Commit Graph

88678 Commits

Author SHA1 Message Date
Taus
989154a105 Merge pull request #22136 from github/tausbn/yeast-translate-with-context
yeast: Add context scoping mechanism
2026-07-09 16:29:54 +02:00
github-actions[bot]
36d0ceb292 update codeql documentation 2026-07-09 14:29:47 +00:00
Taus
d609680083 yeast: Fix escaping bug in yeast-macros
Happily, it turned out that there was already a library function for
handling this case.
2026-07-09 11:48:50 +00:00
Taus
11afcce8b3 yeast: Fix bug in matching (_)
Turns out, `(_)` would match both named and unnamed nodes, as we never
checked the value of the `match_unnamed` field. This is the real reason
why the final catch-all rule we removed in the last commit was
superfluous -- unnamed nodes were being caught by the penultimate rule
instead (and mapped to `unsupported_node`).

Having fixed the bug, we now (correctly) get errors due to unmatched
unnamed nodes in the input. To fix this, we change the catch-all rule to
match unnamed nodes as well. This restores the previous behaviour
exactly.

At some point, we should find a better way to handle unnamed nodes, as
it seems wasteful to map these to `unsupported_node` (since we in
practice only use them for their string content). Perhaps we should not
attempt to translate unnamed nodes at all?
2026-07-09 11:48:50 +00:00
Taus
ee04938ded yeast: Require type annotations on root-level Rust interpolations
In order to facilitate static type checking of rules (and to make it
easier for human readers as well), rust blocks at the root level (i.e.
rules of the form `... => { ... }`) must now have a type annotation in
front.

All other forms are unaffected: if the right hand side of a rule is a
tree, we can read the type of the root node directly. For interpolations
that happen inside of such a tree, we can recover the type by looking at
what field we're interpolating into, and consulting the output schema.

All existing uses have been updated to have the appropriate type
annotations, though these are of course not checked yet (and so could be
wrong).

Finally, this commit also removes the final catch-all rule `_ @node =>
{node}`. Because of the preceding rule that matches `(_) @node`, this
rule would only ever match unnamed nodes, and I think in practice it did
not match at all (at least not in our current set of tests).

To give it a proper type we would have to add some notion of an "any"
type, which I would like to avoid. If it _does_ turn out to be needed,
we can easily add it back (ideally with a test-case that shows why it's
still needed).
2026-07-09 11:48:50 +00:00
Taus
ea36f2d7f8 yeast: add rules! macro
This macro allows the easy addition of multiple rules at the same time.
In addition, it also accepts an input and output schema, which
eventually will be used to check the validity of the rewrite rules.
2026-07-09 11:39:30 +00:00
Taus
1fb4f9d208 yeast: Move schema and YAML loader into yeast-schema crate
For type checking rules, we need to be able to load schemas (so we know
what to check against). However, since we can't have yeast-macros
depending on yeast (where the schema-handling code currently lives) as
this would introduce a circular dependency, we instead split the
schema-related code into its own yeast-schema crate.
2026-07-09 11:39:30 +00:00
Jack Nørskov Jørgensen
d5712ef19a Merge pull request #22130 from github/jacknojo/apache_poi_mads
Add MaDs for Apache POI @ bd97feb849ab86670fe5b5513d4066c46b599797
2026-07-09 08:56:54 +02:00
Owen Mansel-Chan
a238aeeb59 Merge pull request #22141 from github/dependabot/go_modules/go/extractor/extractor-dependencies-017d72eac4
Bump golang.org/x/mod from 0.37.0 to 0.38.0 in /go/extractor in the extractor-dependencies group
2026-07-09 07:16:05 +01:00
dependabot[bot]
6da42a2456 Bump golang.org/x/mod
Bumps the extractor-dependencies group in /go/extractor with 1 update: [golang.org/x/mod](https://github.com/golang/mod).


