Commit Graph

75534 Commits

Author SHA1 Message Date
Simon Friis Vindum
70550950d8 Java, C#: Ensure variable is used in all disjuncts 2025-01-29 10:30:26 +01:00
Simon Friis Vindum
13e0829d19 Shared: Generalize the number of columns in a generated MaD row 2025-01-28 15:36:09 +01:00
Erik Krogh Kristensen
f0755bfb5d Merge pull request #18601 from erik-krogh/del-deps-jan-2025
All: delete outdated deprecations
2025-01-28 13:31:41 +01:00
Geoffrey White
6337f5a08b Merge pull request #18586 from geoffw0/floatguards
C++: Test and (perhaps) fix an issue with guards on floating point comparisons.
2025-01-28 09:05:13 +00:00
Asger F
16634e6dc9 Merge pull request #18540 from JarLob/bash
Actions: Improve bash support
2025-01-28 09:49:58 +01:00
Geoffrey White
78d0c5c529 Merge pull request #18602 from geoffw0/reqwest2
Rust: Additional models for Reqwest
2025-01-28 08:40:38 +00:00
erik-krogh
c7fc164680 java: remove the 2 from SafeTransformerFactoryFlow, not that the previous naming conflict has been deleted 2025-01-28 09:13:59 +01:00
Geoffrey White
fd9fb10bb9 Rust: Accept changes from fixing the ]. 2025-01-27 22:50:09 +00:00
Geoffrey White
494d8f2da0 Rust: Update MaD IDs for an unrelated test. :( 2025-01-27 22:22:41 +00:00
Geoffrey White
9d6a13cec2 Rust: Accept improved results for rust/sql-injection. Note that the lost annotations are only sources, not results, and I suspect will return when we have sufficient flow in these cases. 2025-01-27 22:22:38 +00:00
erik-krogh
a1afa20d4b add change-notes 2025-01-27 22:43:13 +01:00
erik-krogh
d46a2d4e80 ruby: delete the remainders of the old deprecated typetracking library 2025-01-27 22:38:07 +01:00
erik-krogh
90b403b40b py: delete the remainder of the deprecated TypeTracker libary 2025-01-27 22:17:18 +01:00
erik-krogh
e1b14cb0be ruby: delete now dead Ruby method 2025-01-27 22:17:13 +01:00
erik-krogh
0056e923ea js: revert the JS deprecations. The old dataflow library is not that old yet 2025-01-27 22:17:07 +01:00
erik-krogh
7b1b366d98 ruby: update ruby tests after deleting deprecated test predicates 2025-01-27 22:17:00 +01:00
erik-krogh
bd8ed1dc04 cpp: revert two cpp dataflow deprecations that take more work 2025-01-27 22:16:54 +01:00
erik-krogh
34f5f61a10 all: use my script to delete outdated deprecations 2025-01-27 22:16:48 +01:00
Geoffrey White
9ea9f3ae19 Update rust/ql/lib/codeql/rust/frameworks/reqwest.model.yml
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2025-01-27 21:09:21 +00:00
Geoffrey White
7cf872baad Rust: Adjust the tests to work around test processing of /. 2025-01-27 21:00:08 +00:00
Geoffrey White
23ac35e5ca Rust: Model more Reqwest methods (.await still doesn't work though). 2025-01-27 20:52:31 +00:00
Geoffrey White
9583a2a7d3 Rust: Additional test cases for reqwest sources. 2025-01-27 20:42:35 +00:00
Tom Hvitved
253ccd1210 Merge pull request #14303 from hvitved/ruby/must-flow
Ruby: Implement `localMustFlowStep `
2025-01-27 12:51:29 +01:00
Erik Krogh Kristensen
87ad09bcdf Merge pull request #18595 from erik-krogh/erik-krogh/clear-text-example
JS: fix example in clear-text-logging qhelp to actually be bad
2025-01-27 11:45:50 +01:00
Geoffrey White
67a746eff1 Update cpp/ql/lib/semmle/code/cpp/controlflow/IRGuards.qll
Co-authored-by: Jeroen Ketema <93738568+jketema@users.noreply.github.com>
2025-01-27 10:41:50 +00:00
Geoffrey White
f32fd38f74 Merge pull request #18582 from geoffw0/logging
Rust: Query for cleartext logging of sensitive information
