hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/main' into mbg/go/private-registries

Browse Source
This commit is contained in:
Michael B. Gale
2025-04-25 12:34:13 +01:00
parent cafe1efefa 8b95e0ee4a
commit e805d1ee90
816 changed files with 82866 additions and 7962 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.bazelversion
View File

@@ -1 +1 @@
8.0.0
8.1.1

2
CODEOWNERS
View File

@@ -8,6 +8,7 @@
/javascript/ @github/codeql-javascript
/python/ @github/codeql-python
/ruby/ @github/codeql-ruby
/rust/ @github/codeql-rust
/swift/ @github/codeql-swift
/misc/codegen/ @github/codeql-swift
/java/kotlin-extractor/ @github/codeql-kotlin
@@ -41,6 +42,7 @@ MODULE.bazel @github/codeql-ci-reviewers
/.github/workflows/go-* @github/codeql-go
/.github/workflows/ql-for-ql-* @github/codeql-ql-for-ql-reviewers
/.github/workflows/ruby-* @github/codeql-ruby
/.github/workflows/rust.yml @github/codeql-rust
/.github/workflows/swift.yml @github/codeql-swift
# Misc

277
Cargo.lock generated
View File

@@ -154,15 +154,15 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
[[package]]
name = "bitflags"
version = "2.8.0"
version = "2.9.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8f68f53c83ab957f72c32642f3868eec03eb974d1fb82e453128456482613d36"
checksum = "5c8214115b7bf84099f1309324e63141d4c5d7cc26862f97a0a857dbefe165bd"
[[package]]
name = "borsh"
version = "1.5.3"
version = "1.5.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "2506947f73ad44e344215ccd6403ac2ae18cd8e046e581a441bf8d199f257f03"
checksum = "5430e3be710b68d984d1391c854eb431a9d548640711faa54eecb1df93db91cc"
dependencies = [
"cfg_aliases",
]
@@ -224,9 +224,9 @@ dependencies = [
[[package]]
name = "cargo_metadata"
version = "0.18.1"
version = "0.19.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "2d886547e41f740c616ae73108f6eb70afe6d940c7bc697cb30f13daec073037"
checksum = "dd5eb614ed4c27c5d706420e4320fbe3216ab31fa1c33cd8246ac36dae4479ba"
dependencies = [
"camino",
"cargo-platform",
@@ -275,7 +275,7 @@ version = "0.100.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4f114996bda14c0213f014a4ef31a7867dcf5f539a3900477fc6b20138e7a17b"
dependencies = [
"bitflags 2.8.0",
"bitflags 2.9.0",
"chalk-derive",
]
@@ -301,7 +301,7 @@ dependencies = [
"chalk-derive",
"chalk-ir",
"ena",
"indexmap 2.7.0",
"indexmap 2.9.0",
"itertools 0.12.1",
"petgraph",
"rustc-hash 1.1.0",
@@ -325,9 +325,9 @@ dependencies = [
[[package]]
name = "clap"
version = "4.5.32"
version = "4.5.35"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6088f3ae8c3608d19260cd7445411865a485688711b78b5be70d78cd96136f83"
checksum = "d8aa86934b44c19c50f87cc2790e19f54f7a67aedb64101c2e1a2e5ecfb73944"
dependencies = [
"clap_builder",
"clap_derive",
@@ -335,9 +335,9 @@ dependencies = [
[[package]]
name = "clap_builder"
version = "4.5.32"
version = "4.5.35"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "22a7ef7f676155edfb82daa97f99441f3ebf4a58d5e32f295a56259f1b6facc8"
checksum = "2414dbb2dd0695280da6ea9261e327479e9d37b0630f6b53ba2a11c60c679fd9"
dependencies = [
"anstream",
"anstyle",
@@ -622,7 +622,7 @@ version = "0.14.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "3d248bdd43ce613d87415282f69b9bb99d947d290b10962dd6c56233312c2ad5"
dependencies = [
"log 0.4.25",
"log 0.4.27",
]
[[package]]
@@ -691,9 +691,9 @@ checksum = "a246d82be1c9d791c5dfde9a2bd045fc3cbba3fa2b11ad558f27d01712f00569"
[[package]]
name = "equivalent"
version = "1.0.1"
version = "1.0.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
[[package]]
name = "figment"
@@ -781,7 +781,7 @@ checksum = "cc6bd114ceda131d3b1d665eba35788690ad37f5916457286b32ab6fd3c438dd"
dependencies = [
"cfg-if",
"libc",
"log 0.4.25",
"log 0.4.27",
"rustversion",
"windows",
]
@@ -812,7 +812,7 @@ checksum = "15f1ce686646e7f1e19bf7d5533fe443a45dbfb990e00629110797578b42fb19"
dependencies = [
"aho-corasick",
"bstr",
"log 0.4.25",
"log 0.4.27",
"regex-automata 0.4.9",
"regex-syntax 0.8.5",
]
@@ -918,9 +918,9 @@ dependencies = [
[[package]]
name = "indexmap"
version = "2.7.0"
version = "2.9.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "62f822373a4fe84d4bb149bf54e584a7f4abec90e072ed49cda0edea5b95471f"
checksum = "cea70ddb795996207ad57735b50c5982d8844f38ba9ee5f1aedcfb708a2aa11e"
dependencies = [
"equivalent",
"hashbrown 0.15.2",
@@ -939,7 +939,7 @@ version = "0.11.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f37dccff2791ab604f9babef0ba14fbe0be30bd368dc541e2b08d07c8aa908f3"
dependencies = [
"bitflags 2.8.0",
"bitflags 2.9.0",
"inotify-sys",
"libc",
]
@@ -979,9 +979,9 @@ dependencies = [
[[package]]
name = "itoa"
version = "1.0.14"
version = "1.0.15"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d75a2a4b1b190afb6f5425f10f6a8f959d2ea0b9c2b1d79553551850539e4674"
checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
[[package]]
name = "jod-thread"
@@ -1033,9 +1033,9 @@ checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
[[package]]
name = "libc"
version = "0.2.169"
version = "0.2.171"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b5aba8db14291edd000dfcc4d620c7ebfb122c613afb886ca8803fa4e128a20a"
checksum = "c19937216e9d3aa9956d9bb8dfc0b0c8beb6058fc4f7a4dc4d850edf86a237d6"
[[package]]
name = "libredox"
@@ -1043,7 +1043,7 @@ version = "0.1.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c0ff37bd590ca25063e35af745c343cb7a0271906fb7b37e4813e8f79f00268d"
dependencies = [
"bitflags 2.8.0",
"bitflags 2.9.0",
"libc",
"redox_syscall",
]
@@ -1074,14 +1074,14 @@ version = "0.3.9"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e19e8d5c34a3e0e2223db8e060f9e8264aeeb5c5fc64a4ee9965c062211c024b"
dependencies = [
"log 0.4.25",
"log 0.4.27",
]
[[package]]
name = "log"
version = "0.4.25"
version = "0.4.27"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "04cbf5b083de1c7e0222a7a51dbfdba1cbe1c6ab0b15e29fff3f6c077fd9cd9f"
checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94"
[[package]]
name = "loom"
@@ -1096,12 +1096,6 @@ dependencies = [
"tracing-subscriber",
]
[[package]]
name = "lz4_flex"
version = "0.11.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "75761162ae2b0e580d7e7c390558127e5f01b4194debd6221fd8c207fc80e3f5"
[[package]]
name = "matchers"
version = "0.1.0"
@@ -1142,7 +1136,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "2886843bf800fba2e3377cff24abf6379b4c4d5c6681eaf9ea5b0d15090450bd"
dependencies = [
"libc",
"log 0.4.25",
"log 0.4.27",
"wasi 0.11.0+wasi-snapshot-preview1",
"windows-sys 0.52.0",
]
@@ -1178,13 +1172,13 @@ version = "8.0.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "2fee8403b3d66ac7b26aee6e40a897d85dc5ce26f44da36b8b73e987cc52e943"
dependencies = [
"bitflags 2.8.0",
"bitflags 2.9.0",
"filetime",
"fsevent-sys",
"inotify",
"kqueue",
"libc",
"log 0.4.25",
"log 0.4.27",
"mio",
"notify-types",
"walkdir",
@@ -1240,9 +1234,9 @@ checksum = "945462a4b81e43c4e3ba96bd7b49d834c6f61198356aa858733bc4acf3cbe62e"
[[package]]
name = "oorandom"
version = "11.1.4"
version = "11.1.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b410bbe7e14ab526a0e86877eb47c6996a2bd7746f027ba551028c925390e4e9"
checksum = "d6790f58c7ff633d8771f42965289203411a5e5c68388703c06e14f24770b41e"
[[package]]
name = "os_str_bytes"
@@ -1331,7 +1325,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b4c5cc86750666a3ed20bdaf5ca2a0344f9c67674cae0515bec2da16fbaa47db"
dependencies = [
"fixedbitset",
"indexmap 2.7.0",
"indexmap 2.9.0",
]
[[package]]
@@ -1398,7 +1392,7 @@ version = "0.100.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f1651b0f7e8c3eb7c27a88f39d277e69c32bfe58e3be174d286c1a24d6a7a4d8"
dependencies = [
"bitflags 2.8.0",
"bitflags 2.9.0",
"ra-ap-rustc_hashes",
"ra-ap-rustc_index",
"tracing",
@@ -1470,18 +1464,16 @@ dependencies = [
[[package]]
name = "ra_ap_base_db"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4baa9734d254af14fd603528ad594650dea601b1764492bd39988da38598ae67"
checksum = "8fd761118bbafe29e2b187e694c6b8e800f2c7822bbc1d9d2db4ac21fb8b0365"
dependencies = [
"dashmap 5.5.3",
"la-arena",
"lz4_flex",
"ra_ap_cfg",
"ra_ap_intern",
"ra_ap_query-group-macro",
"ra_ap_span",
"ra_ap_stdx",
"ra_ap_syntax",
"ra_ap_vfs",
"rustc-hash 2.1.1",
@@ -1493,9 +1485,9 @@ dependencies = [
[[package]]
name = "ra_ap_cfg"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0ef2ba45636c5e585040c0c4bee640737a6001b08309f1a25ca78cf04abfbf90"
checksum = "5ce74ce1af24afd86d3529dbbf5a849d026948b2d8ba51d199b6ea6db6e345b6"
dependencies = [
"ra_ap_intern",
"ra_ap_tt",
@@ -1505,20 +1497,20 @@ dependencies = [
[[package]]
name = "ra_ap_edition"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8955c1484d5e7274f755187788ba0d51eb149f870c69cdf0d87c3b7edea20ea0"
checksum = "f423b9fb19e3920e4c7039120d09d9c79070a26efe8ff9f787c7234b07f518c5"
[[package]]
name = "ra_ap_hir"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a51d7955beff2212701b149bea36d4cf2dc0f5cd129652c9bcf0cb5c0b021078"
checksum = "dd4aa8a568b80d288b90c4fa5dc8a3cc405914d261bfd33a3761c1ba41be358d"
dependencies = [
"arrayvec",
"either",
"indexmap 2.7.0",
"itertools 0.12.1",
"indexmap 2.9.0",
"itertools 0.14.0",
"ra_ap_base_db",
"ra_ap_cfg",
"ra_ap_hir_def",
@@ -1537,23 +1529,20 @@ dependencies = [
[[package]]
name = "ra_ap_hir_def"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e5c97e617e4c585d24b3d4f668861452aedddfbe0262f4c53235dcea77e62f9b"
checksum = "acb18d9378a828a23ccf87b89199db005adb67ba2a05a37d7a3fcad4d1036e66"
dependencies = [
"arrayvec",
"bitflags 2.8.0",
"bitflags 2.9.0",
"cov-mark",
"dashmap 5.5.3",
"drop_bomb",
"either",
"fst",
"hashbrown 0.14.5",
"indexmap 2.7.0",
"itertools 0.12.1",
"indexmap 2.9.0",
"itertools 0.14.0",
"la-arena",
"ra-ap-rustc_abi",
"ra-ap-rustc_hashes",
"ra-ap-rustc_parse_format",
"ra_ap_base_db",
"ra_ap_cfg",
@@ -1570,21 +1559,20 @@ dependencies = [
"salsa",
"smallvec",
"text-size",
"thin-vec",
"tracing",
"triomphe",
]
[[package]]
name = "ra_ap_hir_expand"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "be57c0d7e3f2180dd8ea584b11447f34060eadc06f0f6d559e2a790f6e91b6c5"
checksum = "094fa79d8f661f52cf3b7fb8b3d91c4be2ad9e71a3967d3dacd25429fa44b37d"
dependencies = [
"cov-mark",
"either",
"hashbrown 0.14.5",
"itertools 0.12.1",
"la-arena",
"itertools 0.14.0",
"ra_ap_base_db",
"ra_ap_cfg",
"ra_ap_intern",
@@ -1605,24 +1593,22 @@ dependencies = [
[[package]]
name = "ra_ap_hir_ty"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f260f35748f3035b46a8afcdebda7cb75d95c24750105fad86101d09a9d387c8"
checksum = "093482d200d5db421db5692e7819bbb14fb717cc8cb0f91f93cce9fde85b3df2"
dependencies = [
"arrayvec",
"bitflags 2.8.0",
"bitflags 2.9.0",
"chalk-derive",
"chalk-ir",
"chalk-recursive",
"chalk-solve",
"cov-mark",
