88676 Commits

Author SHA1 Message Date
Mathias Vorreiter Pedersen
478878cfb7 Merge pull request #22242 from MathiasVP/add-reg-flow-sources
C++: Add flow sources for `winreg.h`
2026-07-28 18:45:19 +01:00
Jeroen Ketema
9d1a8a7298 Merge pull request #22129 from jketema/jketema/subst-fix
Introduce canonicalization library for Windows `subst` drives
2026-07-28 16:21:44 +02:00
Taus
3a4897298d Merge pull request #22233 from github/tausbn/swift-syntax-rs-sequenced
unified: Switch over to using `swift-syntax` for parsing
2026-07-28 16:06:15 +02:00
yoff
4d885a891f Merge pull request #21921 from github/yoff/python-add-new-cfg-library
Python: add new shared-CFG-backed control flow graph (additive)
2026-07-28 15:12:31 +02:00
yoff
3ad48615a7 Python: fix replace of upper-case characters 2026-07-28 14:54:09 +02:00
Mathias Vorreiter Pedersen
034a90bf2a C++: Accept test changes. 2026-07-28 13:53:06 +01:00
Mathias Vorreiter Pedersen
daefacfcc9 C++: Add models for 'RegGetValue' and friends. 2026-07-28 13:52:09 +01:00
Mathias Vorreiter Pedersen
b0f345a1ad C++: Add a test for 'RegGetValueA'. 2026-07-28 13:50:12 +01:00
yoff
c516d1f0b9 python: forward rather implement subtle predicates 2026-07-28 14:49:18 +02:00
yoff
c11b4914e9 Update python/ql/lib/semmle/python/controlflow/internal/AstNodeImpl.qll
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
2026-07-28 14:42:04 +02:00
Taus
ceffe40a54 unified: Remove references to Swift input schema generation 2026-07-28 11:55:11 +00:00
Taus
a2ff35a72d unified: Fix Bazel formatting errors 2026-07-28 11:45:53 +00:00
Taus
a3d9492e8c Merge branch 'main' into tausbn/swift-syntax-rs-sequenced 2026-07-28 13:39:46 +02:00
Mathias Vorreiter Pedersen
7bd322a3c7 C++: Add change note. 2026-07-28 12:26:18 +01:00
Mathias Vorreiter Pedersen
154b3b1f6c C++: Accept test changes. 2026-07-28 12:20:34 +01:00
Mathias Vorreiter Pedersen
16ad0a3c31 C++: Add flow sources for 'winreg.h'. 2026-07-28 12:20:14 +01:00
Mathias Vorreiter Pedersen
b5cb703f2e C++: Add tests with missing flow sources. 2026-07-28 12:19:15 +01:00
Michael B. Gale
07514086a1 Merge pull request #22204 from github/dependabot/bazel/rules_nodejs-6.7.5
build(deps): bump rules_nodejs from 6.7.3 to 6.7.5
2026-07-27 16:55:19 +01:00
yoff
9b4de2bfb6 Python: add tests for short-circuiting comparisons
- Both the old and new CFG model this incorrectly right now.
- Added ConsecutivePredecessorTimestamps.ql for the old CFG for symmetry.
2026-07-27 17:52:24 +02:00
Taus
ba26e1d029 unified: Add corpus tests for nested types
Adds a few tests that validate that higher-order functions are parsed
correctly into the commonAST representation.

