Commit Graph

86820 Commits

Author SHA1 Message Date
Asger F
47d299e93b Add parse diagnostics support via getSyntacticDiagnostics API
Fetch syntactic diagnostics from the tsgo API after parsing each file.
Only genuine parse errors (diagnostic codes 1000-1999) are included;
higher codes like 2880 (import assertion deprecation) are filtered out
since they don't indicate actual parse failures.

The Java extractor uses parseDiagnostics to report syntax errors and
skip full AST extraction for broken files, matching TS5 behavior.

TRAP test results: 495/495 passing (100%)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-13 15:27:47 +02:00
Asger F
fbaf648e4f Fix nodeFlags: bit 6 is ExportContext, not GlobalAugmentation
TS7 binary AST uses bit 6 for ExportContext (set on all nodes inside
`declare module` contexts), not GlobalAugmentation as previously assumed.
GlobalAugmentation is not a flag in the TS7 binary format at all.

Fix by using a synthetic flag bit (1<<30) for GlobalAugmentation that the
converter sets on `declare global {}` nodes based on the name identifier
being "global". This lets the Java extractor correctly distinguish
`declare global {}` from regular namespace declarations.

Also corrects the flag shift: ExportContext=64 (bit 6), ContainsThis=128
(bit 7), etc., matching the actual TS7 binary layout.

TRAP test results: 494/495 passing (99.8%)
Remaining: badimport.ts (TS7 binary API doesn't report parse diagnostics)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-13 15:22:58 +02:00
Asger F
637ce99e44 TypeScript Go extractor: metadata fixes, NestedNamespace inference, and scanner improvements
- Fix TS7 nodeFlags: remove Synthesized (shifted in TS7), add GlobalAugmentation=64,
  correct OptionalChain=32, Namespace=16, shift subsequent flags
- Add 33 missing operator/punctuation token kinds to syntaxKinds metadata
- Infer NestedNamespace flag for dotted namespace declarations (TS7 binary
  doesn't set it, but Java extractor needs it)
- Fix shebang handling: emit ShebangTrivia (kind 6) instead of SingleLineCommentTrivia
- Fix token kinds for regex/template rescans to match TS5 pre-rescan behavior
  (SlashToken for regexes, CloseBraceToken for template continuations)
- Fix augmentPos to correctly skip comments (matching TS5's trivia-skipping regex)
- Resolve native tsgo binary from npm wrapper to avoid Node.js dependency
- Update project-layout glob for worktree support

TRAP test results: 493/495 passing (99.6%)
Remaining: badimport.ts (missing diagnostics), externalmodule.ts (structural diff)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-13 15:11:48 +02:00
Asger F
bd9d6b1962 Add Go TypeScript parser wrapper integration to Java extractor
Wire the Go-based TypeScript parser wrapper as an alternative to the
Node.js wrapper. Enabled via SEMMLE_TYPESCRIPT_USE_GO_PARSER=true.

When enabled:
- Skips Node.js installation verification
- Launches the Go binary directly (no Node.js required)
- Uses the same newline-delimited JSON protocol over stdin/stdout
- Go binary path configurable via SEMMLE_TYPESCRIPT_GO_PARSER_WRAPPER
- tsgo binary path passed through via SEMMLE_TYPESCRIPT_TSGO_BINARY

The Go wrapper implements all protocol commands: get-metadata, parse,
prepare-files, reset, and quit.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-10 15:44:55 +02:00
Asger F
bd5e4761bd Fix broader validation: 52/57 tests pass
Key fixes:
- UTF-16 offset conversion for positions (buildOffsetTables, byteToUTF16, utf16ToByte)
- Unicode identifier scanning (support ID_Start/ID_Continue categories)
- Filter zero-width synthetic modifiers from nested namespaces
- Add ImportAttributes to childprops (elements property)
- Emit isTypeOf:false for ImportType nodes
- Always emit empty statements array for SourceFile
- Emit empty arrays for remaining array properties when no children
- Non-greedy > scanning (always single GreaterThanToken)
- Ignore parseDiagnostics in structural comparison

Remaining 5 failures are binary/UTF-16-BOM encoded files (not real TypeScript).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-10 15:19:49 +02:00
Asger F
93deb33a2a Fix validation script to tolerate expected TS7 kind/flags diffsTS5
The shell validation script now uses a structural comparison that
ignores expected numeric differences in kind/flags/token/operator
values between TS5 and TS7. Only truly structural diffs cause failure.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-10 14:54:19 +02:00
Asger F
f3b27a56b1 TypeScript-Go wrapper: binary AST decoder, JSON converter, and tokenizer
Implement the core components for translating tsgo's binary AST format
into the JSON format expected by the Java extractor:

- decoder.go: Binary AST format parser with random-access node accessors
  (kind, pos, end, flags, children, strings, extended data)
- converter.go: Walks decoded AST and produces JSON matching Node.js
  wrapper output (augmented , , , ,
  isTypeOnly, HeritageClause token, TypeOperator operator)
- childprops.go: Maps ~100 SyntaxKind names to ordered child property
  name lists for correct bitmask-to-property assignment
- scanner.go: TypeScript tokenizer producing  array with rescan
  support for regex, template, and greater-than disambiguation

Update metadata.go with correct TS7 SyntaxKind iota values and export
metadata functions. Wire decoder+converter through TsgoParser.Parse().

