Joe Farebrother
6431228d37
Limit size of allowImplicitRead for performance
2025-04-16 09:40:01 +01:00
github-actions[bot]
d78736b1bf
Post-release preparation for codeql-cli-2.21.1
2025-04-15 16:33:15 +00:00
github-actions[bot]
b961c5961d
Release preparation for version 2.21.1
2025-04-14 09:53:06 +00:00
Joe Farebrother
7f7fca9e27
Merge pull request #19165 from joefarebrother/python-qual-loop-var-capture
...
Python: Modernize the Loop Variable Capture query
2025-04-10 13:07:05 +01:00
Joe Farebrother
6802037c89
Update qhelp formatting
2025-04-10 09:52:18 +01:00
Joe Farebrother
00999baf9a
Apply docs review suggestion - Reword query description.
...
Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com >
2025-04-10 09:06:01 +01:00
Joe Farebrother
84aa2e8627
Apply review suggestion - Tweak wording of example comment
...
Co-authored-by: Taus <tausbn@github.com >
2025-04-09 14:07:38 +01:00
Joe Farebrother
e08072d77b
Fix qhelp formatting
2025-04-04 12:51:46 +01:00
Joe Farebrother
de7e611962
Rewrite documentation
2025-04-04 12:36:13 +01:00
Joe Farebrother
b5805503fe
Cleanups
2025-04-04 11:56:07 +01:00
Joe Farebrother
9fb1c31206
Update tests to inline expectations
2025-04-04 10:13:39 +01:00
Joe Farebrother
adfe89fadc
Update test output
2025-04-04 09:47:21 +01:00
Joe Farebrother
c37809a187
Reduce scope of allowImplicitRead to avoid cartesian product.
2025-04-02 09:35:50 +01:00
Joe Farebrother
2d6476ad21
Update names and alert message
2025-04-02 09:35:43 +01:00
Joe Farebrother
11830bf661
Move to separate folder
2025-04-02 09:35:39 +01:00
Joe Farebrother
5b7200a041
Use flow path in alerts
2025-04-02 09:35:32 +01:00
Joe Farebrother
08b4281187
Update query message and remove field case
2025-04-02 09:35:25 +01:00
Joe Farebrother
efdb4a6d82
Use global dataflow for loop variable capture
2025-04-02 09:35:17 +01:00
Taus
aacdc70a73
Merge pull request #19136 from github/tausbn/python-modernise-mixed-tuple-returns-query
...
Python: Modernize `py/mixed-tuple-returns`
2025-04-01 17:31:56 +02:00
Arthur Baars
0e23b86bf5
Merge pull request #19182 from github/post-release-prep/codeql-cli-2.21.0
...
Post-release preparation for codeql-cli-2.21.0
2025-04-01 15:12:29 +02:00
github-actions[bot]
10205cb990
Post-release preparation for codeql-cli-2.21.0
2025-04-01 11:30:43 +00:00
Joe Farebrother
73eebcbca6
Python: Add file-not-closed and special-method-wrong-signature to python code-quality suite
2025-04-01 10:05:17 +01:00
github-actions[bot]
84f6564cc0
Release preparation for version 2.21.0
2025-03-31 17:35:15 +00:00
Taus
840abbf5b1
Merge pull request #18956 from github/tausbn/python-more-special-method-query-refactoring
...
Python: Modernize special method query
2025-03-28 17:11:24 +01:00
Taus
6674288fd2
Python: Update test cases
...
Adds a comment explaining why we no longer flag the indirect tuple
example.
Also adds a test case which _would_ be flagged if not for the type
annotation.
2025-03-28 15:12:39 +00:00
Joe Farebrother
43567664bf
Merge pull request #18845 from joefarebrother/python-qual-file-not-closed
...
Python: Modernize File Not Always Closed query
2025-03-28 14:47:38 +00:00
Taus
68668b8e22
Python: Fix grammar in change note
2025-03-27 23:23:29 +01:00
Joe Farebrother
2fd9b16736
Attempt performance improvement for fileLocalFlow
2025-03-27 15:45:38 +00:00
Taus
980c7d83da
Python: Add change note
2025-03-27 15:33:00 +00:00
Taus
f601f4ad9b
Python: Update test expectations
...