Also removes a redundant assignment to `ctx.in_function_type` that
happend after all translations had taken place (and so nothing would
actually read this field).
2026-07-27 15:48:06 +00:00
yoff
3206ab0be1 Python: address CodeQL alerts 2026-07-27 17:37:36 +02:00
yoff
665e046ae6 Python: add overlay annotations to inlined predicates 2026-07-27 17:00:35 +02:00
yoff
fa94dc9a32 Python: remove reference to line numbers 2026-07-27 16:31:41 +02:00
yoff
05aa8debc4 python: make LoopStmt final 2026-07-27 16:25:07 +02:00
yoff
aa305c20b1 Python: mark definition of type ascription as SPURIOUS 2026-07-27 16:25:06 +02:00
yoff
2c0ed98cb2 python: remove uninformative headers 2026-07-27 16:25:06 +02:00
yoff
1068add0ed Split tests with disjoint concerns 2026-07-27 16:25:05 +02:00
yoff
90c1ddfd49 Update python/ql/lib/ide-contextual-queries/printCfg.ql
Co-authored-by: Tom Hvitved <hvitved@github.com>
2026-07-27 16:24:46 +02:00
Jeroen Ketema
726705b731 Address review comments 2026-07-27 14:00:40 +02:00
Jeroen Ketema
9976a7a3ac Address review comments 2026-07-27 14:00:38 +02:00
Jeroen Ketema
c95a8ab9d2 Go: Update expected test results 2026-07-27 14:00:36 +02:00
Jeroen Ketema
e06ce00d60 Go: Resolve substed drives on Windows 2026-07-27 14:00:34 +02:00
Jeroen Ketema
009ed608e0 Java: Update expected test results 2026-07-27 14:00:33 +02:00
Jeroen Ketema
75ee4afec9 Kotlin: Resolve substed drives on Windows 2026-07-27 14:00:31 +02:00
Jeroen Ketema
4f30042b10 Update expected test results after CLI/extractor changes 2026-07-27 14:00:29 +02:00
Asger F
9c5cd36ab7 Merge pull request #22222 from cysp/fastify-scoped-rate-limit
JS: Recognize @fastify/rate-limit as a rate limiter
2026-07-27 13:02:25 +02:00
Taus
e3a0822248 unified: Package the swift-syntax parser in the extractor pack
The extractor shells out to a separate `swift-syntax-parse` binary, but
nothing placed it in the extractor pack, so a shipped Swift extraction
failed at the first spawn. Package it next to the extractor, the same
way `//swift/extractor` ships its Swift-linked binary: a small wrapper
points the dynamic loader at its own directory and execs the real
binary, whose Swift runtime libraries travel alongside it.

- `swift-syntax-parse.sh`: wrapper that sets `LD_LIBRARY_PATH` /
  `DYLD_LIBRARY_PATH` to its directory and execs
  `swift-syntax-parse.real`
  (mirrors `swift/extractor/extractor.sh`).
- `runtime.bzl`: a `swift_runtime_libs` rule that selects just the Linux
  Swift runtime shared objects (`usr/lib/swift/linux/*.so`) out of the
  full toolchain, so only they — not the whole toolchain — travel with
  the binary.
- `swift-syntax-rs/BUILD.bazel`: the `rust_binary` becomes
  `swift-syntax-parse.real`
  and carries the runtime libraries as runfiles on Linux; a `sh_binary`
  (`swift-syntax-parse`) is the wrapper; `codeql_pkg_runfiles` flattens
  the three (wrapper, real binary, runtime) into one directory.
- `BUILD.bazel`: ship that group under `tools/{CODEQL_PLATFORM}` next to
  the extractor, on the platforms where swift-syntax builds
  (Linux/macOS).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-24 16:10:12 +00:00
Taus
7721ce2eba unified: Add swift_node_types.yml to the extractor's compile_data
`languages::swift::adapter` embeds the swift-syntax node-types schema
with `include_str!("../../../swift_node_types.yml")`, but the file was
never listed in the extractor's Bazel `compile_data`. The `cargo` build
finds it on disk, so this went unnoticed, but the sandboxed Bazel build
cannot see it and fails to compile the extractor. List it alongside
`ast_types.yml`.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-24 16:08:16 +00:00
Taus
17cbb4eb6b unified: Harden the external Swift parser integration
Two fixes prompted by review of the swift-syntax switch-over.

Parser resolution (`parse.rs`): `parse_bin` now resolves the
`swift-syntax-parse` executable in priority order — the
`CODEQL_EXTRACTOR_UNIFIED_SWIFT_SYNTAX_PARSE` override, then a copy next
to the extractor executable (as a shipped extractor pack lays it out:
`tools/<platform>/{extractor,swift-syntax-parse}`), then a
bare `PATH` lookup. This lets a packaged extractor find its parser with
no environment setup. (Bundling the binary into the pack, together with
its Swift runtime, is a separate follow-up.)

Corpus test guard (`corpus_tests.rs`): `parser_available` previously
treated *any* parser error as "unavailable" and skipped the entire
corpus suite, so a parser that was present but crashed or emitted
invalid JSON would silently skip the exact regressions the suite exists
to catch. It now uses the new `binary_available`, which reports whether
the *executable* can be launched (false only when it cannot be found,
e.g. no Swift toolchain); a launchable-but-failing parser makes the
suite run and fail.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-24 16:08:16 +00:00
Taus
c50bcbacc0 swift-syntax-rs: Degrade gracefully without a Swift toolchain
`swift-syntax-rs` is a workspace member, so its build script runs on a
plain `cargo check`/`fmt`/`clippy` at the repo root. Previously it
panicked when `swift build` could not be run, breaking those Swift-free
workflows for anyone without a Swift toolchain.

