've written yourself) using the `CodeQL
+for VS Code extension ` or the `CodeQL CLI
`__. For more information about queries, see ":ref:`About CodeQL queries `."
.. _interpret-query-results:
diff --git a/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.8.1.rst b/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.8.1.rst
index 7c76c396073..5197b2f6165 100644
--- a/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.8.1.rst
+++ b/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.8.1.rst
@@ -82,7 +82,7 @@ Bug Fixes
Python
""""""
-* The `View AST functionality `__ no longer prints detailed information about regular expressions, greatly improving performance.
+* The `View AST functionality `__ no longer prints detailed information about regular expressions, greatly improving performance.
Minor Analysis Improvements
~~~~~~~~~~~~~~~~~~~~~~~~~~~
diff --git a/docs/codeql/codeql-overview/codeql-tools.rst b/docs/codeql/codeql-overview/codeql-tools.rst
index c6df9d8882d..0adb630bf25 100644
--- a/docs/codeql/codeql-overview/codeql-tools.rst
+++ b/docs/codeql/codeql-overview/codeql-tools.rst
@@ -53,5 +53,5 @@ CodeQL for Visual Studio Code
You can analyze CodeQL databases in Visual Studio Code using the CodeQL
extension, which provides an enhanced environment for writing and running custom
-queries and viewing the results. For more information, see ":ref:`CodeQL
-for Visual Studio Code `."
\ No newline at end of file
+queries and viewing the results. For more information, see "`CodeQL
+for Visual Studio Code `."
\ No newline at end of file
diff --git a/docs/codeql/ql-training/cpp/bad-overflow-guard.rst b/docs/codeql/ql-training/cpp/bad-overflow-guard.rst
index 55657871b4f..07a5b78af76 100644
--- a/docs/codeql/ql-training/cpp/bad-overflow-guard.rst
+++ b/docs/codeql/ql-training/cpp/bad-overflow-guard.rst
@@ -9,7 +9,7 @@ CodeQL for C/C++
Setup
=====
-For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `ChakraCore `__ from GitHub.
+For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `ChakraCore `__ from GitHub.
Checking for overflow in C
==========================
diff --git a/docs/codeql/ql-training/cpp/control-flow-cpp.rst b/docs/codeql/ql-training/cpp/control-flow-cpp.rst
index b18348509c2..d2bbc6a6af2 100644
--- a/docs/codeql/ql-training/cpp/control-flow-cpp.rst
+++ b/docs/codeql/ql-training/cpp/control-flow-cpp.rst
@@ -11,7 +11,7 @@ CodeQL for C/C++
Setup
=====
-For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `ChakraCore `__ from GitHub.
+For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `ChakraCore `__ from GitHub.
.. rst-class:: agenda
diff --git a/docs/codeql/ql-training/cpp/data-flow-cpp.rst b/docs/codeql/ql-training/cpp/data-flow-cpp.rst
index da4f287b392..e46f72596be 100644
--- a/docs/codeql/ql-training/cpp/data-flow-cpp.rst
+++ b/docs/codeql/ql-training/cpp/data-flow-cpp.rst
@@ -9,7 +9,7 @@ Finding string formatting vulnerabilities in C/C++
Setup
=====
-For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `dotnet/coreclr `__ from GitHub.
+For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `dotnet/coreclr `__ from GitHub.
.. rst-class:: agenda
diff --git a/docs/codeql/ql-training/cpp/global-data-flow-cpp.rst b/docs/codeql/ql-training/cpp/global-data-flow-cpp.rst
index a2391e40332..c0dc6923f67 100644
--- a/docs/codeql/ql-training/cpp/global-data-flow-cpp.rst
+++ b/docs/codeql/ql-training/cpp/global-data-flow-cpp.rst
@@ -9,7 +9,7 @@ CodeQL for C/C++
Setup
=====
-For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `dotnet/coreclr `__ from GitHub.
+For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `dotnet/coreclr `__ from GitHub.
.. rst-class:: agenda
diff --git a/docs/codeql/ql-training/cpp/intro-ql-cpp.rst b/docs/codeql/ql-training/cpp/intro-ql-cpp.rst
index dff2c50ec0c..005f847b846 100644
--- a/docs/codeql/ql-training/cpp/intro-ql-cpp.rst
+++ b/docs/codeql/ql-training/cpp/intro-ql-cpp.rst
@@ -9,7 +9,7 @@ CodeQL for C/C++
Setup
=====
-For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `exiv2 `__ from GitHub.
+For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `exiv2 `__ from GitHub.
.. Include language-agnostic section here
diff --git a/docs/codeql/ql-training/cpp/snprintf.rst b/docs/codeql/ql-training/cpp/snprintf.rst
index 58b2c31d2e4..d784d79f5f8 100644
--- a/docs/codeql/ql-training/cpp/snprintf.rst
+++ b/docs/codeql/ql-training/cpp/snprintf.rst
@@ -9,7 +9,7 @@ CodeQL for C/C++
Setup
=====
-For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `rsyslog `__ from GitHub.
+For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `rsyslog `__ from GitHub.
``snprintf``
============
diff --git a/docs/codeql/ql-training/java/apache-struts-java.rst b/docs/codeql/ql-training/java/apache-struts-java.rst
index 24186bda48f..4e5c4493db1 100644
--- a/docs/codeql/ql-training/java/apache-struts-java.rst
+++ b/docs/codeql/ql-training/java/apache-struts-java.rst
@@ -13,7 +13,7 @@ Exercise: Apache Struts
Setup
=====
-For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `Apache Struts `__ from GitHub.
+For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `Apache Struts `__ from GitHub.
Unsafe deserialization in Struts
================================
diff --git a/docs/codeql/ql-training/java/data-flow-java.rst b/docs/codeql/ql-training/java/data-flow-java.rst
index f55b25ff5ab..4353b618acf 100644
--- a/docs/codeql/ql-training/java/data-flow-java.rst
+++ b/docs/codeql/ql-training/java/data-flow-java.rst
@@ -9,7 +9,7 @@ Finding SPARQL injection vulnerabilities in Java
Setup
=====
-For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `VIVO Vitro `__ from GitHub.
+For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `VIVO Vitro `__ from GitHub.
.. rst-class:: agenda
diff --git a/docs/codeql/ql-training/java/global-data-flow-java.rst b/docs/codeql/ql-training/java/global-data-flow-java.rst
index ddee9645d17..67e71c03391 100644
--- a/docs/codeql/ql-training/java/global-data-flow-java.rst
+++ b/docs/codeql/ql-training/java/global-data-flow-java.rst
@@ -9,7 +9,7 @@ CodeQL for Java
Setup
=====
-For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `Apache Struts `__ from GitHub.
+For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `Apache Struts `__ from GitHub.
.. rst-class:: agenda
diff --git a/docs/codeql/ql-training/java/intro-ql-java.rst b/docs/codeql/ql-training/java/intro-ql-java.rst
index fec966e2fe4..38e311060ec 100644
--- a/docs/codeql/ql-training/java/intro-ql-java.rst
+++ b/docs/codeql/ql-training/java/intro-ql-java.rst
@@ -9,7 +9,7 @@ CodeQL for Java
Setup
=====
-For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `Apache Struts `__ from GitHub.
+For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `Apache Struts `__ from GitHub.
.. Include language-agnostic section here
diff --git a/docs/codeql/ql-training/java/query-injection-java.rst b/docs/codeql/ql-training/java/query-injection-java.rst
index a16ac49b6a3..d1f8c17288a 100644
--- a/docs/codeql/ql-training/java/query-injection-java.rst
+++ b/docs/codeql/ql-training/java/query-injection-java.rst
@@ -9,7 +9,7 @@ CodeQL for Java
Setup
=====
-For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `VIVO Vitro `__ from GitHub.
+For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `VIVO Vitro `__ from GitHub.
SQL injection
=============
diff --git a/docs/codeql/ql-training/template.rst b/docs/codeql/ql-training/template.rst
index 503ac757fdb..7d525d9e3b2 100644
--- a/docs/codeql/ql-training/template.rst
+++ b/docs/codeql/ql-training/template.rst
@@ -36,7 +36,7 @@ Setup
For this example you should download:
-- `CodeQL for Visual Studio Code `__
+- `CodeQL for Visual Studio Code `__
- A CodeQL database
.. note::
diff --git a/docs/codeql/reusables/deprecation-note.rst b/docs/codeql/reusables/deprecation-note.rst
new file mode 100644
index 00000000000..1cff31f2385
--- /dev/null
+++ b/docs/codeql/reusables/deprecation-note.rst
@@ -0,0 +1,6 @@
+.. pull-quote::
+
+ Note
+
+ This documentation has been migrated to docs.github.com/en/code-security/codeql-for-vs-code. This version is no longer maintained, and it will be removed on TODOCS.
+
\ No newline at end of file
diff --git a/docs/codeql/writing-codeql-queries/creating-path-queries.rst b/docs/codeql/writing-codeql-queries/creating-path-queries.rst
index 1e1b8d1f7a6..0ab162a59c2 100644
--- a/docs/codeql/writing-codeql-queries/creating-path-queries.rst
+++ b/docs/codeql/writing-codeql-queries/creating-path-queries.rst
@@ -20,7 +20,7 @@ This topic provides information on how to structure a path query file so you can
Note
- The alerts generated by path queries are included in the results generated using the `CodeQL CLI `__ and in `code scanning `__. You can also view the path explanations generated by your path query in the :ref:`CodeQL extension for VS Code `.
+ The alerts generated by path queries are included in the results generated using the `CodeQL CLI `__ and in `code scanning `__. You can also view the path explanations generated by your path query in the `CodeQL extension for VS Code `.
To learn more about modeling data flow with CodeQL, see ":doc:`About data flow analysis `."
@@ -171,7 +171,7 @@ Select clauses for path queries consist of four 'columns', with the following st
select element, source, sink, string
The ``element`` and ``string`` columns represent the location of the alert and the alert message respectively, as explained in ":doc:`About CodeQL queries `." The second and third columns, ``source`` and ``sink``, are nodes on the path graph selected by the query.
-Each result generated by your query is displayed at a single location in the same way as an alert query. Additionally, each result also has an associated path, which can be viewed in the :ref:`CodeQL extension for VS Code `.
+Each result generated by your query is displayed at a single location in the same way as an alert query. Additionally, each result also has an associated path, which can be viewed in the `CodeQL extension for VS Code `.
The ``element`` that you select in the first column depends on the purpose of the query and the type of issue that it is designed to find. This is particularly important for security issues. For example, if you believe the ``source`` value to be globally invalid or malicious it may be best to display the alert at the ``source``. In contrast, you should consider displaying the alert at the ``sink`` if you believe it is the element that requires sanitization.
diff --git a/docs/codeql/writing-codeql-queries/defining-the-results-of-a-query.rst b/docs/codeql/writing-codeql-queries/defining-the-results-of-a-query.rst
index 4e074bc411d..94a949ce076 100644
--- a/docs/codeql/writing-codeql-queries/defining-the-results-of-a-query.rst
+++ b/docs/codeql/writing-codeql-queries/defining-the-results-of-a-query.rst
@@ -9,7 +9,7 @@ About query results
-------------------
The information contained in the results of a query is controlled by the ``select`` statement. Part of the process of developing a useful query is to make the results clear and easy for other users to understand.
-When you write your own queries in the CodeQL :ref:`extension for VS Code ` there are no constraints on what can be selected.
+When you write your own queries in the CodeQL `extension for VS Code ` there are no constraints on what can be selected.
However, if you want to use a query to create alerts for code scanning or generate valid analysis results using the `CodeQL CLI `__, you'll need to make the ``select`` statement report results in the required format.
You must also ensure that the query has the appropriate metadata properties defined.
This topic explains how to write your select statement to generate helpful analysis results.
diff --git a/docs/codeql/writing-codeql-queries/introduction-to-ql.rst b/docs/codeql/writing-codeql-queries/introduction-to-ql.rst
index 04dccfc98b6..fa4736ec706 100644
--- a/docs/codeql/writing-codeql-queries/introduction-to-ql.rst
+++ b/docs/codeql/writing-codeql-queries/introduction-to-ql.rst
@@ -19,7 +19,7 @@ QL also supports recursion and aggregates. This allows you to write complex recu
Running a query
---------------
-You can try out the following examples and exercises using :ref:`CodeQL for VS Code ` or the `CodeQL template `__ on GitHub Codespaces.
+You can try out the following examples and exercises using `CodeQL for VS Code ` or the `CodeQL template `__ on GitHub Codespaces.
Here is an example of a basic query:
@@ -114,7 +114,7 @@ The following example queries *do* use these databases and give you an idea of h
Queries using the CodeQL libraries can find errors and uncover variants of important security vulnerabilities in codebases.
Visit `GitHub Security Lab `__ to read about examples of vulnerabilities that we have recently found in open source projects.
-Before you can run the following examples, you will need to install the CodeQL extension for Visual Studio Code. For more information, see :ref:`Setting up CodeQL in Visual Studio Code `. You will also need to import and select a database in the corresponding programming language. For more information about obtaining CodeQL databases, see `Analyzing your projects `__ in the CodeQL for VS Code documentation.
+Before you can run the following examples, you will need to install the CodeQL extension for Visual Studio Code. For more information, see :ref:`Setting up CodeQL in Visual Studio Code `. You will also need to import and select a database in the corresponding programming language. For more information about obtaining CodeQL databases, see `Managing CodeQL databases `__ in the CodeQL for VS Code documentation.
To import the CodeQL library for a specific programming language, type ``import `` at the start of the query.
diff --git a/docs/codeql/writing-codeql-queries/metadata-for-codeql-queries.rst b/docs/codeql/writing-codeql-queries/metadata-for-codeql-queries.rst
index 16a0eba56c2..731a5195ae7 100644
--- a/docs/codeql/writing-codeql-queries/metadata-for-codeql-queries.rst
+++ b/docs/codeql/writing-codeql-queries/metadata-for-codeql-queries.rst
@@ -9,7 +9,7 @@ About query metadata
--------------------
Any query that is run as part of an analysis includes a number of properties, known as query metadata. Metadata is included at the top of each query file as the content of a QLDoc comment.
-This metadata tells the CodeQL :ref:`extension for VS Code ` and the `Code scanning feature in GitHub `__ how to handle the query and display its results correctly.
+This metadata tells the CodeQL `extension for VS Code ` and the `Code scanning feature in GitHub `__ how to handle the query and display its results correctly.
It also gives other users information about what the query results mean. For more information on query metadata, see the `query metadata style guide `__ in our `open source repository `__ on GitHub.
.. pull-quote::
diff --git a/docs/ql-style-guide.md b/docs/ql-style-guide.md
index 29a427fdfae..7018719bb13 100644
--- a/docs/ql-style-guide.md
+++ b/docs/ql-style-guide.md
@@ -3,7 +3,7 @@
## Introduction
This document describes how to format the code you contribute to this repository. It covers aspects such as layout, white-space, naming, and documentation. Adhering to consistent standards makes code easier to read and maintain. Of course, these are only guidelines, and can be overridden as the need arises on a case-by-case basis. Where existing code deviates from these guidelines, prefer consistency with the surrounding code.
-Note, if you use [CodeQL for Visual Studio Code](https://codeql.github.com/docs/codeql-for-visual-studio-code/about-codeql-for-visual-studio-code/), you can autoformat your query in the editor.
+Note, if you use [CodeQL for Visual Studio Code](https://docs.github.com/en/code-security/codeql-for-vs-code/), you can autoformat your query in the editor.
Words in *italic* are defined in the [Glossary](#glossary).
diff --git a/docs/supported-queries.md b/docs/supported-queries.md
index 3529866d461..4335d819413 100644
--- a/docs/supported-queries.md
+++ b/docs/supported-queries.md
@@ -45,7 +45,7 @@ The process must begin with the first step and must conclude with the final step
- Understand [the evaluation model of QL](https://codeql.github.com/docs/ql-language-reference/evaluation-of-ql-programs/). It's more similar to SQL than to any mainstream programming language.
- Most performance tuning in QL boils down to computing as few tuples (rows of data) as possible. As a mental model, think of predicate evaluation as enumerating all combinations of parameters that satisfy the predicate body. This includes the implicit parameters `this` and `result`.
- The major libraries in CodeQL are _cached_ and will only be computed once for the entire suite of queries. The first query that needs a cached _stage_ will trigger its evaluation. This means that query authors should usually only look at the run time of the last stage of evaluation.
- - In [the settings for the VSCode extension](https://codeql.github.com/docs/codeql-for-visual-studio-code/customizing-settings/), check the box "Running Queries: Debug" (`codeQL.runningQueries.debug`). Then find "CodeQL Query Server" in the VSCode Output panel (View -> Output) and capture the output when running the query. That output contains timing and tuple counts for all computed predicates.
+ - In [the settings for the VSCode extension](https://docs.github.com/en/code-security/codeql-for-vs-code/using-the-advanced-functionality-of-the-codeql-for-vs-code-extension/customizing-settings), check the box "Running Queries: Debug" (`codeQL.runningQueries.debug`). Then find "CodeQL Query Server" in the VSCode Output panel (View -> Output) and capture the output when running the query. That output contains timing and tuple counts for all computed predicates.
- To clear the entire cache, invoke "CodeQL: Clear Cache" from the VSCode command palette.
6. **Make sure your query has the correct metadata**
diff --git a/go/CONTRIBUTING.md b/go/CONTRIBUTING.md
index 801d856e53e..38dffd1d754 100644
--- a/go/CONTRIBUTING.md
+++ b/go/CONTRIBUTING.md
@@ -33,7 +33,7 @@ Follow the steps below to help other users understand what your query does, and
2. **Format your code correctly**
- All of the standard CodeQL queries and libraries are uniformly formatted for clarity and consistency, so we strongly recommend that all contributions follow the same formatting guidelines. If you use the CodeQL extension for Visual Studio Code, you can auto-format your query using the [Format Document command](https://codeql.github.com/docs/codeql-for-visual-studio-code/about-codeql-for-visual-studio-code/). For more information, see the [QL style guide](https://github.com/github/codeql/blob/main/docs/ql-style-guide.md).
+ All of the standard CodeQL queries and libraries are uniformly formatted for clarity and consistency, so we strongly recommend that all contributions follow the same formatting guidelines. If you use the CodeQL extension for Visual Studio Code, you can auto-format your query using the [Format Document command](https://docs.github.com/en/code-security/codeql-for-vs-code/). For more information, see the [QL style guide](https://github.com/github/codeql/blob/main/docs/ql-style-guide.md).
3. **Make sure your query has the correct metadata**
diff --git a/go/ql/docs/experimental.md b/go/ql/docs/experimental.md
index bef435d6674..ea5ed312fb5 100644
--- a/go/ql/docs/experimental.md
+++ b/go/ql/docs/experimental.md
@@ -21,7 +21,7 @@ Experimental queries and libraries may not be actively maintained as the standar
3. **Formatting**
- - The queries and libraries must be [autoformatted](https://codeql.github.com/docs/codeql-for-visual-studio-code/about-codeql-for-visual-studio-code/).
+ - The queries and libraries must be [autoformatted](https://docs.github.com/en/code-security/codeql-for-vs-code/).
4. **Compilation**
diff --git a/python/ql/src/CHANGELOG.md b/python/ql/src/CHANGELOG.md
index ef271f0654d..a980559ca8e 100644
--- a/python/ql/src/CHANGELOG.md
+++ b/python/ql/src/CHANGELOG.md
@@ -277,7 +277,7 @@ No user-facing changes.
### Bug Fixes
-* The [View AST functionality](https://codeql.github.com/docs/codeql-for-visual-studio-code/exploring-the-structure-of-your-source-code/) no longer prints detailed information about regular expressions, greatly improving performance.
+* The [View AST functionality](https://docs.github.com/en/code-security/codeql-for-vs-code/) no longer prints detailed information about regular expressions, greatly improving performance.
## 0.0.8
diff --git a/python/ql/src/change-notes/released/0.0.9.md b/python/ql/src/change-notes/released/0.0.9.md
index 1136727b684..d50d846f53e 100644
--- a/python/ql/src/change-notes/released/0.0.9.md
+++ b/python/ql/src/change-notes/released/0.0.9.md
@@ -2,4 +2,4 @@
### Bug Fixes
-* The [View AST functionality](https://codeql.github.com/docs/codeql-for-visual-studio-code/exploring-the-structure-of-your-source-code/) no longer prints detailed information about regular expressions, greatly improving performance.
+* The [View AST functionality](https://docs.github.com/en/code-security/codeql-for-vs-code/using-the-advanced-functionality-of-the-codeql-for-vs-code-extension/exploring-the-structure-of-your-source-code) no longer prints detailed information about regular expressions, greatly improving performance.
From 037211c4a4edf39aa923bc2caec33503c9296af7 Mon Sep 17 00:00:00 2001
From: Ben Ahmady <32935794+subatoi@users.noreply.github.com>
Date: Thu, 25 Apr 2024 08:10:27 +0000
Subject: [PATCH 006/118] Add formatting fixes
---
.../codeql/codeql-language-guides/codeql-library-for-ruby.rst | 2 +-
docs/codeql/codeql-overview/about-codeql.rst | 2 +-
.../codeql-overview/codeql-changelog/codeql-cli-2.8.1.rst | 2 +-
docs/codeql/codeql-overview/codeql-tools.rst | 2 +-
docs/codeql/reusables/deprecation-note.rst | 2 +-
docs/codeql/writing-codeql-queries/creating-path-queries.rst | 4 ++--
.../defining-the-results-of-a-query.rst | 2 +-
docs/codeql/writing-codeql-queries/introduction-to-ql.rst | 4 ++--
.../writing-codeql-queries/metadata-for-codeql-queries.rst | 2 +-
docs/supported-queries.md | 2 +-
10 files changed, 12 insertions(+), 12 deletions(-)
diff --git a/docs/codeql/codeql-language-guides/codeql-library-for-ruby.rst b/docs/codeql/codeql-language-guides/codeql-library-for-ruby.rst
index 9d8f218edca..2ff7a62b2ac 100644
--- a/docs/codeql/codeql-language-guides/codeql-library-for-ruby.rst
+++ b/docs/codeql/codeql-language-guides/codeql-library-for-ruby.rst
@@ -73,7 +73,7 @@ The CodeQL examples in this article are only excerpts and are not meant to repre
Abstract syntax
---------------
-The abstract syntax tree (AST) represents the elements of the source code organized into a tree. The `AST viewer `__
+The abstract syntax tree (AST) represents the elements of the source code organized into a tree. The `AST viewer `__
in Visual Studio Code shows the AST nodes, including the relevant CodeQL classes and predicates.
All CodeQL AST classes inherit from the `AstNode` class, which provides the following member predicates
diff --git a/docs/codeql/codeql-overview/about-codeql.rst b/docs/codeql/codeql-overview/about-codeql.rst
index db48990e96c..eccc81c8754 100644
--- a/docs/codeql/codeql-overview/about-codeql.rst
+++ b/docs/codeql/codeql-overview/about-codeql.rst
@@ -71,7 +71,7 @@ After you've created a CodeQL database, one or more queries are executed
against it. CodeQL queries are written in a specially-designed object-oriented
query language called QL. You can run the queries checked out from the CodeQL
repo (or custom queries that you've written yourself) using the `CodeQL
-for VS Code extension ` or the `CodeQL CLI
+for VS Code extension `__ or the `CodeQL CLI
`__. For more information about queries, see ":ref:`About CodeQL queries `."
.. _interpret-query-results:
diff --git a/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.8.1.rst b/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.8.1.rst
index 5197b2f6165..c59a3e6498e 100644
--- a/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.8.1.rst
+++ b/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.8.1.rst
@@ -82,7 +82,7 @@ Bug Fixes
Python
""""""
-* The `View AST functionality `__ no longer prints detailed information about regular expressions, greatly improving performance.
+* The `View AST functionality `__ no longer prints detailed information about regular expressions, greatly improving performance.
Minor Analysis Improvements
~~~~~~~~~~~~~~~~~~~~~~~~~~~
diff --git a/docs/codeql/codeql-overview/codeql-tools.rst b/docs/codeql/codeql-overview/codeql-tools.rst
index 0adb630bf25..d58730e4702 100644
--- a/docs/codeql/codeql-overview/codeql-tools.rst
+++ b/docs/codeql/codeql-overview/codeql-tools.rst
@@ -54,4 +54,4 @@ CodeQL for Visual Studio Code
You can analyze CodeQL databases in Visual Studio Code using the CodeQL
extension, which provides an enhanced environment for writing and running custom
queries and viewing the results. For more information, see "`CodeQL
-for Visual Studio Code `."
\ No newline at end of file
+for Visual Studio Code `__."
\ No newline at end of file
diff --git a/docs/codeql/reusables/deprecation-note.rst b/docs/codeql/reusables/deprecation-note.rst
index 1cff31f2385..3019939baa1 100644
--- a/docs/codeql/reusables/deprecation-note.rst
+++ b/docs/codeql/reusables/deprecation-note.rst
@@ -2,5 +2,5 @@
Note
- This documentation has been migrated to docs.github.com/en/code-security/codeql-for-vs-code. This version is no longer maintained, and it will be removed on TODOCS.
+ This documentation was migrated to docs.github.com/en/code-security/codeql-for-vs-code on 2024/05/08, and this version is no longer maintained.
\ No newline at end of file
diff --git a/docs/codeql/writing-codeql-queries/creating-path-queries.rst b/docs/codeql/writing-codeql-queries/creating-path-queries.rst
index 0ab162a59c2..41f0683594c 100644
--- a/docs/codeql/writing-codeql-queries/creating-path-queries.rst
+++ b/docs/codeql/writing-codeql-queries/creating-path-queries.rst
@@ -20,7 +20,7 @@ This topic provides information on how to structure a path query file so you can
Note
- The alerts generated by path queries are included in the results generated using the `CodeQL CLI `__ and in `code scanning `__. You can also view the path explanations generated by your path query in the `CodeQL extension for VS Code `.
+ The alerts generated by path queries are included in the results generated using the `CodeQL CLI `__ and in `code scanning `__. You can also view the path explanations generated by your path query in the `CodeQL extension for VS Code `__.
To learn more about modeling data flow with CodeQL, see ":doc:`About data flow analysis `."
@@ -171,7 +171,7 @@ Select clauses for path queries consist of four 'columns', with the following st
select element, source, sink, string
The ``element`` and ``string`` columns represent the location of the alert and the alert message respectively, as explained in ":doc:`About CodeQL queries `." The second and third columns, ``source`` and ``sink``, are nodes on the path graph selected by the query.
-Each result generated by your query is displayed at a single location in the same way as an alert query. Additionally, each result also has an associated path, which can be viewed in the `CodeQL extension for VS Code `.
+Each result generated by your query is displayed at a single location in the same way as an alert query. Additionally, each result also has an associated path, which can be viewed in the `CodeQL extension for VS Code `__.
The ``element`` that you select in the first column depends on the purpose of the query and the type of issue that it is designed to find. This is particularly important for security issues. For example, if you believe the ``source`` value to be globally invalid or malicious it may be best to display the alert at the ``source``. In contrast, you should consider displaying the alert at the ``sink`` if you believe it is the element that requires sanitization.
diff --git a/docs/codeql/writing-codeql-queries/defining-the-results-of-a-query.rst b/docs/codeql/writing-codeql-queries/defining-the-results-of-a-query.rst
index 94a949ce076..560505506f2 100644
--- a/docs/codeql/writing-codeql-queries/defining-the-results-of-a-query.rst
+++ b/docs/codeql/writing-codeql-queries/defining-the-results-of-a-query.rst
@@ -9,7 +9,7 @@ About query results
-------------------
The information contained in the results of a query is controlled by the ``select`` statement. Part of the process of developing a useful query is to make the results clear and easy for other users to understand.
-When you write your own queries in the CodeQL `extension for VS Code ` there are no constraints on what can be selected.
+When you write your own queries in the CodeQL `extension for VS Code `__ there are no constraints on what can be selected.
However, if you want to use a query to create alerts for code scanning or generate valid analysis results using the `CodeQL CLI `__, you'll need to make the ``select`` statement report results in the required format.
You must also ensure that the query has the appropriate metadata properties defined.
This topic explains how to write your select statement to generate helpful analysis results.
diff --git a/docs/codeql/writing-codeql-queries/introduction-to-ql.rst b/docs/codeql/writing-codeql-queries/introduction-to-ql.rst
index fa4736ec706..203f590f761 100644
--- a/docs/codeql/writing-codeql-queries/introduction-to-ql.rst
+++ b/docs/codeql/writing-codeql-queries/introduction-to-ql.rst
@@ -19,7 +19,7 @@ QL also supports recursion and aggregates. This allows you to write complex recu
Running a query
---------------
-You can try out the following examples and exercises using `CodeQL for VS Code ` or the `CodeQL template `__ on GitHub Codespaces.
+You can try out the following examples and exercises using `CodeQL for VS Code `__ or the `CodeQL template `__ on GitHub Codespaces.
Here is an example of a basic query:
@@ -114,7 +114,7 @@ The following example queries *do* use these databases and give you an idea of h
Queries using the CodeQL libraries can find errors and uncover variants of important security vulnerabilities in codebases.
Visit `GitHub Security Lab `__ to read about examples of vulnerabilities that we have recently found in open source projects.
-Before you can run the following examples, you will need to install the CodeQL extension for Visual Studio Code. For more information, see :ref:`Setting up CodeQL in Visual Studio Code `. You will also need to import and select a database in the corresponding programming language. For more information about obtaining CodeQL databases, see `Managing CodeQL databases `__ in the CodeQL for VS Code documentation.
+Before you can run the following examples, you will need to install the CodeQL extension for Visual Studio Code. For more information, see :ref:`Setting up CodeQL in Visual Studio Code `. You will also need to import and select a database in the corresponding programming language. For more information about obtaining CodeQL databases, see `Managing CodeQL databases `__ in the CodeQL for VS Code documentation.
To import the CodeQL library for a specific programming language, type ``import `` at the start of the query.
diff --git a/docs/codeql/writing-codeql-queries/metadata-for-codeql-queries.rst b/docs/codeql/writing-codeql-queries/metadata-for-codeql-queries.rst
index 731a5195ae7..34907e3910c 100644
--- a/docs/codeql/writing-codeql-queries/metadata-for-codeql-queries.rst
+++ b/docs/codeql/writing-codeql-queries/metadata-for-codeql-queries.rst
@@ -9,7 +9,7 @@ About query metadata
--------------------
Any query that is run as part of an analysis includes a number of properties, known as query metadata. Metadata is included at the top of each query file as the content of a QLDoc comment.
-This metadata tells the CodeQL `extension for VS Code ` and the `Code scanning feature in GitHub `__ how to handle the query and display its results correctly.
+This metadata tells the CodeQL `extension for VS Code `__ and the `Code scanning feature in GitHub `__ how to handle the query and display its results correctly.
It also gives other users information about what the query results mean. For more information on query metadata, see the `query metadata style guide `__ in our `open source repository `__ on GitHub.
.. pull-quote::
diff --git a/docs/supported-queries.md b/docs/supported-queries.md
index 4335d819413..fa4cf1ea5d8 100644
--- a/docs/supported-queries.md
+++ b/docs/supported-queries.md
@@ -45,7 +45,7 @@ The process must begin with the first step and must conclude with the final step
- Understand [the evaluation model of QL](https://codeql.github.com/docs/ql-language-reference/evaluation-of-ql-programs/). It's more similar to SQL than to any mainstream programming language.
- Most performance tuning in QL boils down to computing as few tuples (rows of data) as possible. As a mental model, think of predicate evaluation as enumerating all combinations of parameters that satisfy the predicate body. This includes the implicit parameters `this` and `result`.
- The major libraries in CodeQL are _cached_ and will only be computed once for the entire suite of queries. The first query that needs a cached _stage_ will trigger its evaluation. This means that query authors should usually only look at the run time of the last stage of evaluation.
- - In [the settings for the VSCode extension](https://docs.github.com/en/code-security/codeql-for-vs-code/using-the-advanced-functionality-of-the-codeql-for-vs-code-extension/customizing-settings), check the box "Running Queries: Debug" (`codeQL.runningQueries.debug`). Then find "CodeQL Query Server" in the VSCode Output panel (View -> Output) and capture the output when running the query. That output contains timing and tuple counts for all computed predicates.
+ - In [the settings for the VSCode extension](https://docs.github.com/en/code-security/codeql-for-vs-code/using-the-advanced-functionality-of-the-codeql-for-vs-code-extension/customizing-settings/), check the box "Running Queries: Debug" (`codeQL.runningQueries.debug`). Then find "CodeQL Query Server" in the VSCode Output panel (View -> Output) and capture the output when running the query. That output contains timing and tuple counts for all computed predicates.
- To clear the entire cache, invoke "CodeQL: Clear Cache" from the VSCode command palette.
6. **Make sure your query has the correct metadata**
From be9009d653c32fd8c8b85060418286fc3bd3170e Mon Sep 17 00:00:00 2001
From: Ben Ahmady <32935794+subatoi@users.noreply.github.com>
Date: Thu, 25 Apr 2024 08:16:48 +0000
Subject: [PATCH 007/118] Use clearer filename
---
.../about-codeql-for-visual-studio-code.rst | 2 +-
.../about-telemetry-in-codeql-for-visual-studio-code.rst | 2 +-
.../codeql-for-visual-studio-code/analyzing-your-projects.rst | 2 +-
.../codeql-for-visual-studio-code/customizing-settings.rst | 2 +-
.../exploring-data-flow-with-path-queries.rst | 2 +-
.../exploring-the-structure-of-your-source-code.rst | 2 +-
docs/codeql/codeql-for-visual-studio-code/index.rst | 2 +-
.../running-codeql-queries-at-scale-with-mrva.rst | 2 +-
.../setting-up-codeql-in-visual-studio-code.rst | 2 +-
.../testing-codeql-queries-in-visual-studio-code.rst | 2 +-
.../troubleshooting-codeql-for-visual-studio-code.rst | 2 +-
.../troubleshooting-variant-analysis.rst | 2 +-
.../using-the-codeql-model-editor.rst | 2 +-
.../working-with-codeql-packs-in-visual-studio-code.rst | 2 +-
.../{deprecation-note.rst => vs-code-deprecation-note.rst} | 0
15 files changed, 14 insertions(+), 14 deletions(-)
rename docs/codeql/reusables/{deprecation-note.rst => vs-code-deprecation-note.rst} (100%)
diff --git a/docs/codeql/codeql-for-visual-studio-code/about-codeql-for-visual-studio-code.rst b/docs/codeql/codeql-for-visual-studio-code/about-codeql-for-visual-studio-code.rst
index f0dfbe29017..c763092ddac 100644
--- a/docs/codeql/codeql-for-visual-studio-code/about-codeql-for-visual-studio-code.rst
+++ b/docs/codeql/codeql-for-visual-studio-code/about-codeql-for-visual-studio-code.rst
@@ -5,7 +5,7 @@
About CodeQL for Visual Studio Code
=================================================
-.. include:: ../reusables/deprecation-note.rst
+.. include:: ../reusables/vs-code-deprecation-note.rst
CodeQL for Visual Studio Code is an extension that lets you write, run, and test CodeQL queries in Visual Studio Code.
diff --git a/docs/codeql/codeql-for-visual-studio-code/about-telemetry-in-codeql-for-visual-studio-code.rst b/docs/codeql/codeql-for-visual-studio-code/about-telemetry-in-codeql-for-visual-studio-code.rst
index 832e6d4e856..03af3e675c3 100644
--- a/docs/codeql/codeql-for-visual-studio-code/about-telemetry-in-codeql-for-visual-studio-code.rst
+++ b/docs/codeql/codeql-for-visual-studio-code/about-telemetry-in-codeql-for-visual-studio-code.rst
@@ -5,7 +5,7 @@
About telemetry in CodeQL for Visual Studio Code
=================================================
-.. include:: ../reusables/deprecation-note.rst
+.. include:: ../reusables/vs-code-deprecation-note.rst
If you specifically opt in to permit GitHub to do so, GitHub will collect usage data and metrics for the purposes of helping the core developers to improve the CodeQL extension for VS Code.
diff --git a/docs/codeql/codeql-for-visual-studio-code/analyzing-your-projects.rst b/docs/codeql/codeql-for-visual-studio-code/analyzing-your-projects.rst
index dea8007c460..4dca293308b 100644
--- a/docs/codeql/codeql-for-visual-studio-code/analyzing-your-projects.rst
+++ b/docs/codeql/codeql-for-visual-studio-code/analyzing-your-projects.rst
@@ -5,7 +5,7 @@
Analyzing your projects
=================================================
-.. include:: ../reusables/deprecation-note.rst
+.. include:: ../reusables/vs-code-deprecation-note.rst
You can run queries on CodeQL databases and view the results in Visual Studio Code. This article explains how to get a CodeQL database and analyze it on your local machine. For information on running analysis at scale across many CodeQL databases, see ":ref:`Running CodeQL queries at scale with multi-repository variant analysis `."
diff --git a/docs/codeql/codeql-for-visual-studio-code/customizing-settings.rst b/docs/codeql/codeql-for-visual-studio-code/customizing-settings.rst
index 737024861a6..4a5f6e324de 100644
--- a/docs/codeql/codeql-for-visual-studio-code/customizing-settings.rst
+++ b/docs/codeql/codeql-for-visual-studio-code/customizing-settings.rst
@@ -5,7 +5,7 @@
Customizing settings
====================
-.. include:: ../reusables/deprecation-note.rst
+.. include:: ../reusables/vs-code-deprecation-note.rst
You can edit the settings for the CodeQL extension to suit your needs.
diff --git a/docs/codeql/codeql-for-visual-studio-code/exploring-data-flow-with-path-queries.rst b/docs/codeql/codeql-for-visual-studio-code/exploring-data-flow-with-path-queries.rst
index 9975d06b0eb..26f48dd561c 100644
--- a/docs/codeql/codeql-for-visual-studio-code/exploring-data-flow-with-path-queries.rst
+++ b/docs/codeql/codeql-for-visual-studio-code/exploring-data-flow-with-path-queries.rst
@@ -5,7 +5,7 @@
Exploring data flow with path queries
=====================================
-.. include:: ../reusables/deprecation-note.rst
+.. include:: ../reusables/vs-code-deprecation-note.rst
You can run CodeQL queries in VS Code to help you track the flow of data through a program, highlighting areas that are potential security vulnerabilities.
diff --git a/docs/codeql/codeql-for-visual-studio-code/exploring-the-structure-of-your-source-code.rst b/docs/codeql/codeql-for-visual-studio-code/exploring-the-structure-of-your-source-code.rst
index 9494902d24e..51056f8d2e7 100644
--- a/docs/codeql/codeql-for-visual-studio-code/exploring-the-structure-of-your-source-code.rst
+++ b/docs/codeql/codeql-for-visual-studio-code/exploring-the-structure-of-your-source-code.rst
@@ -5,7 +5,7 @@
Exploring the structure of your source code
=================================================
-.. include:: ../reusables/deprecation-note.rst
+.. include:: ../reusables/vs-code-deprecation-note.rst
You can use the AST viewer to display the abstract syntax tree of a CodeQL database.
diff --git a/docs/codeql/codeql-for-visual-studio-code/index.rst b/docs/codeql/codeql-for-visual-studio-code/index.rst
index 6207d37b286..36089de079c 100644
--- a/docs/codeql/codeql-for-visual-studio-code/index.rst
+++ b/docs/codeql/codeql-for-visual-studio-code/index.rst
@@ -3,7 +3,7 @@
CodeQL for Visual Studio Code
=============================
-.. include:: ../reusables/deprecation-note.rst
+.. include:: ../reusables/vs-code-deprecation-note.rst
The CodeQL extension for Visual Studio Code adds rich language support for CodeQL and allows you to easily find problems in codebases.
diff --git a/docs/codeql/codeql-for-visual-studio-code/running-codeql-queries-at-scale-with-mrva.rst b/docs/codeql/codeql-for-visual-studio-code/running-codeql-queries-at-scale-with-mrva.rst
index 2c591c68948..19d44312a5e 100644
--- a/docs/codeql/codeql-for-visual-studio-code/running-codeql-queries-at-scale-with-mrva.rst
+++ b/docs/codeql/codeql-for-visual-studio-code/running-codeql-queries-at-scale-with-mrva.rst
@@ -5,7 +5,7 @@
Running CodeQL queries at scale with multi-repository variant analysis
======================================================================
-.. include:: ../reusables/deprecation-note.rst
+.. include:: ../reusables/vs-code-deprecation-note.rst
.. include:: ../reusables/beta-note-mrva.rst
diff --git a/docs/codeql/codeql-for-visual-studio-code/setting-up-codeql-in-visual-studio-code.rst b/docs/codeql/codeql-for-visual-studio-code/setting-up-codeql-in-visual-studio-code.rst
index fd553d49ab9..94b291a69b8 100644
--- a/docs/codeql/codeql-for-visual-studio-code/setting-up-codeql-in-visual-studio-code.rst
+++ b/docs/codeql/codeql-for-visual-studio-code/setting-up-codeql-in-visual-studio-code.rst
@@ -5,7 +5,7 @@
Setting up CodeQL in Visual Studio Code
=================================================
-.. include:: ../reusables/deprecation-note.rst
+.. include:: ../reusables/vs-code-deprecation-note.rst
You can install and configure the CodeQL extension in Visual Studio Code.
diff --git a/docs/codeql/codeql-for-visual-studio-code/testing-codeql-queries-in-visual-studio-code.rst b/docs/codeql/codeql-for-visual-studio-code/testing-codeql-queries-in-visual-studio-code.rst
index 8f77e0110bc..67f45203b47 100644
--- a/docs/codeql/codeql-for-visual-studio-code/testing-codeql-queries-in-visual-studio-code.rst
+++ b/docs/codeql/codeql-for-visual-studio-code/testing-codeql-queries-in-visual-studio-code.rst
@@ -5,7 +5,7 @@
Testing CodeQL queries in Visual Studio Code
============================================
-.. include:: ../reusables/deprecation-note.rst
+.. include:: ../reusables/vs-code-deprecation-note.rst
You can run unit tests for CodeQL queries using the Visual Studio Code extension. When you are sure that your query finds the results you want to identify, you can use variant analysis to run it at scale. For information on running analysis at scale across many CodeQL databases, see ":ref:`Running CodeQL queries at scale with multi-repository variant analysis `."
