Merge branch 'master' of github.com:github/codeql into UnmatchableDollar

to make CodeScan happy

python/ql/test/query-tests/Classes/equals-hash/DefineEqualsWhenAddingFields.expected

@@ -1 +1 @@
-| attr_eq_test.py:21:1:21:27 | class BadColorPoint | The class 'BadColorPoint' does not override $@, but adds the new attribute $@. | attr_eq_test.py:10:5:10:28 | Function __eq__ | '__eq__' | attr_eq_test.py:25:9:25:19 | Attribute | _color |
+| attr_eq_test.py:21:1:21:27 | class BadColorPoint | The class 'BadColorPoint' does not override $@, but adds the new attribute $@. | attr_eq_test.py:10:5:10:28 | Function Point.__eq__ | '__eq__' | attr_eq_test.py:25:9:25:19 | Attribute | _color |

python/ql/test/query-tests/Expressions/Regex/test.py

@@ -144,3 +144,10 @@ re.compile(r'(?:(?P<n1>^(?:|x)))')
 
 #Potentially mis-parsed character set
 re.compile(r"\[(?P<txt>[^[]*)\]\((?P<uri>[^)]*)")
+
+#Allow unicode in raw strings
+re.compile(r"[\U00010000-\U0010FFFF]")
+re.compile(r"[\u0000-\uFFFF]")
+
+#Allow unicode names
+re.compile(r"[\N{degree sign}\N{EM DASH}]")

python/ql/test/query-tests/Security/CWE-020/hosttest.py

@@ -17,3 +17,7 @@ def safe(request):
     target = request.args.get('target', '')
     if SAFE_REGEX.match(target):
         return redirect(target)
+
+# FP reported in https://github.com/github/codeql/issues/3712
+# This does not define a regex (but could be used by other code to do so)
+escaped = re.escape("https://www.humblebundle.com/home/library")

python/ql/test/query-tests/Security/CWE-020/urltest.py

@@ -17,16 +17,16 @@ def unsafe2(request):
 
 
 
-#Simplest and safest approach is to use a white-list
+#Simplest and safest approach is to use an allowlist
 
 @app.route('/some/path/good1')
 def safe1(request):
-    whitelist = [
+    allowlist = [
         "example.com/home",
         "example.com/login",
     ]
     target = request.args.get('target', '')
-    if target in whitelist:
+    if target in allowlist:
         return redirect(target)
 
 #More complex example allowing sub-domains.

python/ql/test/query-tests/Security/CWE-327/TestNode.ql

@@ -1,5 +1,5 @@
 import python
-import semmle.python.security.TaintTracking
+import semmle.python.dataflow.TaintTracking
 import python
 import semmle.python.security.SensitiveData
 import semmle.python.security.Crypto

python/ql/test/query-tests/Security/lib/fabric/api.py

@@ -23,3 +23,7 @@ def sudo(command, shell=True, pty=True, combine_stderr=None, user=None,
     quiet=False, warn_only=False, stdout=None, stderr=None, group=None,
     timeout=None, shell_escape=None, capture_buffer_size=None):
     pass
+
+# https://github.com/fabric/fabric/blob/1.14/fabric/tasks.py#L281
+def execute(task, *args, **kwargs):
+    pass

python/ql/test/query-tests/analysis/Consistency/Consistency.qlref

@@ -0,0 +1 @@
+analysis/Consistency.ql

python/ql/test/query-tests/analysis/Sanity/Sanity.qlref

@@ -1 +0,0 @@
-analysis/Sanity.ql