hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #20996 from michaelnebel/csharp/updateroslyn

Browse Source 
C#: Update Roslyn, MsBuild and Binlog extractor dependencies.
This commit is contained in:
Michael Nebel
2025-12-11 13:50:22 +01:00
committed by GitHub
parent 004dfbdf24 24417cf93d
commit ce2c149cb3
14 changed files with 80 additions and 92 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
csharp/.vscode/launch.json vendored
View File

@@ -6,7 +6,7 @@
"type": "coreclr",
"request": "launch",
"preLaunchTask": "dotnet: build",
"program": "${workspaceFolder}/extractor/Semmle.Extraction.CSharp.Standalone/bin/Debug/net9.0/Semmle.Extraction.CSharp.Standalone.dll",
"program": "${workspaceFolder}/extractor/Semmle.Extraction.CSharp.Standalone/bin/Debug/net10.0/Semmle.Extraction.CSharp.Standalone.dll",
"args": [],
// Set the path to the folder that should be extracted:
"cwd": "${workspaceFolder}/ql/test/library-tests/standalone/standalonemode",
@@ -35,7 +35,7 @@
"type": "coreclr",
"request": "launch",
"preLaunchTask": "dotnet: build",
"program": "${workspaceFolder}/autobuilder/Semmle.Autobuild.CSharp/bin/Debug/net9.0/Semmle.Autobuild.CSharp.dll",
"program": "${workspaceFolder}/autobuilder/Semmle.Autobuild.CSharp/bin/Debug/net10.0/Semmle.Autobuild.CSharp.dll",
// Set the path to the folder that should be extracted:
"cwd": "${workspaceFolder}/ql/integration-tests/all-platforms/autobuild",
"stopAtEntry": true,
@@ -53,7 +53,7 @@
"type": "coreclr",
"request": "launch",
"preLaunchTask": "dotnet: build",
"program": "${workspaceFolder}/extractor/Semmle.Extraction.CSharp.Driver/bin/Debug/net9.0/Semmle.Extraction.CSharp.Driver.dll",
"program": "${workspaceFolder}/extractor/Semmle.Extraction.CSharp.Driver/bin/Debug/net10.0/Semmle.Extraction.CSharp.Driver.dll",
"stopAtEntry": true,
"args": [
"--binlog",
@@ -66,7 +66,7 @@
"type": "coreclr",
"request": "launch",
"preLaunchTask": "dotnet: build",
"program": "${workspaceFolder}/extractor/Semmle.Extraction.CSharp.Driver/bin/Debug/net9.0/Semmle.Extraction.CSharp.Driver.dll",
"program": "${workspaceFolder}/extractor/Semmle.Extraction.CSharp.Driver/bin/Debug/net10.0/Semmle.Extraction.CSharp.Driver.dll",
// Set the path to the folder that should be extracted:
"cwd": "${workspaceFolder}/ql/test/library-tests/dataflow/local",
"args": [

8
csharp/paket.dependencies
View File

@@ -4,7 +4,7 @@ source https://api.nuget.org/v3/index.json
# behave like nuget in choosing transitive dependency versions
strategy: max
nuget Basic.CompilerLog.Util 0.9.21
nuget Basic.CompilerLog.Util 0.9.25
nuget Mono.Posix.NETStandard
nuget Newtonsoft.Json
nuget NuGet.Versioning
@@ -12,6 +12,6 @@ nuget xunit
nuget xunit.runner.visualstudio
nuget xunit.runner.utility
nuget Microsoft.NET.Test.Sdk
nuget Microsoft.CodeAnalysis.CSharp 4.14.0
nuget Microsoft.CodeAnalysis 4.14.0
nuget Microsoft.Build 17.14.28
nuget Microsoft.CodeAnalysis.CSharp 5.0.0
nuget Microsoft.CodeAnalysis 5.0.0
nuget Microsoft.Build 18.0.2

