Commit Graph

88606 Commits

Author SHA1 Message Date
Jeroen Ketema
6017cbc6cb Merge pull request #22176 from jketema/jketema/go-dead
Go: Remove dead extractor code
2026-07-13 12:33:00 +02:00
github-actions[bot]
0584ca09dc Go: Update to 1.26.5 2026-07-13 04:12:46 +00:00
Jeroen Ketema
559f9f3850 Go: Remove dead isAlias 2026-07-13 00:38:58 +02:00
Jeroen Ketema
63ff22abd6 Go: Remove dead ObjectsOverride 2026-07-13 00:08:51 +02:00
Owen Mansel-Chan
a142121038 Merge pull request #22157 from github/dependabot/go_modules/go/extractor/extractor-dependencies-ac3bf41f8e
Bump golang.org/x/tools from 0.47.0 to 0.48.0 in /go/extractor in the extractor-dependencies group
2026-07-11 22:28:05 +01:00
Owen Mansel-Chan
6057b4b6e9 Fix path sanitizer 2026-07-11 07:28:14 +01:00
Owen Mansel-Chan
22fca39735 Merge pull request #22156 from github/workflow/coverage/update
Update CSV framework coverage reports
2026-07-11 01:14:26 +01:00
Owen Mansel-Chan
dee6386459 Merge pull request #22126 from owen-mc/js/convert-qlref-inline-expectations
JS: Convert qlref tests to inline expectations
2026-07-11 00:24:20 +01:00
Owen Mansel-Chan
9fc65df23d Merge pull request #22150 from owen-mc/go/remove-incorrect-sanitizer
Go: Fix incorrect path injection sanitizer `FilePath.Rel`
2026-07-10 15:25:17 +01:00
Kristen Newbury
2cd9220b74 Format 2026-07-10 09:36:53 -04:00
Anders Schack-Mulligen
33261f441e Java: Improve join order.
Before:
```
[2026-07-10 15:15:58] Evaluated non-recursive predicate ControlFlowGraph::NonReturningCalls::EffectivelyNonVirtualMethod.getAnAccess/0#dispred#efac59ed@090459qt in 4303ms (size: 186002).
Evaluated relational algebra for predicate ControlFlowGraph::NonReturningCalls::EffectivelyNonVirtualMethod.getAnAccess/0#dispred#efac59ed@090459qt with tuple counts:
           790592  ~0%    {2} r1 = JOIN `Expr::MethodCall.getMethod/0#dispred#41989dc9_10#join_rhs` WITH `Member::Method.getSourceDeclaration/0#dispred#93e6cdf8` ON FIRST 1 OUTPUT Rhs.1, Lhs.1
        539755681  ~2%    {2}    | JOIN WITH `Member::SrcMethod.getAPossibleImplementationOfSrcMethod/0#dispred#4f4317e6#bf` ON FIRST 1 OUTPUT Rhs.1, Lhs.1
           186002  ~2%    {2}    | JOIN WITH ControlFlowGraph::NonReturningCalls::EffectivelyNonVirtualMethod#86c19e07 ON FIRST 1 OUTPUT Lhs.0, Lhs.1
                          return r1
```
After:
```
[2026-07-10 15:29:39] Evaluated non-recursive predicate ControlFlowGraph::NonReturningCalls::EffectivelyNonVirtualMethod.getAnAccess/0#dispred#efac59ed@32fb2e61 in 10ms (size: 186002).
Evaluated relational algebra for predicate ControlFlowGraph::NonReturningCalls::EffectivelyNonVirtualMethod.getAnAccess/0#dispred#efac59ed@32fb2e61 with tuple counts:
        122765  ~0%    {2} r1 = SCAN ControlFlowGraph::NonReturningCalls::EffectivelyNonVirtualMethod#86c19e07 OUTPUT In.0, In.0
        122766  ~0%    {2}    | JOIN WITH `Member::SrcMethod.getAPossibleImplementationOfSrcMethod/0#dispred#4f4317e6_10#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.1
        126911  ~0%    {2}    | JOIN WITH `Member::Method.getSourceDeclaration/0#dispred#93e6cdf8_10#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.1
        186002  ~2%    {2}    | JOIN WITH `Expr::MethodCall.getMethod/0#dispred#41989dc9_10#join_rhs` ON FIRST 1 OUTPUT Lhs.1, Rhs.1
                       return r1
```
2026-07-10 15:32:44 +02:00
Taus
58ddeacde0 unified: Hook up swift-syntax AST
At this point it's only a proof-of-concept translation -- it translates
`sourceFile` nodes, but everything else gets mapped to
'unsupported_node`.
2026-07-10 13:14:35 +00:00
Taus
ddab6ccb35 unified: Emit locations for comments
Also gathers these into a separate side-channel during the initial AST
construction. That way, we don't encounter these as weird extra nodes
while running yeast.
2026-07-10 11:36:37 +00:00
Taus
8909fae81e unified: Extract locations from swift-syntax AST
Introduces new yeast types for `Point`s and `Range`s (corresponding to
the tree-sitter equivalents), since it seemed silly to have
`swift-syntax-rs` pull in `tree-sitter` just to have those types
available.