As we're no longer tracking tuples across function boundaries, we lose
the result that related to this setup (which, as the preceding commit
explains, lead to a lot of false positives).
2025-03-27 15:31:28 +00:00
Taus
2dcd7895ec
Python: Modernise py/mixed-tuple-returns
...
Removes the dependence on points-to in favour of an approach based on
(local) data-flow.
I first tried a version that used type tracking, as this more accurately
mimics the behaviour of the old query. However, I soon discovered that
there were _many_ false positives in this setup. The main bad pattern I
saw was a helper function somewhere deep inside the code that both
receives and returns an argument that can be tuples with different sizes
and origins. In this case, global flow produces something akin to a
cartesian product of "n-tuples that flow into the function" and
"m-tuples that flow into the function" where m < n.
To combat this, I decided to instead focus on only flow _within_ a given
function (and so local data-flow was sufficient).
Additionally, another class of false positives I saw was cases where the
return type actually witnessed that the function in question could
return tuples of varying sizes. In this case it seems reasonable to not
flag these instances, since they are already (presumably) being checked
by a type checker.
More generally, if you've annotated the return type of the function with
anything (not just `Tuple[...]`), then there's probably little need to
flag it.
2025-03-27 15:27:42 +00:00
Arthur Baars
9dd7b20db7
Merge pull request #18960 from github/aibaars/rust-tainted-path
...
Rust: TaintedPath query
2025-03-27 10:37:36 +01:00
Tamas Vajk
34e8318797
Rename the CCR query suite to code-quality
2025-03-27 08:36:53 +01:00
Joe Farebrother
d23c3b8a74
Revert manual magic
...
This appeared to cause timeouts on DCA.
2025-03-26 09:23:49 +00:00
Joe Farebrother
0fa70db4c2
Review suggestions - update comment and introduce manual magic to filelocalflow
2025-03-25 08:55:55 +00:00
Joe Farebrother
a46c157e46
Add quality tag + tweak description
2025-03-21 09:24:54 +00:00
Joe Farebrother
bdbdcf8bd8
Clean up charpred of WithStatement + fix a comment
2025-03-20 14:28:57 +00:00
Taus
074af6f548
Python: Add change note
2025-03-20 13:57:32 +00:00
Joe Farebrother
3707f107bf
Fix tests + add more tests
2025-03-20 11:35:38 +00:00
Joe Farebrother
2c74ddb853
Add django FileRsponse as a wrapper
2025-03-20 11:35:29 +00:00
Joe Farebrother
b2acfbcf87
Simplify handling of wrapper classes and exception flow + improve qldoc and annotate tests.
2025-03-20 11:35:18 +00:00
Joe Farebrother
f8a0b1c5f9
Update docs, precision, and deprecate old library
2025-03-20 11:35:12 +00:00
Joe Farebrother
f750e22d91
Add case for exception flow
2025-03-20 11:35:01 +00:00
Joe Farebrother
c8fc56560d
Check for wrapper classes
2025-03-20 11:34:51 +00:00
Joe Farebrother
ecb3050780
Update tests
2025-03-20 11:34:42 +00:00
Joe Farebrother
09694c448d
Rewrite file not closed simple case using dataflow
2025-03-20 11:34:33 +00:00
Arthur Baars
d3e28772ae
Rust/Python improve qldoc of SafeAccessCheck
2025-03-20 11:16:45 +01:00
Chris Smowton
9a2a13ed55
Merge remote-tracking branch 'origin/main' into smowton/admin/merge-rc317-into-main
2025-03-19 16:01:29 +00:00
github-actions[bot]
51cdeefafb
Post-release preparation for codeql-cli-2.20.7
2025-03-17 13:00:41 +00:00
github-actions[bot]
2d64a618e6
Release preparation for version 2.20.7
2025-03-17 12:15:54 +00:00