diff --git a/docs/codeql/codeql-for-visual-studio-code/troubleshooting-codeql-for-visual-studio-code.rst b/docs/codeql/codeql-for-visual-studio-code/troubleshooting-codeql-for-visual-studio-code.rst
index cdd6579b6aa..6b81bd5bd83 100644
--- a/docs/codeql/codeql-for-visual-studio-code/troubleshooting-codeql-for-visual-studio-code.rst
+++ b/docs/codeql/codeql-for-visual-studio-code/troubleshooting-codeql-for-visual-studio-code.rst
@@ -5,7 +5,7 @@
Troubleshooting CodeQL for Visual Studio Code
=============================================
-.. include:: ../reusables/deprecation-note.rst
+.. include:: ../reusables/vs-code-deprecation-note.rst
This article explains how to debug problems with the analysis of CodeQL databases that are stored on your local
machine. For information on troubleshooting variant analysis, which runs on GitHub.com, see
diff --git a/docs/codeql/codeql-for-visual-studio-code/troubleshooting-variant-analysis.rst b/docs/codeql/codeql-for-visual-studio-code/troubleshooting-variant-analysis.rst
index f052bb1722c..1b0613accf1 100644
--- a/docs/codeql/codeql-for-visual-studio-code/troubleshooting-variant-analysis.rst
+++ b/docs/codeql/codeql-for-visual-studio-code/troubleshooting-variant-analysis.rst
@@ -5,7 +5,7 @@
Troubleshooting variant analysis
================================
-.. include:: ../reusables/deprecation-note.rst
+.. include:: ../reusables/vs-code-deprecation-note.rst
.. include:: ../reusables/beta-note-mrva.rst
diff --git a/docs/codeql/codeql-for-visual-studio-code/using-the-codeql-model-editor.rst b/docs/codeql/codeql-for-visual-studio-code/using-the-codeql-model-editor.rst
index 5c61e780da5..c74fc247e00 100644
--- a/docs/codeql/codeql-for-visual-studio-code/using-the-codeql-model-editor.rst
+++ b/docs/codeql/codeql-for-visual-studio-code/using-the-codeql-model-editor.rst
@@ -5,7 +5,7 @@
Using the CodeQL model editor
=============================
-.. include:: ../reusables/deprecation-note.rst
+.. include:: ../reusables/vs-code-deprecation-note.rst
.. include:: ../reusables/beta-note-model-pack-editor-vsc.rst
diff --git a/docs/codeql/codeql-for-visual-studio-code/working-with-codeql-packs-in-visual-studio-code.rst b/docs/codeql/codeql-for-visual-studio-code/working-with-codeql-packs-in-visual-studio-code.rst
index a652021b1c3..11b866cf78c 100644
--- a/docs/codeql/codeql-for-visual-studio-code/working-with-codeql-packs-in-visual-studio-code.rst
+++ b/docs/codeql/codeql-for-visual-studio-code/working-with-codeql-packs-in-visual-studio-code.rst
@@ -5,7 +5,7 @@
Working with CodeQL packs in Visual Studio Code
===============================================
-.. include:: ../reusables/deprecation-note.rst
+.. include:: ../reusables/vs-code-deprecation-note.rst
.. include:: ../reusables/beta-note-package-management.rst
diff --git a/docs/codeql/reusables/deprecation-note.rst b/docs/codeql/reusables/vs-code-deprecation-note.rst
similarity index 100%
rename from docs/codeql/reusables/deprecation-note.rst
rename to docs/codeql/reusables/vs-code-deprecation-note.rst
From 7d9a68bf173511af23c94bbd04560c42a123dc09 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Fri, 26 Apr 2024 11:19:22 +0200
Subject: [PATCH 008/118] Go: wrap gazelle to regenerate from scratch and add
header
---
go/extractor/autobuilder/BUILD.bazel | 2 ++
go/extractor/cli/go-autobuilder/BUILD.bazel | 2 ++
go/extractor/cli/go-bootstrap/BUILD.bazel | 2 ++
go/extractor/cli/go-build-runner/BUILD.bazel | 2 ++
go/extractor/cli/go-extractor/BUILD.bazel | 2 ++
go/extractor/cli/go-gen-dbscheme/BUILD.bazel | 2 ++
go/extractor/cli/go-tokenizer/BUILD.bazel | 2 ++
go/extractor/dbscheme/BUILD.bazel | 2 ++
go/extractor/diagnostics/BUILD.bazel | 2 ++
go/extractor/project/BUILD.bazel | 2 ++
go/extractor/srcarchive/BUILD.bazel | 2 ++
go/extractor/toolchain/BUILD.bazel | 2 ++
go/extractor/trap/BUILD.bazel | 2 ++
go/extractor/util/BUILD.bazel | 2 ++
.../x/mod/internal/lazyregexp/BUILD.bazel | 2 ++
.../vendor/golang.org/x/mod/modfile/BUILD.bazel | 2 ++
.../vendor/golang.org/x/mod/module/BUILD.bazel | 2 ++
.../vendor/golang.org/x/mod/semver/BUILD.bazel | 2 ++
.../x/tools/go/gcexportdata/BUILD.bazel | 2 ++
.../tools/go/internal/packagesdriver/BUILD.bazel | 2 ++
.../golang.org/x/tools/go/packages/BUILD.bazel | 2 ++
.../x/tools/go/types/objectpath/BUILD.bazel | 2 ++
.../x/tools/internal/event/BUILD.bazel | 2 ++
.../x/tools/internal/event/core/BUILD.bazel | 2 ++
.../x/tools/internal/event/keys/BUILD.bazel | 2 ++
.../x/tools/internal/event/label/BUILD.bazel | 2 ++
.../x/tools/internal/event/tag/BUILD.bazel | 2 ++
.../x/tools/internal/gcimporter/BUILD.bazel | 2 ++
.../x/tools/internal/gocommand/BUILD.bazel | 2 ++
.../tools/internal/packagesinternal/BUILD.bazel | 2 ++
.../x/tools/internal/pkgbits/BUILD.bazel | 2 ++
.../x/tools/internal/tokeninternal/BUILD.bazel | 2 ++
.../x/tools/internal/typeparams/BUILD.bazel | 2 ++
.../x/tools/internal/typesinternal/BUILD.bazel | 2 ++
.../x/tools/internal/versions/BUILD.bazel | 2 ++
go/gazelle/BUILD.bazel | 13 +++++++++----
go/gazelle/gazelle.py | 16 ++++++++++++++++
37 files changed, 95 insertions(+), 4 deletions(-)
create mode 100644 go/gazelle/gazelle.py
diff --git a/go/extractor/autobuilder/BUILD.bazel b/go/extractor/autobuilder/BUILD.bazel
index b81b15816aa..e40dc3a0321 100644
--- a/go/extractor/autobuilder/BUILD.bazel
+++ b/go/extractor/autobuilder/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library", "go_test")
go_library(
diff --git a/go/extractor/cli/go-autobuilder/BUILD.bazel b/go/extractor/cli/go-autobuilder/BUILD.bazel
index bf1235b33aa..7abf4600d94 100644
--- a/go/extractor/cli/go-autobuilder/BUILD.bazel
+++ b/go/extractor/cli/go-autobuilder/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library")
load("//go:rules.bzl", "codeql_go_binary")
diff --git a/go/extractor/cli/go-bootstrap/BUILD.bazel b/go/extractor/cli/go-bootstrap/BUILD.bazel
index 7bdd6d6e70f..86b08dfa121 100644
--- a/go/extractor/cli/go-bootstrap/BUILD.bazel
+++ b/go/extractor/cli/go-bootstrap/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library")
load("//go:rules.bzl", "codeql_go_binary")
diff --git a/go/extractor/cli/go-build-runner/BUILD.bazel b/go/extractor/cli/go-build-runner/BUILD.bazel
index 15557d751cf..e91c4530610 100644
--- a/go/extractor/cli/go-build-runner/BUILD.bazel
+++ b/go/extractor/cli/go-build-runner/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library")
load("//go:rules.bzl", "codeql_go_binary")
diff --git a/go/extractor/cli/go-extractor/BUILD.bazel b/go/extractor/cli/go-extractor/BUILD.bazel
index be426331868..769e4a7b09b 100644
--- a/go/extractor/cli/go-extractor/BUILD.bazel
+++ b/go/extractor/cli/go-extractor/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library")
load("//go:rules.bzl", "codeql_go_binary")
diff --git a/go/extractor/cli/go-gen-dbscheme/BUILD.bazel b/go/extractor/cli/go-gen-dbscheme/BUILD.bazel
index 06c0d0f61f1..9de6d2198f8 100644
--- a/go/extractor/cli/go-gen-dbscheme/BUILD.bazel
+++ b/go/extractor/cli/go-gen-dbscheme/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library")
load("//go:rules.bzl", "codeql_go_binary")
diff --git a/go/extractor/cli/go-tokenizer/BUILD.bazel b/go/extractor/cli/go-tokenizer/BUILD.bazel
index 3fc5b464c7c..8ce0c76be26 100644
--- a/go/extractor/cli/go-tokenizer/BUILD.bazel
+++ b/go/extractor/cli/go-tokenizer/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library")
load("//go:rules.bzl", "codeql_go_binary")
diff --git a/go/extractor/dbscheme/BUILD.bazel b/go/extractor/dbscheme/BUILD.bazel
index efaf51684d7..496a5ccdf49 100644
--- a/go/extractor/dbscheme/BUILD.bazel
+++ b/go/extractor/dbscheme/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library")
go_library(
diff --git a/go/extractor/diagnostics/BUILD.bazel b/go/extractor/diagnostics/BUILD.bazel
index 8b218dc1317..9b0c148db32 100644
--- a/go/extractor/diagnostics/BUILD.bazel
+++ b/go/extractor/diagnostics/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library")
go_library(
diff --git a/go/extractor/project/BUILD.bazel b/go/extractor/project/BUILD.bazel
index dd49b3b320f..0048adf9164 100644
--- a/go/extractor/project/BUILD.bazel
+++ b/go/extractor/project/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library", "go_test")
go_library(
diff --git a/go/extractor/srcarchive/BUILD.bazel b/go/extractor/srcarchive/BUILD.bazel
index 90664c90190..e72e2e7ca08 100644
--- a/go/extractor/srcarchive/BUILD.bazel
+++ b/go/extractor/srcarchive/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library", "go_test")
go_library(
diff --git a/go/extractor/toolchain/BUILD.bazel b/go/extractor/toolchain/BUILD.bazel
index d1ce09c2632..fde8d327e9e 100644
--- a/go/extractor/toolchain/BUILD.bazel
+++ b/go/extractor/toolchain/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library", "go_test")
go_library(
diff --git a/go/extractor/trap/BUILD.bazel b/go/extractor/trap/BUILD.bazel
index 6c3f67b3247..6cc7c4983b2 100644
--- a/go/extractor/trap/BUILD.bazel
+++ b/go/extractor/trap/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library", "go_test")
go_library(
diff --git a/go/extractor/util/BUILD.bazel b/go/extractor/util/BUILD.bazel
index 787a627b5bc..8b8869cac52 100644
--- a/go/extractor/util/BUILD.bazel
+++ b/go/extractor/util/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library", "go_test")
go_library(
diff --git a/go/extractor/vendor/golang.org/x/mod/internal/lazyregexp/BUILD.bazel b/go/extractor/vendor/golang.org/x/mod/internal/lazyregexp/BUILD.bazel
index 33c06c34bec..deb5dc2b019 100644
--- a/go/extractor/vendor/golang.org/x/mod/internal/lazyregexp/BUILD.bazel
+++ b/go/extractor/vendor/golang.org/x/mod/internal/lazyregexp/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library")
go_library(
diff --git a/go/extractor/vendor/golang.org/x/mod/modfile/BUILD.bazel b/go/extractor/vendor/golang.org/x/mod/modfile/BUILD.bazel
index 7b5a78d785c..097bacb107c 100644
--- a/go/extractor/vendor/golang.org/x/mod/modfile/BUILD.bazel
+++ b/go/extractor/vendor/golang.org/x/mod/modfile/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library")
go_library(
diff --git a/go/extractor/vendor/golang.org/x/mod/module/BUILD.bazel b/go/extractor/vendor/golang.org/x/mod/module/BUILD.bazel
index 46ff4dbb7d1..3bf5ae9997d 100644
--- a/go/extractor/vendor/golang.org/x/mod/module/BUILD.bazel
+++ b/go/extractor/vendor/golang.org/x/mod/module/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library")
go_library(
diff --git a/go/extractor/vendor/golang.org/x/mod/semver/BUILD.bazel b/go/extractor/vendor/golang.org/x/mod/semver/BUILD.bazel
index 5b54efe1981..760be56c9e0 100644
--- a/go/extractor/vendor/golang.org/x/mod/semver/BUILD.bazel
+++ b/go/extractor/vendor/golang.org/x/mod/semver/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library")
go_library(
diff --git a/go/extractor/vendor/golang.org/x/tools/go/gcexportdata/BUILD.bazel b/go/extractor/vendor/golang.org/x/tools/go/gcexportdata/BUILD.bazel
index 57f503f1cb2..5d68c2fe989 100644
--- a/go/extractor/vendor/golang.org/x/tools/go/gcexportdata/BUILD.bazel
+++ b/go/extractor/vendor/golang.org/x/tools/go/gcexportdata/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library")
go_library(
diff --git a/go/extractor/vendor/golang.org/x/tools/go/internal/packagesdriver/BUILD.bazel b/go/extractor/vendor/golang.org/x/tools/go/internal/packagesdriver/BUILD.bazel
index 962442de1e0..2ef27e2c88a 100644
--- a/go/extractor/vendor/golang.org/x/tools/go/internal/packagesdriver/BUILD.bazel
+++ b/go/extractor/vendor/golang.org/x/tools/go/internal/packagesdriver/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library")
go_library(
diff --git a/go/extractor/vendor/golang.org/x/tools/go/packages/BUILD.bazel b/go/extractor/vendor/golang.org/x/tools/go/packages/BUILD.bazel
index 1cad8baca98..03d3e3b0158 100644
--- a/go/extractor/vendor/golang.org/x/tools/go/packages/BUILD.bazel
+++ b/go/extractor/vendor/golang.org/x/tools/go/packages/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library")
go_library(
diff --git a/go/extractor/vendor/golang.org/x/tools/go/types/objectpath/BUILD.bazel b/go/extractor/vendor/golang.org/x/tools/go/types/objectpath/BUILD.bazel
index 1029221f434..374c5c601bc 100644
--- a/go/extractor/vendor/golang.org/x/tools/go/types/objectpath/BUILD.bazel
+++ b/go/extractor/vendor/golang.org/x/tools/go/types/objectpath/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library")
go_library(
diff --git a/go/extractor/vendor/golang.org/x/tools/internal/event/BUILD.bazel b/go/extractor/vendor/golang.org/x/tools/internal/event/BUILD.bazel
index b882fef0d8c..200e436fcd4 100644
--- a/go/extractor/vendor/golang.org/x/tools/internal/event/BUILD.bazel
+++ b/go/extractor/vendor/golang.org/x/tools/internal/event/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library")
go_library(
diff --git a/go/extractor/vendor/golang.org/x/tools/internal/event/core/BUILD.bazel b/go/extractor/vendor/golang.org/x/tools/internal/event/core/BUILD.bazel
index 36bd68eed9f..a16713f536c 100644
--- a/go/extractor/vendor/golang.org/x/tools/internal/event/core/BUILD.bazel
+++ b/go/extractor/vendor/golang.org/x/tools/internal/event/core/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library")
go_library(
diff --git a/go/extractor/vendor/golang.org/x/tools/internal/event/keys/BUILD.bazel b/go/extractor/vendor/golang.org/x/tools/internal/event/keys/BUILD.bazel
index f1674735052..1feefdf1a83 100644
--- a/go/extractor/vendor/golang.org/x/tools/internal/event/keys/BUILD.bazel
+++ b/go/extractor/vendor/golang.org/x/tools/internal/event/keys/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library")
go_library(
diff --git a/go/extractor/vendor/golang.org/x/tools/internal/event/label/BUILD.bazel b/go/extractor/vendor/golang.org/x/tools/internal/event/label/BUILD.bazel
index 2329754d6cf..a4430ba0a17 100644
--- a/go/extractor/vendor/golang.org/x/tools/internal/event/label/BUILD.bazel
+++ b/go/extractor/vendor/golang.org/x/tools/internal/event/label/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library")
go_library(
diff --git a/go/extractor/vendor/golang.org/x/tools/internal/event/tag/BUILD.bazel b/go/extractor/vendor/golang.org/x/tools/internal/event/tag/BUILD.bazel
index 276dc5f4489..d2c87f41a8a 100644
--- a/go/extractor/vendor/golang.org/x/tools/internal/event/tag/BUILD.bazel
+++ b/go/extractor/vendor/golang.org/x/tools/internal/event/tag/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library")
go_library(
diff --git a/go/extractor/vendor/golang.org/x/tools/internal/gcimporter/BUILD.bazel b/go/extractor/vendor/golang.org/x/tools/internal/gcimporter/BUILD.bazel
index 1879fe0dadf..56da3b0130e 100644
--- a/go/extractor/vendor/golang.org/x/tools/internal/gcimporter/BUILD.bazel
+++ b/go/extractor/vendor/golang.org/x/tools/internal/gcimporter/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library")
go_library(
diff --git a/go/extractor/vendor/golang.org/x/tools/internal/gocommand/BUILD.bazel b/go/extractor/vendor/golang.org/x/tools/internal/gocommand/BUILD.bazel
index 58f7091b49c..7e64f94b95c 100644
--- a/go/extractor/vendor/golang.org/x/tools/internal/gocommand/BUILD.bazel
+++ b/go/extractor/vendor/golang.org/x/tools/internal/gocommand/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library")
go_library(
diff --git a/go/extractor/vendor/golang.org/x/tools/internal/packagesinternal/BUILD.bazel b/go/extractor/vendor/golang.org/x/tools/internal/packagesinternal/BUILD.bazel
index 3ed918c9489..2d2b7dc5b33 100644
--- a/go/extractor/vendor/golang.org/x/tools/internal/packagesinternal/BUILD.bazel
+++ b/go/extractor/vendor/golang.org/x/tools/internal/packagesinternal/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library")
go_library(
diff --git a/go/extractor/vendor/golang.org/x/tools/internal/pkgbits/BUILD.bazel b/go/extractor/vendor/golang.org/x/tools/internal/pkgbits/BUILD.bazel
index 820e8f04c9b..cce32747051 100644
--- a/go/extractor/vendor/golang.org/x/tools/internal/pkgbits/BUILD.bazel
+++ b/go/extractor/vendor/golang.org/x/tools/internal/pkgbits/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library")
go_library(
diff --git a/go/extractor/vendor/golang.org/x/tools/internal/tokeninternal/BUILD.bazel b/go/extractor/vendor/golang.org/x/tools/internal/tokeninternal/BUILD.bazel
index ff66085dbdb..c0f6cc8fb13 100644
--- a/go/extractor/vendor/golang.org/x/tools/internal/tokeninternal/BUILD.bazel
+++ b/go/extractor/vendor/golang.org/x/tools/internal/tokeninternal/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library")
go_library(
diff --git a/go/extractor/vendor/golang.org/x/tools/internal/typeparams/BUILD.bazel b/go/extractor/vendor/golang.org/x/tools/internal/typeparams/BUILD.bazel
index 266816d9ea2..9c2dc20b6c6 100644
--- a/go/extractor/vendor/golang.org/x/tools/internal/typeparams/BUILD.bazel
+++ b/go/extractor/vendor/golang.org/x/tools/internal/typeparams/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library")
go_library(
diff --git a/go/extractor/vendor/golang.org/x/tools/internal/typesinternal/BUILD.bazel b/go/extractor/vendor/golang.org/x/tools/internal/typesinternal/BUILD.bazel
index c03b8a36ef7..653752ab715 100644
--- a/go/extractor/vendor/golang.org/x/tools/internal/typesinternal/BUILD.bazel
+++ b/go/extractor/vendor/golang.org/x/tools/internal/typesinternal/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library")
go_library(
diff --git a/go/extractor/vendor/golang.org/x/tools/internal/versions/BUILD.bazel b/go/extractor/vendor/golang.org/x/tools/internal/versions/BUILD.bazel
index 6d7ffd0ac68..85d428debf5 100644
--- a/go/extractor/vendor/golang.org/x/tools/internal/versions/BUILD.bazel
+++ b/go/extractor/vendor/golang.org/x/tools/internal/versions/BUILD.bazel
@@ -1,3 +1,5 @@
+# generated running `bazel run //go/gazelle`, do not edit
+
load("@rules_go//go:def.bzl", "go_library")
go_library(
diff --git a/go/gazelle/BUILD.bazel b/go/gazelle/BUILD.bazel
index 7c9b34edb3a..3d81b50590a 100644
--- a/go/gazelle/BUILD.bazel
+++ b/go/gazelle/BUILD.bazel
@@ -1,8 +1,13 @@
load("@gazelle//:def.bzl", "gazelle")
gazelle(
- name = "gazelle",
- extra_args = [
- "go/extractor",
- ],
+ name = "_gazelle",
+)
+
+py_binary(
+ name = "gazelle",
+ srcs = ["gazelle.py"],
+ args = ["$(rlocationpath :_gazelle)"],
+ data = [":_gazelle"],
+ deps = ["@rules_python//python/runfiles"],
)
diff --git a/go/gazelle/gazelle.py b/go/gazelle/gazelle.py
new file mode 100644
index 00000000000..200f3c3ed6b
--- /dev/null
+++ b/go/gazelle/gazelle.py
@@ -0,0 +1,16 @@
+import sys
+import pathlib
+import subprocess
+from python.runfiles import runfiles
+
+this = pathlib.Path(__file__).resolve()
+go_extractor_dir = this.parents[1] / "extractor"
+gazelle = runfiles.Create().Rlocation(sys.argv[1])
+for build_file in go_extractor_dir.glob("*/**/BUILD.bazel"):
+ build_file.unlink()
+
+subprocess.check_call([gazelle, "go/extractor"])
+
+for build_file in go_extractor_dir.glob("*/**/BUILD.bazel"):
+ contents = build_file.read_text()
+ build_file.write_text(f"# generated running `bazel run //go/gazelle`, do not edit\n\n{contents}")
From 3ad9c026a5c59b8a23d5541a1251fc611dd89988 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Fri, 26 Apr 2024 11:20:47 +0200
Subject: [PATCH 009/118] Go: remove `go_sdk.host`
It's not required, and it can't work from the internal repository.
---
MODULE.bazel | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/MODULE.bazel b/MODULE.bazel
index 7a85ab51a96..16697403dcc 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -23,8 +23,7 @@ bazel_dep(name = "bazel_skylib", version = "1.5.0")
bazel_dep(name = "abseil-cpp", version = "20240116.0", repo_name = "absl")
bazel_dep(name = "nlohmann_json", version = "3.11.3", repo_name = "json")
bazel_dep(name = "fmt", version = "10.0.0")
-
-bazel_dep(name = "gazelle", version = "0.36.0", dev_dependency = True)
+bazel_dep(name = "gazelle", version = "0.36.0")
pip = use_extension("@rules_python//python/extensions:pip.bzl", "pip")
pip.parse(
@@ -56,7 +55,6 @@ use_repo(node, "nodejs", "nodejs_toolchains")
go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")
go_sdk.download(version = "1.22.2")
-go_sdk.host()
register_toolchains(
"@nodejs_toolchains//:all",
From 925a2cca7e6a5c8231b37f67df3de469ddf50925 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Fri, 26 Apr 2024 12:01:23 +0200
Subject: [PATCH 010/118] Go: create whole extractor pack with bazel
---
go/BUILD.bazel | 59 +++++++++++++++++++++++++++++++++++++
go/codeql-tools/BUILD.bazel | 28 ++++++++++++++++++
go/create_extractor_pack.py | 16 ++++++++++
go/downgrades/BUILD.bazel | 12 ++++++++
go/extractor/BUILD.bazel | 31 +++++++++++++++++++
5 files changed, 146 insertions(+)
create mode 100644 go/codeql-tools/BUILD.bazel
create mode 100644 go/create_extractor_pack.py
create mode 100644 go/downgrades/BUILD.bazel
diff --git a/go/BUILD.bazel b/go/BUILD.bazel
index e69de29bb2d..5736912310a 100644
--- a/go/BUILD.bazel
+++ b/go/BUILD.bazel
@@ -0,0 +1,59 @@
+load("@rules_pkg//pkg:mappings.bzl", "pkg_filegroup", "pkg_files")
+load("@rules_pkg//pkg:install.bzl", "pkg_install")
+load("//:defs.bzl", "codeql_platform")
+
+pkg_files(
+ name = "resources",
+ srcs = [
+ "LICENSE",
+ "codeql-extractor.yml",
+ "ql/lib/go.dbscheme",
+ "ql/lib/go.dbscheme.stats",
+ ],
+)
+
+pkg_filegroup(
+ name = "extractor-pack-generic",
+ srcs = [
+ ":resources",
+ "//go/codeql-tools",
+ "//go/downgrades",
+ "//go/extractor:tokenizer",
+ ],
+ visibility = ["//visibility:public"],
+)
+
+pkg_files(
+ name = "extractor-pack-arch",
+ srcs = [
+ "//go/extractor/cli/go-autobuilder",
+ "//go/extractor/cli/go-bootstrap",
+ "//go/extractor/cli/go-build-runner",
+ "//go/extractor/cli/go-extractor",
+ "//go/extractor/cli/go-gen-dbscheme",
+ "//go/extractor/cli/go-tokenizer",
+ ],
+ prefix = "tools/" + codeql_platform,
+ visibility = ["//visibility:public"],
+)
+
+pkg_filegroup(
+ name = "extractor-pack",
+ srcs = [
+ ":extractor-pack-arch",
+ ":extractor-pack-generic",
+ ],
+ visibility = ["//visibility:public"],
+)
+
+pkg_install(
+ name = "_create_extractor_pack",
+ srcs = [":extractor-pack"],
+)
+
+py_binary(
+ name = "create-extractor-pack",
+ srcs = ["create_extractor_pack.py"],
+ main = "create_extractor_pack.py",
+ deps = [":_create_extractor_pack"],
+)
diff --git a/go/codeql-tools/BUILD.bazel b/go/codeql-tools/BUILD.bazel
new file mode 100644
index 00000000000..4e839b4774b
--- /dev/null
+++ b/go/codeql-tools/BUILD.bazel
@@ -0,0 +1,28 @@
+load("@rules_pkg//pkg:mappings.bzl", "pkg_attributes", "pkg_filegroup", "pkg_files")
+
+pkg_files(
+ name = "executables",
+ srcs = glob(["*.sh"]),
+ attributes = pkg_attributes(mode = "0755"),
+)
+
+pkg_files(
+ name = "non-executables",
+ srcs = glob(
+ ["*"],
+ exclude = [
+ "*.sh",
+ "BUILD.bazel",
+ ],
+ ),
+)
+
+pkg_filegroup(
+ name = "codeql-tools",
+ srcs = [
+ ":executables",
+ ":non-executables",
+ ],
+ prefix = "tools",
+ visibility = ["//go:__pkg__"],
+)
diff --git a/go/create_extractor_pack.py b/go/create_extractor_pack.py
new file mode 100644
index 00000000000..08665a2d8dc
--- /dev/null
+++ b/go/create_extractor_pack.py
@@ -0,0 +1,16 @@
+import os
+import pathlib
+import shutil
+import sys
+from go._create_extractor_pack_install_script import main
+
+try:
+ workspace_dir = pathlib.Path(os.environ['BUILD_WORKSPACE_DIRECTORY'])
+except KeyError:
+ print("this should be run with bazel run", file=sys.stderr)
+ sys.exit(1)
+
+dest_dir = workspace_dir / 'go' / 'build' / 'codeql-extractor-go'
+shutil.rmtree(dest_dir, ignore_errors=True)
+os.environ['DESTDIR'] = str(dest_dir)
+main(sys.argv)
diff --git a/go/downgrades/BUILD.bazel b/go/downgrades/BUILD.bazel
new file mode 100644
index 00000000000..68c15741a9f
--- /dev/null
+++ b/go/downgrades/BUILD.bazel
@@ -0,0 +1,12 @@
+load("@rules_pkg//pkg:mappings.bzl", "pkg_files", "strip_prefix")
+
+pkg_files(
+ name = "downgrades",
+ srcs = glob(
+ ["**"],
+ exclude = ["BUILD.bazel"],
+ ),
+ prefix = "downgrades",
+ strip_prefix = strip_prefix.from_pkg(),
+ visibility = ["//go:__pkg__"],
+)
diff --git a/go/extractor/BUILD.bazel b/go/extractor/BUILD.bazel
index 040b4227314..cb7bc3ac8ef 100644
--- a/go/extractor/BUILD.bazel
+++ b/go/extractor/BUILD.bazel
@@ -1,4 +1,5 @@
load("@rules_go//go:def.bzl", "go_library")
+load("@rules_pkg//pkg:mappings.bzl", "pkg_files")
# gazelle:prefix github.com/github/codeql-go/extractor
# gazelle:map_kind go_binary codeql_go_binary //go:rules.bzl
@@ -22,3 +23,33 @@ go_library(
"//go/extractor/vendor/golang.org/x/tools/go/packages",
],
)
+
+java_library(
+ name = "tokenizer-deps",
+ srcs = [
+ "net/sourceforge/pmd/cpd/AbstractLanguage.java",
+ "net/sourceforge/pmd/cpd/SourceCode.java",
+ "net/sourceforge/pmd/cpd/TokenEntry.java",
+ "net/sourceforge/pmd/cpd/Tokenizer.java",
+ ],
+)
+
+java_library(
+ name = "tokenizer-jar",
+ srcs = [
+ "net/sourceforge/pmd/cpd/GoLanguage.java",
+ "opencsv/CSVParser.java",
+ "opencsv/CSVReader.java",
+ ],
+ deps = [":tokenizer-deps"],
+)
+
+pkg_files(
+ name = "tokenizer",
+ srcs = [":tokenizer-jar"],
+ prefix = "tools",
+ renames = {
+ ":tokenizer-jar": "tokenizer.jar",
+ },
+ visibility = ["//go:__pkg__"],
+)
From 19b2e56d0276518c1c6559536338b61e2451acf6 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Fri, 26 Apr 2024 13:38:10 +0200
Subject: [PATCH 011/118] Go: group BUILD and dbscheme generation target
---
.pre-commit-config.yaml | 8 ++++----
go/BUILD.bazel | 28 ++++++++++++++++++++++++++++
go/gazelle/BUILD.bazel | 13 -------------
go/{gazelle/gazelle.py => gen.py} | 12 ++++++++++--
4 files changed, 42 insertions(+), 19 deletions(-)
delete mode 100644 go/gazelle/BUILD.bazel
rename go/{gazelle/gazelle.py => gen.py} (56%)
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 4e81bcc7711..899ddd71b89 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -27,11 +27,11 @@ repos:
- repo: local
hooks:
- - id: gazelle
- name: Check gazelle-generated BUILD files
- files: go/extractor/.*
+ - id: go-gen
+ name: Check checked in generated files in go
+ files: go/.*
language: system
- entry: bazel run //go/gazelle
+ entry: bazel run //go:gen
pass_filenames: false
- id: codeql-format
diff --git a/go/BUILD.bazel b/go/BUILD.bazel
index 5736912310a..c5f32c5309f 100644
--- a/go/BUILD.bazel
+++ b/go/BUILD.bazel
@@ -1,7 +1,26 @@
load("@rules_pkg//pkg:mappings.bzl", "pkg_filegroup", "pkg_files")
load("@rules_pkg//pkg:install.bzl", "pkg_install")
+load("@bazel_skylib//rules:native_binary.bzl", "native_binary")
+load("@gazelle//:def.bzl", "gazelle")
load("//:defs.bzl", "codeql_platform")
+gazelle(
+ name = "_gazelle",
+)
+
+_gen_binaries = [
+ ":_gazelle",
+ "//go/extractor/cli/go-gen-dbscheme",
+]
+
+py_binary(
+ name = "gen",
+ srcs = ["gen.py"],
+ args = ["$(rlocationpath %s)" % bin for bin in _gen_binaries],
+ data = _gen_binaries,
+ deps = ["@rules_python//python/runfiles"],
+)
+
pkg_files(
name = "resources",
srcs = [
@@ -57,3 +76,12 @@ py_binary(
main = "create_extractor_pack.py",
deps = [":_create_extractor_pack"],
)
+
+native_binary(
+ name = "gen-dbscheme",
+ src = "//go/extractor/cli/go-gen-dbscheme",
+ out = "go-gen-dbscheme",
+ args = [
+ "$$BUILD_WORKSPACE_DIRECTORY/go/ql/lib/go.dbscheme",
+ ],
+)
diff --git a/go/gazelle/BUILD.bazel b/go/gazelle/BUILD.bazel
deleted file mode 100644
index 3d81b50590a..00000000000
--- a/go/gazelle/BUILD.bazel
+++ /dev/null
@@ -1,13 +0,0 @@
-load("@gazelle//:def.bzl", "gazelle")
-
-gazelle(
- name = "_gazelle",
-)
-
-py_binary(
- name = "gazelle",
- srcs = ["gazelle.py"],
- args = ["$(rlocationpath :_gazelle)"],
- data = [":_gazelle"],
- deps = ["@rules_python//python/runfiles"],
-)
diff --git a/go/gazelle/gazelle.py b/go/gen.py
similarity index 56%
rename from go/gazelle/gazelle.py
rename to go/gen.py
index 200f3c3ed6b..7b7e9d73237 100644
--- a/go/gazelle/gazelle.py
+++ b/go/gen.py
@@ -4,13 +4,21 @@ import subprocess
from python.runfiles import runfiles
this = pathlib.Path(__file__).resolve()
-go_extractor_dir = this.parents[1] / "extractor"
-gazelle = runfiles.Create().Rlocation(sys.argv[1])
+go_extractor_dir = this.parent / "extractor"
+go_dbscheme = this.parent / "ql" / "lib" / "go.dbscheme"
+r = runfiles.Create()
+gazelle, go_gen_dbscheme = map(r.Rlocation, sys.argv[1:])
+
+print("clearing generated BUILD files")
for build_file in go_extractor_dir.glob("*/**/BUILD.bazel"):
build_file.unlink()
+print("running gazelle")
subprocess.check_call([gazelle, "go/extractor"])
+print("adding header to generated BUILD files")
for build_file in go_extractor_dir.glob("*/**/BUILD.bazel"):
contents = build_file.read_text()
build_file.write_text(f"# generated running `bazel run //go/gazelle`, do not edit\n\n{contents}")
+
+subprocess.check_call([go_gen_dbscheme, go_dbscheme])
From bfa189e2ac2c251518cb61f9665f0970b36e099d Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Fri, 26 Apr 2024 13:48:44 +0200
Subject: [PATCH 012/118] Go: use a dbscheme generated during the build in
`extractor-pack`
---
go/BUILD.bazel | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/go/BUILD.bazel b/go/BUILD.bazel
index c5f32c5309f..d327a406f5f 100644
--- a/go/BUILD.bazel
+++ b/go/BUILD.bazel
@@ -21,13 +21,23 @@ py_binary(
deps = ["@rules_python//python/runfiles"],
)
+# this is an internal copy of the dbscheme to be used by extractor-pack
+# this allows the extractor-pack target to be independent and up-to-date with respect to
+# having run //go:gen to update the checked in files
+genrule(
+ name = "dbscheme",
+ outs = ["go.dbscheme"],
+ cmd = "$(execpath //go/extractor/cli/go-gen-dbscheme) $@",
+ tools = ["//go/extractor/cli/go-gen-dbscheme"],
+)
+
pkg_files(
name = "resources",
srcs = [
"LICENSE",
"codeql-extractor.yml",
- "ql/lib/go.dbscheme",
"ql/lib/go.dbscheme.stats",
+ ":dbscheme",
],
)
From 146d84bbf8c0012cb3e496a4deb7470afb61a0dd Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Fri, 26 Apr 2024 15:20:33 +0200
Subject: [PATCH 013/118] Go: rework makefile
---
go/Makefile | 75 +++++------------------------------------------------
1 file changed, 7 insertions(+), 68 deletions(-)
diff --git a/go/Makefile b/go/Makefile
index d0289a093a5..d9ba2c7e2d4 100644
--- a/go/Makefile
+++ b/go/Makefile
@@ -1,4 +1,4 @@
-all: extractor ql/lib/go.dbscheme
+all: gen extractor
ifeq ($(OS),Windows_NT)
EXE = .exe
@@ -14,17 +14,11 @@ CODEQL_PLATFORM = osx64
endif
endif
-CODEQL_TOOLS = $(addprefix codeql-tools/,autobuild.cmd autobuild.sh baseline-config-empty.json baseline-config-vendor.json configure-baseline.cmd configure-baseline.sh identify-environment.cmd identify-environment.sh index.cmd index.sh pre-finalize.cmd pre-finalize.sh tracing-config.lua)
-
EXTRACTOR_PACK_OUT = build/codeql-extractor-go
-BINARIES = go-extractor go-tokenizer go-autobuilder go-build-runner go-bootstrap go-gen-dbscheme
-
-.PHONY: tools tools-codeql tools-codeql-full clean autoformat \
- tools-linux64 tools-osx64 tools-win64 check-formatting
+.PHONY: extractor gen clean autoformat check-formatting
clean:
- rm -rf tools/bin tools/linux64 tools/osx64 tools/win64 tools/net tools/opencsv
rm -rf $(EXTRACTOR_PACK_OUT) build/stats build/testdb
autoformat:
@@ -47,66 +41,11 @@ endif
qhelp-to-markdown:
scripts/qhelp-to-markdown.sh ql/src "$(QHELP_OUT_DIR)"
-tools: tools-codeql tools/tokenizer.jar
+extractor:
+ bazel run :create-extractor-pack
-.PHONY: $(addsuffix $(EXE),$(addprefix tools/bin/,$(BINARIES)))
-$(addsuffix $(EXE),$(addprefix tools/bin/,$(BINARIES))):
- go build -C extractor -mod=vendor -o ../$@ ./cli/$(basename $(@F))
-
-tools-codeql: tools-$(CODEQL_PLATFORM)
-
-tools-codeql-full: tools-linux64 tools-osx64 tools-win64
-
-tools-linux64: $(addprefix tools/linux64/,$(BINARIES))
-
-.PHONY: $(addprefix tools/linux64/,$(BINARIES))
-$(addprefix tools/linux64/,$(BINARIES)):
- GOOS=linux GOARCH=amd64 go build -C extractor -mod=vendor -o ../$@ ./cli/$(@F)
-
-tools-osx64: $(addprefix tools/osx64/,$(BINARIES))
-
-.PHONY: $(addprefix tools/osx64/,$(BINARIES))
-$(addprefix tools/osx64/,$(BINARIES)):
- GOOS=darwin GOARCH=amd64 go build -C extractor -mod=vendor -o ../$@.amd64 ./cli/$(@F)
- GOOS=darwin GOARCH=arm64 go build -C extractor -mod=vendor -o ../$@.arm64 ./cli/$(@F)
- lipo -create $@.amd64 $@.arm64 -output $@
- rm $@.amd64 $@.arm64
-
-tools-win64: $(addsuffix .exe,$(addprefix tools/win64/,$(BINARIES)))
-
-.PHONY: $(addsuffix .exe,$(addprefix tools/win64/,$(BINARIES)))
-$(addsuffix .exe,$(addprefix tools/win64/,$(BINARIES))):
- env GOOS=windows GOARCH=amd64 go build -C extractor -mod=vendor -o ../$@ ./cli/$(basename $(@F))
-
-.PHONY: extractor-common extractor extractor-full
-extractor-common: codeql-extractor.yml LICENSE ql/lib/go.dbscheme \
- tools/tokenizer.jar $(CODEQL_TOOLS)
- rm -rf $(EXTRACTOR_PACK_OUT)
- mkdir -p $(EXTRACTOR_PACK_OUT)
- cp codeql-extractor.yml LICENSE ql/lib/go.dbscheme ql/lib/go.dbscheme.stats $(EXTRACTOR_PACK_OUT)
- mkdir $(EXTRACTOR_PACK_OUT)/tools
- cp -r tools/tokenizer.jar $(CODEQL_TOOLS) $(EXTRACTOR_PACK_OUT)/tools
- cp -r downgrades $(EXTRACTOR_PACK_OUT)
-
-extractor: extractor-common tools-codeql
- cp -r tools/$(CODEQL_PLATFORM) $(EXTRACTOR_PACK_OUT)/tools
-
-extractor-full: extractor-common tools-codeql-full
- cp -r $(addprefix tools/,linux64 osx64 win64) $(EXTRACTOR_PACK_OUT)/tools
-
-tools/tokenizer.jar: tools/net/sourceforge/pmd/cpd/GoLanguage.class
- jar cf $@ -C tools net
- jar uf $@ -C tools opencsv
-
-tools/net/sourceforge/pmd/cpd/GoLanguage.class: extractor/net/sourceforge/pmd/cpd/GoLanguage.java
- javac -cp extractor -d tools $<
- rm tools/net/sourceforge/pmd/cpd/AbstractLanguage.class
- rm tools/net/sourceforge/pmd/cpd/SourceCode.class
- rm tools/net/sourceforge/pmd/cpd/TokenEntry.class
- rm tools/net/sourceforge/pmd/cpd/Tokenizer.class
-
-ql/lib/go.dbscheme: tools/$(CODEQL_PLATFORM)/go-gen-dbscheme$(EXE)
- $< $@
+gen:
+ bazel run :gen
build/stats/src.stamp:
mkdir -p $(@D)/src
@@ -123,7 +62,7 @@ test: all build/testdb/check-upgrade-path
codeql test run -j0 ql/test --search-path build/codeql-extractor-go --consistency-queries ql/test/consistency --compilation-cache=$(cache)
# use GOOS=linux because GOOS=darwin GOARCH=386 is no longer supported
env GOOS=linux GOARCH=386 codeql$(EXE) test run -j0 ql/test/query-tests/Security/CWE-681 --search-path build/codeql-extractor-go --consistency-queries ql/test/consistency --compilation-cache=$(cache)
- cd extractor; go test -mod=vendor ./...
+ cd extractor; bazel test ...
bash extractor-smoke-test/test.sh || (echo "Extractor smoke test FAILED"; exit 1)
.PHONY: build/testdb/check-upgrade-path
From d98ccdfa066544c75c3278c7499e12986cfd11e5 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Fri, 26 Apr 2024 16:02:22 +0200
Subject: [PATCH 014/118] Go: update workflow
---
.github/workflows/go-tests.yml | 58 +++++++++++++++++++---------------
1 file changed, 33 insertions(+), 25 deletions(-)
diff --git a/.github/workflows/go-tests.yml b/.github/workflows/go-tests.yml
index 6d9cac5dae9..75c34f4f5de 100644
--- a/.github/workflows/go-tests.yml
+++ b/.github/workflows/go-tests.yml
@@ -28,13 +28,6 @@ jobs:
name: Test Linux (Ubuntu)
runs-on: ubuntu-latest-xl
steps:
- - name: Set up Go ${{ env.GO_VERSION }}
- uses: actions/setup-go@v5
- with:
- go-version: ${{ env.GO_VERSION }}
- cache: false
- id: go
-
- name: Check out code
uses: actions/checkout@v4
@@ -47,24 +40,7 @@ jobs:
- name: Build
run: |
- cd go
- make
-
- - name: Check that all Go code is autoformatted
- run: |
- cd go
- make check-formatting
-
- - name: Compile qhelp files to markdown
- run: |
- cd go
- env QHELP_OUT_DIR=qhelp-out make qhelp-to-markdown
-
- - name: Upload qhelp markdown
- uses: actions/upload-artifact@v3
- with:
- name: qhelp-markdown
- path: go/qhelp-out/**/*.md
+ bazel run //go:create-extractor-pack
- name: Cache compilation cache
id: query-cache
@@ -76,3 +52,35 @@ jobs:
run: |
cd go
make test cache="${{ steps.query-cache.outputs.cache-dir }}"
+
+ check-code:
+ name: Check code
+ runs-on: ubuntu-latest
+ steps:
+ - name: Check out code
+ uses: actions/checkout@v4
+
+ - name: Check that all Go code is autoformatted
+ run: |
+ cd go
+ make check-formatting
+
+ - name: Check checked-in generated code
+ run: |
+ bazel run //go:gen
+ git add .
