hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-19 18:33:16 +01:00
Code Issues Packages Projects Releases Wiki Activity
82,643 Commits 1,671 Branches 157 Tags
alexet/avoid-path-node-java
Commit Graph

82643 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Anders Schack-Mulligen
273429d14a Java: Accept qltest output 2025-08-05 10:32:53 +02:00
Tom Hvitved
b426d84e1c Merge pull request #20164 from hvitved/rust/fix-bad-join 
Rust: Fix bad join
 2025-08-05 09:55:51 +02:00
Geoffrey White
dcda6db88b Rust: Lets not try to maintain this list. 2025-08-04 19:51:34 +01:00
Geoffrey White
0a49b65887 Rust: Make the rust/cleartext-transmission alert message more consistent with similar queries. 2025-08-04 19:47:33 +01:00
Chuan-kai Lin
e2b8d7b1ea Merge pull request #20166 from github/post-release-prep/codeql-cli-2.22.3 
Post-release preparation for codeql-cli-2.22.3
 2025-08-04 11:38:38 -07:00
Geoffrey White
6c024a5f9e Rust: Remove unnecessary pattern matching in cleartext logging query sinks (probably inherited from another query or language where it is used). 2025-08-04 19:28:40 +01:00
Geoffrey White
eab7481b97 Rust: Accept CWE-312 consistency check failures. 2025-08-04 18:26:09 +01:00
github-actions[bot]
fb4b0aac53 Post-release preparation for codeql-cli-2.22.3 2025-08-04 17:18:08 +00:00
Chuan-kai Lin
da3e5479df Merge pull request #20165 from github/release-prep/2.22.3 
Release preparation for version 2.22.3
codeql-cli/v2.22.3 		2025-08-04 09:19:35 -07:00
Geoffrey White
def655f994 Rust: Accept changes to the CWE-089 test (there are some duplicate results that an existing unmerged PR will address). 2025-08-04 17:15:48 +01:00
Chuan-kai Lin
4df1c12876 Minor CHANGELOG updates 2025-08-04 09:09:25 -07:00
Geoffrey White
b60faadf70 Rust: Change note. 2025-08-04 17:07:58 +01:00
github-actions[bot]
fd82aeb1f8 Release preparation for version 2.22.3 2025-08-04 15:47:57 +00:00
Geoffrey White
836f797def Rust: Accept suite changes. 2025-08-04 16:43:21 +01:00
Tom Hvitved
651e1624a6 Rust: Fix bad join 
```
Evaluated relational algebra for predicate _Crate::Crate.getSourceFile/0#dispred#e7adf9d7_Crate::Generated::Crate.getName/0#dispred#f4d3b3bf_Pa__#join_rhs@5a04a7t0 with tuple counts:
        34471980   ~0%    {3} r1 = JOIN `PathResolution::isSourceFile/1#803de032` WITH `Crate::Crate.getSourceFile/0#dispred#e7adf9d7` CARTESIAN PRODUCT OUTPUT Rhs.0, Lhs.0, Rhs.1
        34471980  ~37%    {4}    | JOIN WITH `Crate::Generated::Crate.getName/0#dispred#f4d3b3bf` ON FIRST 1 OUTPUT Lhs.1, Lhs.2, Rhs.1, _
                          {3}    | REWRITE WITH NOT [Tmp.3 := "std", TEST InOut.2 != Tmp.3, Tmp.3 := "core", TEST InOut.2 != Tmp.3] KEEPING 3
           93420  ~91%    {3}    | SCAN OUTPUT In.1, _, In.0
           93420  ~87%    {3}    | REWRITE WITH Out.1 := "prelude"
                          return r1
```
 2025-08-04 17:33:26 +02:00
Tom Hvitved
65bf76e3ed Merge pull request #20161 from hvitved/rust/fix-bad-joins 
Rust: Fix two bad joins introduced by magic
 2025-08-04 17:32:54 +02:00
Geoffrey White
a86479eba9 Rust: Accept consistency check failures. 2025-08-04 16:26:41 +01:00
Geoffrey White
8b5603cf71 Merge pull request #20160 from geoffw0/exec 
Rust: Add type inference test cases resembling missing call targets in SQLx.