Instead, when `swift build` cannot be spawned, emit a `cargo:warning`
and skip the link directives rather than panicking. `cargo
check`/`fmt`/`clippy` don't link, so they keep working; only `cargo
build`/`cargo test` then fail, at link time — which is fair, since those
genuinely need Swift (and CI builds go through Bazel). A Swift toolchain
that is present but whose build fails is still surfaced as a hard error.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-24 16:08:16 +00:00
Taus
046c88a329 unified: Regenerate the enhanced getter/setter property corpus case
Regenerate `types/property-with-getter-and-setter`, whose mapped AST now
differs from the tree-sitter output: the backing `private var _v`
retains its `private` modifier (`modifier "var"` + `modifier
"private"`), whereas the tree-sitter path dropped it (its
`visibility_modifier` node carried no text). The swift-syntax
front-end preserves the modifier, so the mapped AST is strictly richer
here.

The raw (second) section is regenerated to the swift-syntax AST like the
other cases; the mapped (third) section gains the retained `private`
modifier.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-24 16:08:15 +00:00
Taus
20a2537299 unified: Regenerate the raw-AST corpus section for swift-syntax
Now that the Swift front-end is swift-syntax, regenerate the second (raw
parse tree) section of the corpus `.output` files to hold the
swift-syntax AST the adapter builds, instead of the old tree-sitter
parse tree.

These 98 cases map to a byte-for-byte identical mapped AST (the third
section), so only their raw section changes — the mapping rules were
ported to produce the same output. The one case whose mapped AST differs
(`types/property-with-getter-and-setter`) is handled separately.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-24 16:08:15 +00:00
Taus
5c5fd5e1cc unified: Switch the Swift front-end to swift-syntax
Flip the runtime Swift front-end from tree-sitter to swift-syntax. The
mapping rules were already ported, so the mapped AST is unchanged; this
makes the switch live.

- `language_spec` now builds a language-free desugarer
  (`ConcreteDesugarer::without_language`) and wires the swift-syntax
  parser (`swift_parse::parse`) as the front-end, dropping the
  tree-sitter language and node types. The desugarer supplies the output
  schema, so `node_types` is left empty.
- The `swift_adapter`/`swift_parse` modules are no longer
  `allow(dead_code)`: they are now reached from the live extraction
  path.
- `corpus_tests` skips (rather than fails) when the external
  `swift-syntax-parse` binary is unavailable, since it cannot run
  without the Swift-backed parser.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-24 16:08:15 +00:00
Taus
c4fbd74cfe unified: Port constructor and related declaration rules to swift-syntax
Retarget the remaining member declarations to the swift-syntax AST. An
`initializerDecl` becomes a `constructor_declaration` (its body
optional, so a bodyless protocol requirement still maps);
`deinitializerDecl`, `typeAliasDecl`, and `associatedTypeDecl` map to
`destructor_declaration`, `type_alias_declaration`, and
`associated_type_declaration` respectively.

The tree-sitter subscript and preprocessor-diagnostic rules are dropped:
their swift-syntax counterparts (`subscriptDecl`, `ifConfigDecl`) fall
through to the `unsupported_node` fallback, producing the same output.
This also removes the now-unused `type` unwrap rule (swift-syntax has no
such wrapper node) and retires the last `ctx.literal` helper use in
favour of a `tree!` leaf.

PARITY(tree-sitter): the initializer's parameters are still not emitted,
because the tree-sitter path dropped them too. Emitting them is a future
improvement.

This completes the rule migration: every declaration now maps through
the swift-syntax front-end.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-24 16:08:15 +00:00
Taus
90ea1b591d unified: Port enum-case rules to swift-syntax
Retarget enum cases to the swift-syntax AST. An `enumCaseDecl` flattens
its comma-separated `enumCaseElement`s (non-first tagged
`chained_declaration`) and publishes any case modifiers (e.g.
`indirect`) into `ctx`; an element with a payload becomes a nested
`class_like_declaration` + constructor, an element with a raw value
(`case a = 1`) or a plain element a `variable_declaration`;
`enumCaseParameter` becomes a `parameter`.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-24 16:08:15 +00:00
Taus
ec0c49a053 unified: Port property accessor rules to swift-syntax
Retarget property accessors to the swift-syntax AST, output unchanged.
An accessor-bearing `variableDecl` publishes the property name/type into
`ctx`; a computed property (`var v: T { get set }`) emits accessors
carrying the type, while a stored property with observers (`var x = e {
didSet {…} }`) emits the backing `variable_declaration` first.
swift-syntax models get/set/willSet/didSet uniformly as `accessorDecl`,
so a single `accessorDecl` rule — with an optional body distinguishing a
computed accessor from a bodyless protocol requirement — replaces the
tree-sitter grammar's separate computed-getter/setter/modify,
willset/didset, and getter-/setter-specifier rules.

