Commit Graph

84161 Commits

Author SHA1 Message Date
Jeroen Ketema
bff4213c62 C++: Add upgrade and downgrade scripts 2025-06-09 23:42:11 +02:00
Jeroen Ketema
f910906965 C++: Update expected test results 2025-06-09 23:42:09 +02:00
Jeroen Ketema
691e462501 C++: Support the __mfp8 floating point type 2025-06-09 23:42:07 +02:00
REDMOND\brodes
729467ccd6 Crypto: Separate out CTX parameter initialization, and add additional initializer subclasses. 2025-06-09 16:49:54 -04:00
Chuan-kai Lin
c1c0a705b9 Merge pull request #19704 from github/post-release-prep/codeql-cli-2.22.0
Post-release preparation for codeql-cli-2.22.0
2025-06-09 12:54:57 -07:00
REDMOND\brodes
4f2045bbdd Crypto: CtxFlow now uses an interface for additional steps. Add CTX step to handle paramgen. Remove redundant test. Overhaul of EVP update/initializer/final mechanics. Misc. updates for new API and refactoring EVPKeyGenOperation. Clean up of keygen_operaitons.ql. 2025-06-09 15:07:00 -04:00
github-actions[bot]
21463a9653 Post-release preparation for codeql-cli-2.22.0 2025-06-09 18:50:20 +00:00
Chuan-kai Lin
4d681f05bd Merge pull request #19703 from github/release-prep/2.22.0
Release preparation for version 2.22.0
codeql-cli/v2.22.0
2025-06-09 11:19:39 -07:00
github-actions[bot]
88ba02edf8 Release preparation for version 2.22.0 2025-06-09 18:14:51 +00:00
Geoffrey White
a9d5d8b2b3 Rust: Accept the new alert message in tests. 2025-06-09 19:14:14 +01:00
Geoffrey White
74ce4e8105 Update rust/ql/src/queries/security/CWE-825/AccessAfterLifetime.ql
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2025-06-09 19:10:39 +01:00
Geoffrey White
e7945e16cb Rust: Accept the query in suite listings. 2025-06-09 19:06:34 +01:00
Geoffrey White
9b0ee8fb9f Rust: Add security-severity tag and reduce precision to medium for now.
precis
2025-06-09 17:58:44 +01:00
Geoffrey White
b3330b5636 Rust: Allow parameter accesses as sources. 2025-06-09 17:58:42 +01:00
Geoffrey White
d3d0a533b5 Rust: Add test showing yet another spurious result. 2025-06-09 17:58:41 +01:00
Geoffrey White
858eec390d Rust: Exclude results where the source is a reference. 2025-06-09 17:58:40 +01:00
Geoffrey White
7bae451af3 Rust: Exclude results in macro invocations. 2025-06-09 17:58:38 +01:00
Geoffrey White
26f85585fd Rust: Add qhelp, examples, and examples as tests. 2025-06-09 17:58:37 +01:00
Aditya Sharad
e48a7da827 Actions: Add change note for Bash parsing fixes 2025-06-09 09:56:41 -07:00
Aditya Sharad
98186e3f0e Merge pull request #19700 from adityasharad/actions/validate-change-notes
CI: Expand list of packs/languages for change note validation
2025-06-09 22:13:30 +05:30
Aditya Sharad
2ecbecbd4b Actions: Add stress test for complex command and string interpolation
Anonymised version of a customer report that led to
performance bottlenecks in Bash parsing.
No results are expected from both query and library tests.
2025-06-09 09:29:15 -07:00
Aditya Sharad
848064e95a Actions: Order quoted strings by their ID, not text
In the Bash parser, we compute a mostly-unique ID for each
quoted string within a shell script block.
Quoted strings are then ranked and referred to individually.

Avoid a performance bottleneck by ranking quoted strings by their
ID, not by their source text.
I think this was the original intent of the code.

Ranking by their original text ends up evaluating multiple
possible orderings, which is slow on workflows that contain
multiple complex quoted strings, such as JSON payloads.
2025-06-09 09:15:45 -07:00
Aditya Sharad
fbe11cfca6 Actions: Refactor logic for identifying quoted strings
Add some doc comments and meaningful variable names.
2025-06-09 09:15:45 -07:00
Aditya Sharad
9f60335b66 CI: Expand list of packs/languages for change note validation 2025-06-09 08:48:16 -07:00
Geoffrey White
fe20fb403d Rust: More robust fix for closures. 2025-06-09 16:41:31 +01:00
Aditya Sharad
321513c89b Actions: Order command substitutions by their ID, not text
In the Bash parser, we compute a mostly-unique ID for each
command substitution within a shell script block.
Commands are then ranked and referred to individually.