+ git diff --exit-code HEAD || (
+ echo "please run bazel run //go:gen"
+ exit 1
+ )
+
+ - name: Compile qhelp files to markdown
+ run: |
+ cd go
+ env QHELP_OUT_DIR=qhelp-out make qhelp-to-markdown
+
+ - name: Upload qhelp markdown
+ uses: actions/upload-artifact@v3
+ with:
+ name: qhelp-markdown
+ path: go/qhelp-out/**/*.md
From 0f387eeac298cb8c30c11a13ba9f9dcd027220e9 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Fri, 26 Apr 2024 16:31:04 +0200
Subject: [PATCH 015/118] Go: add vendor update to `//go:gen`
---
go/BUILD.bazel | 9 ++++++---
go/extractor/vendor/modules.txt | 1 +
go/gen.py | 7 +++++--
3 files changed, 12 insertions(+), 5 deletions(-)
diff --git a/go/BUILD.bazel b/go/BUILD.bazel
index e769afeea1d..50e2bc0d447 100644
--- a/go/BUILD.bazel
+++ b/go/BUILD.bazel
@@ -1,15 +1,17 @@
load("@bazel_skylib//rules:native_binary.bzl", "native_binary")
load("@gazelle//:def.bzl", "gazelle")
load("@rules_pkg//pkg:install.bzl", "pkg_install")
-load("@rules_pkg//pkg:mappings.bzl", "pkg_filegroup", "pkg_files")
+load("@rules_pkg//pkg:mappings.bzl", "pkg_attributes", "pkg_filegroup", "pkg_files")
load("//:defs.bzl", "codeql_platform")
gazelle(
- name = "_gazelle",
+ name = "gazelle",
+ extra_args = ["go/extractor"],
)
_gen_binaries = [
- ":_gazelle",
+ "@rules_go//go",
+ ":gazelle",
"//go/extractor/cli/go-gen-dbscheme",
]
@@ -62,6 +64,7 @@ pkg_files(
"//go/extractor/cli/go-gen-dbscheme",
"//go/extractor/cli/go-tokenizer",
],
+ attributes = pkg_attributes(mode = "0755"),
prefix = "tools/" + codeql_platform,
visibility = ["//visibility:public"],
)
diff --git a/go/extractor/vendor/modules.txt b/go/extractor/vendor/modules.txt
index 5687615f62c..37c4a68d828 100644
--- a/go/extractor/vendor/modules.txt
+++ b/go/extractor/vendor/modules.txt
@@ -1,3 +1,4 @@
+## workspace
# golang.org/x/mod v0.15.0
## explicit; go 1.18
golang.org/x/mod/internal/lazyregexp
diff --git a/go/gen.py b/go/gen.py
index 7b7e9d73237..4b4cac0e46f 100644
--- a/go/gen.py
+++ b/go/gen.py
@@ -7,14 +7,17 @@ this = pathlib.Path(__file__).resolve()
go_extractor_dir = this.parent / "extractor"
go_dbscheme = this.parent / "ql" / "lib" / "go.dbscheme"
r = runfiles.Create()
-gazelle, go_gen_dbscheme = map(r.Rlocation, sys.argv[1:])
+go, gazelle, go_gen_dbscheme = map(r.Rlocation, sys.argv[1:])
+
+print("updating vendor")
+subprocess.check_call([go, "-C", go_extractor_dir, "work", "vendor"])
print("clearing generated BUILD files")
for build_file in go_extractor_dir.glob("*/**/BUILD.bazel"):
build_file.unlink()
print("running gazelle")
-subprocess.check_call([gazelle, "go/extractor"])
+subprocess.check_call([gazelle])
print("adding header to generated BUILD files")
for build_file in go_extractor_dir.glob("*/**/BUILD.bazel"):
From 86d6b8ef21c8a1d82fb23c4530aa31b07de0a305 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Fri, 26 Apr 2024 16:39:51 +0200
Subject: [PATCH 016/118] Go: put back go setup
---
.github/workflows/go-tests.yml | 47 +++++++++++++++++++---------------
1 file changed, 26 insertions(+), 21 deletions(-)
diff --git a/.github/workflows/go-tests.yml b/.github/workflows/go-tests.yml
index 75c34f4f5de..5c9204f8405 100644
--- a/.github/workflows/go-tests.yml
+++ b/.github/workflows/go-tests.yml
@@ -16,9 +16,6 @@ on:
- .github/actions/**
- codeql-workspace.yml
-env:
- GO_VERSION: '~1.22.0'
-
permissions:
contents: read
@@ -31,6 +28,21 @@ jobs:
- name: Check out code
uses: actions/checkout@v4
+ - name: Get go version
+ shell: bash
+ run: |
+ (
+ echo -n "GO_VERSION="
+ bazel run @rules_go//go -- version | sed 's/go version go\(\S*\) .*/\1/'
+ ) | tee -a "$GITHUB_ENV"
+
+ - name: Set up Go
+ uses: actions/setup-go@v5
+ with:
+ go-version: ${{ env.GO_VERSION }}
+ cache: false
+ id: go
+
- name: Set up CodeQL CLI
uses: ./.github/actions/fetch-codeql
@@ -42,24 +54,6 @@ jobs:
run: |
bazel run //go:create-extractor-pack
- - name: Cache compilation cache
- id: query-cache
- uses: ./.github/actions/cache-query-compilation
- with:
- key: go-qltest
-
- - name: Test
- run: |
- cd go
- make test cache="${{ steps.query-cache.outputs.cache-dir }}"
-
- check-code:
- name: Check code
- runs-on: ubuntu-latest
- steps:
- - name: Check out code
- uses: actions/checkout@v4
-
- name: Check that all Go code is autoformatted
run: |
cd go
@@ -84,3 +78,14 @@ jobs:
with:
name: qhelp-markdown
path: go/qhelp-out/**/*.md
+
+ - name: Cache compilation cache
+ id: query-cache
+ uses: ./.github/actions/cache-query-compilation
+ with:
+ key: go-qltest
+
+ - name: Test
+ run: |
+ cd go
+ make test cache="${{ steps.query-cache.outputs.cache-dir }}"
From d66494dcb0b2b23010794a052a2315f19de10f30 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Fri, 26 Apr 2024 17:03:56 +0200
Subject: [PATCH 017/118] Go: update `go-tests-other-os.yml`
---
.github/workflows/go-tests-other-os.yml | 70 ++++++++-----------------
1 file changed, 21 insertions(+), 49 deletions(-)
diff --git a/.github/workflows/go-tests-other-os.yml b/.github/workflows/go-tests-other-os.yml
index ded53f868b7..ba3dd0335ad 100644
--- a/.github/workflows/go-tests-other-os.yml
+++ b/.github/workflows/go-tests-other-os.yml
@@ -7,27 +7,38 @@ on:
- .github/workflows/go-tests-other-os.yml
- .github/actions/**
- codeql-workspace.yml
-env:
- GO_VERSION: '~1.22.0'
permissions:
contents: read
jobs:
- test-mac:
- name: Test MacOS
- runs-on: macos-latest
+ test:
+ name: Test
+ strategy:
+ fail-fast: false
+ matrix:
+ os: [macos-latest, windows-latest-xl]
+ if: matrix.os == 'macos-latest' || github.repository_owner == 'github'
+ runs-on: ${{ matrix.os }}
steps:
- - name: Set up Go ${{ env.GO_VERSION }}
+ - name: Check out code
+ uses: actions/checkout@v4
+
+ - name: Get go version
+ shell: bash
+ run: |
+ (
+ echo -n "GO_VERSION="
+ bazel run @rules_go//go -- version | sed 's/go version go\(\S*\) .*/\1/'
+ ) | tee -a "$GITHUB_ENV"
+
+ - name: Set up Go
uses: actions/setup-go@v5
with:
go-version: ${{ env.GO_VERSION }}
cache: false
id: go
- - name: Check out code
- uses: actions/checkout@v4
-
- name: Set up CodeQL CLI
uses: ./.github/actions/fetch-codeql
@@ -37,8 +48,7 @@ jobs:
- name: Build
run: |
- cd go
- make
+ bazel run //go:create-extractor-pack
- name: Cache compilation cache
id: query-cache
@@ -49,41 +59,3 @@ jobs:
run: |
cd go
make test cache="${{ steps.query-cache.outputs.cache-dir }}"
-
- test-win:
- if: github.repository_owner == 'github'
- name: Test Windows
- runs-on: windows-latest-xl
- steps:
- - name: Set up Go ${{ env.GO_VERSION }}
- uses: actions/setup-go@v5
- with:
- go-version: ${{ env.GO_VERSION }}
- cache: false
- id: go
-
- - name: Check out code
- uses: actions/checkout@v4
-
- - name: Set up CodeQL CLI
- uses: ./.github/actions/fetch-codeql
-
- - name: Enable problem matchers in repository
- shell: bash
- run: 'find .github/problem-matchers -name \*.json -exec echo "::add-matcher::{}" \;'
-
- - name: Build
- run: |
- cd go
- make
-
- - name: Cache compilation cache
- id: query-cache
- uses: ./.github/actions/cache-query-compilation
- with:
- key: go-qltest
-
- - name: Test
- run: |
- cd go
- make test cache="${{ steps.query-cache.outputs.cache-dir }}"
From b0758fd1097191313fc62a95cb61edff994707ee Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Mon, 29 Apr 2024 10:29:53 +0200
Subject: [PATCH 018/118] Go: workaround for gazelle on macOS
See https://github.com/bazelbuild/bazel-gazelle/issues/1793 for details.
---
MODULE.bazel | 6 +++++-
go/BUILD.bazel | 13 +++++++++++++
2 files changed, 18 insertions(+), 1 deletion(-)
diff --git a/MODULE.bazel b/MODULE.bazel
index 6daa5a98215..5fd99f76740 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -56,7 +56,11 @@ node.toolchain(
use_repo(node, "nodejs", "nodejs_toolchains")
go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")
-go_sdk.download(version = "1.22.2")
+go_sdk.download(version = "1.22.2") # default
+
+# following is needed for gazelle on macOS
+# see https://github.com/bazelbuild/bazel-gazelle/issues/1793
+go_sdk.download(version = "1.21.9")
register_toolchains(
"@nodejs_toolchains//:all",
diff --git a/go/BUILD.bazel b/go/BUILD.bazel
index 50e2bc0d447..41113d45f51 100644
--- a/go/BUILD.bazel
+++ b/go/BUILD.bazel
@@ -1,12 +1,25 @@
load("@bazel_skylib//rules:native_binary.bzl", "native_binary")
load("@gazelle//:def.bzl", "gazelle")
+load("@rules_go//go:def.bzl", "go_cross_binary")
load("@rules_pkg//pkg:install.bzl", "pkg_install")
load("@rules_pkg//pkg:mappings.bzl", "pkg_attributes", "pkg_filegroup", "pkg_files")
load("//:defs.bzl", "codeql_platform")
+# following is needed for running gazelle on macOS
+# see https://github.com/bazelbuild/bazel-gazelle/issues/1793
+go_cross_binary(
+ name = "gazelle-1.21.9",
+ sdk_version = "1.21.9",
+ target = "@gazelle//cmd/gazelle",
+)
+
gazelle(
name = "gazelle",
extra_args = ["go/extractor"],
+ gazelle = select({
+ "@platforms//os:macos": ":gazelle-1.21.9",
+ "//conditions:default": "@gazelle//cmd/gazelle",
+ }),
)
_gen_binaries = [
From 0dfd3367291da2e84b2dbe95f57d3ae054992bf3 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Mon, 29 Apr 2024 10:34:22 +0200
Subject: [PATCH 019/118] Go: fix `//go:gen` on windows
---
go/gen.py | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/go/gen.py b/go/gen.py
index 4b4cac0e46f..b9394cd15b2 100644
--- a/go/gen.py
+++ b/go/gen.py
@@ -1,11 +1,17 @@
import sys
import pathlib
import subprocess
+import os
from python.runfiles import runfiles
-this = pathlib.Path(__file__).resolve()
-go_extractor_dir = this.parent / "extractor"
-go_dbscheme = this.parent / "ql" / "lib" / "go.dbscheme"
+try:
+ workspace_dir = pathlib.Path(os.environ['BUILD_WORKSPACE_DIRECTORY'])
+except KeyError:
+ print("this should be run with bazel run", file=sys.stderr)
+ sys.exit(1)
+
+go_extractor_dir = workspace_dir / "go" / "extractor"
+go_dbscheme = workspace_dir / "go" / "ql" / "lib" / "go.dbscheme"
r = runfiles.Create()
go, gazelle, go_gen_dbscheme = map(r.Rlocation, sys.argv[1:])
From 6ec223c5150efbacdb14157f7e5f0815bac7d62a Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Mon, 29 Apr 2024 11:00:21 +0200
Subject: [PATCH 020/118] Go: small cleanup in `Makefile`
---
go/Makefile | 14 --------------
1 file changed, 14 deletions(-)
diff --git a/go/Makefile b/go/Makefile
index d9ba2c7e2d4..3ebeb69fcaf 100644
--- a/go/Makefile
+++ b/go/Makefile
@@ -1,19 +1,5 @@
all: gen extractor
-ifeq ($(OS),Windows_NT)
-EXE = .exe
-CODEQL_PLATFORM = win64
-else
-EXE =
-UNAME_S := $(shell uname -s)
-ifeq ($(UNAME_S),Linux)
-CODEQL_PLATFORM = linux64
-endif
-ifeq ($(UNAME_S),Darwin)
-CODEQL_PLATFORM = osx64
-endif
-endif
-
EXTRACTOR_PACK_OUT = build/codeql-extractor-go
.PHONY: extractor gen clean autoformat check-formatting
From 2f6dd2ab819c59425a4c636cdb65930d6c6405fb Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Mon, 29 Apr 2024 11:11:23 +0200
Subject: [PATCH 021/118] Go: refactor workflows with shared action
---
.github/workflows/go-tests-other-os.yml | 57 +++++-------------
.github/workflows/go-tests.yml | 64 +-------------------
go/actions/test/action.yml | 80 +++++++++++++++++++++++++
3 files changed, 97 insertions(+), 104 deletions(-)
create mode 100644 go/actions/test/action.yml
diff --git a/.github/workflows/go-tests-other-os.yml b/.github/workflows/go-tests-other-os.yml
index ba3dd0335ad..9915b0869db 100644
--- a/.github/workflows/go-tests-other-os.yml
+++ b/.github/workflows/go-tests-other-os.yml
@@ -12,50 +12,21 @@ permissions:
contents: read
jobs:
- test:
- name: Test
- strategy:
- fail-fast: false
- matrix:
- os: [macos-latest, windows-latest-xl]
- if: matrix.os == 'macos-latest' || github.repository_owner == 'github'
- runs-on: ${{ matrix.os }}
+ test-mac:
+ name: Test MacOS
+ runs-on: macos-latest
steps:
- name: Check out code
uses: actions/checkout@v4
+ - name: Run tests
+ uses: ./go/actions/test
- - name: Get go version
- shell: bash
- run: |
- (
- echo -n "GO_VERSION="
- bazel run @rules_go//go -- version | sed 's/go version go\(\S*\) .*/\1/'
- ) | tee -a "$GITHUB_ENV"
-
- - name: Set up Go
- uses: actions/setup-go@v5
- with:
- go-version: ${{ env.GO_VERSION }}
- cache: false
- id: go
-
- - name: Set up CodeQL CLI
- uses: ./.github/actions/fetch-codeql
-
- - name: Enable problem matchers in repository
- shell: bash
- run: 'find .github/problem-matchers -name \*.json -exec echo "::add-matcher::{}" \;'
-
- - name: Build
- run: |
- bazel run //go:create-extractor-pack
-
- - name: Cache compilation cache
- id: query-cache
- uses: ./.github/actions/cache-query-compilation
- with:
- key: go-qltest
- - name: Test
- run: |
- cd go
- make test cache="${{ steps.query-cache.outputs.cache-dir }}"
+ test-win:
+ if: github.repository_owner == 'github'
+ name: Test Windows
+ runs-on: windows-latest-xl
+ steps:
+ - name: Check out code
+ uses: actions/checkout@v4
+ - name: Run tests
+ uses: ./go/actions/test
diff --git a/.github/workflows/go-tests.yml b/.github/workflows/go-tests.yml
index 5c9204f8405..63e2b7c4974 100644
--- a/.github/workflows/go-tests.yml
+++ b/.github/workflows/go-tests.yml
@@ -27,65 +27,7 @@ jobs:
steps:
- name: Check out code
uses: actions/checkout@v4
-
- - name: Get go version
- shell: bash
- run: |
- (
- echo -n "GO_VERSION="
- bazel run @rules_go//go -- version | sed 's/go version go\(\S*\) .*/\1/'
- ) | tee -a "$GITHUB_ENV"
-
- - name: Set up Go
- uses: actions/setup-go@v5
+ - name: Run tests
+ uses: ./go/actions/test
with:
- go-version: ${{ env.GO_VERSION }}
- cache: false
- id: go
-
- - name: Set up CodeQL CLI
- uses: ./.github/actions/fetch-codeql
-
- - name: Enable problem matchers in repository
- shell: bash
- run: 'find .github/problem-matchers -name \*.json -exec echo "::add-matcher::{}" \;'
-
- - name: Build
- run: |
- bazel run //go:create-extractor-pack
-
- - name: Check that all Go code is autoformatted
- run: |
- cd go
- make check-formatting
-
- - name: Check checked-in generated code
- run: |
- bazel run //go:gen
- git add .
- git diff --exit-code HEAD || (
- echo "please run bazel run //go:gen"
- exit 1
- )
-
- - name: Compile qhelp files to markdown
- run: |
- cd go
- env QHELP_OUT_DIR=qhelp-out make qhelp-to-markdown
-
- - name: Upload qhelp markdown
- uses: actions/upload-artifact@v3
- with:
- name: qhelp-markdown
- path: go/qhelp-out/**/*.md
-
- - name: Cache compilation cache
- id: query-cache
- uses: ./.github/actions/cache-query-compilation
- with:
- key: go-qltest
-
- - name: Test
- run: |
- cd go
- make test cache="${{ steps.query-cache.outputs.cache-dir }}"
+ run-code-checks: true
diff --git a/go/actions/test/action.yml b/go/actions/test/action.yml
new file mode 100644
index 00000000000..f9bdee5fe0c
--- /dev/null
+++ b/go/actions/test/action.yml
@@ -0,0 +1,80 @@
+name: Test go extractor
+description: Run build, QL tests and optionally basic code sanity checks (formatting and generation)
+inputs:
+ run-code-checks:
+ description: Whether to run formatting, code and qhelp generation checks
+ required: false
+ default: false
+runs:
+ using: composite
+ steps:
+ - name: Get go version
+ shell: bash
+ run: |
+ (
+ echo -n "GO_VERSION="
+ bazel run @rules_go//go -- version | sed 's/go version go\(\S*\) .*/\1/'
+ ) | tee -a "$GITHUB_ENV"
+
+ - name: Set up Go
+ uses: actions/setup-go@v5
+ with:
+ go-version: ${{ env.GO_VERSION }}
+ cache: false
+ id: go
+
+ - name: Set up CodeQL CLI
+ uses: ./.github/actions/fetch-codeql
+
+ - name: Enable problem matchers in repository
+ shell: bash
+ run: 'find .github/problem-matchers -name \*.json -exec echo "::add-matcher::{}" \;'
+
+ - name: Build
+ shell: bash
+ run: |
+ bazel run //go:create-extractor-pack
+
+ - name: Check that all Go code is autoformatted
+ if: inputs.run-code-checks == 'true'
+ shell: bash
+ run: |
+ cd go
+ make check-formatting
+
+ - name: Check checked-in generated code
+ if: inputs.run-code-checks == 'true'
+ shell: bash
+ run: |
+ bazel run //go:gen
+ git add .
+ git diff --exit-code HEAD || (
+ echo "please run bazel run //go:gen"
+ exit 1
+ )
+
+ - name: Compile qhelp files to markdown
+ if: inputs.run-code-checks == 'true'
+ shell: bash
+ run: |
+ cd go
+ env QHELP_OUT_DIR=qhelp-out make qhelp-to-markdown
+
+ - name: Upload qhelp markdown
+ if: inputs.run-code-checks == 'true'
+ uses: actions/upload-artifact@v3
+ with:
+ name: qhelp-markdown
+ path: go/qhelp-out/**/*.md
+
+ - name: Cache compilation cache
+ id: query-cache
+ uses: ./.github/actions/cache-query-compilation
+ with:
+ key: go-qltest
+
+ - name: Test
+ shell: bash
+ run: |
+ cd go
+ make test cache="${{ steps.query-cache.outputs.cache-dir }}"
From f0f6c229f6d10c6f3f770777a5bc23b1bd808439 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Mon, 29 Apr 2024 11:16:30 +0200
Subject: [PATCH 022/118] Go: fix regex in action for macOS
---
go/actions/test/action.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/go/actions/test/action.yml b/go/actions/test/action.yml
index f9bdee5fe0c..ade22410d95 100644
--- a/go/actions/test/action.yml
+++ b/go/actions/test/action.yml
@@ -13,7 +13,7 @@ runs:
run: |
(
echo -n "GO_VERSION="
- bazel run @rules_go//go -- version | sed 's/go version go\(\S*\) .*/\1/'
+ bazel run @rules_go//go -- version | sed 's/go version go\(.*\) .*/\1/'
) | tee -a "$GITHUB_ENV"
- name: Set up Go
From 1f78882cdc80011a86dfeb866b08dd46f3004121 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Mon, 29 Apr 2024 11:27:16 +0200
Subject: [PATCH 023/118] Go: make windows checks happy
---
go/actions/test/action.yml | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/go/actions/test/action.yml b/go/actions/test/action.yml
index ade22410d95..a351c4382ac 100644
--- a/go/actions/test/action.yml
+++ b/go/actions/test/action.yml
@@ -33,7 +33,7 @@ runs:
- name: Build
shell: bash
run: |
- bazel run //go:create-extractor-pack
+ bazel run go:create-extractor-pack
- name: Check that all Go code is autoformatted
if: inputs.run-code-checks == 'true'
@@ -46,7 +46,7 @@ runs:
if: inputs.run-code-checks == 'true'
shell: bash
run: |
- bazel run //go:gen
+ bazel run go:gen
git add .
git diff --exit-code HEAD || (
echo "please run bazel run //go:gen"
From 15bb846a5fb9a00748219475e4a2d436181e5e1a Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Mon, 29 Apr 2024 12:17:47 +0200
Subject: [PATCH 024/118] Go: add workaround for extractor pack windows
installer
---
go/BUILD.bazel | 23 +++++++++++++++++++++--
go/create_extractor_pack.py | 16 +++++++++++++---
2 files changed, 34 insertions(+), 5 deletions(-)
diff --git a/go/BUILD.bazel b/go/BUILD.bazel
index 41113d45f51..4251ebd228f 100644
--- a/go/BUILD.bazel
+++ b/go/BUILD.bazel
@@ -3,6 +3,7 @@ load("@gazelle//:def.bzl", "gazelle")
load("@rules_go//go:def.bzl", "go_cross_binary")
load("@rules_pkg//pkg:install.bzl", "pkg_install")
load("@rules_pkg//pkg:mappings.bzl", "pkg_attributes", "pkg_filegroup", "pkg_files")
+load("@rules_pkg//pkg:zip.bzl", "pkg_zip")
load("//:defs.bzl", "codeql_platform")
# following is needed for running gazelle on macOS
@@ -92,15 +93,33 @@ pkg_filegroup(
)
pkg_install(
- name = "_create_extractor_pack",
+ name = "_extractor-pack-installer",
srcs = [":extractor-pack"],
)
+# rules_pkg installer is currently broken on Windows
+# see https://github.com/bazelbuild/rules_pkg/issues/387
+# for now, work around it using an archive
+pkg_zip(
+ name = "_extractor-pack-zip",
+ srcs = [":extractor-pack"],
+)
+
+alias(
+ name = "_create-extractor-pack-arg",
+ actual = select({
+ "@platforms//os:windows": ":_extractor-pack-zip",
+ "//conditions:default": ":_extractor-pack-installer",
+ }),
+)
+
py_binary(
name = "create-extractor-pack",
srcs = ["create_extractor_pack.py"],
+ args = ["$(rlocationpath :_create-extractor-pack-arg)"],
+ data = [":_create-extractor-pack-arg"],
main = "create_extractor_pack.py",
- deps = [":_create_extractor_pack"],
+ deps = ["@rules_python//python/runfiles"],
)
native_binary(
diff --git a/go/create_extractor_pack.py b/go/create_extractor_pack.py
index 08665a2d8dc..a1154a777d8 100644
--- a/go/create_extractor_pack.py
+++ b/go/create_extractor_pack.py
@@ -2,7 +2,9 @@ import os
import pathlib
import shutil
import sys
-from go._create_extractor_pack_install_script import main
+import subprocess
+import zipfile
+from python.runfiles import runfiles
try:
workspace_dir = pathlib.Path(os.environ['BUILD_WORKSPACE_DIRECTORY'])
@@ -11,6 +13,14 @@ except KeyError:
sys.exit(1)
dest_dir = workspace_dir / 'go' / 'build' / 'codeql-extractor-go'
+installer_or_zip = pathlib.Path(runfiles.Create().Rlocation(sys.argv[1]))
+
shutil.rmtree(dest_dir, ignore_errors=True)
-os.environ['DESTDIR'] = str(dest_dir)
-main(sys.argv)
+
+if installer_or_zip.suffix == '.zip':
+ dest_dir.mkdir()
+ with zipfile.ZipFile(installer_or_zip) as pack:
+ pack.extractall(dest_dir)
+else:
+ os.environ['DESTDIR'] = str(dest_dir)
+ subprocess.check_call([installer_or_zip])
From e7886d0e572a3b13e073dce8a121ef44dd9e6e26 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Mon, 29 Apr 2024 13:31:48 +0200
Subject: [PATCH 025/118] Bazel: add empty registry override
---
.bazelrc | 3 +
.bazelrc.internal | 4 +
misc/bazel/registry/AUTHORS | 7 +
misc/bazel/registry/LICENSE | 202 ++++++++++++++++++++++++
misc/bazel/registry/NOTICE | 3 +
misc/bazel/registry/README.md | 3 +
misc/bazel/registry/bazel_registry.json | 3 +
misc/bazel/registry/fix.py | 55 +++++++
8 files changed, 280 insertions(+)
create mode 100644 .bazelrc.internal
create mode 100644 misc/bazel/registry/AUTHORS
create mode 100644 misc/bazel/registry/LICENSE
create mode 100644 misc/bazel/registry/NOTICE
create mode 100644 misc/bazel/registry/README.md
create mode 100644 misc/bazel/registry/bazel_registry.json
create mode 100755 misc/bazel/registry/fix.py
diff --git a/.bazelrc b/.bazelrc
index 12232b4bbd6..0a49f682da3 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -14,4 +14,7 @@ build:linux --cxxopt=-std=c++20
build:macos --cxxopt=-std=c++20 --cpu=darwin_x86_64
build:windows --cxxopt=/std:c++20 --cxxopt=/Zc:preprocessor
+common --registry=file:///%workspace%/misc/bazel/registry
+common --registry=https://bcr.bazel.build
+
try-import %workspace%/local.bazelrc
diff --git a/.bazelrc.internal b/.bazelrc.internal
new file mode 100644
index 00000000000..cdffa9ccdea
--- /dev/null
+++ b/.bazelrc.internal
@@ -0,0 +1,4 @@
+# this file should contain bazel settings required to build things from `semmle-code`
+
+common --registry=file:///%workspace%/ql/misc/bazel/registry
+common --registry=https://bcr.bazel.build
diff --git a/misc/bazel/registry/AUTHORS b/misc/bazel/registry/AUTHORS
new file mode 100644
index 00000000000..42818b292e7
--- /dev/null
+++ b/misc/bazel/registry/AUTHORS
@@ -0,0 +1,7 @@
+# This is the list of Bazel's significant contributors.
+#
+# This does not necessarily list everyone who has contributed code,
+# especially since many employees of one corporation may be contributing.
+# To see the full list of contributors, see the revision history in
+# source control.
+Google LLC
diff --git a/misc/bazel/registry/LICENSE b/misc/bazel/registry/LICENSE
new file mode 100644
index 00000000000..d6456956733
--- /dev/null
+++ b/misc/bazel/registry/LICENSE
@@ -0,0 +1,202 @@
+
+ Apache License
+ Version 2.0, January 2004
+ http://www.apache.org/licenses/
+
+ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+ 1. Definitions.
+
+ "License" shall mean the terms and conditions for use, reproduction,
+ and distribution as defined by Sections 1 through 9 of this document.
+
+ "Licensor" shall mean the copyright owner or entity authorized by
+ the copyright owner that is granting the License.
+
+ "Legal Entity" shall mean the union of the acting entity and all
+ other entities that control, are controlled by, or are under common
+ control with that entity. For the purposes of this definition,
+ "control" means (i) the power, direct or indirect, to cause the
+ direction or management of such entity, whether by contract or
+ otherwise, or (ii) ownership of fifty percent (50%) or more of the
+ outstanding shares, or (iii) beneficial ownership of such entity.
+
+ "You" (or "Your") shall mean an individual or Legal Entity
+ exercising permissions granted by this License.
+
+ "Source" form shall mean the preferred form for making modifications,
+ including but not limited to software source code, documentation
+ source, and configuration files.
+
+ "Object" form shall mean any form resulting from mechanical
+ transformation or translation of a Source form, including but
+ not limited to compiled object code, generated documentation,
+ and conversions to other media types.
+
+ "Work" shall mean the work of authorship, whether in Source or
+ Object form, made available under the License, as indicated by a
+ copyright notice that is included in or attached to the work
+ (an example is provided in the Appendix below).
+
+ "Derivative Works" shall mean any work, whether in Source or Object
+ form, that is based on (or derived from) the Work and for which the
+ editorial revisions, annotations, elaborations, or other modifications
+ represent, as a whole, an original work of authorship. For the purposes
+ of this License, Derivative Works shall not include works that remain
+ separable from, or merely link (or bind by name) to the interfaces of,
+ the Work and Derivative Works thereof.
+
+ "Contribution" shall mean any work of authorship, including
+ the original version of the Work and any modifications or additions
+ to that Work or Derivative Works thereof, that is intentionally
+ submitted to Licensor for inclusion in the Work by the copyright owner
+ or by an individual or Legal Entity authorized to submit on behalf of
+ the copyright owner. For the purposes of this definition, "submitted"
+ means any form of electronic, verbal, or written communication sent
+ to the Licensor or its representatives, including but not limited to
+ communication on electronic mailing lists, source code control systems,
+ and issue tracking systems that are managed by, or on behalf of, the
+ Licensor for the purpose of discussing and improving the Work, but
+ excluding communication that is conspicuously marked or otherwise
+ designated in writing by the copyright owner as "Not a Contribution."
+
+ "Contributor" shall mean Licensor and any individual or Legal Entity
+ on behalf of whom a Contribution has been received by Licensor and
+ subsequently incorporated within the Work.
+
+ 2. Grant of Copyright License. Subject to the terms and conditions of
+ this License, each Contributor hereby grants to You a perpetual,
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+ copyright license to reproduce, prepare Derivative Works of,
+ publicly display, publicly perform, sublicense, and distribute the
+ Work and such Derivative Works in Source or Object form.
+
+ 3. Grant of Patent License. Subject to the terms and conditions of
+ this License, each Contributor hereby grants to You a perpetual,
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+ (except as stated in this section) patent license to make, have made,
+ use, offer to sell, sell, import, and otherwise transfer the Work,
+ where such license applies only to those patent claims licensable
+ by such Contributor that are necessarily infringed by their
+ Contribution(s) alone or by combination of their Contribution(s)
+ with the Work to which such Contribution(s) was submitted. If You
+ institute patent litigation against any entity (including a
+ cross-claim or counterclaim in a lawsuit) alleging that the Work
+ or a Contribution incorporated within the Work constitutes direct
+ or contributory patent infringement, then any patent licenses
+ granted to You under this License for that Work shall terminate
+ as of the date such litigation is filed.
+
+ 4. Redistribution. You may reproduce and distribute copies of the
+ Work or Derivative Works thereof in any medium, with or without
+ modifications, and in Source or Object form, provided that You
+ meet the following conditions:
+
+ (a) You must give any other recipients of the Work or
+ Derivative Works a copy of this License; and
+
+ (b) You must cause any modified files to carry prominent notices
+ stating that You changed the files; and
+
+ (c) You must retain, in the Source form of any Derivative Works
+ that You distribute, all copyright, patent, trademark, and
+ attribution notices from the Source form of the Work,
+ excluding those notices that do not pertain to any part of
+ the Derivative Works; and
+
+ (d) If the Work includes a "NOTICE" text file as part of its
+ distribution, then any Derivative Works that You distribute must
+ include a readable copy of the attribution notices contained
+ within such NOTICE file, excluding those notices that do not
+ pertain to any part of the Derivative Works, in at least one
+ of the following places: within a NOTICE text file distributed
+ as part of the Derivative Works; within the Source form or
+ documentation, if provided along with the Derivative Works; or,
+ within a display generated by the Derivative Works, if and
+ wherever such third-party notices normally appear. The contents
+ of the NOTICE file are for informational purposes only and
+ do not modify the License. You may add Your own attribution
+ notices within Derivative Works that You distribute, alongside
+ or as an addendum to the NOTICE text from the Work, provided
+ that such additional attribution notices cannot be construed
+ as modifying the License.
+
+ You may add Your own copyright statement to Your modifications and
+ may provide additional or different license terms and conditions
+ for use, reproduction, or distribution of Your modifications, or
+ for any such Derivative Works as a whole, provided Your use,
+ reproduction, and distribution of the Work otherwise complies with
+ the conditions stated in this License.
+
+ 5. Submission of Contributions. Unless You explicitly state otherwise,
+ any Contribution intentionally submitted for inclusion in the Work
+ by You to the Licensor shall be under the terms and conditions of
+ this License, without any additional terms or conditions.
+ Notwithstanding the above, nothing herein shall supersede or modify
+ the terms of any separate license agreement you may have executed
+ with Licensor regarding such Contributions.
+
+ 6. Trademarks. This License does not grant permission to use the trade
+ names, trademarks, service marks, or product names of the Licensor,
+ except as required for reasonable and customary use in describing the
+ origin of the Work and reproducing the content of the NOTICE file.
+
+ 7. Disclaimer of Warranty. Unless required by applicable law or
+ agreed to in writing, Licensor provides the Work (and each
+ Contributor provides its Contributions) on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+ implied, including, without limitation, any warranties or conditions
+ of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+ PARTICULAR PURPOSE. You are solely responsible for determining the
+ appropriateness of using or redistributing the Work and assume any
+ risks associated with Your exercise of permissions under this License.
+
+ 8. Limitation of Liability. In no event and under no legal theory,
+ whether in tort (including negligence), contract, or otherwise,
+ unless required by applicable law (such as deliberate and grossly
+ negligent acts) or agreed to in writing, shall any Contributor be
+ liable to You for damages, including any direct, indirect, special,
+ incidental, or consequential damages of any character arising as a
+ result of this License or out of the use or inability to use the
+ Work (including but not limited to damages for loss of goodwill,
+ work stoppage, computer failure or malfunction, or any and all
+ other commercial damages or losses), even if such Contributor
+ has been advised of the possibility of such damages.
+
+ 9. Accepting Warranty or Additional Liability. While redistributing
+ the Work or Derivative Works thereof, You may choose to offer,
+ and charge a fee for, acceptance of support, warranty, indemnity,
+ or other liability obligations and/or rights consistent with this
+ License. However, in accepting such obligations, You may act only
+ on Your own behalf and on Your sole responsibility, not on behalf
+ of any other Contributor, and only if You agree to indemnify,
+ defend, and hold each Contributor harmless for any liability
+ incurred by, or claims asserted against, such Contributor by reason
+ of your accepting any such warranty or additional liability.
+
+ END OF TERMS AND CONDITIONS
+
+ APPENDIX: How to apply the Apache License to your work.
+
+ To apply the Apache License to your work, attach the following
+ boilerplate notice, with the fields enclosed by brackets "[]"
+ replaced with your own identifying information. (Don't include
+ the brackets!) The text should be enclosed in the appropriate
+ comment syntax for the file format. We also recommend that a
+ file or class name and description of purpose be included on the
+ same "printed page" as the copyright notice for easier
+ identification within third-party archives.
+
+ Copyright [yyyy] [name of copyright owner]
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
diff --git a/misc/bazel/registry/NOTICE b/misc/bazel/registry/NOTICE
new file mode 100644
index 00000000000..95329ae18f6
--- /dev/null
+++ b/misc/bazel/registry/NOTICE
@@ -0,0 +1,3 @@
+The files in this directory where originally taken from http://github.com/bazelbuild/bazel-central-registry and are
+a derivative work thereof, distributed under the Apache 2.0 license, with the following exceptions:
+* the `fix.py` file was added under the MIT license as the rest of the `codeql` repository.
diff --git a/misc/bazel/registry/README.md b/misc/bazel/registry/README.md
new file mode 100644
index 00000000000..5d1723d0eac
--- /dev/null
+++ b/misc/bazel/registry/README.md
@@ -0,0 +1,3 @@
+Versions to be patched can be taken from https://github.com/bazelbuild/bazel-central-repository. After adding patches
+inside `//patches`, and eventually renaming ``, run [`fix.py`](./fix.py) to align all metadata
+to the renamed version and added patches.
diff --git a/misc/bazel/registry/bazel_registry.json b/misc/bazel/registry/bazel_registry.json
new file mode 100644
index 00000000000..ea3f94f7a1e
--- /dev/null
+++ b/misc/bazel/registry/bazel_registry.json
@@ -0,0 +1,3 @@
+{
+ "mirrors": []
+}
diff --git a/misc/bazel/registry/fix.py b/misc/bazel/registry/fix.py
new file mode 100755
index 00000000000..a2b947e19e2
--- /dev/null
+++ b/misc/bazel/registry/fix.py
@@ -0,0 +1,55 @@
+#!/usr/bin/env python3
+
+# Copyright (c) 2024 GitHub, Inc.
+
+"""
+Fix metadata in overridden registry, updating `metadata.json` to list correct versions and `source.json`
+to list correct patches with sha256 hashes.
+"""
+
+import pathlib
+import json
+import base64
+import hashlib
+import re
+
+this_dir = pathlib.Path(__file__).resolve().parent
+
+
+def sha256(file):
+ with open(file, 'rb') as input:
+ hash = hashlib.sha256(input.read()).digest()
+ hash = base64.b64encode(hash).decode()
+ return f"sha256-{hash}"
+
+
+def patch_file(file, f):
+ try:
+ data = file.read_text()
+ except FileNotFoundError:
+ data = None
+ file.write_text(f(data))
+
+
+def patch_json(file, **kwargs):
+ def update(data):
+ data = json.loads(data) if data else {}
+ data.update(kwargs)
+ return json.dumps(data, indent=4) + "\n"
+
+ patch_file(file, update)
+
+
+for entry in this_dir.joinpath("modules").iterdir():
+ if not entry.is_dir():
+ continue
+ versions = [e for e in entry.iterdir() if e.is_dir()]
+
+ patch_json(entry / "metadata.json", versions=[v.name for v in versions])
+
+ for version in versions:
+ patch_json(version / "source.json", patches={
+ p.name: sha256(p) for p in version.joinpath("patches").iterdir()
+ })
+ patch_file(version / "MODULE.bazel",
+ lambda s: re.sub(r'''version\s*=\s*['"].*['"]''', f'version = "{version.name}"', s, 1))
From cb85a756a053b4f7526e3ef7ab88e4c044baa39d Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Mon, 29 Apr 2024 13:42:05 +0200
Subject: [PATCH 026/118] Bazel: patch `apple_support` to avoid registering its
toolchain
This is done in order to avoid requiring a full Xcode installation, but
still being able to use other `apple_support` facilities, like
`universal_binary`.
---
MODULE.bazel | 2 +-
.../1.15.1-codeql.1/MODULE.bazel | 17 ++++++++++++++++
.../1.15.1-codeql.1/patches/module.patch | 20 +++++++++++++++++++
.../apple_support/1.15.1-codeql.1/source.json | 9 +++++++++
.../modules/apple_support/metadata.json | 5 +++++
5 files changed, 52 insertions(+), 1 deletion(-)
create mode 100644 misc/bazel/registry/modules/apple_support/1.15.1-codeql.1/MODULE.bazel
create mode 100644 misc/bazel/registry/modules/apple_support/1.15.1-codeql.1/patches/module.patch
create mode 100644 misc/bazel/registry/modules/apple_support/1.15.1-codeql.1/source.json
create mode 100644 misc/bazel/registry/modules/apple_support/metadata.json
diff --git a/MODULE.bazel b/MODULE.bazel
index 5fd99f76740..875e61da383 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -13,7 +13,7 @@ local_path_override(
# see https://registry.bazel.build/ for a list of available packages
-bazel_dep(name = "apple_support", version = "1.15.1")
+bazel_dep(name = "apple_support", version = "1.15.1-codeql.1")
bazel_dep(name = "platforms", version = "0.0.9")
bazel_dep(name = "rules_go", version = "0.47.0")
bazel_dep(name = "rules_pkg", version = "0.10.1")
diff --git a/misc/bazel/registry/modules/apple_support/1.15.1-codeql.1/MODULE.bazel b/misc/bazel/registry/modules/apple_support/1.15.1-codeql.1/MODULE.bazel
new file mode 100644
index 00000000000..a58d520fee2
--- /dev/null
+++ b/misc/bazel/registry/modules/apple_support/1.15.1-codeql.1/MODULE.bazel
@@ -0,0 +1,17 @@
+module(
+ name = "apple_support",
+ version = "1.15.1-codeql.1",
+ bazel_compatibility = [">=6.0.0"],
+ compatibility_level = 1,
+ repo_name = "build_bazel_apple_support",
+)
+
+bazel_dep(name = "bazel_skylib", version = "1.3.0")
+bazel_dep(name = "platforms", version = "0.0.9")
+
+bazel_dep(
+ name = "stardoc",
+ version = "0.6.2",
+ dev_dependency = True,
+ repo_name = "io_bazel_stardoc",
+)
diff --git a/misc/bazel/registry/modules/apple_support/1.15.1-codeql.1/patches/module.patch b/misc/bazel/registry/modules/apple_support/1.15.1-codeql.1/patches/module.patch
new file mode 100644
index 00000000000..59fc49ec7b3
--- /dev/null
+++ b/misc/bazel/registry/modules/apple_support/1.15.1-codeql.1/patches/module.patch
@@ -0,0 +1,20 @@
+diff --git a/MODULE.bazel b/MODULE.bazel
+index 6b06c3b..99bc7c6 100644
+--- a/MODULE.bazel
++++ b/MODULE.bazel
+@@ -1,6 +1,6 @@
+ module(
+ name = "apple_support",
+- version = "0",
++ version = "1.15.1-codeql.1",
+ bazel_compatibility = [">=6.0.0"],
+ compatibility_level = 1,
+ repo_name = "build_bazel_apple_support",
+@@ -16,7 +16,3 @@ bazel_dep(
+ repo_name = "io_bazel_stardoc",
+ )
+
+-apple_cc_configure = use_extension("//crosstool:setup.bzl", "apple_cc_configure_extension")
+-use_repo(apple_cc_configure, "local_config_apple_cc", "local_config_apple_cc_toolchains")
+-
+-register_toolchains("@local_config_apple_cc_toolchains//:all")
diff --git a/misc/bazel/registry/modules/apple_support/1.15.1-codeql.1/source.json b/misc/bazel/registry/modules/apple_support/1.15.1-codeql.1/source.json
new file mode 100644
index 00000000000..57a1f2137fe
--- /dev/null
+++ b/misc/bazel/registry/modules/apple_support/1.15.1-codeql.1/source.json
@@ -0,0 +1,9 @@
+{
+ "integrity": "sha256-xLsrc2fEhDgjAK7nW+WYuS+EeJb7MbvSLzojRq32aoA=",
+ "strip_prefix": "",
+ "url": "https://github.com/bazelbuild/apple_support/releases/download/1.15.1/apple_support.1.15.1.tar.gz",
+ "patches": {
+ "module.patch": "sha256-K06B2W9t6nKcU8S5u6cWeNIdw/vGWWKAoJdGiI8CSS0="
+ },
+ "patch_strip": 1
+}
diff --git a/misc/bazel/registry/modules/apple_support/metadata.json b/misc/bazel/registry/modules/apple_support/metadata.json
new file mode 100644
index 00000000000..8a0e54c9abd
--- /dev/null
+++ b/misc/bazel/registry/modules/apple_support/metadata.json
@@ -0,0 +1,5 @@
+{
+ "versions": [
+ "1.15.1-codeql.1"
+ ]
+}
From 608791fd7f99166b6f6daba5b27f9abb7c37bac9 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Thu, 2 May 2024 09:13:40 +0200
Subject: [PATCH 027/118] Bazel/Go: use native cross compilation for fat
binaries
---
go/rules.bzl | 40 +++++++++++++++++++++++++++++----
misc/bazel/universal_binary.bzl | 24 --------------------
2 files changed, 36 insertions(+), 28 deletions(-)
delete mode 100644 misc/bazel/universal_binary.bzl
diff --git a/go/rules.bzl b/go/rules.bzl
index 4ef798001d2..e26dd57bf44 100644
--- a/go/rules.bzl
+++ b/go/rules.bzl
@@ -1,5 +1,37 @@
-load("@rules_go//go:def.bzl", "go_binary")
-load("//misc/bazel:universal_binary.bzl", "wrap_as_universal_binary")
+load("@rules_go//go:def.bzl", "go_binary", "go_cross_binary")
-def codeql_go_binary(**kwargs):
- wrap_as_universal_binary(go_binary, **kwargs)
+def codeql_go_binary(*, name, visibility = None, **kwargs):
+ def internal(prefix = "internal"):
+ return "%s/%s" % (prefix, name)
+
+ go_binary(
+ name = internal(),
+ visibility = ["//visibility:private"],
+ **kwargs
+ )
+ macos_targets = ("darwin_arm64", "darwin_amd64")
+ for target in macos_targets:
+ go_cross_binary(
+ name = internal(target),
+ platform = "@rules_go//go/toolchain:%s" % target,
+ target = internal(),
+ target_compatible_with = ["@platforms//os:macos"],
+ visibility = ["//visibility:private"],
+ )
+ native.genrule(
+ name = internal("universal"),
+ outs = [internal("universal_")],
+ srcs = [internal(t) for t in macos_targets],
+ target_compatible_with = ["@platforms//os:macos"],
+ executable = True,
+ visibility = ["//visibility:private"],
+ cmd = "lipo -create $(SRCS) -output $@",
+ )
+ native.alias(
+ name = name,
+ actual = select({
+ "@platforms//os:macos": internal("universal"),
+ "//conditions:default": internal(),
+ }),
+ visibility = visibility,
+ )
diff --git a/misc/bazel/universal_binary.bzl b/misc/bazel/universal_binary.bzl
deleted file mode 100644
index 85881356d0e..00000000000
--- a/misc/bazel/universal_binary.bzl
+++ /dev/null
@@ -1,24 +0,0 @@
-load("@apple_support//rules:universal_binary.bzl", _universal_binary = "universal_binary")
-
-def wrap_as_universal_binary(rule, *, name, visibility = None, **kwargs):
- internal_name = "internal/%s" % name
- universal_name = "universal/%s" % name
- rule(
- name = internal_name,
- visibility = ["//visibility:private"],
- **kwargs
- )
- _universal_binary(
- name = universal_name,
- target_compatible_with = ["@platforms//os:macos"],
- binary = internal_name,
- visibility = ["//visibility:private"],
- )
- native.alias(
- name = name,
- actual = select({
- "@platforms//os:macos": universal_name,
- "//conditions:default": internal_name,
- }),
- visibility = visibility,
- )
From 94212d103ec3cffd91f5efcffa668db36f99b7a7 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Thu, 2 May 2024 09:14:15 +0200
Subject: [PATCH 028/118] Bazel/Go: remove `apple_support`
This was actually unnecessary, and requried a full Xcode installation
that we'd rather avoid.
