Commit Graph

88684 Commits

Author SHA1 Message Date
Michael B. Gale
73ccefff88 Go: Reduce package processing log messages to debug level 2026-07-29 17:31:32 +01:00
Paolo Tranquilli
1764c650ce Merge pull request #22247 from github/redsun82-arm64-platform-string
Make CODEQL_PLATFORM architecture-aware for linux-arm64
2026-07-29 17:10:26 +02:00
Jeroen Ketema
46e738df8f Merge pull request #22234 from jketema/jketema/swift-fix
Swift: Recurse clang submodules when computing extension indexes
2026-07-29 16:16:03 +02:00
Paolo Tranquilli
0c20a33bc2 Anchor linux_arm64 select key to the codeql repo
When `codeql_platform_select` builds its `select` from a macro invoked in
another workspace (e.g. semmle-code consuming this repo as `@codeql`), a bare
`//misc/bazel:linux_arm64` string key resolves against the consuming repo and
fails with "no such package 'misc/bazel'". Use `Label(...)`, which resolves
relative to this file's own repo, so the key always binds to
`@codeql//misc/bazel:linux_arm64` regardless of the calling workspace.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c5c5b0bf-4afa-468c-b2dd-197d80932b4b
2026-07-29 16:03:39 +02:00
Paolo Tranquilli
ba3fce17df Add posix convenience to os_select
`posix` sets the shared value for both `linux` and `macos`. It is mutually
exclusive with either of them and fails if supplied together with `linux`
or `macos`.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c5c5b0bf-4afa-468c-b2dd-197d80932b4b
2026-07-29 14:50:21 +02:00
Paolo Tranquilli
b6e7464da2 Address review: linux-arm64 docs + None-vs-falsey fallback
- codeql_pack docstring: include `linux-arm64` in the exhaustive list of
  values the `{CODEQL_PLATFORM}` placeholder expands to (both mentions).
- codeql_platform_select: only fall back to `otherwise` on `None`, not on
  any falsey value, via a small `_or_otherwise` helper, matching the
  documented `None` defaults.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c5c5b0bf-4afa-468c-b2dd-197d80932b4b
2026-07-29 14:25:13 +02:00
Paolo Tranquilli
d0b6e96e5b Make CODEQL_PLATFORM architecture-aware for linux-arm64
CODEQL_PLATFORM is OS-only today (linux->linux64, macos->osx64,
windows->win64). ELF has no fat-binary equivalent, so Linux arm64 needs
its own string. Add `linux-arm64` for os:linux AND cpu:arm64 while
keeping every existing string byte-identical.

- Add a public `//misc/bazel:linux_arm64` config_setting (os:linux +
  cpu:arm64).
- Turn `os_select` into `codeql_platform_select`, a full selector over
  the four CodeQL platforms (`linux64`, `linux_arm64`, `osx64`, `win64`,
  plus `otherwise`), working in both macro (select) and rule
  (target_platform_has_constraint) contexts. There is deliberately no
  fallback between the two Linux slots.
- Re-express `os_select` as a thin OS-only wrapper around it (Linux maps
  to both `linux64` and `linux_arm64`), so its existing swift/xcode
  callers keep working unchanged.
- Add an `_arm64_constraint` entry to OS_DETECTION_ATTRS.
- Drive the platform string from `codeql_platform_select` in pkg.bzl's
  `_detect_platform` and defs.bzl's `codeql_platform`.