"dashmap 5.5.3",
"either",
"ena",
"indexmap 2.7.0",
"itertools 0.12.1",
"indexmap 2.9.0",
"itertools 0.14.0",
"la-arena",
"nohash-hasher",
"oorandom",
"ra-ap-rustc_abi",
"ra-ap-rustc_index",
@@ -1647,19 +1633,18 @@ dependencies = [
[[package]]
name = "ra_ap_ide_db"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0426263be26e27cb55a3b9ef88b120511b66fe7d9b418a2473d6d5f3ac2fe0a6"
checksum = "b655b92dfa9444db8129321b9217d9e4a83a58ee707aa1004a93052acfb43d57"
dependencies = [
"arrayvec",
"bitflags 2.8.0",
"bitflags 2.9.0",
"cov-mark",
"crossbeam-channel",
"dashmap 5.5.3",
"either",
"fst",
"indexmap 2.7.0",
"itertools 0.12.1",
"indexmap 2.9.0",
"itertools 0.14.0",
"line-index",
"memchr",
"nohash-hasher",
@@ -1681,9 +1666,9 @@ dependencies = [
[[package]]
name = "ra_ap_intern"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f6ea8c9615b3b0688cf557e7310dbd9432f43860c8ea766d54f4416cbecf3571"
checksum = "b4e528496b4d4c351806bb073d3d7f6526535741b9e8801776603c924bbec624"
dependencies = [
"dashmap 5.5.3",
"hashbrown 0.14.5",
@@ -1693,17 +1678,16 @@ dependencies = [
[[package]]
name = "ra_ap_load-cargo"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "570907e16725c13a678bfd8050ce8839af2831da042a0878b75ee8c41b0f7b0c"
checksum = "1a97a5070b2f4b99f56683d91b2687aa0c530d8969cc5252ec2ae5644e428ffe"
dependencies = [
"anyhow",
"crossbeam-channel",
"itertools 0.12.1",
"itertools 0.14.0",
"ra_ap_hir_expand",
"ra_ap_ide_db",
"ra_ap_intern",
"ra_ap_paths",
"ra_ap_proc_macro_api",
"ra_ap_project_model",
"ra_ap_span",
@@ -1715,9 +1699,9 @@ dependencies = [
[[package]]
name = "ra_ap_mbe"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e893fe03b04b30c9b5a339ac2bf39ce32ac9c05a8b50121b7d89ce658346e164"
checksum = "b187ee5ee3fa726eeea5142242a0397e2200d77084026986a68324b9599f9046"
dependencies = [
"arrayvec",
"cov-mark",
@@ -1726,19 +1710,17 @@ dependencies = [
"ra_ap_parser",
"ra_ap_span",
"ra_ap_stdx",
"ra_ap_syntax",
"ra_ap_syntax-bridge",
"ra_ap_tt",
"rustc-hash 2.1.1",
"smallvec",
"tracing",
]
[[package]]
name = "ra_ap_parser"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6fd9a264120968b14a66b6ba756cd7f99435385b5dbc2f0a611cf3a12221c385"
checksum = "2306e6c051e60483f3b317fac9dec6c883b7792eeb8db24ec6f39dbfa5430159"
dependencies = [
"drop_bomb",
"ra-ap-rustc_lexer",
@@ -1748,20 +1730,20 @@ dependencies = [
[[package]]
name = "ra_ap_paths"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f47817351651e36b56ff3afc483b41600053c9cb7e67d945467c0abe93416032"
checksum = "dcedd00499621bdd0f1fe01955c04e4b388197aa826744003afaf6cc2944bc80"
dependencies = [
"camino",
]
[[package]]
name = "ra_ap_proc_macro_api"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d96da3b8b9f6b813a98f5357eef303905450741f47ba90adaab8a5371b748416"
checksum = "7a2e49b550015cd4ad152bd78d92d73594497f2e44f61273f9fed3534ad4bbbe"
dependencies = [
"indexmap 2.7.0",
"indexmap 2.9.0",
"ra_ap_intern",
"ra_ap_paths",
"ra_ap_span",
@@ -1776,9 +1758,9 @@ dependencies = [
[[package]]
name = "ra_ap_profile"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "13637377287c84f88a628e40229d271ef0081c0d683956bd99a6c8278a4f8b14"
checksum = "87cdbd27ebe02ec21fdae3df303f194bda036a019ecef80d47e0082646f06c54"
dependencies = [
"cfg-if",
"libc",
@@ -1788,13 +1770,13 @@ dependencies = [
[[package]]
name = "ra_ap_project_model"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "053c5207a638fc7a752c7a454bc952b28b0d02f0bf9f6d7ec785ec809579d8fa"
checksum = "5eaa3406c891a7840d20ce615f8decca32cbc9d3654b82dcbcc3a31257ce90b9"
dependencies = [
"anyhow",
"cargo_metadata",
"itertools 0.12.1",
"itertools 0.14.0",
"la-arena",
"ra_ap_base_db",
"ra_ap_cfg",
@@ -1814,22 +1796,20 @@ dependencies = [
[[package]]
name = "ra_ap_query-group-macro"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0f1a38f07b442e47a234cbe2e8fd1b8a41ff0cc5123cb1cf994c5ce20edb5bd6"
checksum = "1fbc1748e4876a9b0ccfacfc7e2fe254f30e92ef58d98925282b3803e8b004ed"
dependencies = [
"heck",
"proc-macro2",
"quote",
"salsa",
"syn",
]
[[package]]
name = "ra_ap_span"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8818680c6f7da3b32cb2bb0992940b24264b1aa90203aa94812e09ab34d362d1"
checksum = "ed1d036e738bf32a057d90698df85bcb83ed6263b5fe9fba132c99e8ec3aecaf"
dependencies = [
"hashbrown 0.14.5",
"la-arena",
@@ -1843,12 +1823,12 @@ dependencies = [
[[package]]
name = "ra_ap_stdx"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f1c10bee1b03fc48083862c13cf06bd3ed17760463ecce2734103a2f511e5ed4"
checksum = "6e3775954ab24408f71e97079a97558078a166a4082052e83256ae4c22dae18d"
dependencies = [
"crossbeam-channel",
"itertools 0.12.1",
"itertools 0.14.0",
"jod-thread",
"libc",
"miow",
@@ -1858,14 +1838,12 @@ dependencies = [
[[package]]
name = "ra_ap_syntax"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "92bc32f3946fc5fcbdc79e61b7e26a8c2a3a56f3ef6ab27c7d298a9e21a462f2"
checksum = "b49b081f209a764700f688db91820a66c2ecfe5f138895d831361cf84f716691"
dependencies = [
"cov-mark",
"either",
"indexmap 2.7.0",
"itertools 0.12.1",
"itertools 0.14.0",
"ra-ap-rustc_lexer",
"ra_ap_parser",
"ra_ap_stdx",
@@ -1878,9 +1856,9 @@ dependencies = [
[[package]]
name = "ra_ap_syntax-bridge"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a42052c44c98c122c37aac476260c8f19d8fec495edc9c05835307c9ae86194d"
checksum = "f2740bbe603d527f2cf0aaf51629de7d072694fbbaaeda8264f7591be1493d1b"
dependencies = [
"ra_ap_intern",
"ra_ap_parser",
@@ -1889,14 +1867,13 @@ dependencies = [
"ra_ap_syntax",
"ra_ap_tt",
"rustc-hash 2.1.1",
"tracing",
]
[[package]]
name = "ra_ap_toolchain"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "75996e70b3a0c68cd5157ba01f018964c7c6a5d7b209047d449b393139d0b57f"
checksum = "efbff9f26f307ef958586357d1653d000861dcd3acbaf33a009651e024720c7e"
dependencies = [
"camino",
"home",
@@ -1904,9 +1881,9 @@ dependencies = [
[[package]]
name = "ra_ap_tt"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0e4ee31e93bfabe83e6720b7469db88d7ad7ec5c59a1f011efec4aa1327ffc5c"
checksum = "0b1ce3ac14765e414fa6031fda7dc35d3492c74de225aac689ba8b8bf037e1f8"
dependencies = [
"arrayvec",
"ra-ap-rustc_lexer",
@@ -1917,13 +1894,13 @@ dependencies = [
[[package]]
name = "ra_ap_vfs"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f6aac1e277ac70bb073f40f8a3fc44e4b1bb9e4d4b1d0e0bd2f8269543560f80"
checksum = "29427a7c27ce8ddfefb52d77c952a4588c74d0a7ab064dc627129088a90423ca"
dependencies = [
"crossbeam-channel",
"fst",
"indexmap 2.7.0",
"indexmap 2.9.0",
"nohash-hasher",
"ra_ap_paths",
"ra_ap_stdx",
@@ -1933,9 +1910,9 @@ dependencies = [
[[package]]
name = "ra_ap_vfs-notify"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "cd95285146049621ee8f7a512c982a008bf036321fcc9b01a95c1ad7e6aeae57"
checksum = "d5a0e3095b8216ecc131f38b4b0025cac324a646469a95d2670354aee7278078"
dependencies = [
"crossbeam-channel",
"notify",
@@ -2005,7 +1982,7 @@ version = "0.5.8"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "03a862b389f93e68874fbf580b9de08dd02facb9a788ebadaf4a3fd33cf58834"
dependencies = [
"bitflags 2.8.0",
"bitflags 2.9.0",
]
[[package]]
@@ -2093,10 +2070,10 @@ checksum = "2febf9acc5ee5e99d1ad0afcdbccc02d87aa3f857a1f01f825b80eacf8edfcd1"
[[package]]
name = "rustc_apfloat"
version = "0.2.1+llvm-462a31f5a5ab"
source = "git+https://github.com/redsun82/rustc_apfloat.git?rev=096d585100636bc2e9f09d7eefec38c5b334d47b#096d585100636bc2e9f09d7eefec38c5b334d47b"
version = "0.2.2+llvm-462a31f5a5ab"
source = "git+https://github.com/redsun82/rustc_apfloat.git?rev=32968f16ef1b082243f9bf43a3fbd65c381b3e27#32968f16ef1b082243f9bf43a3fbd65c381b3e27"
dependencies = [
"bitflags 1.3.2",
"bitflags 2.9.0",
"smallvec",
]
@@ -2123,7 +2100,7 @@ dependencies = [
"dashmap 6.1.0",
"hashbrown 0.15.2",
"hashlink",
"indexmap 2.7.0",
"indexmap 2.9.0",
"parking_lot",
"portable-atomic",
"rayon",
@@ -2176,9 +2153,9 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
[[package]]
name = "semver"
version = "1.0.24"
version = "1.0.26"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "3cb6eb87a131f756572d7fb904f6e7b68633f09cca868c5df1c4b8d1a694bbba"
checksum = "56e6fa9c48d24d85fb3de5ad847117517440f6beceb7798af16b4a87d616b8d0"
dependencies = [
"serde",
]
@@ -2234,7 +2211,7 @@ dependencies = [
"chrono",
"hex",
"indexmap 1.9.3",
"indexmap 2.7.0",
"indexmap 2.9.0",
"serde",
"serde_derive",
"serde_json",
@@ -2260,7 +2237,7 @@ version = "0.9.34+deprecated"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6a8b1a1a2ebf674015cc02edccce75287f1a0130d394307b36743c2f5d504b47"
dependencies = [
"indexmap 2.7.0",
"indexmap 2.9.0",
"itoa",
"ryu",
"serde",
@@ -2345,19 +2322,25 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f18aa187839b2bdb1ad2fa35ead8c4c2976b64e4363c386d45ac0f7ee85c9233"
[[package]]
name = "thiserror"
version = "1.0.69"
name = "thin-vec"
version = "0.2.14"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
checksum = "144f754d318415ac792f9d69fc87abbbfc043ce2ef041c60f16ad828f638717d"
[[package]]
name = "thiserror"
version = "2.0.12"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "567b8a2dae586314f7be2a752ec7474332959c6460e02bde30d702a66d488708"
dependencies = [
"thiserror-impl",
]
[[package]]
name = "thiserror-impl"
version = "1.0.69"
version = "2.0.12"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
checksum = "7f7cf42b4507d8ea322120659672cf1b9dbb93f8f2d4ecfd6e51350ff5b17a1d"
dependencies = [
"proc-macro2",
"quote",
@@ -2432,7 +2415,7 @@ version = "0.22.24"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "17b4795ff5edd201c7cd6dca065ae59972ce77d1b80fa0a84d94950ece7d1474"
dependencies = [
"indexmap 2.7.0",
"indexmap 2.9.0",
"serde",
"serde_spanned",
"toml_datetime",
@@ -2488,7 +2471,7 @@ version = "0.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
dependencies = [
"log 0.4.25",
"log 0.4.27",
"once_cell",
"tracing-core",
]
@@ -2603,9 +2586,9 @@ checksum = "a3e5df347f0bf3ec1d670aad6ca5c6a1859cd9ea61d2113125794654ccced68f"
[[package]]
name = "unicode-ident"
version = "1.0.16"
version = "1.0.17"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a210d160f08b701c8721ba1c726c11662f877ea6b7094007e1ca9a1041945034"
checksum = "00e2473a93778eb0bad35909dff6a10d28e63f792f16ed15e404fca9d5eeedbe"
[[package]]
name = "unicode-properties"
@@ -2686,7 +2669,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5f89bb38646b4f81674e8f5c3fb81b562be1fd936d84320f3264486418519c79"
dependencies = [
"bumpalo",
"log 0.4.25",
"log 0.4.27",
"proc-macro2",
"quote",
"syn",
@@ -2995,7 +2978,7 @@ version = "0.33.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "3268f3d866458b787f390cf61f4bbb563b922d091359f9608842999eaee3943c"
dependencies = [
"bitflags 2.8.0",
"bitflags 2.9.0",
]
[[package]]