Avoid a performance bottleneck by ranking commands by their
ID, not by their source text.
I think this was the original intent of the code.
Ranking by their original text ends up evaluating multiple
possible orderings, which is slow on workflows that contain
multiple complex command substitutions.
2025-06-09 08:39:58 -07:00
Aditya Sharad
39e710e805 Actions: Refactor logic for identifying command substitution
Extract helper predicates for `$(...)` command interpolation
and backtick-quoted commands.
Add some doc comments and meaningful variable names.
2025-06-09 08:37:40 -07:00
Chad Bentz
371a50e6c4 Merge branch 'main' into cwe-134 2025-06-09 11:22:40 -04:00
Jeroen Ketema
ef210b8f5e Merge pull request #19678 from jketema/swift-6.1.2
Swift: Update to Swift 6.1.2
2025-06-09 17:19:42 +02:00
Chuan-kai Lin
68d2c132b2 Merge pull request #19699 from github/cklin/rc-3.18-mergeback
Merge rc/3.18 back to main
2025-06-09 08:15:58 -07:00
Asger F
42f762a140 JS: Update test output now that 'satisfies' is a SourceNode 2025-06-09 16:22:30 +02:00
Chuan-kai Lin
631502e129 Merge branch 'main' into cklin/rc-3.18-mergeback 2025-06-09 07:19:40 -07:00
Mathew Payne
9d23677024 Merge branch 'main' into js-clientrests-axios 2025-06-09 14:18:54 +01:00
Jeroen Ketema
428b48dfe7 Merge pull request #19679 from jketema/stats
C++: Update stats file after changes to DCA source suite
2025-06-09 12:39:33 +02:00
Geoffrey White
21b4baeb42 Rust: Have the alert message cite the variable, so it's easier to understand whether the alert is correct. 2025-06-09 10:28:25 +01:00
Geoffrey White
79f8584efb Rust: Fix spurious results involving closures. 2025-06-09 10:25:48 +01:00
Geoffrey White
bf4ea02dd2 Rust: Implement the query. 2025-06-09 10:25:40 +01:00
Chad Bentz
53a6133e6f Add change-notes for csharp/java/swift 2025-06-06 12:23:59 -04:00
Paolo Tranquilli
d6d13b9164 MaD generator: use decompress terminology instead of extract 2025-06-06 17:36:05 +02:00
Chad Bentz
77e49f1f90 Merge branch 'main' into cwe-134 2025-06-06 11:16:10 -04:00
Paolo Tranquilli
f3e4f94e81 Rust: add documentation 2025-06-06 16:19:32 +02:00
Paolo Tranquilli
c70decbe86 Rust: add Callable::getParam and CallExprBase::getArg shortcuts 2025-06-06 16:18:16 +02:00
Paolo Tranquilli
779d06f47c Merge branch 'main' into redsun82/rust-doc 2025-06-06 14:25:37 +02:00
Owen Mansel-Chan
ef5e605cc4 Merge pull request #19386 from owen-mc/go/promote/html-template-escaping-bypass-xss
Go: promote `html-template-escaping-bypass-xss`
2025-06-06 12:36:27 +01:00
Jeroen Ketema
1f7a6ba538 Swift: Update LFS 2025-06-06 11:18:21 +02:00
Owen Mansel-Chan
5bfed770ef Merge pull request #19683 from github/dependabot/go_modules/go/extractor/extractor-dependencies-e08f8ad452
Bump the extractor-dependencies group in /go/extractor with 2 updates
2025-06-06 09:56:09 +01:00
Jeroen Ketema
86f425d2fc C++: Fix join-order problem after stats file update
Before the fix:
```
Pipeline standard for AVRule79::exprReleases/3#e849cdd3@f2995ebb was evaluated in 5 iterations totaling 168745ms (delta sizes total: 12583).
              85855    ~0%    {2} r1 = SCAN `AVRule79::exprReleases/3#e849cdd3#prev_delta` OUTPUT In.1, In.2