This _does_ mean there is a slight overhead in the shared extractor when
converting between these types, but I think this is negligible.
2026-07-10 11:36:37 +00:00
Taus
446ff7c463 unified: Add mapping from swift-syntax JSON to yeast AST
Adds a preliminary mapping that decodes the JSON into the yeast AST. The
JSON AST itself is still very verbose, but it would be useful to see if
it actually contains all of the things we want it to contain.
2026-07-10 11:35:57 +00:00
Taus
87c8173125 unified: Don't emit empty trivia
These were taking up roughly 20% of the JSON payload.
2026-07-10 11:35:57 +00:00
Taus
89e11e5cfc unified: Add swift-syntax-rs
Adds an initial prototype of an interface from Rust to Swift, which
enables us to use the `swift-syntax` package for parsing.

At present, the parsed AST is passed between Swift and Rust as a JSON
string.
2026-07-10 11:35:57 +00:00
Taus
247e54ba8d Merge pull request #22112 from github/tausbn/yeast-reify-output-schema-as-ast-types 2026-07-10 12:11:41 +02:00
Kristen Newbury
059aa2da70 Add missing changenote 2026-07-10 00:04:33 -04:00
dependabot[bot]
985a79a45e Bump golang.org/x/tools
Bumps the extractor-dependencies group in /go/extractor with 1 update: [golang.org/x/tools](https://github.com/golang/tools).


Updates `golang.org/x/tools` from 0.47.0 to 0.48.0
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](https://github.com/golang/tools/compare/v0.47.0...v0.48.0)

---
updated-dependencies:
- dependency-name: golang.org/x/tools
  dependency-version: 0.48.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: extractor-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-07-10 03:03:43 +00:00
github-actions[bot]
8ff671f99d Add changed framework coverage reports 2026-07-10 00:44:25 +00:00
Kristen Newbury
643080208b Add UntrustedCheckoutTOCTOUX ControlCheck model fix 2026-07-09 17:01:29 -04:00
github-actions[bot]
ec83894d48 Post-release preparation for codeql-cli-2.26.1 2026-07-09 17:25:35 +00:00
Óscar San José
373814b430 Merge pull request #22151 from github/release-prep/2.26.1
Release preparation for version 2.26.1
codeql-cli/v2.26.1
2026-07-09 18:52:26 +02:00
github-actions[bot]
9acbbb8049 Release preparation for version 2.26.1 2026-07-09 16:48:01 +00:00
Jeroen Ketema
161c8c4d30 Merge pull request #22149 from jketema/jketema/cwe-114-tag
C++/C#: Specify additional CWE tags for queries that specify CWE 114
2026-07-09 18:02:21 +02:00
Owen Mansel-Chan
233c3ce30d Fix incorrect sanitizers 2026-07-09 16:47:49 +01:00
Jeroen Ketema
72efb6a058 C++: Add CWE 73 and CWE 78 tags to cpp/uncontrolled-process-operation
User controlled data here either leads to the loading of an uncontrolled
library (CWE 73) or the execution of an uncontrolled command (CWE 78).
2026-07-09 17:11:58 +02:00
Jeroen Ketema
66fea698a2 C#: Add CWE-73 tag to cs/assembly-path-injection
Use of CWE-114 is discoraged, and CWE-73 seems appropriate as the assembly
path is user controlled here.
2026-07-09 17:10:13 +02:00
Jeroen Ketema
2ae79d0f1e C#: Remove misplaced change note
After almost 4 years it does not seem to be relevant anymore to propagate this
to the change log.
2026-07-09 17:09:07 +02:00
Florin Coada
747aa452cd Merge pull request #22147 from github/codeql-spark-run-29025431896
Update changelog documentation site for codeql-cli-2.26.0
2026-07-09 15:43:31 +01:00
Taus
9e99a3c968 Merge branch 'main' into tausbn/yeast-reify-output-schema-as-ast-types 2026-07-09 16:30:06 +02:00
Taus
989154a105 Merge pull request #22136 from github/tausbn/yeast-translate-with-context
yeast: Add context scoping mechanism
2026-07-09 16:29:54 +02:00
github-actions[bot]
36d0ceb292 update codeql documentation 2026-07-09 14:29:47 +00:00
Taus
d609680083 yeast: Fix escaping bug in yeast-macros
Happily, it turned out that there was already a library function for
handling this case.
2026-07-09 11:48:50 +00:00
Taus
11afcce8b3 yeast: Fix bug in matching (_)
Turns out, `(_)` would match both named and unnamed nodes, as we never
checked the value of the `match_unnamed` field. This is the real reason
why the final catch-all rule we removed in the last commit was
superfluous -- unnamed nodes were being caught by the penultimate rule
instead (and mapped to `unsupported_node`).