2
Cargo.toml
View File

@@ -14,4 +14,4 @@ members = [
[patch.crates-io]
# patch for build script bug preventing bazel build
# see https://github.com/rust-lang/rustc_apfloat/pull/17
rustc_apfloat = { git = "https://github.com/redsun82/rustc_apfloat.git", rev = "096d585100636bc2e9f09d7eefec38c5b334d47b" }
rustc_apfloat = { git = "https://github.com/redsun82/rustc_apfloat.git", rev = "32968f16ef1b082243f9bf43a3fbd65c381b3e27" }

34
MODULE.bazel
View File

@@ -75,7 +75,7 @@ use_repo(
"vendor_ts__argfile-0.2.1",
"vendor_ts__chalk-ir-0.100.0",
"vendor_ts__chrono-0.4.40",
"vendor_ts__clap-4.5.32",
"vendor_ts__clap-4.5.35",
"vendor_ts__dunce-1.0.5",
"vendor_ts__either-1.15.0",
"vendor_ts__encoding-0.2.33",
@@ -90,22 +90,22 @@ use_repo(
"vendor_ts__num_cpus-1.16.0",
"vendor_ts__proc-macro2-1.0.94",
"vendor_ts__quote-1.0.40",
"vendor_ts__ra_ap_base_db-0.0.270",
"vendor_ts__ra_ap_cfg-0.0.270",
"vendor_ts__ra_ap_hir-0.0.270",
"vendor_ts__ra_ap_hir_def-0.0.270",
"vendor_ts__ra_ap_hir_expand-0.0.270",
"vendor_ts__ra_ap_hir_ty-0.0.270",
"vendor_ts__ra_ap_ide_db-0.0.270",
"vendor_ts__ra_ap_intern-0.0.270",
"vendor_ts__ra_ap_load-cargo-0.0.270",
"vendor_ts__ra_ap_parser-0.0.270",
"vendor_ts__ra_ap_paths-0.0.270",
"vendor_ts__ra_ap_project_model-0.0.270",
"vendor_ts__ra_ap_span-0.0.270",
"vendor_ts__ra_ap_stdx-0.0.270",
"vendor_ts__ra_ap_syntax-0.0.270",
"vendor_ts__ra_ap_vfs-0.0.270",
"vendor_ts__ra_ap_base_db-0.0.273",
"vendor_ts__ra_ap_cfg-0.0.273",
"vendor_ts__ra_ap_hir-0.0.273",
"vendor_ts__ra_ap_hir_def-0.0.273",
"vendor_ts__ra_ap_hir_expand-0.0.273",
"vendor_ts__ra_ap_hir_ty-0.0.273",
"vendor_ts__ra_ap_ide_db-0.0.273",
"vendor_ts__ra_ap_intern-0.0.273",
"vendor_ts__ra_ap_load-cargo-0.0.273",
"vendor_ts__ra_ap_parser-0.0.273",
"vendor_ts__ra_ap_paths-0.0.273",
"vendor_ts__ra_ap_project_model-0.0.273",
"vendor_ts__ra_ap_span-0.0.273",
"vendor_ts__ra_ap_stdx-0.0.273",
"vendor_ts__ra_ap_syntax-0.0.273",
"vendor_ts__ra_ap_vfs-0.0.273",
"vendor_ts__rand-0.9.0",
"vendor_ts__rayon-1.10.0",
"vendor_ts__regex-1.11.1",

19
actions/extractor/tools/autobuild-impl.ps1
View File

@@ -1,7 +1,3 @@
if (($null -ne $env:LGTM_INDEX_INCLUDE) -or ($null -ne $env:LGTM_INDEX_EXCLUDE) -or ($null -ne $env:LGTM_INDEX_FILTERS)) {
Write-Output 'Path filters set. Passing them through to the JavaScript extractor.'
} else {
Write-Output 'No path filters set. Using the default filters.'
# Note: We're adding the `reusable_workflows` subdirectories to proactively
# record workflows that were called cross-repo, check them out locally,
# and enable an interprocedural analysis across the workflow files.
@@ -16,12 +12,23 @@ if (($null -ne $env:LGTM_INDEX_INCLUDE) -or ($null -ne $env:LGTM_INDEX_EXCLUDE)
'include:**/action.yaml'
)
if ($null -ne $env:LGTM_INDEX_FILTERS) {
Write-Output 'LGTM_INDEX_FILTERS set. Using the default filters together with the user-provided filters, and passing through to the JavaScript extractor.'
# Begin with the default path inclusions only,
# followed by the user-provided filters.
# If the user provided `paths`, those patterns override the default inclusions
# (because `LGTM_INDEX_FILTERS` will begin with `exclude:**/*`).
# If the user provided `paths-ignore`, those patterns are excluded.
$PathFilters = ($DefaultPathFilters -join "`n") + "`n" + $env:LGTM_INDEX_FILTERS
$env:LGTM_INDEX_FILTERS = $PathFilters
} else {
Write-Output 'LGTM_INDEX_FILTERS not set. Using the default filters, and passing through to the JavaScript extractor.'
$env:LGTM_INDEX_FILTERS = $DefaultPathFilters -join "`n"
}
# Find the JavaScript extractor directory via `codeql resolve extractor`.
$CodeQL = Join-Path $env:CODEQL_DIST 'codeql.exe'
$env:CODEQL_EXTRACTOR_JAVASCRIPT_ROOT = &$CodeQL resolve extractor --language javascript
$env:CODEQL_EXTRACTOR_JAVASCRIPT_ROOT = &"$CodeQL" resolve extractor --language javascript
if ($LASTEXITCODE -ne 0) {
throw 'Failed to resolve JavaScript extractor.'
}
@@ -40,7 +47,7 @@ $env:CODEQL_EXTRACTOR_JAVASCRIPT_SOURCE_ARCHIVE_DIR = $env:CODEQL_EXTRACTOR_ACTI
$env:CODEQL_EXTRACTOR_JAVASCRIPT_TRAP_DIR = $env:CODEQL_EXTRACTOR_ACTIONS_TRAP_DIR
$env:CODEQL_EXTRACTOR_JAVASCRIPT_WIP_DATABASE = $env:CODEQL_EXTRACTOR_ACTIONS_WIP_DATABASE
&$JavaScriptAutoBuild
&"$JavaScriptAutoBuild"
if ($LASTEXITCODE -ne 0) {
throw "JavaScript autobuilder failed."
}