79
csharp/paket.lock generated
View File

@@ -3,7 +3,7 @@ STRATEGY: MAX
RESTRICTION: == net10.0
NUGET
remote: https://api.nuget.org/v3/index.json
Basic.CompilerLog.Util (0.9.21)
Basic.CompilerLog.Util (0.9.25)
MessagePack (>= 3.1.4)
Microsoft.Bcl.Memory (>= 9.0.10)
Microsoft.CodeAnalysis (>= 4.8)
@@ -12,6 +12,7 @@ NUGET
Microsoft.Extensions.ObjectPool (>= 9.0.10)
MSBuild.StructuredLogger (>= 2.3.71)
NaturalSort.Extension (>= 4.4)
NuGet.Versioning (>= 6.14)
Humanizer.Core (3.0.1)
MessagePack (3.1.4)
MessagePack.Annotations (>= 3.1.4)
@@ -21,13 +22,13 @@ NUGET
MessagePackAnalyzer (3.1.4)
Microsoft.Bcl.AsyncInterfaces (10.0)
Microsoft.Bcl.Memory (10.0)
Microsoft.Build (17.14.28)
Microsoft.Build.Framework (>= 17.14.28)
Microsoft.NET.StringTools (>= 17.14.28)
Microsoft.Build (18.0.2)
Microsoft.Build.Framework (>= 18.0.2)
Microsoft.NET.StringTools (>= 18.0.2)
System.Configuration.ConfigurationManager (>= 9.0)
System.Diagnostics.EventLog (>= 9.0)
System.Reflection.MetadataLoadContext (>= 9.0)
System.Security.Cryptography.ProtectedData (>= 9.0)
System.Security.Cryptography.ProtectedData (>= 9.0.6)
Microsoft.Build.Framework (18.0.2)
Microsoft.Build.Utilities.Core (18.0.2)
Microsoft.Build.Framework (>= 18.0.2)
@@ -35,69 +36,51 @@ NUGET
System.Configuration.ConfigurationManager (>= 9.0)
System.Diagnostics.EventLog (>= 9.0)
System.Security.Cryptography.ProtectedData (>= 9.0.6)
Microsoft.CodeAnalysis (4.14)
Microsoft.CodeAnalysis (5.0)
Humanizer.Core (>= 2.14.1)
Microsoft.Bcl.AsyncInterfaces (>= 9.0)
Microsoft.CodeAnalysis.Analyzers (>= 3.11)
Microsoft.CodeAnalysis.CSharp.Workspaces (4.14)
Microsoft.CodeAnalysis.VisualBasic.Workspaces (4.14)
System.Buffers (>= 4.5.1)
Microsoft.CodeAnalysis.CSharp.Workspaces (5.0)
Microsoft.CodeAnalysis.VisualBasic.Workspaces (5.0)
System.Buffers (>= 4.6)
System.Collections.Immutable (>= 9.0)
System.Composition (>= 9.0)
System.IO.Pipelines (>= 9.0)
System.Memory (>= 4.5.5)
System.Numerics.Vectors (>= 4.5)
System.Memory (>= 4.6)
System.Numerics.Vectors (>= 4.6)
System.Reflection.Metadata (>= 9.0)
System.Runtime.CompilerServices.Unsafe (>= 6.0)
System.Text.Encoding.CodePages (>= 7.0)
System.Threading.Channels (>= 7.0)
System.Threading.Tasks.Extensions (>= 4.5.4)
System.Runtime.CompilerServices.Unsafe (>= 6.1)
System.Text.Encoding.CodePages (>= 8.0)
System.Threading.Channels (>= 8.0)
System.Threading.Tasks.Extensions (>= 4.6)
Microsoft.CodeAnalysis.Analyzers (3.11)
