Commit Graph

82643 Commits

Author SHA1 Message Date
Mathias Vorreiter Pedersen
2fd07f28f0 C++: Add test with missing flow. 2024-10-23 13:00:33 +01:00
Michael Nebel
146c88fabb C#: Update test expected output where the results are not affected. 2024-10-23 13:08:21 +02:00
Michael Nebel
5495a211f2 C#: Update exception information exposure expected output. 2024-10-23 13:08:19 +02:00
Michael Nebel
cad9aa21d8 C#: Update flow summaries test expected output. 2024-10-23 13:08:18 +02:00
Michael Nebel
b7b6feed04 C#: Re-generate .NET 8 Runtime models. 2024-10-23 13:08:17 +02:00
Michael Nebel
9cd9ebfda9 C#: Add manual models for StringWriter. 2024-10-23 13:08:15 +02:00
Michael Nebel
87caf3d826 C#: Add change note. 2024-10-23 13:08:14 +02:00
Michael Nebel
d3a359b498 C#: Update .NET 8 models. 2024-10-23 13:08:13 +02:00
Michael Nebel
00ccd20452 C#: Delete all .NET 8 Runtime models. 2024-10-23 13:08:11 +02:00
Michael Nebel
20b5a7b6f0 C#: Update expected test output. 2024-10-23 13:08:10 +02:00
Michael Nebel
062a2ad97d C#: Include exception property accesses in the exception information exposure query. 2024-10-23 13:08:08 +02:00
Alvaro Muñoz
9a0795cc75 Bump qlpack versions 2024-10-23 12:16:32 +02:00
Alvaro Muñoz
43211d3286 Update tests 2024-10-23 12:16:02 +02:00
Alvaro Muñoz
315ffdff8d Improve env var injection sanitizers 2024-10-23 12:15:54 +02:00
Alvaro Muñoz
fef37b6025 Remove pull_request from context event map so that accesss to github.event.pull_request are not considered a source for pull_request triggers 2024-10-23 12:15:26 +02:00
Alvaro Muñoz
c9bb42a46c Enforce a checkout kind of trigger to consider gh pr/gh api ... pulls as a source of untrusted data 2024-10-23 12:14:20 +02:00
Tom Hvitved
7a2105b1d5 Go: Update expected test output 2024-10-23 10:41:13 +02:00
Tom Hvitved
2e7b71c28d Data flow: Prevent quadratic blowup in Stage6Param::localStep 2024-10-23 10:41:12 +02:00
Alvaro Muñoz
6298f2520e Bump qlpack versions 2024-10-23 10:37:33 +02:00
Alvaro Muñoz
d1d92ae68a Create getATriggerEvent for Steps and refactor the code to use it 2024-10-23 10:13:20 +02:00
Alvaro Muñoz
b2a3aaacfd Bump qlpack versions 2024-10-23 09:40:25 +02:00
Alvaro Muñoz
a057b9dd44 Add poisonable step for azure/powershell 2024-10-23 09:39:34 +02:00
Alvaro Muñoz
0738a66380 Add trigger event checks for all checkout models 2024-10-23 09:37:01 +02:00
Michael Nebel
caa08046b6 Java: Update expected test output. 2024-10-23 09:29:29 +02:00
Michael Nebel
3d70f91b9f Java: Add manual models for various mapToObj methods. 2024-10-23 09:29:15 +02:00
Michael Nebel
197642c914 Merge pull request #17547 from michaelnebel/java/jdk17update
Java: Update Java JDK 17 models.
2024-10-23 09:07:02 +02:00
Alvaro Muñoz
0cacb6feaf Bump qlpack versions 2024-10-22 22:42:51 +02:00
Alvaro Muñoz
42d4bb577c Better identification of checkout of untrusted code depending on the triggering events 2024-10-22 22:42:11 +02:00
Alvaro Muñoz
8f350d9068 Merge pull request #104 from github/new_gh_sources
New gh CLI sources
2024-10-22 21:36:19 +02:00
Henning Makholm
665354ebd2 Merge pull request #17823 from github/hmakholm/pr/graph-equivalence-test
Supplement 'query-type: graph' with actual query metadata
2024-10-22 21:08:15 +02:00
Henning Makholm
3d8d340f2a Supplement 'query-type: graph' with actual query metadata
A number of CPP library tests contain `// query-type: graph`
annotations that make the test driver compare the output
from the test query in a special mode. (This feature is
not used by other languages).

