Ian Lynagh
2409bcc0d6
Merge pull request #19301 from github/release-prep/2.21.1
...
Release preparation for version 2.21.1
2025-04-15 16:52:54 +01:00
Ian Lynagh
8ee353c12c
Merge pull request #19312 from igfoo/igfoo/fix-typo-unmasked-secret-exposure
...
actions: Fix spelling error in UnmaskedSecretExposure.md
2025-04-15 15:41:07 +01:00
Ian Lynagh
b75e0ed02e
actions: Fix spelling error in UnmaskedSecretExposure.md
...
Corrects "know" to "known" in the description of the UnmaskedSecretExposure document.
2025-04-15 14:25:39 +01:00
github-actions[bot]
b961c5961d
Release preparation for version 2.21.1
2025-04-14 09:53:06 +00:00
Geoffrey White
884c4a6e7b
Merge pull request #19171 from geoffw0/badalloc
...
Rust: Query for uncontrolled allocation size
2025-04-14 10:10:53 +01:00
Geoffrey White
c821f27309
Merge branch 'main' into badalloc
2025-04-14 09:36:59 +01:00
Napalys Klicius
86313715a4
Merge pull request #19184 from Napalys/js/request_handlers
...
JS: Support for `Request` and `NextRequest`
2025-04-14 08:07:24 +02:00
yoff
85527101bd
Merge pull request #19205 from yoff/ruby/refine-uninitialised-local
...
ruby: refine `rb/uninitialized-local-variable`
2025-04-11 23:08:01 +02:00
yoff
7517272d34
ruby: remove repetitive change note
2025-04-11 23:01:15 +02:00
yoff
b988be8ff6
ruby: improve help file
...
This has improved autofixes
I hope it also helps humans
2025-04-11 21:29:01 +02:00
yoff
85e27cae60
Merge branch 'main' into ruby/refine-uninitialised-local
2025-04-11 18:09:59 +02:00
Aditya Sharad
2dc88d87ae
Merge pull request #19278 from adityasharad/actions/integration-test-filters
...
Actions: Fix handling of paths-ignore in autobuild scripts, add integration tests for configured path filters
2025-04-11 20:53:33 +05:30
yoff
eb0f8e9572
ruby: add rb/uninitialized-local-variable to quality suite
2025-04-11 16:27:21 +02:00
Mathias Vorreiter Pedersen
11aef7019e
Merge pull request #19273 from MathiasVP/prepare-shared-mad-generation-for-cpp
...
Shared: Prepare model generation for C++ adoption
2025-04-11 07:22:56 -07:00
yoff
6a76a40cf4
ruby: adjust change notes
2025-04-11 16:18:03 +02:00
yoff
2477233508
ruby: only report on method calls
...
Interviewing a Ruby developer, I learned that
dealing with nil is common practice.
So alerts are mostly useful, if we can point to a place where this has gone wrong.
2025-04-11 15:01:57 +02:00
Mathias Vorreiter Pedersen
877118fb3b
Merge pull request #19274 from MathiasVP/prepare-cpp-for-mad-generation
...
C++: Prepare for model generation adoption
2025-04-11 05:11:36 -07:00
Mathias Vorreiter Pedersen
deef95d384
Update cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
...
Co-authored-by: Taus <tausbn@github.com >
2025-04-11 12:43:59 +01:00
Mathias Vorreiter Pedersen
bfc494c0e1
Update cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
...
Co-authored-by: Taus <tausbn@github.com >
2025-04-11 12:43:51 +01:00
yoff
b641d5f177
ruby: fix FP
2025-04-11 13:22:42 +02:00
yoff
6e2cfab7b2
ruby: add test for for
...
found during triage
2025-04-11 12:46:25 +02:00
Paolo Tranquilli
4ae49cfe35
Merge pull request #19281 from github/redsun82/rust-setup
...
Rust: refine `ql/test/setup.sh`
2025-04-11 11:55:12 +02:00
Owen Mansel-Chan
472bfa2668
Merge pull request #19115 from owen-mc/java/port/java/string-replace-all-with-non-regex
...
Java: Add new quality query to detect `String#replaceAll` with non-regex first argument
2025-04-11 10:31:38 +01:00
Napalys Klicius
3d7c0201d9
Merge pull request #19231 from Napalys/js/typed_array
...
JS: Taint propagation from low-level `ArrayBuffer` to `Strings`
2025-04-11 11:29:01 +02:00
Napalys
11abbf8c4a
Now nextUrl is of type parameter and loosen the restriction for NextAppRouteHandler
2025-04-11 11:19:12 +02:00
Napalys Klicius
92e4f112c0
Update javascript/ql/lib/semmle/javascript/frameworks/Next.qll
...