Microsoft.CodeAnalysis.Common (4.14)
Microsoft.CodeAnalysis.Common (5.0)
Microsoft.CodeAnalysis.Analyzers (>= 3.11)
System.Collections.Immutable (>= 9.0)
System.Reflection.Metadata (>= 9.0)
Microsoft.CodeAnalysis.CSharp (4.14)
Microsoft.CodeAnalysis.CSharp (5.0)
Microsoft.CodeAnalysis.Analyzers (>= 3.11)
Microsoft.CodeAnalysis.Common (4.14)
System.Collections.Immutable (>= 9.0)
System.Reflection.Metadata (>= 9.0)
Microsoft.CodeAnalysis.CSharp.Workspaces (4.14)
Microsoft.CodeAnalysis.Common (5.0)
Microsoft.CodeAnalysis.CSharp.Workspaces (5.0)
Humanizer.Core (>= 2.14.1)
Microsoft.CodeAnalysis.Analyzers (>= 3.11)
Microsoft.CodeAnalysis.Common (4.14)
Microsoft.CodeAnalysis.CSharp (4.14)
Microsoft.CodeAnalysis.Workspaces.Common (4.14)
System.Collections.Immutable (>= 9.0)
Microsoft.CodeAnalysis.Common (5.0)
Microsoft.CodeAnalysis.CSharp (5.0)
Microsoft.CodeAnalysis.Workspaces.Common (5.0)
System.Composition (>= 9.0)
System.IO.Pipelines (>= 9.0)
System.Reflection.Metadata (>= 9.0)
System.Threading.Channels (>= 7.0)
Microsoft.CodeAnalysis.VisualBasic (4.14)
Microsoft.CodeAnalysis.VisualBasic (5.0)
Microsoft.CodeAnalysis.Analyzers (>= 3.11)
Microsoft.CodeAnalysis.Common (4.14)
System.Collections.Immutable (>= 9.0)
System.Reflection.Metadata (>= 9.0)
Microsoft.CodeAnalysis.VisualBasic.Workspaces (4.14)
Microsoft.CodeAnalysis.Common (5.0)
Microsoft.CodeAnalysis.VisualBasic.Workspaces (5.0)
Humanizer.Core (>= 2.14.1)
Microsoft.CodeAnalysis.Analyzers (>= 3.11)
Microsoft.CodeAnalysis.Common (4.14)
Microsoft.CodeAnalysis.VisualBasic (4.14)
Microsoft.CodeAnalysis.Workspaces.Common (4.14)
System.Collections.Immutable (>= 9.0)
Microsoft.CodeAnalysis.Common (5.0)
Microsoft.CodeAnalysis.VisualBasic (5.0)
Microsoft.CodeAnalysis.Workspaces.Common (5.0)
System.Composition (>= 9.0)
System.IO.Pipelines (>= 9.0)
System.Reflection.Metadata (>= 9.0)
System.Threading.Channels (>= 7.0)
Microsoft.CodeAnalysis.Workspaces.Common (4.14)
Microsoft.CodeAnalysis.Workspaces.Common (5.0)
Humanizer.Core (>= 2.14.1)
Microsoft.CodeAnalysis.Analyzers (>= 3.11)
Microsoft.CodeAnalysis.Common (4.14)
System.Collections.Immutable (>= 9.0)
Microsoft.CodeAnalysis.Common (5.0)
System.Composition (>= 9.0)
System.IO.Pipelines (>= 9.0)
System.Reflection.Metadata (>= 9.0)
System.Threading.Channels (>= 7.0)
Microsoft.CodeCoverage (18.0.1)
Microsoft.Extensions.ObjectPool (10.0)
Microsoft.NET.StringTools (18.0.2)

