github-actions[bot]
625354c46e
Release preparation for version 2.21.2
2025-04-28 10:55:22 +00:00
Chuan-kai Lin
6c1e80df3a
Python: disable diff-informed PolynomialReDoS.ql
...
This commit disabled diff-informed for PolynomialReDoS.ql because it
could miss some alerts within diff ranges.
2025-04-24 14:57:06 -07:00
github-actions[bot]
d78736b1bf
Post-release preparation for codeql-cli-2.21.1
2025-04-15 16:33:15 +00:00
github-actions[bot]
b961c5961d
Release preparation for version 2.21.1
2025-04-14 09:53:06 +00:00
github-actions[bot]
10205cb990
Post-release preparation for codeql-cli-2.21.0
2025-04-01 11:30:43 +00:00
github-actions[bot]
84f6564cc0
Release preparation for version 2.21.0
2025-03-31 17:35:15 +00:00
Arthur Baars
9dd7b20db7
Merge pull request #18960 from github/aibaars/rust-tainted-path
...
Rust: TaintedPath query
2025-03-27 10:37:36 +01:00
Arthur Baars
d3e28772ae
Rust/Python improve qldoc of SafeAccessCheck
2025-03-20 11:16:45 +01:00
Chris Smowton
9a2a13ed55
Merge remote-tracking branch 'origin/main' into smowton/admin/merge-rc317-into-main
2025-03-19 16:01:29 +00:00
github-actions[bot]
51cdeefafb
Post-release preparation for codeql-cli-2.20.7
2025-03-17 13:00:41 +00:00
github-actions[bot]
2d64a618e6
Release preparation for version 2.20.7
2025-03-17 12:15:54 +00:00
Taus
3d643c02be
Merge pull request #18921 from github/tausbn/python-fix-unused-global-variable-in-forward-annotation-fp
...
Python: Add support for forward references in unused var query
2025-03-13 16:37:25 +01:00
Taus
f30ebf1571
Merge pull request #18871 from github/tausbn/python-modernise-special-method-signature-query
...
Python: Move min/maxParameter methods to `Function` class
2025-03-13 13:03:21 +01:00
Taus
6546bb1b1d
Merge branch 'main' into tausbn/python-fix-match-pruning-logic
2025-03-06 14:37:58 +01:00
Taus
bf3d9ee6a9
Python: Address review comments
2025-03-04 22:30:55 +00:00
Taus
f246ef764a
Python: Update change note
...
Co-authored-by: Aditya Sharad <6874315+adityasharad@users.noreply.github.com >
2025-03-04 18:09:54 +01:00
Taus
50a01b1244
Python: Remove superfluous reference to FunctionExpr
...
This way we also get annotations that appear in `Lambda`s
2025-03-04 15:53:34 +00:00
Taus
88615f427b
Python: Add support for forward declarations in unused var query
...
Fixes the false positive reported in
https://github.com/github/codeql/issues/18910
Adds a new `Annotation` class (subclass of `Expr`) which encompasses all
possible kinds of annotations in Python.
Using this, we look for string literals which are part of an annotation,
and which have the same content as the name of a (potentially) unused
global variable, and in that case we do not produce an alert.
In future, we may want to support inspecting such string literals more
deeply (e.g. to support stuff like "list[unused_var]"), but I think for
now this level of support is sufficient.
2025-03-04 14:41:45 +00:00
github-actions[bot]
58f355ae5a
Post-release preparation for codeql-cli-2.20.6
2025-03-03 18:18:15 +00:00
github-actions[bot]
fa850cccb1
Release preparation for version 2.20.6
2025-03-03 17:13:19 +00:00
Taus
83cdcdbb0b
Python: Add change note
2025-02-26 13:53:49 +00:00
Taus
3956a1fea8
Python: Move min/maxParameter methods to Function
...
These seem generally useful outside of points-to, and so it might be
better to add them to the `Function` class instead.
I took the liberty of renaming these to say `Arguments` rather than
`Parameters`, as this is more in line with the nomenclature that we're
using elsewhere. (The internal points-to methods retain the old names.)
I'm somewhat ambivalent about the behaviour of `getMaxParameters` on
functions with `*varargs`. The hard-coded `INT_MAX` return value is
somewhat awkward, but the alternative (to only have the predicate
defined when a specific maximum exists) seems like it would potentially
cause a lot of headaches.
