Taus
72f5109ec2
Python: Add more overlay[caller] to Flow.qll
...
These were causing the repo `gufolabs/noc` to spend ~30 seconds
evaluating `ControlFlowNode.strictlyDominates`. Just in case, I added
`overlay[caller] to the other instances of `pragma[inline]` as well.
2026-02-16 13:48:33 +00:00
Taus
248932db7a
Python: Fix frameworks/data/warnings.ql
2026-02-16 13:48:32 +00:00
Taus
306d7d1b5d
Python: DataFlowDispatch.qll annotations
2026-02-16 13:48:32 +00:00
Taus
7ea96c43ec
Python: DataFlowPrivate.qll annotations
2026-02-16 13:48:32 +00:00
Taus
bd71db87be
Python: DataFlowPublic.qll annotations
2026-02-16 13:48:32 +00:00
Taus
c46c662b72
Python: LocalSources.qll annotations
2026-02-16 13:48:32 +00:00
Taus
df0f2f8ce4
Python: Simple dataflow annotations
...
None of these required any changes to the dataflow libraries, so it
seemed easiest to put them in their own commit.
2026-02-16 13:48:32 +00:00
Taus
51ebec9164
Python: Fix broken queries
2026-02-16 13:48:32 +00:00
Taus
fd7b123ee3
Python: Add overlay annotations to AST classes
...
... and everything else that it depends on.
2026-02-16 13:48:32 +00:00
Tom Hvitved
79cbf2f1cf
Merge pull request #21312 from hvitved/rust/type-inference-bad-join
...
Rust: Fix bad join
2026-02-16 14:45:58 +01:00
Owen Mansel-Chan
7742a5667f
Merge pull request #21326 from owen-mc/java/log-injection-regex-match
...
Java: Recognise `@Pattern` annotation as sanitizer for log injection
2026-02-16 12:14:28 +00:00
Owen Mansel-Chan
cf73d96c9d
Update test results (remove SPURIOUS annotations)
2026-02-16 12:03:02 +00:00
Owen Mansel-Chan
597be6a1c0
Add change note
2026-02-16 12:01:15 +00:00
Owen Mansel-Chan
94f1d94a2b
Rename MethodCall ma to mc
2026-02-16 12:01:14 +00:00
Owen Mansel-Chan
9fc95f5171
Expand log injection sanitizers to annotation regex matches
2026-02-16 12:01:13 +00:00
Owen Mansel-Chan
924bb92d91
Expand log injection sanitizer guards to non-annotation regex matches
2026-02-16 12:01:11 +00:00
Owen Mansel-Chan
60e58f8219
Refactor logInjectionGuard part 2
2026-02-16 12:01:10 +00:00
Owen Mansel-Chan
6c0c1d558e
Refactor logInjectionGuard part 1
2026-02-16 12:01:08 +00:00
Owen Mansel-Chan
146fc7a8c0
Add failing log injection test for @Pattern validation
2026-02-16 12:01:07 +00:00
Jeroen Ketema
7d2b40c657
Merge pull request #21313 from MathiasVP/range-analysis-lower-bound-and-measure-enums
...
C++: Measure bounds for `Enum` constants and reduce `getBoundsLimit`
2026-02-16 11:50:38 +01:00
Mathias Vorreiter Pedersen
5ccd61ac97
C++: Respond to review comments.
2026-02-16 09:49:31 +00:00
Mathias Vorreiter Pedersen
bfbb2eef6c
C++: Add a test showing that we infer a lower and upper bound for parameters of enum types.
2026-02-16 09:38:15 +00:00
Mathias Vorreiter Pedersen
84be8517bb
Update cpp/ql/lib/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll
...
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2026-02-16 09:30:56 +00:00
Tom Hvitved
149f3ed5b6
Merge pull request #21301 from hvitved/rust/type-inference-trait-call-perf
...
Rust: Speedup type inference for `Trait::function()` calls
2026-02-16 10:20:50 +01:00
Owen Mansel-Chan
47a9f87d9b
Merge pull request #21310 from owen-mc/java/regex-execution
...
