Commit Graph

88512 Commits

Author SHA1 Message Date
Anders Fugmann
1f27b7d64d kotlin-extractor: fix NotNullExpr start offset to span from operand
In K1 mode, the IrCall node for the !! operator stores startOffset at
the '!' character rather than at the start of the operand. This means
that x!! was previously reported as spanning from '!' to the end of the
expression, omitting the operand from the location.

Fix this by computing the NotNullExpr location from the value argument's
startOffset (the operand) to c.endOffset. This matches the K2 behaviour
where the IrCall.startOffset already points at the operand.

The fix guards against invalid (< 0) offsets on either side and falls
back to the default IrCall location in those cases.

Updated expected files in test-kotlin1:
- exprs/unaryOp.expected: !! locations now start at operand column
- exprs/exprs.expected: same (NotNullExpr entries corrected)
- exprs/binop.expected: !! child locations now correct (parent binop
  location for s!!.plus(5) still differs due to a separate K1 IR
  limitation where the enclosing call inherits the wrong receiver offset)
- controlflow/basic/bbStmts.expected: CFG references to !! now use the
  improved location
- controlflow/basic/getASuccessor.expected: same

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-09 15:59:08 +02:00
Anders Fugmann
e0cd40f06a kotlin-extractor: PSI-backed source locations for expression-level nodes
K1 and K2 IR backends compute source locations differently. K1 uses the IR
node's synthetic startOffset/endOffset, while K2 reconstructs source positions
from PSI. For expression-level nodes this causes location differences across
the two language modes.

Introduce PSI-backed location lookup as the preferred source for spans wherever
PSI is available:

  getPsiBasedLocation(element) ?: tw.getLocation(element)

getPsiBasedLocation() resolves the PSI element for the IR node via
psi2Ir.findPsiElement() and builds a location from its startOffset..endOffset.
currentIrFile is tracked in extractFileContents so the PSI lookup has the
file context it needs.

Applied to expression-level nodes (both K1 and K2 modes):
- local variable declarations (extractVariable, extractVariableExpr)
- IrLocalDelegatedProperty blocks
- IrWhen expressions and when-branches
- IrGetValue (varaccess) expressions
- IrFunctionExpression (lambda) nodes
- Block statements (extractBlock)
- this/super access expressions (extractThisAccess)
- String literals

Declaration-level nodes (class, function, property) are guarded with
if (usesK2) to avoid a regression in K1 mode where the PSI lookup causes
parameterised type instantiations to appear as fromSource(), inflating
generic-type query results. The K1 IR frontend does not map all declaration
nodes cleanly to source PSI elements; for these nodes we keep the original
IR-based location in K1 mode.

Expected output changes (both suites):
- controlflow/basic/bbStmts, bbStrictDominance, bbSuccessor, getASuccessor,
  strictDominance: when-branch and varaccess location improvements
- java-kotlin-collection-type-generic-methods/test: new stdlib entries from
  JDK update (AbstractCollection<Runnable> methods)
- annotation_classes/PrintAst: variable access location improvement in K1
- classes/genericExprTypes: location improvement in K1
- compilation-units/cus: removed two internal JDK inner-class entries (stdlib
  version change)
- reflection/reflection: removed a few external-class entries (stdlib version)

Verified: all 285 tests pass for both test-kotlin1 (kotlinc 2.3.20 / K1) and
test-kotlin2 (kotlinc 2.4.0 / K2).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-09 15:59:08 +02:00
Anders Fugmann
c1e8d4ad0c kotlin tests: sync dataflow/foreach test inputs and K2 expected output
Copy K1's richer C2.kt (which includes test2, test3 and l.get(0) in test)
into test-kotlin2. K2 in -language 2.0 mode already tracks dataflow through
array.set() and indirect wrapper calls, so the additional tests produce results
identical to K1.

The expected files for test-kotlin1 and test-kotlin2 are now byte-identical for
this test.

Verified:
- test-kotlin1 (kotlinc 2.3.20 / -language 1.9): all tests pass
- test-kotlin2 (kotlinc 2.4.0 / -language 2.0): all tests pass

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-09 15:59:07 +02:00
Anders Fugmann
83b046baa1 kotlin tests: sync generated-throws.kt source between test-kotlin1 and test-kotlin2
Remove the K1-only comment '// This doesn't generate a throw statement in
Kotlin 1 mode' from test-kotlin1/library-tests/generated-throws/generated-throws.kt
so the source files are byte-identical between the two suites.

The expected outputs still legitimately differ: in K2 mode the compiler generates
an implicit throw NoWhenBranchMatchedException for the exhaustive sealed-class when
expression, but the K1 frontend does not emit this node. This is a mode-specific
behaviour difference that cannot be bridged by an extractor change.