2025-02-26 13:51:12 +00:00
github-actions[bot]
ad24f94a77
Post-release preparation for codeql-cli-2.20.5
2025-02-17 17:58:24 +00:00
github-actions[bot]
6f4562f3bd
Release preparation for version 2.20.5
2025-02-17 16:55:54 +00:00
Taus
a69e3f5236
Python: Add change note
...
Co-authored-by: yoff <yoff@github.com >
2025-02-11 13:02:09 +00:00
Asger F
eedfa4dbb2
Merge pull request #18341 from asgerf/py/diff-informed
...
Python: enable diff-informed data flow queries
2025-02-11 13:15:44 +01:00
yoff
37ddaa36ad
Merge pull request #18702 from github/tausbn/python-allow-comments-in-subscripts
...
Python: Allow comments in subscripts
2025-02-06 23:31:29 +01:00
Taus
131ec8d22f
Python: Handle loop constructs outside of loops
...
Observed on some test files in Nuitka/Nuitka, having `break` and
`continue` outside of loops in Python is (to Python) a syntax error, but
our parser happily accepted this broken syntax.
This then caused issues further downstream in the control-flow
construction, as it broke some invariants.
To fix this we now skip the code that would previously fail when the
invariants are broken.
Co-authored-by: yoff <yoff@github.com >
2025-02-06 14:30:16 +00:00
Taus
3d25cd3bb5
Python: Add change note
2025-02-06 14:08:20 +00:00
Asger F
d3b9d1d89d
JS: Partial SSRF does not select the sink location
2025-02-06 11:30:32 +01:00
Asger F
7d6abb4e0a
JS: Disable diff-informedness for full SSRF
...
Partial SSRF uses its result in a way that prevents diff-informedness
2025-02-06 11:30:18 +01:00
Asger F
d3ee658399
Python: resolve remaining TODOs
2025-02-06 10:27:56 +01:00
Asger F
975ce064fc
Python: implement for polynomial redos
2025-02-06 10:27:45 +01:00
Asger F
e4a1847dad
Python: mass enable diff-informed data flow
2025-02-06 10:27:19 +01:00
github-actions[bot]
f1b05a79a4
Post-release preparation for codeql-cli-2.20.4
2025-02-04 09:25:09 +00:00
github-actions[bot]
573e53e454
Release preparation for version 2.20.4
2025-02-03 15:19:35 +00:00
erik-krogh
a1afa20d4b
add change-notes
2025-01-27 22:43:13 +01:00
erik-krogh
90b403b40b
py: delete the remainder of the deprecated TypeTracker libary
2025-01-27 22:17:18 +01:00
erik-krogh
34f5f61a10
all: use my script to delete outdated deprecations
2025-01-27 22:16:48 +01:00
github-actions[bot]
fbb7f0a0c6
Post-release preparation for codeql-cli-2.20.2
2025-01-20 21:11:14 +00:00
github-actions[bot]
a0512a50f2
Release preparation for version 2.20.2
2025-01-20 21:11:12 +00:00
Joe Farebrother
d248fbfe57
Merge pull request #18301 from joefarebrother/python-model-missing-builtins
...
Python: Add models for builtins `map`, `filter`, `zip`, and `enumerate`.
2025-01-20 16:39:37 +00:00
Geoffrey White
90faab456d
Merge pull request #18473 from geoffw0/sensitive2
...
Improve shared sensitive data library handling of snake_case variable names
2025-01-15 18:02:33 +00:00
Joe Farebrother
344dd2dab5
Qldoc fix
2025-01-15 10:26:37 +00:00
Joe Farebrother
2aea356756
Add change note + fix tests
2025-01-15 10:24:18 +00:00
Joe Farebrother
460de3f7d5
Reduce generality of map and zip for performance
2025-01-14 09:39:57 +00:00
Joe Farebrother
4e36008ed9
Add tests
2025-01-14 09:39:56 +00:00
Joe Farebrother
642f9dcbea
Model missing builtins
2025-01-14 09:39:54 +00:00
yoff
599411b440
Merge pull request #17787 from yoff/shared/add-location-to-typetracking-nodes
...
shared: Add locations to type tracking nodes
2025-01-13 23:06:09 +01:00
Joe Farebrother
a7fb73a2b2
Merge pull request #18185 from joefarebrother/python-lxml
...
Python: Model additional flow steps for the lxml framework
2025-01-10 13:40:16 +00:00