3
actions/extractor/tools/autobuild.cmd
View File

@@ -1,3 +1,4 @@
@echo off
rem All of the work is done in the PowerShell script
powershell.exe %~dp0autobuild-impl.ps1
echo "Running PowerShell script at '%~dp0autobuild-impl.ps1'"
powershell.exe -File "%~dp0autobuild-impl.ps1"

22
actions/extractor/tools/autobuild.sh
View File

@@ -17,16 +17,28 @@ include:**/action.yaml
END
)
if [ -n "${LGTM_INDEX_INCLUDE:-}" ] || [ -n "${LGTM_INDEX_EXCLUDE:-}" ] || [ -n "${LGTM_INDEX_FILTERS:-}" ] ; then
echo "Path filters set. Passing them through to the JavaScript extractor."
if [ -n "${LGTM_INDEX_FILTERS:-}" ]; then
echo "LGTM_INDEX_FILTERS set. Using the default filters together with the user-provided filters, and passing through to the JavaScript extractor."
# Begin with the default path inclusions only,
# followed by the user-provided filters.
# If the user provided `paths`, those patterns override the default inclusions
# (because `LGTM_INDEX_FILTERS` will begin with `exclude:**/*`).
# If the user provided `paths-ignore`, those patterns are excluded.
PATH_FILTERS="$(cat << END
${DEFAULT_PATH_FILTERS}
${LGTM_INDEX_FILTERS}
END
)"
LGTM_INDEX_FILTERS="${PATH_FILTERS}"
export LGTM_INDEX_FILTERS
else
echo "No path filters set. Using the default filters."
echo "LGTM_INDEX_FILTERS not set. Using the default filters, and passing through to the JavaScript extractor."
LGTM_INDEX_FILTERS="${DEFAULT_PATH_FILTERS}"
export LGTM_INDEX_FILTERS
fi
# Find the JavaScript extractor directory via `codeql resolve extractor`.
CODEQL_EXTRACTOR_JAVASCRIPT_ROOT="$($CODEQL_DIST/codeql resolve extractor --language javascript)"
CODEQL_EXTRACTOR_JAVASCRIPT_ROOT="$("${CODEQL_DIST}/codeql" resolve extractor --language javascript)"
export CODEQL_EXTRACTOR_JAVASCRIPT_ROOT
echo "Found JavaScript extractor at '${CODEQL_EXTRACTOR_JAVASCRIPT_ROOT}'."
@@ -42,4 +54,4 @@ env CODEQL_EXTRACTOR_JAVASCRIPT_DIAGNOSTIC_DIR="${CODEQL_EXTRACTOR_ACTIONS_DIAGN
CODEQL_EXTRACTOR_JAVASCRIPT_SOURCE_ARCHIVE_DIR="${CODEQL_EXTRACTOR_ACTIONS_SOURCE_ARCHIVE_DIR}" \
CODEQL_EXTRACTOR_JAVASCRIPT_TRAP_DIR="${CODEQL_EXTRACTOR_ACTIONS_TRAP_DIR}" \
CODEQL_EXTRACTOR_JAVASCRIPT_WIP_DATABASE="${CODEQL_EXTRACTOR_ACTIONS_WIP_DATABASE}" \
${JAVASCRIPT_AUTO_BUILD}
"${JAVASCRIPT_AUTO_BUILD}"

5
actions/ql/integration-tests/filters-default/actions.ql Normal file
View File

@@ -0,0 +1,5 @@
import actions
from AstNode n
where n instanceof Workflow or n instanceof CompositeAction
select n

6
actions/ql/integration-tests/filters/actions.default-filters.expected Normal file
View File

@@ -0,0 +1,6 @@
| src/.github/action.yaml:1:1:11:32 | name: ' ... action' |
| src/.github/actions/action-name/action.yml:1:1:11:32 | name: ' ... action' |
| src/.github/workflows/workflow.yml:1:1:12:33 | name: A workflow |
| src/action.yml:1:1:11:32 | name: ' ... action' |
| src/excluded/action.yml:1:1:11:32 | name: ' ... action' |
| src/included/action.yml:1:1:11:32 | name: ' ... action' |

2
actions/ql/integration-tests/filters/actions.paths-and-paths-ignore.expected Normal file
View File

@@ -0,0 +1,2 @@
| src/included/action.yml:1:1:11:32 | name: ' ... action' |
| src/included/unreachable-workflow.yml:1:1:12:33 | name: A ... orkflow |

5
actions/ql/integration-tests/filters/actions.paths-ignore-only.expected Normal file
View File

@@ -0,0 +1,5 @@
| src/.github/action.yaml:1:1:11:32 | name: ' ... action' |
| src/.github/actions/action-name/action.yml:1:1:11:32 | name: ' ... action' |
| src/.github/workflows/workflow.yml:1:1:12:33 | name: A workflow |
| src/action.yml:1:1:11:32 | name: ' ... action' |
| src/included/action.yml:1:1:11:32 | name: ' ... action' |

2
actions/ql/integration-tests/filters/actions.paths-only.expected Normal file
View File

@@ -0,0 +1,2 @@
| src/included/action.yml:1:1:11:32 | name: ' ... action' |
| src/included/unreachable-workflow.yml:1:1:12:33 | name: A ... orkflow |

5
actions/ql/integration-tests/filters/actions.ql Normal file
View File

@@ -0,0 +1,5 @@
import actions
from AstNode n
where n instanceof Workflow or n instanceof CompositeAction
select n

4
actions/ql/integration-tests/filters/codeql-config.paths-and-paths-ignore.yml Normal file
View File

@@ -0,0 +1,4 @@
paths:
- 'included'
paths-ignore:
- 'excluded'

2
actions/ql/integration-tests/filters/codeql-config.paths-ignore-only.yml Normal file
View File

@@ -0,0 +1,2 @@
paths-ignore:
- 'excluded'

2
actions/ql/integration-tests/filters/codeql-config.paths-only.yml Normal file
View File

@@ -0,0 +1,2 @@
paths:
- 'included'

6
actions/ql/integration-tests/filters/source_archive.default-filters.expected Normal file
View File

@@ -0,0 +1,6 @@
src/.github/action.yaml
src/.github/actions/action-name/action.yml
src/.github/workflows/workflow.yml
src/action.yml
src/excluded/action.yml
src/included/action.yml

3
actions/ql/integration-tests/filters/source_archive.paths-and-paths-ignore.expected Normal file
View File

@@ -0,0 +1,3 @@
src/included/action.yml
src/included/not-an-action.yml
src/included/unreachable-workflow.yml

5
actions/ql/integration-tests/filters/source_archive.paths-ignore-only.expected Normal file
View File

@@ -0,0 +1,5 @@
src/.github/action.yaml
src/.github/actions/action-name/action.yml
src/.github/workflows/workflow.yml
src/action.yml
src/included/action.yml

3
actions/ql/integration-tests/filters/source_archive.paths-only.expected Normal file
View File

@@ -0,0 +1,3 @@
src/included/action.yml
src/included/not-an-action.yml
src/included/unreachable-workflow.yml

11
actions/ql/integration-tests/filters/src/.github/action.yaml vendored Normal file
View File

@@ -0,0 +1,11 @@
name: 'A composite action'
description: 'Do something'
runs:
using: "composite"
steps:
- name: Print
run: echo "Hello world"
shell: bash
- name: Checkout
uses: actions/checkout@v4

11
actions/ql/integration-tests/filters/src/.github/actions/action-name/action.yml vendored Normal file
View File

@@ -0,0 +1,11 @@
name: 'A composite action'
description: 'Do something'
runs:
using: "composite"
steps:
- name: Print
run: echo "Hello world"
shell: bash
- name: Checkout
uses: actions/checkout@v4

12
actions/ql/integration-tests/filters/src/.github/unreachable-workflow.yml vendored Normal file
View File

@@ -0,0 +1,12 @@
name: An unreachable workflow
on:
push:
branches:
- main
jobs:
job:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4

12
actions/ql/integration-tests/filters/src/.github/workflows/workflow.yml vendored Normal file
View File

@@ -0,0 +1,12 @@
name: A workflow
on:
push:
branches:
- main
jobs:
job:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4

11
actions/ql/integration-tests/filters/src/action.yml Normal file
View File

@@ -0,0 +1,11 @@
name: 'A composite action'
description: 'Do something'
runs:
using: "composite"
steps:
- name: Print
run: echo "Hello world"
shell: bash
- name: Checkout
uses: actions/checkout@v4

11
actions/ql/integration-tests/filters/src/excluded/action.yml Normal file
View File

@@ -0,0 +1,11 @@
name: 'A composite action'
description: 'Do something'
runs:
using: "composite"
steps:
- name: Print
run: echo "Hello world"
shell: bash
- name: Checkout
uses: actions/checkout@v4

12
actions/ql/integration-tests/filters/src/excluded/unreachable-workflow.yml Normal file
View File

@@ -0,0 +1,12 @@
name: An unreachable workflow
on:
push:
branches:
- main
jobs:
job:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4

11
actions/ql/integration-tests/filters/src/included/action.yml Normal file
View File

@@ -0,0 +1,11 @@
name: 'A composite action'
description: 'Do something'
runs:
using: "composite"
steps:
- name: Print
run: echo "Hello world"
shell: bash
- name: Checkout
uses: actions/checkout@v4

1
actions/ql/integration-tests/filters/src/included/not-an-action.yml Normal file
View File

@@ -0,0 +1 @@
name: 'Not an action, just a YAML file'

12
actions/ql/integration-tests/filters/src/included/unreachable-workflow.yml Normal file
View File

@@ -0,0 +1,12 @@
name: An unreachable workflow
on:
push:
branches:
- main
jobs:
job:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4

12
actions/ql/integration-tests/filters/src/unreachable-workflow.yml Normal file
View File

@@ -0,0 +1,12 @@
name: An unreachable workflow
on:
push:
branches:
- main
jobs:
job:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4

18
actions/ql/integration-tests/filters/test.py Executable file
View File

@@ -0,0 +1,18 @@
import pytest
@pytest.mark.ql_test(expected=".default-filters.expected")
def test_default_filters(codeql, actions, check_source_archive):
check_source_archive.expected_suffix = ".default-filters.expected"
codeql.database.create(source_root="src")
@pytest.mark.ql_test(expected=".paths-only.expected")
def test_config_paths_only(codeql, actions):
codeql.database.create(source_root="src", codescanning_config="codeql-config.paths-only.yml")
@pytest.mark.ql_test(expected=".paths-ignore-only.expected")
def test_config_paths_ignore_only(codeql, actions):
codeql.database.create(source_root="src", codescanning_config="codeql-config.paths-ignore-only.yml")
@pytest.mark.ql_test(expected=".paths-and-paths-ignore.expected")
def test_config_paths_and_paths_ignore(codeql, actions):
codeql.database.create(source_root="src", codescanning_config="codeql-config.paths-and-paths-ignore.yml")

4
actions/ql/lib/CHANGELOG.md
View File

@@ -1,3 +1,7 @@
## 0.4.7
No user-facing changes.
## 0.4.6
### Bug Fixes

3
actions/ql/lib/change-notes/released/0.4.7.md Normal file
View File

@@ -0,0 +1,3 @@
## 0.4.7
No user-facing changes.