 2025-08-04 16:03:12 +01:00
Geoffrey White
e368ee4b1b Rust: Accept that sql-injection sinks are sinks for this query, and that the existing sinks created for this query are also new sql-injection sinks. 2025-08-04 15:23:04 +01:00
Geoffrey White
989b48d576 Rust: Add tests for rusqlite. 2025-08-04 15:00:06 +01:00
Anders Schack-Mulligen
0a27a8c255 Java: Assume normal termination in post-dominance. 2025-08-04 15:08:26 +02:00
Geoffrey White
f1cb1a3f5a Rust: Add computed security-severity tag. 2025-08-04 13:41:16 +01:00
Geoffrey White
6925d4e564 Merge pull request #20129 from codeqlhelper/main 
C++: Static variables are initialized to zero or null by compiler
 2025-08-04 13:23:45 +01:00
Tom Hvitved
125a4b9b10 Rust: Fix two bad joins introduced by magic 
```
Evaluated relational algebra for predicate TypeInference::closureParameterPath/2#9d0bf423#bbf@ba08cc1s with tuple counts:
           565067    ~172652%    {2} r1 = JOIN `Callable::Callable.getParam/1#dispred#ce0254b3_01#count_range` WITH `Callable::Generated::Callable.getNumberOfParams/0#dispred#abb45996` ON FIRST 1 OUTPUT Rhs.1, Lhs.1
            24684     ~11784%    {3}    | JOIN WITH Type::TTupleTypeParameter#5ca17706 ON FIRST 2 OUTPUT Rhs.2, Lhs.1, Lhs.0
             2970      ~1391%    {3}    | JOIN WITH `TypeInference::TypePath::singleton/1#ee45de3b` ON FIRST 1 OUTPUT Lhs.1, Lhs.2, Rhs.1
              664       ~242%    {4}    | JOIN WITH `Stdlib::FnOnceTrait.getTypeParam/0#dispred#93f20bbc` CARTESIAN PRODUCT OUTPUT Rhs.1, Lhs.0, Lhs.1, Lhs.2
              303        ~49%    {4}    | JOIN WITH Type::TDynTraitTypeParameter#e16268df ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Lhs.2, Lhs.3
              198         ~0%    {8}    | JOIN WITH `TypeInference::TypePath::singleton/1#ee45de3b` ON FIRST 1 OUTPUT Lhs.1, Lhs.2, _, _, Rhs.1, Lhs.3, _, _
                                 {4}    | REWRITE WITH Out.2 := (In.4 ++ In.5), Tmp.3 := (In.4 ++ In.5), Tmp.6 := "[0-9]+", Tmp.7 := "", Out.3 := regexpReplaceAll(Tmp.3,Tmp.6,Tmp.7) KEEPING 4
              198         ~0%    {6}    | SCAN OUTPUT In.0, In.1, In.2, _, In.3, _
                                 {4}    | REWRITE WITH Out.3 := length(In.4), Tmp.5 := 10, TEST Out.3 <= Tmp.5 KEEPING 4
              198         ~0%    {3}    | SCAN OUTPUT In.1, In.0, In.2

           877984   ~1444714%    {1} r2 = SCAN `CallExprBase::CallExprBase.getArg/1#dispred#d775f13d` OUTPUT In.1
           299888     ~83707%    {3}    | JOIN WITH Type::TTupleTypeParameter#5ca17706_102#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.0, Rhs.2
        515462762     ~59140%    {4}    | JOIN WITH `CallExprBase::Generated::CallExprBase.getNumberOfArgs/0#dispred#0975fe12_10#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Lhs.0, Lhs.2
          9429188  ~25728933%    {3}    | JOIN WITH TypeInference::InvokedClosureExpr#24e5dacb_1#join_rhs ON FIRST 1 OUTPUT Lhs.3, Lhs.1, Lhs.2
