Commit Graph

83792 Commits

Author SHA1 Message Date
Idriss Riouak
0d76d582b5 CODEOWNERS: Add Go-related folders for extractor and autobuilder
Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com>
2025-11-06 11:12:53 +01:00
idrissrio
51475df5a9 CODEOWNERS: Add code-scanning-language-coverage team to all extractors 2025-11-05 10:04:16 +01:00
Jeroen Ketema
26f59a8786 Merge pull request #20710 from jketema/swift-rsc
Swift: Do not include the embedded resources
2025-10-29 17:38:07 +01:00
Jeroen Ketema
cf2cd20884 Swift: Update resources 2025-10-29 15:54:17 +01:00
Jeroen Ketema
ea6b05eda3 Update docs/codeql/codeql-overview/system-requirements.rst 2025-10-29 15:49:53 +01:00
Tom Hvitved
3c663d8ebf Merge pull request #20715 from hvitved/rust/type-inference-overlap-test
Rust: Add type inference tests for method resolution overlap
2025-10-29 15:39:07 +01:00
Tom Hvitved
6ed8bcbcf3 Rust: Add type inference tests for method resolution overlap 2025-10-29 14:53:28 +01:00
Tom Hvitved
e5f1238e26 Merge pull request #20707 from paldepind/rust/ti-self-trait
Rust: Improve handling of `Self` type parameter
2025-10-29 13:17:14 +01:00
Anders Schack-Mulligen
51a577a429 Merge pull request #20713 from aschackmull/dataflow/qldoc1
Dataflow: Minor drive-by qldoc addition.
2025-10-29 13:13:43 +01:00
Anders Schack-Mulligen
4ea90e06a5 Dataflow: Minor drive-by qldoc addition. 2025-10-29 12:58:56 +01:00
Geoffrey White
558ca74e9c Merge pull request #20702 from geoffw0/gen2
Rust: Generalize more models
2025-10-29 11:32:00 +00:00
Simon Friis Vindum
ce8cffc331 Rust: Address comments 2025-10-29 11:18:02 +01:00
Tom Hvitved
b7293541cd Merge pull request #20704 from hvitved/rust/fix-bad-joins
Rust: Fix two bad joins
2025-10-29 11:11:54 +01:00
Jeroen Ketema
6906c88781 Swift: Update change note 2025-10-29 11:08:16 +01:00
Jeroen Ketema
2505c8f3e3 Swift: Improve docs 2025-10-29 11:06:50 +01:00
Jeroen Ketema
9f498df9fa Swift: Do not include the embedded resources 2025-10-29 11:00:04 +01:00
Simon Friis Vindum
9022f996e8 Rust: Improve handling of occurrences of the Self type parameter 2025-10-29 10:41:46 +01:00
Simon Friis Vindum
9ff3c61c6e Rust: Add type inference tests involving Self 2025-10-29 10:41:44 +01:00
yoff
4461be180a Merge pull request #19539 from yoff/java/conflicting-access 2025-10-28 20:37:44 +01:00
Tom Hvitved
f2380d3ef1 Merge pull request #20612 from hvitved/rust/type-inference-blanket-non-satisfaction
Rust: Compute incompatible blanket implementations
2025-10-28 14:00:55 +01:00
Tom Hvitved
b3bbe78974 Rust: Fix bad join
Before
```
Pipeline standard for TypeInference::MethodCallMatching::directTypeMatch/6#f0fb0b61@31ee5u2w was evaluated in 821 iterations totaling 1057ms (delta sizes total: 689971).