2
actions/ql/lib/codeql-pack.release.yml
View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.4.6
lastReleaseVersion: 0.4.7

2
actions/ql/lib/qlpack.yml
View File

@@ -1,5 +1,5 @@
name: codeql/actions-all
version: 0.4.7-dev
version: 0.4.8-dev
library: true
warnOnImplicitThis: true
dependencies:

6
actions/ql/src/CHANGELOG.md
View File

@@ -1,3 +1,9 @@
## 0.5.4
### Bug Fixes
* Alerts produced by the query `actions/missing-workflow-permissions` now include a minimal set of recommended permissions in the alert message, based on well-known actions seen within the workflow file.
## 0.5.3
### Bug Fixes

2
actions/ql/src/Security/CWE-077/EnvVarInjectionMedium.md
View File

@@ -109,7 +109,7 @@ An attacker could craft a malicious artifact that writes dangerous environment v
### Exploitation
An attacker is be able to run arbitrary code by injecting environment variables such as `LD_PRELOAD`, `BASH_ENV`, etc.
An attacker would be able to run arbitrary code by injecting environment variables such as `LD_PRELOAD`, `BASH_ENV`, etc.
## References

2
actions/ql/src/Security/CWE-275/MissingActionsPermissions.ql
View File

@@ -1,6 +1,6 @@
/**
* @name Workflow does not contain permissions
* @description Workflows should contain permissions to provide a clear understanding has permissions to run the workflow.
* @description Workflows should contain explicit permissions to restrict the scope of the default GITHUB_TOKEN.
* @kind problem
* @security-severity 5.0
* @problem.severity warning

1
actions/ql/src/Security/CWE-312/ExcessiveSecretsExposure.ql
View File

@@ -3,6 +3,7 @@
* @description All organization and repository secrets are passed to the workflow runner.
* @kind problem
* @precision high
* @security-severity 5.0
* @problem.severity warning
* @id actions/excessive-secrets-exposure
* @tags actions

4
actions/ql/src/Security/CWE-312/UnmaskedSecretExposure.md
View File

@@ -2,11 +2,11 @@
## Description
Secrets derived from other secrets are not know to the workflow runner and therefore not masked unless explicitly registered.
Secrets derived from other secrets are not known to the workflow runner, and therefore are not masked unless explicitly registered.
## Recommendations
Avoid defining non-plain secrets. For example, do not define a new secret containing a JSON object and then read properties out of it from the workflow since these read values will not be masked by the workflow runner.
Avoid defining non-plain secrets. For example, do not define a new secret containing a JSON object and then read properties out of it from the workflow, since these read values will not be masked by the workflow runner.
## Examples

4
actions/ql/src/change-notes/2025-04-14-excessive-secrets-exposure-security-severity.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: fix
---
* Assigned a `security-severity` to the query `actions/excessive-secrets-exposure`.

7
actions/ql/src/change-notes/2025-02-04-suggest-actions-permissions.md → actions/ql/src/change-notes/released/0.5.4.md
View File

@@ -1,4 +1,5 @@
---
category: fix
---
## 0.5.4
### Bug Fixes
* Alerts produced by the query `actions/missing-workflow-permissions` now include a minimal set of recommended permissions in the alert message, based on well-known actions seen within the workflow file.

2
actions/ql/src/codeql-pack.release.yml
View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.5.3
lastReleaseVersion: 0.5.4

2
actions/ql/src/qlpack.yml
View File

@@ -1,5 +1,5 @@
name: codeql/actions-queries
version: 0.5.4-dev
version: 0.5.5-dev
library: false
warnOnImplicitThis: true
groups: [actions, queries]

2446
cpp/downgrades/0f0a390468a5eb43d1dc72937c028070b106bf53/old.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

2444
cpp/downgrades/0f0a390468a5eb43d1dc72937c028070b106bf53/semmlecode.cpp.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

3
cpp/downgrades/0f0a390468a5eb43d1dc72937c028070b106bf53/upgrade.properties Normal file
View File

@@ -0,0 +1,3 @@
description: Add a new predicate `isVla()` to the `ArrayType` class
compatibility: full
type_is_vla.rel: delete

11
cpp/downgrades/2e2d805ef93d060b813403cb9b51dc72455a4c68/aggregate_array_init.ql Normal file
View File

@@ -0,0 +1,11 @@
class Expr extends @expr {
string toString() { none() }
}
class AggregateLiteral extends Expr, @aggregateliteral {
override string toString() { none() }
}
from AggregateLiteral aggregate, Expr initializer, int element_index, int position
where aggregate_array_init(aggregate, initializer, element_index, position, _)
select aggregate, initializer, element_index, position

15
cpp/downgrades/2e2d805ef93d060b813403cb9b51dc72455a4c68/aggregate_field_init.ql Normal file
View File

@@ -0,0 +1,15 @@
class Expr extends @expr {
string toString() { none() }
}
class AggregateLiteral extends Expr, @aggregateliteral {
override string toString() { none() }
}
class MemberVariable extends @membervariable {
string toString() { none() }
}
from AggregateLiteral aggregate, Expr initializer, MemberVariable field, int position
where aggregate_field_init(aggregate, initializer, field, position, _)
select aggregate, initializer, field, position

2448
cpp/downgrades/2e2d805ef93d060b813403cb9b51dc72455a4c68/old.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

2446
cpp/downgrades/2e2d805ef93d060b813403cb9b51dc72455a4c68/semmlecode.cpp.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

4
cpp/downgrades/2e2d805ef93d060b813403cb9b51dc72455a4c68/upgrade.properties Normal file
View File

@@ -0,0 +1,4 @@
description: add `hasDesignator` predicate to `ArrayOrVectorAggregateLiteral` and `ClassAggregateLiteral`
compatibility: backwards
aggregate_array_init.rel: run aggregate_array_init.qlo
aggregate_field_init.rel: run aggregate_field_init.qlo

11
cpp/downgrades/9a7c3c14c1076f64b871719117a558733d987b48/decltypes.ql Normal file
View File

@@ -0,0 +1,11 @@
class Type extends @type {
string toString() { none() }
}
class Expr extends @expr {
string toString() { none() }
}
from Type decltype, Expr expr, Type basetype, boolean parentheses
where decltypes(decltype, expr, _, basetype, parentheses)
select decltype, expr, basetype, parentheses

19
cpp/downgrades/9a7c3c14c1076f64b871719117a558733d987b48/derivedtypes.ql Normal file
View File

@@ -0,0 +1,19 @@
class Type extends @type {
string toString() { none() }
}
predicate derivedType(Type type, string name, int kind, Type type_id) {
derivedtypes(type, name, kind, type_id)
}
predicate typeTransformation(Type type, string name, int kind, Type type_id) {
type_operators(type, _, _, type_id) and
name = "" and
kind = 3 // @type_with_specifiers
}
from Type type, string name, int kind, Type type_id
where
derivedType(type, name, kind, type_id) or
typeTransformation(type, name, kind, type_id)
select type, name, kind, type_id

2491
cpp/downgrades/9a7c3c14c1076f64b871719117a558733d987b48/old.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

2448
cpp/downgrades/9a7c3c14c1076f64b871719117a558733d987b48/semmlecode.cpp.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

5
cpp/downgrades/9a7c3c14c1076f64b871719117a558733d987b48/upgrade.properties Normal file
View File

@@ -0,0 +1,5 @@
description: Support C23 typeof and typeof_unqual
compatibility: backwards
decltypes.rel: run decltypes.qlo
derivedtypes.rel: run derivedtypes.qlo
type_operators.rel: delete

7
cpp/ql/lib/CHANGELOG.md
View File

@@ -1,3 +1,10 @@
## 4.2.0
### New Features
* Calling conventions explicitly specified on function declarations (`__cdecl`, `__stdcall`, `__fastcall`, etc.) are now represented as specifiers of those declarations.
* A new class `CallingConventionSpecifier` extending the `Specifier` class was introduced, which represents explicitly specified calling conventions.
## 4.1.0
### New Features

4
cpp/ql/lib/change-notes/2025-04-14-variable-length-arrays.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: feature
---
* Added the `isVla()` predicate to the `ArrayType` class. This allows queries to identify variable-length arrays (VLAs).

4
cpp/ql/lib/change-notes/2025-04-15-field-array-designator.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: feature
---
* Introduced `hasDesignator()` predicates to distinguish between designated and positional initializations for both struct/union fields and array elements.

5
cpp/ql/lib/change-notes/2025-04-23-typeof.md Normal file
View File

@@ -0,0 +1,5 @@
---
category: feature
---
* New classes `TypeofType`, `TypeofExprType`, and `TypeofTypeType` were introduced, which represent the C23 `typeof` and `typeof_unqual` operators. The `TypeofExprType` class represents the variant taking an expression as its argument. The `TypeofTypeType` class represents the variant taking a type as its argument.
* A new class `IntrinsicTransformedType` was introduced, which represents the type transforming intrinsics supported by clang, gcc, and MSVC.

7
cpp/ql/lib/change-notes/2025-03-31-calling-convention.md → cpp/ql/lib/change-notes/released/4.2.0.md
View File

@@ -1,5 +1,6 @@
---
category: feature
---
## 4.2.0
### New Features
* Calling conventions explicitly specified on function declarations (`__cdecl`, `__stdcall`, `__fastcall`, etc.) are now represented as specifiers of those declarations.
* A new class `CallingConventionSpecifier` extending the `Specifier` class was introduced, which represents explicitly specified calling conventions.