macOS keeps osx64 for both arch slices (universal binary): the
linux_arm64 key requires both constraints, so the OS discriminator
dominates. The new branch is dormant on existing CI (no job builds
linux-on-arm64), so all current configs produce byte-identical outputs.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c5c5b0bf-4afa-468c-b2dd-197d80932b4b
2026-07-29 14:17:27 +02:00
Mathias Vorreiter Pedersen
478878cfb7 Merge pull request #22242 from MathiasVP/add-reg-flow-sources
C++: Add flow sources for `winreg.h`
2026-07-28 18:45:19 +01:00
Jeroen Ketema
9d1a8a7298 Merge pull request #22129 from jketema/jketema/subst-fix
Introduce canonicalization library for Windows `subst` drives
2026-07-28 16:21:44 +02:00
Taus
3a4897298d Merge pull request #22233 from github/tausbn/swift-syntax-rs-sequenced
unified: Switch over to using `swift-syntax` for parsing
2026-07-28 16:06:15 +02:00
yoff
4d885a891f Merge pull request #21921 from github/yoff/python-add-new-cfg-library
Python: add new shared-CFG-backed control flow graph (additive)
2026-07-28 15:12:31 +02:00
yoff
3ad48615a7 Python: fix replace of upper-case characters 2026-07-28 14:54:09 +02:00
Mathias Vorreiter Pedersen
034a90bf2a C++: Accept test changes. 2026-07-28 13:53:06 +01:00
Mathias Vorreiter Pedersen
daefacfcc9 C++: Add models for 'RegGetValue' and friends. 2026-07-28 13:52:09 +01:00
Mathias Vorreiter Pedersen
b0f345a1ad C++: Add a test for 'RegGetValueA'. 2026-07-28 13:50:12 +01:00
yoff
c516d1f0b9 python: forward rather implement subtle predicates 2026-07-28 14:49:18 +02:00
yoff
c11b4914e9 Update python/ql/lib/semmle/python/controlflow/internal/AstNodeImpl.qll
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
2026-07-28 14:42:04 +02:00
Taus
ceffe40a54 unified: Remove references to Swift input schema generation 2026-07-28 11:55:11 +00:00
Taus
a2ff35a72d unified: Fix Bazel formatting errors 2026-07-28 11:45:53 +00:00
Taus
a3d9492e8c Merge branch 'main' into tausbn/swift-syntax-rs-sequenced 2026-07-28 13:39:46 +02:00
Mathias Vorreiter Pedersen
7bd322a3c7 C++: Add change note. 2026-07-28 12:26:18 +01:00
Mathias Vorreiter Pedersen
154b3b1f6c C++: Accept test changes. 2026-07-28 12:20:34 +01:00
Mathias Vorreiter Pedersen
16ad0a3c31 C++: Add flow sources for 'winreg.h'. 2026-07-28 12:20:14 +01:00
Mathias Vorreiter Pedersen
b5cb703f2e C++: Add tests with missing flow sources. 2026-07-28 12:19:15 +01:00
Michael B. Gale
07514086a1 Merge pull request #22204 from github/dependabot/bazel/rules_nodejs-6.7.5
build(deps): bump rules_nodejs from 6.7.3 to 6.7.5
2026-07-27 16:55:19 +01:00
yoff
9b4de2bfb6 Python: add tests for short-circuiting comparisons
- Both the old and new CFG model this incorrectly right now.
- Added ConsecutivePredecessorTimestamps.ql for the old CFG for symmetry.
2026-07-27 17:52:24 +02:00
Taus
ba26e1d029 unified: Add corpus tests for nested types
Adds a few tests that validate that higher-order functions are parsed
correctly into the commonAST representation.

Also removes a redundant assignment to `ctx.in_function_type` that
happend after all translations had taken place (and so nothing would
actually read this field).
2026-07-27 15:48:06 +00:00
yoff
3206ab0be1 Python: address CodeQL alerts 2026-07-27 17:37:36 +02:00
yoff
665e046ae6 Python: add overlay annotations to inlined predicates 2026-07-27 17:00:35 +02:00
yoff
fa94dc9a32 Python: remove reference to line numbers 2026-07-27 16:31:41 +02:00
yoff
05aa8debc4 python: make LoopStmt final 2026-07-27 16:25:07 +02:00
yoff
aa305c20b1 Python: mark definition of type ascription as SPURIOUS 2026-07-27 16:25:06 +02:00
yoff
2c0ed98cb2 python: remove uninformative headers 2026-07-27 16:25:06 +02:00
yoff
1068add0ed Split tests with disjoint concerns 2026-07-27 16:25:05 +02:00
yoff
90c1ddfd49 Update python/ql/lib/ide-contextual-queries/printCfg.ql
Co-authored-by: Tom Hvitved <hvitved@github.com>
2026-07-27 16:24:46 +02:00
Jeroen Ketema
726705b731 Address review comments 2026-07-27 14:00:40 +02:00
Jeroen Ketema
9976a7a3ac Address review comments 2026-07-27 14:00:38 +02:00
Jeroen Ketema
c95a8ab9d2 Go: Update expected test results 2026-07-27 14:00:36 +02:00
Jeroen Ketema
e06ce00d60 Go: Resolve substed drives on Windows 2026-07-27 14:00:34 +02:00
Jeroen Ketema
009ed608e0 Java: Update expected test results 2026-07-27 14:00:33 +02:00
Jeroen Ketema
75ee4afec9 Kotlin: Resolve substed drives on Windows 2026-07-27 14:00:31 +02:00
Jeroen Ketema
4f30042b10 Update expected test results after CLI/extractor changes 2026-07-27 14:00:29 +02:00
Asger F
9c5cd36ab7 Merge pull request #22222 from cysp/fastify-scoped-rate-limit
JS: Recognize @fastify/rate-limit as a rate limiter
2026-07-27 13:02:25 +02:00
Jeroen Ketema
2b871e92bb Swift: Recurse calng submodules when computing extension indexes
Fixes: https://github.com/github/codeql/issues/22224
2026-07-27 12:55:04 +02:00
Taus
e3a0822248 unified: Package the swift-syntax parser in the extractor pack
The extractor shells out to a separate `swift-syntax-parse` binary, but
nothing placed it in the extractor pack, so a shipped Swift extraction
failed at the first spawn. Package it next to the extractor, the same
way `//swift/extractor` ships its Swift-linked binary: a small wrapper
points the dynamic loader at its own directory and execs the real
binary, whose Swift runtime libraries travel alongside it.