---
MODULE.bazel | 5 -----
go/BUILD.bazel | 13 ------------
.../1.15.1-codeql.1/MODULE.bazel | 17 ----------------
.../1.15.1-codeql.1/patches/module.patch | 20 -------------------
.../apple_support/1.15.1-codeql.1/source.json | 9 ---------
.../modules/apple_support/metadata.json | 5 -----
6 files changed, 69 deletions(-)
delete mode 100644 misc/bazel/registry/modules/apple_support/1.15.1-codeql.1/MODULE.bazel
delete mode 100644 misc/bazel/registry/modules/apple_support/1.15.1-codeql.1/patches/module.patch
delete mode 100644 misc/bazel/registry/modules/apple_support/1.15.1-codeql.1/source.json
delete mode 100644 misc/bazel/registry/modules/apple_support/metadata.json
diff --git a/MODULE.bazel b/MODULE.bazel
index 875e61da383..d069d320f07 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -13,7 +13,6 @@ local_path_override(
# see https://registry.bazel.build/ for a list of available packages
-bazel_dep(name = "apple_support", version = "1.15.1-codeql.1")
bazel_dep(name = "platforms", version = "0.0.9")
bazel_dep(name = "rules_go", version = "0.47.0")
bazel_dep(name = "rules_pkg", version = "0.10.1")
@@ -58,10 +57,6 @@ use_repo(node, "nodejs", "nodejs_toolchains")
go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")
go_sdk.download(version = "1.22.2") # default
-# following is needed for gazelle on macOS
-# see https://github.com/bazelbuild/bazel-gazelle/issues/1793
-go_sdk.download(version = "1.21.9")
-
register_toolchains(
"@nodejs_toolchains//:all",
)
diff --git a/go/BUILD.bazel b/go/BUILD.bazel
index 4251ebd228f..6c80e7cb258 100644
--- a/go/BUILD.bazel
+++ b/go/BUILD.bazel
@@ -1,26 +1,13 @@
load("@bazel_skylib//rules:native_binary.bzl", "native_binary")
load("@gazelle//:def.bzl", "gazelle")
-load("@rules_go//go:def.bzl", "go_cross_binary")
load("@rules_pkg//pkg:install.bzl", "pkg_install")
load("@rules_pkg//pkg:mappings.bzl", "pkg_attributes", "pkg_filegroup", "pkg_files")
load("@rules_pkg//pkg:zip.bzl", "pkg_zip")
load("//:defs.bzl", "codeql_platform")
-# following is needed for running gazelle on macOS
-# see https://github.com/bazelbuild/bazel-gazelle/issues/1793
-go_cross_binary(
- name = "gazelle-1.21.9",
- sdk_version = "1.21.9",
- target = "@gazelle//cmd/gazelle",
-)
-
gazelle(
name = "gazelle",
extra_args = ["go/extractor"],
- gazelle = select({
- "@platforms//os:macos": ":gazelle-1.21.9",
- "//conditions:default": "@gazelle//cmd/gazelle",
- }),
)
_gen_binaries = [
diff --git a/misc/bazel/registry/modules/apple_support/1.15.1-codeql.1/MODULE.bazel b/misc/bazel/registry/modules/apple_support/1.15.1-codeql.1/MODULE.bazel
deleted file mode 100644
index a58d520fee2..00000000000
--- a/misc/bazel/registry/modules/apple_support/1.15.1-codeql.1/MODULE.bazel
+++ /dev/null
@@ -1,17 +0,0 @@
-module(
- name = "apple_support",
- version = "1.15.1-codeql.1",
- bazel_compatibility = [">=6.0.0"],
- compatibility_level = 1,
- repo_name = "build_bazel_apple_support",
-)
-
-bazel_dep(name = "bazel_skylib", version = "1.3.0")
-bazel_dep(name = "platforms", version = "0.0.9")
-
-bazel_dep(
- name = "stardoc",
- version = "0.6.2",
- dev_dependency = True,
- repo_name = "io_bazel_stardoc",
-)
diff --git a/misc/bazel/registry/modules/apple_support/1.15.1-codeql.1/patches/module.patch b/misc/bazel/registry/modules/apple_support/1.15.1-codeql.1/patches/module.patch
deleted file mode 100644
index 59fc49ec7b3..00000000000
--- a/misc/bazel/registry/modules/apple_support/1.15.1-codeql.1/patches/module.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-diff --git a/MODULE.bazel b/MODULE.bazel
-index 6b06c3b..99bc7c6 100644
---- a/MODULE.bazel
-+++ b/MODULE.bazel
-@@ -1,6 +1,6 @@
- module(
- name = "apple_support",
-- version = "0",
-+ version = "1.15.1-codeql.1",
- bazel_compatibility = [">=6.0.0"],
- compatibility_level = 1,
- repo_name = "build_bazel_apple_support",
-@@ -16,7 +16,3 @@ bazel_dep(
- repo_name = "io_bazel_stardoc",
- )
-
--apple_cc_configure = use_extension("//crosstool:setup.bzl", "apple_cc_configure_extension")
--use_repo(apple_cc_configure, "local_config_apple_cc", "local_config_apple_cc_toolchains")
--
--register_toolchains("@local_config_apple_cc_toolchains//:all")
diff --git a/misc/bazel/registry/modules/apple_support/1.15.1-codeql.1/source.json b/misc/bazel/registry/modules/apple_support/1.15.1-codeql.1/source.json
deleted file mode 100644
index 57a1f2137fe..00000000000
--- a/misc/bazel/registry/modules/apple_support/1.15.1-codeql.1/source.json
+++ /dev/null
@@ -1,9 +0,0 @@
-{
- "integrity": "sha256-xLsrc2fEhDgjAK7nW+WYuS+EeJb7MbvSLzojRq32aoA=",
- "strip_prefix": "",
- "url": "https://github.com/bazelbuild/apple_support/releases/download/1.15.1/apple_support.1.15.1.tar.gz",
- "patches": {
- "module.patch": "sha256-K06B2W9t6nKcU8S5u6cWeNIdw/vGWWKAoJdGiI8CSS0="
- },
- "patch_strip": 1
-}
diff --git a/misc/bazel/registry/modules/apple_support/metadata.json b/misc/bazel/registry/modules/apple_support/metadata.json
deleted file mode 100644
index 8a0e54c9abd..00000000000
--- a/misc/bazel/registry/modules/apple_support/metadata.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
- "versions": [
- "1.15.1-codeql.1"
- ]
-}
From 6eb07a7a7e99ee2aec2373cf71172cfb0c4a5ba0 Mon Sep 17 00:00:00 2001
From: Felicity Chapman
Date: Thu, 2 May 2024 11:05:39 +0100
Subject: [PATCH 029/118] Apply suggestions from code review
Co-authored-by: Ben Ahmady <32935794+subatoi@users.noreply.github.com>
---
README.md | 2 +-
docs/codeql/ql-training/cpp/bad-overflow-guard.rst | 2 +-
docs/codeql/ql-training/cpp/control-flow-cpp.rst | 2 +-
docs/codeql/ql-training/cpp/data-flow-cpp.rst | 2 +-
docs/codeql/ql-training/cpp/global-data-flow-cpp.rst | 2 +-
docs/codeql/ql-training/cpp/intro-ql-cpp.rst | 2 +-
docs/codeql/ql-training/cpp/snprintf.rst | 2 +-
docs/codeql/ql-training/java/apache-struts-java.rst | 2 +-
docs/codeql/ql-training/java/data-flow-java.rst | 2 +-
docs/codeql/ql-training/java/global-data-flow-java.rst | 2 +-
docs/codeql/ql-training/java/intro-ql-java.rst | 2 +-
docs/codeql/ql-training/java/query-injection-java.rst | 2 +-
docs/codeql/ql-training/template.rst | 2 +-
docs/codeql/reusables/vs-code-deprecation-note.rst | 2 +-
python/ql/src/CHANGELOG.md | 2 +-
15 files changed, 15 insertions(+), 15 deletions(-)
diff --git a/README.md b/README.md
index 42382b1d834..2a0fad907f9 100644
--- a/README.md
+++ b/README.md
@@ -4,7 +4,7 @@ This open source repository contains the standard CodeQL libraries and queries t
## How do I learn CodeQL and run queries?
-There is [extensive documentation](https://codeql.github.com/docs/) on getting started with writing CodeQL using the [CodeQL extension for Visual Studio Code](https://docs.github.com/en/code-security/codeql-for-vs-code/) and the [CodeQL CLI](https://codeql.github.com/docs/codeql-cli/).
+There is [extensive documentation](https://codeql.github.com/docs/) on getting started with writing CodeQL using the [CodeQL extension for Visual Studio Code](https://docs.github.com/en/code-security/codeql-for-vs-code/) and the [CodeQL CLI](https://docs.github.com/en/code-security/codeql-cli).
## Contributing
diff --git a/docs/codeql/ql-training/cpp/bad-overflow-guard.rst b/docs/codeql/ql-training/cpp/bad-overflow-guard.rst
index 07a5b78af76..b2e6883dcae 100644
--- a/docs/codeql/ql-training/cpp/bad-overflow-guard.rst
+++ b/docs/codeql/ql-training/cpp/bad-overflow-guard.rst
@@ -9,7 +9,7 @@ CodeQL for C/C++
Setup
=====
-For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `ChakraCore `__ from GitHub.
+For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `ChakraCore `__ from GitHub.
Checking for overflow in C
==========================
diff --git a/docs/codeql/ql-training/cpp/control-flow-cpp.rst b/docs/codeql/ql-training/cpp/control-flow-cpp.rst
index d2bbc6a6af2..6c6905576e5 100644
--- a/docs/codeql/ql-training/cpp/control-flow-cpp.rst
+++ b/docs/codeql/ql-training/cpp/control-flow-cpp.rst
@@ -11,7 +11,7 @@ CodeQL for C/C++
Setup
=====
-For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `ChakraCore `__ from GitHub.
+For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `ChakraCore `__ from GitHub.
.. rst-class:: agenda
diff --git a/docs/codeql/ql-training/cpp/data-flow-cpp.rst b/docs/codeql/ql-training/cpp/data-flow-cpp.rst
index e46f72596be..8a22db69463 100644
--- a/docs/codeql/ql-training/cpp/data-flow-cpp.rst
+++ b/docs/codeql/ql-training/cpp/data-flow-cpp.rst
@@ -9,7 +9,7 @@ Finding string formatting vulnerabilities in C/C++
Setup
=====
-For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `dotnet/coreclr `__ from GitHub.
+For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `dotnet/coreclr `__ from GitHub.
.. rst-class:: agenda
diff --git a/docs/codeql/ql-training/cpp/global-data-flow-cpp.rst b/docs/codeql/ql-training/cpp/global-data-flow-cpp.rst
index c0dc6923f67..62c235b7696 100644
--- a/docs/codeql/ql-training/cpp/global-data-flow-cpp.rst
+++ b/docs/codeql/ql-training/cpp/global-data-flow-cpp.rst
@@ -9,7 +9,7 @@ CodeQL for C/C++
Setup
=====
-For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `dotnet/coreclr `__ from GitHub.
+For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `dotnet/coreclr `__ from GitHub.
.. rst-class:: agenda
diff --git a/docs/codeql/ql-training/cpp/intro-ql-cpp.rst b/docs/codeql/ql-training/cpp/intro-ql-cpp.rst
index 005f847b846..2511669a731 100644
--- a/docs/codeql/ql-training/cpp/intro-ql-cpp.rst
+++ b/docs/codeql/ql-training/cpp/intro-ql-cpp.rst
@@ -9,7 +9,7 @@ CodeQL for C/C++
Setup
=====
-For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `exiv2 `__ from GitHub.
+For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `exiv2 `__ from GitHub.
.. Include language-agnostic section here
diff --git a/docs/codeql/ql-training/cpp/snprintf.rst b/docs/codeql/ql-training/cpp/snprintf.rst
index d784d79f5f8..86c963fa1f2 100644
--- a/docs/codeql/ql-training/cpp/snprintf.rst
+++ b/docs/codeql/ql-training/cpp/snprintf.rst
@@ -9,7 +9,7 @@ CodeQL for C/C++
Setup
=====
-For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `rsyslog `__ from GitHub.
+For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `rsyslog `__ from GitHub.
``snprintf``
============
diff --git a/docs/codeql/ql-training/java/apache-struts-java.rst b/docs/codeql/ql-training/java/apache-struts-java.rst
index 4e5c4493db1..503dfad5450 100644
--- a/docs/codeql/ql-training/java/apache-struts-java.rst
+++ b/docs/codeql/ql-training/java/apache-struts-java.rst
@@ -13,7 +13,7 @@ Exercise: Apache Struts
Setup
=====
-For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `Apache Struts `__ from GitHub.
+For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `Apache Struts `__ from GitHub.
Unsafe deserialization in Struts
================================
diff --git a/docs/codeql/ql-training/java/data-flow-java.rst b/docs/codeql/ql-training/java/data-flow-java.rst
index 4353b618acf..1648589f5a5 100644
--- a/docs/codeql/ql-training/java/data-flow-java.rst
+++ b/docs/codeql/ql-training/java/data-flow-java.rst
@@ -9,7 +9,7 @@ Finding SPARQL injection vulnerabilities in Java
Setup
=====
-For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `VIVO Vitro `__ from GitHub.
+For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `VIVO Vitro `__ from GitHub.
.. rst-class:: agenda
diff --git a/docs/codeql/ql-training/java/global-data-flow-java.rst b/docs/codeql/ql-training/java/global-data-flow-java.rst
index 67e71c03391..0b6d4c08b90 100644
--- a/docs/codeql/ql-training/java/global-data-flow-java.rst
+++ b/docs/codeql/ql-training/java/global-data-flow-java.rst
@@ -9,7 +9,7 @@ CodeQL for Java
Setup
=====
-For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `Apache Struts `__ from GitHub.
+For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `Apache Struts `__ from GitHub.
.. rst-class:: agenda
diff --git a/docs/codeql/ql-training/java/intro-ql-java.rst b/docs/codeql/ql-training/java/intro-ql-java.rst
index 38e311060ec..9d546b62b37 100644
--- a/docs/codeql/ql-training/java/intro-ql-java.rst
+++ b/docs/codeql/ql-training/java/intro-ql-java.rst
@@ -9,7 +9,7 @@ CodeQL for Java
Setup
=====
-For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `Apache Struts `__ from GitHub.
+For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `Apache Struts `__ from GitHub.
.. Include language-agnostic section here
diff --git a/docs/codeql/ql-training/java/query-injection-java.rst b/docs/codeql/ql-training/java/query-injection-java.rst
index d1f8c17288a..028b26bfab6 100644
--- a/docs/codeql/ql-training/java/query-injection-java.rst
+++ b/docs/codeql/ql-training/java/query-injection-java.rst
@@ -9,7 +9,7 @@ CodeQL for Java
Setup
=====
-For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `VIVO Vitro `__ from GitHub.
+For this example you need to set up `CodeQL for Visual Studio Code `__ and download the CodeQL database for `VIVO Vitro `__ from GitHub.
SQL injection
=============
diff --git a/docs/codeql/ql-training/template.rst b/docs/codeql/ql-training/template.rst
index 7d525d9e3b2..761d5b36235 100644
--- a/docs/codeql/ql-training/template.rst
+++ b/docs/codeql/ql-training/template.rst
@@ -36,7 +36,7 @@ Setup
For this example you should download:
-- `CodeQL for Visual Studio Code `__
+- `CodeQL for Visual Studio Code `__
- A CodeQL database
.. note::
diff --git a/docs/codeql/reusables/vs-code-deprecation-note.rst b/docs/codeql/reusables/vs-code-deprecation-note.rst
index 3019939baa1..5f56c9cc0cb 100644
--- a/docs/codeql/reusables/vs-code-deprecation-note.rst
+++ b/docs/codeql/reusables/vs-code-deprecation-note.rst
@@ -2,5 +2,5 @@
Note
- This documentation was migrated to docs.github.com/en/code-security/codeql-for-vs-code on 2024/05/08, and this version is no longer maintained.
+ This documentation `was migrated `_ to docs.github.com/en/code-security/codeql-for-vs-code on 2024/05/08, and this version is no longer maintained.
\ No newline at end of file
diff --git a/python/ql/src/CHANGELOG.md b/python/ql/src/CHANGELOG.md
index a980559ca8e..aa139345d22 100644
--- a/python/ql/src/CHANGELOG.md
+++ b/python/ql/src/CHANGELOG.md
@@ -277,7 +277,7 @@ No user-facing changes.
### Bug Fixes
-* The [View AST functionality](https://docs.github.com/en/code-security/codeql-for-vs-code/) no longer prints detailed information about regular expressions, greatly improving performance.
+* The [View AST functionality](https://docs.github.com/en/code-security/codeql-for-vs-code/using-the-advanced-functionality-of-the-codeql-for-vs-code-extension/exploring-the-structure-of-your-source-code) no longer prints detailed information about regular expressions, greatly improving performance.
## 0.0.8
From 12b9b805e2f40fd72bf30c0c8178c6b04e647891 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Thu, 2 May 2024 12:37:47 +0200
Subject: [PATCH 030/118] Go: revert changes to `make` and CI to postpone them
in a separate PR
---
.github/workflows/go-tests-other-os.yml | 65 ++++++++++++++++--
.github/workflows/go-tests.yml | 51 +++++++++++++-
go/Makefile | 89 +++++++++++++++++++++++--
3 files changed, 191 insertions(+), 14 deletions(-)
diff --git a/.github/workflows/go-tests-other-os.yml b/.github/workflows/go-tests-other-os.yml
index 9915b0869db..ded53f868b7 100644
--- a/.github/workflows/go-tests-other-os.yml
+++ b/.github/workflows/go-tests-other-os.yml
@@ -7,6 +7,8 @@ on:
- .github/workflows/go-tests-other-os.yml
- .github/actions/**
- codeql-workspace.yml
+env:
+ GO_VERSION: '~1.22.0'
permissions:
contents: read
@@ -16,17 +18,72 @@ jobs:
name: Test MacOS
runs-on: macos-latest
steps:
+ - name: Set up Go ${{ env.GO_VERSION }}
+ uses: actions/setup-go@v5
+ with:
+ go-version: ${{ env.GO_VERSION }}
+ cache: false
+ id: go
+
- name: Check out code
uses: actions/checkout@v4
- - name: Run tests
- uses: ./go/actions/test
+
+ - name: Set up CodeQL CLI
+ uses: ./.github/actions/fetch-codeql
+
+ - name: Enable problem matchers in repository
+ shell: bash
+ run: 'find .github/problem-matchers -name \*.json -exec echo "::add-matcher::{}" \;'
+
+ - name: Build
+ run: |
+ cd go
+ make
+
+ - name: Cache compilation cache
+ id: query-cache
+ uses: ./.github/actions/cache-query-compilation
+ with:
+ key: go-qltest
+ - name: Test
+ run: |
+ cd go
+ make test cache="${{ steps.query-cache.outputs.cache-dir }}"
test-win:
if: github.repository_owner == 'github'
name: Test Windows
runs-on: windows-latest-xl
steps:
+ - name: Set up Go ${{ env.GO_VERSION }}
+ uses: actions/setup-go@v5
+ with:
+ go-version: ${{ env.GO_VERSION }}
+ cache: false
+ id: go
+
- name: Check out code
uses: actions/checkout@v4
- - name: Run tests
- uses: ./go/actions/test
+
+ - name: Set up CodeQL CLI
+ uses: ./.github/actions/fetch-codeql
+
+ - name: Enable problem matchers in repository
+ shell: bash
+ run: 'find .github/problem-matchers -name \*.json -exec echo "::add-matcher::{}" \;'
+
+ - name: Build
+ run: |
+ cd go
+ make
+
+ - name: Cache compilation cache
+ id: query-cache
+ uses: ./.github/actions/cache-query-compilation
+ with:
+ key: go-qltest
+
+ - name: Test
+ run: |
+ cd go
+ make test cache="${{ steps.query-cache.outputs.cache-dir }}"
diff --git a/.github/workflows/go-tests.yml b/.github/workflows/go-tests.yml
index 63e2b7c4974..6d9cac5dae9 100644
--- a/.github/workflows/go-tests.yml
+++ b/.github/workflows/go-tests.yml
@@ -16,6 +16,9 @@ on:
- .github/actions/**
- codeql-workspace.yml
+env:
+ GO_VERSION: '~1.22.0'
+
permissions:
contents: read
@@ -25,9 +28,51 @@ jobs:
name: Test Linux (Ubuntu)
runs-on: ubuntu-latest-xl
steps:
+ - name: Set up Go ${{ env.GO_VERSION }}
+ uses: actions/setup-go@v5
+ with:
+ go-version: ${{ env.GO_VERSION }}
+ cache: false
+ id: go
+
- name: Check out code
uses: actions/checkout@v4
- - name: Run tests
- uses: ./go/actions/test
+
+ - name: Set up CodeQL CLI
+ uses: ./.github/actions/fetch-codeql
+
+ - name: Enable problem matchers in repository
+ shell: bash
+ run: 'find .github/problem-matchers -name \*.json -exec echo "::add-matcher::{}" \;'
+
+ - name: Build
+ run: |
+ cd go
+ make
+
+ - name: Check that all Go code is autoformatted
+ run: |
+ cd go
+ make check-formatting
+
+ - name: Compile qhelp files to markdown
+ run: |
+ cd go
+ env QHELP_OUT_DIR=qhelp-out make qhelp-to-markdown
+
+ - name: Upload qhelp markdown
+ uses: actions/upload-artifact@v3
with:
- run-code-checks: true
+ name: qhelp-markdown
+ path: go/qhelp-out/**/*.md
+
+ - name: Cache compilation cache
+ id: query-cache
+ uses: ./.github/actions/cache-query-compilation
+ with:
+ key: go-qltest
+
+ - name: Test
+ run: |
+ cd go
+ make test cache="${{ steps.query-cache.outputs.cache-dir }}"
diff --git a/go/Makefile b/go/Makefile
index 3ebeb69fcaf..d0289a093a5 100644
--- a/go/Makefile
+++ b/go/Makefile
@@ -1,10 +1,30 @@
-all: gen extractor
+all: extractor ql/lib/go.dbscheme
+
+ifeq ($(OS),Windows_NT)
+EXE = .exe
+CODEQL_PLATFORM = win64
+else
+EXE =
+UNAME_S := $(shell uname -s)
+ifeq ($(UNAME_S),Linux)
+CODEQL_PLATFORM = linux64
+endif
+ifeq ($(UNAME_S),Darwin)
+CODEQL_PLATFORM = osx64
+endif
+endif
+
+CODEQL_TOOLS = $(addprefix codeql-tools/,autobuild.cmd autobuild.sh baseline-config-empty.json baseline-config-vendor.json configure-baseline.cmd configure-baseline.sh identify-environment.cmd identify-environment.sh index.cmd index.sh pre-finalize.cmd pre-finalize.sh tracing-config.lua)
EXTRACTOR_PACK_OUT = build/codeql-extractor-go
-.PHONY: extractor gen clean autoformat check-formatting
+BINARIES = go-extractor go-tokenizer go-autobuilder go-build-runner go-bootstrap go-gen-dbscheme
+
+.PHONY: tools tools-codeql tools-codeql-full clean autoformat \
+ tools-linux64 tools-osx64 tools-win64 check-formatting
clean:
+ rm -rf tools/bin tools/linux64 tools/osx64 tools/win64 tools/net tools/opencsv
rm -rf $(EXTRACTOR_PACK_OUT) build/stats build/testdb
autoformat:
@@ -27,11 +47,66 @@ endif
qhelp-to-markdown:
scripts/qhelp-to-markdown.sh ql/src "$(QHELP_OUT_DIR)"
-extractor:
- bazel run :create-extractor-pack
+tools: tools-codeql tools/tokenizer.jar
-gen:
- bazel run :gen
+.PHONY: $(addsuffix $(EXE),$(addprefix tools/bin/,$(BINARIES)))
+$(addsuffix $(EXE),$(addprefix tools/bin/,$(BINARIES))):
+ go build -C extractor -mod=vendor -o ../$@ ./cli/$(basename $(@F))
+
+tools-codeql: tools-$(CODEQL_PLATFORM)
+
+tools-codeql-full: tools-linux64 tools-osx64 tools-win64
+
+tools-linux64: $(addprefix tools/linux64/,$(BINARIES))
+
+.PHONY: $(addprefix tools/linux64/,$(BINARIES))
+$(addprefix tools/linux64/,$(BINARIES)):
+ GOOS=linux GOARCH=amd64 go build -C extractor -mod=vendor -o ../$@ ./cli/$(@F)
+
+tools-osx64: $(addprefix tools/osx64/,$(BINARIES))
+
+.PHONY: $(addprefix tools/osx64/,$(BINARIES))
+$(addprefix tools/osx64/,$(BINARIES)):
+ GOOS=darwin GOARCH=amd64 go build -C extractor -mod=vendor -o ../$@.amd64 ./cli/$(@F)
+ GOOS=darwin GOARCH=arm64 go build -C extractor -mod=vendor -o ../$@.arm64 ./cli/$(@F)
+ lipo -create $@.amd64 $@.arm64 -output $@
+ rm $@.amd64 $@.arm64
+
+tools-win64: $(addsuffix .exe,$(addprefix tools/win64/,$(BINARIES)))
+
+.PHONY: $(addsuffix .exe,$(addprefix tools/win64/,$(BINARIES)))
+$(addsuffix .exe,$(addprefix tools/win64/,$(BINARIES))):
+ env GOOS=windows GOARCH=amd64 go build -C extractor -mod=vendor -o ../$@ ./cli/$(basename $(@F))
+
+.PHONY: extractor-common extractor extractor-full
+extractor-common: codeql-extractor.yml LICENSE ql/lib/go.dbscheme \
+ tools/tokenizer.jar $(CODEQL_TOOLS)
+ rm -rf $(EXTRACTOR_PACK_OUT)
+ mkdir -p $(EXTRACTOR_PACK_OUT)
+ cp codeql-extractor.yml LICENSE ql/lib/go.dbscheme ql/lib/go.dbscheme.stats $(EXTRACTOR_PACK_OUT)
+ mkdir $(EXTRACTOR_PACK_OUT)/tools
+ cp -r tools/tokenizer.jar $(CODEQL_TOOLS) $(EXTRACTOR_PACK_OUT)/tools
+ cp -r downgrades $(EXTRACTOR_PACK_OUT)
+
+extractor: extractor-common tools-codeql
+ cp -r tools/$(CODEQL_PLATFORM) $(EXTRACTOR_PACK_OUT)/tools
+
+extractor-full: extractor-common tools-codeql-full
+ cp -r $(addprefix tools/,linux64 osx64 win64) $(EXTRACTOR_PACK_OUT)/tools
+
+tools/tokenizer.jar: tools/net/sourceforge/pmd/cpd/GoLanguage.class
+ jar cf $@ -C tools net
+ jar uf $@ -C tools opencsv
+
+tools/net/sourceforge/pmd/cpd/GoLanguage.class: extractor/net/sourceforge/pmd/cpd/GoLanguage.java
+ javac -cp extractor -d tools $<
+ rm tools/net/sourceforge/pmd/cpd/AbstractLanguage.class
+ rm tools/net/sourceforge/pmd/cpd/SourceCode.class
+ rm tools/net/sourceforge/pmd/cpd/TokenEntry.class
+ rm tools/net/sourceforge/pmd/cpd/Tokenizer.class
+
+ql/lib/go.dbscheme: tools/$(CODEQL_PLATFORM)/go-gen-dbscheme$(EXE)
+ $< $@
build/stats/src.stamp:
mkdir -p $(@D)/src
@@ -48,7 +123,7 @@ test: all build/testdb/check-upgrade-path
codeql test run -j0 ql/test --search-path build/codeql-extractor-go --consistency-queries ql/test/consistency --compilation-cache=$(cache)
# use GOOS=linux because GOOS=darwin GOARCH=386 is no longer supported
env GOOS=linux GOARCH=386 codeql$(EXE) test run -j0 ql/test/query-tests/Security/CWE-681 --search-path build/codeql-extractor-go --consistency-queries ql/test/consistency --compilation-cache=$(cache)
- cd extractor; bazel test ...
+ cd extractor; go test -mod=vendor ./...
bash extractor-smoke-test/test.sh || (echo "Extractor smoke test FAILED"; exit 1)
.PHONY: build/testdb/check-upgrade-path
From 7f271273010e58955e9be4ab017a6ee3b0247042 Mon Sep 17 00:00:00 2001
From: Felicity Chapman
Date: Thu, 2 May 2024 12:02:09 +0100
Subject: [PATCH 031/118] Update
docs/codeql/reusables/vs-code-deprecation-note.rst
---
docs/codeql/reusables/vs-code-deprecation-note.rst | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/docs/codeql/reusables/vs-code-deprecation-note.rst b/docs/codeql/reusables/vs-code-deprecation-note.rst
index 5f56c9cc0cb..73fae9b98a0 100644
--- a/docs/codeql/reusables/vs-code-deprecation-note.rst
+++ b/docs/codeql/reusables/vs-code-deprecation-note.rst
@@ -2,5 +2,5 @@
Note
- This documentation `was migrated `_ to docs.github.com/en/code-security/codeql-for-vs-code on 2024/05/08, and this version is no longer maintained.
+ This documentation `was migrated `__ to docs.github.com/en/code-security/codeql-for-vs-code on 2024/05/08, and this version is no longer maintained.
\ No newline at end of file
From 54793cfa01acc05b37f7bfe98db3a0de32c3e0da Mon Sep 17 00:00:00 2001
From: Felicity Chapman
Date: Thu, 2 May 2024 12:52:43 +0100
Subject: [PATCH 032/118] Update a couple of reusables
---
.../vs-code-basic-instructions/note-store-quick-query.rst | 2 +-
.../vs-code-basic-instructions/setup-to-run-queries.rst | 2 +-
docs/codeql/reusables/vs-code-deprecation-note.rst | 3 +--
3 files changed, 3 insertions(+), 4 deletions(-)
diff --git a/docs/codeql/reusables/vs-code-basic-instructions/note-store-quick-query.rst b/docs/codeql/reusables/vs-code-basic-instructions/note-store-quick-query.rst
index 3638b37d35e..070ff04a789 100644
--- a/docs/codeql/reusables/vs-code-basic-instructions/note-store-quick-query.rst
+++ b/docs/codeql/reusables/vs-code-basic-instructions/note-store-quick-query.rst
@@ -2,4 +2,4 @@
Note
- If you want to move your experimental query somewhere more permanent, you need to move the whole ``Quick Queries`` directory. The directory is a CodeQL pack with a ``qlpack.yml`` file that defines the content as queries for |language-text| CodeQL databases. For more information about CodeQL packs, see ":ref:`Working with CodeQL packs in Visual Studio Code `."
\ No newline at end of file
+ If you want to move your experimental query somewhere more permanent, you need to move the whole ``Quick Queries`` directory. The directory is a CodeQL pack with a ``qlpack.yml`` file that defines the content as queries for |language-text| CodeQL databases. For more information about CodeQL packs, see "`Managing CodeQL query packs and library packs `__."
diff --git a/docs/codeql/reusables/vs-code-basic-instructions/setup-to-run-queries.rst b/docs/codeql/reusables/vs-code-basic-instructions/setup-to-run-queries.rst
index 4e6ecf8daf2..3fe9e27013d 100644
--- a/docs/codeql/reusables/vs-code-basic-instructions/setup-to-run-queries.rst
+++ b/docs/codeql/reusables/vs-code-basic-instructions/setup-to-run-queries.rst
@@ -1 +1 @@
-For information about installing the CodeQL extension for Visual Studio code, see ":ref:`Setting up CodeQL in Visual Studio Code `."
\ No newline at end of file
+For information about installing the CodeQL extension for Visual Studio code, see "`Installing CodeQL for Visual Studio Code `__."
diff --git a/docs/codeql/reusables/vs-code-deprecation-note.rst b/docs/codeql/reusables/vs-code-deprecation-note.rst
index 73fae9b98a0..51e70e00d5e 100644
--- a/docs/codeql/reusables/vs-code-deprecation-note.rst
+++ b/docs/codeql/reusables/vs-code-deprecation-note.rst
@@ -2,5 +2,4 @@
Note
- This documentation `was migrated `__ to docs.github.com/en/code-security/codeql-for-vs-code on 2024/05/08, and this version is no longer maintained.
-
\ No newline at end of file
+ This documentation `was migrated `__ to ``docs.github.com/en/code-security/codeql-for-vs-code`` on 2024/05/08, and this version is no longer maintained.
From 9055d9567aa9e850e6c7836aa7086c847192d588 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Thu, 2 May 2024 15:08:51 +0200
Subject: [PATCH 033/118] Go: remove unused action (will be re-added later)
---
go/actions/test/action.yml | 80 --------------------------------------
1 file changed, 80 deletions(-)
delete mode 100644 go/actions/test/action.yml
diff --git a/go/actions/test/action.yml b/go/actions/test/action.yml
deleted file mode 100644
index a351c4382ac..00000000000
--- a/go/actions/test/action.yml
+++ /dev/null
@@ -1,80 +0,0 @@
-name: Test go extractor
-description: Run build, QL tests and optionally basic code sanity checks (formatting and generation)
-inputs:
- run-code-checks:
- description: Whether to run formatting, code and qhelp generation checks
- required: false
- default: false
-runs:
- using: composite
- steps:
- - name: Get go version
- shell: bash
- run: |
- (
- echo -n "GO_VERSION="
- bazel run @rules_go//go -- version | sed 's/go version go\(.*\) .*/\1/'
- ) | tee -a "$GITHUB_ENV"
-
- - name: Set up Go
- uses: actions/setup-go@v5
- with:
- go-version: ${{ env.GO_VERSION }}
- cache: false
- id: go
-
- - name: Set up CodeQL CLI
- uses: ./.github/actions/fetch-codeql
-
- - name: Enable problem matchers in repository
- shell: bash
- run: 'find .github/problem-matchers -name \*.json -exec echo "::add-matcher::{}" \;'
-
- - name: Build
- shell: bash
- run: |
- bazel run go:create-extractor-pack
-
- - name: Check that all Go code is autoformatted
- if: inputs.run-code-checks == 'true'
- shell: bash
- run: |
- cd go
- make check-formatting
-
- - name: Check checked-in generated code
- if: inputs.run-code-checks == 'true'
- shell: bash
- run: |
- bazel run go:gen
- git add .
- git diff --exit-code HEAD || (
- echo "please run bazel run //go:gen"
- exit 1
- )
-
- - name: Compile qhelp files to markdown
- if: inputs.run-code-checks == 'true'
- shell: bash
- run: |
- cd go
- env QHELP_OUT_DIR=qhelp-out make qhelp-to-markdown
-
- - name: Upload qhelp markdown
- if: inputs.run-code-checks == 'true'
- uses: actions/upload-artifact@v3
- with:
- name: qhelp-markdown
- path: go/qhelp-out/**/*.md
-
- - name: Cache compilation cache
- id: query-cache
- uses: ./.github/actions/cache-query-compilation
- with:
- key: go-qltest
-
- - name: Test
- shell: bash
- run: |
- cd go
- make test cache="${{ steps.query-cache.outputs.cache-dir }}"
From ca2d94b297820ff93ef072419c19de31d6c6dd57 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Thu, 2 May 2024 15:15:45 +0200
Subject: [PATCH 034/118] Fix go pattern in `.pre-commit-config.yaml`
---
.pre-commit-config.yaml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 055cab4ac05..5a0ccc4938f 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -31,7 +31,7 @@ repos:
- id: go-gen
name: Check checked in generated files in go
- files: go/.*
+ files: ^go/.*
language: system
entry: bazel run //go:gen
pass_filenames: false
From 318d954536bfca389d3c00812a84ff81f99ff64c Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Thu, 2 May 2024 15:38:47 +0200
Subject: [PATCH 035/118] Go: make `//go:gen` not clear by default, and clean
on `--force`
---
go/gen.py | 36 ++++++++++++++++++++++++++++++------
1 file changed, 30 insertions(+), 6 deletions(-)
diff --git a/go/gen.py b/go/gen.py
index b9394cd15b2..ebb57b2a685 100644
--- a/go/gen.py
+++ b/go/gen.py
@@ -2,8 +2,18 @@ import sys
import pathlib
import subprocess
import os
+import argparse
+import shutil
from python.runfiles import runfiles
+def options():
+ p = argparse.ArgumentParser(description="Update generated checked in files in the Go pack")
+ p.add_argument("--force", "-f", action="store_true", help="Regenerate all files from scratch rather than updating them")
+ p.add_argument("generators", nargs=3)
+ return p.parse_args()
+
+opts = options()
+
try:
workspace_dir = pathlib.Path(os.environ['BUILD_WORKSPACE_DIRECTORY'])
except KeyError:
@@ -13,20 +23,34 @@ except KeyError:
go_extractor_dir = workspace_dir / "go" / "extractor"
go_dbscheme = workspace_dir / "go" / "ql" / "lib" / "go.dbscheme"
r = runfiles.Create()
-go, gazelle, go_gen_dbscheme = map(r.Rlocation, sys.argv[1:])
+go, gazelle, go_gen_dbscheme = map(r.Rlocation, opts.generators)
-print("updating vendor")
+
+if opts.force:
+ print("clearing vendor directory")
+ shutil.rmtree(go_extractor_dir / "vendor")
+
+existing_build_files = set(go_extractor_dir.glob("*/**/BUILD.bazel"))
+
+print("updating vendor directory")
subprocess.check_call([go, "-C", go_extractor_dir, "work", "vendor"])
-print("clearing generated BUILD files")
-for build_file in go_extractor_dir.glob("*/**/BUILD.bazel"):
- build_file.unlink()
+if opts.force:
+ print("clearing generated BUILD files")
+ for build_file in existing_build_files:
+ build_file.unlink()
print("running gazelle")
subprocess.check_call([gazelle])
+build_files_to_update = set(go_extractor_dir.glob("*/**/BUILD.bazel"))
+if not opts.force:
+ build_files_to_update -= existing_build_files
+ # these are always refreshed
+ build_files_to_update.update(go_extractor_dir.glob("vendor/**/BUILD.bazel"))
+
print("adding header to generated BUILD files")
-for build_file in go_extractor_dir.glob("*/**/BUILD.bazel"):
+for build_file in build_files_to_update:
contents = build_file.read_text()
build_file.write_text(f"# generated running `bazel run //go/gazelle`, do not edit\n\n{contents}")
From 4ae82ac2150cd2c90cb708f1e810381367fb0fa7 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Thu, 2 May 2024 15:40:13 +0200
Subject: [PATCH 036/118] Go: add explanatory comment to `extractor` `BUILD`
file
---
go/extractor/BUILD.bazel | 1 +
1 file changed, 1 insertion(+)
diff --git a/go/extractor/BUILD.bazel b/go/extractor/BUILD.bazel
index cb7bc3ac8ef..32eaa8fda74 100644
--- a/go/extractor/BUILD.bazel
+++ b/go/extractor/BUILD.bazel
@@ -4,6 +4,7 @@ load("@rules_pkg//pkg:mappings.bzl", "pkg_files")
# gazelle:prefix github.com/github/codeql-go/extractor
# gazelle:map_kind go_binary codeql_go_binary //go:rules.bzl
+# following target is kept up to date by `bazel run //go:gen`, do not edit directly
go_library(
name = "extractor",
srcs = [
From 0bc6934bfc210d7efc2f87966ab13cae710a82a0 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Thu, 2 May 2024 15:44:06 +0200
Subject: [PATCH 037/118] Go: rename `pkg_files` to something less confusing
---
go/codeql-tools/BUILD.bazel | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/go/codeql-tools/BUILD.bazel b/go/codeql-tools/BUILD.bazel
index 4e839b4774b..8c3946b24ad 100644
--- a/go/codeql-tools/BUILD.bazel
+++ b/go/codeql-tools/BUILD.bazel
@@ -1,13 +1,13 @@
load("@rules_pkg//pkg:mappings.bzl", "pkg_attributes", "pkg_filegroup", "pkg_files")
pkg_files(
- name = "executables",
+ name = "sh-files",
srcs = glob(["*.sh"]),
attributes = pkg_attributes(mode = "0755"),
)
pkg_files(
- name = "non-executables",
+ name = "non-sh-files",
srcs = glob(
["*"],
exclude = [
@@ -20,8 +20,8 @@ pkg_files(
pkg_filegroup(
name = "codeql-tools",
srcs = [
- ":executables",
- ":non-executables",
+ ":non-sh-files",
+ ":sh-files",
],
prefix = "tools",
visibility = ["//go:__pkg__"],
From abcd9165b4b9ded2c2b9c297502df24529f95561 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Thu, 2 May 2024 16:08:17 +0200
Subject: [PATCH 038/118] Go: write test go runtime version in a specific file
---
.github/workflows/go-tests-other-os.yml | 10 ++++------
.github/workflows/go-tests.yml | 7 ++-----
go/ql/test/go.mod | 4 ----
go/test-runtime-version/go.work | 1 +
4 files changed, 7 insertions(+), 15 deletions(-)
delete mode 100644 go/ql/test/go.mod
create mode 100644 go/test-runtime-version/go.work
diff --git a/.github/workflows/go-tests-other-os.yml b/.github/workflows/go-tests-other-os.yml
index ded53f868b7..d38fd18f272 100644
--- a/.github/workflows/go-tests-other-os.yml
+++ b/.github/workflows/go-tests-other-os.yml
@@ -7,8 +7,6 @@ on:
- .github/workflows/go-tests-other-os.yml
- .github/actions/**
- codeql-workspace.yml
-env:
- GO_VERSION: '~1.22.0'
permissions:
contents: read
@@ -18,10 +16,10 @@ jobs:
name: Test MacOS
runs-on: macos-latest
steps:
- - name: Set up Go ${{ env.GO_VERSION }}
+ - name: Set up Go
uses: actions/setup-go@v5
with:
- go-version: ${{ env.GO_VERSION }}
+ go-version-file: go/test-runtime-version/go.work
cache: false
id: go
@@ -55,10 +53,10 @@ jobs:
name: Test Windows
runs-on: windows-latest-xl
steps:
- - name: Set up Go ${{ env.GO_VERSION }}
+ - name: Set up Go
uses: actions/setup-go@v5
with:
- go-version: ${{ env.GO_VERSION }}
+ go-version-file: go/test-runtime-version/go.work
cache: false
id: go
diff --git a/.github/workflows/go-tests.yml b/.github/workflows/go-tests.yml
index 6d9cac5dae9..60182bb2c81 100644
--- a/.github/workflows/go-tests.yml
+++ b/.github/workflows/go-tests.yml
@@ -16,9 +16,6 @@ on:
- .github/actions/**
- codeql-workspace.yml
-env:
- GO_VERSION: '~1.22.0'
-
permissions:
contents: read
@@ -28,10 +25,10 @@ jobs:
name: Test Linux (Ubuntu)
runs-on: ubuntu-latest-xl
steps:
- - name: Set up Go ${{ env.GO_VERSION }}
+ - name: Set up Go
uses: actions/setup-go@v5
with:
- go-version: ${{ env.GO_VERSION }}
+ go-version-file: go/test-runtime-version/go.work
cache: false
id: go
diff --git a/go/ql/test/go.mod b/go/ql/test/go.mod
deleted file mode 100644
index 2420613ecee..00000000000
--- a/go/ql/test/go.mod
+++ /dev/null
@@ -1,4 +0,0 @@
-module github.com/github/codeql-go/ql/test
-
-go 1.21
-
diff --git a/go/test-runtime-version/go.work b/go/test-runtime-version/go.work
new file mode 100644
index 00000000000..233b1008240
--- /dev/null
+++ b/go/test-runtime-version/go.work
@@ -0,0 +1 @@
+go 1.22
From 1aafc377adf9a809e59e3a66f24235e2671b1822 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Thu, 2 May 2024 16:22:24 +0200
Subject: [PATCH 039/118] Revert "Go: write test go runtime version in a
specific file"
This reverts commit abcd9165b4b9ded2c2b9c297502df24529f95561.