2025-01-27 10:37:17 +00:00
erik-krogh
37a1727043 fix example in clear-text-logging qhelp to actually be bad 2025-01-27 11:31:28 +01:00
Owen Mansel-Chan
1bacb99410 Merge pull request #18585 from owen-mc/go/1.24-support-prep
Go: 1.24 support - Tolerate type parameters on alias types
2025-01-27 10:14:36 +00:00
Tom Hvitved
f75ecdb16e Merge pull request #18570 from hvitved/csharp/dotnet3-integration-test
C#: Verify that downloaded .NET CLIs are executable
2025-01-27 10:28:04 +01:00
Simon Friis Vindum
eaeeafeea4 Merge pull request #18590 from paldepind/rust-control-flow-test
Rust: Add two additional control flow tests
2025-01-27 09:05:20 +01:00
Jeroen Ketema
4d2ec75ef2 Merge pull request #18588 from jketema/decl-entry
C++: Fix join-order problem in `UserType::getADeclarationEntry`
2025-01-24 19:38:54 +01:00
Geoffrey White
06bd394695 C++: Add a note for the other predicates as well. 2025-01-24 17:52:13 +00:00
Geoffrey White
1f962004a9 C++: Add a note in the QLDoc for comparesEq. 2025-01-24 17:52:03 +00:00
Geoffrey White
7664fd16e7 C++: Add more test cases for guards. 2025-01-24 17:51:45 +00:00
Geoffrey White
0a3d44c44e Rust: Re-apply suggested changes (I accidentally force-pushed them away). 2025-01-24 17:31:38 +00:00
Geoffrey White
117db8a9b2 Rust: Make the test runnable. 2025-01-24 17:22:42 +00:00
Florin Coada
41ee84b412 Merge pull request #18591 from github/changedocs/2.20.3
Add changelog entries for CodeQL CLI versions 2.20.1 to 2.20.3
2025-01-24 17:21:11 +00:00
Florin Coada
a76e9a4c21 Add changelog entries for CodeQL CLI versions 2.20.1 to 2.20.3 2025-01-24 16:59:30 +00:00
Michael Nebel
d3d3cceb40 Merge pull request #18575 from michaelnebel/csharp/overloadresolution
C# 13: Overload resolution priority.
2025-01-24 16:14:18 +01:00
Jeroen Ketema
2e33a4287f C++: Apply review suggestion 2025-01-24 16:12:16 +01:00
Simon Friis Vindum
c195840ec8 Rust: Add two additional control flow tests 2025-01-24 16:09:32 +01:00
Jeroen Ketema
4c256d17ae C++: Fix join-order problem in UserType::getADeclarationEntry
Before on `LRMPUT/PUTSLAM`:
```
Evaluated recursive predicate UserType::UserType.getADeclarationEntry/0#cea44e2f@7ce3a4hu in 22069ms on iteration 2 (delta size: 379076853).
Evaluated relational algebra for predicate UserType::UserType.getADeclarationEntry/0#cea44e2f@7ce3a4hu on iteration 2 running pipeline standard with tuple counts:
           126825  ~32%    {2} r1 = JOIN `UserType::UserType.getADeclarationEntry/0#cea44e2f#prev_delta` WITH Class::Class#9afdbffd ON FIRST 1 OUTPUT Lhs.0, Lhs.1
        379076853  ~97%    {2}    | JOIN WITH `Class::Class.isConstructedFrom/1#dispred#390e01c8_10#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.1
        379076853  ~97%    {2}    | JOIN WITH UserType::UserType#21e9e463 ON FIRST 1 OUTPUT Lhs.0, Lhs.1
                           {2}    | AND NOT `UserType::UserType.getADeclarationEntry/0#cea44e2f#prev`(FIRST 2)
        379076853  ~96%    {2}    | SCAN OUTPUT In.1, In.0
                           {2}    | AND NOT `_Class::Class#9afdbffd_Class::Class.isConstructedFrom/1#dispred#390e01c8_10#join_rhs_ResolveClass::r__#antijoin_rhs`(FIRST 2)
        379076853  ~97%    {2}    | SCAN OUTPUT In.1, In.0
                           return r1

Evaluated named local _Class::Class#9afdbffd_Class::Class.isConstructedFrom/1#dispred#390e01c8_10#join_rhs_ResolveClass::r__#antijoin_rhs@L0#7ce3a in 7459ms on iteration 2 (size: 0).