           416937   ~1%    {6} r1 = SCAN `TypeInference::MethodCallMatching::directTypeMatch0/6#dfcc7717#prev_delta` OUTPUT In.0, In.3, In.1, In.2, In.4, In.5

           222757   ~2%    {8} r2 = JOIN r1 WITH `TypeInference::MethodCallMatchingInput::Access.getInferredNonSelfType/2#dispred#b181cb0a#prev` ON FIRST 2 OUTPUT Lhs.0, Lhs.2, Lhs.3, Lhs.5, Rhs.3, _, Lhs.4, Rhs.2
                           {6}    | REWRITE WITH Tmp.5 := "", Out.5 := InverseAppend(In.6,Tmp.5,In.7) KEEPING 6
           164360   ~3%    {6}    | SCAN OUTPUT In.0, In.1, In.2, In.5, In.4, In.3

        315350783   ~1%    {6} r3 = SCAN `TypeInference::MethodCallMatching::directTypeMatch0/6#dfcc7717#prev` OUTPUT In.0, In.3, In.1, In.2, In.4, In.5

           593815   ~1%    {8} r4 = JOIN r3 WITH `TypeInference::MethodCallMatchingInput::Access.getInferredNonSelfType/2#dispred#b181cb0a#prev_delta` ON FIRST 2 OUTPUT Lhs.0, Lhs.2, Lhs.3, Lhs.5, Rhs.3, _, Lhs.4, Rhs.2
                           {6}    | REWRITE WITH Tmp.5 := "", Out.5 := InverseAppend(In.6,Tmp.5,In.7) KEEPING 6
           342226   ~1%    {6}    | SCAN OUTPUT In.0, In.1, In.2, In.5, In.4, In.3

           826517   ~0%    {8} r5 = JOIN r1 WITH `TypeInference::MethodCallMatchingInput::Access.getInferredSelfType/3#dispred#45b2f893#prev` ON FIRST 3 OUTPUT Lhs.0, Lhs.2, Lhs.3, Lhs.5, Rhs.4, _, Lhs.4, Rhs.3
                           {6}    | REWRITE WITH Tmp.5 := "", Out.5 := InverseAppend(In.6,Tmp.5,In.7) KEEPING 6
           345294   ~1%    {6}    | SCAN OUTPUT In.0, In.1, In.2, In.5, In.4, In.3

            73715   ~0%    {8} r6 = JOIN r3 WITH `TypeInference::MethodCallMatchingInput::Access.getInferredSelfType/3#dispred#45b2f893#prev_delta` ON FIRST 3 OUTPUT Lhs.0, Lhs.2, Lhs.3, Lhs.5, Rhs.4, _, Lhs.4, Rhs.3
                           {6}    | REWRITE WITH Tmp.5 := "", Out.5 := InverseAppend(In.6,Tmp.5,In.7) KEEPING 6
            47802   ~1%    {6}    | SCAN OUTPUT In.0, In.1, In.2, In.5, In.4, In.3

           899682   ~5%    {6} r7 = r2 UNION r4 UNION r5 UNION r6
           711040   ~6%    {6}    | AND NOT `TypeInference::MethodCallMatching::directTypeMatch/6#f0fb0b61#prev`(FIRST 6)
                           return r7
```

After
```
Pipeline standard for TypeInference::MethodCallMatching::directTypeMatch/6#f0fb0b61@ad458u2w was evaluated in 821 iterations totaling 374ms (delta sizes total: 691168).
