Commit Graph

12097 Commits

Author SHA1 Message Date
Asger F
47d299e93b Add parse diagnostics support via getSyntacticDiagnostics API
Fetch syntactic diagnostics from the tsgo API after parsing each file.
Only genuine parse errors (diagnostic codes 1000-1999) are included;
higher codes like 2880 (import assertion deprecation) are filtered out
since they don't indicate actual parse failures.

The Java extractor uses parseDiagnostics to report syntax errors and
skip full AST extraction for broken files, matching TS5 behavior.

TRAP test results: 495/495 passing (100%)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-13 15:27:47 +02:00
Asger F
fbaf648e4f Fix nodeFlags: bit 6 is ExportContext, not GlobalAugmentation
TS7 binary AST uses bit 6 for ExportContext (set on all nodes inside
`declare module` contexts), not GlobalAugmentation as previously assumed.
GlobalAugmentation is not a flag in the TS7 binary format at all.

Fix by using a synthetic flag bit (1<<30) for GlobalAugmentation that the
converter sets on `declare global {}` nodes based on the name identifier
being "global". This lets the Java extractor correctly distinguish
`declare global {}` from regular namespace declarations.

Also corrects the flag shift: ExportContext=64 (bit 6), ContainsThis=128
(bit 7), etc., matching the actual TS7 binary layout.

TRAP test results: 494/495 passing (99.8%)
Remaining: badimport.ts (TS7 binary API doesn't report parse diagnostics)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-13 15:22:58 +02:00
Asger F
637ce99e44 TypeScript Go extractor: metadata fixes, NestedNamespace inference, and scanner improvements
- Fix TS7 nodeFlags: remove Synthesized (shifted in TS7), add GlobalAugmentation=64,
  correct OptionalChain=32, Namespace=16, shift subsequent flags
- Add 33 missing operator/punctuation token kinds to syntaxKinds metadata
- Infer NestedNamespace flag for dotted namespace declarations (TS7 binary
  doesn't set it, but Java extractor needs it)
- Fix shebang handling: emit ShebangTrivia (kind 6) instead of SingleLineCommentTrivia
- Fix token kinds for regex/template rescans to match TS5 pre-rescan behavior
  (SlashToken for regexes, CloseBraceToken for template continuations)
- Fix augmentPos to correctly skip comments (matching TS5's trivia-skipping regex)
- Resolve native tsgo binary from npm wrapper to avoid Node.js dependency
- Update project-layout glob for worktree support

TRAP test results: 493/495 passing (99.6%)
Remaining: badimport.ts (missing diagnostics), externalmodule.ts (structural diff)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-13 15:11:48 +02:00
Asger F
bd9d6b1962 Add Go TypeScript parser wrapper integration to Java extractor
Wire the Go-based TypeScript parser wrapper as an alternative to the
Node.js wrapper. Enabled via SEMMLE_TYPESCRIPT_USE_GO_PARSER=true.

When enabled:
- Skips Node.js installation verification
- Launches the Go binary directly (no Node.js required)
- Uses the same newline-delimited JSON protocol over stdin/stdout
- Go binary path configurable via SEMMLE_TYPESCRIPT_GO_PARSER_WRAPPER
- tsgo binary path passed through via SEMMLE_TYPESCRIPT_TSGO_BINARY

The Go wrapper implements all protocol commands: get-metadata, parse,
prepare-files, reset, and quit.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-10 15:44:55 +02:00
Asger F
bd5e4761bd Fix broader validation: 52/57 tests pass
Key fixes:
- UTF-16 offset conversion for positions (buildOffsetTables, byteToUTF16, utf16ToByte)
- Unicode identifier scanning (support ID_Start/ID_Continue categories)
- Filter zero-width synthetic modifiers from nested namespaces
- Add ImportAttributes to childprops (elements property)
- Emit isTypeOf:false for ImportType nodes
- Always emit empty statements array for SourceFile
- Emit empty arrays for remaining array properties when no children
- Non-greedy > scanning (always single GreaterThanToken)
- Ignore parseDiagnostics in structural comparison

Remaining 5 failures are binary/UTF-16-BOM encoded files (not real TypeScript).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-10 15:19:49 +02:00
Asger F
93deb33a2a Fix validation script to tolerate expected TS7 kind/flags diffsTS5
The shell validation script now uses a structural comparison that
ignores expected numeric differences in kind/flags/token/operator
values between TS5 and TS7. Only truly structural diffs cause failure.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-10 14:54:19 +02:00
Asger F
f3b27a56b1 TypeScript-Go wrapper: binary AST decoder, JSON converter, and tokenizer
Implement the core components for translating tsgo's binary AST format
into the JSON format expected by the Java extractor:

- decoder.go: Binary AST format parser with random-access node accessors
  (kind, pos, end, flags, children, strings, extended data)
- converter.go: Walks decoded AST and produces JSON matching Node.js
  wrapper output (augmented , , , ,
  isTypeOnly, HeritageClause token, TypeOperator operator)
- childprops.go: Maps ~100 SyntaxKind names to ordered child property
  name lists for correct bitmask-to-property assignment
- scanner.go: TypeScript tokenizer producing  array with rescan
  support for regex, template, and greater-than disambiguation

Update metadata.go with correct TS7 SyntaxKind iota values and export
metadata functions. Wire decoder+converter through TsgoParser.Parse().

Validation test passes: all 421 diffs are expected TS5-vs-TS7 numeric
kind/flags/token/operator value differences. Zero structural diffs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-10 14:36:00 +02:00
Asger F
37852aa1d3 JS: Fix validation script to use stdin protocol with timeouts
The script was calling wrappers in single-file CLI mode, but neither
wrapper supports that (they read commands from stdin). Now sends
parse + quit commands via stdin and uses `timeout` to avoid hangs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-10 13:46:39 +02:00
Asger F
78b1651596 JS: Add Go-based TypeScript parser wrapper scaffolding
Add initial scaffolding for a Go process that will replace the Node.js
TypeScript parser wrapper, preparing for TypeScript 7's Go-based compiler.

The Go wrapper implements the same stdin/stdout line-delimited JSON
protocol as the existing Node.js wrapper (lib/typescript/src/main.ts),
making it a drop-in replacement from the Java extractor's perspective.

Key components:
- Protocol handler matching the Node.js wrapper's command set
  (get-metadata, prepare-files, parse, reset, quit)
- Parser backend interface with tsgo subprocess implementation
  using the tsgo --api --async JSON-RPC mode (LSP Content-Length framing)
- AST property whitelist matching the ~90 properties from the Node.js wrapper
- Static TS7 SyntaxKind and NodeFlags metadata mappings
- Validation framework for comparing JSON output between wrappers
- Integration tests demonstrating successful tsgo API communication:
  initialize, updateSnapshot (project opening), getSourceFile

Key finding: the tsgo API returns binary-encoded ASTs (not JSON),
requiring a decoder for the custom flat-node-array format. See
microsoft/typescript-go/internal/api/encoder/ for the format spec.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-10 13:11:17 +02:00
github-actions[bot]
ce6e6d5db3 Post-release preparation for codeql-cli-2.25.1 2026-03-30 08:43:48 +00:00
github-actions[bot]
fb011842c9 Release preparation for version 2.25.1 2026-03-25 23:43:06 +00:00
github-actions[bot]
8cf0954796 Release preparation for version 2.25.1 2026-03-25 08:28:30 +00:00
github-actions[bot]
d6055754b6 Release preparation for version 2.25.0 2026-03-16 12:15:34 +00:00
Asger F
22f16dda85 Merge pull request #21368 from asgerf/browser-sources
JS: Add 'browser' source kinds
2026-03-16 09:24:54 +01:00
Asger F
821cc0e875 JS: Address PR review comments
- Fix misplaced semicolons in test files (was inside comment, moved before it)
- Update QLdoc comments to reference new browser source kind names
- Update docs to list browser source kinds and fix outdated 'only remote' note

