hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-07-23 04:02:07 +02:00
Code Issues Packages Projects Releases Wiki Activity
88,607 Commits 1,811 Branches 171 Tags
copilot/add-cpp-regular-expression-parser
Commit Graph

2983 Commits

Author SHA1 Message Date
copilot-swe-agent[bot]
ebecc19f81 Remove duplicated ReDoS fast-path filter from RegexGrammar; narrow at RegexFlowConfigs wrappers 2026-07-20 13:08:53 +00:00
copilot-swe-agent[bot]
645f2fdc3d Move StdBasicRegex to shared StdRegex module; return ExploitableStringLiteral to flow layer 2026-07-20 12:49:45 +00:00
copilot-swe-agent[bot]
4fab077bbe Extract C++ regex grammar/flag knobs into flow-free RegexGrammar module 2026-07-20 12:02:38 +00:00
copilot-swe-agent[bot]
db58698394 Fix C++ regex term source locations for raw and encoding-prefixed literals 2026-07-20 10:00:13 +00:00
copilot-swe-agent[bot]
09938f0531 Revert "Resolve dead-code alerts: export RegexPatternFlowConfig module" 
This reverts commit cc95e25e56.
 2026-07-17 18:09:25 +00:00
copilot-swe-agent[bot]
cc95e25e56 Resolve dead-code alerts: export RegexPatternFlowConfig module 
The two "Dead code" alerts (100379, 100380) point at the isSource and
isSink predicates in `private module RegexPatternFlowConfig implements
DataFlow::ConfigSig` in cpp/ql/lib/semmle/code/cpp/regex/RegexFlowConfigs.qll.

