copilot-swe-agent[bot]
73bc2d70ae
Model instance-attribute type flow
...
Use a field level step like JS and Ruby.
2026-06-11 14:48:55 +02:00
copilot-swe-agent[bot]
a4585d8d94
Add test documenting missing PEP249 alerts for connection stored in self attribute
2026-06-11 05:48:40 +00:00
Tom Hvitved
f5919875b7
Merge pull request #21941 from hvitved/python/content-approx
...
Python: Implement `ContentApprox`
2026-06-09 15:46:04 +02:00
yoff
0cea01c22f
Merge pull request #21926 from github/yoff/python-simplify-decorator-predicates
...
Python: simplify decorator-detection predicates to pure AST match
2026-06-08 22:04:33 +02:00
Tom Hvitved
cc1ea25856
Python: Implement ContentApprox
2026-06-08 08:41:28 +02:00
Owen Mansel-Chan
1f91f915c7
Merge pull request #21888 from owen-mc/py/remove-imprecise-container-steps
...
Python: Remove imprecise container steps #2
2026-06-04 22:16:24 +01:00
Owen Mansel-Chan
da999ee440
Address review comments
2026-06-03 21:24:16 +01:00
Owen Mansel-Chan
6f2cc43f32
Remove imprecise model for tuple()
2026-06-02 21:59:48 +01:00
Owen Mansel-Chan
5042fdee84
Remove imprecise model for list()
2026-06-02 21:59:46 +01:00
Owen Mansel-Chan
04341c47bd
Tweak model for str.join
2026-06-02 21:59:44 +01:00
Owen Mansel-Chan
b27d08ee32
Update edges in expected test output
2026-06-02 18:29:56 +01:00
Owen Mansel-Chan
20ce679d61
Accept changed edges in test output
...
No changes to alerts
2026-06-02 16:15:08 +01:00
Owen Mansel-Chan
f62ebef9e0
Adjust expected test output
2026-06-02 16:15:06 +01:00
Owen Mansel-Chan
c3ef1ddd64
Add MaD models for lxml and xml etree.fromstringlist
2026-06-02 16:15:01 +01:00
Owen Mansel-Chan
dede5bc49b
Track flow through tuple() with list with tainted elements
2026-06-02 16:14:59 +01:00
Owen Mansel-Chan
ad97b6dd64
Use access path for str.join model
2026-06-02 16:14:56 +01:00
yoff
5fb75ac987
Python: simplify decorator-detection predicates to pure AST match
...
The internal predicates that identify `@staticmethod`, `@classmethod` and
`@property` decorators previously required the decorator's `NameNode` to
satisfy `isGlobal()` (i.e. no SSA def reaches the decorator's name use).
That filter was correct but unnecessarily indirect: these three names
are builtins, and even when a class body redefines one, the class body
has not started executing at the decorator position, so Python uses the
builtin.
Match the decorator's AST `Name` directly instead, dropping the CFG/SSA
detour. The slight semantic change — `isGlobal()` would have rejected
module-level shadowing of these builtins — is negligible in practice
and explicitly documented in the change note.
`hasContextmanagerDecorator` and `hasOverloadDecorator` keep the
`NameNode.isGlobal()` check because their target names (`contextmanager`,
`overload`) are imported, not builtin, and local shadowing is a real
concern.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
2026-06-01 14:04:43 +00:00
Owen Mansel-Chan
b38440490a
Address review comment
2026-05-31 21:47:44 +01:00
Henry Mercer
a16f1c555c
Merge pull request #21912 from github/post-release-prep/codeql-cli-2.25.6
...
Post-release preparation for codeql-cli-2.25.6
2026-05-29 14:43:56 +01:00
github-actions[bot]
cfb18c2477
Post-release preparation for codeql-cli-2.25.6
2026-05-29 12:04:35 +00:00
github-actions[bot]
8b6f969cdb
Release preparation for version 2.25.6
2026-05-29 11:27:54 +00:00
Henry Mercer
9bc0c1b1ab
Revert "Release preparation for version 2.25.6"
2026-05-29 12:13:50 +01:00
Owen Mansel-Chan
aee33a0cc9
Add missing code for TAnyTupleOrDictionaryElement
2026-05-29 10:26:24 +01:00
Taus
6165623cbf
Merge pull request #21724 from github/tausbn/python-add-self-validating-cfg-tests
2026-05-28 22:07:55 +02:00
Owen Mansel-Chan
df15a719cb
Add a ContentSet for any tuple or dictionary element
2026-05-28 16:48:23 +01:00
Owen Mansel-Chan
812e8e6b34
Add change note
2026-05-28 11:37:54 +01:00
Owen Mansel-Chan
80c6f082d1
Fix TODO in containerStep
2026-05-28 11:34:02 +01:00
Taus
35faec3db1
Python: Address review comments
...