---
.github/workflows/go-tests-other-os.yml | 10 ++++++----
.github/workflows/go-tests.yml | 7 +++++--
go/ql/test/go.mod | 4 ++++
go/test-runtime-version/go.work | 1 -
4 files changed, 15 insertions(+), 7 deletions(-)
create mode 100644 go/ql/test/go.mod
delete mode 100644 go/test-runtime-version/go.work
diff --git a/.github/workflows/go-tests-other-os.yml b/.github/workflows/go-tests-other-os.yml
index d38fd18f272..ded53f868b7 100644
--- a/.github/workflows/go-tests-other-os.yml
+++ b/.github/workflows/go-tests-other-os.yml
@@ -7,6 +7,8 @@ on:
- .github/workflows/go-tests-other-os.yml
- .github/actions/**
- codeql-workspace.yml
+env:
+ GO_VERSION: '~1.22.0'
permissions:
contents: read
@@ -16,10 +18,10 @@ jobs:
name: Test MacOS
runs-on: macos-latest
steps:
- - name: Set up Go
+ - name: Set up Go ${{ env.GO_VERSION }}
uses: actions/setup-go@v5
with:
- go-version-file: go/test-runtime-version/go.work
+ go-version: ${{ env.GO_VERSION }}
cache: false
id: go
@@ -53,10 +55,10 @@ jobs:
name: Test Windows
runs-on: windows-latest-xl
steps:
- - name: Set up Go
+ - name: Set up Go ${{ env.GO_VERSION }}
uses: actions/setup-go@v5
with:
- go-version-file: go/test-runtime-version/go.work
+ go-version: ${{ env.GO_VERSION }}
cache: false
id: go
diff --git a/.github/workflows/go-tests.yml b/.github/workflows/go-tests.yml
index 60182bb2c81..6d9cac5dae9 100644
--- a/.github/workflows/go-tests.yml
+++ b/.github/workflows/go-tests.yml
@@ -16,6 +16,9 @@ on:
- .github/actions/**
- codeql-workspace.yml
+env:
+ GO_VERSION: '~1.22.0'
+
permissions:
contents: read
@@ -25,10 +28,10 @@ jobs:
name: Test Linux (Ubuntu)
runs-on: ubuntu-latest-xl
steps:
- - name: Set up Go
+ - name: Set up Go ${{ env.GO_VERSION }}
uses: actions/setup-go@v5
with:
- go-version-file: go/test-runtime-version/go.work
+ go-version: ${{ env.GO_VERSION }}
cache: false
id: go
diff --git a/go/ql/test/go.mod b/go/ql/test/go.mod
new file mode 100644
index 00000000000..2420613ecee
--- /dev/null
+++ b/go/ql/test/go.mod
@@ -0,0 +1,4 @@
+module github.com/github/codeql-go/ql/test
+
+go 1.21
+
diff --git a/go/test-runtime-version/go.work b/go/test-runtime-version/go.work
deleted file mode 100644
index 233b1008240..00000000000
--- a/go/test-runtime-version/go.work
+++ /dev/null
@@ -1 +0,0 @@
-go 1.22
From 76067cb12d88fdd761ac4dbfbd85eada52415977 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Thu, 2 May 2024 17:02:48 +0200
Subject: [PATCH 040/118] Go: skip `X:nocoverageredesign` printing by
autobuilder built with bazel
---
go/extractor/cli/go-autobuilder/go-autobuilder.go | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/go/extractor/cli/go-autobuilder/go-autobuilder.go b/go/extractor/cli/go-autobuilder/go-autobuilder.go
index 08f8477cac7..8df8b506918 100644
--- a/go/extractor/cli/go-autobuilder/go-autobuilder.go
+++ b/go/extractor/cli/go-autobuilder/go-autobuilder.go
@@ -487,7 +487,9 @@ func extract(workspace project.GoWorkspace) bool {
// Build the project and run the extractor.
func installDependenciesAndBuild() {
- log.Printf("Autobuilder was built with %s, environment has %s\n", runtime.Version(), toolchain.GetEnvGoVersion())
+ // do not print experiments the autobuilder was built with if any, only the version
+ version := strings.SplitN(runtime.Version(), " ", 2)[0]
+ log.Printf("Autobuilder was built with %s, environment has %s\n", version, toolchain.GetEnvGoVersion())
srcdir := getSourceDir()
From 00baccbc152af091936983ba111d0f5cc3b46c46 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Thu, 2 May 2024 17:08:23 +0200
Subject: [PATCH 041/118] Go: autoformat
---
go/extractor/cli/go-autobuilder/go-autobuilder.go | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/go/extractor/cli/go-autobuilder/go-autobuilder.go b/go/extractor/cli/go-autobuilder/go-autobuilder.go
index 8df8b506918..2e9731c989b 100644
--- a/go/extractor/cli/go-autobuilder/go-autobuilder.go
+++ b/go/extractor/cli/go-autobuilder/go-autobuilder.go
@@ -487,8 +487,8 @@ func extract(workspace project.GoWorkspace) bool {
// Build the project and run the extractor.
func installDependenciesAndBuild() {
- // do not print experiments the autobuilder was built with if any, only the version
- version := strings.SplitN(runtime.Version(), " ", 2)[0]
+ // do not print experiments the autobuilder was built with if any, only the version
+ version := strings.SplitN(runtime.Version(), " ", 2)[0]
log.Printf("Autobuilder was built with %s, environment has %s\n", version, toolchain.GetEnvGoVersion())
srcdir := getSourceDir()
From 355c7d9b41f017ff54d0f8c552cbae12262ca35d Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Wed, 1 May 2024 09:29:56 +0100
Subject: [PATCH 042/118] C++: Rename an example file.
---
...ongTypeFormatArguments.cpp => WrongTypeFormatArgumentsBad.cpp} | 0
1 file changed, 0 insertions(+), 0 deletions(-)
rename cpp/ql/src/Likely Bugs/Format/{WrongTypeFormatArguments.cpp => WrongTypeFormatArgumentsBad.cpp} (100%)
diff --git a/cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArguments.cpp b/cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArgumentsBad.cpp
similarity index 100%
rename from cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArguments.cpp
rename to cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArgumentsBad.cpp
From e22159ab5d4e15c6b99ac236303d5b380c1fb06d Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 May 2024 14:20:02 +0100
Subject: [PATCH 043/118] C++: Update WrongTypeFormatArguments.qhelp.
---
.../Format/WrongTypeFormatArguments.qhelp | 27 +++++++++++--------
.../Format/WrongTypeFormatArgumentsBad.cpp | 2 +-
.../Format/WrongTypeFormatArgumentsGood.cpp | 4 +++
3 files changed, 21 insertions(+), 12 deletions(-)
create mode 100644 cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArgumentsGood.cpp
diff --git a/cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArguments.qhelp b/cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArguments.qhelp
index 02bfd391a33..6b3393febe1 100644
--- a/cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArguments.qhelp
+++ b/cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArguments.qhelp
@@ -4,29 +4,34 @@
Each call to the printf function or a related function should include
-the type and sequence of arguments defined by the format. If the function is passed arguments
+the type and sequence of arguments defined by the format. If the function is passed arguments
of a different type or in a different sequence then the arguments are reinterpreted to fit the type and sequence expected, resulting in unpredictable behavior.
-Review the format and arguments expected by the highlighted function calls. Update either
-the format or the arguments so that the expected type and sequence of arguments are passed to
+
Review the format and arguments expected by the highlighted function calls. Update either
+the format or the arguments so that the expected type and sequence of arguments are passed to
the function.
-
+
+
+In the following example, the wrong format specifier is given for an integer format argument:
+
+
+
+The corrected version uses %i as the format specifier for the integer format argument:
+
+
-CERT C Coding
-Standard: FIO30-C. Exclude user input from format strings.
-cplusplus.com: C++ Functions.
-CRT Alphabetical Function Reference: printf, _printf_l, wprintf, _wprintf_l.
-
-
-
+Microsoft Learn: Format specification syntax: printf and wprintf functions.
+cplusplus.com:printf
+CERT C Coding"
+Standard: FIO47-C. Use valid format strings.
diff --git a/cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArgumentsBad.cpp b/cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArgumentsBad.cpp
index c3dd09c3071..046233af1b0 100644
--- a/cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArgumentsBad.cpp
+++ b/cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArgumentsBad.cpp
@@ -1,4 +1,4 @@
int main() {
- printf("%s\n", 42); //printf will treat 42 as a char*, will most likely segfault
+ printf("%s\n", 42); // BAD: printf will treat 42 as a char*, will most likely segfault
return 0;
}
diff --git a/cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArgumentsGood.cpp b/cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArgumentsGood.cpp
new file mode 100644
index 00000000000..0bd3fb5c439
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArgumentsGood.cpp
@@ -0,0 +1,4 @@
+int main() {
+ printf("%i\n", 42); // GOOD: printf will treat 42 as an int
+ return 0;
+}
From 06d8892e03008533712bcabfbd94daae4d335567 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 May 2024 14:22:27 +0100
Subject: [PATCH 044/118] C++: Rename an example file.
---
.../{StrncpyFlippedArgs.cpp => StrncpyFlippedArgsBad.cpp} | 0
1 file changed, 0 insertions(+), 0 deletions(-)
rename cpp/ql/src/Likely Bugs/Memory Management/{StrncpyFlippedArgs.cpp => StrncpyFlippedArgsBad.cpp} (100%)
diff --git a/cpp/ql/src/Likely Bugs/Memory Management/StrncpyFlippedArgs.cpp b/cpp/ql/src/Likely Bugs/Memory Management/StrncpyFlippedArgsBad.cpp
similarity index 100%
rename from cpp/ql/src/Likely Bugs/Memory Management/StrncpyFlippedArgs.cpp
rename to cpp/ql/src/Likely Bugs/Memory Management/StrncpyFlippedArgsBad.cpp
From 8a261b7e7a2ac760daa54dd126f13fcf78290a0a Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 May 2024 14:31:26 +0100
Subject: [PATCH 045/118] C++: Update StrncpyFlippedArgs.qhelp.
---
.../Memory Management/StrncpyFlippedArgs.qhelp | 9 +++++++--
.../Memory Management/StrncpyFlippedArgsBad.cpp | 11 +++++++++--
.../Memory Management/StrncpyFlippedArgsGood.cpp | 10 ++++++++++
3 files changed, 26 insertions(+), 4 deletions(-)
create mode 100644 cpp/ql/src/Likely Bugs/Memory Management/StrncpyFlippedArgsGood.cpp
diff --git a/cpp/ql/src/Likely Bugs/Memory Management/StrncpyFlippedArgs.qhelp b/cpp/ql/src/Likely Bugs/Memory Management/StrncpyFlippedArgs.qhelp
index 2e297116710..9ba2b7c7c8e 100644
--- a/cpp/ql/src/Likely Bugs/Memory Management/StrncpyFlippedArgs.qhelp
+++ b/cpp/ql/src/Likely Bugs/Memory Management/StrncpyFlippedArgs.qhelp
@@ -3,7 +3,7 @@
"qhelp.dtd">
-The standard library function strncpy copies a source string to a destination buffer. The third argument defines the maximum number of characters to copy and should be less than
+
The standard library function strncpy copies a source string to a destination buffer. The third argument defines the maximum number of characters to copy and should be less than
or equal to the size of the destination buffer. Calls of the form strncpy(dest, src, strlen(src)) or strncpy(dest, src, sizeof(src)) incorrectly set the third argument to the size of the source buffer. Executing a call of this type may cause a buffer overflow. Buffer overflows can lead to anything from a segmentation fault to a security vulnerability.
@@ -12,9 +12,14 @@ or equal to the size of the destination buffer. Calls of the form strncpy(
not the source buffer.
-
+In the following examples, the size of the source buffer is incorrectly used as a parameter to strncpy:
+
+
+The corrected version uses the size of the destination buffer, or a variable containing the size of the destination buffer as the size parameter to strncpy:
+
+
diff --git a/cpp/ql/src/Likely Bugs/Memory Management/StrncpyFlippedArgsBad.cpp b/cpp/ql/src/Likely Bugs/Memory Management/StrncpyFlippedArgsBad.cpp
index 07acc91cd5a..952550b2638 100644
--- a/cpp/ql/src/Likely Bugs/Memory Management/StrncpyFlippedArgsBad.cpp
+++ b/cpp/ql/src/Likely Bugs/Memory Management/StrncpyFlippedArgsBad.cpp
@@ -1,2 +1,9 @@
-strncpy(dest, src, sizeof(src)); //wrong: size of dest should be used
-strncpy(dest, src, strlen(src)); //wrong: size of dest should be used
+char src[256];
+char dest1[128];
+
+...
+
+strncpy(dest1, src, sizeof(src)); // wrong: size of dest should be used
+
+char *dest2 = (char *)malloc(sz1 + sz2 + sz3);
+strncpy(dest2, src, strlen(src)); // wrong: size of dest should be used
diff --git a/cpp/ql/src/Likely Bugs/Memory Management/StrncpyFlippedArgsGood.cpp b/cpp/ql/src/Likely Bugs/Memory Management/StrncpyFlippedArgsGood.cpp
new file mode 100644
index 00000000000..22fc4ebd222
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/Memory Management/StrncpyFlippedArgsGood.cpp
@@ -0,0 +1,10 @@
+char src[256];
+char dest1[128];
+
+...
+
+strncpy(dest1, src, sizeof(dest1)); // correct
+
+size_t destSize = sz1 + sz2 + sz3;
+char *dest2 = (char *)malloc(destSize);
+strncpy(dest2, src, destSize); // correct
From 8f682ef4e4fd492169f384da3fc03f44fe3753e6 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 May 2024 14:17:11 +0100
Subject: [PATCH 046/118] C++: Improve quality of some qhelp references.
---
.../src/Likely Bugs/Format/TooManyFormatArguments.qhelp | 4 +---
.../Format/WrongNumberOfFormatArguments.qhelp | 9 +++------
.../Likely Bugs/Format/WrongTypeFormatArguments.qhelp | 3 +--
3 files changed, 5 insertions(+), 11 deletions(-)
diff --git a/cpp/ql/src/Likely Bugs/Format/TooManyFormatArguments.qhelp b/cpp/ql/src/Likely Bugs/Format/TooManyFormatArguments.qhelp
index bbd64254d54..b4df60cbac7 100644
--- a/cpp/ql/src/Likely Bugs/Format/TooManyFormatArguments.qhelp
+++ b/cpp/ql/src/Likely Bugs/Format/TooManyFormatArguments.qhelp
@@ -22,10 +22,8 @@ function.
-cplusplus.com: C++ Functions.
+CERT C Coding Standard: FIO47-C. Use valid format strings.
Microsoft C Runtime Library Reference: printf, wprintf.
-
-
diff --git a/cpp/ql/src/Likely Bugs/Format/WrongNumberOfFormatArguments.qhelp b/cpp/ql/src/Likely Bugs/Format/WrongNumberOfFormatArguments.qhelp
index 66344e93f22..bb4687b2d9a 100644
--- a/cpp/ql/src/Likely Bugs/Format/WrongNumberOfFormatArguments.qhelp
+++ b/cpp/ql/src/Likely Bugs/Format/WrongNumberOfFormatArguments.qhelp
@@ -19,8 +19,8 @@ contents.
-Review the format and arguments expected by the highlighted function calls. Update either
-the format or the arguments so that the expected number of arguments are passed to the
+
Review the format and arguments expected by the highlighted function calls. Update either
+the format or the arguments so that the expected number of arguments are passed to the
function.
@@ -30,11 +30,8 @@ function.
-CERT C Coding
-Standard: FIO30-C. Exclude user input from format strings.
-cplusplus.com: C++ Functions.
+CERT C Coding Standard: FIO47-C. Use valid format strings.
Microsoft C Runtime Library Reference: printf, wprintf.
-
diff --git a/cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArguments.qhelp b/cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArguments.qhelp
index 6b3393febe1..476d37fb300 100644
--- a/cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArguments.qhelp
+++ b/cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArguments.qhelp
@@ -30,8 +30,7 @@ the function.
Microsoft Learn: Format specification syntax: printf and wprintf functions.
cplusplus.com:printf
-CERT C Coding"
-Standard: FIO47-C. Use valid format strings.
+CERT C Coding Standard: FIO47-C. Use valid format strings.
From f4e4e238ba2da04b4a55cb81218084f7398d3981 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 May 2024 16:09:03 +0100
Subject: [PATCH 047/118] C++: Add test cases for IncorrectNotOperatorUsage.ql.
---
.../IncorrectNotOperatorUsage.cpp | 5 ++---
.../IncorrectNotOperatorUsage.cpp | 21 ++++++++++++++++++-
.../IncorrectNotOperatorUsage.expected | 1 +
3 files changed, 23 insertions(+), 4 deletions(-)
diff --git a/cpp/ql/src/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage.cpp b/cpp/ql/src/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage.cpp
index c3640a66ab6..c345e5a88a9 100644
--- a/cpp/ql/src/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage.cpp
+++ b/cpp/ql/src/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage.cpp
@@ -4,17 +4,16 @@ void f_warning(int i)
{
// The usage of the logical not operator in this case is unlikely to be correct
// as the output is being used as an operator for a bit-wise and operation
- if (i & !FLAGS)
+ if (i & !FLAGS)
{
// code
}
}
-
void f_fixed(int i)
{
if (i & ~FLAGS) // Changing the logical not operator for the bit-wise not operator would fix this logic
{
// code
}
-}
\ No newline at end of file
+}
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage/IncorrectNotOperatorUsage.cpp b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage/IncorrectNotOperatorUsage.cpp
index 90c21ca90f3..ac3f1ab3ed5 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage/IncorrectNotOperatorUsage.cpp
+++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage/IncorrectNotOperatorUsage.cpp
@@ -3,7 +3,7 @@
void C6317_positive(int i)
{
- if (i & !FLAGS) // BUG
+ if (i & !FLAGS) // BUG
{
}
}
@@ -71,3 +71,22 @@ void macroUsage(unsigned int arg1, unsigned int arg2)
}
}
+
+void bool_examples(bool a, bool b)
+{
+ if (a & !b) // dubious (confusing intent, but shouldn't produce a wrong result)
+ {
+ }
+
+ if (a & ~b)
+ {
+ }
+
+ if (a && ~b)
+ {
+ }
+
+ if (a && !b)
+ {
+ }
+}
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage/IncorrectNotOperatorUsage.expected b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage/IncorrectNotOperatorUsage.expected
index a5bbea858da..9c6d4154bf5 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage/IncorrectNotOperatorUsage.expected
+++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage/IncorrectNotOperatorUsage.expected
@@ -14,3 +14,4 @@
| IncorrectNotOperatorUsage.cpp:48:9:48:18 | ... \| ... | Usage of a logical not (!) expression as a bitwise operator. |
| IncorrectNotOperatorUsage.cpp:49:9:49:20 | ... \| ... | Usage of a logical not (!) expression as a bitwise operator. |
| IncorrectNotOperatorUsage.cpp:70:10:70:34 | ... \| ... | Usage of a logical not (!) expression as a bitwise operator. |
+| IncorrectNotOperatorUsage.cpp:77:9:77:14 | ... & ... | Usage of a logical not (!) expression as a bitwise operator. |
From 8a04840f933cd6efba82bcba6c3c905344b07abd Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 May 2024 16:32:45 +0100
Subject: [PATCH 048/118] C++: Improve qhelp for IncorrectNotOperatorUsage.ql,
including mention of an alternative fix.
---
.../Likely Bugs/Likely Typos/IncorrectNotOperatorUsage.cpp | 4 ++--
.../Likely Bugs/Likely Typos/IncorrectNotOperatorUsage.qhelp | 2 ++
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/cpp/ql/src/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage.cpp b/cpp/ql/src/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage.cpp
index c345e5a88a9..29eef7c2b1f 100644
--- a/cpp/ql/src/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage.cpp
+++ b/cpp/ql/src/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage.cpp
@@ -2,7 +2,7 @@
void f_warning(int i)
{
- // The usage of the logical not operator in this case is unlikely to be correct
+ // BAD: the usage of the logical not operator in this case is unlikely to be correct
// as the output is being used as an operator for a bit-wise and operation
if (i & !FLAGS)
{
@@ -12,7 +12,7 @@ void f_warning(int i)
void f_fixed(int i)
{
- if (i & ~FLAGS) // Changing the logical not operator for the bit-wise not operator would fix this logic
+ if (i & ~FLAGS) // GOOD: Changing the logical not operator for the bit-wise not operator would fix this logic
{
// code
}
diff --git a/cpp/ql/src/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage.qhelp b/cpp/ql/src/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage.qhelp
index bac09fe9cf1..bd89593d96c 100644
--- a/cpp/ql/src/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage.qhelp
+++ b/cpp/ql/src/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage.qhelp
@@ -16,7 +16,9 @@
Carefully inspect the flagged expressions. Consider the intent in the code logic, and decide whether it is necessary to change the not operator.
+Here is an example of this issue and how it can be fixed:
+In other cases, particularly when the expressions have bool type, the fix may instead be of the form a && !b
From 669fc925e0c562d4f880ad2039811ad4d8932b14 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 May 2024 17:24:20 +0100
Subject: [PATCH 049/118] C++: Fix qhelp formatting.
---
.../Likely Typos/IncorrectNotOperatorUsage.qhelp | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/cpp/ql/src/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage.qhelp b/cpp/ql/src/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage.qhelp
index bd89593d96c..251e26d50f7 100644
--- a/cpp/ql/src/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage.qhelp
+++ b/cpp/ql/src/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage.qhelp
@@ -16,9 +16,13 @@
Carefully inspect the flagged expressions. Consider the intent in the code logic, and decide whether it is necessary to change the not operator.
+
Here is an example of this issue and how it can be fixed:
-
+
+
+
In other cases, particularly when the expressions have bool type, the fix may instead be of the form a && !b
+
From ecbf7aef181553960e87b231c1668655106183c8 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 May 2024 17:26:24 +0100
Subject: [PATCH 050/118] C++: Fix qhelp formatting.
---
.../Likely Bugs/Memory Management/StrncpyFlippedArgs.qhelp | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/cpp/ql/src/Likely Bugs/Memory Management/StrncpyFlippedArgs.qhelp b/cpp/ql/src/Likely Bugs/Memory Management/StrncpyFlippedArgs.qhelp
index 9ba2b7c7c8e..4ef13551ad2 100644
--- a/cpp/ql/src/Likely Bugs/Memory Management/StrncpyFlippedArgs.qhelp
+++ b/cpp/ql/src/Likely Bugs/Memory Management/StrncpyFlippedArgs.qhelp
@@ -13,15 +13,16 @@ not the source buffer.
+
In the following examples, the size of the source buffer is incorrectly used as a parameter to strncpy:
-
+
The corrected version uses the size of the destination buffer, or a variable containing the size of the destination buffer as the size parameter to strncpy:
-
-
+
+
cplusplus.com: strncpy.
From 657402b42f06ef5d6278c2a0cce0f6f2272beab7 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 May 2024 17:31:09 +0100
Subject: [PATCH 051/118] C++: Fix % character in qhelp.
---
cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArguments.qhelp | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArguments.qhelp b/cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArguments.qhelp
index 476d37fb300..055adeb741f 100644
--- a/cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArguments.qhelp
+++ b/cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArguments.qhelp
@@ -21,7 +21,7 @@ the function.
-The corrected version uses %i as the format specifier for the integer format argument:
+The corrected version uses %i as the format specifier for the integer format argument:
From 08e08a2b3ac4dcdf31896ac4f8841a17328dbbfc Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 May 2024 17:32:24 +0100
Subject: [PATCH 052/118] C++: Qhelp punctuation.
---
.../Likely Bugs/Likely Typos/IncorrectNotOperatorUsage.qhelp | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/cpp/ql/src/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage.qhelp b/cpp/ql/src/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage.qhelp
index 251e26d50f7..a33685bdb6f 100644
--- a/cpp/ql/src/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage.qhelp
+++ b/cpp/ql/src/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage.qhelp
@@ -21,7 +21,7 @@
-In other cases, particularly when the expressions have bool type, the fix may instead be of the form a && !b
+In other cases, particularly when the expressions have bool type, the fix may instead be of the form a && !b
.
From 73cc211779611c30afe5879746edb68eaa43baa5 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 May 2024 17:36:35 +0100
Subject: [PATCH 053/118] C++: Fix qhelp error.
---
.../Likely Bugs/Likely Typos/IncorrectNotOperatorUsage.qhelp | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/cpp/ql/src/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage.qhelp b/cpp/ql/src/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage.qhelp
index a33685bdb6f..3b5824c314a 100644
--- a/cpp/ql/src/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage.qhelp
+++ b/cpp/ql/src/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage.qhelp
@@ -21,7 +21,7 @@
-In other cases, particularly when the expressions have bool type, the fix may instead be of the form a && !b
.
+In other cases, particularly when the expressions have bool type, the fix may instead be of the form a && !b.
From f5431abb1095ecf3ca9a27d4f7c8ad92bfc47995 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 May 2024 17:37:52 +0100
Subject: [PATCH 054/118] C++: Fix strncpy reference link (the old link was
broken).
---
.../src/Likely Bugs/Memory Management/StrncpyFlippedArgs.qhelp | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/cpp/ql/src/Likely Bugs/Memory Management/StrncpyFlippedArgs.qhelp b/cpp/ql/src/Likely Bugs/Memory Management/StrncpyFlippedArgs.qhelp
index 4ef13551ad2..201b9057499 100644
--- a/cpp/ql/src/Likely Bugs/Memory Management/StrncpyFlippedArgs.qhelp
+++ b/cpp/ql/src/Likely Bugs/Memory Management/StrncpyFlippedArgs.qhelp
@@ -25,7 +25,7 @@ not the source buffer.
-cplusplus.com: strncpy.
+cplusplus.com: strncpy.
I. Gerg. An Overview and Example of the Buffer-Overflow Exploit. IANewsletter vol 7 no 4. 2005.
From e64a2d6c9c318749567eccfbfa4cf6c5dc026ada Mon Sep 17 00:00:00 2001
From: Michael Nebel
Date: Mon, 29 Apr 2024 13:24:32 +0200
Subject: [PATCH 055/118] C#: Align telemetry implementation with Java.
---
.../security/dataflow/CodeInjectionQuery.qll | 3 +-
.../dataflow/ConditionalBypassQuery.qll | 5 +-
.../ExposureOfPrivateInformationQuery.qll | 3 +-
.../dataflow/HardcodedCredentialsQuery.qll | 3 +-
.../security/dataflow/LDAPInjectionQuery.qll | 3 +-
.../security/dataflow/LogForgingQuery.qll | 3 +-
.../dataflow/MissingXMLValidationQuery.qll | 3 +-
.../csharp/security/dataflow/ReDoSQuery.qll | 3 +-
.../security/dataflow/RegexInjectionQuery.qll | 3 +-
.../dataflow/ResourceInjectionQuery.qll | 3 +-
.../security/dataflow/SqlInjectionQuery.qll | 3 +-
.../security/dataflow/TaintedPathQuery.qll | 3 +-
.../dataflow/UnsafeDeserializationQuery.qll | 3 +-
.../security/dataflow/UrlRedirectQuery.qll | 3 +-
.../dataflow/XMLEntityInjectionQuery.qll | 3 +-
.../security/dataflow/XPathInjectionQuery.qll | 3 +-
.../csharp/security/dataflow/ZipSlipQuery.qll | 3 +-
.../security/dataflow/flowsinks/AllSinks.qll | 84 -------------------
.../security/dataflow/flowsinks/ApiSinks.qll | 35 ++++++++
.../flowsinks/ExternalLocationSink.qll | 3 +-
.../security/dataflow/flowsinks/FlowSinks.qll | 23 +++++
.../dataflow/flowsinks/ParallelSink.qll | 3 +-
.../security/dataflow/flowsinks/Remote.qll | 3 +-
.../dataflow/flowsources/AllSources.qll | 77 -----------------
.../dataflow/flowsources/ApiSources.qll | 14 ++++
.../dataflow/flowsources/FlowSources.qll | 15 ++++
csharp/ql/src/Telemetry/ExternalApi.qll | 8 +-
27 files changed, 132 insertions(+), 186 deletions(-)
delete mode 100644 csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/AllSinks.qll
create mode 100644 csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/ApiSinks.qll
create mode 100644 csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/FlowSinks.qll
delete mode 100644 csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/AllSources.qll
create mode 100644 csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/ApiSources.qll
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/CodeInjectionQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/CodeInjectionQuery.qll
index 1256ae5a7ee..e33c4e37d28 100644
--- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/CodeInjectionQuery.qll
+++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/CodeInjectionQuery.qll
@@ -3,6 +3,7 @@
*/
import csharp
+private import semmle.code.csharp.security.dataflow.flowsinks.FlowSinks
private import semmle.code.csharp.security.dataflow.flowsources.FlowSources
private import semmle.code.csharp.frameworks.system.codedom.Compiler
private import semmle.code.csharp.security.Sanitizers
@@ -16,7 +17,7 @@ abstract class Source extends DataFlow::Node { }
/**
* A data flow sink for user input treated as code vulnerabilities.
*/
-abstract class Sink extends DataFlow::ExprNode { }
+abstract class Sink extends ApiSinkExprNode { }
/**
* A sanitizer for user input treated as code vulnerabilities.
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ConditionalBypassQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ConditionalBypassQuery.qll
index a8938ecc6c9..cd7119a36af 100644
--- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ConditionalBypassQuery.qll
+++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ConditionalBypassQuery.qll
@@ -6,6 +6,7 @@
import csharp
private import semmle.code.csharp.controlflow.Guards
private import semmle.code.csharp.controlflow.BasicBlocks
+private import semmle.code.csharp.security.dataflow.flowsinks.FlowSinks
private import semmle.code.csharp.security.dataflow.flowsources.FlowSources
private import semmle.code.csharp.frameworks.System
private import semmle.code.csharp.frameworks.system.Net
@@ -14,12 +15,12 @@ private import semmle.code.csharp.security.SensitiveActions
/**
* A data flow source for user-controlled bypass of sensitive method.
*/
-abstract class Source extends DataFlow::Node { }
+abstract class Source extends ApiSourceNode { }
/**
* A data flow sink for user-controlled bypass of sensitive method.
*/
-abstract class Sink extends DataFlow::ExprNode {
+abstract class Sink extends ApiSinkExprNode {
/** Gets the 'MethodCall' which is considered sensitive. */
abstract MethodCall getSensitiveMethodCall();
}
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ExposureOfPrivateInformationQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ExposureOfPrivateInformationQuery.qll
index 03db7fadf81..1e5f5ae8256 100644
--- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ExposureOfPrivateInformationQuery.qll
+++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ExposureOfPrivateInformationQuery.qll
@@ -3,6 +3,7 @@
*/
import csharp
+private import semmle.code.csharp.security.dataflow.flowsinks.FlowSinks
private import semmle.code.csharp.security.dataflow.flowsources.FlowSources
private import semmle.code.csharp.security.dataflow.flowsinks.ExternalLocationSink
private import semmle.code.csharp.security.PrivateData
@@ -15,7 +16,7 @@ abstract class Source extends DataFlow::ExprNode { }
/**
* A data flow sink for private information flowing unencrypted to an external location.
*/
-abstract class Sink extends DataFlow::ExprNode { }
+abstract class Sink extends ApiSinkExprNode { }
/**
* A sanitizer for private information flowing unencrypted to an external location.
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/HardcodedCredentialsQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/HardcodedCredentialsQuery.qll
index dd6669579e1..63a0bb50732 100644
--- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/HardcodedCredentialsQuery.qll
+++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/HardcodedCredentialsQuery.qll
@@ -9,6 +9,7 @@ private import semmle.code.csharp.frameworks.Moq
private import semmle.code.csharp.frameworks.system.web.Security
private import semmle.code.csharp.frameworks.system.security.cryptography.X509Certificates
private import semmle.code.csharp.frameworks.Test
+private import semmle.code.csharp.security.dataflow.flowsinks.FlowSinks
/**
* A data flow source for hard coded credentials.
@@ -18,7 +19,7 @@ abstract class Source extends DataFlow::ExprNode { }
/**
* A data flow sink for hard coded credentials.
*/
-abstract class Sink extends DataFlow::ExprNode {
+abstract class Sink extends ApiSinkExprNode {
/**
* Gets a description of this sink, including a placeholder for the sink and a placeholder for
* the supplementary element.
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/LDAPInjectionQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/LDAPInjectionQuery.qll
index 58a34f7604b..78800f39209 100644
--- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/LDAPInjectionQuery.qll
+++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/LDAPInjectionQuery.qll
@@ -4,6 +4,7 @@
*/
import csharp
+private import semmle.code.csharp.security.dataflow.flowsinks.FlowSinks
private import semmle.code.csharp.security.dataflow.flowsources.FlowSources
private import semmle.code.csharp.frameworks.system.DirectoryServices
private import semmle.code.csharp.frameworks.system.directoryservices.Protocols
@@ -18,7 +19,7 @@ abstract class Source extends DataFlow::Node { }
/**
* A data flow sink for unvalidated user input that is used to construct LDAP queries.
*/
-abstract class Sink extends DataFlow::ExprNode { }
+abstract class Sink extends ApiSinkExprNode { }
/**
* A sanitizer for unvalidated user input that is used to construct LDAP queries.
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/LogForgingQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/LogForgingQuery.qll
index ed6e69f0709..f0153fea2d4 100644
--- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/LogForgingQuery.qll
+++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/LogForgingQuery.qll
@@ -3,6 +3,7 @@
*/
import csharp
+private import semmle.code.csharp.security.dataflow.flowsinks.FlowSinks
private import semmle.code.csharp.security.dataflow.flowsources.FlowSources
private import semmle.code.csharp.frameworks.System
private import semmle.code.csharp.frameworks.system.text.RegularExpressions
@@ -18,7 +19,7 @@ abstract class Source extends DataFlow::Node { }
/**
* A data flow sink for untrusted user input used in log entries.
*/
-abstract class Sink extends DataFlow::ExprNode { }
+abstract class Sink extends ApiSinkExprNode { }
/**
* A sanitizer for untrusted user input used in log entries.
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/MissingXMLValidationQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/MissingXMLValidationQuery.qll
index 914239bf7d5..b2934d31eda 100644
--- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/MissingXMLValidationQuery.qll
+++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/MissingXMLValidationQuery.qll
@@ -4,6 +4,7 @@
*/
import csharp
+private import semmle.code.csharp.security.dataflow.flowsinks.FlowSinks
private import semmle.code.csharp.security.dataflow.flowsources.FlowSources
private import semmle.code.csharp.frameworks.system.Xml
private import semmle.code.csharp.security.Sanitizers
@@ -18,7 +19,7 @@ abstract class Source extends DataFlow::Node { }
* A data flow sink for untrusted user input processed as XML without validation against a known
* schema.
*/
-abstract class Sink extends DataFlow::ExprNode {
+abstract class Sink extends ApiSinkExprNode {
/** Gets a string describing the reason why this is a sink. */
abstract string getReason();
}
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ReDoSQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ReDoSQuery.qll
index 84d12fca0cc..bf4fbd99323 100644
--- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ReDoSQuery.qll
+++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ReDoSQuery.qll
@@ -5,6 +5,7 @@
import csharp
private import semmle.code.csharp.dataflow.DataFlow2
+private import semmle.code.csharp.security.dataflow.flowsinks.FlowSinks
private import semmle.code.csharp.security.dataflow.flowsources.FlowSources
private import semmle.code.csharp.frameworks.system.text.RegularExpressions
private import semmle.code.csharp.security.Sanitizers
@@ -17,7 +18,7 @@ abstract class Source extends DataFlow::Node { }
/**
* A data flow sink for untrusted user input used in dangerous regular expression operations.
*/
-abstract class Sink extends DataFlow::ExprNode { }
+abstract class Sink extends ApiSinkExprNode { }
/**
* A sanitizer for untrusted user input used in dangerous regular expression operations.
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/RegexInjectionQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/RegexInjectionQuery.qll
index 501ede13f29..1a053c29f24 100644
--- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/RegexInjectionQuery.qll
+++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/RegexInjectionQuery.qll
@@ -4,6 +4,7 @@
*/
import csharp
+private import semmle.code.csharp.security.dataflow.flowsinks.FlowSinks
private import semmle.code.csharp.security.dataflow.flowsources.FlowSources
private import semmle.code.csharp.frameworks.system.text.RegularExpressions
private import semmle.code.csharp.security.Sanitizers
@@ -16,7 +17,7 @@ abstract class Source extends DataFlow::Node { }
/**
* A data flow sink for untrusted user input used to construct regular expressions.
*/
-abstract class Sink extends DataFlow::ExprNode { }
+abstract class Sink extends ApiSinkExprNode { }
/**
* A sanitizer for untrusted user input used to construct regular expressions.
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ResourceInjectionQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ResourceInjectionQuery.qll
index a66283de02a..fb016dcddae 100644
--- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ResourceInjectionQuery.qll
+++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ResourceInjectionQuery.qll
@@ -3,6 +3,7 @@
*/
import csharp
+private import semmle.code.csharp.security.dataflow.flowsinks.FlowSinks
private import semmle.code.csharp.security.dataflow.flowsources.FlowSources
private import semmle.code.csharp.frameworks.system.Data
private import semmle.code.csharp.security.Sanitizers
@@ -15,7 +16,7 @@ abstract class Source extends DataFlow::Node { }
/**
* A data flow sink for untrusted user input used in resource descriptors.
*/
-abstract class Sink extends DataFlow::ExprNode { }
+abstract class Sink extends ApiSinkExprNode { }
/**
* A sanitizer for untrusted user input used in resource descriptors.
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/SqlInjectionQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/SqlInjectionQuery.qll
index b7b198bbca0..6473aa58e1c 100644
--- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/SqlInjectionQuery.qll
+++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/SqlInjectionQuery.qll
@@ -3,6 +3,7 @@
*/
import csharp
+private import semmle.code.csharp.security.dataflow.flowsinks.FlowSinks
private import semmle.code.csharp.security.dataflow.flowsources.FlowSources
private import semmle.code.csharp.frameworks.Sql
private import semmle.code.csharp.security.Sanitizers
@@ -16,7 +17,7 @@ abstract class Source extends DataFlow::Node { }
/**
* A sink for SQL injection vulnerabilities.
*/
-abstract class Sink extends DataFlow::ExprNode { }
+abstract class Sink extends ApiSinkExprNode { }
/**
* A sanitizer for SQL injection vulnerabilities.
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/TaintedPathQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/TaintedPathQuery.qll
index bbd32b58353..ca2b13439ce 100644
--- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/TaintedPathQuery.qll
+++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/TaintedPathQuery.qll
@@ -5,6 +5,7 @@
import csharp
private import semmle.code.csharp.controlflow.Guards
+private import semmle.code.csharp.security.dataflow.flowsinks.FlowSinks
private import semmle.code.csharp.security.dataflow.flowsources.FlowSources
private import semmle.code.csharp.frameworks.system.IO
private import semmle.code.csharp.frameworks.system.Web
@@ -18,7 +19,7 @@ abstract class Source extends DataFlow::Node { }
/**
* A data flow sink for uncontrolled data in path expression vulnerabilities.
*/
-abstract class Sink extends DataFlow::ExprNode { }
+abstract class Sink extends ApiSinkExprNode { }
/**
* A sanitizer for uncontrolled data in path expression vulnerabilities.
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/UnsafeDeserializationQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/UnsafeDeserializationQuery.qll
index 6de1305a11d..a5341aca42f 100644
--- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/UnsafeDeserializationQuery.qll
+++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/UnsafeDeserializationQuery.qll
@@ -6,6 +6,7 @@
import csharp
private import semmle.code.csharp.serialization.Deserializers
private import semmle.code.csharp.dataflow.TaintTracking2
+private import semmle.code.csharp.security.dataflow.flowsinks.FlowSinks
private import semmle.code.csharp.security.dataflow.flowsources.FlowSources
/**
@@ -16,7 +17,7 @@ abstract class Source extends DataFlow::Node { }
/**
* A data flow sink for unsafe deserialization vulnerabilities.
*/
-abstract class Sink extends DataFlow::Node { }
+abstract class Sink extends ApiSinkNode { }
/**
* A data flow sink for unsafe deserialization vulnerabilities to an instance method.
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/UrlRedirectQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/UrlRedirectQuery.qll
index 9a5ec46cb37..b21d5846bf5 100644
--- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/UrlRedirectQuery.qll
+++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/UrlRedirectQuery.qll
@@ -3,6 +3,7 @@
*/
import csharp
+private import semmle.code.csharp.security.dataflow.flowsinks.FlowSinks
private import semmle.code.csharp.security.dataflow.flowsources.FlowSources
private import semmle.code.csharp.controlflow.Guards
private import semmle.code.csharp.frameworks.Format
@@ -20,7 +21,7 @@ abstract class Source extends DataFlow::Node { }
/**
* A data flow sink for unvalidated URL redirect vulnerabilities.
*/
-abstract class Sink extends DataFlow::ExprNode { }
+abstract class Sink extends ApiSinkExprNode { }
/**
* A sanitizer for unvalidated URL redirect vulnerabilities.
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/XMLEntityInjectionQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/XMLEntityInjectionQuery.qll
index 7e7fd61fb1c..0bb842adf79 100644
--- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/XMLEntityInjectionQuery.qll
+++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/XMLEntityInjectionQuery.qll
@@ -3,6 +3,7 @@
*/
import csharp
+private import semmle.code.csharp.security.dataflow.flowsinks.FlowSinks
private import semmle.code.csharp.security.dataflow.flowsources.FlowSources
private import semmle.code.csharp.frameworks.System
private import semmle.code.csharp.frameworks.system.text.RegularExpressions
@@ -19,7 +20,7 @@ private class ThreatModelSource extends Source instanceof ThreatModelFlowSource
/**
* A data flow sink for untrusted user input used in XML processing.
*/
-abstract class Sink extends DataFlow::ExprNode {
+abstract class Sink extends ApiSinkExprNode {
/**
* Gets the reason for the insecurity of this sink.
*/
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/XPathInjectionQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/XPathInjectionQuery.qll
index 1edddf45f56..c471a432425 100644
--- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/XPathInjectionQuery.qll
+++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/XPathInjectionQuery.qll
@@ -3,6 +3,7 @@
*/
import csharp
+private import semmle.code.csharp.security.dataflow.flowsinks.FlowSinks
private import semmle.code.csharp.security.dataflow.flowsources.FlowSources
private import semmle.code.csharp.frameworks.system.xml.XPath
private import semmle.code.csharp.frameworks.system.Xml
@@ -16,7 +17,7 @@ abstract class Source extends DataFlow::Node { }
/**
* A data flow sink for untrusted user input used in XPath expression.
*/
-abstract class Sink extends DataFlow::ExprNode { }
+abstract class Sink extends ApiSinkExprNode { }
/**
* A sanitizer for untrusted user input used in XPath expression.
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ZipSlipQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ZipSlipQuery.qll
index a83bb8b4f5a..93e7b601585 100644
--- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ZipSlipQuery.qll
+++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ZipSlipQuery.qll
@@ -4,6 +4,7 @@
import csharp
private import semmle.code.csharp.controlflow.Guards
+private import semmle.code.csharp.security.dataflow.flowsinks.FlowSinks
/**
* A data flow source for unsafe zip extraction.
@@ -13,7 +14,7 @@ abstract class Source extends DataFlow::Node { }
/**
* A data flow sink for unsafe zip extraction.
*/
-abstract class Sink extends DataFlow::ExprNode { }
+abstract class Sink extends ApiSinkExprNode { }
/**
* A sanitizer for unsafe zip extraction.
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/AllSinks.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/AllSinks.qll
deleted file mode 100644
index bf601bdf9b6..00000000000
--- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/AllSinks.qll
+++ /dev/null
@@ -1,84 +0,0 @@
-/** Provides classes representing various flow sinks for data flow / taint tracking. */
-
-private import semmle.code.csharp.dataflow.internal.ExternalFlow
-
-/**
- * A data flow sink node.
- */
-abstract class SinkNode extends DataFlow::Node { }
-
-/**
- * Module that adds all sinks to `SinkNode`, excluding sinks for cryptography based
- * queries, and queries where sinks are not succifiently explicit.
- */
-private module AllSinks {
- private import ParallelSink as ParallelSink
- private import Remote as Remote
- private import semmle.code.csharp.security.dataflow.CodeInjectionQuery as CodeInjectionQuery
- private import semmle.code.csharp.security.dataflow.ConditionalBypassQuery as ConditionalBypassQuery
- private import semmle.code.csharp.security.dataflow.ExposureOfPrivateInformationQuery as ExposureOfPrivateInformationQuery
- private import semmle.code.csharp.security.dataflow.HardcodedCredentialsQuery as HardcodedCredentialsQuery
- private import semmle.code.csharp.security.dataflow.LDAPInjectionQuery as LdapInjectionQuery
- private import semmle.code.csharp.security.dataflow.LogForgingQuery as LogForgingQuery
- private import semmle.code.csharp.security.dataflow.MissingXMLValidationQuery as MissingXmlValidationQuery
- private import semmle.code.csharp.security.dataflow.ReDoSQuery as ReDosQuery
- private import semmle.code.csharp.security.dataflow.RegexInjectionQuery as RegexInjectionQuery
- private import semmle.code.csharp.security.dataflow.ResourceInjectionQuery as ResourceInjectionQuery
- private import semmle.code.csharp.security.dataflow.SqlInjectionQuery as SqlInjectionQuery
- private import semmle.code.csharp.security.dataflow.TaintedPathQuery as TaintedPathQuery
- private import semmle.code.csharp.security.dataflow.UnsafeDeserializationQuery as UnsafeDeserializationQuery
- private import semmle.code.csharp.security.dataflow.UrlRedirectQuery as UrlRedirectQuery
- private import semmle.code.csharp.security.dataflow.XMLEntityInjectionQuery as XmlEntityInjectionQuery
- private import semmle.code.csharp.security.dataflow.XPathInjectionQuery as XpathInjectionQuery
- private import semmle.code.csharp.security.dataflow.XSSSinks as XssSinks
- private import semmle.code.csharp.security.dataflow.ZipSlipQuery as ZipSlipQuery
-
- private class ParallelSink extends SinkNode instanceof ParallelSink::ParallelSink { }
-
- private class RemoteSinkFlowSinks extends SinkNode instanceof Remote::RemoteFlowSink { }
-
- private class CodeInjectionSink extends SinkNode instanceof CodeInjectionQuery::Sink { }
-
- private class ConditionalBypassSink extends SinkNode instanceof ConditionalBypassQuery::Sink { }
-
- private class ExposureOfPrivateInformationSink extends SinkNode instanceof ExposureOfPrivateInformationQuery::Sink
- { }
-
- private class HardcodedCredentialsSink extends SinkNode instanceof HardcodedCredentialsQuery::Sink
- { }
-
- private class LdapInjectionSink extends SinkNode instanceof LdapInjectionQuery::Sink { }
-
- private class LogForgingSink extends SinkNode instanceof LogForgingQuery::Sink { }
-
- private class MissingXmlValidationSink extends SinkNode instanceof MissingXmlValidationQuery::Sink
- { }
-
- private class ReDosSink extends SinkNode instanceof ReDosQuery::Sink { }
-
- private class RegexInjectionSink extends SinkNode instanceof RegexInjectionQuery::Sink { }
-
- private class ResourceInjectionSink extends SinkNode instanceof ResourceInjectionQuery::Sink { }
-
- private class SqlInjectionSink extends SinkNode instanceof SqlInjectionQuery::Sink { }
-
- private class TaintedPathSink extends SinkNode instanceof TaintedPathQuery::Sink { }
-
- private class UnsafeDeserializationSink extends SinkNode instanceof UnsafeDeserializationQuery::Sink
- { }
-
- private class UrlRedirectSink extends SinkNode instanceof UrlRedirectQuery::Sink { }
-
- private class XmlEntityInjectionSink extends SinkNode instanceof XmlEntityInjectionQuery::Sink { }
-
- private class XpathInjectionSink extends SinkNode instanceof XpathInjectionQuery::Sink { }
-
- private class XssSink extends SinkNode instanceof XssSinks::Sink { }
-
- /**
- * Add all models as data sinks.