2
cpp/ql/lib/codeql-pack.release.yml
View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 4.1.0
lastReleaseVersion: 4.2.0

5
cpp/ql/lib/ext/generated/empty.model.yml Normal file
View File

@@ -0,0 +1,5 @@
extensions:
- addsTo:
pack: codeql/cpp-all
extensible: summaryModel
data: []

3
cpp/ql/lib/qlpack.yml
View File

@@ -1,5 +1,5 @@
name: codeql/cpp-all
version: 4.1.1-dev
version: 4.2.1-dev
groups: cpp
dbscheme: semmlecode.cpp.dbscheme
extractor: cpp
@@ -16,6 +16,7 @@ dependencies:
codeql/xml: ${workspace}
dataExtensions:
- ext/*.model.yml
- ext/generated/*.model.yml
- ext/deallocation/*.model.yml
- ext/allocation/*.model.yml
warnOnImplicitThis: true

24
cpp/ql/lib/semmle/code/cpp/Print.qll
View File

@@ -176,6 +176,30 @@ private class DecltypeDumpType extends DumpType, Decltype {
}
}
private class TypeofDumpType extends DumpType, TypeofType {
override string getTypeSpecifier() { result = this.getBaseType().(DumpType).getTypeSpecifier() }
override string getDeclaratorPrefix() {
result = this.getBaseType().(DumpType).getDeclaratorPrefix()
}
override string getDeclaratorSuffix() {
result = this.getBaseType().(DumpType).getDeclaratorSuffix()
}
}
private class IntrinsicTransformedDumpType extends DumpType, IntrinsicTransformedType {
override string getTypeSpecifier() { result = this.getBaseType().(DumpType).getTypeSpecifier() }
override string getDeclaratorPrefix() {
result = this.getBaseType().(DumpType).getDeclaratorPrefix()
}
override string getDeclaratorSuffix() {
result = this.getBaseType().(DumpType).getDeclaratorSuffix()
}
}
private class PointerIshDumpType extends DerivedDumpType {
PointerIshDumpType() {
this instanceof PointerType or

