9616 Commits

Author SHA1 Message Date
Geoffrey White
918700ff6f Merge branch 'main' into moresensitive2 2025-07-14 11:58:08 +01:00
Geoffrey White
30c6082b5d Sync identical files. 2025-07-14 11:45:34 +01:00
Joe Farebrother
61af4e4514 Add changenote and update integraion test output 2025-07-14 11:00:05 +01:00
Joe Farebrother
ea48fcca8f Update doc for equalsNotEquals 2025-07-14 10:49:28 +01:00
Jeroen Ketema
f07d8ee493 Remove duplicate copies of CryptoAlgorithms and CryptoAlgorithmNames 2025-07-14 11:39:06 +02:00
Jeroen Ketema
f4ba2e1fd0 Properly share CryptoAlgorithms and CryptoAlgorithmNames 2025-07-14 11:39:00 +02:00
Jeroen Ketema
c582a9ccd6 Remove duplicate copies of SensitiveDataHeuristics 2025-07-14 11:38:52 +02:00
Jeroen Ketema
8b828cecf1 Use shared SensitiveDataHeuristics 2025-07-14 11:38:47 +02:00
Joe Farebrother
58f503de38 Update docs for incomplete ordering + inconsistent hashing 2025-07-11 23:08:50 +01:00
Joe Farebrother
843a6c8012 Remove total order check from equals not equals (doesn't make sense there; total order doesn't define eq or ne methods at all) 2025-07-11 15:12:59 +01:00
Joe Farebrother
083d258585 Add/update unit tests 2025-07-11 15:10:45 +01:00
Taus
c6c6a857df Python: Add tests
Also fixes an issue with the return type annotations that caused these
to not work properly.

Currently, annotated assignments don't work properly, due to the fact
that our flow relation doesn't consider flow going to the "type" part of
an annotated assignment. This means that in `x : Foo`, we do correctly
note that `x` is annotated with `Foo`, but we have no idea what `Foo`
is, since it has no incoming flow.

To fix this we should probably just extend the flow relation, but this
may need to be done with some care, so I have left it as future work.
2025-07-11 12:03:14 +00:00
Taus
2c45550a9f Python: Add change note
Co-authored-by: Napalys Klicius <napalys@github.com>
2025-07-11 12:03:14 +00:00
Taus
d1cf7f0624 Python: Support type annotations in call graph
Adds support for tracking instances via type annotations. Also adds a
convenience method to the newly added `Annotation` class,
`getAnnotatedExpression`, that returns the expression that is annotated
with the given type. For return annotations this is any value returned
from the annotated function in question.

Co-authored-by: Napalys Klicius <napalys@github.com>
2025-07-11 12:03:14 +00:00
Geoffrey White
8f6f9f4359 Add change notes. 2025-07-11 11:54:59 +01:00
Geoffrey White
123458fd21 Sync identical files. 2025-07-10 18:10:24 +01:00
Joe Farebrother
8fb9bdd0af move equals attr test to equals attr folder 2025-07-09 15:25:21 +01:00
Joe Farebrother
a687b60af9 Modernise equals-hash-mismatch 2025-07-09 14:14:38 +01:00
Joe Farebrother
eb1b5a35d7 Modernize inconsistent equality 2025-07-09 14:14:30 +01:00
Joe Farebrother
4c5c4e06c3 Move inconsistentEquality and equals-hash-mismatch to subfolder 2025-07-09 14:14:26 +01:00
Joe Farebrother
e71af8fd6d Move to subfolder 2025-07-09 14:14:22 +01:00
Joe Farebrother
fccdc30ac5 Modernize incomplete ordering query 2025-07-09 14:14:17 +01:00
Jonas Jensen
5a1246a586 Merge remote-tracking branch 'upstream/main' into approximate-related-location 2025-07-09 10:10:20 +02:00
github-actions[bot]
24a0ac1223 Post-release preparation for codeql-cli-2.22.2 2025-07-07 18:15:04 +00:00
github-actions[bot]
f12daefabe Release preparation for version 2.22.2 2025-07-07 14:00:26 +00:00
Asger F
4a2d795076 Shared: Make approximate location filtering the default behaviour 2025-07-02 14:41:02 +02:00
Asger F
a46b5f9529 Python: enable diff-informedness for poly redos using approximate related locations 2025-07-02 14:39:42 +02:00
Michael Nebel
233b54c7fa Merge pull request #19891 from michaelnebel/michaelnebel/freezemoresuites
Go/Ruby/Python: Freeze quality queries in `security-and-quality`.
2025-07-01 09:04:19 +02:00
Taus
184dd5bf10 Merge pull request #19895 from github/tausbn/python-fix-match-as-identifier
Python: Allow use of `match` as an identifier
2025-06-30 16:24:23 +02:00
Kasper Svendsen
da1b99b921 Merge pull request #19779 from github/kaspersv/overlay-java-annotations
Overlay: Add overlay annotations to Java & shared libraries
2025-06-27 08:26:33 +02:00
Joe Farebrother
4cbaeb10e9 Merge pull request #19641 from joefarebrother/python-qual-file-not-closed
Python: Improve performance of FileNotClosed query by using basic block reachability
2025-06-26 23:35:38 +01:00
Taus
cd0e46314c Python: Add change note 2025-06-26 15:36:02 +00:00
Taus
ad53518644 Python: Regenerate parser files 2025-06-26 15:34:44 +00:00
Taus
e04821e9e3 Python: Allow use of match as an identifier
This previously only worked in certain circumstances. In particular,
assignments such as `match[1] = ...` or even just `match[1]` would fail
to parse correctly.