18
csharp/paket.main.bzl generated
View File

File diff suppressed because one or more lines are too long

4
csharp/ql/lib/change-notes/2025-12-11-net10-basic-support.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* Basic extractor support for .NET 10 is now available. Extraction is supported for .NET 10 projects in both traced mode and `build mode: none`. However, code that uses language features new to C# 14 is not yet fully supported for extraction and analysis.

3
csharp/ql/lib/semmle/code/csharp/commons/Strings.qll
View File

@@ -3,6 +3,7 @@
*/
import csharp
private import semmle.code.csharp.commons.Collections
private import semmle.code.csharp.frameworks.Format
private import semmle.code.csharp.frameworks.System
private import semmle.code.csharp.frameworks.system.Text
@@ -33,7 +34,7 @@ class ImplicitToStringExpr extends Expr {
or
p instanceof StringFormatItemParameter and
not p.getType() =
any(ArrayType at |
any(ParamsCollectionType at |
at.getElementType() instanceof ObjectType and
this.getType().isImplicitlyConvertibleTo(at)
)

4
csharp/ql/test/library-tests/csharp7.3/PrintAst.expected
View File

@@ -75,8 +75,8 @@ csharp73.cs:
# 22| -1: [TypeMention] Span<int>
# 22| 1: [TypeMention] int
# 22| 0: [LocalVariableAccess] access to local variable t
# 22| 1: [OperatorCall] call to operator implicit conversion
# 22| 0: [ArrayCreation] array creation of type Int32[]
# 22| 1: [CastExpr] (...) ...
# 22| 1: [ArrayCreation] array creation of type Int32[]
# 22| -1: [TypeMention] Int32[]
# 22| 1: [TypeMention] int
# 22| 0: [IntLiteral] 10

6
csharp/ql/test/library-tests/csharp7/CSharp7.cs
View File

@@ -11,13 +11,13 @@ class Literals
class ExpressionBodiedMembers
{
int field = 0;
int Foo() => field;
int @field = 0;
int Foo() => @field;
int P => 5;
int Q
{
get => Foo();
set => field = value;
set => @field = value;
}
ExpressionBodiedMembers() : this(1) { }
ExpressionBodiedMembers(int x) => Foo();

2
csharp/ql/test/library-tests/csharp7/DefUse.expected
View File

@@ -1,4 +1,4 @@
| CSharp7.cs:20:9:20:11 | value | CSharp7.cs:20:24:20:28 | access to parameter value |
| CSharp7.cs:20:9:20:11 | value | CSharp7.cs:20:25:20:29 | access to parameter value |
| CSharp7.cs:29:19:29:19 | i | CSharp7.cs:31:16:31:16 | access to parameter i |
| CSharp7.cs:29:19:29:19 | i | CSharp7.cs:31:24:31:24 | access to parameter i |
| CSharp7.cs:42:19:42:19 | x | CSharp7.cs:44:13:44:13 | access to parameter x |

4
csharp/ql/test/library-tests/csharp7/ExpressionBodies.expected
View File

@@ -1,7 +1,7 @@
| CSharp7.cs:15:9:15:11 | Foo | CSharp7.cs:15:18:15:22 | access to field field |
| CSharp7.cs:15:9:15:11 | Foo | CSharp7.cs:15:18:15:23 | access to field field |
| CSharp7.cs:16:14:16:14 | get_P | CSharp7.cs:16:14:16:14 | 5 |
| CSharp7.cs:19:9:19:11 | get_Q | CSharp7.cs:19:16:19:20 | call to method Foo |
| CSharp7.cs:20:9:20:11 | set_Q | CSharp7.cs:20:16:20:28 | ... = ... |
| CSharp7.cs:20:9:20:11 | set_Q | CSharp7.cs:20:16:20:29 | ... = ... |
| CSharp7.cs:23:5:23:27 | ExpressionBodiedMembers | CSharp7.cs:23:39:23:43 | call to method Foo |
| CSharp7.cs:24:6:24:28 | ~ExpressionBodiedMembers | CSharp7.cs:24:35:24:39 | call to method Foo |
| CSharp7.cs:135:9:135:22 | f3 | CSharp7.cs:135:21:135:21 | 2 |

