hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-23 18:33:42 +01:00
Code Issues Packages Projects Releases Wiki Activity
85,757 Commits 1,693 Branches 161 Tags
36e4efe77e55c237be39dbe2ea79ab0d190b8588
Commit Graph

85757 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Ben Rodes
36e4efe77e Apply suggestion from @geoffw0 
Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
 2026-02-12 10:20:32 -05:00
Ben Rodes
f5a38b4701 Apply suggestion from @geoffw0 
Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
 2026-02-12 10:17:56 -05:00
Ben Rodes
b39732ba02 Update cpp/ql/src/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearModification.ql 
Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
 2026-02-12 10:10:11 -05:00
Ben Rodes
dfe6ed2171 Update cpp/ql/src/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearModification.ql 
Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
 2026-02-12 10:09:25 -05:00
REDMOND\brodes
c64a6762d0 Merge branch 'UncheckedLeaprYearAfterModification_Refactor_Upstream' of https://github.com/microsoft/codeql into UncheckedLeaprYearAfterModification_Refactor_Upstream 2026-02-12 09:52:49 -05:00
REDMOND\brodes
f7231f40eb C++: misc comment clean up per PR suggestions. Unified additional flow steps for two similar flows into a common additional step predicate. 2026-02-12 09:52:19 -05:00
Ben Rodes
a53218c2ce Update cpp/ql/lib/change-notes/2026-02-06-UncheckedLeapYearAfterModification_Refactor.md 
Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
 2026-02-12 09:36:57 -05:00
Ben Rodes
d1eb9ab5d2 Update cpp/ql/src/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearModification.ql 
Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
 2026-02-12 09:36:36 -05:00
REDMOND\brodes
e2ad1f6511 C++: Updating comment per PR reveiw suggestions. 2026-02-12 09:20:55 -05:00
REDMOND\brodes
98b51149da C++: Change log missing .md extension. 2026-02-09 10:48:24 -05:00
REDMOND\brodes
8e36316ebf C++: Addressing Copilot PR suggestions. 2026-02-09 10:42:34 -05:00
REDMOND\brodes
1796bc0abb C++: Add change note. 2026-02-06 16:19:11 -05:00
REDMOND\brodes
36cc20989c C++: Accept test changes (removing false negative) 2026-02-06 16:11:51 -05:00
REDMOND\brodes
2b806ad6fd C++: Add missing DateTime models for PTIME_FIELDS and TIME_FIELDS 2026-02-06 16:10:04 -05:00
REDMOND\brodes
a534d26449 C++: Accept test changes. 2026-02-06 16:07:44 -05:00
REDMOND\brodes
ca18179bd2 C++: Correct false positive. Only TimeConversionFunction that do not auto correct for leap year should be considered. 2026-02-06 16:07:07 -05:00
REDMOND\brodes
d9feadcfec C++. Accept test changes. One false positive introduced, and one false negative remains. 2026-02-06 16:05:38 -05:00
REDMOND\brodes
95d4a541bc C++: Refactor leap year logic for UncheckedLeapYearAfterYearModification. Includes new logic for detecting leap year checks, new forms of leap year checks detected, and various heuristics to remove false postives. Move TimeConversionFunction into LeapYear.qll and refactored to separate conversion functions that are expected to be checked for failure from those that auto correct leap year dates if feb 29 is provided on a non-leap year. Increas the set of known TimeConversionFunctions. 2026-02-06 16:03:37 -05:00
REDMOND\brodes
6c171c804f C++: Add more tests for modified years with and without leap year checks (UncheckedLeapYearAfterYearModification). Switch to using 'postprocess' for unit tests. 2026-02-06 16:03:25 -05:00
Jon Janego
d0bd8459a1 Merge pull request #21291 from github/codeql-spark-run-21760759512 
Update changelog documentation site
 2026-02-06 12:28:56 -06:00
Jon Janego
1c43ceae95 Merge branch 'main' into codeql-spark-run-21760759512 2026-02-06 12:16:31 -06:00
Jon Janego
5bf2d9442e Fix formatting in changelog for Go path injection query 2026-02-06 12:14:03 -06:00
Jon Janego
c40d784a4d Update codeql-cli-2.23.1.rst 2026-02-06 12:13:34 -06:00
Jon Janego
bf6568b928 Fix formatting for Kotlin version support note 2026-02-06 12:12:55 -06:00
Jon Janego
79ad064a93 Fix formatting in Kotlin version support note 2026-02-06 12:12:16 -06:00
Jon Janego
552976d057 Update codeql-cli-2.19.1.rst 2026-02-06 12:11:49 -06:00
github-actions[bot]
353cd31ce6 update codeql documentation 2026-02-06 18:09:49 +00:00
Paolo Tranquilli
48db24d184 Merge pull request #21287 from github/redsun82/fix-rust-deps-patching 
Bazel: fix Rust deps patching for semver build metadata
 2026-02-06 17:17:24 +01:00
github-actions[bot]
38830ddc5c Bazel: fix Rust deps patching for semver build metadata 
Handle crate versions containing `+` build metadata (e.g., `0.9.11+spec-1.1.0`).
Bazel repo names use `-` instead of `+`, so the generated labels need patching
to reference the correct repo name.

