Commit Graph

4694 Commits

Author SHA1 Message Date
Taus
bf688b88a9 Python: Add missing special methods 2025-03-14 16:29:54 +00:00
Taus
3d643c02be Merge pull request #18921 from github/tausbn/python-fix-unused-global-variable-in-forward-annotation-fp
Python: Add support for forward references in unused var query
2025-03-13 16:37:25 +01:00
Taus
f3353dc3fb Python: Ignore special methods with placeholder bodies
Instances of this include
- Bodies that contain just a docstring (common in Zope interfaces)
- Bodies that do nothing but raise an exception.
2025-03-13 12:18:43 +00:00
Taus
862b89207d Python: Disable "usused default" logic
Adds a new boolean parameter `is_unused_default` that indicates whether
the given result is one where a parameter to a special method has a
default value (which will never be used when invoked in the normal way).
These results are somewhat less useful (because the special method
_might_ be invoked directly, in which case the default value would still
be relevant), but it seemed like a shame to simply remove the code, so
instead I opted to disable it in this way.
2025-03-13 12:18:43 +00:00
Taus
24b2eb24c1 Python: Refactor special method query
Moves a bunch of `owner.declaredAttribute(name) = f` instances to the
top level, in the process greatly cleaning up the code. The behaviour
should be the unchanged.

Having done this, there's only one place where we depend on points-to,
and that's in the remaining `declaredAttribute` call. This should
greatly simplify the move away from points to.
2025-03-13 12:18:43 +00:00
yoff
a5101bdae6 Merge pull request #18855 from Kwstubbs/ssrf_documentation
Python: Add more documentation in regards to SSRF
2025-03-12 15:27:01 +01:00
Taus
a9ab39da1b Merge pull request #18448 from github/tausbn/python-add-type-annotation-metrics-query
Python: Add metrics query for type annotations
2025-03-06 13:52:26 +01:00
Joe Farebrother
a06de21f45 Python: Include py/not-named-self and py/not-named-cls in the CCR suite. 2025-03-05 15:13:20 +00:00
Taus
5d3b40d514 Python: Add change note 2025-03-04 14:47:03 +00:00
Taus
88615f427b Python: Add support for forward declarations in unused var query
Fixes the false positive reported in
https://github.com/github/codeql/issues/18910

Adds a new `Annotation` class (subclass of `Expr`) which encompasses all
possible kinds of annotations in Python.

Using this, we look for string literals which are part of an annotation,
and which have the same content as the name of a (potentially) unused
global variable, and in that case we do not produce an alert.