Validation test passes: all 421 diffs are expected TS5-vs-TS7 numeric
kind/flags/token/operator value differences. Zero structural diffs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-10 14:36:00 +02:00
Asger F
37852aa1d3 JS: Fix validation script to use stdin protocol with timeouts
The script was calling wrappers in single-file CLI mode, but neither
wrapper supports that (they read commands from stdin). Now sends
parse + quit commands via stdin and uses `timeout` to avoid hangs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-10 13:46:39 +02:00
Asger F
78b1651596 JS: Add Go-based TypeScript parser wrapper scaffolding
Add initial scaffolding for a Go process that will replace the Node.js
TypeScript parser wrapper, preparing for TypeScript 7's Go-based compiler.

The Go wrapper implements the same stdin/stdout line-delimited JSON
protocol as the existing Node.js wrapper (lib/typescript/src/main.ts),
making it a drop-in replacement from the Java extractor's perspective.

Key components:
- Protocol handler matching the Node.js wrapper's command set
  (get-metadata, prepare-files, parse, reset, quit)
- Parser backend interface with tsgo subprocess implementation
  using the tsgo --api --async JSON-RPC mode (LSP Content-Length framing)
- AST property whitelist matching the ~90 properties from the Node.js wrapper
- Static TS7 SyntaxKind and NodeFlags metadata mappings
- Validation framework for comparing JSON output between wrappers
- Integration tests demonstrating successful tsgo API communication:
  initialize, updateSnapshot (project opening), getSourceFile

Key finding: the tsgo API returns binary-encoded ASTs (not JSON),
requiring a decoder for the custom flat-node-array format. See
microsoft/typescript-go/internal/api/encoder/ for the format spec.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-10 13:11:17 +02:00
Paolo Tranquilli
7de8ce961c Merge pull request #21677 from github/dependabot/bazel/gazelle-0.50.0
Bump gazelle from 0.47.0 to 0.50.0
2026-04-10 10:07:25 +02:00
Michael Nebel
66278fcd10 Merge pull request #21690 from samchang-msft/update-net10-support
Support added in Jan 2026
2026-04-10 08:40:29 +02:00
Sam Chang
7883fab44f Qualify the limited support for .NET 10 and C# 14 2026-04-09 12:06:54 -07:00
Sam Chang
38440d96b8 Support added in Jan 2026 2026-04-09 10:48:08 -07:00
Tom Hvitved
33cc887be0 Merge pull request #21592 from hvitved/dataflow/source-call-context-type-flow
Data flow: Add hook for preventing lambda dispatch in source call contexts
2026-04-09 13:44:42 +02:00
Tom Hvitved
d704b753c8 Fix CP in typeFlowParamType
Forgot to link `p` with `c` using `nodeEnclosingCallable(p, c)`.
2026-04-09 09:19:55 +02:00
dependabot[bot]
7833a0a2e8 Bump gazelle from 0.47.0 to 0.50.0
Bumps [gazelle](https://github.com/bazel-contrib/bazel-gazelle) from 0.47.0 to 0.50.0.
- [Release notes](https://github.com/bazel-contrib/bazel-gazelle/releases)
- [Commits](https://github.com/bazel-contrib/bazel-gazelle/compare/v0.47.0...v0.50.0)