Java: Add RegexMatch concept and recognise `@Pattern` annotation as sanitizer
2026-02-16 09:11:47 +00:00
Simon Friis Vindum
6f609a5ed6
Merge pull request #21316 from paldepind/ruby/binary-of-at-start-of-line
...
Ruby: Add test cases for binary operator at start of line
2026-02-16 09:49:48 +01:00
Owen Mansel-Chan
16ddb5658f
Small refactor for stylistic consistency
2026-02-15 14:39:23 +00:00
Owen Mansel-Chan
d6b71a346e
Extend RegexMatch framework to allow for MatcherMatchesCall edge case
2026-02-15 14:39:21 +00:00
Owen Mansel-Chan
8f8f4c2d52
Fix Matcher.matches edge case
2026-02-14 00:28:37 +00:00
Owen Mansel-Chan
90befa0c00
Add failing test for Matcher.matches() edge case
2026-02-14 00:28:34 +00:00
Owen Mansel-Chan
ca4c988e97
Remove redundant variable
2026-02-13 22:58:09 +00:00
Owen Mansel-Chan
2e0f244376
Improve QLDoc on RegexMatch.getName()
2026-02-13 22:55:01 +00:00
Owen Mansel-Chan
c7099584b4
Put imports implementing abstract classes in private module
2026-02-13 22:51:53 +00:00
Owen Mansel-Chan
3c161f9c93
Make contract of RegexMatch clear
2026-02-13 22:47:44 +00:00
Owen Mansel-Chan
1fefa989d7
Rename RegexMatch and only include expressions
2026-02-13 22:45:48 +00:00
Owen Mansel-Chan
953ff9f0d0
PatternAnnotation.getString() should only be field reads
2026-02-13 22:41:20 +00:00
Owen Mansel-Chan
106254b220
Improve QLDocs
2026-02-13 22:40:36 +00:00
Owen Mansel-Chan
5bdf550317
Fix QLDocs
2026-02-12 16:57:14 +00:00
Owen Mansel-Chan
c539c2f4fd
Add change note
2026-02-12 16:57:12 +00:00
Owen Mansel-Chan
bfe26c1989
Add @Pattern as RegexExecution => SSRF sanitizer
2026-02-12 16:57:11 +00:00
Owen Mansel-Chan
d0999e3abd
Add failing test for @Pattern validation
2026-02-12 16:57:04 +00:00
Simon Friis Vindum
bf02e478fd
Rust: Comment out tests with parse errors
2026-02-12 14:49:09 +01:00
Taus
7d17454a3b
Merge pull request #21138 from github/tausbn/python-prepare-for-overlay-annotations
...
Prepare dataflow for local annotations
2026-02-12 14:23:45 +01:00
Taus
3e5c2ddeaf
Merge pull request #21308 from github/smowton/admin/path-injection-use-autofix-qhelp
...
Python: use path-injection qhelp variant employed by autofix
2026-02-12 13:17:08 +01:00
Chris Smowton
5f970d9f2f
Rewordings per copilot
2026-02-12 12:01:33 +00:00
Simon Friis Vindum
218585b52a
Ruby: Add additonal tests with operators at the start of lines
2026-02-12 12:30:43 +01:00
Anders Schack-Mulligen
a945f15987
Merge pull request #21317 from aschackmull/java/deprecate-unreachableblocks
...
Java: Deprecate UnreachableBlocks.
2026-02-12 11:43:37 +01:00
Anders Schack-Mulligen
5c53677051
Java: Deprecate UnreachableBlocks.
2026-02-12 11:06:34 +01:00
Mathias Vorreiter Pedersen
2dc91a56eb
C++: Lower the treshold for max number of bounds to 2^29.
2026-02-12 09:44:20 +00:00
Mathias Vorreiter Pedersen
6dd6bddff3
C++: Add more terms to make range analysis test timeout.
2026-02-12 09:44:17 +00:00