        222757   ~2%    {8} r1 = JOIN `TypeInference::MethodCallMatching::directTypeMatch0/6#dfcc7717#prev_delta` WITH `TypeInference::MethodCallMatchingInput::Access.getInferredNonSelfType/2#dispred#b181cb0a#prev` ON FIRST 2 OUTPUT Lhs.0, Lhs.2, Lhs.3, Lhs.5, Rhs.3, _, Lhs.4, Rhs.2
                        {6}    | REWRITE WITH Tmp.5 := "", Out.5 := InverseAppend(In.6,Tmp.5,In.7) KEEPING 6
        164360   ~3%    {6}    | SCAN OUTPUT In.0, In.1, In.2, In.5, In.4, In.3

        593815   ~1%    {8} r2 = JOIN `TypeInference::MethodCallMatching::directTypeMatch0/6#dfcc7717#prev` WITH `TypeInference::MethodCallMatchingInput::Access.getInferredNonSelfType/2#dispred#b181cb0a#prev_delta` ON FIRST 2 OUTPUT Lhs.0, Lhs.2, Lhs.3, Lhs.5, Rhs.3, _, Lhs.4, Rhs.2
                        {6}    | REWRITE WITH Tmp.5 := "", Out.5 := InverseAppend(In.6,Tmp.5,In.7) KEEPING 6
        342226   ~1%    {6}    | SCAN OUTPUT In.0, In.1, In.2, In.5, In.4, In.3

        826517   ~0%    {8} r3 = JOIN `TypeInference::MethodCallMatching::directTypeMatch0/6#dfcc7717#prev_delta` WITH `TypeInference::MethodCallMatchingInput::Access.getInferredSelfType/3#dispred#45b2f893#prev` ON FIRST 3 OUTPUT Lhs.0, Lhs.2, Lhs.3, Lhs.5, Rhs.4, _, Lhs.4, Rhs.3
                        {6}    | REWRITE WITH Tmp.5 := "", Out.5 := InverseAppend(In.6,Tmp.5,In.7) KEEPING 6
        345294   ~1%    {6}    | SCAN OUTPUT In.0, In.1, In.2, In.5, In.4, In.3

         73715   ~0%    {8} r4 = JOIN `TypeInference::MethodCallMatching::directTypeMatch0/6#dfcc7717#prev` WITH `TypeInference::MethodCallMatchingInput::Access.getInferredSelfType/3#dispred#45b2f893#prev_delta` ON FIRST 3 OUTPUT Lhs.0, Lhs.2, Lhs.3, Lhs.5, Rhs.4, _, Lhs.4, Rhs.3
                        {6}    | REWRITE WITH Tmp.5 := "", Out.5 := InverseAppend(In.6,Tmp.5,In.7) KEEPING 6
         47802   ~1%    {6}    | SCAN OUTPUT In.0, In.1, In.2, In.5, In.4, In.3

        899682   ~5%    {6} r5 = r1 UNION r2 UNION r3 UNION r4
        711095   ~6%    {6}    | AND NOT `TypeInference::MethodCallMatching::directTypeMatch/6#f0fb0b61#prev`(FIRST 6)
                        return r5
```
2025-10-28 13:09:39 +01:00
Tom Hvitved
104ba0e291 Rust: Fix bad join
Before
```
Pipeline standard for TypeInference::MethodCallMatching::AccessConstraint::RelevantAccess.getTypeAt/1#dispred#e8abf748@ada3a07w was evaluated in 801 iterations totaling 31ms (delta sizes total: 182871).
           50151   ~1%    {4} r1 = SCAN TypeInference::MethodCallMatching::AccessConstraint::MkRelevantAccess#7a01048b#prev_delta OUTPUT In.0, In.2, In.3, In.4
           39574   ~0%    {5}    | JOIN WITH `TypeInference::MethodCallMatchingInput::Access.getInferredNonSelfType/2#dispred#b181cb0a#prev` ON FIRST 2 OUTPUT Lhs.3, Rhs.3, _, Lhs.2, Rhs.2
                          {3}    | REWRITE WITH Tmp.2 := "", Out.2 := InverseAppend(In.3,Tmp.2,In.4) KEEPING 3
           36996   ~0%    {3}    | SCAN OUTPUT In.0, In.2, In.1

        36102333   ~0%    {4} r2 = SCAN TypeInference::MethodCallMatching::AccessConstraint::MkRelevantAccess#7a01048b#prev OUTPUT In.0, In.2, In.3, In.4
           90175   ~1%    {5}    | JOIN WITH `TypeInference::MethodCallMatchingInput::Access.getInferredNonSelfType/2#dispred#b181cb0a#prev_delta` ON FIRST 2 OUTPUT Lhs.3, Rhs.3, _, Lhs.2, Rhs.2