              85855    ~0%    {2} r2 = JOIN r1 WITH `AVRule79::exprOrDereference/1#c20425a1_10#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.1
             115767    ~6%    {2}    | JOIN WITH `ASTValueNumbering::GVN.getAnExpr/0#dispred#a14f45bf_10#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.1
             333369   ~18%    {2}    | JOIN WITH `ASTValueNumbering::GVN.getAnExpr/0#dispred#a14f45bf` ON FIRST 1 OUTPUT Rhs.1, Lhs.1
             266264  ~204%    {2}    | JOIN WITH `Access::Access.getTarget/0#dispred#cf25c8aa` ON FIRST 1 OUTPUT Rhs.1, Lhs.1
              16379   ~21%    {3}    | JOIN WITH `Function::Function.getParameter/1#dispred#200dcf26_201#join_rhs` ON FIRST 1 OUTPUT Rhs.2, Lhs.1, Rhs.1

        13117819221    ~0%    {4} r3 = JOIN r2 WITH `Call::Call.getArgument/1#dispred#ada436ba_102#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.2, Lhs.1, Rhs.2
              10477    ~3%    {3}    | JOIN WITH `Call::FunctionCall.getTarget/0#dispred#935da4c5` ON FIRST 2 OUTPUT Lhs.0, Lhs.3, Lhs.2

        13117819221    ~1%    {4} r4 = JOIN r2 WITH `Call::Call.getArgument/1#dispred#ada436ba_102#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Lhs.2, Rhs.2
        13022632157    ~1%    {5}    | JOIN WITH `Call::FunctionCall.getTarget/0#dispred#935da4c5` ON FIRST 1 OUTPUT Rhs.1, Lhs.2, Lhs.1, Lhs.0, Lhs.3
               3720   ~70%    {3}    | JOIN WITH `#MemberFunction::MemberFunction.getAnOverridingFunction/0#dispred#a6e65b9ePlus` ON FIRST 2 OUTPUT Lhs.3, Lhs.4, Lhs.2

             115767    ~6%    {2} r5 = JOIN r1 WITH `ASTValueNumbering::GVN.getAnExpr/0#dispred#a14f45bf_10#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.1
             333367   ~20%    {3}    | JOIN WITH `ASTValueNumbering::GVN.getAnExpr/0#dispred#a14f45bf` ON FIRST 1 OUTPUT Rhs.1, _, Lhs.1
             333367   ~12%    {3}    | REWRITE WITH Out.1 := 85
                  4    ~0%    {2}    | JOIN WITH exprs ON FIRST 2 OUTPUT Lhs.0, Lhs.2
                  4  ~100%    {2}    | JOIN WITH `Expr::Expr.getEnclosingFunction/0#dispred#3960f06c` ON FIRST 1 OUTPUT Rhs.1, Lhs.1

                  0    ~0%    {2} r6 = JOIN r5 WITH `Call::FunctionCall.getTarget/0#dispred#935da4c5_10#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.1

                  0    ~0%    {2} r7 = JOIN r5 WITH `#MemberFunction::MemberFunction.getAnOverridingFunction/0#dispred#a6e65b9ePlus#swapped` ON FIRST 1 OUTPUT Rhs.1, Lhs.1
                  0    ~0%    {2}    | JOIN WITH `Call::FunctionCall.getTarget/0#dispred#935da4c5_10#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.1

                  0    ~0%    {2} r8 = r6 UNION r7
                  0    ~0%    {3}    | JOIN WITH `Call::Call.getQualifier/0#dispred#7d175544` ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Lhs.0
                  0    ~0%    {3}    | JOIN WITH `AVRule79::exprOrDereference/1#c20425a1_10#join_rhs` ON FIRST 1 OUTPUT Lhs.2, Rhs.1, Lhs.1

              14197   ~18%    {3} r9 = r3 UNION r4 UNION r8
              12615    ~3%    {3}    | AND NOT `AVRule79::exprReleases/3#e849cdd3#prev`(FIRST 3)
                              return r9
```

