hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-08-01 16:02:57 +02:00
Code Issues Packages Projects Releases Wiki Activity
88,599 Commits 1,817 Branches 172 Tags
copilot/add-cpp-ecmascript-parser
Commit Graph

88599 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Jeroen Ketema
305a63bc38 C++: Update dbscheme stats 2026-05-16 16:10:27 +02:00
Jeroen Ketema
963715884e C++: Add change note 2026-05-16 11:50:00 +02:00
Jeroen Ketema
b6847974f7 C++: Add upgrade and downgrade scripts 2026-05-16 09:26:08 +02:00
Jeroen Ketema
336bbc229e C++: Add support for alias templates 
Add other missing cases to `isFromTemplateInstantiationRec` and
`isFromUninstantiatedTemplateRec` while here.
 2026-05-16 09:11:54 +02:00
Mathias Vorreiter Pedersen
8ce601b1d7 C++: Add change notes. 2026-05-15 21:22:38 +01:00
Mathias Vorreiter Pedersen
4396e66f35 C++: Fix FP by providing an implementation of 'hasSocketInput'. 2026-05-15 21:12:34 +01:00
Mathias Vorreiter Pedersen
eda33adafd C++: Add FP. 2026-05-15 21:07:45 +01:00
BazookaMusic
5ef09a102c add tests for langchain and remove wrong model for guardrails agent 2026-05-15 12:49:36 +02:00
BazookaMusic
fe7eabd56f Add run from agents into the user prompt and fix an issue with classifying it as a system prompt injection 2026-05-15 12:39:54 +02:00
BazookaMusic
535adc7a31 add barrier when data flows into user messages for system prompt detection, remove embeddings from user prompt injection query 2026-05-15 12:14:14 +02:00
Geoffrey White
a4b2c0f6fd Update change notes (Copilot's suggestions). 2026-05-15 09:24:29 +01:00
Kristen Newbury
3eaf04ef72 Fix expected files for changes to alert messages UntrustedCheckoutCritical and UntrustedCheckoutHigh 2026-05-14 15:05:08 -04:00
Jeroen Ketema
d47ee6bed9 C++: Update test results after extractor changes 2026-05-14 20:22:47 +02:00
Kristen Newbury
914c7e1a7b Improve UntrustedCheckoutX helpfiles 2026-05-14 13:34:59 -04:00
Kristen Newbury
29ffd87bf8 Add full stop to alert messages in UntrustedCheckoutHigh and UntrustedCheckoutCritical 2026-05-14 12:58:20 -04:00
Kristen Newbury
eae9c0ef0e Add one missing changenote actions-queries-untrusted-checkout 2026-05-14 12:06:55 -04:00
Kristen Newbury
c36ad7be37 Adjust untrusted checkout actions queries 2026-05-14 11:59:55 -04:00
Florin Coada
a84332ac15 Merge pull request #21727 from github/docs/customizing-library-models-for-rust 
docs: Add 'Customizing library models for Rust' documentation
 2026-05-14 15:04:12 +01:00
Geoffrey White
59dbd68a5e Add change notes. 2026-05-14 14:46:05 +01:00
Tom Hvitved
3f7b50ebba Type inference: Unify getABaseTypeMention and conditionSatisfiesConstraint 2026-05-13 16:24:36 +02:00
Taus
dd9c066c61 unified: Regenerate files 2026-05-13 14:24:12 +00:00
Taus
f4f85b58ca unified: Remove some pointless fields 
All of these fields have contents that are uniquely determined by the
node they appear on, so they convey no information.
 2026-05-13 14:22:06 +00:00
Taus
caef72b047 unified: Introduced named property_binding node 
This groups together a bunch of related values that would otherwise be
impossible to match up correctly.
 2026-05-13 13:54:21 +00:00
Taus
9787a8b072 unified: Group enum entries 
Same as in the preceding commit.
 2026-05-13 13:51:25 +00:00
Taus
c8f7c3d7f2 unified: Group more paired items 
Same as in the preceding commit, these items do not make sense as
separate fields on the parent node, so we materialise (or create new)
intermediate nodes to group them together.
 2026-05-13 13:49:30 +00:00
Taus
ea6f3a9568 unified: Encapsulate function parameters 
The field representation would have made it difficult to figure out
which parameters correspond to which default values and attributes, so
instead we now encapsulate these in a new `function_parameter` node.
 2026-05-13 13:20:58 +00:00
Taus
5d6dc5c3c3 unified: Clean up statements/block mess 
Introduces (by making it named) a `block` node, and conversely makes
`statements` anonymous. This enables us to sensibly distinguish between
the "then" and "else" branch of an `if_statement`, which we were not
able to previously.
 2026-05-13 13:06:34 +00:00
Owen Mansel-Chan
0c274849be Merge pull request #21842 from github/workflow/coverage/update 
Update CSV framework coverage reports
 2026-05-13 13:48:35 +01:00
Owen Mansel-Chan
b49b8ff6bd Give slightly more detail in change note 2026-05-13 13:47:53 +01:00
Mathias Vorreiter Pedersen
25c4d9d09b Potential fix for pull request finding 
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-05-13 13:27:04 +01:00
Mathias Vorreiter Pedersen
07b8d7eba7 C++: Accept test changes in experimental query. 2026-05-13 13:14:25 +01:00
Mathias Vorreiter Pedersen
f40d42c575 C++: Perform an SCC reduction to simulate greatest fixed-point semantics. 2026-05-13 13:14:20 +01:00
Mathias Vorreiter Pedersen
8585bb616d C++: Some writes are always certain regardless of the address. 2026-05-13 13:14:13 +01:00
Mathias Vorreiter Pedersen
fc80a2472d C++: Slightly refactor certainty computation with a newtype. 2026-05-13 13:09:12 +01:00
Mathias Vorreiter Pedersen
6d5d57acca C++: Add missing overrides. 2026-05-13 13:09:10 +01:00
Mathias Vorreiter Pedersen
e77d85f23e C++: Add a new test to test assignment certainty (i.e., whether the entire buffer is overwritten). 2026-05-13 13:09:08 +01:00
Mathias Vorreiter Pedersen
b753e7d228 C++: Make 'toString' on 'Ssa::Definition' more clear. 2026-05-13 13:09:01 +01:00
Mathias Vorreiter Pedersen
8e25240282 C++: Add a FP caused by missing certainty around SSA writes from Uninitialized instructions. 2026-05-13 13:07:56 +01:00
Geoffrey White
c8196e439f Merge branch 'main' into extsensitive 2026-05-13 13:04:48 +01:00
BazookaMusic
9c136264de remove guardrails sanitizer for now 2026-05-13 13:37:44 +02:00
Michael Nebel
c8efc34e8b C#: Update the generated lock, targets and bzl files. 2026-05-13 13:02:14 +02:00
Florin Coada
ab0b492429 Merge branch 'main' into docs/customizing-library-models-for-rust 2026-05-13 11:45:11 +01:00
Florin Coada
8abd3b93c9 Update docs/codeql/codeql-language-guides/customizing-library-models-for-rust.rst 
Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
 2026-05-13 11:44:43 +01:00
Paolo Tranquilli
ee13ea0f6b Harden _relative_path for Windows and mixed-form inputs 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-05-13 11:35:02 +02:00
Asger F
554bdf14b2 Yeast: fix warning about unnecessary mutability 2026-05-13 11:19:51 +02:00
BazookaMusic
34da804aee Move structurally typed prompt injection sinks to Models as Data 
Move OpenAI, Anthropic, Google GenAI, and LangChain sinks that are
structurally typed (identified by API name alone) into MaD YAML files.