Evaluated relational algebra for predicate _Class::Class#9afdbffd_Class::Class.isConstructedFrom/1#dispred#390e01c8_10#join_rhs_ResolveClass::r__#antijoin_rhs@L0#7ce3a on iteration 2 running pipeline main with tuple counts:
           126825  ~32%    {2} r1 = JOIN `UserType::UserType.getADeclarationEntry/0#cea44e2f#prev_delta` WITH Class::Class#9afdbffd ON FIRST 1 OUTPUT Lhs.0, Lhs.1
        379076853  ~97%    {2}    | JOIN WITH `Class::Class.isConstructedFrom/1#dispred#390e01c8_10#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.1
        379076853  ~97%    {2}    | JOIN WITH UserType::UserType#21e9e463 ON FIRST 1 OUTPUT Lhs.0, Lhs.1
        379076853  ~97%    {2}    | AND NOT `UserType::UserType.getADeclarationEntry/0#cea44e2f#prev`(FIRST 2)

                0   ~0%    {2} r2 = r1 AND NOT usertypes_0#antijoin_rhs(FIRST 1)
                0   ~0%    {2}    | JOIN WITH type_decls_1#join_rhs ON FIRST 1 OUTPUT Lhs.1, Lhs.0

        379077929  ~95%    {3} r3 = JOIN r1 WITH `ResolveClass::resolveClass/1#ea47deee_10#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Lhs.0
                0   ~0%    {2}    | JOIN WITH type_decls_1#join_rhs ON FIRST 1 OUTPUT Lhs.1, Lhs.2

                0   ~0%    {2} r4 = r2 UNION r3
                           return r4

Evaluated named local _Class::Class#9afdbffd_Class::Class.isConstructedFrom/1#dispred#390e01c8_10#join_rhs_ResolveClass::r__#antijoin_rhs@L0#7ce3a in 1031ms on iteration 3 (size: 0).
Evaluated relational algebra for predicate _Class::Class#9afdbffd_Class::Class.isConstructedFrom/1#dispred#390e01c8_10#join_rhs_ResolveClass::r__#antijoin_rhs@L0#7ce3a on iteration 3 running pipeline main with tuple counts:
        190114100   ~0%    {2} r1 = JOIN `UserType::UserType.getADeclarationEntry/0#cea44e2f#prev_delta` WITH Class::Class#9afdbffd ON FIRST 1 OUTPUT Lhs.0, Lhs.1
                0   ~0%    {2}    | JOIN WITH `Class::Class.isConstructedFrom/1#dispred#390e01c8_10#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.1
                0   ~0%    {2}    | JOIN WITH UserType::UserType#21e9e463 ON FIRST 1 OUTPUT Lhs.0, Lhs.1
                0   ~0%    {2}    | AND NOT `UserType::UserType.getADeclarationEntry/0#cea44e2f#prev`(FIRST 2)

                0   ~0%    {2} r2 = r1 AND NOT usertypes_0#antijoin_rhs(FIRST 1)
                0   ~0%    {2}    | JOIN WITH type_decls_1#join_rhs ON FIRST 1 OUTPUT Lhs.1, Lhs.0

                0   ~0%    {3} r3 = JOIN r1 WITH `ResolveClass::resolveClass/1#ea47deee_10#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Lhs.0
                0   ~0%    {2}    | JOIN WITH type_decls_1#join_rhs ON FIRST 1 OUTPUT Lhs.1, Lhs.2

                0   ~0%    {2} r4 = r2 UNION r3
                           return r4

Pipeline base for UserType::UserType.getADeclarationEntry/0#cea44e2f@7ce3a4hu was evaluated in 1 iterations totaling 149ms (delta sizes total: 224004).
         149171    ~17%    {1} r1 = JOIN type_decls_1#join_rhs WITH `ResolveClass::resolveClass/1#ea47deee` ON FIRST 1 OUTPUT Rhs.1
         125649     ~0%    {1}    | JOIN WITH UserType::UserType#21e9e463 ON FIRST 1 OUTPUT Lhs.0
        1811817  ~1075%    {2}    | JOIN WITH `ResolveClass::resolveClass/1#ea47deee_10#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.0
        1812281  ~1172%    {2}    | JOIN WITH type_decls_10#join_rhs ON FIRST 1 OUTPUT Lhs.1, Rhs.1
                           return r1

Pipeline standard for UserType::UserType.getADeclarationEntry/0#cea44e2f@7ce3a4hu was evaluated in 1 iterations totaling 22069ms (delta sizes total: 379076853).
