Tom Hvitved
55e5bc4970
Rust: Add telemtry tags to queries
2026-02-10 11:25:42 +01:00
Tom Hvitved
c3ac20267a
Merge pull request #21217 from hvitved/rust/type-inference-perf
...
Rust: Rework call disambiguation logic
2026-02-10 08:52:01 +01:00
Tom Hvitved
16539b4667
Address review comments
2026-02-09 19:30:58 +01:00
yoff
5ad42f8bcc
Merge pull request #20563 from microsoft/azure_python_sdk_url_summary_upstream
...
Azure python sdk url summary upstream
2026-02-09 18:34:36 +01:00
Ian Lynagh
b5e3168032
Merge pull request #21286 from github/andersfugmann/kotlin_2.3.10-no-artifacts
...
Kotlin: Support Kotlin 2.3.10
2026-02-09 13:26:40 +00:00
Michael B. Gale
71e8730c63
Merge pull request #21263 from github/mbg/csharp/registry-diagnostic
...
C#: Add diagnostic for private registry usage
2026-02-09 12:58:43 +00:00
Owen Mansel-Chan
90401b3ad3
Merge pull request #21254 from owen-mc/go/astnode-get-enclosing-block
...
Go: Add `AstNode.getEnclosingBlock()`
2026-02-06 22:23:15 +00:00
Jon Janego
d0bd8459a1
Merge pull request #21291 from github/codeql-spark-run-21760759512
...
Update changelog documentation site
2026-02-06 12:28:56 -06:00
Jon Janego
1c43ceae95
Merge branch 'main' into codeql-spark-run-21760759512
2026-02-06 12:16:31 -06:00
Jon Janego
5bf2d9442e
Fix formatting in changelog for Go path injection query
2026-02-06 12:14:03 -06:00
Jon Janego
c40d784a4d
Update codeql-cli-2.23.1.rst
2026-02-06 12:13:34 -06:00
Jon Janego
bf6568b928
Fix formatting for Kotlin version support note
2026-02-06 12:12:55 -06:00
Jon Janego
79ad064a93
Fix formatting in Kotlin version support note
2026-02-06 12:12:16 -06:00
Jon Janego
552976d057
Update codeql-cli-2.19.1.rst
2026-02-06 12:11:49 -06:00
github-actions[bot]
353cd31ce6
update codeql documentation
2026-02-06 18:09:49 +00:00
Paolo Tranquilli
48db24d184
Merge pull request #21287 from github/redsun82/fix-rust-deps-patching
...
Bazel: fix Rust deps patching for semver build metadata
2026-02-06 17:17:24 +01:00
REDMOND\brodes
8459eec239
Moving the SsrfSink concept into Concepts.qll, and renaming to HttpClientRequestFromModel as suggested in PR review.
2026-02-06 09:26:49 -05:00
Anders Fugmann
c5179e40c6
Kotlin: Add change note for supporting 2.3.10
2026-02-06 14:59:34 +01:00
github-actions[bot]
38830ddc5c
Bazel: fix Rust deps patching for semver build metadata
...
Handle crate versions containing `+` build metadata (e.g., `0.9.11+spec-1.1.0`).
Bazel repo names use `-` instead of `+`, so the generated labels need patching
to reference the correct repo name.
Also adds documentation for both patching issues handled by patch_defs.py.
2026-02-06 14:58:34 +01:00
Anders Fugmann
d5827b5cca
Kotlin: Support Kotlin 2.3.10
2026-02-06 14:54:08 +01:00
Mathias Vorreiter Pedersen
2c05624088
Merge pull request #21280 from MathiasVP/make-getChildCount-more-robust
...
C++: Make 'getChildCount' more robust by counting indices instead of elements
2026-02-06 12:19:20 +00:00
Ben Rodes
ac1987f264
Update python/ql/lib/change-notes/2025-09-30-azure_ssrf_models.md
...
Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com >
2026-02-05 15:44:44 -05:00
Mathias Vorreiter Pedersen
d57a42a7f7
C++: Make 'getChildCount' more robust by counting indexes instead of 'TranslatedDeclarationEntry's.
2026-02-05 20:23:45 +00:00
Tom Hvitved
32aaac27ec
Rust: Add type inference regression test
2026-02-05 17:29:42 +01:00
Tom Hvitved
2dc7576232
Rust: Rework call disambiguation logic
2026-02-05 17:29:40 +01:00
Taus
5adc9f8ff0
Merge pull request #21274 from github/tausbn/python-fix-parsing-of-format-specifiers
...
Python: Fix syntax error when `=` is used as a format fill character
2026-02-05 16:37:42 +01:00
Taus
8c27437628
Python: Bump extractor version and add change note
2026-02-05 13:50:54 +00:00
Taus
12ee93042b
Python: Add tests
2026-02-05 13:47:24 +00:00
Taus
bac356c9a1
Python: Regenerate parser files
2026-02-05 13:46:59 +00:00
Taus
68c1a3d389
Python: Fix syntax error when = is used as a format fill character
...