Fixing this turned out to be less trivial than anticipated. Consider the
fact that
```
match [1]: case (...)
```
can either look the start of a `match` statement, or it could be a type
ascription, ascribing the value of `case(...)` (a call) to the item at
index 1 of `match`.

To fix this, then, we give `match` the identifier and `match` the
statement the same precendence in the grammar, and additionally also
mark a conflict between `match_statement` and `primary_expression`. This
causes the conflict to be resolved dynamically, and seems to do the
right thing in all cases.
2025-06-26 15:33:00 +00:00
Michael Nebel
37b3ca036a Python: Freeze the quality queries in the security-and-quality suite. 2025-06-26 14:45:05 +02:00
Kasper Svendsen
9d2dd782d9 Merge remote-tracking branch 'github/main' into kaspersv/overlay-java-annotations 2025-06-26 13:18:25 +02:00
github-actions[bot]
6972c7a872 Post-release preparation for codeql-cli-2.22.1 2025-06-24 12:55:14 +00:00
github-actions[bot]
3e074b2425 Release preparation for version 2.22.1 2025-06-24 08:55:31 +00:00
Kasper Svendsen
2da8d61984 Run config/sync-files.py 2025-06-24 10:25:06 +02:00
Joe Farebrother
f457453647 Update redundant assignment to be a correctness issue for cross language consistency 2025-06-19 14:22:12 +01:00
Joe Farebrother
e67f057b85 Update integration test output 2025-06-19 14:09:55 +01:00
Joe Farebrother
63d7eac127 Ensure exactly one subcategory is used 2025-06-19 14:09:07 +01:00
Joe Farebrother
c8c92a7139 Update tags for mixed-tuple-returns to include exactly 1 subcategory 2025-06-19 14:09:00 +01:00
Joe Farebrother
c3f7b18055 Review suggestions - update some tags 2025-06-19 14:08:51 +01:00
Joe Farebrother
09516a47d3 Fix integration test output 2025-06-19 14:08:42 +01:00
Joe Farebrother
d28a19c961 Update integration test output & add changenote 2025-06-19 14:08:30 +01:00
Joe Farebrother
fa5b2ef794 Tag remaining high precision quality queries
Excluded queries that are python 2 specific; as well as the cyclic import queries
2025-06-19 14:08:07 +01:00
Joe Farebrother
02f8ec33f2 Tag 'type-checking'-like quality queries 2025-06-19 14:07:55 +01:00
Joe Farebrother
4b1d31c976 Tag 'linter-like' quality queries that don't use pointsto 2025-06-19 14:07:42 +01:00
Joe Farebrother
869e33e38c Tag 'linter-like' quality queries that use pointto
Excluded for now: unnecassary-delete; since the pattern is often intentional to break reference cycles, which the query doesn't account for; so uncertain about its claim of high precision
2025-06-19 14:07:15 +01:00