- `swift-syntax-parse.sh`: wrapper that sets `LD_LIBRARY_PATH` /
  `DYLD_LIBRARY_PATH` to its directory and execs
  `swift-syntax-parse.real`
  (mirrors `swift/extractor/extractor.sh`).
- `runtime.bzl`: a `swift_runtime_libs` rule that selects just the Linux
  Swift runtime shared objects (`usr/lib/swift/linux/*.so`) out of the
  full toolchain, so only they — not the whole toolchain — travel with
  the binary.
- `swift-syntax-rs/BUILD.bazel`: the `rust_binary` becomes
  `swift-syntax-parse.real`
  and carries the runtime libraries as runfiles on Linux; a `sh_binary`
  (`swift-syntax-parse`) is the wrapper; `codeql_pkg_runfiles` flattens
  the three (wrapper, real binary, runtime) into one directory.
- `BUILD.bazel`: ship that group under `tools/{CODEQL_PLATFORM}` next to
  the extractor, on the platforms where swift-syntax builds
  (Linux/macOS).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-24 16:10:12 +00:00
Taus
7721ce2eba unified: Add swift_node_types.yml to the extractor's compile_data
`languages::swift::adapter` embeds the swift-syntax node-types schema
with `include_str!("../../../swift_node_types.yml")`, but the file was
never listed in the extractor's Bazel `compile_data`. The `cargo` build
finds it on disk, so this went unnoticed, but the sandboxed Bazel build
cannot see it and fails to compile the extractor. List it alongside
`ast_types.yml`.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-24 16:08:16 +00:00
Taus
17cbb4eb6b unified: Harden the external Swift parser integration
Two fixes prompted by review of the swift-syntax switch-over.

Parser resolution (`parse.rs`): `parse_bin` now resolves the
`swift-syntax-parse` executable in priority order — the
`CODEQL_EXTRACTOR_UNIFIED_SWIFT_SYNTAX_PARSE` override, then a copy next
to the extractor executable (as a shipped extractor pack lays it out:
`tools/<platform>/{extractor,swift-syntax-parse}`), then a
bare `PATH` lookup. This lets a packaged extractor find its parser with
no environment setup. (Bundling the binary into the pack, together with
its Swift runtime, is a separate follow-up.)

Corpus test guard (`corpus_tests.rs`): `parser_available` previously
treated *any* parser error as "unavailable" and skipped the entire
corpus suite, so a parser that was present but crashed or emitted
invalid JSON would silently skip the exact regressions the suite exists
to catch. It now uses the new `binary_available`, which reports whether
the *executable* can be launched (false only when it cannot be found,
e.g. no Swift toolchain); a launchable-but-failing parser makes the
suite run and fail.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-24 16:08:16 +00:00
Taus
c50bcbacc0 swift-syntax-rs: Degrade gracefully without a Swift toolchain
`swift-syntax-rs` is a workspace member, so its build script runs on a
plain `cargo check`/`fmt`/`clippy` at the repo root. Previously it
panicked when `swift build` could not be run, breaking those Swift-free
workflows for anyone without a Swift toolchain.

Instead, when `swift build` cannot be spawned, emit a `cargo:warning`
and skip the link directives rather than panicking. `cargo
check`/`fmt`/`clippy` don't link, so they keep working; only `cargo
build`/`cargo test` then fail, at link time — which is fair, since those
genuinely need Swift (and CI builds go through Bazel). A Swift toolchain
that is present but whose build fails is still surfaced as a hard error.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-24 16:08:16 +00:00
Taus
046c88a329 unified: Regenerate the enhanced getter/setter property corpus case
Regenerate `types/property-with-getter-and-setter`, whose mapped AST now
differs from the tree-sitter output: the backing `private var _v`
retains its `private` modifier (`modifier "var"` + `modifier
"private"`), whereas the tree-sitter path dropped it (its
`visibility_modifier` node carried no text). The swift-syntax
front-end preserves the modifier, so the mapped AST is strictly richer
here.

The raw (second) section is regenerated to the swift-syntax AST like the
other cases; the mapped (third) section gains the retained `private`
modifier.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-24 16:08:15 +00:00
Taus
20a2537299 unified: Regenerate the raw-AST corpus section for swift-syntax
Now that the Swift front-end is swift-syntax, regenerate the second (raw
parse tree) section of the corpus `.output` files to hold the
swift-syntax AST the adapter builds, instead of the old tree-sitter
parse tree.

These 98 cases map to a byte-for-byte identical mapped AST (the third
section), so only their raw section changes — the mapping rules were
ported to produce the same output. The one case whose mapped AST differs
(`types/property-with-getter-and-setter`) is handled separately.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-24 16:08:15 +00:00