- */
- private class SinkNodeExternal extends SinkNode {
- SinkNodeExternal() { sinkNode(this, _) }
- }
-}
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/ApiSinks.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/ApiSinks.qll
new file mode 100644
index 00000000000..7a069adb2ed
--- /dev/null
+++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/ApiSinks.qll
@@ -0,0 +1,35 @@
+/** Provides classes representing various flow sinks for data flow / taint tracking. */
+
+private import semmle.code.csharp.dataflow.internal.ExternalFlow
+private import semmle.code.csharp.security.dataflow.flowsinks.FlowSinks
+
+/**
+ * A data flow sink node.
+ */
+final class SinkNode = ApiSinkNode;
+
+/**
+ * Module that adds all API like sinks to `SinkNode`, excluding sinks for cryptography based
+ * queries, and queries where sinks are not succifiently defined (eg. using broad method name matching).
+ */
+private module AllApiSinks {
+ private import ParallelSink
+ private import Remote
+ private import semmle.code.csharp.security.dataflow.CodeInjectionQuery as CodeInjectionQuery
+ private import semmle.code.csharp.security.dataflow.ConditionalBypassQuery as ConditionalBypassQuery
+ private import semmle.code.csharp.security.dataflow.ExposureOfPrivateInformationQuery as ExposureOfPrivateInformationQuery
+ private import semmle.code.csharp.security.dataflow.HardcodedCredentialsQuery as HardcodedCredentialsQuery
+ private import semmle.code.csharp.security.dataflow.LDAPInjectionQuery as LdapInjectionQuery
+ private import semmle.code.csharp.security.dataflow.LogForgingQuery as LogForgingQuery
+ private import semmle.code.csharp.security.dataflow.MissingXMLValidationQuery as MissingXmlValidationQuery
+ private import semmle.code.csharp.security.dataflow.ReDoSQuery as ReDosQuery
+ private import semmle.code.csharp.security.dataflow.RegexInjectionQuery as RegexInjectionQuery
+ private import semmle.code.csharp.security.dataflow.ResourceInjectionQuery as ResourceInjectionQuery
+ private import semmle.code.csharp.security.dataflow.SqlInjectionQuery as SqlInjectionQuery
+ private import semmle.code.csharp.security.dataflow.TaintedPathQuery as TaintedPathQuery
+ private import semmle.code.csharp.security.dataflow.UnsafeDeserializationQuery as UnsafeDeserializationQuery
+ private import semmle.code.csharp.security.dataflow.UrlRedirectQuery as UrlRedirectQuery
+ private import semmle.code.csharp.security.dataflow.XMLEntityInjectionQuery as XmlEntityInjectionQuery
+ private import semmle.code.csharp.security.dataflow.XPathInjectionQuery as XpathInjectionQuery
+ private import semmle.code.csharp.security.dataflow.ZipSlipQuery as ZipSlipQuery
+}
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/ExternalLocationSink.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/ExternalLocationSink.qll
index abd1ad92733..3bcfdde669a 100644
--- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/ExternalLocationSink.qll
+++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/ExternalLocationSink.qll
@@ -3,6 +3,7 @@
*/
import csharp
+private import FlowSinks
private import Remote
private import semmle.code.csharp.commons.Loggers
private import semmle.code.csharp.frameworks.system.Web
@@ -16,7 +17,7 @@ private import semmle.code.csharp.dataflow.internal.ExternalFlow
* which the application may have no access control. For example, files on a local or remote
* filesystem (including log files and cookies).
*/
-abstract class ExternalLocationSink extends DataFlow::ExprNode { }
+abstract class ExternalLocationSink extends ApiSinkExprNode { }
private class ExternalModelSink extends ExternalLocationSink {
ExternalModelSink() { sinkNode(this, "file-content-store") }
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/FlowSinks.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/FlowSinks.qll
new file mode 100644
index 00000000000..0c5bf14e65c
--- /dev/null
+++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/FlowSinks.qll
@@ -0,0 +1,23 @@
+/** Provides classes representing various flow sinks for data flow / taint tracking. */
+
+private import csharp
+private import semmle.code.csharp.dataflow.internal.ExternalFlow
+
+/**
+ * A data flow sink node for an API, which should be considered
+ * supported from a modeling perspective.
+ */
+abstract class ApiSinkNode extends DataFlow::Node { }
+
+/**
+ * A data flow sink expression node for an API, which should be considered
+ * supported from a modeling perspective.
+ */
+abstract class ApiSinkExprNode extends ApiSinkNode, DataFlow::ExprNode { }
+
+/**
+ * Add all sink models as data sinks.
+ */
+private class ApiSinkNodeExternal extends ApiSinkNode {
+ ApiSinkNodeExternal() { sinkNode(this, _) }
+}
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/ParallelSink.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/ParallelSink.qll
index 5e53c9bd8fd..1546d72887d 100644
--- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/ParallelSink.qll
+++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/ParallelSink.qll
@@ -3,11 +3,12 @@
*/
import csharp
+private import FlowSinks
/**
* A data flow sink node for parallel execution.
*/
-abstract class ParallelSink extends DataFlow::Node { }
+abstract class ParallelSink extends ApiSinkNode { }
/**
* A data flow sink node for lambda parallel sink.
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/Remote.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/Remote.qll
index 0770a948b09..b58beb38ca5 100644
--- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/Remote.qll
+++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/Remote.qll
@@ -5,12 +5,13 @@
import csharp
private import Email::Email
private import ExternalLocationSink
+private import FlowSinks
private import Html
private import semmle.code.csharp.security.dataflow.XSSSinks as XssSinks
private import semmle.code.csharp.frameworks.system.web.UI
/** A data flow sink of remote user output. */
-abstract class RemoteFlowSink extends DataFlow::Node { }
+abstract class RemoteFlowSink extends ApiSinkNode { }
/**
* A value written to the `[Inner]Text` property of an object defined in the
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/AllSources.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/AllSources.qll
deleted file mode 100644
index 7d05500446a..00000000000
--- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/AllSources.qll
+++ /dev/null
@@ -1,77 +0,0 @@
-/** Provides classes representing various flow sources for data flow / taint tracking. */
-
-private import semmle.code.csharp.dataflow.internal.ExternalFlow
-
-/**
- * A data flow source node.
- */
-abstract class SourceNode extends DataFlow::Node { }
-
-/**
- * Module that adds all sources to `SourceNode`, excluding source for cryptography based
- * queries, and queries where sources are not succifiently explicit or mainly hardcoded constants.
- */
-private module AllSources {
- private import FlowSources as FlowSources
- private import semmle.code.csharp.security.cryptography.HardcodedSymmetricEncryptionKey
- private import semmle.code.csharp.security.dataflow.CleartextStorageQuery as CleartextStorageQuery
- private import semmle.code.csharp.security.dataflow.CodeInjectionQuery as CodeInjectionQuery
- private import semmle.code.csharp.security.dataflow.ConditionalBypassQuery as ConditionalBypassQuery
- private import semmle.code.csharp.security.dataflow.ExposureOfPrivateInformationQuery as ExposureOfPrivateInformationQuery
- private import semmle.code.csharp.security.dataflow.HardcodedCredentialsQuery as HardcodedCredentialsQuery
- private import semmle.code.csharp.security.dataflow.LDAPInjectionQuery as LdapInjectionQuery
- private import semmle.code.csharp.security.dataflow.LogForgingQuery as LogForgingQuery
- private import semmle.code.csharp.security.dataflow.MissingXMLValidationQuery as MissingXmlValidationQuery
- private import semmle.code.csharp.security.dataflow.ReDoSQuery as ReDosQuery
- private import semmle.code.csharp.security.dataflow.RegexInjectionQuery as RegexInjectionQuery
- private import semmle.code.csharp.security.dataflow.ResourceInjectionQuery as ResourceInjectionQuery
- private import semmle.code.csharp.security.dataflow.SqlInjectionQuery as SqlInjectionQuery
- private import semmle.code.csharp.security.dataflow.TaintedPathQuery as TaintedPathQuery
- private import semmle.code.csharp.security.dataflow.UnsafeDeserializationQuery as UnsafeDeserializationQuery
- private import semmle.code.csharp.security.dataflow.UrlRedirectQuery as UrlRedirectQuery
- private import semmle.code.csharp.security.dataflow.XMLEntityInjectionQuery as XmlEntityInjectionQuery
- private import semmle.code.csharp.security.dataflow.XPathInjectionQuery as XpathInjectionQuery
- private import semmle.code.csharp.security.dataflow.ZipSlipQuery as ZipSlipQuery
-
- private class FlowSourcesSources extends SourceNode instanceof FlowSources::SourceNode { }
-
- private class CodeInjectionSource extends SourceNode instanceof CodeInjectionQuery::Source { }
-
- private class ConditionalBypassSource extends SourceNode instanceof ConditionalBypassQuery::Source
- { }
-
- private class LdapInjectionSource extends SourceNode instanceof LdapInjectionQuery::Source { }
-
- private class LogForgingSource extends SourceNode instanceof LogForgingQuery::Source { }
-
- private class MissingXmlValidationSource extends SourceNode instanceof MissingXmlValidationQuery::Source
- { }
-
- private class ReDosSource extends SourceNode instanceof ReDosQuery::Source { }
-
- private class RegexInjectionSource extends SourceNode instanceof RegexInjectionQuery::Source { }
-
- private class ResourceInjectionSource extends SourceNode instanceof ResourceInjectionQuery::Source
- { }
-
- private class SqlInjectionSource extends SourceNode instanceof SqlInjectionQuery::Source { }
-
- private class TaintedPathSource extends SourceNode instanceof TaintedPathQuery::Source { }
-
- private class UnsafeDeserializationSource extends SourceNode instanceof UnsafeDeserializationQuery::Source
- { }
-
- private class UrlRedirectSource extends SourceNode instanceof UrlRedirectQuery::Source { }
-
- private class XmlEntityInjectionSource extends SourceNode instanceof XmlEntityInjectionQuery::Source
- { }
-
- private class XpathInjectionSource extends SourceNode instanceof XpathInjectionQuery::Source { }
-
- /**
- * Add all models as data sources.
- */
- private class SourceNodeExternal extends SourceNode {
- SourceNodeExternal() { sourceNode(this, _) }
- }
-}
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/ApiSources.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/ApiSources.qll
new file mode 100644
index 00000000000..01d838f2f94
--- /dev/null
+++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/ApiSources.qll
@@ -0,0 +1,14 @@
+/** Provides classes representing various flow sources for data flow / taint tracking. */
+
+private import FlowSources as FlowSources
+
+final class SourceNode = FlowSources::SourceNode;
+
+/**
+ * Module that adds all API like sources to `SourceNode`, excluding some sources for cryptography based
+ * queries, and queries where sources are not succifiently defined (eg. using broad method name matching).
+ */
+private module AllApiSources {
+ private import semmle.code.csharp.security.dataflow.ConditionalBypassQuery as ConditionalBypassQuery
+ private import semmle.code.csharp.security.dataflow.ZipSlipQuery as ZipSlipQuery
+}
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/FlowSources.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/FlowSources.qll
index a5ada1cbaf8..c610b3de4c7 100644
--- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/FlowSources.qll
+++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/FlowSources.qll
@@ -32,3 +32,18 @@ class ThreatModelFlowSource extends DataFlow::Node {
)
}
}
+
+/**
+ * A data flow source node for an API, which should be considered
+ * supported from a modeling perspective.
+ */
+abstract class ApiSourceNode extends DataFlow::Node { }
+
+private class AddSourceNodes extends ApiSourceNode instanceof SourceNode { }
+
+/**
+ * Add all source models as data sources.
+ */
+private class ApiSourceNodeExternal extends ApiSourceNode {
+ ApiSourceNodeExternal() { sourceNode(this, _) }
+}
diff --git a/csharp/ql/src/Telemetry/ExternalApi.qll b/csharp/ql/src/Telemetry/ExternalApi.qll
index a710cdf7cfd..270db8b0d19 100644
--- a/csharp/ql/src/Telemetry/ExternalApi.qll
+++ b/csharp/ql/src/Telemetry/ExternalApi.qll
@@ -8,8 +8,8 @@ private import semmle.code.csharp.dataflow.internal.DataFlowDispatch as DataFlow
private import semmle.code.csharp.dataflow.internal.ExternalFlow
private import semmle.code.csharp.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl
private import semmle.code.csharp.dataflow.internal.TaintTrackingPrivate
-private import semmle.code.csharp.security.dataflow.flowsources.AllSources
-private import semmle.code.csharp.security.dataflow.flowsinks.AllSinks
+private import semmle.code.csharp.security.dataflow.flowsources.ApiSources as ApiSources
+private import semmle.code.csharp.security.dataflow.flowsinks.ApiSinks as ApiSinks
private import TestLibrary
/** Holds if the given callable is not worth supporting. */
@@ -85,11 +85,11 @@ class ExternalApi extends Callable {
/** Holds if this API is a known source. */
pragma[nomagic]
- predicate isSource() { this.getAnOutput() instanceof SourceNode }
+ predicate isSource() { this.getAnOutput() instanceof ApiSources::SourceNode }
/** Holds if this API is a known sink. */
pragma[nomagic]
- predicate isSink() { this.getAnInput() instanceof SinkNode }
+ predicate isSink() { this.getAnInput() instanceof ApiSinks::SinkNode }
/** Holds if this API is a known neutral. */
pragma[nomagic]
From 31c427e64c030e0cdaeb26b7c571e05124ba00f0 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Fri, 3 May 2024 13:04:42 +0200
Subject: [PATCH 056/118] Bazel/Go: add more explanation in `gen.py`
---
go/gen.py | 22 +++++++++++++++++-----
1 file changed, 17 insertions(+), 5 deletions(-)
diff --git a/go/gen.py b/go/gen.py
index ebb57b2a685..0e9005571ea 100644
--- a/go/gen.py
+++ b/go/gen.py
@@ -1,3 +1,12 @@
+"""
+Update generated files related to Go in the repo. Using --force will regenerate all files from scratch.
+
+In particular the script will:
+1. update the `vendor` dir with `go work vendor` (using a go toolchain provided by bazel)
+2. update `BUILD.bazel` files using gazelle
+3. update `ql/lib/go.dbscheme` using a compiled `go-dbschemegen`
+"""
+
import sys
import pathlib
import subprocess
@@ -7,9 +16,9 @@ import shutil
from python.runfiles import runfiles
def options():
- p = argparse.ArgumentParser(description="Update generated checked in files in the Go pack")
+ p = argparse.ArgumentParser(description="Update generated files related to Go in the repo")
p.add_argument("--force", "-f", action="store_true", help="Regenerate all files from scratch rather than updating them")
- p.add_argument("generators", nargs=3)
+ p.add_argument("executables", nargs=3, help="Internally provided executables")
return p.parse_args()
opts = options()
@@ -23,7 +32,7 @@ except KeyError:
go_extractor_dir = workspace_dir / "go" / "extractor"
go_dbscheme = workspace_dir / "go" / "ql" / "lib" / "go.dbscheme"
r = runfiles.Create()
-go, gazelle, go_gen_dbscheme = map(r.Rlocation, opts.generators)
+go, gazelle, go_gen_dbscheme = map(r.Rlocation, opts.executables)
if opts.force:
@@ -43,13 +52,16 @@ if opts.force:
print("running gazelle")
subprocess.check_call([gazelle])
+# we want to stamp all newly generated `BUILD.bazel` files with a header
build_files_to_update = set(go_extractor_dir.glob("*/**/BUILD.bazel"))
+# if --force, all files are new
if not opts.force:
+ # otherwise, subtract the files that existed at the start
build_files_to_update -= existing_build_files
- # these are always refreshed
+ # but bring back the `vendor` ones, as the vendor update step always clears them
build_files_to_update.update(go_extractor_dir.glob("vendor/**/BUILD.bazel"))
-print("adding header to generated BUILD files")
+print("adding header to newly generated BUILD files")
for build_file in build_files_to_update:
contents = build_file.read_text()
build_file.write_text(f"# generated running `bazel run //go/gazelle`, do not edit\n\n{contents}")
From 8f0b88497a89ed9cce41c659528175427d61bf85 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Fri, 3 May 2024 13:07:56 +0200
Subject: [PATCH 057/118] Bazel/Go: be more specific in
`go/extractor/BUILD.bazel` comments
---
go/extractor/BUILD.bazel | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/go/extractor/BUILD.bazel b/go/extractor/BUILD.bazel
index 32eaa8fda74..297ca52c8b8 100644
--- a/go/extractor/BUILD.bazel
+++ b/go/extractor/BUILD.bazel
@@ -4,7 +4,7 @@ load("@rules_pkg//pkg:mappings.bzl", "pkg_files")
# gazelle:prefix github.com/github/codeql-go/extractor
# gazelle:map_kind go_binary codeql_go_binary //go:rules.bzl
-# following target is kept up to date by `bazel run //go:gen`, do not edit directly
+# the immediately following `extractor` target is kept up to date by `bazel run //go:gen`, do not edit directly
go_library(
name = "extractor",
srcs = [
@@ -25,6 +25,7 @@ go_library(
],
)
+# notice that these other targets are not generated
java_library(
name = "tokenizer-deps",
srcs = [
From ff85db36e2bb8ce248696a6dd1ec127a798d65db Mon Sep 17 00:00:00 2001
From: erik-krogh
Date: Fri, 3 May 2024 13:58:11 +0200
Subject: [PATCH 058/118] exclude credentials as kind `key` from
hardcoded-credentials when the key looks like a dummy password
---
javascript/ql/src/Security/CWE-798/HardcodedCredentials.ql | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/javascript/ql/src/Security/CWE-798/HardcodedCredentials.ql b/javascript/ql/src/Security/CWE-798/HardcodedCredentials.ql
index 3cc63e51dcf..1c13ad78bfa 100644
--- a/javascript/ql/src/Security/CWE-798/HardcodedCredentials.ql
+++ b/javascript/ql/src/Security/CWE-798/HardcodedCredentials.ql
@@ -30,7 +30,7 @@ where
// exclude dummy passwords and templates
not (
sink.getNode().(Sink).(DefaultCredentialsSink).getKind() =
- ["password", "credentials", "token"] and
+ ["password", "credentials", "token", "key"] and
PasswordHeuristics::isDummyPassword(val)
or
sink.getNode().(Sink).getKind() = "authorization header" and
From d9e8e0e00aee0f2184e81493fc1c1db25212a45a Mon Sep 17 00:00:00 2001
From: erik-krogh
Date: Fri, 3 May 2024 13:58:37 +0200
Subject: [PATCH 059/118] use some more standard values for credentials-kind
for NodeJS client credentials
---
javascript/ql/lib/semmle/javascript/frameworks/NodeJSLib.qll | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/NodeJSLib.qll b/javascript/ql/lib/semmle/javascript/frameworks/NodeJSLib.qll
index b3d93383ed7..98bb0f615b6 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/NodeJSLib.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/NodeJSLib.qll
@@ -1003,7 +1003,7 @@ module NodeJSLib {
exists(ClientRequestLoginCallback callback | this = callback.getACall().getArgument(0))
}
- override string getCredentialsKind() { result = "Node.js http(s) client login username" }
+ override string getCredentialsKind() { result = "user name" }
}
/**
@@ -1014,7 +1014,7 @@ module NodeJSLib {
exists(ClientRequestLoginCallback callback | this = callback.getACall().getArgument(1))
}
- override string getCredentialsKind() { result = "Node.js http(s) client login password" }
+ override string getCredentialsKind() { result = "password" }
}
/**
From 2132c7bf967e6975827ce8a35b3511cf8297d3f2 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Fri, 3 May 2024 14:52:17 +0200
Subject: [PATCH 060/118] Bazel/Go: make `@codeql//go:gen` runnable from
internal repo
---
go/BUILD.bazel | 22 +++++++---------------
go/gen.py | 12 +++++++++---
2 files changed, 16 insertions(+), 18 deletions(-)
diff --git a/go/BUILD.bazel b/go/BUILD.bazel
index 6c80e7cb258..e0da93475a2 100644
--- a/go/BUILD.bazel
+++ b/go/BUILD.bazel
@@ -1,13 +1,14 @@
load("@bazel_skylib//rules:native_binary.bzl", "native_binary")
-load("@gazelle//:def.bzl", "gazelle")
load("@rules_pkg//pkg:install.bzl", "pkg_install")
load("@rules_pkg//pkg:mappings.bzl", "pkg_attributes", "pkg_filegroup", "pkg_files")
load("@rules_pkg//pkg:zip.bzl", "pkg_zip")
load("//:defs.bzl", "codeql_platform")
-gazelle(
+native_binary(
name = "gazelle",
- extra_args = ["go/extractor"],
+ src = "@gazelle//cmd/gazelle",
+ out = "gazelle.exe",
+ args = ["go/extractor"],
)
_gen_binaries = [
@@ -24,9 +25,9 @@ py_binary(
deps = ["@rules_python//python/runfiles"],
)
-# this is an internal copy of the dbscheme to be used by extractor-pack
-# this allows the extractor-pack target to be independent and up-to-date with respect to
-# having run //go:gen to update the checked in files
+# this is an instance of the dbscheme kept in the bazel build tree
+# this allows everything that bazel builds to be up-to-date,
+# independently from whether //go:gen was already run to update the checked in files
genrule(
name = "dbscheme",
outs = ["go.dbscheme"],
@@ -108,12 +109,3 @@ py_binary(
main = "create_extractor_pack.py",
deps = ["@rules_python//python/runfiles"],
)
-
-native_binary(
- name = "gen-dbscheme",
- src = "//go/extractor/cli/go-gen-dbscheme",
- out = "go-gen-dbscheme",
- args = [
- "$$BUILD_WORKSPACE_DIRECTORY/go/ql/lib/go.dbscheme",
- ],
-)
diff --git a/go/gen.py b/go/gen.py
index 0e9005571ea..6f8d47d7096 100644
--- a/go/gen.py
+++ b/go/gen.py
@@ -24,12 +24,18 @@ def options():
opts = options()
try:
- workspace_dir = pathlib.Path(os.environ['BUILD_WORKSPACE_DIRECTORY'])
+ workspace_dir = pathlib.Path(os.environ.pop('BUILD_WORKSPACE_DIRECTORY'))
except KeyError:
print("this should be run with bazel run", file=sys.stderr)
sys.exit(1)
go_extractor_dir = workspace_dir / "go" / "extractor"
+
+if not go_extractor_dir.exists():
+ # internal repo?
+ workspace_dir /= "ql"
+ go_extractor_dir = workspace_dir / "go" / "extractor"
+
go_dbscheme = workspace_dir / "go" / "ql" / "lib" / "go.dbscheme"
r = runfiles.Create()
go, gazelle, go_gen_dbscheme = map(r.Rlocation, opts.executables)
@@ -49,8 +55,8 @@ if opts.force:
for build_file in existing_build_files:
build_file.unlink()
-print("running gazelle")
-subprocess.check_call([gazelle])
+print("running gazelle", gazelle, go_extractor_dir)
+subprocess.check_call([gazelle, "go/extractor"], cwd=workspace_dir)
# we want to stamp all newly generated `BUILD.bazel` files with a header
build_files_to_update = set(go_extractor_dir.glob("*/**/BUILD.bazel"))
From 471303bd7ce7e45182cc586db60344f7bae86858 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Fri, 3 May 2024 14:56:17 +0200
Subject: [PATCH 061/118] Bazel/Go: remove unneeded comment
---
MODULE.bazel | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/MODULE.bazel b/MODULE.bazel
index d069d320f07..27479e1978f 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -55,7 +55,7 @@ node.toolchain(
use_repo(node, "nodejs", "nodejs_toolchains")
go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")
-go_sdk.download(version = "1.22.2") # default
+go_sdk.download(version = "1.22.2")
register_toolchains(
"@nodejs_toolchains//:all",
From 17990da205995d0fcd7f052287ba9ecb15616e69 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Fri, 3 May 2024 15:58:43 +0200
Subject: [PATCH 062/118] Update go/extractor/BUILD.bazel
Co-authored-by: Cornelius Riemenschneider
---
go/extractor/BUILD.bazel | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/go/extractor/BUILD.bazel b/go/extractor/BUILD.bazel
index 297ca52c8b8..6047eea6860 100644
--- a/go/extractor/BUILD.bazel
+++ b/go/extractor/BUILD.bazel
@@ -25,7 +25,7 @@ go_library(
],
)
-# notice that these other targets are not generated
+# the other targets are not generated
java_library(
name = "tokenizer-deps",
srcs = [
From 7a1b85aa56063210db75f5394c68d38f014b7967 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Fri, 3 May 2024 16:04:21 +0100
Subject: [PATCH 063/118] C++: Add FP test.
---
.../IteratorToExpiredContainer.expected | 1 +
.../semmle/tests/IteratorToExpiredContainer/test.cpp | 9 +++++++++
2 files changed, 10 insertions(+)
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/IteratorToExpiredContainer.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/IteratorToExpiredContainer.expected
index f47e5d655b9..5bb295dc02a 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/IteratorToExpiredContainer.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/IteratorToExpiredContainer.expected
@@ -4,3 +4,4 @@
| test.cpp:702:27:702:27 | call to operator[] | This object is destroyed at the end of the full-expression. |
| test.cpp:727:23:727:23 | call to operator[] | This object is destroyed at the end of the full-expression. |
| test.cpp:735:23:735:23 | call to operator[] | This object is destroyed at the end of the full-expression. |
+| test.cpp:803:3:803:3 | pointer to ~vector output argument | This object is destroyed at the end of the full-expression. |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/test.cpp
index 85d9c4b57ad..0dc97ece06d 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/test.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/test.cpp
@@ -792,4 +792,13 @@ void test4() {
// function we may end up in the destructor call `chunk.~A()`in `A.foo`. This destructor
// call can flow to `begin` through the back-edge and cause a strange FP.
auto zero = A().size();
+}
+
+void test5(int i)
+{
+ while(i < 10) {
+ const auto& vvs = returnValue();
+ for(const auto& vs : vvs) { }
+ ++i;
+ } // GOOD [FALSE POSITIVE]
}
\ No newline at end of file
From 77128de105d35ada1e379a6dea61d3939e6cab6e Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Fri, 3 May 2024 17:44:29 +0200
Subject: [PATCH 064/118] Bazel/Go: make installer work from internal repo and
on windows
It turns out everything that is needed for the installer to work on
windows is enabling runfiles. This also requires symlinks to avoid
excessive copying of files.
---
.bazelrc | 3 +++
go/BUILD.bazel | 24 +++---------------------
go/create_extractor_pack.py | 24 ++++++++++--------------
3 files changed, 16 insertions(+), 35 deletions(-)
mode change 100644 => 100755 go/create_extractor_pack.py
diff --git a/.bazelrc b/.bazelrc
index 0a49f682da3..36111310779 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -14,6 +14,9 @@ build:linux --cxxopt=-std=c++20
build:macos --cxxopt=-std=c++20 --cpu=darwin_x86_64
build:windows --cxxopt=/std:c++20 --cxxopt=/Zc:preprocessor
+# this requires developer mode, but is required to have pack installer functioning
+common:windows --windows_enable_symlinks --enable_runfiles
+
common --registry=file:///%workspace%/misc/bazel/registry
common --registry=https://bcr.bazel.build
diff --git a/go/BUILD.bazel b/go/BUILD.bazel
index e0da93475a2..4fb73a51fb6 100644
--- a/go/BUILD.bazel
+++ b/go/BUILD.bazel
@@ -1,7 +1,6 @@
load("@bazel_skylib//rules:native_binary.bzl", "native_binary")
load("@rules_pkg//pkg:install.bzl", "pkg_install")
load("@rules_pkg//pkg:mappings.bzl", "pkg_attributes", "pkg_filegroup", "pkg_files")
-load("@rules_pkg//pkg:zip.bzl", "pkg_zip")
load("//:defs.bzl", "codeql_platform")
native_binary(
@@ -81,31 +80,14 @@ pkg_filegroup(
)
pkg_install(
- name = "_extractor-pack-installer",
+ name = "_extractor_pack",
srcs = [":extractor-pack"],
)
-# rules_pkg installer is currently broken on Windows
-# see https://github.com/bazelbuild/rules_pkg/issues/387
-# for now, work around it using an archive
-pkg_zip(
- name = "_extractor-pack-zip",
- srcs = [":extractor-pack"],
-)
-
-alias(
- name = "_create-extractor-pack-arg",
- actual = select({
- "@platforms//os:windows": ":_extractor-pack-zip",
- "//conditions:default": ":_extractor-pack-installer",
- }),
-)
-
py_binary(
name = "create-extractor-pack",
srcs = ["create_extractor_pack.py"],
- args = ["$(rlocationpath :_create-extractor-pack-arg)"],
- data = [":_create-extractor-pack-arg"],
+ env = {"REPO_NAME": repo_name()},
main = "create_extractor_pack.py",
- deps = ["@rules_python//python/runfiles"],
+ deps = ["_extractor_pack"],
)
diff --git a/go/create_extractor_pack.py b/go/create_extractor_pack.py
old mode 100644
new mode 100755
index a1154a777d8..4d194ab93e4
--- a/go/create_extractor_pack.py
+++ b/go/create_extractor_pack.py
@@ -1,26 +1,22 @@
+#!/usr/bin/env python3
import os
import pathlib
import shutil
import sys
import subprocess
-import zipfile
-from python.runfiles import runfiles
try:
workspace_dir = pathlib.Path(os.environ['BUILD_WORKSPACE_DIRECTORY'])
except KeyError:
- print("this should be run with bazel run", file=sys.stderr)
- sys.exit(1)
+ res = subprocess.run(["bazel", "run", ":create-extractor-pack"], cwd=pathlib.Path(__file__).parent)
+ sys.exit(res.returncode)
-dest_dir = workspace_dir / 'go' / 'build' / 'codeql-extractor-go'
-installer_or_zip = pathlib.Path(runfiles.Create().Rlocation(sys.argv[1]))
+from go._extractor_pack_install_script import main
+if os.environ['REPO_NAME'] == 'codeql~':
+ workspace_dir /= 'ql'
+
+dest_dir = workspace_dir / 'go' / 'build' / 'codeql-extractor-pack'
shutil.rmtree(dest_dir, ignore_errors=True)
-
-if installer_or_zip.suffix == '.zip':
- dest_dir.mkdir()
- with zipfile.ZipFile(installer_or_zip) as pack:
- pack.extractall(dest_dir)
-else:
- os.environ['DESTDIR'] = str(dest_dir)
- subprocess.check_call([installer_or_zip])
+os.environ['DESTDIR'] = str(dest_dir)
+main(sys.argv)
From b209fc67cbdd9b366239f877f7734e852c0e1071 Mon Sep 17 00:00:00 2001
From: erik-krogh
Date: Fri, 3 May 2024 19:34:18 +0200
Subject: [PATCH 065/118] test the change to hardcoded-credentials
---
.../CWE-798/HardcodedCredentials.expected | 24 +++++++++++--------
.../Security/CWE-798/HardcodedCredentials.js | 8 +++++--
2 files changed, 20 insertions(+), 12 deletions(-)
diff --git a/javascript/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.expected b/javascript/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.expected
index 3635090cb43..0a9edfb64f8 100644
--- a/javascript/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.expected
@@ -153,12 +153,12 @@ nodes
| HardcodedCredentials.js:135:41:135:50 | "hgfedcba" |
| HardcodedCredentials.js:135:41:135:50 | "hgfedcba" |
| HardcodedCredentials.js:135:41:135:50 | "hgfedcba" |
-| HardcodedCredentials.js:160:38:160:48 | "change_me" |
-| HardcodedCredentials.js:160:38:160:48 | "change_me" |
-| HardcodedCredentials.js:160:38:160:48 | "change_me" |
-| HardcodedCredentials.js:161:41:161:51 | 'change_me' |
-| HardcodedCredentials.js:161:41:161:51 | 'change_me' |
-| HardcodedCredentials.js:161:41:161:51 | 'change_me' |
+| HardcodedCredentials.js:160:38:160:56 | "oiuneawrgiyubaegr" |
+| HardcodedCredentials.js:160:38:160:56 | "oiuneawrgiyubaegr" |
+| HardcodedCredentials.js:160:38:160:56 | "oiuneawrgiyubaegr" |
+| HardcodedCredentials.js:161:41:161:59 | 'oiuneawrgiyubaegr' |
+| HardcodedCredentials.js:161:41:161:59 | 'oiuneawrgiyubaegr' |
+| HardcodedCredentials.js:161:41:161:59 | 'oiuneawrgiyubaegr' |
| HardcodedCredentials.js:164:35:164:45 | 'change_me' |
| HardcodedCredentials.js:164:35:164:45 | 'change_me' |
| HardcodedCredentials.js:164:35:164:45 | 'change_me' |
@@ -271,6 +271,9 @@ nodes
| HardcodedCredentials.js:295:37:295:66 | `Basic ... 000001` |
| HardcodedCredentials.js:295:37:295:66 | `Basic ... 000001` |
| HardcodedCredentials.js:295:37:295:66 | `Basic ... 000001` |
+| HardcodedCredentials.js:299:44:299:52 | 'mytoken' |
+| HardcodedCredentials.js:299:44:299:52 | 'mytoken' |
+| HardcodedCredentials.js:299:44:299:52 | 'mytoken' |
edges
| HardcodedCredentials.js:5:15:5:22 | 'dbuser' | HardcodedCredentials.js:5:15:5:22 | 'dbuser' |
| HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' |
@@ -326,8 +329,8 @@ edges
| HardcodedCredentials.js:130:44:130:53 | 'hgfedcba' | HardcodedCredentials.js:130:44:130:53 | 'hgfedcba' |
| HardcodedCredentials.js:131:52:131:61 | 'hgfedcba' | HardcodedCredentials.js:131:52:131:61 | 'hgfedcba' |
| HardcodedCredentials.js:135:41:135:50 | "hgfedcba" | HardcodedCredentials.js:135:41:135:50 | "hgfedcba" |
-| HardcodedCredentials.js:160:38:160:48 | "change_me" | HardcodedCredentials.js:160:38:160:48 | "change_me" |
-| HardcodedCredentials.js:161:41:161:51 | 'change_me' | HardcodedCredentials.js:161:41:161:51 | 'change_me' |
+| HardcodedCredentials.js:160:38:160:56 | "oiuneawrgiyubaegr" | HardcodedCredentials.js:160:38:160:56 | "oiuneawrgiyubaegr" |
+| HardcodedCredentials.js:161:41:161:59 | 'oiuneawrgiyubaegr' | HardcodedCredentials.js:161:41:161:59 | 'oiuneawrgiyubaegr' |
| HardcodedCredentials.js:164:35:164:45 | 'change_me' | HardcodedCredentials.js:164:35:164:45 | 'change_me' |
| HardcodedCredentials.js:171:11:171:25 | USER | HardcodedCredentials.js:173:35:173:38 | USER |
| HardcodedCredentials.js:171:18:171:25 | 'sdsdag' | HardcodedCredentials.js:171:11:171:25 | USER |
@@ -399,6 +402,7 @@ edges
| HardcodedCredentials.js:293:37:293:65 | `Basic ... xxxxxx` | HardcodedCredentials.js:293:37:293:65 | `Basic ... xxxxxx` |
| HardcodedCredentials.js:294:37:294:70 | `Basic ... gbbbbb` | HardcodedCredentials.js:294:37:294:70 | `Basic ... gbbbbb` |
| HardcodedCredentials.js:295:37:295:66 | `Basic ... 000001` | HardcodedCredentials.js:295:37:295:66 | `Basic ... 000001` |
+| HardcodedCredentials.js:299:44:299:52 | 'mytoken' | HardcodedCredentials.js:299:44:299:52 | 'mytoken' |
#select
| HardcodedCredentials.js:5:15:5:22 | 'dbuser' | HardcodedCredentials.js:5:15:5:22 | 'dbuser' | HardcodedCredentials.js:5:15:5:22 | 'dbuser' | The hard-coded value "dbuser" is used as $@. | HardcodedCredentials.js:5:15:5:22 | 'dbuser' | user name |
| HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | The hard-coded value "hgfedcba" is used as $@. | HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | password |
@@ -448,8 +452,8 @@ edges
| HardcodedCredentials.js:130:44:130:53 | 'hgfedcba' | HardcodedCredentials.js:130:44:130:53 | 'hgfedcba' | HardcodedCredentials.js:130:44:130:53 | 'hgfedcba' | The hard-coded value "hgfedcba" is used as $@. | HardcodedCredentials.js:130:44:130:53 | 'hgfedcba' | key |
| HardcodedCredentials.js:131:52:131:61 | 'hgfedcba' | HardcodedCredentials.js:131:52:131:61 | 'hgfedcba' | HardcodedCredentials.js:131:52:131:61 | 'hgfedcba' | The hard-coded value "hgfedcba" is used as $@. | HardcodedCredentials.js:131:52:131:61 | 'hgfedcba' | key |
| HardcodedCredentials.js:135:41:135:50 | "hgfedcba" | HardcodedCredentials.js:135:41:135:50 | "hgfedcba" | HardcodedCredentials.js:135:41:135:50 | "hgfedcba" | The hard-coded value "hgfedcba" is used as $@. | HardcodedCredentials.js:135:41:135:50 | "hgfedcba" | key |
-| HardcodedCredentials.js:160:38:160:48 | "change_me" | HardcodedCredentials.js:160:38:160:48 | "change_me" | HardcodedCredentials.js:160:38:160:48 | "change_me" | The hard-coded value "change_me" is used as $@. | HardcodedCredentials.js:160:38:160:48 | "change_me" | key |
-| HardcodedCredentials.js:161:41:161:51 | 'change_me' | HardcodedCredentials.js:161:41:161:51 | 'change_me' | HardcodedCredentials.js:161:41:161:51 | 'change_me' | The hard-coded value "change_me" is used as $@. | HardcodedCredentials.js:161:41:161:51 | 'change_me' | key |
+| HardcodedCredentials.js:160:38:160:56 | "oiuneawrgiyubaegr" | HardcodedCredentials.js:160:38:160:56 | "oiuneawrgiyubaegr" | HardcodedCredentials.js:160:38:160:56 | "oiuneawrgiyubaegr" | The hard-coded value "oiuneawrgiyubaegr" is used as $@. | HardcodedCredentials.js:160:38:160:56 | "oiuneawrgiyubaegr" | key |
+| HardcodedCredentials.js:161:41:161:59 | 'oiuneawrgiyubaegr' | HardcodedCredentials.js:161:41:161:59 | 'oiuneawrgiyubaegr' | HardcodedCredentials.js:161:41:161:59 | 'oiuneawrgiyubaegr' | The hard-coded value "oiuneawrgiyubaegr" is used as $@. | HardcodedCredentials.js:161:41:161:59 | 'oiuneawrgiyubaegr' | key |
| HardcodedCredentials.js:171:18:171:25 | 'sdsdag' | HardcodedCredentials.js:171:18:171:25 | 'sdsdag' | HardcodedCredentials.js:178:30:178:44 | `Basic ${AUTH}` | The hard-coded value "sdsdag" is used as $@. | HardcodedCredentials.js:178:30:178:44 | `Basic ${AUTH}` | authorization header |
| HardcodedCredentials.js:171:18:171:25 | 'sdsdag' | HardcodedCredentials.js:171:18:171:25 | 'sdsdag' | HardcodedCredentials.js:188:30:188:44 | `Basic ${AUTH}` | The hard-coded value "sdsdag" is used as $@. | HardcodedCredentials.js:188:30:188:44 | `Basic ${AUTH}` | authorization header |
| HardcodedCredentials.js:171:18:171:25 | 'sdsdag' | HardcodedCredentials.js:171:18:171:25 | 'sdsdag' | HardcodedCredentials.js:195:37:195:51 | `Basic ${AUTH}` | The hard-coded value "sdsdag" is used as $@. | HardcodedCredentials.js:195:37:195:51 | `Basic ${AUTH}` | authorization header |
diff --git a/javascript/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.js b/javascript/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.js
index 8482d5106fe..b033764f264 100644
--- a/javascript/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.js
+++ b/javascript/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.js
@@ -157,8 +157,8 @@
})();
(function(){
- require("cookie-session")({ secret: "change_me" }); // NOT OK
- require('crypto').createHmac('sha256', 'change_me'); // NOT OK
+ require("cookie-session")({ secret: "oiuneawrgiyubaegr" }); // NOT OK
+ require('crypto').createHmac('sha256', 'oiuneawrgiyubaegr'); // NOT OK
var basicAuth = require('express-basic-auth');
basicAuth({users: { [adminName]: 'change_me' }}); // OK
@@ -294,3 +294,7 @@
headers.append("Authorization", `Basic sdsdag:aaaiuogrweuibgbbbbb`); // NOT OK
headers.append("Authorization", `Basic sdsdag:000000000000001`); // OK
});
+
+(function () {
+ require('crypto').createHmac('sha256', 'mytoken'); // OK
+})();
\ No newline at end of file
From 39a8b49222c3f3765ed348d70d612a2babedb6ed Mon Sep 17 00:00:00 2001
From: erik-krogh
Date: Fri, 3 May 2024 19:37:31 +0200
Subject: [PATCH 066/118] add qhelp recommendation that you can use an obvious
placeholder value
---
.../src/Security/CWE-798/HardcodedCredentials.qhelp | 4 ++++
.../Security/CWE-798/HardcodedCredentials.expected | 13 +++++++++++++
.../Security/CWE-798/HardcodedCredentials.js | 3 +++
3 files changed, 20 insertions(+)
diff --git a/javascript/ql/src/Security/CWE-798/HardcodedCredentials.qhelp b/javascript/ql/src/Security/CWE-798/HardcodedCredentials.qhelp
index adcd6fc4715..b2d00e38c28 100644
--- a/javascript/ql/src/Security/CWE-798/HardcodedCredentials.qhelp
+++ b/javascript/ql/src/Security/CWE-798/HardcodedCredentials.qhelp
@@ -19,6 +19,10 @@
If possible, store configuration files including credential data separately from the source code,
in a secure location with restricted access.
+
+ If the credentials are a placeholder value, make sure the value is obviously a placeholder by
+ using a name such as "SampleToken" or "MyPassword".