233
cpp/ql/lib/semmle/code/cpp/Type.qll
View File

@@ -92,8 +92,9 @@ class Type extends Locatable, @type {
/**
* Gets this type after typedefs have been resolved.
*
* The result of this predicate will be the type itself, except in the case of a TypedefType or a Decltype,
* in which case the result will be type which results from (possibly recursively) resolving typedefs.
* The result of this predicate will be the type itself, except in the case of a TypedefType, a Decltype,
* or a TypeofType, in which case the result will be type which results from (possibly recursively)
* resolving typedefs.
*/
pragma[nomagic]
Type getUnderlyingType() { result = this }
@@ -1117,18 +1118,20 @@ class DerivedType extends Type, @derivedtype {
* decltype(a) b;
* ```
*/
class Decltype extends Type, @decltype {
class Decltype extends Type {
Decltype() { decltypes(underlyingElement(this), _, 0, _, _) }
override string getAPrimaryQlClass() { result = "Decltype" }
/**
* The expression whose type is being obtained by this decltype.
* Gets the expression whose type is being obtained by this decltype.
*/
Expr getExpr() { decltypes(underlyingElement(this), unresolveElement(result), _, _) }
Expr getExpr() { decltypes(underlyingElement(this), unresolveElement(result), _, _, _) }
/**
* The type immediately yielded by this decltype.
* Gets the type immediately yielded by this decltype.
*/
Type getBaseType() { decltypes(underlyingElement(this), _, unresolveElement(result), _) }
Type getBaseType() { decltypes(underlyingElement(this), _, _, unresolveElement(result), _) }
/**
* Whether an extra pair of parentheses around the expression would change the semantics of this decltype.
@@ -1142,7 +1145,7 @@ class Decltype extends Type, @decltype {
* ```
* Please consult the C++11 standard for more details.
*/
predicate parenthesesWouldChangeMeaning() { decltypes(underlyingElement(this), _, _, true) }
predicate parenthesesWouldChangeMeaning() { decltypes(underlyingElement(this), _, _, _, true) }
override Type getUnderlyingType() { result = this.getBaseType().getUnderlyingType() }
@@ -1183,6 +1186,215 @@ class Decltype extends Type, @decltype {
}
}
/**
* An instance of the C23 `typeof` or `typeof_unqual` operator. For example:
* ```
* int a;
* typeof(a) b;
* typeof_unqual(const int) b;
* ```
*/
class TypeofType extends Type {
TypeofType() {
decltypes(underlyingElement(this), _, 1, _, _) or
type_operators(underlyingElement(this), _, 0, _)
}
/**
* Gets the type immediately yielded by this typeof.
*/
Type getBaseType() {
decltypes(underlyingElement(this), _, _, unresolveElement(result), _)
or
type_operators(underlyingElement(this), _, _, unresolveElement(result))
}
override Type getUnderlyingType() { result = this.getBaseType().getUnderlyingType() }
override Type stripTopLevelSpecifiers() { result = this.getBaseType().stripTopLevelSpecifiers() }
override Type stripType() { result = this.getBaseType().stripType() }
override Type resolveTypedefs() { result = this.getBaseType().resolveTypedefs() }
override string toString() { result = "typeof(...)" }
override string getName() { none() }
override int getSize() { result = this.getBaseType().getSize() }
override int getAlignment() { result = this.getBaseType().getAlignment() }
override int getPointerIndirectionLevel() {
result = this.getBaseType().getPointerIndirectionLevel()
}
override string explain() {
result = "typeof resulting in {" + this.getBaseType().explain() + "}"
}
override predicate involvesReference() { this.getBaseType().involvesReference() }
override predicate involvesTemplateParameter() { this.getBaseType().involvesTemplateParameter() }
override predicate isDeeplyConst() { this.getBaseType().isDeeplyConst() }
override predicate isDeeplyConstBelow() { this.getBaseType().isDeeplyConstBelow() }
override Specifier internal_getAnAdditionalSpecifier() {
result = this.getBaseType().getASpecifier()
}
}
/**
* An instance of the C23 `typeof` or `typeof_unqual` operator taking an expression
* as its argument. For example:
* ```
* int a;
* typeof(a) b;
* ```
*/
class TypeofExprType extends TypeofType {
TypeofExprType() { decltypes(underlyingElement(this), _, 1, _, _) }
override string getAPrimaryQlClass() { result = "TypeofExprType" }
/**
* Gets the expression whose type is being obtained by this typeof.
*/
Expr getExpr() { decltypes(underlyingElement(this), unresolveElement(result), _, _, _) }
override Location getLocation() { result = this.getExpr().getLocation() }
}
/**
* A type obtained by C23 `typeof` or `typeof_unqual` operator taking a type as its
* argument. For example:
* ```
* typeof_unqual(const int) b;
* ```
*/
class TypeofTypeType extends TypeofType {
TypeofTypeType() { type_operators(underlyingElement(this), _, 0, _) }
/**
* Gets the expression whose type is being obtained by this typeof.
*/
Type getType() { type_operators(underlyingElement(this), unresolveElement(result), _, _) }
override string getAPrimaryQlClass() { result = "TypeofTypeType" }
override string toString() { result = "typeof(...)" }
}
/**
* A type obtained by applying a type transforming intrinsic. For example:
* ```
* __make_unsigned(int) x;
* ```
*/
class IntrinsicTransformedType extends Type {
int intrinsic;
IntrinsicTransformedType() {
type_operators(underlyingElement(this), _, intrinsic, _) and
intrinsic in [1 .. 19]
}
override string getAPrimaryQlClass() { result = "IntrinsicTransformedType" }
override string toString() { result = this.getIntrinsicName() + "(...)" }
/**
* Gets the type immediately yielded by this transformation.
*/
Type getBaseType() { type_operators(underlyingElement(this), _, _, unresolveElement(result)) }
/**
* Gets the type that is transformed.
*/
Type getType() { type_operators(underlyingElement(this), unresolveElement(result), _, _) }
/**
* Gets the name of the intrinsic used to transform the type.
*/
string getIntrinsicName() {
intrinsic = 1 and result = "__underlying_type"
or
intrinsic = 2 and result = "__bases"
or
intrinsic = 3 and result = "__direct_bases"
or
intrinsic = 4 and result = "__add_lvalue_reference"
or
intrinsic = 5 and result = "__add_pointer"
or
intrinsic = 6 and result = "__add_rvalue_reference"
or
intrinsic = 7 and result = "__decay"
or
intrinsic = 8 and result = "__make_signed"
or
intrinsic = 9 and result = "__make_unsigned"
or
intrinsic = 10 and result = "__remove_all_extents"
or
intrinsic = 11 and result = "__remove_const"
or
intrinsic = 12 and result = "__remove_cv"
or
intrinsic = 13 and result = "__remove_cvref"
or
intrinsic = 14 and result = "__remove_extent"
or
intrinsic = 15 and result = "__remove_pointer"
or
intrinsic = 16 and result = "__remove_reference_t"
or
intrinsic = 17 and result = "__remove_restrict"
or
intrinsic = 18 and result = "__remove_volatile"
or
intrinsic = 19 and result = "__remove_reference"
}
override Type getUnderlyingType() { result = this.getBaseType().getUnderlyingType() }
override Type stripTopLevelSpecifiers() { result = this.getBaseType().stripTopLevelSpecifiers() }
override Type stripType() { result = this.getBaseType().stripType() }
override Type resolveTypedefs() { result = this.getBaseType().resolveTypedefs() }
override string getName() { none() }
override int getSize() { result = this.getBaseType().getSize() }
override int getAlignment() { result = this.getBaseType().getAlignment() }
override int getPointerIndirectionLevel() {
result = this.getBaseType().getPointerIndirectionLevel()
}
override string explain() {
result =
"application of " + this.getIntrinsicName() + " resulting in {" + this.getBaseType().explain()
+ "}"
}
override predicate involvesReference() { this.getBaseType().involvesReference() }
override predicate involvesTemplateParameter() { this.getBaseType().involvesTemplateParameter() }
override predicate isDeeplyConst() { this.getBaseType().isDeeplyConst() }
override predicate isDeeplyConstBelow() { this.getBaseType().isDeeplyConstBelow() }
override Specifier internal_getAnAdditionalSpecifier() {
result = this.getBaseType().getASpecifier()
}
}
/**
* A C/C++ pointer type. See 4.9.1.
* ```
@@ -1369,6 +1581,11 @@ class ArrayType extends DerivedType {
override predicate isDeeplyConst() { this.getBaseType().isDeeplyConst() } // No such thing as a const array type
override predicate isDeeplyConstBelow() { this.getBaseType().isDeeplyConst() }
/**
* Holds if this array is a variable-length array (VLA).
*/
predicate isVla() { type_is_vla(underlyingElement(this)) }
}
/**

24
cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
View File

@@ -465,7 +465,7 @@ private predicate isFunctionConstructedFrom(Function f, Function templateFunc) {
}
/** Gets the fully templated version of `f`. */
private Function getFullyTemplatedFunction(Function f) {
Function getFullyTemplatedFunction(Function f) {
not f.isFromUninstantiatedTemplate(_) and
(
exists(Class c, Class templateClass, int i |
@@ -559,12 +559,15 @@ private string getTypeName(Type t, boolean needsSpace) {
/**
* Gets a type name for the `n`'th parameter of `f` without any template
* arguments. The result may be a string representing a type for which the
* typedefs have been resolved.
* arguments.
*
* If `canonical = false` then the result may be a string representing a type
* for which the typedefs have been resolved. If `canonical = true` then the
* result will be a string representing a type without resolving `typedefs`.
*/
bindingset[f]
pragma[inline_late]
string getParameterTypeWithoutTemplateArguments(Function f, int n) {
string getParameterTypeWithoutTemplateArguments(Function f, int n, boolean canonical) {
exists(string s, string base, string specifiers, Type t |
t = f.getParameter(n).getType() and
// The name of the string can either be the possibly typedefed name
@@ -572,14 +575,19 @@ string getParameterTypeWithoutTemplateArguments(Function f, int n) {
// `getTypeName(t, _)` is almost equal to `t.resolveTypedefs().getName()`,
// except that `t.resolveTypedefs()` doesn't have a result when the
// resulting type doesn't appear in the database.
s = [t.getName(), getTypeName(t, _)] and
(
s = t.getName() and canonical = true
or
s = getTypeName(t, _) and canonical = false
) and
parseAngles(s, base, _, specifiers) and
result = base + specifiers
)
or
f.isVarargs() and
n = f.getNumberOfParameters() and
result = "..."
result = "..." and
canonical = true
}
/**
@@ -590,7 +598,7 @@ private string getTypeNameWithoutFunctionTemplates(Function f, int n, int remain
exists(Function templateFunction |
templateFunction = getFullyTemplatedFunction(f) and
remaining = templateFunction.getNumberOfTemplateArguments() and
result = getParameterTypeWithoutTemplateArguments(templateFunction, n)
result = getParameterTypeWithoutTemplateArguments(templateFunction, n, _)
)
or
exists(string mid, TypeTemplateParameter tp, Function templateFunction |
@@ -627,7 +635,7 @@ private string getTypeNameWithoutClassTemplates(Function f, int n, int remaining
}
/** Gets the string representation of the `i`'th parameter of `c`. */
private string getParameterTypeName(Function c, int i) {
string getParameterTypeName(Function c, int i) {
result = getTypeNameWithoutClassTemplates(c, i, 0)
}

2
cpp/ql/lib/semmle/code/cpp/exprs/Expr.qll
View File

@@ -310,6 +310,8 @@ class Expr extends StmtParent, @expr {
or
exists(Decltype d | d.getExpr() = this.getParentWithConversions*())
or
exists(TypeofExprType t | t.getExpr() = this.getParentWithConversions*())
or
exists(ConstexprIfStmt constIf |
constIf.getControllingExpr() = this.getParentWithConversions*()
)

38
cpp/ql/lib/semmle/code/cpp/exprs/Literal.qll
View File

@@ -213,7 +213,24 @@ class ClassAggregateLiteral extends AggregateLiteral {
Expr getFieldExpr(Field field, int position) {
field = classType.getAField() and
aggregate_field_init(underlyingElement(this), unresolveElement(result), unresolveElement(field),
position)
position, _)
}
/**
* Holds if the `position`-th initialization of `field` in this aggregate initializer
* uses a designated (e.g., `.x = ...`) rather than a positional initializer.
*
* For example, in:
* ```c
* struct S { int x, y; };
* struct S s = { .x = 1, 2 };
* ```
* - `.x = 1` is a designated initializer, therefore `hasDesignator(x, 0)` holds.
* - `2` is a positional initializer for `s.y`, therefore `hasDesignator(y, 1)` does not hold.
*/
predicate hasDesignator(Field field, int position) {
field = classType.getAField() and
aggregate_field_init(underlyingElement(this), _, unresolveElement(field), position, true)
}
/**
@@ -304,7 +321,24 @@ class ArrayOrVectorAggregateLiteral extends AggregateLiteral {
* - `a.getElementExpr(0, 2)` gives `789`.
*/
Expr getElementExpr(int elementIndex, int position) {
aggregate_array_init(underlyingElement(this), unresolveElement(result), elementIndex, position)
aggregate_array_init(underlyingElement(this), unresolveElement(result), elementIndex, position,
_)
}
/**
* Holds if the `position`-th initialization of the array element at `elementIndex`
* in this aggregate initializer uses a designated (e.g., `[0] = ...`) rather than
* a positional initializer.
*
* For example, in:
* ```c
* int x[] = { [0] = 1, 2 };
* ```
* - `[0] = 1` is a designated initializer, therefore `hasDesignator(0, 0)` holds.
* - `2` is a positional initializer for `x[1]`, therefore `hasDesignator(1, 1)` does not hold.
*/
predicate hasDesignator(int elementIndex, int position) {
aggregate_array_init(underlyingElement(this), _, elementIndex, position, true)
}
/**

46
cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
View File

@@ -371,7 +371,7 @@ private class PrimaryArgumentNode extends ArgumentNode, OperandNode {
PrimaryArgumentNode() { exists(CallInstruction call | op = call.getAnArgumentOperand()) }
override predicate argumentOf(DataFlowCall call, ArgumentPosition pos) {
op = call.getArgumentOperand(pos.(DirectPosition).getIndex())
op = call.getArgumentOperand(pos.(DirectPosition).getArgumentIndex())
}
}
@@ -410,8 +410,16 @@ class ParameterPosition = Position;
class ArgumentPosition = Position;
abstract class Position extends TPosition {
/** Gets a textual representation of this position. */
abstract string toString();
/**
* Gets the argument index of this position. The qualifier of a call has
* argument index `-1`.
*/
abstract int getArgumentIndex();
/** Gets the indirection index of this position. */
abstract int getIndirectionIndex();
}
@@ -428,7 +436,7 @@ class DirectPosition extends Position, TDirectPosition {
result = index.toString()
}
int getIndex() { result = index }
override int getArgumentIndex() { result = index }
final override int getIndirectionIndex() { result = 0 }
}
@@ -445,16 +453,29 @@ class IndirectionPosition extends Position, TIndirectionPosition {
else result = repeatStars(indirectionIndex) + argumentIndex.toString()
}
int getArgumentIndex() { result = argumentIndex }
override int getArgumentIndex() { result = argumentIndex }
final override int getIndirectionIndex() { result = indirectionIndex }
}
newtype TPosition =
TDirectPosition(int argumentIndex) { exists(any(CallInstruction c).getArgument(argumentIndex)) } or
TDirectPosition(int argumentIndex) {
exists(any(CallInstruction c).getArgument(argumentIndex))
or
// Handle the rare case where there is a function definition but no call to
// the function.
exists(any(Cpp::Function f).getParameter(argumentIndex))
} or
TIndirectionPosition(int argumentIndex, int indirectionIndex) {
Ssa::hasIndirectOperand(any(CallInstruction call).getArgumentOperand(argumentIndex),
indirectionIndex)
or
// Handle the rare case where there is a function definition but no call to
// the function.
exists(Cpp::Function f, Cpp::Parameter p |
p = f.getParameter(argumentIndex) and
indirectionIndex = [1 .. Ssa::getMaxIndirectionsForType(p.getUnspecifiedType()) - 1]
)
}
private newtype TReturnKind =
@@ -501,6 +522,15 @@ class ReturnKind extends TReturnKind {
/** Gets a textual representation of this return kind. */
abstract string toString();
/** Holds if this `ReturnKind` is generated from a `return` statement. */
abstract predicate isNormalReturn();
/**
* Holds if this `ReturnKind` is generated from a write to the parameter with
* index `argumentIndex`
*/
abstract predicate isIndirectReturn(int argumentIndex);
}
/**
@@ -514,6 +544,10 @@ class NormalReturnKind extends ReturnKind, TNormalReturnKind {
override int getIndirectionIndex() { result = indirectionIndex }
override string toString() { result = "indirect return" }
override predicate isNormalReturn() { any() }
override predicate isIndirectReturn(int argumentIndex) { none() }
}
/**
@@ -528,6 +562,10 @@ private class IndirectReturnKind extends ReturnKind, TIndirectReturnKind {
override int getIndirectionIndex() { result = indirectionIndex }
override string toString() { result = "indirect outparam[" + argumentIndex.toString() + "]" }
override predicate isNormalReturn() { none() }
override predicate isIndirectReturn(int argumentIndex_) { argumentIndex_ = argumentIndex }
}
/** A data flow node that occurs as the result of a `ReturnStmt`. */

6
cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
View File

@@ -1445,7 +1445,7 @@ private class ExplicitParameterInstructionNode extends AbstractExplicitParameter
ExplicitParameterInstructionNode() { exists(instr.getParameter()) }
override predicate isSourceParameterOf(Function f, ParameterPosition pos) {
f.getParameter(pos.(DirectPosition).getIndex()) = instr.getParameter()
f.getParameter(pos.(DirectPosition).getArgumentIndex()) = instr.getParameter()
}
override string toStringImpl() { result = instr.getParameter().toString() }
@@ -1460,7 +1460,7 @@ class ThisParameterInstructionNode extends AbstractExplicitParameterNode,
ThisParameterInstructionNode() { instr.getIRVariable() instanceof IRThisVariable }
override predicate isSourceParameterOf(Function f, ParameterPosition pos) {
pos.(DirectPosition).getIndex() = -1 and
pos.(DirectPosition).getArgumentIndex() = -1 and
instr.getEnclosingFunction() = f
}
@@ -1494,7 +1494,7 @@ private class DirectBodyLessParameterNode extends AbstractExplicitParameterNode,
override predicate isSourceParameterOf(Function f, ParameterPosition pos) {
this.getFunction() = f and
f.getParameter(pos.(DirectPosition).getIndex()) = p
f.getParameter(pos.(DirectPosition).getArgumentIndex()) = p
}
override Parameter getParameter() { result = p }

4
cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/TaintTrackingUtil.qll
View File

@@ -229,11 +229,11 @@ private module SpeculativeTaintFlow {
not exists(DataFlowDispatch::viableCallable(call)) and
src.(DataFlowPrivate::ArgumentNode).argumentOf(call, argpos)
|
not argpos.(DirectPosition).getIndex() = -1 and
not argpos.(DirectPosition).getArgumentIndex() = -1 and
sink.(PostUpdateNode)
.getPreUpdateNode()
.(DataFlowPrivate::ArgumentNode)
.argumentOf(call, any(DirectPosition qualpos | qualpos.getIndex() = -1))
.argumentOf(call, any(DirectPosition qualpos | qualpos.getArgumentIndex() = -1))
or
sink.(DataFlowPrivate::OutNode).getCall() = call
)

8
cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/SideEffects.qll
View File

@@ -16,6 +16,10 @@ private predicate isDeeplyConst(Type t) {
or
isDeeplyConst(t.(Decltype).getBaseType())
or
isDeeplyConst(t.(TypeofType).getBaseType())
or
isDeeplyConst(t.(IntrinsicTransformedType).getBaseType())
or
isDeeplyConst(t.(ReferenceType).getBaseType())
or
exists(SpecifiedType specType | specType = t |
@@ -36,6 +40,10 @@ private predicate isDeeplyConstBelow(Type t) {
or
isDeeplyConstBelow(t.(Decltype).getBaseType())
or
isDeeplyConstBelow(t.(TypeofType).getBaseType())
or
isDeeplyConstBelow(t.(IntrinsicTransformedType).getBaseType())
or
isDeeplyConst(t.(PointerType).getBaseType())
or
isDeeplyConst(t.(ReferenceType).getBaseType())

59
cpp/ql/lib/semmlecode.cpp.dbscheme
View File

@@ -743,15 +743,17 @@ typedefbase(
);
/**
* An instance of the C++11 `decltype` operator. For example:
* An instance of the C++11 `decltype` operator or C23 `typeof`/`typeof_unqual`
* operator taking an expression as its argument. For example:
* ```
* int a;
* decltype(1+a) b;
* typeof(1+a) c;
* ```
* Here `expr` is `1+a`.
*
* Sometimes an additional pair of parentheses around the expression
* would change the semantics of this decltype, e.g.
* changes the semantics of the decltype, e.g.
* ```
* struct A { double x; };
* const A* a = new A();
@@ -761,14 +763,55 @@ typedefbase(
* (Please consult the C++11 standard for more details).
* `parentheses_would_change_meaning` is `true` iff that is the case.
*/
/*
case @decltype.kind of
| 0 = @decltype
| 1 = @typeof // The frontend does not differentiate between typeof and typeof_unqual
;
*/
#keyset[id, expr]
decltypes(
int id: @decltype,
int expr: @expr ref,
int kind: int ref,
int base_type: @type ref,
boolean parentheses_would_change_meaning: boolean ref
);
/*
case @type_operator.kind of
| 0 = @typeof // The frontend does not differentiate between typeof and typeof_unqual
| 1 = @underlying_type
| 2 = @bases
| 3 = @direct_bases
| 4 = @add_lvalue_reference
| 5 = @add_pointer
| 6 = @add_rvalue_reference
| 7 = @decay
| 8 = @make_signed
| 9 = @make_unsigned
| 10 = @remove_all_extents
| 11 = @remove_const
| 12 = @remove_cv
| 13 = @remove_cvref
| 14 = @remove_extent
| 15 = @remove_pointer
| 16 = @remove_reference_t
| 17 = @remove_restrict
| 18 = @remove_volatile
| 19 = @remove_reference
;
*/
type_operators(
unique int id: @type_operator,
int arg_type: @type ref,
int kind: int ref,
int base_type: @type ref
)
/*
case @usertype.kind of
| 0 = @unknown_usertype
@@ -1103,10 +1146,10 @@ stmtattributes(
@type = @builtintype
| @derivedtype
| @usertype
/* TODO | @fixedpointtype */
| @routinetype
| @ptrtomember
| @decltype;
| @decltype
| @type_operator;
unspecifiedtype(
unique int type_id: @type ref,
@@ -2039,7 +2082,8 @@ aggregate_field_init(
int aggregate: @aggregateliteral ref,
int initializer: @expr ref,
int field: @membervariable ref,
int position: int ref
int position: int ref,
boolean is_designated: boolean ref
);
/**
@@ -2051,7 +2095,8 @@ aggregate_array_init(
int aggregate: @aggregateliteral ref,
int initializer: @expr ref,
int element_index: int ref,
int position: int ref
int position: int ref,
boolean is_designated: boolean ref
);
@ctorinit = @ctordirectinit
@@ -2178,6 +2223,8 @@ variable_vla(
int decl: @stmt_vla_decl ref
);
type_is_vla(unique int type_id: @derivedtype ref)
if_initialization(
unique int if_stmt: @stmt_if ref,
int init_id: @stmt ref