The tree-sitter protocol property and function requirement rules
(`protocol_property_declaration`, `protocol_function_declaration`) are
dropped: swift-syntax models those requirements as ordinary
`variableDecl`s (with bodyless accessors) and `functionDecl`s, already
handled by the general rules.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-24 16:08:15 +00:00
Taus
8e6651aa9b unified: Port type-container declarations to swift-syntax
Retarget the nominal type declarations to the swift-syntax AST, output
unchanged.
`classDecl`/`structDecl`/`enumDecl`/`protocolDecl`/`extensionDecl`
each become a `class_like_declaration` tagged with a modifier naming the
declaration keyword, with members drawn from the `memberBlock`; each
`memberBlockItem` unwraps to its contained declaration. `superExpr` maps
to `super_expr`; `self` needs no rule (swift-syntax models it as an
ordinary `declReferenceExpr`, already a `name_expr`).

Following the tree-sitter path (PARITY), the inheritance clause is not
emitted as a `base_type` (the tree-sitter rule captured it positionally,
but the grammar nests it under a field, so it never actually matched);
swift-syntax exposes it cleanly, so that is a correctness improvement to
make once tree-sitter is retired. The tree-sitter grammar's standalone
`self`, dead modifier (`visibility_modifier`, etc.), key-path, and
inheritance-specifier rules are dropped; `#selector`/`#keyPath` (now a
`macroExpansionExpr`) stays an `unsupported_node`.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-24 16:08:15 +00:00
Taus
37654b4bcc unified: Port import rules to swift-syntax
Retarget imports to the swift-syntax AST, output unchanged. swift-syntax
represents the dotted path as a list of `importPathComponent`s, folded
into a `name_expr`/`member_access_expr` chain via `member_chain`. A
single rule handles both forms via an optional `importKindSpecifier`: a
scoped import (`import struct Foo.Bar`) has one and binds the last path
component as a `name_pattern`; a plain import (`import Foundation`) has
none and uses a `bulk_importing_pattern`. Leading attributes
(`@_exported`) and access modifiers (`public`) become `modifier`s.

The tree-sitter multi-part `identifier` rule is dropped: swift-syntax
qualified names are already `memberAccessExpr` chains, and import paths
are `importPathComponent`s.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-24 16:08:15 +00:00
Taus
6275977bc5 unified: Port optional and error-handling rules to swift-syntax
Retarget optional chaining, `try`, `do`/`catch`, casts, type tests,
`await`, and force-unwrap to the swift-syntax AST, output unchanged:

- `optionalChainingExpr` (`x?`) unwraps transparently (the enclosing
  member access / call carries the semantics).
- `tryExpr` -> prefix `unary_expr`; swift-syntax splits the operator
  into a `try` keyword and an optional `?`/`!` mark, recombined into one
  `prefix_operator` spelling.
- `doStmt` -> `try_expr` with `catchClause` -> `catch_clause`; a `catch`
  binds the first `catchItem`'s pattern and optional `where` guard.
- `asExpr` (`x as`/`as?`/`as!` `T`) -> `type_cast_expr`, `isExpr`
  (`x is T`) -> `type_test_expr`, and `awaitExpr` -> prefix
  `unary_expr`.
- `forceUnwrapExpr` (`x!`) -> postfix `unary_expr` (swift-syntax has a
  dedicated node; the tree-sitter path used the generic postfix
  operator).

A couple of rewritten rules keep their opening inlined so this commit's
diff stays readable; a later commit restores the canonical formatting.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-24 16:08:15 +00:00
Taus
4c764b52dc unified: Port collection rules to swift-syntax
Retarget collection literals and subscripts to the swift-syntax AST,
output unchanged: `arrayExpr` -> `array_literal` (each `arrayElement`
unwraps to its expression); `dictionaryExpr` -> an opaque `map_literal`
leaf (its source span, matching the tree-sitter path); and
`subscriptCallExpr` (`xs[0]`) -> `call_expr`, mirroring the tree-sitter
grammar's treatment of a subscript as a call.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-24 16:08:14 +00:00