An example (provided by @redsun82) is the string `f"{x:=^20}"`. Parsing
this (with unnamed nodes shown) illustrates the problem:
```
module [0, 0] - [2, 0]
expression_statement [0, 0] - [0, 11]
string [0, 0] - [0, 11]
string_start [0, 0] - [0, 2]
interpolation [0, 2] - [0, 10]
"{" [0, 2] - [0, 3]
expression: named_expression [0, 3] - [0, 9]
name: identifier [0, 3] - [0, 4]
":=" [0, 4] - [0, 6]
ERROR [0, 6] - [0, 7]
"^" [0, 6] - [0, 7]
value: integer [0, 7] - [0, 9]
"}" [0, 9] - [0, 10]
string_end [0, 10] - [0, 11]
```
Observe that we've managed to combine the format specifier token `:` and
the fill character `=` in a single token (which doesn't match the `:` we
expect in the grammar rule), and hence we get a syntax error.
If we change the `=` to some other character (e.g. a `-`), we instead
get
```
module [0, 0] - [2, 0]
expression_statement [0, 0] - [0, 11]
string [0, 0] - [0, 11]
string_start [0, 0] - [0, 2]
interpolation [0, 2] - [0, 10]
"{" [0, 2] - [0, 3]
expression: identifier [0, 3] - [0, 4]
format_specifier: format_specifier [0, 4] - [0, 9]
":" [0, 4] - [0, 5]
"}" [0, 9] - [0, 10]
string_end [0, 10] - [0, 11]
```
and in particular no syntax error.
To fix this, we want to ensure that the `:` is lexed on its own, and the
`token(prec(1, ...))` construction can be used to do exactly this.
Finally, you may wonder why `=` is special here. I think what's going on
is that the lexer knows that `:=` is a token on its own (because it's
used in the walrus operator), and so it greedily consumes the following
`=` with this in mind.
2026-02-05 13:45:54 +00:00
Tom Hvitved
2764d697d2
Rust: Merge Input1 and Input2 modules
2026-02-05 14:29:46 +01:00
Tom Hvitved
c62d95ac9d
Rust: More type inference tests
2026-02-05 14:29:41 +01:00
Paolo Tranquilli
05bef12ddd
Merge pull request #21265 from github/redsun82/csharp-csrf-inheritance
...
C#: Fix CSRF query to check antiforgery attributes on base classes
2026-02-05 14:20:30 +01:00
Idriss Riouak
1df3adf021
Merge pull request #21244 from github/idrissrio/cpp/overlay/changes-json
...
C/C++ overlay: use files table instead of `overlayChangedFiles` for overlay discard
2026-02-05 13:15:07 +01:00
Tom Hvitved
025f73301b
Rust: Move some overloading tests into a separate file
2026-02-05 12:49:53 +01:00
idrissrio
e26c199426
C/C++ overlay: use files table instead of overlayChangedFiles for overlay discard
2026-02-05 12:43:01 +01:00
Tom Hvitved
1203da1b66
Merge pull request #21253 from paldepind/rust/as-path-trait
...
Rust: Resolve `as` paths to trait
2026-02-05 12:38:16 +01:00
Paolo Tranquilli
f79bd3f4cf
C#: accept location changes in test
2026-02-05 12:14:59 +01:00
Mathias Vorreiter Pedersen
476df7de73
Merge pull request #21260 from MathiasVP/add-windows-remote-flow-sources
...
C++: Add more Win32 and Azure SDK remote flow sources
2026-02-05 10:47:03 +00:00
Anders Schack-Mulligen
29e01748b7
Merge pull request #21267 from aschackmull/java/rename-misc
...
Java: Rename several AST predicates.
2026-02-05 11:15:29 +01:00
Anders Schack-Mulligen
11003e685d
Java: Fix qldoc
2026-02-05 10:37:19 +01:00
Anders Schack-Mulligen
e4daeec2ca
Merge pull request #21268 from aschackmull/java/view-cfg
...
Java: Add support for "View CFG" in VSCode.
2026-02-05 09:48:14 +01:00
Anders Schack-Mulligen
81977f11a1
Cfg: qldoc + overlay fixups.
2026-02-05 08:59:28 +01:00
Anders Schack-Mulligen
32fe12a6dd
Java: Delay deprecation a bit.
2026-02-05 08:51:27 +01:00
Anders Schack-Mulligen
83adf793e4
Cfg: Fix compilation.
2026-02-04 15:28:37 +01:00
REDMOND\brodes
0a88425170
Python: Altering SSRF MaD to use 'request-forgery' tag. Update to test cases expected results, off by one line. Changed to using ModelOutput::sinkNode.
2026-02-04 09:04:22 -05:00
Ben Rodes
cd73dcfb04
Merge branch 'main' into azure_python_sdk_url_summary_upstream
2026-02-04 08:55:38 -05:00
Simon Friis Vindum
52dc58172d
Merge branch 'main' into rust/as-path-trait
2026-02-04 14:47:57 +01:00
Owen Mansel-Chan
544931f73f
Merge pull request #21266 from owen-mc/python/pretty-print-models-in-test
...
Python: Pretty print models in test
2026-02-04 13:46:51 +00:00
Anders Schack-Mulligen
2d02908e7f
Java: Add change note.
2026-02-04 14:43:32 +01:00
