Merge remote-tracking branch 'upstream/main' into approximate-related-location

ruby/codeql-extractor.yml

@@ -3,7 +3,7 @@ display_name: "Ruby"
 version: 0.1.0
 column_kind: "utf8"
 legacy_qltest_extraction: true
-overlay_support_version: 20250108
+overlay_support_version: 20250626
 build_modes:
   - none
 github_api_languages:

ruby/downgrades/eae6926f5000373d5eb1d82131e1ff6152b67b2c/upgrade.properties

@@ -0,0 +1,3 @@
+description: Add overlayChangedFiles relation
+compatibility: full
+overlayChangedFiles.rel: delete

ruby/ql/lib/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 4.1.10
+
+No user-facing changes.
+
 ## 4.1.9
 
 No user-facing changes.

ruby/ql/lib/change-notes/released/4.1.10.md

@@ -0,0 +1,3 @@
+## 4.1.10
+
+No user-facing changes.

ruby/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 4.1.9
+lastReleaseVersion: 4.1.10

ruby/ql/lib/codeql/ruby/ast/internal/TreeSitter.qll

@@ -9,6 +9,20 @@ import codeql.Locations as L
 overlay[local]
 private predicate isOverlay() { databaseMetadata("isOverlay", "true") }
 
+/** Holds if `loc` is in the `file` and is part of the overlay base database. */
+overlay[local]
+private predicate discardableLocation(@file file, @location_default loc) {
+  not isOverlay() and locations_default(loc, file, _, _, _, _)
+}
+
+/** Holds if `loc` should be discarded, because it is part of the overlay base and is in a file that was also extracted as part of the overlay database. */
+overlay[discard_entity]
+private predicate discardLocation(@location_default loc) {
+  exists(@file file, string path | files(file, path) |
+    discardableLocation(file, loc) and overlayChangedFiles(path)
+  )
+}
+
 module Ruby {
   /** The base class for all AST nodes */
   class AstNode extends @ruby_ast_node {
@@ -60,10 +74,6 @@ module Ruby {
     )
   }
 
-  /** Holds if `file` was extracted as part of the overlay database. */
-  overlay[local]
-  private predicate discardFile(@file file) { isOverlay() and file = getNodeFile(_) }
-
   /** Holds if `node` is in the `file` and is part of the overlay base database. */
   overlay[local]
   private predicate discardableAstNode(@file file, @ruby_ast_node node) {
@@ -73,7 +83,9 @@ module Ruby {
   /** Holds if `node` should be discarded, because it is part of the overlay base and is in a file that was also extracted as part of the overlay database. */
   overlay[discard_entity]
   private predicate discardAstNode(@ruby_ast_node node) {
-    exists(@file file | discardableAstNode(file, node) and discardFile(file))
+    exists(@file file, string path | files(file, path) |
+      discardableAstNode(file, node) and overlayChangedFiles(path)
+    )
   }
 
   class UnderscoreArg extends @ruby_underscore_arg, AstNode { }
@@ -2006,10 +2018,6 @@ module Erb {
     )
   }
 
-  /** Holds if `file` was extracted as part of the overlay database. */
-  overlay[local]
-  private predicate discardFile(@file file) { isOverlay() and file = getNodeFile(_) }
-
   /** Holds if `node` is in the `file` and is part of the overlay base database. */
   overlay[local]
   private predicate discardableAstNode(@file file, @erb_ast_node node) {
@@ -2019,7 +2027,9 @@ module Erb {
   /** Holds if `node` should be discarded, because it is part of the overlay base and is in a file that was also extracted as part of the overlay database. */
   overlay[discard_entity]
   private predicate discardAstNode(@erb_ast_node node) {
-    exists(@file file | discardableAstNode(file, node) and discardFile(file))
+    exists(@file file, string path | files(file, path) |
+      discardableAstNode(file, node) and overlayChangedFiles(path)
+    )
   }
 