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-03-13 14:58:04 +01:00
Asger F
b8c44be599 Add QL test for bun/tsx shebang recognition in TypeScript files
Add test files with #!/usr/bin/env bun, #!/usr/bin/env tsx, and
#!/usr/bin/env node shebangs. The query lists extracted .ts files,
verifying that all three shebangs are recognized and the files are
not skipped by the extractor.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-03-12 10:09:56 +01:00
Asger F
84d1828a9c JavaScript extractor: recognise bun and tsx in shebang lines
Update the shebang regexp (renamed NODE_INVOCATION -> JS_INVOCATION) to
also match 'bun' and 'tsx' so that scripts using these runtimes are
correctly identified as JavaScript files.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-03-12 09:35:36 +01:00
Asger F
5db30c9947 JS: Add change note 2026-03-11 15:40:07 +01:00
Asger F
4a001f960f JS: Add tests in request forgery queries 2026-03-11 13:53:25 +01:00
Asger F
1253553aec JS: Add browser source kinds 2026-03-11 13:50:07 +01:00
Óscar San José
3b9eba2afc Merge branch 'main' of https://github.com/github/codeql into oscarsj/merge-back-rc-3.21 2026-03-06 16:20:36 +01:00
Asger F
c9fa7fa283 Merge pull request #21369 from asgerf/js/this-bindings
JS: Emit variables for 'this'
2026-03-05 13:36:38 +01:00
Owen Mansel-Chan
c82f75604a Add change notes 2026-03-05 10:34:30 +00:00
Owen Mansel-Chan
99a4fe4828 Update expected test output column numbers 2026-03-04 15:02:53 +00:00
Owen Mansel-Chan
ea30f02271 js: Inline expectation should have space before $ 2026-03-04 13:11:35 +00:00
Owen Mansel-Chan
0eccd902c2 js: Inline expectation should have space after $
This was a regex-find-replace from `// \$(?! )` (using a negative lookahead) to `// $ `.
2026-03-04 12:45:03 +00:00
github-actions[bot]
e152f08468 Post-release preparation for codeql-cli-2.24.3 2026-03-02 22:51:27 +00:00
github-actions[bot]
7795badd18 Release preparation for version 2.24.3 2026-03-02 13:23:40 +00:00
Asger F
f2cc0da936 JS: Add upgrade/downgrade scripts but with 'partial' compatibility 2026-03-02 11:09:19 +01:00
Asger F
d440b5fa85 JS: Update TRAP files 2026-02-27 14:15:34 +01:00
Asger F
47895b3334 JS: Update test for UniquePropertyNames test
This query now reports the alert previously found by DuplicateProperty
2026-02-27 13:37:29 +01:00
Asger F
71fb6bf915 JS: Mark corresponding lost result for the getter 2026-02-27 13:35:43 +01:00
Asger F
c673bd9151 JS: Document a missing alert due to limitation in structural comparison 2026-02-27 13:34:55 +01:00
Asger F
0f2de46648 JS: Emit variable bindings for 'this' expressions 2026-02-27 11:44:54 +01:00
Asger F
f0f58dacb3 JS: Also emit 'this' variable for class scopes 2026-02-27 11:44:31 +01:00
Asger F
4a3b86c652 JS: Update test output 2026-02-27 11:13:50 +01:00
Asger F
e0ab5ce49b JS: Emit variables for 'this'
The extractor does not emit bindings for 'this', we just ensure that a variable exists for it
2026-02-25 10:17:02 +01:00
Asger F
f0e665d08c Merge pull request #21349 from asgerf/mobx-wrapper
Support React components wrapped by 'mobx-react'
2026-02-25 09:24:45 +01:00
Owen Mansel-Chan
ada9c452f0 Merge pull request #21336 from owen-mc/js/accept-mad-sanitizers
JS: Accept MaD sanitizers for queries with MaD sinks
2026-02-23 13:44:54 +00:00
Asger F
27638c7029 JS: Add change note 2026-02-20 11:20:46 +01:00
Asger F
a684943bb7 JS: Model mobx-react{-lite} as higher-order component builders 2026-02-19 11:26:46 +01:00
Asger F
a0099d64c8 JS: Add mobx-react and mobx-react-lite tests 2026-02-19 11:26:44 +01:00
Paolo Tranquilli
dfe451128e Merge branch 'main' into redsun82/bazel-9 2026-02-19 11:05:32 +01:00
Owen Mansel-Chan
05f9b4124d Revert "javascript: remove sanitizer to be replaced by model"
This reverts commit da2f77d615.
2026-02-17 14:39:04 +00:00
Owen Mansel-Chan
b8f9dd9de5 Revert "javascript: add MaD model"
This reverts commit 75bd4a7a12.
2026-02-17 14:38:56 +00:00
Owen Mansel-Chan
61e8f91404 Accept MaD sanitizers for queries with MaD sinks 2026-02-17 12:45:24 +00:00
github-actions[bot]
b5898c5a30 Post-release preparation for codeql-cli-2.24.2 2026-02-16 17:07:45 +00:00
github-actions[bot]
ef04f927fb Release preparation for version 2.24.2 2026-02-16 13:29:25 +00:00
Paolo Tranquilli
10a2824b82 refactor: migrate BUILD files to explicit rules_java imports
Add explicit load statements for java_library and java_test from
@rules_java//java:defs.bzl in:
- javascript/extractor/BUILD.bazel
- javascript/extractor/test/com/semmle/js/extractor/test/BUILD.bazel
2026-02-10 13:44:06 +01:00
github-actions[bot]
73d06f26cb Post-release preparation for codeql-cli-2.24.1 2026-02-02 14:04:26 +00:00