Updates `golang.org/x/mod` from 0.37.0 to 0.38.0
- [Commits](https://github.com/golang/mod/compare/v0.37.0...v0.38.0)

---
updated-dependencies:
- dependency-name: golang.org/x/mod
  dependency-version: 0.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: extractor-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-07-09 03:03:43 +00:00
Tom Hvitved
f4773e9dc2 Merge pull request #22114 from hvitved/type-inference-join
Type inference: Small join-order tweak
2026-07-08 20:19:48 +02:00
Florin Coada
11be07952e Merge pull request #22139 from github/codeql-spark-run-28955698948
Update changelog documentation site for codeql-cli-2.26.0
2026-07-08 17:00:03 +01:00
github-actions[bot]
47ea9b49cc update codeql documentation 2026-07-08 15:46:33 +00:00
Taus
33da3ef74e yeast: Fix typo
Co-authored-by: Jeroen Ketema <93738568+jketema@users.noreply.github.com>
2026-07-08 16:35:01 +02:00
Owen Mansel-Chan
25cd352de7 Merge pull request #22123 from owen-mc/csharp/convert-qlref-tests-to-inline-expectations
C#: Convert qlref tests to inline expectations
2026-07-08 14:47:04 +01:00
Geoffrey White
8bb12d1507 Merge pull request #22005 from github/dependabot/pip/misc/codegen/pip-02f7ad5a4b
Bump the pip group across 2 directories with 2 updates
2026-07-08 14:37:05 +01:00
Tom Hvitved
15c7428593 Address review comment 2026-07-08 15:08:46 +02:00
Owen Mansel-Chan
aba008dcd7 Remove comments "// BAD: but flagged by cs/constant-condition" 2026-07-08 14:00:57 +01:00
Owen Mansel-Chan
7b96f66d34 Also run cs/constant-condition on test for cs/comparison-of-identical-expressions 2026-07-08 14:00:55 +01:00
Taus
9b7a9c3851 yeast: Use clone-and-drop for per-rule context isolation
In order to avoid having context changes bubble up through the tree (or
from one sibling to another) the current framework makes a copy of the
context before calling `translate` recursively, and then restores it
afterwards.

However, this is a bit silly -- after we're done with all of the
translations, there's really no need to restore the context (as it
doesn't get accessed again).

So instead we change it from "save and then restore" to "clone and then
drop". Each rule invocation gets its own copy of the context, and simply
drops it when it's done.
2026-07-08 12:33:36 +00:00
Taus
13510b1ddd yeast: Add BuildCtx::scoped for isolated context modification
A previous commit added a translate_reset method on BuildCtx, which had
the effect of performing a translation in a completely empty context.

One issue with this is that this is an all-or-nothing proposition -- If
you want to preserve _some_ parts of the context, you have to do
something more complicated. Moreover, if you introduce a contextual
value that _should_ be preserved, all of the existing uses of
translate_reset now silently do the wrong thing.

There are two patterns that we want to address. The first one is "modify
the context in some way, then do a translation". If the translation is
the last step of a Rust block, then we don't actually need
translate_reset -- we could just reset the context and then call
`translate`. The fact that the outer context is restored afterwards
means it's okay to make destructive changes to `ctx.user_ctx` -- none of
these changes will persist.

The second pattern is the same, but where we want to do more
translations using the original context, after having performed a
translation with a modified context. In this case, we cannot just
overwrite the context, since that would invalidate the subsequent
translations.

Instead, we introduce a new method `ctx.scoped` which takes a closure as
an argument. With this we can now write

```
ctx.scoped(|ctx| ctx.reset(); ctx.translate(...));
```

and the closure is run with a copy of `ctx` that has a clone of
`user_ctx` on the inside, so no changes will persist.

(You may wonder: why not just clone `ctx` and use the clone? The answer
is that `ctx` owns mutable pointers to the AST etc., and this makes it
awkward to just "clone" it. The closure circumvents this issue nicely,
since it can borrow these pointers internally.)

For now, this rewrite has the same behaviour as the version that used
translate_reset -- we clear the entire `user_ctx`. However, we could
imagine being more fine-grained in this approach, by implementing, say,
SwiftContext::reset_modifiers (which would only affect what modifiers
are currently in the context, leaving everything else as-is).
2026-07-08 12:33:35 +00:00
Taus
8272848620 yeast: Implement IntoIterator for Id as a singleton
There's an awkward divide in yeast between returning a list of nodes or
optional node (both of which are iterable), and returning a single node
(which is not). In practice, we would like all of these cases to be
handled transparently: if a single node is returned, it behaves as if it
were a singleton list containing that node. This gives us a uniform
interface during translation -- no matter what is returned, it will be
an iterable of nodes.