   /** A class representing `code` tokens. */

ruby/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/ruby-all
-version: 4.1.10-dev
+version: 4.1.11-dev
 groups: ruby
 extractor: ruby
 dbscheme: ruby.dbscheme

ruby/ql/lib/ruby.dbscheme

@@ -114,6 +114,10 @@ databaseMetadata(
   string value: string ref
 );
 
+overlayChangedFiles(
+  string path: string ref
+);
+
 /*- Ruby dbscheme -*/
 @ruby_underscore_arg = @ruby_assignment | @ruby_binary | @ruby_conditional | @ruby_operator_assignment | @ruby_range | @ruby_unary | @ruby_underscore_primary
 

ruby/ql/lib/ruby.dbscheme.stats

@@ -21557,6 +21557,17 @@
                 </dep>
             </dependencies>
         </relation>
+        <relation>
+            <name>overlayChangedFiles</name>
+            <cardinality>50</cardinality>
+            <columnsizes>
+                <e>
+                    <k>path</k>
+                    <v>50</v>
+                </e>
+            </columnsizes>
+            <dependencies/>
+        </relation>
         <relation>
             <name>yaml_aliases</name>
             <cardinality>0</cardinality>

ruby/ql/lib/upgrades/dc51d416301df12df5b70fbc4338de6cc1f82bfd/upgrade.properties

@@ -0,0 +1,2 @@
+description: Add overlayChangedFiles relation
+compatibility: full

ruby/ql/src/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 1.4.1
+
+No user-facing changes.
+
 ## 1.4.0
 
 ### Query Metadata Changes

ruby/ql/src/change-notes/released/1.4.1.md

@@ -0,0 +1,3 @@
+## 1.4.1
+
+No user-facing changes.

ruby/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.4.0
+lastReleaseVersion: 1.4.1

ruby/ql/src/experimental/ldap-improper-auth/ImproperLdapAuth.ql

@@ -16,5 +16,5 @@ import ImproperLdapAuthFlow::PathGraph
 
 from ImproperLdapAuthFlow::PathNode source, ImproperLdapAuthFlow::PathNode sink
 where ImproperLdapAuthFlow::flowPath(source, sink)
-select sink.getNode(), source, sink, "This LDAP authencation depends on a $@.", source.getNode(),
+select sink.getNode(), source, sink, "This LDAP authentication depends on a $@.", source.getNode(),
   "user-provided value"

ruby/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/ruby-queries
-version: 1.4.1-dev
+version: 1.4.2-dev
 groups:
   - ruby
   - queries

ruby/ql/test/query-tests/experimental/ImproperLdapAuth/ImproperLdapAuth.expected

@@ -16,5 +16,5 @@ nodes
 | ImproperLdapAuth.rb:31:24:31:27 | pass | semmle.label | pass |
 subpaths
 #select
-| ImproperLdapAuth.rb:15:23:15:26 | pass | ImproperLdapAuth.rb:5:12:5:17 | call to params | ImproperLdapAuth.rb:15:23:15:26 | pass | This LDAP authencation depends on a $@. | ImproperLdapAuth.rb:5:12:5:17 | call to params | user-provided value |
-| ImproperLdapAuth.rb:31:24:31:27 | pass | ImproperLdapAuth.rb:24:12:24:17 | call to params | ImproperLdapAuth.rb:31:24:31:27 | pass | This LDAP authencation depends on a $@. | ImproperLdapAuth.rb:24:12:24:17 | call to params | user-provided value |
+| ImproperLdapAuth.rb:15:23:15:26 | pass | ImproperLdapAuth.rb:5:12:5:17 | call to params | ImproperLdapAuth.rb:15:23:15:26 | pass | This LDAP authentication depends on a $@. | ImproperLdapAuth.rb:5:12:5:17 | call to params | user-provided value |
+| ImproperLdapAuth.rb:31:24:31:27 | pass | ImproperLdapAuth.rb:24:12:24:17 | call to params | ImproperLdapAuth.rb:31:24:31:27 | pass | This LDAP authentication depends on a $@. | ImproperLdapAuth.rb:24:12:24:17 | call to params | user-provided value |