Also adds documentation for both patching issues handled by patch_defs.py.
 2026-02-06 14:58:34 +01:00
Mathias Vorreiter Pedersen
2c05624088 Merge pull request #21280 from MathiasVP/make-getChildCount-more-robust 
C++: Make 'getChildCount' more robust by counting indices instead of elements
 2026-02-06 12:19:20 +00:00
Mathias Vorreiter Pedersen
d57a42a7f7 C++: Make 'getChildCount' more robust by counting indexes instead of 'TranslatedDeclarationEntry's. 2026-02-05 20:23:45 +00:00
Taus
5adc9f8ff0 Merge pull request #21274 from github/tausbn/python-fix-parsing-of-format-specifiers 
Python: Fix syntax error when `=` is used as a format fill character
 2026-02-05 16:37:42 +01:00
Taus
8c27437628 Python: Bump extractor version and add change note 2026-02-05 13:50:54 +00:00
Taus
12ee93042b Python: Add tests 2026-02-05 13:47:24 +00:00
Taus
bac356c9a1 Python: Regenerate parser files 2026-02-05 13:46:59 +00:00
Taus
68c1a3d389 Python: Fix syntax error when = is used as a format fill character 
An example (provided by @redsun82) is the string `f"{x:=^20}"`. Parsing
this (with unnamed nodes shown) illustrates the problem:

```
module [0, 0] - [2, 0]
  expression_statement [0, 0] - [0, 11]
    string [0, 0] - [0, 11]
      string_start [0, 0] - [0, 2]
      interpolation [0, 2] - [0, 10]
        "{" [0, 2] - [0, 3]
        expression: named_expression [0, 3] - [0, 9]
          name: identifier [0, 3] - [0, 4]
          ":=" [0, 4] - [0, 6]
          ERROR [0, 6] - [0, 7]
            "^" [0, 6] - [0, 7]
          value: integer [0, 7] - [0, 9]
        "}" [0, 9] - [0, 10]
      string_end [0, 10] - [0, 11]
```
Observe that we've managed to combine the format specifier token `:` and
the fill character `=` in a single token (which doesn't match the `:` we
expect in the grammar rule), and hence we get a syntax error.

If we change the `=` to some other character (e.g. a `-`), we instead
get

```
module [0, 0] - [2, 0]
  expression_statement [0, 0] - [0, 11]
    string [0, 0] - [0, 11]
      string_start [0, 0] - [0, 2]
      interpolation [0, 2] - [0, 10]
        "{" [0, 2] - [0, 3]
        expression: identifier [0, 3] - [0, 4]
        format_specifier: format_specifier [0, 4] - [0, 9]
          ":" [0, 4] - [0, 5]
        "}" [0, 9] - [0, 10]
      string_end [0, 10] - [0, 11]
```
and in particular no syntax error.

To fix this, we want to ensure that the `:` is lexed on its own, and the
`token(prec(1, ...))` construction can be used to do exactly this.

Finally, you may wonder why `=` is special here. I think what's going on
is that the lexer knows that `:=` is a token on its own (because it's
used in the walrus operator), and so it greedily consumes the following
`=` with this in mind.
 2026-02-05 13:45:54 +00:00
Paolo Tranquilli
05bef12ddd Merge pull request #21265 from github/redsun82/csharp-csrf-inheritance 
C#: Fix CSRF query to check antiforgery attributes on base classes
 2026-02-05 14:20:30 +01:00
Idriss Riouak
1df3adf021 Merge pull request #21244 from github/idrissrio/cpp/overlay/changes-json 
C/C++ overlay: use files table instead of `overlayChangedFiles` for overlay discard
 2026-02-05 13:15:07 +01:00
idrissrio
e26c199426 C/C++ overlay: use files table instead of overlayChangedFiles for overlay discard 2026-02-05 12:43:01 +01:00
Tom Hvitved
1203da1b66 Merge pull request #21253 from paldepind/rust/as-path-trait 
Rust: Resolve `as` paths to trait
 2026-02-05 12:38:16 +01:00
Paolo Tranquilli
f79bd3f4cf C#: accept location changes in test 2026-02-05 12:14:59 +01:00
Mathias Vorreiter Pedersen
476df7de73 Merge pull request #21260 from MathiasVP/add-windows-remote-flow-sources 
C++: Add more Win32 and Azure SDK remote flow sources
 2026-02-05 10:47:03 +00:00
Anders Schack-Mulligen
29e01748b7 Merge pull request #21267 from aschackmull/java/rename-misc 
Java: Rename several AST predicates.
 2026-02-05 11:15:29 +01:00
Anders Schack-Mulligen
11003e685d Java: Fix qldoc 2026-02-05 10:37:19 +01:00
Anders Schack-Mulligen
e4daeec2ca Merge pull request #21268 from aschackmull/java/view-cfg 
Java: Add support for "View CFG" in VSCode.
 2026-02-05 09:48:14 +01:00
Anders Schack-Mulligen
81977f11a1 Cfg: qldoc + overlay fixups. 2026-02-05 08:59:28 +01:00
Anders Schack-Mulligen
32fe12a6dd Java: Delay deprecation a bit. 2026-02-05 08:51:27 +01:00
Anders Schack-Mulligen
83adf793e4 Cfg: Fix compilation. 2026-02-04 15:28:37 +01:00
Simon Friis Vindum
52dc58172d Merge branch 'main' into rust/as-path-trait 2026-02-04 14:47:57 +01:00
Owen Mansel-Chan
544931f73f Merge pull request #21266 from owen-mc/python/pretty-print-models-in-test 
Python: Pretty print models in test
 2026-02-04 13:46:51 +00:00