It's somewhat awkward in the implementation of `codeql test run`
that this annotation is not an ordinary item of query metadata --
essentially it means that _every_ test query has to be opened
and read an extra time to look for this annotation. I'd like
to move towards using ordinary query metadata for this, since
the QL compiler already parses it anyway.

For the time being, give the annotation in both old and new
syntaxes, until a CLI that recognizes both has been released.
2024-10-22 20:38:00 +02:00
Taus
4f60494019 Python: Support assignments of the form [x,y,z] = w
Surprisingly, the new parser did not support these constructs (and the
relevant test was missing this case), so on files that required the new
parser we were unable to parse this construct.

To fix it, we add `list_pattern` (not to be confused with
`pattern_list`) as a `tree-sitter-python` node that results in a `List`
node in the AST.
2024-10-22 16:06:35 +00:00
Taus
89ea4b8200 Python: Regenerate parser files 2024-10-22 15:39:41 +00:00
Taus
9c913902c5 Python: Allow except* to be written as except *
Turns out, `except*` is actually not a token on its own according to the
Python grammar. This means it's legal to write `except *foo: ...`, which
we previously would consider a syntax error.

To fix it, we simply break up the `except*` into two separate tokens.
2024-10-22 15:39:29 +00:00
Taus
7ceefb509b Python: Regenerate parser files 2024-10-22 15:17:34 +00:00
Taus
8053e0ed44 Python: Allow list_splats as type annotations
That is, the `*T` in `def foo(*args : *T): ...`.

This is apparently a piece of syntax we did not support correctly until
now.

In terms of the grammar, we simply add `list_splat` as a possible
alternative for `type` (which could previously only be an `expression`).
We also update `python.tsg` to not specify `expression` those places (as
the relevant stanzas will then not work for `list_splat`s).

This syntax is not supported by the old parser, hence we only add a new
parser test for it.
2024-10-22 15:17:12 +00:00
Taus
fcec8e0256 Python: Fail tests when errors/warnings are logged
This is primarily useful for ensuring that errors where a node does not
have an appropriate context set in `python.tsg` actually have an effect
on the pass/fail status of the parser tests. Previously, these would
just be logged to stdout, but test could still succeed when there were
errors present.

Also fixes one of the logging lines in `tsg_parser.py` to be more
consistent with the others.
2024-10-22 15:11:51 +00:00
Michael Nebel
16fe7a2fbe Merge pull request #17815 from michaelnebel/csharp/logforgingreplacelineending
C#: Add sanitizer to `cs/log-forging`.
2024-10-22 15:41:17 +02:00
Chris Smowton
2312f9d8df Merge pull request #17811 from github/smowton/admin/package-maven-plugin-change-note
Add change-note for Java buildless packaging its required Maven plugin
2024-10-22 14:23:01 +01:00
Alvaro Muñoz
02c5f74f20 New gh CLI sources 2024-10-22 14:57:59 +02:00
Cornelius Riemenschneider
cdffa09a7b Merge pull request #17821 from github/criemen/win-make-bazel
Go: Fix makefile to use bash to look up bazel path.
2024-10-22 12:50:10 +02:00
Asger F
958602e43e JS: Cache getARead (as per instructions in the SSA library) 2024-10-22 12:46:20 +02:00
Asger F
e784813c3b JS: Make barrier guards work with use-use flow 2024-10-22 12:46:19 +02:00
Asger F
67fdd864c9 JS: Add TODO 2024-10-22 12:46:18 +02:00
Asger F
81af9a1658 Fix missing flow through super calls 2024-10-22 12:46:17 +02:00
Asger F
12370e9210 JS: Use VariableOrThis in variable capture as well 2024-10-22 12:46:16 +02:00
Asger F
0ebe8bdd91 JS: Add test for missing capture flow for 'this' 2024-10-22 12:46:15 +02:00
Asger F
d31499d727 JS: introduce implicit this uses in general 2024-10-22 12:46:14 +02:00
Asger F
8dc0505f84 JS: Add test for missing flow into 'this' in field initializers 2024-10-22 12:46:13 +02:00
Asger F
c3c003b275 JS: Fix post-update flow into 'this' 2024-10-22 12:46:11 +02:00