Both tests continue to pass:
- test-kotlin1 (kotlinc 2.3.20 / -language 1.9): 0 throw results (unchanged)
- test-kotlin2 (kotlinc 2.4.0 / -language 2.0): 1 throw result (unchanged)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-09 15:59:07 +02:00
Anders Fugmann
b4706a3152 kotlin extractor: fold unaryMinus(IrConst) into a signed literal in K2
In K2 mode the frontend emits `-123L` as IrCall(unaryMinus, IrConst(123L))
rather than IrConst(-123L) as in K1. Queries that search for negative numeric
literals therefore need to match both a UnaryMinusExpr wrapping a literal and a
plain literal, depending on language mode.

Fix: when extractCallExpression encounters an isNumericFunction(unaryMinus) call
whose dispatchReceiver is already an IrConst, fold the negation into the constant
before extracting. The resulting literal node is identical to what K1 emits.

Location: extend the span one character to the left to cover the `-` sign.
In K2 the IrCall's startOffset equals the receiver's startOffset, so we recover
the minus by subtracting one from the receiver offset.

K1 is unaffected: the K1 frontend folds the sign into the constant before IR
generation, so this new branch never triggers when compiling with -language 1.9.

Expected output changes:
- test-kotlin2/library-tests/literals/literals.expected: negative long, float and
  double literals now appear as plain typed literals instead of as UnaryMinus nodes.
  The file is now byte-identical to test-kotlin1/library-tests/literals/literals.expected.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-09 15:59:07 +02:00
Anders Fugmann
6465078bfe kotlin tests: synchronise test inputs between test-kotlin1 and test-kotlin2
- Port ministdlib from test-kotlin1 to test-kotlin2. The ministdlib test
  exercises a minimal Kotlin standard library written from scratch. Its
  options file is updated to include -language-version 2.0 so the test
  runs in K2 mode when the K2 compiler is active.

- Port nested_types from test-kotlin2 to test-kotlin1. The nested_types
  test exercises type-alias and inner-type queries. Expected output is
  identical in K1 and K2 modes so no expected-file changes are needed.

- Add test-kotlin2/options with codeql-extractor-kotlin-options:
  -language-version 2.0. The CodeQL CLI adds -language-version 1.9 by
  default in legacy test extraction mode. Without this override the K2
  test suite would run in K1 mode, defeating the purpose of the split.

Both ministdlib and nested_types produce byte-identical expected output
across K1 (2.3.20, -language-version 1.9) and K2 (2.4.0, default K2).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-09 15:59:06 +02:00
Jack Nørskov Jørgensen
d5712ef19a Merge pull request #22130 from github/jacknojo/apache_poi_mads
Add MaDs for Apache POI @ bd97feb849ab86670fe5b5513d4066c46b599797
2026-07-09 08:56:54 +02:00
Owen Mansel-Chan
a238aeeb59 Merge pull request #22141 from github/dependabot/go_modules/go/extractor/extractor-dependencies-017d72eac4
Bump golang.org/x/mod from 0.37.0 to 0.38.0 in /go/extractor in the extractor-dependencies group
2026-07-09 07:16:05 +01:00
dependabot[bot]
6da42a2456 Bump golang.org/x/mod
Bumps the extractor-dependencies group in /go/extractor with 1 update: [golang.org/x/mod](https://github.com/golang/mod).


Updates `golang.org/x/mod` from 0.37.0 to 0.38.0
- [Commits](https://github.com/golang/mod/compare/v0.37.0...v0.38.0)