                          {3}    | REWRITE WITH Tmp.2 := "", Out.2 := InverseAppend(In.3,Tmp.2,In.4) KEEPING 3
           65014   ~1%    {3}    | SCAN OUTPUT In.0, In.2, In.1

           50151   ~1%    {5} r3 = SCAN TypeInference::MethodCallMatching::AccessConstraint::MkRelevantAccess#7a01048b#prev_delta OUTPUT In.2, In.0, In.1, In.3, In.4
           24208   ~1%    {4}    | JOIN WITH `FunctionType::FunctionPosition.isSelf/0#dispred#9e84d302` ON FIRST 1 OUTPUT Lhs.1, Lhs.2, Lhs.3, Lhs.4
           95022   ~0%    {9}    | JOIN WITH `TypeInference::MethodCallMatchingInput::Access.getInferredSelfType/3#dispred#45b2f893#prev` ON FIRST 1 OUTPUT Lhs.2, Lhs.3, Rhs.2, Rhs.3, Rhs.4, _, Rhs.1, Lhs.1, _
                          {6}    | REWRITE WITH Tmp.5 := ";", Tmp.5 := (In.6 ++ Tmp.5), Tmp.8 := "", Out.5 := InverseAppend(Tmp.5,Tmp.8,In.7) KEEPING 6
           93919   ~1%    {7}    | SCAN OUTPUT In.0, In.1, In.2, In.3, In.4, In.5, _
                          {6}    | REWRITE WITH NOT [NOT [Tmp.6 := "borrow", TEST InOut.5 = Tmp.6, Tmp.6 := true, TEST InOut.2 = Tmp.6], NOT [Tmp.6 := "", TEST InOut.5 = Tmp.6, Tmp.6 := true, TEST InOut.2 != Tmp.6]] KEEPING 6
           81298   ~1%    {5}    | SCAN OUTPUT In.1, In.4, _, In.0, In.3
                          {3}    | REWRITE WITH Tmp.2 := "", Out.2 := InverseAppend(In.3,Tmp.2,In.4) KEEPING 3
           64110   ~1%    {3}    | SCAN OUTPUT In.0, In.2, In.1

        36102333   ~0%    {5} r4 = SCAN TypeInference::MethodCallMatching::AccessConstraint::MkRelevantAccess#7a01048b#prev OUTPUT In.2, In.0, In.1, In.3, In.4
        17473531   ~0%    {4}    | JOIN WITH `FunctionType::FunctionPosition.isSelf/0#dispred#9e84d302` ON FIRST 1 OUTPUT Lhs.1, Lhs.2, Lhs.3, Lhs.4
           47409   ~1%    {9}    | JOIN WITH `TypeInference::MethodCallMatchingInput::Access.getInferredSelfType/3#dispred#45b2f893#prev_delta` ON FIRST 1 OUTPUT Lhs.2, Lhs.3, Rhs.2, Rhs.3, Rhs.4, _, Rhs.1, Lhs.1, _
                          {6}    | REWRITE WITH Tmp.5 := ";", Tmp.5 := (In.6 ++ Tmp.5), Tmp.8 := "", Out.5 := InverseAppend(Tmp.5,Tmp.8,In.7) KEEPING 6
           29885   ~0%    {7}    | SCAN OUTPUT In.0, In.1, In.2, In.3, In.4, In.5, _
                          {6}    | REWRITE WITH NOT [NOT [Tmp.6 := "borrow", TEST InOut.5 = Tmp.6, Tmp.6 := true, TEST InOut.2 = Tmp.6], NOT [Tmp.6 := "", TEST InOut.5 = Tmp.6, Tmp.6 := true, TEST InOut.2 != Tmp.6]] KEEPING 6
           16952   ~1%    {5}    | SCAN OUTPUT In.1, In.4, _, In.0, In.3
                          {3}    | REWRITE WITH Tmp.2 := "", Out.2 := InverseAppend(In.3,Tmp.2,In.4) KEEPING 3
           16829   ~0%    {3}    | SCAN OUTPUT In.0, In.2, In.1

          182949   ~1%    {3} r5 = r1 UNION r2 UNION r3 UNION r4
          182949   ~1%    {3}    | AND NOT `TypeInference::MethodCallMatching::AccessConstraint::RelevantAccess.getTypeAt/1#dispred#e8abf748#prev`(FIRST 3)
                          return r5
```

After
```
Pipeline standard for TypeInference::MethodCallMatching::AccessConstraint::RelevantAccess.getTypeAt/1#dispred#e8abf748@31ee547w was evaluated in 801 iterations totaling 19ms (delta sizes total: 182946).