+
diff --git a/javascript/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.expected b/javascript/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.expected
index 0a9edfb64f8..fc41f193149 100644
--- a/javascript/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.expected
+++ b/javascript/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.expected
@@ -274,6 +274,15 @@ nodes
| HardcodedCredentials.js:299:44:299:52 | 'mytoken' |
| HardcodedCredentials.js:299:44:299:52 | 'mytoken' |
| HardcodedCredentials.js:299:44:299:52 | 'mytoken' |
+| HardcodedCredentials.js:300:44:300:56 | 'SampleToken' |
+| HardcodedCredentials.js:300:44:300:56 | 'SampleToken' |
+| HardcodedCredentials.js:300:44:300:56 | 'SampleToken' |
+| HardcodedCredentials.js:301:44:301:55 | 'MyPassword' |
+| HardcodedCredentials.js:301:44:301:55 | 'MyPassword' |
+| HardcodedCredentials.js:301:44:301:55 | 'MyPassword' |
+| HardcodedCredentials.js:302:44:302:69 | 'iubfew ... ybgera' |
+| HardcodedCredentials.js:302:44:302:69 | 'iubfew ... ybgera' |
+| HardcodedCredentials.js:302:44:302:69 | 'iubfew ... ybgera' |
edges
| HardcodedCredentials.js:5:15:5:22 | 'dbuser' | HardcodedCredentials.js:5:15:5:22 | 'dbuser' |
| HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' |
@@ -403,6 +412,9 @@ edges
| HardcodedCredentials.js:294:37:294:70 | `Basic ... gbbbbb` | HardcodedCredentials.js:294:37:294:70 | `Basic ... gbbbbb` |
| HardcodedCredentials.js:295:37:295:66 | `Basic ... 000001` | HardcodedCredentials.js:295:37:295:66 | `Basic ... 000001` |
| HardcodedCredentials.js:299:44:299:52 | 'mytoken' | HardcodedCredentials.js:299:44:299:52 | 'mytoken' |
+| HardcodedCredentials.js:300:44:300:56 | 'SampleToken' | HardcodedCredentials.js:300:44:300:56 | 'SampleToken' |
+| HardcodedCredentials.js:301:44:301:55 | 'MyPassword' | HardcodedCredentials.js:301:44:301:55 | 'MyPassword' |
+| HardcodedCredentials.js:302:44:302:69 | 'iubfew ... ybgera' | HardcodedCredentials.js:302:44:302:69 | 'iubfew ... ybgera' |
#select
| HardcodedCredentials.js:5:15:5:22 | 'dbuser' | HardcodedCredentials.js:5:15:5:22 | 'dbuser' | HardcodedCredentials.js:5:15:5:22 | 'dbuser' | The hard-coded value "dbuser" is used as $@. | HardcodedCredentials.js:5:15:5:22 | 'dbuser' | user name |
| HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | The hard-coded value "hgfedcba" is used as $@. | HardcodedCredentials.js:8:19:8:28 | 'hgfedcba' | password |
@@ -468,3 +480,4 @@ edges
| HardcodedCredentials.js:245:22:245:44 | "myHard ... ateKey" | HardcodedCredentials.js:245:22:245:44 | "myHard ... ateKey" | HardcodedCredentials.js:246:42:246:51 | privateKey | The hard-coded value "myHardCodedPrivateKey" is used as $@. | HardcodedCredentials.js:246:42:246:51 | privateKey | key |
| HardcodedCredentials.js:292:37:292:57 | `Basic ... sdsdag` | HardcodedCredentials.js:292:37:292:57 | `Basic ... sdsdag` | HardcodedCredentials.js:292:37:292:57 | `Basic ... sdsdag` | The hard-coded value "Basic sdsdag:sdsdag" is used as $@. | HardcodedCredentials.js:292:37:292:57 | `Basic ... sdsdag` | authorization header |
| HardcodedCredentials.js:294:37:294:70 | `Basic ... gbbbbb` | HardcodedCredentials.js:294:37:294:70 | `Basic ... gbbbbb` | HardcodedCredentials.js:294:37:294:70 | `Basic ... gbbbbb` | The hard-coded value "Basic sdsdag:aaaiuogrweuibgbbbbb" is used as $@. | HardcodedCredentials.js:294:37:294:70 | `Basic ... gbbbbb` | authorization header |
+| HardcodedCredentials.js:302:44:302:69 | 'iubfew ... ybgera' | HardcodedCredentials.js:302:44:302:69 | 'iubfew ... ybgera' | HardcodedCredentials.js:302:44:302:69 | 'iubfew ... ybgera' | The hard-coded value "iubfewiaaweiybgaeuybgera" is used as $@. | HardcodedCredentials.js:302:44:302:69 | 'iubfew ... ybgera' | key |
diff --git a/javascript/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.js b/javascript/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.js
index b033764f264..d1543f16dc7 100644
--- a/javascript/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.js
+++ b/javascript/ql/test/query-tests/Security/CWE-798/HardcodedCredentials.js
@@ -297,4 +297,7 @@
(function () {
require('crypto').createHmac('sha256', 'mytoken'); // OK
+ require('crypto').createHmac('sha256', 'SampleToken'); // OK
+ require('crypto').createHmac('sha256', 'MyPassword'); // OK
+ require('crypto').createHmac('sha256', 'iubfewiaaweiybgaeuybgera'); // NOT OK
})();
\ No newline at end of file
From 105984f7de7e13b49d8875b0fba6608ec80e3929 Mon Sep 17 00:00:00 2001
From: Michael Nebel
Date: Mon, 6 May 2024 10:01:34 +0200
Subject: [PATCH 067/118] Java: Make param module for MaD inline test.
---
.../CaptureTypeBasedSummaryModels.ql | 52 +++++++++++++------
1 file changed, 35 insertions(+), 17 deletions(-)
diff --git a/java/ql/test/utils/modelgenerator/typebasedflow/CaptureTypeBasedSummaryModels.ql b/java/ql/test/utils/modelgenerator/typebasedflow/CaptureTypeBasedSummaryModels.ql
index fe77abaa6df..88932d3a1ef 100644
--- a/java/ql/test/utils/modelgenerator/typebasedflow/CaptureTypeBasedSummaryModels.ql
+++ b/java/ql/test/utils/modelgenerator/typebasedflow/CaptureTypeBasedSummaryModels.ql
@@ -1,26 +1,44 @@
import java
import utils.modelgenerator.internal.CaptureTypeBasedSummaryModels
-private string expects() {
- exists(Javadoc doc |
- doc.getChild(0).toString().regexpCapture(" *(SPURIOUS-)?MaD=(.*)", 2) = result
- )
+signature module InlineMadTestConfigSig {
+ /**
+ * Gets a relevant code comment, if any.
+ */
+ string getComment();
+
+ /**
+ * Gets an identified summary, if any.
+ */
+ string getCapturedSummary();
}
-private string flows() { result = captureFlow(_) }
+module InlineMadTest {
+ private string expects() {
+ Input::getComment().regexpCapture(" *(SPURIOUS-)?MaD=(.*)", 2) = result
+ }
-query predicate unexpectedSummary(string msg) {
- exists(string flow |
- flow = flows() and
- not flow = expects() and
- msg = "Unexpected summary found: " + flow
- )
+ query predicate unexpectedSummary(string msg) {
+ exists(string flow |
+ flow = Input::getCapturedSummary() and
+ not flow = expects() and
+ msg = "Unexpected summary found: " + flow
+ )
+ }
+
+ query predicate expectedSummary(string msg) {
+ exists(string e |
+ e = expects() and
+ not e = Input::getCapturedSummary() and
+ msg = "Expected summary missing: " + e
+ )
+ }
}
-query predicate expectedSummary(string msg) {
- exists(string e |
- e = expects() and
- not e = flows() and
- msg = "Expected summary missing: " + e
- )
+module InlineMadTestConfig implements InlineMadTestConfigSig {
+ string getComment() { result = any(Javadoc doc).getChild(0).toString() }
+
+ string getCapturedSummary() { result = captureFlow(_) }
}
+
+import InlineMadTest
From 6815bcaa80027a01665d5783821d4fe4fb3fea85 Mon Sep 17 00:00:00 2001
From: Michael Nebel
Date: Mon, 6 May 2024 10:19:39 +0200
Subject: [PATCH 068/118] Java: Move param module into TestUtilities.
---
java/ql/test/TestUtilities/InlineMadTest.qll | 33 +++++++++++++++++
.../CaptureTypeBasedSummaryModels.ql | 35 +------------------
2 files changed, 34 insertions(+), 34 deletions(-)
create mode 100644 java/ql/test/TestUtilities/InlineMadTest.qll
diff --git a/java/ql/test/TestUtilities/InlineMadTest.qll b/java/ql/test/TestUtilities/InlineMadTest.qll
new file mode 100644
index 00000000000..64badab0dca
--- /dev/null
+++ b/java/ql/test/TestUtilities/InlineMadTest.qll
@@ -0,0 +1,33 @@
+signature module InlineMadTestConfigSig {
+ /**
+ * Gets a relevant code comment, if any.
+ */
+ string getComment();
+
+ /**
+ * Gets an identified summary, if any.
+ */
+ string getCapturedSummary();
+}
+
+module InlineMadTest {
+ private string expects() {
+ Input::getComment().regexpCapture(" *(SPURIOUS-)?MaD=(.*)", 2) = result
+ }
+
+ query predicate unexpectedSummary(string msg) {
+ exists(string flow |
+ flow = Input::getCapturedSummary() and
+ not flow = expects() and
+ msg = "Unexpected summary found: " + flow
+ )
+ }
+
+ query predicate expectedSummary(string msg) {
+ exists(string e |
+ e = expects() and
+ not e = Input::getCapturedSummary() and
+ msg = "Expected summary missing: " + e
+ )
+ }
+}
diff --git a/java/ql/test/utils/modelgenerator/typebasedflow/CaptureTypeBasedSummaryModels.ql b/java/ql/test/utils/modelgenerator/typebasedflow/CaptureTypeBasedSummaryModels.ql
index 88932d3a1ef..c5c509ac326 100644
--- a/java/ql/test/utils/modelgenerator/typebasedflow/CaptureTypeBasedSummaryModels.ql
+++ b/java/ql/test/utils/modelgenerator/typebasedflow/CaptureTypeBasedSummaryModels.ql
@@ -1,40 +1,7 @@
import java
+import TestUtilities.InlineMadTest
import utils.modelgenerator.internal.CaptureTypeBasedSummaryModels
-signature module InlineMadTestConfigSig {
- /**
- * Gets a relevant code comment, if any.
- */
- string getComment();
-
- /**
- * Gets an identified summary, if any.
- */
- string getCapturedSummary();
-}
-
-module InlineMadTest {
- private string expects() {
- Input::getComment().regexpCapture(" *(SPURIOUS-)?MaD=(.*)", 2) = result
- }
-
- query predicate unexpectedSummary(string msg) {
- exists(string flow |
- flow = Input::getCapturedSummary() and
- not flow = expects() and
- msg = "Unexpected summary found: " + flow
- )
- }
-
- query predicate expectedSummary(string msg) {
- exists(string e |
- e = expects() and
- not e = Input::getCapturedSummary() and
- msg = "Expected summary missing: " + e
- )
- }
-}
-
module InlineMadTestConfig implements InlineMadTestConfigSig {
string getComment() { result = any(Javadoc doc).getChild(0).toString() }
From 7cb8a6c52f9219abd305b3e2a7d6e4f3c29f3eac Mon Sep 17 00:00:00 2001
From: Michael Nebel
Date: Mon, 6 May 2024 11:01:23 +0200
Subject: [PATCH 069/118] Java: Inline models as data expected output as
comments in the java files and add a test.
---
.../dataflow/CaptureModels.expected | 2 +
.../modelgenerator/dataflow/CaptureModels.ql | 11 +
.../modelgenerator/dataflow/p/Factory.java | 42 ++--
.../modelgenerator/dataflow/p/FinalClass.java | 18 +-
.../modelgenerator/dataflow/p/FluentAPI.java | 18 +-
.../dataflow/p/ImmutablePojo.java | 37 ++--
.../dataflow/p/InnerClasses.java | 29 +--
.../dataflow/p/InnerHolder.java | 57 ++---
.../modelgenerator/dataflow/p/Joiner.java | 203 +++++++++---------
.../dataflow/p/MultipleImpl2.java | 29 +--
.../dataflow/p/MultipleImpls.java | 59 ++---
.../modelgenerator/dataflow/p/ParamFlow.java | 97 +++++----
.../utils/modelgenerator/dataflow/p/Pojo.java | 148 +++++++------
.../p/PrivateFlowViaPublicInterface.java | 82 +++----
14 files changed, 439 insertions(+), 393 deletions(-)
create mode 100644 java/ql/test/utils/modelgenerator/dataflow/CaptureModels.expected
create mode 100644 java/ql/test/utils/modelgenerator/dataflow/CaptureModels.ql
diff --git a/java/ql/test/utils/modelgenerator/dataflow/CaptureModels.expected b/java/ql/test/utils/modelgenerator/dataflow/CaptureModels.expected
new file mode 100644
index 00000000000..ee55a9c6ba6
--- /dev/null
+++ b/java/ql/test/utils/modelgenerator/dataflow/CaptureModels.expected
@@ -0,0 +1,2 @@
+unexpectedSummary
+expectedSummary
diff --git a/java/ql/test/utils/modelgenerator/dataflow/CaptureModels.ql b/java/ql/test/utils/modelgenerator/dataflow/CaptureModels.ql
new file mode 100644
index 00000000000..1a2dbd03d7a
--- /dev/null
+++ b/java/ql/test/utils/modelgenerator/dataflow/CaptureModels.ql
@@ -0,0 +1,11 @@
+import java
+import utils.modelgenerator.internal.CaptureSummaryFlowQuery
+import TestUtilities.InlineMadTest
+
+module InlineMadTestConfig implements InlineMadTestConfigSig {
+ string getComment() { result = any(Javadoc doc).getChild(0).toString() }
+
+ string getCapturedSummary() { result = captureFlow(_) }
+}
+
+import InlineMadTest
diff --git a/java/ql/test/utils/modelgenerator/dataflow/p/Factory.java b/java/ql/test/utils/modelgenerator/dataflow/p/Factory.java
index a6e7ce5fff6..84b55a812c9 100644
--- a/java/ql/test/utils/modelgenerator/dataflow/p/Factory.java
+++ b/java/ql/test/utils/modelgenerator/dataflow/p/Factory.java
@@ -2,29 +2,31 @@ package p;
public final class Factory {
- private String value;
+ private String value;
- private int intValue;
+ private int intValue;
- public static Factory create(String value, int foo) {
- return new Factory(value, foo);
- }
+ // MaD=p;Factory;false;create;(String,int);;Argument[0];ReturnValue;taint;df-generated
+ public static Factory create(String value, int foo) {
+ return new Factory(value, foo);
+ }
- public static Factory create(String value) {
- return new Factory(value, 0);
- }
+ // MaD=p;Factory;false;create;(String);;Argument[0];ReturnValue;taint;df-generated
+ public static Factory create(String value) {
+ return new Factory(value, 0);
+ }
- private Factory(String value, int intValue) {
- this.value = value;
- this.intValue = intValue;
- }
+ private Factory(String value, int intValue) {
+ this.value = value;
+ this.intValue = intValue;
+ }
- public String getValue() {
- return value;
- }
+ // MaD=p;Factory;false;getValue;();;Argument[this];ReturnValue;taint;df-generated
+ public String getValue() {
+ return value;
+ }
- public int getIntValue() {
- return intValue;
- }
-
-}
\ No newline at end of file
+ public int getIntValue() {
+ return intValue;
+ }
+}
diff --git a/java/ql/test/utils/modelgenerator/dataflow/p/FinalClass.java b/java/ql/test/utils/modelgenerator/dataflow/p/FinalClass.java
index 224fc44a0bc..5073f435233 100644
--- a/java/ql/test/utils/modelgenerator/dataflow/p/FinalClass.java
+++ b/java/ql/test/utils/modelgenerator/dataflow/p/FinalClass.java
@@ -2,14 +2,14 @@ package p;
public final class FinalClass {
- private static final String C = "constant";
+ private static final String C = "constant";
- public String returnsInput(String input) {
- return input;
- }
+ // MaD=p;FinalClass;false;returnsInput;(String);;Argument[0];ReturnValue;taint;df-generated
+ public String returnsInput(String input) {
+ return input;
+ }
- public String returnsConstant() {
- return C;
- }
-
-}
\ No newline at end of file
+ public String returnsConstant() {
+ return C;
+ }
+}
diff --git a/java/ql/test/utils/modelgenerator/dataflow/p/FluentAPI.java b/java/ql/test/utils/modelgenerator/dataflow/p/FluentAPI.java
index 65887625d27..2bb2bb97604 100644
--- a/java/ql/test/utils/modelgenerator/dataflow/p/FluentAPI.java
+++ b/java/ql/test/utils/modelgenerator/dataflow/p/FluentAPI.java
@@ -2,14 +2,14 @@ package p;
public final class FluentAPI {
- public FluentAPI returnsThis(String input) {
- return this;
- }
+ // MaD=p;FluentAPI;false;returnsThis;(String);;Argument[this];ReturnValue;value;df-generated
+ public FluentAPI returnsThis(String input) {
+ return this;
+ }
- public class Inner {
- public FluentAPI notThis(String input) {
- return FluentAPI.this;
- }
+ public class Inner {
+ public FluentAPI notThis(String input) {
+ return FluentAPI.this;
}
-
-}
\ No newline at end of file
+ }
+}
diff --git a/java/ql/test/utils/modelgenerator/dataflow/p/ImmutablePojo.java b/java/ql/test/utils/modelgenerator/dataflow/p/ImmutablePojo.java
index 660c1970bd3..38a9b472f62 100644
--- a/java/ql/test/utils/modelgenerator/dataflow/p/ImmutablePojo.java
+++ b/java/ql/test/utils/modelgenerator/dataflow/p/ImmutablePojo.java
@@ -2,25 +2,28 @@ package p;
public final class ImmutablePojo {
- private final String value;
+ private final String value;
- private final long x;
+ private final long x;
- public ImmutablePojo(String value, int x) {
- this.value = value;
- this.x = x;
- }
+ // MaD=p;ImmutablePojo;false;ImmutablePojo;(String,int);;Argument[0];Argument[this];taint;df-generated
+ public ImmutablePojo(String value, int x) {
+ this.value = value;
+ this.x = x;
+ }
- public String getValue() {
- return value;
- }
+ // MaD=p;ImmutablePojo;false;getValue;();;Argument[this];ReturnValue;taint;df-generated
+ public String getValue() {
+ return value;
+ }
- public long getX() {
- return x;
- }
+ public long getX() {
+ return x;
+ }
- public String or(String defaultValue) {
- return value != null ? value : defaultValue;
- }
-
-}
\ No newline at end of file
+ // MaD=p;ImmutablePojo;false;or;(String);;Argument[0];ReturnValue;taint;df-generated
+ // MaD=p;ImmutablePojo;false;or;(String);;Argument[this];ReturnValue;taint;df-generated
+ public String or(String defaultValue) {
+ return value != null ? value : defaultValue;
+ }
+}
diff --git a/java/ql/test/utils/modelgenerator/dataflow/p/InnerClasses.java b/java/ql/test/utils/modelgenerator/dataflow/p/InnerClasses.java
index 936166eddf3..54f014fec93 100644
--- a/java/ql/test/utils/modelgenerator/dataflow/p/InnerClasses.java
+++ b/java/ql/test/utils/modelgenerator/dataflow/p/InnerClasses.java
@@ -1,21 +1,22 @@
package p;
public class InnerClasses {
-
- class IgnoreMe {
- public String no(String input) {
- return input;
- }
- }
-
- public class CaptureMe {
- public String yesCm(String input) {
- return input;
- }
- }
- public String yes(String input) {
- return input;
+ class IgnoreMe {
+ public String no(String input) {
+ return input;
}
+ }
+ public class CaptureMe {
+ // MaD=p;InnerClasses$CaptureMe;true;yesCm;(String);;Argument[0];ReturnValue;taint;df-generated
+ public String yesCm(String input) {
+ return input;
+ }
+ }
+
+ // MaD=p;InnerClasses;true;yes;(String);;Argument[0];ReturnValue;taint;df-generated
+ public String yes(String input) {
+ return input;
+ }
}
diff --git a/java/ql/test/utils/modelgenerator/dataflow/p/InnerHolder.java b/java/ql/test/utils/modelgenerator/dataflow/p/InnerHolder.java
index 5dc07cadd51..ef872942191 100644
--- a/java/ql/test/utils/modelgenerator/dataflow/p/InnerHolder.java
+++ b/java/ql/test/utils/modelgenerator/dataflow/p/InnerHolder.java
@@ -2,36 +2,39 @@ package p;
public final class InnerHolder {
- private class Context {
- private String value;
+ private class Context {
+ private String value;
- Context(String value) {
- this.value = value;
- }
-
- public String getValue() {
- return value;
- }
- }
-
- private Context context = null;
-
- private StringBuilder sb = new StringBuilder();
-
- public void setContext(String value) {
- context = new Context(value);
- }
-
- public void explicitSetContext(String value) {
- this.context = new Context(value);
- }
-
- public void append(String value) {
- sb.append(value);
+ Context(String value) {
+ this.value = value;
}
public String getValue() {
- return context.getValue();
+ return value;
}
+ }
-}
\ No newline at end of file
+ private Context context = null;
+
+ private StringBuilder sb = new StringBuilder();
+
+ // MaD=p;InnerHolder;false;setContext;(String);;Argument[0];Argument[this];taint;df-generated
+ public void setContext(String value) {
+ context = new Context(value);
+ }
+
+ // MaD=p;InnerHolder;false;explicitSetContext;(String);;Argument[0];Argument[this];taint;df-generated
+ public void explicitSetContext(String value) {
+ this.context = new Context(value);
+ }
+
+ // MaD=p;InnerHolder;false;append;(String);;Argument[0];Argument[this];taint;df-generated
+ public void append(String value) {
+ sb.append(value);
+ }
+
+ // MaD=p;InnerHolder;false;getValue;();;Argument[this];ReturnValue;taint;df-generated
+ public String getValue() {
+ return context.getValue();
+ }
+}
diff --git a/java/ql/test/utils/modelgenerator/dataflow/p/Joiner.java b/java/ql/test/utils/modelgenerator/dataflow/p/Joiner.java
index d9869815bc5..daa939ebe51 100644
--- a/java/ql/test/utils/modelgenerator/dataflow/p/Joiner.java
+++ b/java/ql/test/utils/modelgenerator/dataflow/p/Joiner.java
@@ -4,115 +4,122 @@ import java.util.Arrays;
import java.util.Objects;
public final class Joiner {
- private final String prefix;
- private final String delimiter;
- private final String suffix;
- private String[] elts;
- private int size;
- private int len;
- private String emptyValue;
- public Joiner(CharSequence delimiter) {
- this(delimiter, "", "");
- }
+ private final String prefix;
+ private final String delimiter;
+ private final String suffix;
+ private String[] elts;
+ private int size;
+ private int len;
+ private String emptyValue;
- public Joiner(CharSequence delimiter,
- CharSequence prefix,
- CharSequence suffix) {
- Objects.requireNonNull(prefix, "The prefix must not be null");
- Objects.requireNonNull(delimiter, "The delimiter must not be null");
- Objects.requireNonNull(suffix, "The suffix must not be null");
- this.prefix = prefix.toString();
- this.delimiter = delimiter.toString();
- this.suffix = suffix.toString();
- checkAddLength(0, 0);
- }
+ // MaD=p;Joiner;false;Joiner;(CharSequence);;Argument[0];Argument[this];taint;df-generated
+ public Joiner(CharSequence delimiter) {
+ this(delimiter, "", "");
+ }
- public Joiner setEmptyValue(CharSequence emptyValue) {
- this.emptyValue = Objects.requireNonNull(emptyValue,
- "The empty value must not be null").toString();
- return this;
- }
+ // MaD=p;Joiner;false;Joiner;(CharSequence,CharSequence,CharSequence);;Argument[0];Argument[this];taint;df-generated
+ // MaD=p;Joiner;false;Joiner;(CharSequence,CharSequence,CharSequence);;Argument[1];Argument[this];taint;df-generated
+ // MaD=p;Joiner;false;Joiner;(CharSequence,CharSequence,CharSequence);;Argument[2];Argument[this];taint;df-generated
+ public Joiner(CharSequence delimiter, CharSequence prefix, CharSequence suffix) {
+ Objects.requireNonNull(prefix, "The prefix must not be null");
+ Objects.requireNonNull(delimiter, "The delimiter must not be null");
+ Objects.requireNonNull(suffix, "The suffix must not be null");
+ this.prefix = prefix.toString();
+ this.delimiter = delimiter.toString();
+ this.suffix = suffix.toString();
+ checkAddLength(0, 0);
+ }
- private static int getChars(String s, char[] chars, int start) {
- int len = s.length();
- s.getChars(0, len, chars, start);
- return len;
- }
+ // MaD=p;Joiner;false;setEmptyValue;(CharSequence);;Argument[0];Argument[this];taint;df-generated
+ // MaD=p;Joiner;false;setEmptyValue;(CharSequence);;Argument[this];ReturnValue;value;df-generated
+ public Joiner setEmptyValue(CharSequence emptyValue) {
+ this.emptyValue =
+ Objects.requireNonNull(emptyValue, "The empty value must not be null").toString();
+ return this;
+ }
- @Override
- public String toString() {
- final String[] elts = this.elts;
- if (elts == null && emptyValue != null) {
- return emptyValue;
- }
- final int size = this.size;
- final int addLen = prefix.length() + suffix.length();
- if (addLen == 0) {
- compactElts();
- return size == 0 ? "" : elts[0];
- }
- final String delimiter = this.delimiter;
- final char[] chars = new char[len + addLen];
- int k = getChars(prefix, chars, 0);
- if (size > 0) {
- k += getChars(elts[0], chars, k);
- for (int i = 1; i < size; i++) {
- k += getChars(delimiter, chars, k);
- k += getChars(elts[i], chars, k);
- }
- }
- k += getChars(suffix, chars, k);
- return new String(chars);
- }
+ private static int getChars(String s, char[] chars, int start) {
+ int len = s.length();
+ s.getChars(0, len, chars, start);
+ return len;
+ }
- public Joiner add(CharSequence newElement) {
- final String elt = String.valueOf(newElement);
- if (elts == null) {
- elts = new String[8];
- } else {
- if (size == elts.length)
- elts = Arrays.copyOf(elts, 2 * size);
- len = checkAddLength(len, delimiter.length());
- }
- len = checkAddLength(len, elt.length());
- elts[size++] = elt;
- return this;
+ @Override
+ public String toString() {
+ final String[] elts = this.elts;
+ if (elts == null && emptyValue != null) {
+ return emptyValue;
}
+ final int size = this.size;
+ final int addLen = prefix.length() + suffix.length();
+ if (addLen == 0) {
+ compactElts();
+ return size == 0 ? "" : elts[0];
+ }
+ final String delimiter = this.delimiter;
+ final char[] chars = new char[len + addLen];
+ int k = getChars(prefix, chars, 0);
+ if (size > 0) {
+ k += getChars(elts[0], chars, k);
+ for (int i = 1; i < size; i++) {
+ k += getChars(delimiter, chars, k);
+ k += getChars(elts[i], chars, k);
+ }
+ }
+ k += getChars(suffix, chars, k);
+ return new String(chars);
+ }
- private int checkAddLength(int oldLen, int inc) {
- long newLen = (long)oldLen + (long)inc;
- long tmpLen = newLen + (long)prefix.length() + (long)suffix.length();
- if (tmpLen != (int)tmpLen) {
- throw new OutOfMemoryError("Requested array size exceeds VM limit");
- }
- return (int)newLen;
+ // MaD=p;Joiner;false;add;(CharSequence);;Argument[this];ReturnValue;value;df-generated
+ public Joiner add(CharSequence newElement) {
+ final String elt = String.valueOf(newElement);
+ if (elts == null) {
+ elts = new String[8];
+ } else {
+ if (size == elts.length) elts = Arrays.copyOf(elts, 2 * size);
+ len = checkAddLength(len, delimiter.length());
}
+ len = checkAddLength(len, elt.length());
+ elts[size++] = elt;
+ return this;
+ }
- public Joiner merge(Joiner other) {
- Objects.requireNonNull(other);
- if (other.elts == null) {
- return this;
- }
- other.compactElts();
- return add(other.elts[0]);
+ private int checkAddLength(int oldLen, int inc) {
+ long newLen = (long) oldLen + (long) inc;
+ long tmpLen = newLen + (long) prefix.length() + (long) suffix.length();
+ if (tmpLen != (int) tmpLen) {
+ throw new OutOfMemoryError("Requested array size exceeds VM limit");
}
+ return (int) newLen;
+ }
- private void compactElts() {
- if (size > 1) {
- final char[] chars = new char[len];
- int i = 1, k = getChars(elts[0], chars, 0);
- do {
- k += getChars(delimiter, chars, k);
- k += getChars(elts[i], chars, k);
- elts[i] = null;
- } while (++i < size);
- size = 1;
- elts[0] = new String(chars);
- }
+ // MaD=p;Joiner;false;merge;(Joiner);;Argument[this];ReturnValue;value;df-generated
+ public Joiner merge(Joiner other) {
+ Objects.requireNonNull(other);
+ if (other.elts == null) {
+ return this;
}
+ other.compactElts();
+ return add(other.elts[0]);
+ }
- public int length() {
- return (size == 0 && emptyValue != null) ? emptyValue.length() :
- len + prefix.length() + suffix.length();
+ private void compactElts() {
+ if (size > 1) {
+ final char[] chars = new char[len];
+ int i = 1, k = getChars(elts[0], chars, 0);
+ do {
+ k += getChars(delimiter, chars, k);
+ k += getChars(elts[i], chars, k);
+ elts[i] = null;
+ } while (++i < size);
+ size = 1;
+ elts[0] = new String(chars);
}
-}
\ No newline at end of file
+ }
+
+ public int length() {
+ return (size == 0 && emptyValue != null)
+ ? emptyValue.length()
+ : len + prefix.length() + suffix.length();
+ }
+}
diff --git a/java/ql/test/utils/modelgenerator/dataflow/p/MultipleImpl2.java b/java/ql/test/utils/modelgenerator/dataflow/p/MultipleImpl2.java
index 9de2d59b2e4..7c2e2ed9211 100644
--- a/java/ql/test/utils/modelgenerator/dataflow/p/MultipleImpl2.java
+++ b/java/ql/test/utils/modelgenerator/dataflow/p/MultipleImpl2.java
@@ -2,22 +2,23 @@ package p;
class MultipleImpl2 {
- // Multiple implementations of the same interface.
- // This is used to test that we only generate a summary model and
- // not neutral summary model for `IInterface.m`.
- public interface IInterface {
- Object m(Object value);
- }
+ // Multiple implementations of the same interface.
+ // This is used to test that we only generate a summary model and
+ // not neutral summary model for `IInterface.m`.
+ public interface IInterface {
+ // MaD=p;MultipleImpl2$IInterface;true;m;(Object);;Argument[0];ReturnValue;taint;df-generated
+ Object m(Object value);
+ }
- public class Impl1 implements IInterface {
- public Object m(Object value) {
- return null;
- }
+ public class Impl1 implements IInterface {
+ public Object m(Object value) {
+ return null;
}
+ }
- public class Impl2 implements IInterface {
- public Object m(Object value) {
- return value;
- }
+ public class Impl2 implements IInterface {
+ public Object m(Object value) {
+ return value;
}
+ }
}
diff --git a/java/ql/test/utils/modelgenerator/dataflow/p/MultipleImpls.java b/java/ql/test/utils/modelgenerator/dataflow/p/MultipleImpls.java
index a6697393dbc..8cdde304bd5 100644
--- a/java/ql/test/utils/modelgenerator/dataflow/p/MultipleImpls.java
+++ b/java/ql/test/utils/modelgenerator/dataflow/p/MultipleImpls.java
@@ -4,35 +4,38 @@ import java.util.concurrent.Callable;
public class MultipleImpls {
- public static interface Strategy {
- String doSomething(String value);
+ public static interface Strategy {
+ // MaD=p;MultipleImpls$Strategy;true;doSomething;(String);;Argument[0];Argument[this];taint;df-generated
+ // MaD=p;MultipleImpls$Strategy;true;doSomething;(String);;Argument[0];ReturnValue;taint;df-generated
+ String doSomething(String value);
+ }
+
+ public static class Strat1 implements Strategy {
+ public String doSomething(String value) {
+ return value;
+ }
+ }
+
+ // implements in different library should not count as impl
+ public static class Strat3 implements Callable {
+
+ @Override
+ public String call() throws Exception {
+ return null;
+ }
+ }
+
+ public static class Strat2 implements Strategy {
+ private String foo;
+
+ public String doSomething(String value) {
+ this.foo = value;
+ return "none";
}
- public static class Strat1 implements Strategy {
- public String doSomething(String value) {
- return value;
- }
- }
-
- // implements in different library should not count as impl
- public static class Strat3 implements Callable {
-
- @Override
- public String call() throws Exception {
- return null;
- }
-
- }
- public static class Strat2 implements Strategy {
- private String foo;
-
- public String doSomething(String value) {
- this.foo = value;
- return "none";
- }
-
- public String getValue() {
- return this.foo;
- }
+ // MaD=p;MultipleImpls$Strat2;true;getValue;();;Argument[this];ReturnValue;taint;df-generated
+ public String getValue() {
+ return this.foo;
}
+ }
}
diff --git a/java/ql/test/utils/modelgenerator/dataflow/p/ParamFlow.java b/java/ql/test/utils/modelgenerator/dataflow/p/ParamFlow.java
index 8b58c377316..7d9dac157c2 100644
--- a/java/ql/test/utils/modelgenerator/dataflow/p/ParamFlow.java
+++ b/java/ql/test/utils/modelgenerator/dataflow/p/ParamFlow.java
@@ -1,64 +1,71 @@
package p;
-import java.util.Iterator;
-import java.util.List;
import java.io.IOException;
import java.io.OutputStream;
-
+import java.util.Iterator;
+import java.util.List;
public class ParamFlow {
- public String returnsInput(String input) {
- return input;
- }
+ // MaD=p;ParamFlow;true;returnsInput;(String);;Argument[0];ReturnValue;taint;df-generated
+ public String returnsInput(String input) {
+ return input;
+ }
- public int ignorePrimitiveReturnValue(String input) {
- return input.length();
- }
+ public int ignorePrimitiveReturnValue(String input) {
+ return input.length();
+ }
- public String returnMultipleParameters(String one, String two) {
- if (System.currentTimeMillis() > 100) {
- return two;
- }
- return one;
+ // MaD=p;ParamFlow;true;returnMultipleParameters;(String,String);;Argument[0];ReturnValue;taint;df-generated
+ // MaD=p;ParamFlow;true;returnMultipleParameters;(String,String);;Argument[1];ReturnValue;taint;df-generated
+ public String returnMultipleParameters(String one, String two) {
+ if (System.currentTimeMillis() > 100) {
+ return two;
}
+ return one;
+ }
- public String returnArrayElement(String[] input) {
- return input[0];
- }
+ // MaD=p;ParamFlow;true;returnArrayElement;(String[]);;Argument[0].ArrayElement;ReturnValue;taint;df-generated
+ public String returnArrayElement(String[] input) {
+ return input[0];
+ }
- public String returnVarArgElement(String... input) {
- return input[0];
- }
+ // MaD=p;ParamFlow;true;returnVarArgElement;(String[]);;Argument[0].ArrayElement;ReturnValue;taint;df-generated
+ public String returnVarArgElement(String... input) {
+ return input[0];
+ }
- public String returnCollectionElement(List input) {
- return input.get(0);
- }
+ // MaD=p;ParamFlow;true;returnCollectionElement;(List);;Argument[0].Element;ReturnValue;taint;df-generated
+ public String returnCollectionElement(List input) {
+ return input.get(0);
+ }
- public String returnIteratorElement(Iterator input) {
- return input.next();
- }
+ // MaD=p;ParamFlow;true;returnIteratorElement;(Iterator);;Argument[0].Element;ReturnValue;taint;df-generated
+ public String returnIteratorElement(Iterator input) {
+ return input.next();
+ }
- public String returnIterableElement(Iterable input) {
- return input.iterator().next();
- }
+ // MaD=p;ParamFlow;true;returnIterableElement;(Iterable);;Argument[0].Element;ReturnValue;taint;df-generated
+ public String returnIterableElement(Iterable input) {
+ return input.iterator().next();
+ }
- public Class> mapType(Class> input) {
- return input;
- }
+ public Class> mapType(Class> input) {
+ return input;
+ }
- public void writeChunked(byte[] data, OutputStream output)
- throws IOException {
- output.write(data, 0, data.length);
- }
-
- public void writeChunked(char[] data, OutputStream output)
- throws IOException {
- output.write(String.valueOf(data).getBytes(), 0, data.length);
- }
+ // MaD=p;ParamFlow;true;writeChunked;(byte[],OutputStream);;Argument[0];Argument[1];taint;df-generated
+ public void writeChunked(byte[] data, OutputStream output) throws IOException {
+ output.write(data, 0, data.length);
+ }
- public void addTo(String data, List target) {
- target.add(data);
- }
+ // MaD=p;ParamFlow;true;writeChunked;(char[],OutputStream);;Argument[0];Argument[1];taint;df-generated
+ public void writeChunked(char[] data, OutputStream output) throws IOException {
+ output.write(String.valueOf(data).getBytes(), 0, data.length);
+ }
-}
\ No newline at end of file
+ // MaD=p;ParamFlow;true;addTo;(String,List);;Argument[0];Argument[1].Element;taint;df-generated
+ public void addTo(String data, List target) {
+ target.add(data);
+ }
+}
diff --git a/java/ql/test/utils/modelgenerator/dataflow/p/Pojo.java b/java/ql/test/utils/modelgenerator/dataflow/p/Pojo.java
index 40dfa56ae86..15fbda5bc79 100644
--- a/java/ql/test/utils/modelgenerator/dataflow/p/Pojo.java
+++ b/java/ql/test/utils/modelgenerator/dataflow/p/Pojo.java
@@ -8,91 +8,97 @@ import java.util.List;
public final class Pojo {
- private class Holder {
- private String value;
-
- Holder(String value) {
- this.value = value;
- }
-
- int length() {
- return value.length();
- }
- }
-
+ private class Holder {
private String value;
- private int intValue = 2;
-
- private byte[] byteArray = new byte[] {1, 2, 3} ;
- private float[] floatArray = new float[] {1, 2, 3} ;
- private char[] charArray = new char[] {'a', 'b', 'c'} ;
- private List charList = Arrays.asList('a', 'b', 'c');
- private Byte[] byteObjectArray = new Byte[] { 1, 2, 3 };
-
- public String getValue() {
- return value;
+ Holder(String value) {
+ this.value = value;
}
- public void setValue(String value) {
- this.value = value;
+ int length() {
+ return value.length();
}
+ }
- public int doNotSetValue(String value) {
- Holder h = new Holder(value);
- return h.length();
- }
+ private String value;
- public int getIntValue() {
- return intValue;
- }
+ private int intValue = 2;
- public Integer getBoxedValue() {
- return Integer.valueOf(intValue);
- }
+ private byte[] byteArray = new byte[] {1, 2, 3};
+ private float[] floatArray = new float[] {1, 2, 3};
+ private char[] charArray = new char[] {'a', 'b', 'c'};
+ private List charList = Arrays.asList('a', 'b', 'c');
+ private Byte[] byteObjectArray = new Byte[] {1, 2, 3};
- public int[] getPrimitiveArray() {
- return new int[] { intValue };
- }
+ // MaD=p;Pojo;false;getValue;();;Argument[this];ReturnValue;taint;df-generated
+ public String getValue() {
+ return value;
+ }
- public char[] getCharArray() {
- return charArray;
- }
+ // MaD=p;Pojo;false;setValue;(String);;Argument[0];Argument[this];taint;df-generated
+ public void setValue(String value) {
+ this.value = value;
+ }
- public byte[] getByteArray() {
- return byteArray;
- }
-
- public float[] getFloatArray() {
- return floatArray;
- }
+ public int doNotSetValue(String value) {
+ Holder h = new Holder(value);
+ return h.length();
+ }
- public Integer[] getBoxedArray() {
- return new Integer[] { Integer.valueOf(intValue) };
- }
-
- public Collection getBoxedCollection() {
- return List.of(Integer.valueOf(intValue));
- }
+ public int getIntValue() {
+ return intValue;
+ }
- public List getBoxedChars() {
- return charList;
- }
+ public Integer getBoxedValue() {
+ return Integer.valueOf(intValue);
+ }
- public Byte[] getBoxedBytes() {
- return byteObjectArray;
- }
-
- public BigInteger getBigInt() {
- return BigInteger.valueOf(intValue);
- }
+ public int[] getPrimitiveArray() {
+ return new int[] {intValue};
+ }
- public BigDecimal getBigDecimal() {
- return new BigDecimal(value);
- }
+ // MaD=p;Pojo;false;getCharArray;();;Argument[this];ReturnValue;taint;df-generated
+ public char[] getCharArray() {
+ return charArray;
+ }
- public void fillIn(List target) {
- target.add(value);
- }
+ // MaD=p;Pojo;false;getByteArray;();;Argument[this];ReturnValue;taint;df-generated
+ public byte[] getByteArray() {
+ return byteArray;
+ }
-}
\ No newline at end of file
+ public float[] getFloatArray() {
+ return floatArray;
+ }
+
+ public Integer[] getBoxedArray() {
+ return new Integer[] {Integer.valueOf(intValue)};
+ }
+
+ public Collection getBoxedCollection() {
+ return List.of(Integer.valueOf(intValue));
+ }
+
+ // MaD=p;Pojo;false;getBoxedChars;();;Argument[this];ReturnValue;taint;df-generated
+ public List getBoxedChars() {
+ return charList;
+ }
+
+ // MaD=p;Pojo;false;getBoxedBytes;();;Argument[this];ReturnValue;taint;df-generated
+ public Byte[] getBoxedBytes() {
+ return byteObjectArray;
+ }
+
+ public BigInteger getBigInt() {
+ return BigInteger.valueOf(intValue);
+ }
+
+ public BigDecimal getBigDecimal() {
+ return new BigDecimal(value);
+ }
+
+ // MaD=p;Pojo;false;fillIn;(List);;Argument[this];Argument[0].Element;taint;df-generated
+ public void fillIn(List target) {
+ target.add(value);
+ }
+}
diff --git a/java/ql/test/utils/modelgenerator/dataflow/p/PrivateFlowViaPublicInterface.java b/java/ql/test/utils/modelgenerator/dataflow/p/PrivateFlowViaPublicInterface.java
index 59247bfe471..13a2897f08a 100644
--- a/java/ql/test/utils/modelgenerator/dataflow/p/PrivateFlowViaPublicInterface.java
+++ b/java/ql/test/utils/modelgenerator/dataflow/p/PrivateFlowViaPublicInterface.java
@@ -7,55 +7,55 @@ import java.io.OutputStream;
public class PrivateFlowViaPublicInterface {
- static class RandomPojo {
- public File someFile = new File("someFile");
- }
- public static interface SPI {
- OutputStream openStream() throws IOException;
+ static class RandomPojo {
+ public File someFile = new File("someFile");
+ }
- default OutputStream openStreamNone() throws IOException {
- return null;
- };
+ public static interface SPI {
+ // MaD=p;PrivateFlowViaPublicInterface$SPI;true;openStream;();;Argument[this];ReturnValue;taint;df-generated
+ OutputStream openStream() throws IOException;
+
+ default OutputStream openStreamNone() throws IOException {
+ return null;
+ }
+ ;
+ }
+
+ private static final class PrivateImplWithSink implements SPI {
+
+ private File file;
+
+ public PrivateImplWithSink(File file) {
+ this.file = file;
}
- private static final class PrivateImplWithSink implements SPI {
-
- private File file;
-
- public PrivateImplWithSink(File file) {
- this.file = file;
- }
-
- @Override
- public OutputStream openStream() throws IOException {
- return new FileOutputStream(file);
- }
-
+ @Override
+ public OutputStream openStream() throws IOException {
+ return new FileOutputStream(file);
}
-
- private static final class PrivateImplWithRandomField implements SPI {
+ }
- public PrivateImplWithRandomField(File file) {
- }
+ private static final class PrivateImplWithRandomField implements SPI {
- @Override
- public OutputStream openStream() throws IOException {
- return null;
- }
-
- @Override
- public OutputStream openStreamNone() throws IOException {
- return new FileOutputStream(new RandomPojo().someFile);
- }
+ public PrivateImplWithRandomField(File file) {}
+ @Override
+ public OutputStream openStream() throws IOException {
+ return null;
}
- public static SPI createAnSPI(File file) {
- return new PrivateImplWithSink(file);
- }
-
- public static SPI createAnSPIWithoutTrackingFile(File file) {
- return new PrivateImplWithRandomField(file);
+ @Override
+ public OutputStream openStreamNone() throws IOException {
+ return new FileOutputStream(new RandomPojo().someFile);
}
+ }
-}
\ No newline at end of file
+ // MaD=p;PrivateFlowViaPublicInterface;true;createAnSPI;(File);;Argument[0];ReturnValue;taint;df-generated
+ public static SPI createAnSPI(File file) {
+ return new PrivateImplWithSink(file);
+ }
+
+ public static SPI createAnSPIWithoutTrackingFile(File file) {
+ return new PrivateImplWithRandomField(file);
+ }
+}
From a33393d452d8ec5758deb979ae75fbee2eefe74e Mon Sep 17 00:00:00 2001
From: Michael Nebel
Date: Mon, 6 May 2024 11:02:04 +0200
Subject: [PATCH 070/118] Java: Delete old summary models expected output.