---
updated-dependencies:
- dependency-name: gazelle
  dependency-version: 0.50.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-04-09 03:08:02 +00:00
Kristen Newbury
fb0ee5b987 Merge pull request #21640 from knewbury01/knewbury01/adjust-actions-queries-alerts
Adjust alert messages CWE-829/ArtifactPoisoning[Critical|Medium]
2026-04-08 09:44:00 -04:00
Kristen Newbury
7b7411f7df Change alert location CWE-829/ArtifactPoisoning queries 2026-04-08 08:57:45 -04:00
Taus
16683aee0e Merge pull request #21590 from github/tausbn/python-improve-bind-all-interfaces-query
Python: Improve "bind all interfaces" query
2026-04-07 17:59:48 +02:00
Jeroen Ketema
e7d3eedc80 Merge pull request #21661 from jketema/autoconf
C++: Add heuristic for GNU autoconf config files
2026-04-07 15:38:06 +02:00
Taus
4cb238f1af Merge pull request #21598 from github/tausbn/python-port-should-use-with
Python: Port ShouldUseWithStatement.ql
2026-04-07 14:16:41 +02:00
Mathias Vorreiter Pedersen
5e145aa27d Merge pull request #21631 from MathiasVP/expose-fwd-stage-1
Dataflow: Expose stage 1's `fwdFlow`
2026-04-07 11:29:56 +01:00
Mathias Vorreiter Pedersen
e06294bcb4 Shared: Respond to review comments. 2026-04-07 11:11:04 +01:00
Idriss Riouak
39f92e992a Merge pull request #21494 from github/idrissrio/java/jdk26
Java: Accept new test results after JDK 26 extractor upgrade
2026-04-07 12:03:36 +02:00
Tom Hvitved
0d4524f8f3 Address review comments 2026-04-07 11:40:10 +02:00
Tom Hvitved
1e1a8732a3 Data flow: Add hook for preventing lambda dispatch in source call contexts 2026-04-07 11:40:08 +02:00
Tom Hvitved
eb64fcd208 C#: Add test that shows unintended flow summary generation 2026-04-07 11:40:07 +02:00
Jeroen Ketema
04cfd37f53 C++: Fix comments in tests 2026-04-07 10:52:12 +02:00
Jeroen Ketema
b19c648965 C++: Add heuristic for GNU autoconf config files 2026-04-07 10:43:15 +02:00
Michael Nebel
e259ebe258 Merge pull request #21627 from michaelnebel/csharp/cleanup
C#: Deprecate get[L|R]Value predicates.
2026-04-07 10:23:59 +02:00
idrissrio
6f199b90ba Java: Accept new test results for JDK 26
Accept new ByteOrder.getEntries, List.ofLazy, and Map.ofLazy entries
in kotlin2 test expected files.
2026-04-07 09:28:25 +02:00
idrissrio
3ccbd8032c Java: Accept new test results for JDK 26
JDK 26 added ofLazy methods to List, Map, and Set collections.
Update expected test output to include these new methods.
2026-04-07 09:28:23 +02:00
idrissrio
5a6eb79470 Java: Pin CWE-676 test to --release 25
Thread.stop() was removed in JDK 26. Pin the test to --release 25.
2026-04-07 09:28:22 +02:00
idrissrio
74b0e8c19a Java: Accept new test results after JDK 26 extractor upgrade 2026-04-07 09:28:20 +02:00
Tom Hvitved
7d184d0c7f Merge pull request #21206 from hvitved/rust/type-inference-closure-param-context-typed
Rust: Infer argument types based on trait bounds on parameters
2026-04-07 09:17:30 +02:00
Mario Campos
fb8b5699f2 Merge pull request #21639 from github/mario-campos/test-go-registries
Add tests for multiple Git sources and GoProxy servers in registry config parsing
2026-04-02 11:12:51 -05:00
Kristen Newbury
41714656ec Adjust alert messages actions CWE-829 2026-04-02 11:58:58 -04:00
Kristen Newbury
e69e30aa84 Adjust alert messages CWE-829/ArtifactPoisoning[Critical|Medium] 2026-04-02 11:32:37 -04:00
Mario Campos
fb871cdfb8 Add tests for multiple Git sources and GoProxy servers in registry config parsing 2026-04-02 10:12:48 -05:00
Paolo Tranquilli
cedacc91db Merge pull request #21583 from github/redsun82/update-kotlin-2.3.20
Kotlin: update to 2.3.20
2026-04-02 15:58:22 +02:00
Mathias Vorreiter Pedersen
4d8b782695 Shared: Also expose dataflow stage 1's forward flow predicate. 2026-04-02 10:56:09 +01:00
Paolo Tranquilli
88a893efca Kotlin: update supported versions in documentation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-02 08:34:22 +02:00
Paolo Tranquilli
2d76b41293 Merge pull request #21628 from github/redsun82/vendor-picosha2
Vendor `PicoSHA2` into LFS
2026-04-01 15:24:41 +02:00
Paolo Tranquilli
9a1156dd62 Vendor PicoSHA2 into LFS
The upstream repo (`okdshin/PicoSHA2`) is a personal GitHub account,
at risk of suspension — the same scenario that hit `rules_antlr`.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-01 14:31:01 +02:00
Michael Nebel
6d5aff4822 C#: Add change-note. 2026-04-01 13:17:52 +02:00
Michael Nebel
9c095bc580 C#: Deprecate get[L|R]Value predicates. 2026-04-01 12:50:37 +02:00
Mathias Vorreiter Pedersen
43d002e6b5 Merge pull request #21619 from MathiasVP/more-http-remote-flow-sources
C++: Add flow sources from Windows' `http.h`
2026-03-31 15:44:39 +01:00
Mathias Vorreiter Pedersen
16a7e39e95 C++: Fix pointer indirection. Currently, this does not have any effect because of a conflation bug in taint-tracking. 2026-03-31 15:26:15 +01:00
Jeroen Ketema
17ab87d1fc Merge pull request #21618 from jketema/meson-silence
C++: Add heuristics for meson configuration files
2026-03-31 15:24:22 +02:00
Mathias Vorreiter Pedersen
dc8dc61196 C++: Fix type name. 2026-03-31 13:54:30 +01:00