         81298   ~0%    {5} r1 = JOIN TypeInference::MethodCallMatching::AccessConstraint::MkRelevantAccess#7a01048b#prev_delta WITH `TypeInference::MethodCallMatchingInput::Access.getInferredSelfType/3#dispred#45b2f893#prev` ON FIRST 3 OUTPUT Lhs.4, Rhs.4, _, Lhs.3, Rhs.3
                        {3}    | REWRITE WITH Tmp.2 := "", Out.2 := InverseAppend(In.3,Tmp.2,In.4) KEEPING 3
         64110   ~1%    {3}    | SCAN OUTPUT In.0, In.2, In.1

         39574   ~0%    {5} r2 = JOIN TypeInference::MethodCallMatching::AccessConstraint::MkRelevantAccess#7a01048b#prev_delta WITH `TypeInference::MethodCallMatchingInput::Access.getInferredNonSelfType/2#dispred#b181cb0a#prev` ON FIRST 2 OUTPUT Lhs.4, Rhs.3, _, Lhs.3, Rhs.2
                        {3}    | REWRITE WITH Tmp.2 := "", Out.2 := InverseAppend(In.3,Tmp.2,In.4) KEEPING 3
         36996   ~0%    {3}    | SCAN OUTPUT In.0, In.2, In.1

         16952   ~0%    {5} r3 = JOIN TypeInference::MethodCallMatching::AccessConstraint::MkRelevantAccess#7a01048b#prev WITH `TypeInference::MethodCallMatchingInput::Access.getInferredSelfType/3#dispred#45b2f893#prev_delta` ON FIRST 3 OUTPUT Lhs.4, Rhs.4, _, Lhs.3, Rhs.3
                        {3}    | REWRITE WITH Tmp.2 := "", Out.2 := InverseAppend(In.3,Tmp.2,In.4) KEEPING 3
         16829   ~0%    {3}    | SCAN OUTPUT In.0, In.2, In.1

         90175   ~0%    {5} r4 = JOIN TypeInference::MethodCallMatching::AccessConstraint::MkRelevantAccess#7a01048b#prev WITH `TypeInference::MethodCallMatchingInput::Access.getInferredNonSelfType/2#dispred#b181cb0a#prev_delta` ON FIRST 2 OUTPUT Lhs.4, Rhs.3, _, Lhs.3, Rhs.2
                        {3}    | REWRITE WITH Tmp.2 := "", Out.2 := InverseAppend(In.3,Tmp.2,In.4) KEEPING 3
         65014   ~0%    {3}    | SCAN OUTPUT In.0, In.2, In.1

        182949   ~1%    {3} r5 = r1 UNION r2 UNION r3 UNION r4
        182949   ~1%    {3}    | AND NOT `TypeInference::MethodCallMatching::AccessConstraint::RelevantAccess.getTypeAt/1#dispred#e8abf748#prev`(FIRST 3)
                        return r5
```
2025-10-28 13:09:32 +01:00
Nora Dimitrijević
727bddea19 Merge pull request #20607 from d10c/d10c/update-diff-informed-testing
Update diff-informed testing to always treat sources and sinks as alert locations
2025-10-28 11:52:31 +01:00
Tom Hvitved
409f7fb743 Address review comments 2025-10-28 11:48:45 +01:00
Geoffrey White
d6c4ab2724 Merge branch 'main' into gen2 2025-10-28 09:26:13 +00:00
Geoffrey White
abcc1712d5 Rust: Remove more redundant models. 2025-10-28 09:26:11 +00:00