6346
cpp/ql/lib/semmlecode.cpp.dbscheme.stats
View File

File diff suppressed because it is too large Load Diff

11
cpp/ql/lib/upgrades/0f0a390468a5eb43d1dc72937c028070b106bf53/aggregate_array_init.ql Normal file
View File

@@ -0,0 +1,11 @@
class Expr extends @expr {
string toString() { none() }
}
class AggregateLiteral extends Expr, @aggregateliteral {
override string toString() { none() }
}
from AggregateLiteral aggregate, Expr initializer, int element_index, int position
where aggregate_array_init(aggregate, initializer, element_index, position)
select aggregate, initializer, element_index, position, false

15
cpp/ql/lib/upgrades/0f0a390468a5eb43d1dc72937c028070b106bf53/aggregate_field_init.ql Normal file
View File

@@ -0,0 +1,15 @@
class Expr extends @expr {
string toString() { none() }
}
class AggregateLiteral extends Expr, @aggregateliteral {
override string toString() { none() }
}
class MemberVariable extends @membervariable {
string toString() { none() }
}
from AggregateLiteral aggregate, Expr initializer, MemberVariable field, int position
where aggregate_field_init(aggregate, initializer, field, position)
select aggregate, initializer, field, position, false

2446
cpp/ql/lib/upgrades/0f0a390468a5eb43d1dc72937c028070b106bf53/old.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

2448
cpp/ql/lib/upgrades/0f0a390468a5eb43d1dc72937c028070b106bf53/semmlecode.cpp.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

4
cpp/ql/lib/upgrades/0f0a390468a5eb43d1dc72937c028070b106bf53/upgrade.properties Normal file
View File

@@ -0,0 +1,4 @@
description: add `hasDesignator` predicate to `ArrayOrVectorAggregateLiteral` and `ClassAggregateLiteral`
compatibility: backwards
aggregate_array_init.rel: run aggregate_array_init.qlo
aggregate_field_init.rel: run aggregate_field_init.qlo

11
cpp/ql/lib/upgrades/2e2d805ef93d060b813403cb9b51dc72455a4c68/decltypes.ql Normal file
View File

@@ -0,0 +1,11 @@
class Type extends @type {
string toString() { none() }
}
class Expr extends @expr {
string toString() { none() }
}
from Type decltype, Expr expr, Type basetype, boolean parentheses
where decltypes(decltype, expr, basetype, parentheses)
select decltype, expr, 0, basetype, parentheses

2448
cpp/ql/lib/upgrades/2e2d805ef93d060b813403cb9b51dc72455a4c68/old.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

2491
cpp/ql/lib/upgrades/2e2d805ef93d060b813403cb9b51dc72455a4c68/semmlecode.cpp.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

3
cpp/ql/lib/upgrades/2e2d805ef93d060b813403cb9b51dc72455a4c68/upgrade.properties Normal file
View File

@@ -0,0 +1,3 @@
description: Support C23 typeof and typeof_unqual
compatibility: partial
decltypes.rel: run decltypes.qlo

2444
cpp/ql/lib/upgrades/e594389175c098d7225683d0fd8cefcc47d84bc1/old.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

2446
cpp/ql/lib/upgrades/e594389175c098d7225683d0fd8cefcc47d84bc1/semmlecode.cpp.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

2
cpp/ql/lib/upgrades/e594389175c098d7225683d0fd8cefcc47d84bc1/upgrade.properties Normal file
View File

@@ -0,0 +1,2 @@
description: Add a new predicate `isVla()` to the `ArrayType` class
compatibility: backwards

4
cpp/ql/src/CHANGELOG.md
View File

@@ -1,3 +1,7 @@
## 1.3.8
No user-facing changes.
## 1.3.7
### Minor Analysis Improvements

1
cpp/ql/src/Likely Bugs/Arithmetic/IntMultToLong.ql
View File

@@ -179,6 +179,7 @@ predicate overflows(MulExpr me, Type t) {
from MulExpr me, Type t1, Type t2
where
not any(Compilation c).buildModeNone() and
t1 = me.getType().getUnderlyingType() and
t2 = me.getConversion().getType().getUnderlyingType() and
t1.getSize() < t2.getSize() and

1
cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArguments.ql
View File

@@ -154,6 +154,7 @@ int sizeof_IntType() { exists(IntType it | result = it.getSize()) }
from FormattingFunctionCall ffc, int n, Expr arg, Type expected, Type actual
where
not any(Compilation c).buildModeNone() and
(
formattingFunctionCallExpectedType(ffc, n, expected) and
formattingFunctionCallActualType(ffc, n, arg, actual) and

6
cpp/ql/src/Likely Bugs/Memory Management/SuspiciousCallToMemset.ql
View File

@@ -47,11 +47,17 @@ Type stripType(Type t) {
or
result = stripType(t.(Decltype).getBaseType())
or
result = stripType(t.(TypeofType).getBaseType())
or
result = stripType(t.(IntrinsicTransformedType).getBaseType())
or
not t instanceof TypedefType and
not t instanceof ArrayType and
not t instanceof ReferenceType and
not t instanceof SpecifiedType and
not t instanceof Decltype and
not t instanceof TypeofType and
not t instanceof IntrinsicTransformedType and
result = t
}

1
cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
View File

@@ -38,6 +38,7 @@ predicate isCompiledAsC(File f) {
from FunctionDeclarationEntry fdeIm, FunctionCall fc
where
not any(Compilation c).buildModeNone() and
isCompiledAsC(fdeIm.getFile()) and
not isFromMacroDefinition(fc) and
fdeIm.isImplicit() and

1
cpp/ql/src/Security/CWE/CWE-190/ComparisonWithWiderType.ql
View File

@@ -51,6 +51,7 @@ int getComparisonSizeAdjustment(Expr e) {
from Loop l, RelationalOperation rel, VariableAccess small, Expr large
where
not any(Compilation c).buildModeNone() and
small = rel.getLesserOperand() and
large = rel.getGreaterOperand() and
rel = l.getCondition().getAChild*() and

4
cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql
View File

@@ -24,10 +24,12 @@ private predicate isCharSzPtrExpr(Expr e) {
from Expr sizeofExpr, Expr e
where
not any(Compilation c).buildModeNone() and
// If we see an addWithSizeof then we expect the type of
// the pointer expression to be `char*` or `void*`. Otherwise it
// is probably a mistake.
addWithSizeof(e, sizeofExpr, _) and not isCharSzPtrExpr(e)
addWithSizeof(e, sizeofExpr, _) and
not isCharSzPtrExpr(e)
select sizeofExpr,
"Suspicious sizeof offset in a pointer arithmetic expression. The type of the pointer is $@.",
e.getFullyConverted().getType() as t, t.toString()

3
cpp/ql/src/change-notes/released/1.3.8.md Normal file
View File

@@ -0,0 +1,3 @@
## 1.3.8
No user-facing changes.

2
cpp/ql/src/codeql-pack.release.yml
View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.3.7
lastReleaseVersion: 1.3.8

2
cpp/ql/src/qlpack.yml
View File

@@ -1,5 +1,5 @@
name: codeql/cpp-queries
version: 1.3.8-dev
version: 1.3.9-dev
groups:
- cpp
- queries

Some files were not shown because too many files have changed in this diff Show More