---
updated-dependencies:
- dependency-name: golang.org/x/mod
  dependency-version: 0.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: extractor-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-07-09 03:03:43 +00:00
Tom Hvitved
f4773e9dc2 Merge pull request #22114 from hvitved/type-inference-join
Type inference: Small join-order tweak
2026-07-08 20:19:48 +02:00
Florin Coada
11be07952e Merge pull request #22139 from github/codeql-spark-run-28955698948
Update changelog documentation site for codeql-cli-2.26.0
2026-07-08 17:00:03 +01:00
github-actions[bot]
47ea9b49cc update codeql documentation 2026-07-08 15:46:33 +00:00
Owen Mansel-Chan
25cd352de7 Merge pull request #22123 from owen-mc/csharp/convert-qlref-tests-to-inline-expectations
C#: Convert qlref tests to inline expectations
2026-07-08 14:47:04 +01:00
Geoffrey White
8bb12d1507 Merge pull request #22005 from github/dependabot/pip/misc/codegen/pip-02f7ad5a4b
Bump the pip group across 2 directories with 2 updates
2026-07-08 14:37:05 +01:00
Tom Hvitved
15c7428593 Address review comment 2026-07-08 15:08:46 +02:00
Owen Mansel-Chan
aba008dcd7 Remove comments "// BAD: but flagged by cs/constant-condition" 2026-07-08 14:00:57 +01:00
Owen Mansel-Chan
7b96f66d34 Also run cs/constant-condition on test for cs/comparison-of-identical-expressions 2026-07-08 14:00:55 +01:00
Taus
3c3f740a25 Merge pull request #22120 from asgerf/unified/local-scoping
Unified: implement local scoping
2026-07-08 14:33:14 +02:00
Owen Mansel-Chan
85d800f317 Apply suggestions from code review
Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
2026-07-08 13:02:20 +01:00
Owen Mansel-Chan
134e30260d Merge pull request #22119 from owen-mc/java/fix-tainted-path-pattern-sanitization
Java: fix `@Pattern` sanitization for `java/path-injection`
2026-07-08 11:37:15 +01:00
Owen Mansel-Chan
a16e19a3b1 Merge pull request #22127 from owen-mc/cpp/convert-qlref-inline-expectations
C++: Convert qlref tests to inline expectations
2026-07-08 11:36:35 +01:00
Owen Mansel-Chan
69ed2da241 Merge pull request #22134 from github/workflow/coverage/update
Update CSV framework coverage reports
2026-07-08 11:19:06 +01:00
Jack Nørskov Jørgensen
6c7b9f71d6 Remove main entries 2026-07-08 09:28:47 +02:00
github-actions[bot]
bc966f62e2 Add changed framework coverage reports 2026-07-08 00:38:59 +00:00
Owen Mansel-Chan
b6d588c1a8 Revert inline expectations for blazor integration tests with BMN 2026-07-08 00:56:43 +01:00
Owen Mansel-Chan
5ba1fe315d Accept updated .expected output 2026-07-08 00:56:16 +01:00
Owen Mansel-Chan
8363d2d66d Merge pull request #22132 from joshimar/java/spring-webclient-uri-ssrf-sink
Java: Model Spring reactive `WebClient.uri` as a request forgery sink
2026-07-08 00:40:33 +01:00
Luis Azanza
b8f8370c33 Update java/ql/lib/change-notes/2026-06-30-spring-webclient-uri-ssrf.md
Update change note to be more technically accurate

Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com>
2026-07-07 16:21:09 -07:00
Luis Azanza
6ff2a4c0d6 Apply suggestion from @owen-mc
Removing Apple Inc notice per feedback provided by GitHub

Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com>
2026-07-07 16:10:05 -07:00
Luis Azanza
1db31327a7 Java: Model Spring reactive WebClient.uri as a request forgery sink 2026-07-07 13:30:48 -07:00
Owen Mansel-Chan
19745e13b5 Fix some lines with // $ ... // $ MISSING:
Note that when a line is marked `// BAD [NOT DETECTED]` but actually has
an alert, I assume that the `[NOT DETECTED]` is outdated and should be
deleted.
2026-07-07 20:48:39 +01:00
Owen Mansel-Chan
9d9590623d Address review comments 2026-07-07 20:48:36 +01:00
Geoffrey White
117a0bb87e Copilot fix for missing module pygments - regenerating the lockfile fully. 2026-07-07 16:02:36 +01:00
Owen Mansel-Chan
f67b7299f9 Update query example (synced file) 2026-07-07 14:09:50 +01:00
Owen Mansel-Chan
366d70bfee Convert qlref tests to inline expectations 2026-07-07 14:09:48 +01:00
Owen Mansel-Chan
a812e4aa99 Refactor creating barriers with annotations 2026-07-07 12:44:19 +01:00
Owen Mansel-Chan
fa16728522 Fix comments in one test 2026-07-07 12:06:43 +01:00
Owen Mansel-Chan
76d8ae8694 Add MISSING: tag 2026-07-07 10:59:21 +01:00
Owen Mansel-Chan
843ac7c6b0 Add SPURIOUS: tags 2026-07-07 10:54:11 +01:00
Owen Mansel-Chan
a2c5d4c818 C++: Convert qlref tests to inline expectations 2026-07-07 09:49:50 +01:00
Jack Nørskov Jørgensen
0ca353dc7f Add Changenote 2026-07-06 20:40:08 +02:00
Owen Mansel-Chan
8f026b1dc2 Allow inline expectation comments in more file formats 2026-07-06 13:43:31 +01:00
Asger F
bfb3ead314 Apply suggestions from code review
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
2026-07-03 14:29:54 +02:00
Owen Mansel-Chan
e5bd62dbd3 Add change note 2026-07-03 11:34:11 +01:00
Owen Mansel-Chan
76b4f4f223 Fix @Pattern sanitizer for TaintedPath 2026-07-03 11:34:06 +01:00
Owen Mansel-Chan
077b531e41 Add failing TaintedPath test for @Pattern sanitizer 2026-07-03 11:34:03 +01:00
Asger F
c23c3d9e79 unified: Translate bare names in patterns correctly
- Context is fully reset when stepping into an expr/stmt/body.
- Binding modifier is rolled into outer_modifiers.
2026-07-03 11:59:58 +02:00
Asger F
036ed04eee unified: Support OrPattern bindings 2026-07-03 11:59:57 +02:00
Asger F
891e244116 unified: Add WhileStmt as a Conditional 2026-07-03 11:59:55 +02:00
Asger F
c8eb2071d8 unified: Add tests with 'while let' 2026-07-03 11:59:53 +02:00