            53669    ~142315%    {3}    | JOIN WITH `TypeInference::TypePath::singleton/1#ee45de3b` ON FIRST 1 OUTPUT Lhs.1, Lhs.2, Rhs.1
             4003     ~10522%    {4}    | JOIN WITH `Stdlib::FnOnceTrait.getTypeParam/0#dispred#93f20bbc` CARTESIAN PRODUCT OUTPUT Rhs.1, Lhs.0, Lhs.1, Lhs.2
              370       ~910%    {4}    | JOIN WITH Type::TDynTraitTypeParameter#e16268df ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Lhs.2, Lhs.3
              148       ~293%    {8}    | JOIN WITH `TypeInference::TypePath::singleton/1#ee45de3b` ON FIRST 1 OUTPUT Lhs.1, Lhs.2, _, _, Rhs.1, Lhs.3, _, _
                                 {4}    | REWRITE WITH Out.2 := (In.4 ++ In.5), Tmp.3 := (In.4 ++ In.5), Tmp.6 := "[0-9]+", Tmp.7 := "", Out.3 := regexpReplaceAll(Tmp.3,Tmp.6,Tmp.7) KEEPING 4
              148       ~316%    {6}    | SCAN OUTPUT In.0, In.1, In.2, _, In.3, _
                                 {4}    | REWRITE WITH Out.3 := length(In.4), Tmp.5 := 10, TEST Out.3 <= Tmp.5 KEEPING 4
              148       ~293%    {3}    | SCAN OUTPUT In.1, In.0, In.2

              346        ~75%    {3} r3 = r1 UNION r2
                                 return r3
```

and

```
Evaluated relational algebra for predicate TypeInference::fnParameterPath/2#4dea2880#bbf@d56000vi with tuple counts:
                1         ~0%    {1} r1 = SCAN `Stdlib::FnOnceTrait.getTypeParam/0#dispred#93f20bbc` OUTPUT In.1
                1         ~0%    {1}    | JOIN WITH Type::TTypeParamTypeParameter#868c69a5 ON FIRST 1 OUTPUT Rhs.1
                1         ~0%    {1}    | JOIN WITH `TypeInference::TypePath::singleton/1#ee45de3b` ON FIRST 1 OUTPUT Rhs.1
           877984   ~1350201%    {2}    | JOIN WITH `ArgList::Generated::ArgList.getArg/1#dispred#b07adc80` CARTESIAN PRODUCT OUTPUT Rhs.1, Lhs.0
           321252     ~90755%    {4}    | JOIN WITH Type::TTupleTypeParameter#5ca17706_102#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Lhs.0, Rhs.2
        553043191     ~65412%    {5}    | JOIN WITH `CallExprBase::Generated::CallExprBase.getNumberOfArgs/0#dispred#0975fe12_10#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Lhs.2, Lhs.0, Lhs.3
         10089088  ~26772053%    {4}    | JOIN WITH TypeInference::InvokedClosureExpr#24e5dacb_1#join_rhs ON FIRST 1 OUTPUT Lhs.4, Lhs.1, Lhs.2, Lhs.3
            57729    ~157423%    {8}    | JOIN WITH `TypeInference::TypePath::singleton/1#ee45de3b` ON FIRST 1 OUTPUT Lhs.2, Lhs.3, _, _, Lhs.1, Rhs.1, _, _
                                 {4}    | REWRITE WITH Out.2 := (In.4 ++ In.5), Tmp.3 := (In.4 ++ In.5), Tmp.6 := "[0-9]+", Tmp.7 := "", Out.3 := regexpReplaceAll(Tmp.3,Tmp.6,Tmp.7) KEEPING 4
            57729    ~157423%    {6}    | SCAN OUTPUT In.0, In.1, In.2, _, In.3, _
                                 {4}    | REWRITE WITH Out.3 := length(In.4), Tmp.5 := 10, TEST Out.3 <= Tmp.5 KEEPING 4
            57729    ~157423%    {3}    | SCAN OUTPUT In.1, In.0, In.2
                                 return r1
```
 2025-08-04 14:22:50 +02:00
Simon Friis Vindum