Co-authored-by: Asger F <asgerf@github.com >
2025-04-11 11:08:40 +02:00
Napalys Klicius
d0dcf897cb
Update javascript/ql/lib/semmle/javascript/internal/flow_summaries/Strings.qll
...
Co-authored-by: Asger F <asgerf@github.com >
2025-04-11 11:04:08 +02:00
yoff
4167e96058
ruby: more complete impleemntation of isInBooleanContext
...
Co-authored-by: Tom Hvitved <hvitved@github.com >
2025-04-11 11:00:22 +02:00
yoff
f675a143d6
ruby: remove redundant cases
...
The CFG handles the negation
2025-04-11 10:48:41 +02:00
Napalys Klicius
d17d29a387
Merge pull request #19218 from Napalys/js/upgrade_websocket
...
JS: Refactor `WebSocket` to use `API` graphs
2025-04-11 10:05:54 +02:00
Napalys
e3f1720f9c
RenamedDecodeLike to Decode and updated propagatesFlow
2025-04-11 10:04:09 +02:00
Arthur Baars
85940484ab
Update rust/ql/test/setup.sh
2025-04-11 09:57:50 +02:00
Napalys
2c4b3527b4
Added change note
2025-04-11 09:42:12 +02:00
Napalys
678eccb417
Added searchParams.get as potential source for SSRF
2025-04-11 09:42:07 +02:00
Napalys
8674b61e5a
Added SSRF test case with searchParams for NextRequest
2025-04-11 09:26:16 +02:00
Paolo Tranquilli
db1203acb3
Rust: reinstate adding rust-src for test toolchains
2025-04-11 08:57:14 +02:00
Napalys
6e09a65da0
Added support for NextRequest middleware SSRF.
2025-04-11 08:43:36 +02:00
Napalys
734ad2d767
Removed legacy Consistency check as it is redundant now with inline test expectations.
2025-04-11 08:43:08 +02:00
Napalys
208487f236
Added middleware test
2025-04-11 08:39:47 +02:00
Paolo Tranquilli
becea89a47
Rust: refine ql/test/setup.sh
2025-04-11 08:26:48 +02:00
yoff
8555e8c8c8
ruby: add change notes
2025-04-11 03:07:19 +02:00
yoff
53c88da91b
ruby: refine query for uninitialised local variables
...
- there are places where uninitialised reads are intentional
- there are also some places where they are impossible
2025-04-11 03:07:19 +02:00
yoff
1ca25b2ccb
ruby: add test of rb/uninitialized-local-variable
2025-04-11 03:00:05 +02:00
Aditya Sharad
283503b06d
Actions: Fix handling of paths-ignore in autobuild scripts
...
Always concatenate the default filters with the user-provided filters.
This ensures that when `paths-ignore` is provided,
we begin with the default path inclusions,
not all YAML files.
This makes the `paths-ignore-only` integration test variant
under `filters` pass.
The handling of `paths` is unchanged:
if provided, this overrides the default filters.
2025-04-10 11:18:45 -07:00
Aditya Sharad
30ce0c5cbf
Actions: Add integration tests for configured path filters
...
Use the common structure from the existing test
for default filters.
Check both query output finding workflows and actions,
and source archive output showing all extracted YAML files.
The test for only `paths-ignore` fails in this commit,
demonstrating a bug: we start with all YAML files
rather than starting with the default includes.
The tests for `paths` reflect current behaviour
which is consistent with other languages:
`paths` overrides the default inclusions,
and only files under `paths` are included.
This may not be the best user experience for Actions,
since we want to scan all workflow and action files
even in the presence of `paths`, but that is not
currently addressed.
2025-04-10 11:17:51 -07:00
Tom Hvitved
7ed8a85e08
Merge pull request #19246 from hvitved/rust/cache-tweaks
2025-04-10 19:02:25 +02:00
Felicity Chapman
c2baf9a052
Merge pull request #19270 from github/felicitymay-patch-1
...
CodeQL docs: Fix ordering in side navigation bar for Query help
2025-04-10 15:10:14 +01:00
Owen Mansel-Chan
4f5bdbb517
Add new query to java-code-quality.qls.expected
2025-04-10 14:37:11 +01:00
Mathias Vorreiter Pedersen
3bb249f580
C++: Ensure we always have 'Position's even if there are no calls in the DB.
2025-04-10 14:28:40 +01:00
Mathias Vorreiter Pedersen
b678112f4d
C++: Add a few predicates to 'ReturnKind'.
2025-04-10 14:28:38 +01:00