Rationale (Case C): The predicates are genuine and correctly wired -
`RegexPatternFlowConfig` is consumed by
`TaintTracking::Global<RegexPatternFlowConfig>` on the very next line,
which drives the `usedAsRegex` / `regexMatchedAgainst` public predicates.
The DeadCode query cannot see through signature-parameterized modules and
therefore flags every implementation-side `isSource`/`isSink` inside a
private ConfigSig module (the same false positive is present on many
existing configs across the codebase). Removing the leftover `private`
qualifier on the config module resolves both alerts by making the
module publicly reachable; the taint-tracking alias below it remains
private, so no additional flow surface is exposed to consumers of this
library.
 2026-07-17 18:04:25 +00:00
copilot-swe-agent[bot]
1c810ede03 Replace non-ASCII characters (em/en dash, arrow) with ASCII equivalents in regex files 2026-07-17 17:32:30 +00:00
copilot-swe-agent[bot]
6d07e4d619 Apply codeql query format to regex library files 2026-07-17 17:28:18 +00:00
copilot-swe-agent[bot]
9758d5260b Fix Predicate QLDoc style: reword ecma_named_group_start doc to start with "Holds if" 2026-07-17 15:11:55 +00:00
copilot-swe-agent[bot]
4435279157 Replace omittable exists variables with don't-care _ 2026-07-17 14:56:48 +00:00
copilot-swe-agent[bot]
96951956fb Fix "modelled" -> "modeled" spelling in regex PR files 2026-07-17 14:39:10 +00:00
copilot-swe-agent[bot]
918d51c24b Add QLdoc to TRegexGrammar branches 2026-07-17 14:13:15 +00:00
copilot-swe-agent[bot]
c1cb146f40 Add POSIX BRE grammar support: BreRegExp + shared-core refactor 2026-07-17 13:35:37 +00:00
copilot-swe-agent[bot]
9a3613ea04 Add POSIX ERE grammar support to the C++ regex parser 2026-07-17 13:01:15 +00:00
copilot-swe-agent[bot]
e728c71f01 Refactor C++ regex parser into shared core + EcmaRegExp dialect hooks 2026-07-17 12:28:49 +00:00
copilot-swe-agent[bot]
e0cc6795dc Add isBacktrackingEngine gate excluding awk/grep/egrep from C++ ReDoS queries 2026-07-17 12:06:30 +00:00
copilot-swe-agent[bot]
d9f380d446 POSIX bracket soundness: opaque punct/cntrl/print/graph; non-recursive gate; adversarial tests 2026-07-17 10:18:17 +00:00
copilot-swe-agent[bot]
c1103b9b02 Fix C++ ECMAScript regex parser: recognize POSIX bracket sub-expressions; document multiline 2026-07-17 09:52:02 +00:00
copilot-swe-agent[bot]
47969aece8 Add cpp/redos exponential ReDoS query (Phase 4) 2026-07-16 13:06:20 +00:00
copilot-swe-agent[bot]
84d7a2b585 Add cpp/polynomial-redos query (Phase 3) 2026-07-16 12:49:15 +00:00
copilot-swe-agent[bot]
f72bad70f9 Add C++ regex flow modeling and construction-site flags (Phase 2) 2026-07-16 11:21:29 +00:00
copilot-swe-agent[bot]
a27142d2d4 Add C++ regex parser and RegexTreeView (Phase 1) 2026-07-15 21:45:03 +00:00
Mathias Vorreiter Pedersen
4f4cdf434b Merge pull request #22061 from MathiasVP/mad-write-through-model 
Shared: Support flow summaries from `ReturnValue`s
 2026-07-02 12:38:44 +01:00
Mathias Vorreiter Pedersen
f37b3e77ff Merge branch 'main' into remove-mad-support-for-variables 2026-06-30 17:38:37 +01:00
Mathias Vorreiter Pedersen
b7b731bab7 Merge branch 'main' into mad-write-through-model 2026-06-30 15:12:02 +01:00
Mathias Vorreiter Pedersen
06f54d1bbb C++: Add a TODO comment to remove support for unqualified field names. 2026-06-30 13:55:26 +01:00
Mathias Vorreiter Pedersen
396bea6e6a Update cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll 
Co-authored-by: Tom Hvitved <hvitved@github.com>
 2026-06-30 13:44:14 +01:00
Mathias Vorreiter Pedersen
fc954c3e1a C++: Remove support for marking variables as sources and sinks in MaD. 2026-06-30 12:30:40 +01:00
Mathias Vorreiter Pedersen
caaed72288 C++: Hide summary nodes that should be hidden and accept test changes. 2026-06-29 18:30:03 +01:00
Mathias Vorreiter Pedersen
2625c304bf C++: Support fully qualified field names in MaD. 2026-06-29 18:02:20 +01:00
Mathias Vorreiter Pedersen
662f522032 C++: Properly instantiate the new reverse flow feature. 2026-06-23 20:33:31 +01:00
Mathias Vorreiter Pedersen
076b01cbfc C++: Fixes after changes to the flow summary API. 2026-06-23 20:33:08 +01:00
Jeroen Ketema
6d0968744b C++: Fix NameQualifyingElement db inconsistency 2026-06-10 14:35:36 +02:00
Mathias Vorreiter Pedersen
2d581504f7 C++: Fix Copilot comments. 2026-05-28 13:34:18 +02:00
Mathias Vorreiter Pedersen
8393b40b59 C++: Use the new extensionals to map template functions and classes to their fully templated versions. 2026-05-28 13:34:12 +02:00
Mathias Vorreiter Pedersen
5f54a8691d C++: Small cleanup. This has no effect on semantics. 2026-05-27 17:16:22 +02:00
Jeroen Ketema
7862922e5c C++: Remove deprecated code 2026-05-26 17:54:51 +02:00
Jeroen Ketema
3c4e22a8ba Merge pull request #21870 from jketema/jketema/generated 
C++: Add ability to see if one template was generated from another
 2026-05-22 15:46:06 +02:00
Mathias Vorreiter Pedersen
a7405bddaa Merge pull request #21856 from MathiasVP/scanf-safe-functions 
C++: Model secure versions of `scanf` as flow sources
 2026-05-22 12:34:54 +01:00
Jeroen Ketema
0e6257de2d C++: Fix QLDoc wording 2026-05-22 13:13:25 +02:00
Jeroen Ketema
a027665ab4 C++: Add ability to see if one template was generated from another 2026-05-22 13:13:21 +02:00
Mathias Vorreiter Pedersen
a33af09244 C++: Add models for _fscanf_s_l, fwscanf_s and _fwscanf_s_l. 2026-05-20 18:59:04 +01:00
Mathias Vorreiter Pedersen
25d20399f3 C++: Add models for _scanf_s_l, wscanf_s and _wscanf_s_l. 2026-05-20 18:43:07 +01:00
Mathias Vorreiter Pedersen
157424cca3 Merge pull request #21836 from MathiasVP/uncertain-def-more-complete 
C++: Support reasoning about whether a phi node overwrites the entire buffer
 2026-05-20 13:04:37 +01:00
Mathias Vorreiter Pedersen
f5113b1932 C++: Fix internal SCC edges and accept test changes. 2026-05-19 15:39:32 +01:00
Mathias Vorreiter Pedersen
c6ce13a012 C++: Simplify recursion in 'PhiCycle::isCertain' and do not restrict the definition to be a 'PhiNode'. 2026-05-19 15:27:23 +01:00
Mathias Vorreiter Pedersen
d93de54397 C++: Consistent use of 'this.getIndirection()' in 'toString'. 2026-05-19 12:16:37 +01:00
Jeroen Ketema
22a8123ee1 Merge pull request #21860 from jketema/jketema/alias-template 
C++: Support alias templates
 2026-05-19 10:46:56 +02:00
Mathias Vorreiter Pedersen
2c156994de C++: Add two more 'fopen'-like models. 2026-05-18 14:47:11 +01:00
Mathias Vorreiter Pedersen
5f10a88208 C++: Handle size arguments in 'getOutputArgument'. 2026-05-18 14:06:18 +01:00