- Get rid of unnecessary parentheses
- Use call syntax in the relevant test
- Get rid of `dead(2)` annotation
2026-05-27 15:27:19 +00:00
Owen Mansel-Chan
ec13e1bcd3
Add wildcard ContentSets to avoid performance problems
2026-05-27 15:28:07 +01:00
github-actions[bot]
44a914e40f
Release preparation for version 2.25.6
2026-05-25 10:23:26 +00:00
Óscar San José
996e79131e
Merge branch 'main' into post-release-prep/codeql-cli-2.25.5
2026-05-22 16:32:30 +02:00
Owen Mansel-Chan
e8779295ee
Update test results
2026-05-22 11:43:18 +01:00
Rasmus Lerchedahl Petersen
fa758d6bf5
python: fix test
2026-05-21 16:59:19 +01:00
Rasmus Lerchedahl Petersen
fa9426c749
Python: extra tests for comprehension
2026-05-21 16:59:18 +01:00
Rasmus Lerchedahl Petersen
0ecca91dea
Python: typo
2026-05-21 16:59:16 +01:00
Rasmus Lerchedahl Petersen
f669a4f3bf
Python: Make sure all imprecise taint bubbles up
2026-05-21 16:59:14 +01:00
Rasmus Lerchedahl Petersen
3275c814bd
Python: reset test expectations
2026-05-21 16:59:11 +01:00
Rasmus Lerchedahl Petersen
9a180036a5
Python: conversion step for format_map
...
and adjust collection test
2026-05-21 16:59:08 +01:00
Rasmus Lerchedahl Petersen
93e7ab52b7
Python: adjust test expectations
...
We now find an alert on this line as we hope to
It is not an alert for _full_ SSRF, though, since that configuration cannot handle multiple substitutions.
2026-05-21 16:58:51 +01:00
Rasmus Lerchedahl Petersen
facb3b681d
Python: recover taint for % format strings
2026-05-21 16:57:50 +01:00
Rasmus Lerchedahl Petersen
b67694b2ab
Python: Remove imprecise container steps
...
- remove `tupleStoreStep` and `dictStoreStep` from `containerStep`
These are imprecise compared to the content being precise.
- add implicit reads to recover taint at sinks
- add implicit read steps for decoders
to supplement the `AdditionalTaintStep`
that now only covers when the full container is tainted.
2026-05-21 16:57:44 +01:00
Geoffrey White
3aa660663e
Merge pull request #21806 from geoffw0/extsensitive
...
Shared: Improvements to SensitiveDataHeuristics.qll
2026-05-19 16:22:03 +01:00
github-actions[bot]
9f64000962
Post-release preparation for codeql-cli-2.25.5
2026-05-18 15:20:31 +00:00
github-actions[bot]
e38616a2ef
Release preparation for version 2.25.5
2026-05-18 12:05:32 +00:00
Geoffrey White
a4b2c0f6fd
Update change notes (Copilot's suggestions).
2026-05-15 09:24:29 +01:00
Geoffrey White
59dbd68a5e
Add change notes.
2026-05-14 14:46:05 +01:00
Geoffrey White
c8196e439f
Merge branch 'main' into extsensitive
2026-05-13 13:04:48 +01:00
Paolo Tranquilli
ee13ea0f6b
Harden _relative_path for Windows and mixed-form inputs
...
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
2026-05-13 11:35:02 +02:00
Paolo Tranquilli
d28792537b
Python extractor: use relative paths in diagnostic locations
...
Diagnostic `Location.file` fields contained absolute filesystem paths,
causing the GitHub UI to generate broken file links with runner paths
like `/home/runner/work/...`. Now paths are relativized against the
source root (`LGTM_SRC` or cwd), falling back to absolute if the file
is outside the source root.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
2026-05-13 10:32:05 +02:00
Owen Mansel-Chan
0b808e1170
Merge pull request #21807 from owen-mc/java/improve-qhelp-unsafe-deserialization
...
Shared: improve qhelp for unsafe deserialization queries
2026-05-12 22:22:49 +01:00