Nora Dimitrijević
a0975e7e19 Constrain location overrides to actual sources/sinks 2025-10-28 09:42:20 +01:00
Nora Dimitrijević
96e1536769 C++/SqlTainted 2025-10-28 09:42:17 +01:00
Nora Dimitrijević
8e0c453c37 Rust/InsecureCookie 2025-10-28 09:42:14 +01:00
Nora Dimitrijević
4952cb27fb Rust/AccessAfterLifetime 2025-10-28 09:42:11 +01:00
Nora Dimitrijević
0f0bd0f455 Go/SSRF
go/ql/src/experimental/CWE-918/SSRF.ql
2025-10-28 09:42:09 +01:00
Nora Dimitrijević
d41268fc84 Go/UnhandledCloseWritableHandle 2025-10-28 09:42:06 +01:00
Nora Dimitrijević
ec63547925 C++/UseOfHttp 2025-10-28 09:42:03 +01:00
Nora Dimitrijević
a65d4d5997 C++/TaintedAllocationSize 2025-10-28 09:42:01 +01:00
Nora Dimitrijević
f3d51e0151 C++/ArithmeticUncontrolled 2025-10-28 09:41:57 +01:00
Nora Dimitrijević
1321cbb021 C++/DecompressionBombs 2025-10-28 09:41:55 +01:00
Nora Dimitrijević
bbe2bf2b7f C++/CleartextTransmission 2025-10-28 09:41:52 +01:00
Nora Dimitrijević
b0180409f4 C++/CleartextFileWrite 2025-10-28 09:41:49 +01:00
Nora Dimitrijević
d89aa0f19d C++/CleartextBufferWrite 2025-10-28 09:41:46 +01:00
Nora Dimitrijević
17b261a506 C++/AuthenticationBypass 2025-10-28 09:41:43 +01:00
Nora Dimitrijević
0ed27f4e81 C++/CleartextSqliteDatabase 2025-10-28 09:41:40 +01:00
Nora Dimitrijević
f7a1a4cf75 C++/NonConstantFormat 2025-10-28 09:41:38 +01:00
Nora Dimitrijević
2756e8255f C++/UnboundedWrite 2025-10-28 09:41:35 +01:00
Nora Dimitrijević
a4ac0392a6 C++/OverflowDestination 2025-10-28 09:41:32 +01:00
Nora Dimitrijević
65d79ff6fc C++/ExecTainted 2025-10-28 09:41:29 +01:00
Nora Dimitrijević
464f6cb096 C++/ConstantSizeArrayOffByOne 2025-10-28 09:41:26 +01:00
Nora Dimitrijević
974d174757 Actions/CodeInjectionQuery
actions/ql/src/Security/CWE-094/CodeInjectionMedium.ql

actions/ql/src/Security/CWE-094/CodeInjectionCritical.ql
2025-10-28 09:41:24 +01:00
Nora Dimitrijević
62fde8f6e7 Actions/ArgumentInjectionQuery
actions/ql/src/experimental/Security/CWE-088/ArgumentInjectionCritical.ql

actions/ql/src/experimental/Security/CWE-088/ArgumentInjectionMedium.ql
2025-10-28 09:41:21 +01:00
Nora Dimitrijević
c40223319c Actions/EnvVarInjectionQuery
actions/ql/src/Security/CWE-077/EnvVarInjectionMedium.ql

actions/ql/src/Security/CWE-077/EnvVarInjectionCritical.ql
2025-10-28 09:41:18 +01:00
Nora Dimitrijević
edc72d29d7 Actions/EnvPathInjectionQuery
actions/ql/src/Security/CWE-077/EnvPathInjectionMedium.ql

actions/ql/src/Security/CWE-077/EnvPathInjectionCritical.ql
2025-10-28 09:41:16 +01:00