To facilitate this, we make the slightly unorthodox choice of
implementing IntoIterator for Id, with the behaviour detailed above.
2026-07-08 12:33:35 +00:00
Taus
3c3f740a25 Merge pull request #22120 from asgerf/unified/local-scoping
Unified: implement local scoping
2026-07-08 14:33:14 +02:00
Owen Mansel-Chan
85d800f317 Apply suggestions from code review
Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
2026-07-08 13:02:20 +01:00
Owen Mansel-Chan
134e30260d Merge pull request #22119 from owen-mc/java/fix-tainted-path-pattern-sanitization
Java: fix `@Pattern` sanitization for `java/path-injection`
2026-07-08 11:37:15 +01:00
Owen Mansel-Chan
a16e19a3b1 Merge pull request #22127 from owen-mc/cpp/convert-qlref-inline-expectations
C++: Convert qlref tests to inline expectations
2026-07-08 11:36:35 +01:00
Owen Mansel-Chan
69ed2da241 Merge pull request #22134 from github/workflow/coverage/update
Update CSV framework coverage reports
2026-07-08 11:19:06 +01:00
Jeroen Ketema
36af59adbf Swift: Update integration test 2026-07-08 09:35:06 +02:00
Jeroen Ketema
b4db71a38b Swift: Update autobuild tests 2026-07-08 09:35:05 +02:00
Jeroen Ketema
8ecdb2cde0 Swift: update integration tests to not use the integrated driver 2026-07-08 09:35:03 +02:00
Jeroen Ketema
662c7b08e8 Swift: Turn of caching and integrated driver in autobuild
* Caching cases compiler invocations to be omitted. You can try this for
  yourself by turning on caching while building the project from the
  `xcode-hello` integration test, then cleaning of the build artifacts
  and building the project again while caching is enabled. This yields
  a database that is practically empty.
* The integrated driver causes compiler invocations to depend on modules
  shipped with Xcode. Those are unfortunately incompatible with our
  extractor.
2026-07-08 09:35:02 +02:00
Jack Nørskov Jørgensen
6c7b9f71d6 Remove main entries 2026-07-08 09:28:47 +02:00
github-actions[bot]
bc966f62e2 Add changed framework coverage reports 2026-07-08 00:38:59 +00:00
Owen Mansel-Chan
b6d588c1a8 Revert inline expectations for blazor integration tests with BMN 2026-07-08 00:56:43 +01:00
Owen Mansel-Chan
5ba1fe315d Accept updated .expected output 2026-07-08 00:56:16 +01:00
Owen Mansel-Chan
8363d2d66d Merge pull request #22132 from joshimar/java/spring-webclient-uri-ssrf-sink
Java: Model Spring reactive `WebClient.uri` as a request forgery sink
2026-07-08 00:40:33 +01:00
Luis Azanza
b8f8370c33 Update java/ql/lib/change-notes/2026-06-30-spring-webclient-uri-ssrf.md
Update change note to be more technically accurate

Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com>
2026-07-07 16:21:09 -07:00
Luis Azanza
6ff2a4c0d6 Apply suggestion from @owen-mc
Removing Apple Inc notice per feedback provided by GitHub

Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com>
2026-07-07 16:10:05 -07:00
Luis Azanza
1db31327a7 Java: Model Spring reactive WebClient.uri as a request forgery sink 2026-07-07 13:30:48 -07:00
Owen Mansel-Chan
19745e13b5 Fix some lines with // $ ... // $ MISSING:
Note that when a line is marked `// BAD [NOT DETECTED]` but actually has
an alert, I assume that the `[NOT DETECTED]` is outdated and should be
deleted.
2026-07-07 20:48:39 +01:00
Owen Mansel-Chan
9d9590623d Address review comments 2026-07-07 20:48:36 +01:00
Geoffrey White
117a0bb87e Copilot fix for missing module pygments - regenerating the lockfile fully. 2026-07-07 16:02:36 +01:00
Owen Mansel-Chan
f67b7299f9 Update query example (synced file) 2026-07-07 14:09:50 +01:00
Owen Mansel-Chan
366d70bfee Convert qlref tests to inline expectations 2026-07-07 14:09:48 +01:00
Owen Mansel-Chan
a812e4aa99 Refactor creating barriers with annotations 2026-07-07 12:44:19 +01:00
Owen Mansel-Chan
fa16728522 Fix comments in one test 2026-07-07 12:06:43 +01:00
Owen Mansel-Chan
76d8ae8694 Add MISSING: tag 2026-07-07 10:59:21 +01:00
Owen Mansel-Chan
843ac7c6b0 Add SPURIOUS: tags 2026-07-07 10:54:11 +01:00
Owen Mansel-Chan
a2c5d4c818 C++: Convert qlref tests to inline expectations 2026-07-07 09:49:50 +01:00
Jack Nørskov Jørgensen
0ca353dc7f Add Changenote 2026-07-06 20:40:08 +02:00