After:
```
Pipeline standard for AVRule79::exprReleases/3#e849cdd3@13dead04 was evaluated in 5 iterations totaling 68ms (delta sizes total: 12551).
         85855    ~0%    {2} r1 = SCAN `AVRule79::exprReleases/3#e849cdd3#prev_delta` OUTPUT In.1, In.2

         85855    ~0%    {2} r2 = JOIN r1 WITH `AVRule79::exprOrDereference/1#c20425a1_10#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.1
        115767    ~6%    {2}    | JOIN WITH `ASTValueNumbering::GVN.getAnExpr/0#dispred#a14f45bf_10#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.1
        333443   ~18%    {2}    | JOIN WITH `ASTValueNumbering::GVN.getAnExpr/0#dispred#a14f45bf` ON FIRST 1 OUTPUT Rhs.1, Lhs.1
        265872  ~204%    {2}    | JOIN WITH `Access::Access.getTarget/0#dispred#cf25c8aa` ON FIRST 1 OUTPUT Rhs.1, Lhs.1
         16399   ~27%    {3}    | JOIN WITH `Function::Function.getParameter/1#dispred#200dcf26_201#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Rhs.2

         10489    ~1%    {3} r3 = JOIN r2 WITH `Call::FunctionCall.getTarget/0#dispred#935da4c5_10#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.2, Lhs.1

          1558   ~80%    {3} r4 = JOIN r2 WITH `#MemberFunction::MemberFunction.getAnOverridingFunction/0#dispred#a6e65b9ePlus#swapped` ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Lhs.2
          2196    ~7%    {3}    | JOIN WITH `Call::FunctionCall.getTarget/0#dispred#935da4c5_10#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.2, Lhs.1

         12685    ~3%    {3} r5 = r3 UNION r4
         12581    ~3%    {3}    | JOIN WITH `Call::Call.getArgument/1#dispred#ada436ba` ON FIRST 2 OUTPUT Lhs.0, Rhs.2, Lhs.2

        115767    ~6%    {2} r6 = JOIN r1 WITH `ASTValueNumbering::GVN.getAnExpr/0#dispred#a14f45bf_10#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.1
        333443   ~20%    {3}    | JOIN WITH `ASTValueNumbering::GVN.getAnExpr/0#dispred#a14f45bf` ON FIRST 1 OUTPUT Rhs.1, _, Lhs.1
        333443   ~12%    {3}    | REWRITE WITH Out.1 := 85
             4    ~0%    {2}    | JOIN WITH exprs ON FIRST 2 OUTPUT Lhs.0, Lhs.2
             4  ~100%    {2}    | JOIN WITH `Expr::Expr.getEnclosingFunction/0#dispred#3960f06c` ON FIRST 1 OUTPUT Rhs.1, Lhs.1

             0    ~0%    {2} r7 = JOIN r6 WITH `Call::FunctionCall.getTarget/0#dispred#935da4c5_10#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.1

             0    ~0%    {2} r8 = JOIN r6 WITH `#MemberFunction::MemberFunction.getAnOverridingFunction/0#dispred#a6e65b9ePlus#swapped` ON FIRST 1 OUTPUT Rhs.1, Lhs.1
             0    ~0%    {2}    | JOIN WITH `Call::FunctionCall.getTarget/0#dispred#935da4c5_10#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.1

             0    ~0%    {2} r9 = r7 UNION r8
             0    ~0%    {3}    | JOIN WITH `Call::Call.getQualifier/0#dispred#7d175544` ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Lhs.0
             0    ~0%    {3}    | JOIN WITH `AVRule79::exprOrDereference/1#c20425a1_10#join_rhs` ON FIRST 1 OUTPUT Lhs.2, Rhs.1, Lhs.1

         12581    ~3%    {3} r10 = r5 UNION r9
         12576    ~3%    {3}    | AND NOT `AVRule79::exprReleases/3#e849cdd3#prev`(FIRST 3)
                         return r10
```
2025-06-06 07:13:26 +02:00
dependabot[bot]
bbabf2c410 Bump the extractor-dependencies group in /go/extractor with 2 updates
Bumps the extractor-dependencies group in /go/extractor with 2 updates: [golang.org/x/mod](https://github.com/golang/mod) and [golang.org/x/tools](https://github.com/golang/tools).


Updates `golang.org/x/mod` from 0.24.0 to 0.25.0
- [Commits](https://github.com/golang/mod/compare/v0.24.0...v0.25.0)

Updates `golang.org/x/tools` from 0.33.0 to 0.34.0
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](https://github.com/golang/tools/compare/v0.33.0...v0.34.0)

---
updated-dependencies:
- dependency-name: golang.org/x/mod
  dependency-version: 0.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: extractor-dependencies
- dependency-name: golang.org/x/tools
  dependency-version: 0.34.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: extractor-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-06-06 03:29:36 +00:00
REDMOND\brodes
98aae6a7bf Crypto: Add EVP key gen and signature operation (work in progress). Add initial signature tests (no expected files yet). Add new openssl .h stubs. Clean up of OperationBase and associated uses. Update test case stubs to be closer to the actual stubs. Fix unncessary instanceof check in signatures. 2025-06-05 16:43:58 -04:00
Owen Mansel-Chan
238a3021d0 Merge pull request #19673 from github/workflow/coverage/update
Update CSV framework coverage reports
2025-06-05 19:44:44 +01:00