Having fixed the bug, we now (correctly) get errors due to unmatched
unnamed nodes in the input. To fix this, we change the catch-all rule to
match unnamed nodes as well. This restores the previous behaviour
exactly.

At some point, we should find a better way to handle unnamed nodes, as
it seems wasteful to map these to `unsupported_node` (since we in
practice only use them for their string content). Perhaps we should not
attempt to translate unnamed nodes at all?
2026-07-09 11:48:50 +00:00
Taus
ee04938ded yeast: Require type annotations on root-level Rust interpolations
In order to facilitate static type checking of rules (and to make it
easier for human readers as well), rust blocks at the root level (i.e.
rules of the form `... => { ... }`) must now have a type annotation in
front.

All other forms are unaffected: if the right hand side of a rule is a
tree, we can read the type of the root node directly. For interpolations
that happen inside of such a tree, we can recover the type by looking at
what field we're interpolating into, and consulting the output schema.

All existing uses have been updated to have the appropriate type
annotations, though these are of course not checked yet (and so could be
wrong).

Finally, this commit also removes the final catch-all rule `_ @node =>
{node}`. Because of the preceding rule that matches `(_) @node`, this
rule would only ever match unnamed nodes, and I think in practice it did
not match at all (at least not in our current set of tests).

To give it a proper type we would have to add some notion of an "any"
type, which I would like to avoid. If it _does_ turn out to be needed,
we can easily add it back (ideally with a test-case that shows why it's
still needed).
2026-07-09 11:48:50 +00:00
Taus
ea36f2d7f8 yeast: add rules! macro
This macro allows the easy addition of multiple rules at the same time.
In addition, it also accepts an input and output schema, which
eventually will be used to check the validity of the rewrite rules.
2026-07-09 11:39:30 +00:00
Taus
1fb4f9d208 yeast: Move schema and YAML loader into yeast-schema crate
For type checking rules, we need to be able to load schemas (so we know
what to check against). However, since we can't have yeast-macros
depending on yeast (where the schema-handling code currently lives) as
this would introduce a circular dependency, we instead split the
schema-related code into its own yeast-schema crate.
2026-07-09 11:39:30 +00:00
Jack Nørskov Jørgensen
d5712ef19a Merge pull request #22130 from github/jacknojo/apache_poi_mads
Add MaDs for Apache POI @ bd97feb849ab86670fe5b5513d4066c46b599797
2026-07-09 08:56:54 +02:00
Owen Mansel-Chan
a238aeeb59 Merge pull request #22141 from github/dependabot/go_modules/go/extractor/extractor-dependencies-017d72eac4
Bump golang.org/x/mod from 0.37.0 to 0.38.0 in /go/extractor in the extractor-dependencies group
2026-07-09 07:16:05 +01:00
dependabot[bot]
6da42a2456 Bump golang.org/x/mod
Bumps the extractor-dependencies group in /go/extractor with 1 update: [golang.org/x/mod](https://github.com/golang/mod).


Updates `golang.org/x/mod` from 0.37.0 to 0.38.0
- [Commits](https://github.com/golang/mod/compare/v0.37.0...v0.38.0)

---
updated-dependencies:
- dependency-name: golang.org/x/mod
  dependency-version: 0.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: extractor-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-07-09 03:03:43 +00:00
Tom Hvitved
f4773e9dc2 Merge pull request #22114 from hvitved/type-inference-join
Type inference: Small join-order tweak
2026-07-08 20:19:48 +02:00
Florin Coada
11be07952e Merge pull request #22139 from github/codeql-spark-run-28955698948
Update changelog documentation site for codeql-cli-2.26.0
2026-07-08 17:00:03 +01:00
github-actions[bot]
47ea9b49cc update codeql documentation 2026-07-08 15:46:33 +00:00
Taus
33da3ef74e yeast: Fix typo
Co-authored-by: Jeroen Ketema <93738568+jketema@users.noreply.github.com>
2026-07-08 16:35:01 +02:00
Owen Mansel-Chan
25cd352de7 Merge pull request #22123 from owen-mc/csharp/convert-qlref-tests-to-inline-expectations
C#: Convert qlref tests to inline expectations
2026-07-08 14:47:04 +01:00
Geoffrey White
8bb12d1507 Merge pull request #22005 from github/dependabot/pip/misc/codegen/pip-02f7ad5a4b
Bump the pip group across 2 directories with 2 updates
2026-07-08 14:37:05 +01:00
Tom Hvitved
15c7428593 Address review comment 2026-07-08 15:08:46 +02:00
Owen Mansel-Chan
aba008dcd7 Remove comments "// BAD: but flagged by cs/constant-condition" 2026-07-08 14:00:57 +01:00