In future, we may want to support inspecting such string literals more
deeply (e.g. to support stuff like "list[unused_var]"), but I think for
now this level of support is sufficient.
2025-03-04 14:41:45 +00:00
github-actions[bot]
58f355ae5a Post-release preparation for codeql-cli-2.20.6 2025-03-03 18:18:15 +00:00
github-actions[bot]
fa850cccb1 Release preparation for version 2.20.6 2025-03-03 17:13:19 +00:00
Kevin Stubbings
04476ca5f4 Add more choices to SSRF remediation 2025-02-25 00:16:48 -08:00
github-actions[bot]
ad24f94a77 Post-release preparation for codeql-cli-2.20.5 2025-02-17 17:58:24 +00:00
github-actions[bot]
6f4562f3bd Release preparation for version 2.20.5 2025-02-17 16:55:54 +00:00
Joe Farebrother
180e45d66a Merge pull request #18599 from joefarebrother/python-qual-not-named-self-cls
Python: Modernize py/not-named-self and py/not-named-cls queries
2025-02-17 08:58:34 +00:00
Joe Farebrother
f46a2a1773 Exclude some decorators 2025-02-12 09:40:45 +00:00
Asger F
eedfa4dbb2 Merge pull request #18341 from asgerf/py/diff-informed
Python: enable diff-informed data flow queries
2025-02-11 13:15:44 +01:00
Joe Farebrother
61d5a692fb Refactor metaclass logic a bit, ensure lambdas are excluded 2025-02-07 21:46:30 +00:00
Asger F
d3ee658399 Python: resolve remaining TODOs 2025-02-06 10:27:56 +01:00
Asger F
975ce064fc Python: implement for polynomial redos 2025-02-06 10:27:45 +01:00
Asger F
15c2ccb880 Python: ignore experimental for now 2025-02-06 10:27:43 +01:00
Asger F
9dfd1cc608 Python: Fixup broken patch 2025-02-06 10:27:21 +01:00
Asger F
e4a1847dad Python: mass enable diff-informed data flow 2025-02-06 10:27:19 +01:00
Remco Vermeulen
9894e9ef9f Add CCR suites 2025-02-05 01:58:34 +00:00
Joe Farebrother
287cf0121d Fix docs 2025-02-04 15:28:13 +00:00
Joe Farebrother
3802a73f47 Update docs 2025-02-04 14:46:02 +00:00
Joe Farebrother
e8adef18a3 Update to inline expectations + fixes 2025-02-04 14:45:59 +00:00
Joe Farebrother
0bf8d4ec4b Exclude 'methods' used in initialisation, and allow self for metaclass methods 2025-02-04 14:45:52 +00:00
Joe Farebrother
fa76bf3c9f Fix formatting and rewrite redundant exists 2025-02-04 14:45:48 +00:00
Joe Farebrother
526e235fc1 Update NonSelf and NonCls queries 2025-02-04 14:45:44 +00:00
github-actions[bot]
f1b05a79a4 Post-release preparation for codeql-cli-2.20.4 2025-02-04 09:25:09 +00:00
github-actions[bot]
573e53e454 Release preparation for version 2.20.4 2025-02-03 15:19:35 +00:00
github-actions[bot]
fbb7f0a0c6 Post-release preparation for codeql-cli-2.20.2 2025-01-20 21:11:14 +00:00
github-actions[bot]
a0512a50f2 Release preparation for version 2.20.2 2025-01-20 21:11:12 +00:00
Taus
4141b4fb8a Python: Add metrics query for type annotations
Adds a query that counts the number of type annotations of various
kinds. Intended to be used with something like MRVA to inform our
modelling decisions.

Currently the query counts the following "interesting" types in addition
to the total number of types:
- Built-in types (which are less likely to be interesting from a
modelling perspective)
- Forward declarations (i.e. annotations inside strings) which will
require a fair bit of QL machinery to interpret.
- Simple types (stuff like `foo` or `foo.bar.baz`)
- Optional types (stuff like `Optional[foo]` which from a modelling
perspective should likely be treated the same as `foo`)
- Complex types (anything that contains more complex type constructions
such as instantiations of generic types)
2025-01-08 15:41:31 +00:00
github-actions[bot]
fb20f6ca63 Post-release preparation for codeql-cli-2.20.1 2025-01-07 22:07:40 +00:00
github-actions[bot]
88b6f1e79a Release preparation for version 2.20.1 2025-01-07 20:50:36 +00:00
Dave Bartolomeo
72a53c4b23 Revert "Release preparation for version 2.20.1" 2025-01-07 13:32:23 -05:00
github-actions[bot]
fbf9f2fff8 Release preparation for version 2.20.1 2025-01-07 17:20:13 +00:00
Dave Bartolomeo
22e030584c Revert "Release preparation for version 2.20.1" 2025-01-07 12:14:27 -05:00
github-actions[bot]
a121c5a5d0 Release preparation for version 2.20.1 2025-01-06 18:20:22 +00:00
Joe Farebrother
8a778da253 Apply suggestions from docs review
Co-authored-by: Ben Ahmady <32935794+subatoi@users.noreply.github.com>
2024-12-09 19:58:00 +00:00
Joe Farebrother
ebaab89933 Formatting updates 2024-12-09 19:57:25 +00:00
Joe Farebrother
6e16ed52e8 Reveiw suggestions: Spelling/grammar fixes
Co-authored-by: Taus <tausbn@github.com>
2024-12-09 19:56:59 +00:00
Joe Farebrother
494d779541 Add changenote 2024-12-09 19:56:38 +00:00
Joe Farebrother
f0163894b6 fix link in qhelp refs 2024-12-09 19:56:25 +00:00
Joe Farebrother
4602c5c905 Remove experimental version + qhelp fixes 2024-12-09 19:56:18 +00:00
Joe Farebrother
e4e02ec674 Add security severity + fix qhelp 2024-12-09 19:56:03 +00:00
Joe Farebrother
02f395f5f8 Add qhelp 2024-12-09 19:55:57 +00:00