---
.../dataflow/CaptureSummaryModels.expected | 47 -------------------
.../dataflow/CaptureSummaryModels.qlref | 1 -
2 files changed, 48 deletions(-)
delete mode 100644 java/ql/test/utils/modelgenerator/dataflow/CaptureSummaryModels.expected
delete mode 100644 java/ql/test/utils/modelgenerator/dataflow/CaptureSummaryModels.qlref
diff --git a/java/ql/test/utils/modelgenerator/dataflow/CaptureSummaryModels.expected b/java/ql/test/utils/modelgenerator/dataflow/CaptureSummaryModels.expected
deleted file mode 100644
index 50536e850d9..00000000000
--- a/java/ql/test/utils/modelgenerator/dataflow/CaptureSummaryModels.expected
+++ /dev/null
@@ -1,47 +0,0 @@
-| p;Factory;false;create;(String);;Argument[0];ReturnValue;taint;df-generated |
-| p;Factory;false;create;(String,int);;Argument[0];ReturnValue;taint;df-generated |
-| p;Factory;false;getValue;();;Argument[this];ReturnValue;taint;df-generated |
-| p;FinalClass;false;returnsInput;(String);;Argument[0];ReturnValue;taint;df-generated |
-| p;FluentAPI;false;returnsThis;(String);;Argument[this];ReturnValue;value;df-generated |
-| p;ImmutablePojo;false;ImmutablePojo;(String,int);;Argument[0];Argument[this];taint;df-generated |
-| p;ImmutablePojo;false;getValue;();;Argument[this];ReturnValue;taint;df-generated |
-| p;ImmutablePojo;false;or;(String);;Argument[0];ReturnValue;taint;df-generated |
-| p;ImmutablePojo;false;or;(String);;Argument[this];ReturnValue;taint;df-generated |
-| p;InnerClasses$CaptureMe;true;yesCm;(String);;Argument[0];ReturnValue;taint;df-generated |
-| p;InnerClasses;true;yes;(String);;Argument[0];ReturnValue;taint;df-generated |
-| p;InnerHolder;false;append;(String);;Argument[0];Argument[this];taint;df-generated |
-| p;InnerHolder;false;explicitSetContext;(String);;Argument[0];Argument[this];taint;df-generated |
-| p;InnerHolder;false;getValue;();;Argument[this];ReturnValue;taint;df-generated |
-| p;InnerHolder;false;setContext;(String);;Argument[0];Argument[this];taint;df-generated |
-| p;Joiner;false;Joiner;(CharSequence);;Argument[0];Argument[this];taint;df-generated |
-| p;Joiner;false;Joiner;(CharSequence,CharSequence,CharSequence);;Argument[0];Argument[this];taint;df-generated |
-| p;Joiner;false;Joiner;(CharSequence,CharSequence,CharSequence);;Argument[1];Argument[this];taint;df-generated |
-| p;Joiner;false;Joiner;(CharSequence,CharSequence,CharSequence);;Argument[2];Argument[this];taint;df-generated |
-| p;Joiner;false;add;(CharSequence);;Argument[this];ReturnValue;value;df-generated |
-| p;Joiner;false;merge;(Joiner);;Argument[this];ReturnValue;value;df-generated |
-| p;Joiner;false;setEmptyValue;(CharSequence);;Argument[0];Argument[this];taint;df-generated |
-| p;Joiner;false;setEmptyValue;(CharSequence);;Argument[this];ReturnValue;value;df-generated |
-| p;MultipleImpl2$IInterface;true;m;(Object);;Argument[0];ReturnValue;taint;df-generated |
-| p;MultipleImpls$Strat2;true;getValue;();;Argument[this];ReturnValue;taint;df-generated |
-| p;MultipleImpls$Strategy;true;doSomething;(String);;Argument[0];Argument[this];taint;df-generated |
-| p;MultipleImpls$Strategy;true;doSomething;(String);;Argument[0];ReturnValue;taint;df-generated |
-| p;ParamFlow;true;addTo;(String,List);;Argument[0];Argument[1].Element;taint;df-generated |
-| p;ParamFlow;true;returnArrayElement;(String[]);;Argument[0].ArrayElement;ReturnValue;taint;df-generated |
-| p;ParamFlow;true;returnCollectionElement;(List);;Argument[0].Element;ReturnValue;taint;df-generated |
-| p;ParamFlow;true;returnIterableElement;(Iterable);;Argument[0].Element;ReturnValue;taint;df-generated |
-| p;ParamFlow;true;returnIteratorElement;(Iterator);;Argument[0].Element;ReturnValue;taint;df-generated |
-| p;ParamFlow;true;returnMultipleParameters;(String,String);;Argument[0];ReturnValue;taint;df-generated |
-| p;ParamFlow;true;returnMultipleParameters;(String,String);;Argument[1];ReturnValue;taint;df-generated |
-| p;ParamFlow;true;returnVarArgElement;(String[]);;Argument[0].ArrayElement;ReturnValue;taint;df-generated |
-| p;ParamFlow;true;returnsInput;(String);;Argument[0];ReturnValue;taint;df-generated |
-| p;ParamFlow;true;writeChunked;(byte[],OutputStream);;Argument[0];Argument[1];taint;df-generated |
-| p;ParamFlow;true;writeChunked;(char[],OutputStream);;Argument[0];Argument[1];taint;df-generated |
-| p;Pojo;false;fillIn;(List);;Argument[this];Argument[0].Element;taint;df-generated |
-| p;Pojo;false;getBoxedBytes;();;Argument[this];ReturnValue;taint;df-generated |
-| p;Pojo;false;getBoxedChars;();;Argument[this];ReturnValue;taint;df-generated |
-| p;Pojo;false;getByteArray;();;Argument[this];ReturnValue;taint;df-generated |
-| p;Pojo;false;getCharArray;();;Argument[this];ReturnValue;taint;df-generated |
-| p;Pojo;false;getValue;();;Argument[this];ReturnValue;taint;df-generated |
-| p;Pojo;false;setValue;(String);;Argument[0];Argument[this];taint;df-generated |
-| p;PrivateFlowViaPublicInterface$SPI;true;openStream;();;Argument[this];ReturnValue;taint;df-generated |
-| p;PrivateFlowViaPublicInterface;true;createAnSPI;(File);;Argument[0];ReturnValue;taint;df-generated |
diff --git a/java/ql/test/utils/modelgenerator/dataflow/CaptureSummaryModels.qlref b/java/ql/test/utils/modelgenerator/dataflow/CaptureSummaryModels.qlref
deleted file mode 100644
index d751f3823f3..00000000000
--- a/java/ql/test/utils/modelgenerator/dataflow/CaptureSummaryModels.qlref
+++ /dev/null
@@ -1 +0,0 @@
-utils/modelgenerator/CaptureSummaryModels.ql
\ No newline at end of file
From 5b184c179adfcc4a5f3accf86cb617ebdf9a7275 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Mon, 6 May 2024 12:47:51 +0200
Subject: [PATCH 071/118] Bazel/Go: add some comments
---
go/extractor/BUILD.bazel | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/go/extractor/BUILD.bazel b/go/extractor/BUILD.bazel
index 6047eea6860..7e576927f66 100644
--- a/go/extractor/BUILD.bazel
+++ b/go/extractor/BUILD.bazel
@@ -25,7 +25,9 @@ go_library(
],
)
-# the other targets are not generated
+# the other targets are not generated by gazelle
+
+# this is separate from `tokenizer-jar` below because we don't want these compiled class files in the pack
java_library(
name = "tokenizer-deps",
srcs = [
@@ -36,6 +38,7 @@ java_library(
],
)
+# we only need these compiled class files in the pack
java_library(
name = "tokenizer-jar",
srcs = [
@@ -51,7 +54,7 @@ pkg_files(
srcs = [":tokenizer-jar"],
prefix = "tools",
renames = {
- ":tokenizer-jar": "tokenizer.jar",
+ ":tokenizer-jar": "tokenizer.jar", # name is `libtokenizer.jar` by default
},
visibility = ["//go:__pkg__"],
)
From 51e7f3be1a0b3cd3af06ef939253f3e28676f7d0 Mon Sep 17 00:00:00 2001
From: Michael Nebel
Date: Mon, 6 May 2024 13:03:38 +0200
Subject: [PATCH 072/118] Java: Rename MaD to summary.
---
java/ql/test/TestUtilities/InlineMadTest.qll | 9 +-
.../modelgenerator/dataflow/p/Factory.java | 6 +-
.../modelgenerator/dataflow/p/FinalClass.java | 2 +-
.../modelgenerator/dataflow/p/FluentAPI.java | 2 +-
.../dataflow/p/ImmutablePojo.java | 8 +-
.../dataflow/p/InnerClasses.java | 4 +-
.../dataflow/p/InnerHolder.java | 8 +-
.../modelgenerator/dataflow/p/Joiner.java | 16 +-
.../dataflow/p/MultipleImpl2.java | 2 +-
.../dataflow/p/MultipleImpls.java | 6 +-
.../modelgenerator/dataflow/p/ParamFlow.java | 22 +-
.../utils/modelgenerator/dataflow/p/Pojo.java | 14 +-
.../p/PrivateFlowViaPublicInterface.java | 4 +-
.../typebasedflow/p/MyFunction.java | 10 +-
.../typebasedflow/p/Stream.java | 404 +++++++++---------
.../typebasedflow/p/TypeBasedCollection.java | 30 +-
.../typebasedflow/p/TypeBasedComplex.java | 142 +++---
.../typebasedflow/p/TypeBasedSimple.java | 58 ++-
18 files changed, 369 insertions(+), 378 deletions(-)
diff --git a/java/ql/test/TestUtilities/InlineMadTest.qll b/java/ql/test/TestUtilities/InlineMadTest.qll
index 64badab0dca..3e9aee7eb9e 100644
--- a/java/ql/test/TestUtilities/InlineMadTest.qll
+++ b/java/ql/test/TestUtilities/InlineMadTest.qll
@@ -11,21 +11,22 @@ signature module InlineMadTestConfigSig {
}
module InlineMadTest {
- private string expects() {
- Input::getComment().regexpCapture(" *(SPURIOUS-)?MaD=(.*)", 2) = result
+ bindingset[kind]
+ private string expects(string kind) {
+ Input::getComment().regexpCapture(" *(SPURIOUS-)?" + kind + "=(.*)", 2) = result
}
query predicate unexpectedSummary(string msg) {
exists(string flow |
flow = Input::getCapturedSummary() and
- not flow = expects() and
+ not flow = expects("summary") and
msg = "Unexpected summary found: " + flow
)
}
query predicate expectedSummary(string msg) {
exists(string e |
- e = expects() and
+ e = expects("summary") and
not e = Input::getCapturedSummary() and
msg = "Expected summary missing: " + e
)
diff --git a/java/ql/test/utils/modelgenerator/dataflow/p/Factory.java b/java/ql/test/utils/modelgenerator/dataflow/p/Factory.java
index 84b55a812c9..57d26429a93 100644
--- a/java/ql/test/utils/modelgenerator/dataflow/p/Factory.java
+++ b/java/ql/test/utils/modelgenerator/dataflow/p/Factory.java
@@ -6,12 +6,12 @@ public final class Factory {
private int intValue;
- // MaD=p;Factory;false;create;(String,int);;Argument[0];ReturnValue;taint;df-generated
+ // summary=p;Factory;false;create;(String,int);;Argument[0];ReturnValue;taint;df-generated
public static Factory create(String value, int foo) {
return new Factory(value, foo);
}
- // MaD=p;Factory;false;create;(String);;Argument[0];ReturnValue;taint;df-generated
+ // summary=p;Factory;false;create;(String);;Argument[0];ReturnValue;taint;df-generated
public static Factory create(String value) {
return new Factory(value, 0);
}
@@ -21,7 +21,7 @@ public final class Factory {
this.intValue = intValue;
}
- // MaD=p;Factory;false;getValue;();;Argument[this];ReturnValue;taint;df-generated
+ // summary=p;Factory;false;getValue;();;Argument[this];ReturnValue;taint;df-generated
public String getValue() {
return value;
}
diff --git a/java/ql/test/utils/modelgenerator/dataflow/p/FinalClass.java b/java/ql/test/utils/modelgenerator/dataflow/p/FinalClass.java
index 5073f435233..82a39533ce1 100644
--- a/java/ql/test/utils/modelgenerator/dataflow/p/FinalClass.java
+++ b/java/ql/test/utils/modelgenerator/dataflow/p/FinalClass.java
@@ -4,7 +4,7 @@ public final class FinalClass {
private static final String C = "constant";
- // MaD=p;FinalClass;false;returnsInput;(String);;Argument[0];ReturnValue;taint;df-generated
+ // summary=p;FinalClass;false;returnsInput;(String);;Argument[0];ReturnValue;taint;df-generated
public String returnsInput(String input) {
return input;
}
diff --git a/java/ql/test/utils/modelgenerator/dataflow/p/FluentAPI.java b/java/ql/test/utils/modelgenerator/dataflow/p/FluentAPI.java
index 2bb2bb97604..38fbb286bb0 100644
--- a/java/ql/test/utils/modelgenerator/dataflow/p/FluentAPI.java
+++ b/java/ql/test/utils/modelgenerator/dataflow/p/FluentAPI.java
@@ -2,7 +2,7 @@ package p;
public final class FluentAPI {
- // MaD=p;FluentAPI;false;returnsThis;(String);;Argument[this];ReturnValue;value;df-generated
+ // summary=p;FluentAPI;false;returnsThis;(String);;Argument[this];ReturnValue;value;df-generated
public FluentAPI returnsThis(String input) {
return this;
}
diff --git a/java/ql/test/utils/modelgenerator/dataflow/p/ImmutablePojo.java b/java/ql/test/utils/modelgenerator/dataflow/p/ImmutablePojo.java
index 38a9b472f62..1b39856b445 100644
--- a/java/ql/test/utils/modelgenerator/dataflow/p/ImmutablePojo.java
+++ b/java/ql/test/utils/modelgenerator/dataflow/p/ImmutablePojo.java
@@ -6,13 +6,13 @@ public final class ImmutablePojo {
private final long x;
- // MaD=p;ImmutablePojo;false;ImmutablePojo;(String,int);;Argument[0];Argument[this];taint;df-generated
+ // summary=p;ImmutablePojo;false;ImmutablePojo;(String,int);;Argument[0];Argument[this];taint;df-generated
public ImmutablePojo(String value, int x) {
this.value = value;
this.x = x;
}
- // MaD=p;ImmutablePojo;false;getValue;();;Argument[this];ReturnValue;taint;df-generated
+ // summary=p;ImmutablePojo;false;getValue;();;Argument[this];ReturnValue;taint;df-generated
public String getValue() {
return value;
}
@@ -21,8 +21,8 @@ public final class ImmutablePojo {
return x;
}
- // MaD=p;ImmutablePojo;false;or;(String);;Argument[0];ReturnValue;taint;df-generated
- // MaD=p;ImmutablePojo;false;or;(String);;Argument[this];ReturnValue;taint;df-generated
+ // summary=p;ImmutablePojo;false;or;(String);;Argument[0];ReturnValue;taint;df-generated
+ // summary=p;ImmutablePojo;false;or;(String);;Argument[this];ReturnValue;taint;df-generated
public String or(String defaultValue) {
return value != null ? value : defaultValue;
}
diff --git a/java/ql/test/utils/modelgenerator/dataflow/p/InnerClasses.java b/java/ql/test/utils/modelgenerator/dataflow/p/InnerClasses.java
index 54f014fec93..5b6a8427a3f 100644
--- a/java/ql/test/utils/modelgenerator/dataflow/p/InnerClasses.java
+++ b/java/ql/test/utils/modelgenerator/dataflow/p/InnerClasses.java
@@ -9,13 +9,13 @@ public class InnerClasses {
}
public class CaptureMe {
- // MaD=p;InnerClasses$CaptureMe;true;yesCm;(String);;Argument[0];ReturnValue;taint;df-generated
+ // summary=p;InnerClasses$CaptureMe;true;yesCm;(String);;Argument[0];ReturnValue;taint;df-generated
public String yesCm(String input) {
return input;
}
}
- // MaD=p;InnerClasses;true;yes;(String);;Argument[0];ReturnValue;taint;df-generated
+ // summary=p;InnerClasses;true;yes;(String);;Argument[0];ReturnValue;taint;df-generated
public String yes(String input) {
return input;
}
diff --git a/java/ql/test/utils/modelgenerator/dataflow/p/InnerHolder.java b/java/ql/test/utils/modelgenerator/dataflow/p/InnerHolder.java
index ef872942191..e09680dad52 100644
--- a/java/ql/test/utils/modelgenerator/dataflow/p/InnerHolder.java
+++ b/java/ql/test/utils/modelgenerator/dataflow/p/InnerHolder.java
@@ -18,22 +18,22 @@ public final class InnerHolder {
private StringBuilder sb = new StringBuilder();
- // MaD=p;InnerHolder;false;setContext;(String);;Argument[0];Argument[this];taint;df-generated
+ // summary=p;InnerHolder;false;setContext;(String);;Argument[0];Argument[this];taint;df-generated
public void setContext(String value) {
context = new Context(value);
}
- // MaD=p;InnerHolder;false;explicitSetContext;(String);;Argument[0];Argument[this];taint;df-generated
+ // summary=p;InnerHolder;false;explicitSetContext;(String);;Argument[0];Argument[this];taint;df-generated
public void explicitSetContext(String value) {
this.context = new Context(value);
}
- // MaD=p;InnerHolder;false;append;(String);;Argument[0];Argument[this];taint;df-generated
+ // summary=p;InnerHolder;false;append;(String);;Argument[0];Argument[this];taint;df-generated
public void append(String value) {
sb.append(value);
}
- // MaD=p;InnerHolder;false;getValue;();;Argument[this];ReturnValue;taint;df-generated
+ // summary=p;InnerHolder;false;getValue;();;Argument[this];ReturnValue;taint;df-generated
public String getValue() {
return context.getValue();
}
diff --git a/java/ql/test/utils/modelgenerator/dataflow/p/Joiner.java b/java/ql/test/utils/modelgenerator/dataflow/p/Joiner.java
index daa939ebe51..60edb0fb71e 100644
--- a/java/ql/test/utils/modelgenerator/dataflow/p/Joiner.java
+++ b/java/ql/test/utils/modelgenerator/dataflow/p/Joiner.java
@@ -12,14 +12,14 @@ public final class Joiner {
private int len;
private String emptyValue;
- // MaD=p;Joiner;false;Joiner;(CharSequence);;Argument[0];Argument[this];taint;df-generated
+ // summary=p;Joiner;false;Joiner;(CharSequence);;Argument[0];Argument[this];taint;df-generated
public Joiner(CharSequence delimiter) {
this(delimiter, "", "");
}
- // MaD=p;Joiner;false;Joiner;(CharSequence,CharSequence,CharSequence);;Argument[0];Argument[this];taint;df-generated
- // MaD=p;Joiner;false;Joiner;(CharSequence,CharSequence,CharSequence);;Argument[1];Argument[this];taint;df-generated
- // MaD=p;Joiner;false;Joiner;(CharSequence,CharSequence,CharSequence);;Argument[2];Argument[this];taint;df-generated
+ // summary=p;Joiner;false;Joiner;(CharSequence,CharSequence,CharSequence);;Argument[0];Argument[this];taint;df-generated
+ // summary=p;Joiner;false;Joiner;(CharSequence,CharSequence,CharSequence);;Argument[1];Argument[this];taint;df-generated
+ // summary=p;Joiner;false;Joiner;(CharSequence,CharSequence,CharSequence);;Argument[2];Argument[this];taint;df-generated
public Joiner(CharSequence delimiter, CharSequence prefix, CharSequence suffix) {
Objects.requireNonNull(prefix, "The prefix must not be null");
Objects.requireNonNull(delimiter, "The delimiter must not be null");
@@ -30,8 +30,8 @@ public final class Joiner {
checkAddLength(0, 0);
}
- // MaD=p;Joiner;false;setEmptyValue;(CharSequence);;Argument[0];Argument[this];taint;df-generated
- // MaD=p;Joiner;false;setEmptyValue;(CharSequence);;Argument[this];ReturnValue;value;df-generated
+ // summary=p;Joiner;false;setEmptyValue;(CharSequence);;Argument[0];Argument[this];taint;df-generated
+ // summary=p;Joiner;false;setEmptyValue;(CharSequence);;Argument[this];ReturnValue;value;df-generated
public Joiner setEmptyValue(CharSequence emptyValue) {
this.emptyValue =
Objects.requireNonNull(emptyValue, "The empty value must not be null").toString();
@@ -70,7 +70,7 @@ public final class Joiner {
return new String(chars);
}
- // MaD=p;Joiner;false;add;(CharSequence);;Argument[this];ReturnValue;value;df-generated
+ // summary=p;Joiner;false;add;(CharSequence);;Argument[this];ReturnValue;value;df-generated
public Joiner add(CharSequence newElement) {
final String elt = String.valueOf(newElement);
if (elts == null) {
@@ -93,7 +93,7 @@ public final class Joiner {
return (int) newLen;
}
- // MaD=p;Joiner;false;merge;(Joiner);;Argument[this];ReturnValue;value;df-generated
+ // summary=p;Joiner;false;merge;(Joiner);;Argument[this];ReturnValue;value;df-generated
public Joiner merge(Joiner other) {
Objects.requireNonNull(other);
if (other.elts == null) {
diff --git a/java/ql/test/utils/modelgenerator/dataflow/p/MultipleImpl2.java b/java/ql/test/utils/modelgenerator/dataflow/p/MultipleImpl2.java
index 7c2e2ed9211..dc67d0dfe6c 100644
--- a/java/ql/test/utils/modelgenerator/dataflow/p/MultipleImpl2.java
+++ b/java/ql/test/utils/modelgenerator/dataflow/p/MultipleImpl2.java
@@ -6,7 +6,7 @@ class MultipleImpl2 {
// This is used to test that we only generate a summary model and
// not neutral summary model for `IInterface.m`.
public interface IInterface {
- // MaD=p;MultipleImpl2$IInterface;true;m;(Object);;Argument[0];ReturnValue;taint;df-generated
+ // summary=p;MultipleImpl2$IInterface;true;m;(Object);;Argument[0];ReturnValue;taint;df-generated
Object m(Object value);
}
diff --git a/java/ql/test/utils/modelgenerator/dataflow/p/MultipleImpls.java b/java/ql/test/utils/modelgenerator/dataflow/p/MultipleImpls.java
index 8cdde304bd5..8fccdf76ab7 100644
--- a/java/ql/test/utils/modelgenerator/dataflow/p/MultipleImpls.java
+++ b/java/ql/test/utils/modelgenerator/dataflow/p/MultipleImpls.java
@@ -5,8 +5,8 @@ import java.util.concurrent.Callable;
public class MultipleImpls {
public static interface Strategy {
- // MaD=p;MultipleImpls$Strategy;true;doSomething;(String);;Argument[0];Argument[this];taint;df-generated
- // MaD=p;MultipleImpls$Strategy;true;doSomething;(String);;Argument[0];ReturnValue;taint;df-generated
+ // summary=p;MultipleImpls$Strategy;true;doSomething;(String);;Argument[0];Argument[this];taint;df-generated
+ // summary=p;MultipleImpls$Strategy;true;doSomething;(String);;Argument[0];ReturnValue;taint;df-generated
String doSomething(String value);
}
@@ -33,7 +33,7 @@ public class MultipleImpls {
return "none";
}
- // MaD=p;MultipleImpls$Strat2;true;getValue;();;Argument[this];ReturnValue;taint;df-generated
+ // summary=p;MultipleImpls$Strat2;true;getValue;();;Argument[this];ReturnValue;taint;df-generated
public String getValue() {
return this.foo;
}
diff --git a/java/ql/test/utils/modelgenerator/dataflow/p/ParamFlow.java b/java/ql/test/utils/modelgenerator/dataflow/p/ParamFlow.java
index 7d9dac157c2..5c47e292a6b 100644
--- a/java/ql/test/utils/modelgenerator/dataflow/p/ParamFlow.java
+++ b/java/ql/test/utils/modelgenerator/dataflow/p/ParamFlow.java
@@ -7,7 +7,7 @@ import java.util.List;
public class ParamFlow {
- // MaD=p;ParamFlow;true;returnsInput;(String);;Argument[0];ReturnValue;taint;df-generated
+ // summary=p;ParamFlow;true;returnsInput;(String);;Argument[0];ReturnValue;taint;df-generated
public String returnsInput(String input) {
return input;
}
@@ -16,8 +16,8 @@ public class ParamFlow {
return input.length();
}
- // MaD=p;ParamFlow;true;returnMultipleParameters;(String,String);;Argument[0];ReturnValue;taint;df-generated
- // MaD=p;ParamFlow;true;returnMultipleParameters;(String,String);;Argument[1];ReturnValue;taint;df-generated
+ // summary=p;ParamFlow;true;returnMultipleParameters;(String,String);;Argument[0];ReturnValue;taint;df-generated
+ // summary=p;ParamFlow;true;returnMultipleParameters;(String,String);;Argument[1];ReturnValue;taint;df-generated
public String returnMultipleParameters(String one, String two) {
if (System.currentTimeMillis() > 100) {
return two;
@@ -25,27 +25,27 @@ public class ParamFlow {
return one;
}
- // MaD=p;ParamFlow;true;returnArrayElement;(String[]);;Argument[0].ArrayElement;ReturnValue;taint;df-generated
+ // summary=p;ParamFlow;true;returnArrayElement;(String[]);;Argument[0].ArrayElement;ReturnValue;taint;df-generated
public String returnArrayElement(String[] input) {
return input[0];
}
- // MaD=p;ParamFlow;true;returnVarArgElement;(String[]);;Argument[0].ArrayElement;ReturnValue;taint;df-generated
+ // summary=p;ParamFlow;true;returnVarArgElement;(String[]);;Argument[0].ArrayElement;ReturnValue;taint;df-generated
public String returnVarArgElement(String... input) {
return input[0];
}
- // MaD=p;ParamFlow;true;returnCollectionElement;(List);;Argument[0].Element;ReturnValue;taint;df-generated
+ // summary=p;ParamFlow;true;returnCollectionElement;(List);;Argument[0].Element;ReturnValue;taint;df-generated
public String returnCollectionElement(List input) {
return input.get(0);
}
- // MaD=p;ParamFlow;true;returnIteratorElement;(Iterator);;Argument[0].Element;ReturnValue;taint;df-generated
+ // summary=p;ParamFlow;true;returnIteratorElement;(Iterator);;Argument[0].Element;ReturnValue;taint;df-generated
public String returnIteratorElement(Iterator input) {
return input.next();
}
- // MaD=p;ParamFlow;true;returnIterableElement;(Iterable);;Argument[0].Element;ReturnValue;taint;df-generated
+ // summary=p;ParamFlow;true;returnIterableElement;(Iterable);;Argument[0].Element;ReturnValue;taint;df-generated
public String returnIterableElement(Iterable input) {
return input.iterator().next();
}
@@ -54,17 +54,17 @@ public class ParamFlow {
return input;
}
- // MaD=p;ParamFlow;true;writeChunked;(byte[],OutputStream);;Argument[0];Argument[1];taint;df-generated
+ // summary=p;ParamFlow;true;writeChunked;(byte[],OutputStream);;Argument[0];Argument[1];taint;df-generated
public void writeChunked(byte[] data, OutputStream output) throws IOException {
output.write(data, 0, data.length);
}
- // MaD=p;ParamFlow;true;writeChunked;(char[],OutputStream);;Argument[0];Argument[1];taint;df-generated
+ // summary=p;ParamFlow;true;writeChunked;(char[],OutputStream);;Argument[0];Argument[1];taint;df-generated
public void writeChunked(char[] data, OutputStream output) throws IOException {
output.write(String.valueOf(data).getBytes(), 0, data.length);
}
- // MaD=p;ParamFlow;true;addTo;(String,List);;Argument[0];Argument[1].Element;taint;df-generated
+ // summary=p;ParamFlow;true;addTo;(String,List);;Argument[0];Argument[1].Element;taint;df-generated
public void addTo(String data, List target) {
target.add(data);
}
diff --git a/java/ql/test/utils/modelgenerator/dataflow/p/Pojo.java b/java/ql/test/utils/modelgenerator/dataflow/p/Pojo.java
index 15fbda5bc79..524e448ef81 100644
--- a/java/ql/test/utils/modelgenerator/dataflow/p/Pojo.java
+++ b/java/ql/test/utils/modelgenerator/dataflow/p/Pojo.java
@@ -30,12 +30,12 @@ public final class Pojo {
private List charList = Arrays.asList('a', 'b', 'c');
private Byte[] byteObjectArray = new Byte[] {1, 2, 3};
- // MaD=p;Pojo;false;getValue;();;Argument[this];ReturnValue;taint;df-generated
+ // summary=p;Pojo;false;getValue;();;Argument[this];ReturnValue;taint;df-generated
public String getValue() {
return value;
}
- // MaD=p;Pojo;false;setValue;(String);;Argument[0];Argument[this];taint;df-generated
+ // summary=p;Pojo;false;setValue;(String);;Argument[0];Argument[this];taint;df-generated
public void setValue(String value) {
this.value = value;
}
@@ -57,12 +57,12 @@ public final class Pojo {
return new int[] {intValue};
}
- // MaD=p;Pojo;false;getCharArray;();;Argument[this];ReturnValue;taint;df-generated
+ // summary=p;Pojo;false;getCharArray;();;Argument[this];ReturnValue;taint;df-generated
public char[] getCharArray() {
return charArray;
}
- // MaD=p;Pojo;false;getByteArray;();;Argument[this];ReturnValue;taint;df-generated
+ // summary=p;Pojo;false;getByteArray;();;Argument[this];ReturnValue;taint;df-generated
public byte[] getByteArray() {
return byteArray;
}
@@ -79,12 +79,12 @@ public final class Pojo {
return List.of(Integer.valueOf(intValue));
}
- // MaD=p;Pojo;false;getBoxedChars;();;Argument[this];ReturnValue;taint;df-generated
+ // summary=p;Pojo;false;getBoxedChars;();;Argument[this];ReturnValue;taint;df-generated
public List getBoxedChars() {
return charList;
}
- // MaD=p;Pojo;false;getBoxedBytes;();;Argument[this];ReturnValue;taint;df-generated
+ // summary=p;Pojo;false;getBoxedBytes;();;Argument[this];ReturnValue;taint;df-generated
public Byte[] getBoxedBytes() {
return byteObjectArray;
}
@@ -97,7 +97,7 @@ public final class Pojo {
return new BigDecimal(value);
}
- // MaD=p;Pojo;false;fillIn;(List);;Argument[this];Argument[0].Element;taint;df-generated
+ // summary=p;Pojo;false;fillIn;(List);;Argument[this];Argument[0].Element;taint;df-generated
public void fillIn(List target) {
target.add(value);
}
diff --git a/java/ql/test/utils/modelgenerator/dataflow/p/PrivateFlowViaPublicInterface.java b/java/ql/test/utils/modelgenerator/dataflow/p/PrivateFlowViaPublicInterface.java
index 13a2897f08a..6b5dbca3e11 100644
--- a/java/ql/test/utils/modelgenerator/dataflow/p/PrivateFlowViaPublicInterface.java
+++ b/java/ql/test/utils/modelgenerator/dataflow/p/PrivateFlowViaPublicInterface.java
@@ -12,7 +12,7 @@ public class PrivateFlowViaPublicInterface {
}
public static interface SPI {
- // MaD=p;PrivateFlowViaPublicInterface$SPI;true;openStream;();;Argument[this];ReturnValue;taint;df-generated
+ // summary=p;PrivateFlowViaPublicInterface$SPI;true;openStream;();;Argument[this];ReturnValue;taint;df-generated
OutputStream openStream() throws IOException;
default OutputStream openStreamNone() throws IOException {
@@ -50,7 +50,7 @@ public class PrivateFlowViaPublicInterface {
}
}
- // MaD=p;PrivateFlowViaPublicInterface;true;createAnSPI;(File);;Argument[0];ReturnValue;taint;df-generated
+ // summary=p;PrivateFlowViaPublicInterface;true;createAnSPI;(File);;Argument[0];ReturnValue;taint;df-generated
public static SPI createAnSPI(File file) {
return new PrivateImplWithSink(file);
}
diff --git a/java/ql/test/utils/modelgenerator/typebasedflow/p/MyFunction.java b/java/ql/test/utils/modelgenerator/typebasedflow/p/MyFunction.java
index 04683952f83..e3589bf5f6c 100644
--- a/java/ql/test/utils/modelgenerator/typebasedflow/p/MyFunction.java
+++ b/java/ql/test/utils/modelgenerator/typebasedflow/p/MyFunction.java
@@ -3,8 +3,8 @@ package p;
@FunctionalInterface
public interface MyFunction {
- // MaD=p;MyFunction;true;apply;(Object,Object);;Argument[this].SyntheticField[ArgType2];ReturnValue;value;tb-generated
- // MaD=p;MyFunction;true;apply;(Object,Object);;Argument[0];Argument[this].SyntheticField[ArgType0];value;tb-generated
- // MaD=p;MyFunction;true;apply;(Object,Object);;Argument[1];Argument[this].SyntheticField[ArgType1];value;tb-generated
- T3 apply(T1 x, T2 y);
-}
\ No newline at end of file
+ // summary=p;MyFunction;true;apply;(Object,Object);;Argument[this].SyntheticField[ArgType2];ReturnValue;value;tb-generated
+ // summary=p;MyFunction;true;apply;(Object,Object);;Argument[0];Argument[this].SyntheticField[ArgType0];value;tb-generated
+ // summary=p;MyFunction;true;apply;(Object,Object);;Argument[1];Argument[this].SyntheticField[ArgType1];value;tb-generated
+ T3 apply(T1 x, T2 y);
+}
diff --git a/java/ql/test/utils/modelgenerator/typebasedflow/p/Stream.java b/java/ql/test/utils/modelgenerator/typebasedflow/p/Stream.java
index 86d25088645..8e99fc7ca7c 100644
--- a/java/ql/test/utils/modelgenerator/typebasedflow/p/Stream.java
+++ b/java/ql/test/utils/modelgenerator/typebasedflow/p/Stream.java
@@ -2,246 +2,244 @@ package p;
import java.util.*;
import java.util.function.*;
-import java.util.stream.LongStream;
-import java.util.stream.IntStream;
-import java.util.stream.DoubleStream;
import java.util.stream.Collector;
+import java.util.stream.DoubleStream;
+import java.util.stream.IntStream;
+import java.util.stream.LongStream;
-/**
- * This is a stub implementation of the Java Stream API.
- */
+/** This is a stub implementation of the Java Stream API. */
public class Stream {
- // MaD=p;Stream;true;iterator;();;Argument[this].Element;ReturnValue.Element;value;tb-generated
- public Iterator iterator() {
- return null;
- }
+ // summary=p;Stream;true;iterator;();;Argument[this].Element;ReturnValue.Element;value;tb-generated
+ public Iterator iterator() {
+ return null;
+ }
- // MaD=p;Stream;true;allMatch;(Predicate);;Argument[this].Element;Argument[0].Parameter[0];value;tb-generated
- public boolean allMatch(Predicate super T> predicate) {
- return false;
- }
+ // summary=p;Stream;true;allMatch;(Predicate);;Argument[this].Element;Argument[0].Parameter[0];value;tb-generated
+ public boolean allMatch(Predicate super T> predicate) {
+ return false;
+ }
- // MaD=p;Stream;true;collect;(Supplier,BiConsumer,BiConsumer);;Argument[this].Element;Argument[1].Parameter[1];value;tb-generated
- // MaD=p;Stream;true;collect;(Supplier,BiConsumer,BiConsumer);;Argument[0].ReturnValue;Argument[1].Parameter[0];value;tb-generated
- // MaD=p;Stream;true;collect;(Supplier,BiConsumer,BiConsumer);;Argument[0].ReturnValue;Argument[2].Parameter[0];value;tb-generated
- // MaD=p;Stream;true;collect;(Supplier,BiConsumer,BiConsumer);;Argument[0].ReturnValue;Argument[2].Parameter[1];value;tb-generated
- // MaD=p;Stream;true;collect;(Supplier,BiConsumer,BiConsumer);;Argument[0].ReturnValue;ReturnValue;value;tb-generated
- public R collect(Supplier supplier, BiConsumer accumulator, BiConsumer combiner) {
- return null;
- }
+ // summary=p;Stream;true;collect;(Supplier,BiConsumer,BiConsumer);;Argument[this].Element;Argument[1].Parameter[1];value;tb-generated
+ // summary=p;Stream;true;collect;(Supplier,BiConsumer,BiConsumer);;Argument[0].ReturnValue;Argument[1].Parameter[0];value;tb-generated
+ // summary=p;Stream;true;collect;(Supplier,BiConsumer,BiConsumer);;Argument[0].ReturnValue;Argument[2].Parameter[0];value;tb-generated
+ // summary=p;Stream;true;collect;(Supplier,BiConsumer,BiConsumer);;Argument[0].ReturnValue;Argument[2].Parameter[1];value;tb-generated
+ // summary=p;Stream;true;collect;(Supplier,BiConsumer,BiConsumer);;Argument[0].ReturnValue;ReturnValue;value;tb-generated
+ public R collect(
+ Supplier supplier, BiConsumer accumulator, BiConsumer combiner) {
+ return null;
+ }
- // Collector is not a functional interface, so this is not supported
- public R collect(Collector super T, A, R> collector) {
- return null;
- }
+ // Collector is not a functional interface, so this is not supported
+ public R collect(Collector super T, A, R> collector) {
+ return null;
+ }
- // MaD=p;Stream;true;concat;(Stream,Stream);;Argument[0].Element;ReturnValue.Element;value;tb-generated
- // MaD=p;Stream;true;concat;(Stream,Stream);;Argument[1].Element;ReturnValue.Element;value;tb-generated
- public static Stream concat(Stream extends T> a, Stream extends T> b) {
- return null;
- }
+ // summary=p;Stream;true;concat;(Stream,Stream);;Argument[0].Element;ReturnValue.Element;value;tb-generated
+ // summary=p;Stream;true;concat;(Stream,Stream);;Argument[1].Element;ReturnValue.Element;value;tb-generated
+ public static Stream concat(Stream extends T> a, Stream extends T> b) {
+ return null;
+ }
- // MaD=p;Stream;true;distinct;();;Argument[this].Element;ReturnValue.Element;value;tb-generated
- public Stream distinct() {
- return null;
- }
+ // summary=p;Stream;true;distinct;();;Argument[this].Element;ReturnValue.Element;value;tb-generated
+ public Stream distinct() {
+ return null;
+ }
- public static Stream empty() {
- return null;
- }
+ public static Stream empty() {
+ return null;
+ }
- // MaD=p;Stream;true;filter;(Predicate);;Argument[this].Element;Argument[0].Parameter[0];value;tb-generated
- // MaD=p;Stream;true;filter;(Predicate);;Argument[this].Element;ReturnValue.Element;value;tb-generated
- public Stream filter(Predicate super T> predicate) {
- return null;
- }
+ // summary=p;Stream;true;filter;(Predicate);;Argument[this].Element;Argument[0].Parameter[0];value;tb-generated
+ // summary=p;Stream;true;filter;(Predicate);;Argument[this].Element;ReturnValue.Element;value;tb-generated
+ public Stream filter(Predicate super T> predicate) {
+ return null;
+ }
- // MaD=p;Stream;true;findAny;();;Argument[this].Element;ReturnValue.SyntheticField[ArgType0];value;tb-generated
- public Optional findAny() {
- return null;
- }
+ // summary=p;Stream;true;findAny;();;Argument[this].Element;ReturnValue.SyntheticField[ArgType0];value;tb-generated
+ public Optional findAny() {
+ return null;
+ }
- // MaD=p;Stream;true;findFirst;();;Argument[this].Element;ReturnValue.SyntheticField[ArgType0];value;tb-generated
- public Optional findFirst() {
- return null;
- }
+ // summary=p;Stream;true;findFirst;();;Argument[this].Element;ReturnValue.SyntheticField[ArgType0];value;tb-generated
+ public Optional findFirst() {
+ return null;
+ }
- // MaD=p;Stream;true;flatMap;(Function);;Argument[0].ReturnValue.Element;ReturnValue.Element;value;tb-generated
- // MaD=p;Stream;true;flatMap;(Function);;Argument[this].Element;Argument[0].Parameter[0];value;tb-generated
- public Stream flatMap(Function super T, ? extends Stream extends R>> mapper) {
- return null;
- }
+ // summary=p;Stream;true;flatMap;(Function);;Argument[0].ReturnValue.Element;ReturnValue.Element;value;tb-generated
+ // summary=p;Stream;true;flatMap;(Function);;Argument[this].Element;Argument[0].Parameter[0];value;tb-generated
+ public Stream flatMap(Function super T, ? extends Stream extends R>> mapper) {
+ return null;
+ }
- // MaD=p;Stream;true;flatMapToDouble;(Function);;Argument[this].Element;Argument[0].Parameter[0];value;tb-generated
- public DoubleStream flatMapToDouble(Function super T, ? extends DoubleStream> mapper) {
- return null;
- }
+ // summary=p;Stream;true;flatMapToDouble;(Function);;Argument[this].Element;Argument[0].Parameter[0];value;tb-generated
+ public DoubleStream flatMapToDouble(Function super T, ? extends DoubleStream> mapper) {
+ return null;
+ }
- // MaD=p;Stream;true;flatMapToInt;(Function);;Argument[this].Element;Argument[0].Parameter[0];value;tb-generated
- public IntStream flatMapToInt(Function super T, ? extends IntStream> mapper) {
- return null;
- }
+ // summary=p;Stream;true;flatMapToInt;(Function);;Argument[this].Element;Argument[0].Parameter[0];value;tb-generated
+ public IntStream flatMapToInt(Function super T, ? extends IntStream> mapper) {
+ return null;
+ }
- // MaD=p;Stream;true;flatMapToLong;(Function);;Argument[this].Element;Argument[0].Parameter[0];value;tb-generated
- public LongStream flatMapToLong(Function super T, ? extends LongStream> mapper) {
- return null;
- }
+ // summary=p;Stream;true;flatMapToLong;(Function);;Argument[this].Element;Argument[0].Parameter[0];value;tb-generated
+ public LongStream flatMapToLong(Function super T, ? extends LongStream> mapper) {
+ return null;
+ }
- // MaD=p;Stream;true;forEach;(Consumer);;Argument[this].Element;Argument[0].Parameter[0];value;tb-generated
- public void forEach(Consumer super T> action) {
- }
+ // summary=p;Stream;true;forEach;(Consumer);;Argument[this].Element;Argument[0].Parameter[0];value;tb-generated
+ public void forEach(Consumer super T> action) {}
- // MaD=p;Stream;true;forEachOrdered;(Consumer);;Argument[this].Element;Argument[0].Parameter[0];value;tb-generated
- public void forEachOrdered(Consumer super T> action) {
- }
+ // summary=p;Stream;true;forEachOrdered;(Consumer);;Argument[this].Element;Argument[0].Parameter[0];value;tb-generated
+ public void forEachOrdered(Consumer super T> action) {}
- // MaD=p;Stream;true;generate;(Supplier);;Argument[0].ReturnValue;ReturnValue.Element;value;tb-generated
- public static Stream generate(Supplier s) {
- return null;
- }
+ // summary=p;Stream;true;generate;(Supplier);;Argument[0].ReturnValue;ReturnValue.Element;value;tb-generated
+ public static Stream generate(Supplier s) {
+ return null;
+ }
- // MaD=p;Stream;true;iterate;(Object,UnaryOperator);;Argument[0];Argument[1].Parameter[0];value;tb-generated
- // MaD=p;Stream;true;iterate;(Object,UnaryOperator);;Argument[0];ReturnValue.Element;value;tb-generated
- // MaD=p;Stream;true;iterate;(Object,UnaryOperator);;Argument[1].ReturnValue;Argument[1].Parameter[0];value;tb-generated
- // MaD=p;Stream;true;iterate;(Object,UnaryOperator);;Argument[1].ReturnValue;ReturnValue.Element;value;tb-generated
- public static Stream iterate(T seed, UnaryOperator f) {
- return null;
- }
+ // summary=p;Stream;true;iterate;(Object,UnaryOperator);;Argument[0];Argument[1].Parameter[0];value;tb-generated
+ // summary=p;Stream;true;iterate;(Object,UnaryOperator);;Argument[0];ReturnValue.Element;value;tb-generated
+ // summary=p;Stream;true;iterate;(Object,UnaryOperator);;Argument[1].ReturnValue;Argument[1].Parameter[0];value;tb-generated
+ // summary=p;Stream;true;iterate;(Object,UnaryOperator);;Argument[1].ReturnValue;ReturnValue.Element;value;tb-generated
+ public static Stream iterate(T seed, UnaryOperator f) {
+ return null;
+ }
- // MaD=p;Stream;true;limit;(long);;Argument[this].Element;ReturnValue.Element;value;tb-generated
- public Stream limit(long maxSize) {
- return null;
- }
+ // summary=p;Stream;true;limit;(long);;Argument[this].Element;ReturnValue.Element;value;tb-generated
+ public Stream limit(long maxSize) {
+ return null;
+ }
- // MaD=p;Stream;true;map;(Function);;Argument[this].Element;Argument[0].Parameter[0];value;tb-generated
- // MaD=p;Stream;true;map;(Function);;Argument[0].ReturnValue;ReturnValue.Element;value;tb-generated
- public