           126825  ~32%    {2} r1 = JOIN `UserType::UserType.getADeclarationEntry/0#cea44e2f#prev_delta` WITH Class::Class#9afdbffd ON FIRST 1 OUTPUT Lhs.0, Lhs.1
        379076853  ~97%    {2}    | JOIN WITH `Class::Class.isConstructedFrom/1#dispred#390e01c8_10#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.1
        379076853  ~97%    {2}    | JOIN WITH UserType::UserType#21e9e463 ON FIRST 1 OUTPUT Lhs.0, Lhs.1
                           {2}    | AND NOT `UserType::UserType.getADeclarationEntry/0#cea44e2f#prev`(FIRST 2)
        379076853  ~96%    {2}    | SCAN OUTPUT In.1, In.0
                           {2}    | AND NOT `_Class::Class#9afdbffd_Class::Class.isConstructedFrom/1#dispred#390e01c8_10#join_rhs_ResolveClass::r__#antijoin_rhs`(FIRST 2)
        379076853  ~97%    {2}    | SCAN OUTPUT In.1, In.0
                           return r1

Pipeline main for _Class::Class#9afdbffd_Class::Class.isConstructedFrom/1#dispred#390e01c8_10#join_rhs_ResolveClass::r__#antijoin_rhs@L0#7ce3a was evaluated in 2 iterations totaling 8490ms (sizes total: 0).
        190240925   ~0%    {2} r1 = JOIN `UserType::UserType.getADeclarationEntry/0#cea44e2f#prev_delta` WITH Class::Class#9afdbffd ON FIRST 1 OUTPUT Lhs.0, Lhs.1
        379076853  ~97%    {2}    | JOIN WITH `Class::Class.isConstructedFrom/1#dispred#390e01c8_10#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.1
        379076853  ~97%    {2}    | JOIN WITH UserType::UserType#21e9e463 ON FIRST 1 OUTPUT Lhs.0, Lhs.1
        379076853  ~97%    {2}    | AND NOT `UserType::UserType.getADeclarationEntry/0#cea44e2f#prev`(FIRST 2)

                0   ~0%    {2} r2 = r1 AND NOT usertypes_0#antijoin_rhs(FIRST 1)
                0   ~0%    {2}    | JOIN WITH type_decls_1#join_rhs ON FIRST 1 OUTPUT Lhs.1, Lhs.0

        379077929  ~95%    {3} r3 = JOIN r1 WITH `ResolveClass::resolveClass/1#ea47deee_10#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Lhs.0
                0   ~0%    {2}    | JOIN WITH type_decls_1#join_rhs ON FIRST 1 OUTPUT Lhs.1, Lhs.2

                0   ~0%    {2} r4 = r2 UNION r3
                           return r4
```

After:
```
[2025-01-24 15:22:19] Evaluated non-recursive predicate UserType::UserType.getADeclarationEntryBase/0#dispred#d07c0e9a@82645fgi in 8ms (size: 149661).
Evaluated relational algebra for predicate UserType::UserType.getADeclarationEntryBase/0#dispred#d07c0e9a@82645fgi with tuple counts:
        149661  ~5%    {2} r1 = JOIN `_ResolveClass::resolveClass/1#ea47deee_type_decls#shared` WITH UserType::UserType#21e9e463 ON FIRST 1 OUTPUT Lhs.0, Lhs.1
                       return r1

[2025-01-24 15:22:19] Evaluated non-recursive predicate project#UserType::UserType.getADeclarationEntryBase/0#dispred#d07c0e9a@22da38r1 in 10ms (size: 124540).
Evaluated relational algebra for predicate project#UserType::UserType.getADeclarationEntryBase/0#dispred#d07c0e9a@22da38r1 with tuple counts:
        149661  ~17%    {1} r1 = SCAN `UserType::UserType.getADeclarationEntryBase/0#dispred#d07c0e9a` OUTPUT In.0
        124540   ~0%    {1}    | STREAM DEDUP
                        return r1

[2025-01-24 15:22:20] Evaluated non-recursive predicate Class::Class.isConstructedFrom/1#dispred#390e01c8_10#join_rhs@9c5150lt in 91ms (size: 764244).
Evaluated relational algebra for predicate Class::Class.isConstructedFrom/1#dispred#390e01c8_10#join_rhs@9c5150lt with tuple counts:
        764244  ~2%    {2} r1 = SCAN `Class::Class.isConstructedFrom/1#dispred#390e01c8` OUTPUT In.1, In.0
                       return r1

Evaluated recursive predicate UserType::UserType.getADeclarationEntry/0#cea44e2f#fb@d5a154u4 in 8ms on iteration 1 (delta size: 25561).