14
csharp/ql/test/library-tests/csharp7/LocalTaintFlow.expected
View File

@@ -7,15 +7,15 @@
| CSharp7.cs:8:9:8:9 | this access | CSharp7.cs:9:9:9:9 | this access |
| CSharp7.cs:8:13:8:19 | 123456 | CSharp7.cs:8:9:8:9 | access to field y |
| CSharp7.cs:9:13:9:23 | 128 | CSharp7.cs:9:9:9:9 | access to field z |
| CSharp7.cs:12:7:12:29 | this | CSharp7.cs:14:9:14:13 | this access |
| CSharp7.cs:14:17:14:17 | 0 | CSharp7.cs:14:9:14:13 | access to field field |
| CSharp7.cs:15:9:15:11 | SSA entry def(this.field) | CSharp7.cs:15:18:15:22 | access to field field |
| CSharp7.cs:15:9:15:11 | this | CSharp7.cs:15:18:15:22 | this access |
| CSharp7.cs:12:7:12:29 | this | CSharp7.cs:14:9:14:14 | this access |
| CSharp7.cs:14:18:14:18 | 0 | CSharp7.cs:14:9:14:14 | access to field field |
| CSharp7.cs:15:9:15:11 | SSA entry def(this.field) | CSharp7.cs:15:18:15:23 | access to field field |
| CSharp7.cs:15:9:15:11 | this | CSharp7.cs:15:18:15:23 | this access |
| CSharp7.cs:19:9:19:11 | this | CSharp7.cs:19:16:19:20 | this access |
| CSharp7.cs:20:9:20:11 | SSA param(value) | CSharp7.cs:20:24:20:28 | access to parameter value |
| CSharp7.cs:20:9:20:11 | this | CSharp7.cs:20:16:20:20 | this access |
| CSharp7.cs:20:9:20:11 | SSA param(value) | CSharp7.cs:20:25:20:29 | access to parameter value |
| CSharp7.cs:20:9:20:11 | this | CSharp7.cs:20:16:20:21 | this access |
| CSharp7.cs:20:9:20:11 | value | CSharp7.cs:20:9:20:11 | SSA param(value) |
| CSharp7.cs:20:24:20:28 | access to parameter value | CSharp7.cs:20:16:20:20 | access to field field |
| CSharp7.cs:20:25:20:29 | access to parameter value | CSharp7.cs:20:16:20:21 | access to field field |
| CSharp7.cs:23:5:23:27 | [post] this access | CSharp7.cs:23:39:23:43 | this access |
| CSharp7.cs:23:5:23:27 | this | CSharp7.cs:23:5:23:27 | this access |
| CSharp7.cs:23:5:23:27 | this access | CSharp7.cs:23:39:23:43 | this access |

8
csharp/ql/test/library-tests/dataflow/local/DataFlowStep.expected
View File

@@ -507,11 +507,11 @@
| LocalDataFlow.cs:353:21:353:21 | access to parameter x | LocalDataFlow.cs:353:16:353:21 | ... = ... |
| LocalDataFlow.cs:356:33:356:34 | access to parameter os | LocalDataFlow.cs:356:27:356:29 | access to local variable os2 |
| LocalDataFlow.cs:356:33:356:34 | access to parameter os | LocalDataFlow.cs:356:27:356:34 | ... = ... |
| LocalDataFlow.cs:361:41:361:44 | SSA param(args) | LocalDataFlow.cs:363:29:363:32 | access to parameter args |
| LocalDataFlow.cs:361:41:361:44 | SSA param(args) | LocalDataFlow.cs:364:27:364:30 | access to parameter args |
| LocalDataFlow.cs:361:41:361:44 | args | LocalDataFlow.cs:361:41:361:44 | SSA param(args) |
| LocalDataFlow.cs:363:29:363:32 | [post] access to parameter args | LocalDataFlow.cs:364:27:364:30 | access to parameter args |
| LocalDataFlow.cs:363:29:363:32 | access to parameter args | LocalDataFlow.cs:364:27:364:30 | access to parameter args |
| LocalDataFlow.cs:363:29:363:32 | call to operator implicit conversion | LocalDataFlow.cs:363:22:363:25 | access to local variable span |
| LocalDataFlow.cs:361:56:361:57 | SSA param(dt) | LocalDataFlow.cs:363:30:363:31 | access to parameter dt |
| LocalDataFlow.cs:361:56:361:57 | dt | LocalDataFlow.cs:361:56:361:57 | SSA param(dt) |
| LocalDataFlow.cs:363:30:363:31 | call to operator implicit conversion | LocalDataFlow.cs:363:24:363:26 | access to local variable dto |
| LocalDataFlow.cs:364:27:364:30 | call to operator implicit conversion | LocalDataFlow.cs:364:23:364:23 | access to local variable x |
| LocalDataFlow.cs:367:23:367:24 | SSA param(b1) | LocalDataFlow.cs:371:13:371:14 | access to parameter b1 |
| LocalDataFlow.cs:367:23:367:24 | b1 | LocalDataFlow.cs:367:23:367:24 | SSA param(b1) |