Role-filtered sinks that require inspecting a sibling 'role' property
remain in QL code since MaD cannot express conditional logic.

Use two distinct sink kinds:
- user-prompt-injection: picked up by UserPromptInjection.ql
- system-prompt-injection: picked up by SystemPromptInjection.ql

New files:
- javascript/ql/lib/ext/openai.model.yml
- javascript/ql/lib/ext/anthropic.model.yml
- javascript/ql/lib/ext/google-genai.model.yml
- javascript/ql/lib/ext/langchain.model.yml
 2026-05-13 11:08:25 +02:00
Asger F
b031e5b1f8 Unified: regenerate QL and make tests not crash 
The output is not so interesting as the mapping removes most nodes from the current test file.

I added a name_expr.swift test so at least one NameExpr makes it through.
 2026-05-13 10:48:43 +02:00
Asger F
7fa6c4e4a3 Unified: Update test output after rebasing on grammar changes 
The branch was rebased on the grammar changes, but rewriting the history was too difficult, so I'm just updating the test output here.
 2026-05-13 10:35:34 +02:00
Asger F
600a4969c9 Unified: Simplify concatenation of arguments 2026-05-13 10:35:33 +02:00
Asger F
55194dd757 Unified: Support for calls and member access 2026-05-13 10:35:31 +02:00