3ba285c298 Rust: Implement certain type information for annotation and simple calls 2025-08-04 14:06:38 +02:00
Simon Friis Vindum
c3349bbb04 Rust: Add type inference example with cycle blowup 2025-08-04 14:06:37 +02:00
Tom Hvitved
361ef0f50d C#: Include constructors in ValueOrRefType.hasCallable 2025-08-04 13:51:17 +02:00
Geoffrey White
2ec6dafd18 Rust: Add a type inference test case resembling missing call targets in SQLx. 2025-08-04 10:21:59 +01:00
Simon Friis Vindum
9aebc58214 Merge pull request #20147 from paldepind/rust/type-limit-metric 
Rust: Add metric for DCA and debug predicates for type that reach the length limit
 2025-08-04 07:53:14 +02:00
Mathias Vorreiter Pedersen
65b1b7f63e C++: Add change note. 2025-08-03 12:17:37 +01:00
Mathias Vorreiter Pedersen
851c498b37 C++: Accept test changes. This is a FP that's been present since we put the IR into production in #2851. 2025-08-03 12:17:36 +01:00
Mathias Vorreiter Pedersen
b807ee4718 C++: Accept test changes. 2025-08-03 12:17:34 +01:00
Mathias Vorreiter Pedersen
c726285cac C++: Sync identical files. 2025-08-03 12:17:31 +01:00
Mathias Vorreiter Pedersen
0d9e298250 C++: Specifier-only converting instructions preserve GVNs. 2025-08-03 12:17:19 +01:00
Mathias Vorreiter Pedersen
fca49dde92 C++: Accept test changes. 2025-08-02 16:43:19 +01:00
Mathias Vorreiter Pedersen
73e4bfdd3e C++: Fix missing flow by also generating final global uses for functions that have a post-update node for the global variable. 2025-08-02 16:41:23 +01:00
Mathias Vorreiter Pedersen
34c1ec73c2 C++: Add tests with missing flow through globals. 2025-08-02 16:38:32 +01:00
Mathias Vorreiter Pedersen
1aa8adb472 C++: Add test. 2025-08-02 13:00:26 +01:00
Mathias Vorreiter Pedersen
14345a8288 C++: Accept test changes. 2025-08-01 16:09:44 +01:00
Mathias Vorreiter Pedersen
7561190bd1 C++: Fix type errors in C code. 2025-08-01 16:09:42 +01:00
Napalys Klicius
881ea7631e Added change note 2025-08-01 14:34:25 +02:00
Joe Farebrother
5e09c1d3d3 Merge remote-tracking branch 'origin/python-qual-subclass-shadow' into python-qual-subclass-shadow 2025-08-01 12:39:30 +01:00
Joe Farebrother
bc60914ed7 Update test output 2025-08-01 12:37:51 +01:00
Joe Farebrother
d8083add3e Doc updates 2025-08-01 12:35:01 +01:00
Napalys Klicius
ae4077db72 add taint flow for arg/command-line-args with custom argv option 2025-08-01 13:34:08 +02:00
Napalys Klicius
d6508f34b6 Add taint flow for Commander.js direct property access and action callbacks 2025-08-01 13:24:19 +02:00
Napalys Klicius
39170f327c Added couple more test cases for commander js 2025-08-01 13:14:39 +02:00
Napalys Klicius
6b4e34dd39 Added a step from parse to opts for commander js 2025-08-01 13:12:43 +02:00
Mathias Vorreiter Pedersen
1fab97b765 Merge pull request #20149 from MathiasVP/expose-definition-from-dataflow-ssa 
C++: Expose SSA definitions from dataflow
 2025-08-01 12:04:04 +01:00
Mathias Vorreiter Pedersen
0e9286dd34 C++: Fix QLDoc. 2025-08-01 11:37:12 +01:00