4
csharp/ql/test/library-tests/dataflow/local/LocalDataFlow.cs
View File

@@ -358,9 +358,9 @@ public class LocalDataFlow
public static implicit operator LocalDataFlow(string[] args) => null;
public void ConversionFlow(string[] args)
public void ConversionFlow(string[] args, DateTime dt)
{
Span<object> span = args; // flow (library operator)
DateTimeOffset dto = dt; // flow (library operator)
LocalDataFlow x = args; // no flow (source code operator)
}

10
csharp/ql/test/library-tests/dataflow/local/TaintTrackingStep.expected
View File

@@ -618,12 +618,12 @@
| LocalDataFlow.cs:353:21:353:21 | access to parameter x | LocalDataFlow.cs:353:16:353:21 | ... = ... |
| LocalDataFlow.cs:356:33:356:34 | access to parameter os | LocalDataFlow.cs:356:27:356:29 | access to local variable os2 |
| LocalDataFlow.cs:356:33:356:34 | access to parameter os | LocalDataFlow.cs:356:27:356:34 | ... = ... |
| LocalDataFlow.cs:361:41:361:44 | SSA param(args) | LocalDataFlow.cs:363:29:363:32 | access to parameter args |
| LocalDataFlow.cs:361:41:361:44 | SSA param(args) | LocalDataFlow.cs:364:27:364:30 | access to parameter args |
| LocalDataFlow.cs:361:41:361:44 | args | LocalDataFlow.cs:361:41:361:44 | SSA param(args) |
| LocalDataFlow.cs:363:29:363:32 | [post] access to parameter args | LocalDataFlow.cs:364:27:364:30 | access to parameter args |
| LocalDataFlow.cs:363:29:363:32 | access to parameter args | LocalDataFlow.cs:363:29:363:32 | call to operator implicit conversion |
| LocalDataFlow.cs:363:29:363:32 | access to parameter args | LocalDataFlow.cs:364:27:364:30 | access to parameter args |
| LocalDataFlow.cs:363:29:363:32 | call to operator implicit conversion | LocalDataFlow.cs:363:22:363:25 | access to local variable span |
| LocalDataFlow.cs:361:56:361:57 | SSA param(dt) | LocalDataFlow.cs:363:30:363:31 | access to parameter dt |
| LocalDataFlow.cs:361:56:361:57 | dt | LocalDataFlow.cs:361:56:361:57 | SSA param(dt) |
| LocalDataFlow.cs:363:30:363:31 | access to parameter dt | LocalDataFlow.cs:363:30:363:31 | call to operator implicit conversion |
| LocalDataFlow.cs:363:30:363:31 | call to operator implicit conversion | LocalDataFlow.cs:363:24:363:26 | access to local variable dto |
| LocalDataFlow.cs:364:27:364:30 | call to operator implicit conversion | LocalDataFlow.cs:364:23:364:23 | access to local variable x |
| LocalDataFlow.cs:367:23:367:24 | SSA param(b1) | LocalDataFlow.cs:371:13:371:14 | access to parameter b1 |
| LocalDataFlow.cs:367:23:367:24 | b1 | LocalDataFlow.cs:367:23:367:24 | SSA param(b1) |