Evaluated relational algebra for predicate UserType::UserType.getADeclarationEntry/0#cea44e2f#fb@d5a154u4 on iteration 1 running pipeline base with tuple counts:
        149661  ~2%    {2} r1 = SCAN `UserType::UserType.getADeclarationEntryBase/0#dispred#d07c0e9a` OUTPUT In.1, In.0
         25561  ~6%    {2}    | JOIN WITH type_def ON FIRST 1 OUTPUT Lhs.1, Lhs.0
                       return r1

Evaluated recursive predicate UserType::UserType.getADeclarationEntry/0#cea44e2f#fb@d5a154u4 in 108ms on iteration 2 (delta size: 763236).
Evaluated relational algebra for predicate UserType::UserType.getADeclarationEntry/0#cea44e2f#fb@d5a154u4 on iteration 2 running pipeline standard with tuple counts:
          3655  ~0%    {2} r1 = JOIN `UserType::UserType.getADeclarationEntry/0#cea44e2f#fb#prev_delta` WITH Class::Class#9afdbffd ON FIRST 1 OUTPUT Lhs.0, Lhs.1
        763236  ~1%    {2}    | JOIN WITH `Class::Class.isConstructedFrom/1#dispred#390e01c8_10#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.1
        763236  ~1%    {2}    | AND NOT `UserType::UserType.getADeclarationEntry/0#cea44e2f#fb#prev`(FIRST 2)
        763236  ~1%    {2}    | AND NOT `project#UserType::UserType.getADeclarationEntryBase/0#dispred#d07c0e9a`(FIRST 1)
                       return r1

Pipeline base for UserType::UserType.getADeclarationEntry/0#cea44e2f#fb@d5a154u4 was evaluated in 1 iterations totaling 8ms (delta sizes total: 25561).
        149661  ~2%    {2} r1 = SCAN `UserType::UserType.getADeclarationEntryBase/0#dispred#d07c0e9a` OUTPUT In.1, In.0
         25561  ~6%    {2}    | JOIN WITH type_def ON FIRST 1 OUTPUT Lhs.1, Lhs.0
                       return r1

Pipeline standard for UserType::UserType.getADeclarationEntry/0#cea44e2f#fb@d5a154u4 was evaluated in 1 iterations totaling 108ms (delta sizes total: 763236).
          3655  ~0%    {2} r1 = JOIN `UserType::UserType.getADeclarationEntry/0#cea44e2f#fb#prev_delta` WITH Class::Class#9afdbffd ON FIRST 1 OUTPUT Lhs.0, Lhs.1
        763236  ~1%    {2}    | JOIN WITH `Class::Class.isConstructedFrom/1#dispred#390e01c8_10#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.1
        763236  ~1%    {2}    | AND NOT `UserType::UserType.getADeclarationEntry/0#cea44e2f#fb#prev`(FIRST 2)
        763236  ~1%    {2}    | AND NOT `project#UserType::UserType.getADeclarationEntryBase/0#dispred#d07c0e9a`(FIRST 1)
                       return r1
```
2025-01-24 15:24:13 +01:00
Tom Hvitved
ac4f82cfbb C#: Verify that downloaded .NET CLIs are executable 2025-01-24 15:14:58 +01:00
Tom Hvitved
dcd87a9825 C#: Add .NET 3 integration test 2025-01-24 15:13:22 +01:00
Owen Mansel-Chan
29f6d48162 Retain previous check for alias types 2025-01-24 12:30:27 +00:00
Jaroslav Lobačevski
9521467a06 Update actions/ql/lib/codeql/actions/Bash.qll
Co-authored-by: Asger F <asgerf@github.com>
2025-01-24 12:59:41 +01:00
Asger F
a54e732aab Merge pull request #18572 from asgerf/rb/diff-informed2
Ruby: fix and improve diff-informed queries
2025-01-24 11:05:46 +01:00
Asger F
1b7977bf90 Merge pull request #18466 from asgerf/js/view-component-inputs
JS: Add view-component-input threat model
2025-01-24 10:59:25 +01:00
Asger F
60f9160822 Merge pull request #18574 from asgerf/js/diff-informed2
JS: fix and improve diff-informed queries
2025-01-24 10:58:22 +01:00
Simon Friis Vindum
a6cd53eeb8 Merge pull request #18497 from paldepind/shared-basic-block-library
Add shared basic block library
2025-01-24 10:49:33 +01:00