hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-03-30 20:28:15 +02:00
Code Issues Packages Projects Releases Wiki Activity
85,745 Commits 1,724 Branches 164 Tags
96a06bed8d96c86836dee2f740117c693e9ff3f5
Commit Graph

85745 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Geoffrey White
96a06bed8d Rust: Accept consistency check changes. 2026-02-26 12:41:17 +00:00
Geoffrey White
78f855d7e3 Rust: Make the manual model for Option::map more accurate. 2026-02-26 11:34:30 +00:00
Geoffrey White
75ffb5fc4c Rust: Change note. 2026-02-26 10:59:48 +00:00
Geoffrey White
75fea4245a Rust: Add neutral models of From::from (corresponding with existing generated sink models). 2026-02-26 10:00:30 +00:00
Geoffrey White
5c108e5c12 Rust: Add a manual model for flow through Option::map. 2026-02-26 09:12:33 +00:00
Geoffrey White
53e886380c Rust: Add a neutral model of Option::map (so that we don't use the generated models). 2026-02-26 08:36:28 +00:00
Geoffrey White
97f7a26e11 Rust: Add test cases for log injection + uncontrolled allocation size with from. 2026-02-25 19:12:06 +00:00
Geoffrey White
1213369d75 Rust: Add test cases for log injection with map. 2026-02-25 14:30:01 +00:00
Geoffrey White
ccc318106e Rust: Add an empty.model.yml similar to the one in CPP, to avoid errors about missing extensionals. 2026-02-25 14:25:12 +00:00
Geoffrey White
8769059ce5 Rust: Remove another call to neutralModel we don't need to make explicitly. 2026-02-24 15:01:45 +00:00
Geoffrey White
e9511560b7 Rust: Autoformat. 2026-02-23 19:51:22 +00:00
Geoffrey White
6b7f339287 Rust: Define neutralElement in the shared data flow input. 2026-02-23 19:38:13 +00:00
Geoffrey White
a5aeadd31d Rust: Fix for neutral summaries. 2026-02-06 18:15:13 +00:00
Geoffrey White
08174d7ec9 Rust: Add test cases for summaries as well. 2026-02-06 18:05:54 +00:00
Geoffrey White
05a487ec3b Rust: Repair following merge. 2026-02-05 15:56:58 +00:00
Geoffrey White
c0a5c63e8e Merge branch 'main' into neutralmodels 2026-02-05 15:53:28 +00:00
Taus
5adc9f8ff0 Merge pull request #21274 from github/tausbn/python-fix-parsing-of-format-specifiers 
Python: Fix syntax error when `=` is used as a format fill character
 2026-02-05 16:37:42 +01:00
Taus
8c27437628 Python: Bump extractor version and add change note 2026-02-05 13:50:54 +00:00
Taus
12ee93042b Python: Add tests 2026-02-05 13:47:24 +00:00
Taus
bac356c9a1 Python: Regenerate parser files 2026-02-05 13:46:59 +00:00
Taus
68c1a3d389 Python: Fix syntax error when = is used as a format fill character 
An example (provided by @redsun82) is the string `f"{x:=^20}"`. Parsing
this (with unnamed nodes shown) illustrates the problem:

```
module [0, 0] - [2, 0]
  expression_statement [0, 0] - [0, 11]
    string [0, 0] - [0, 11]
      string_start [0, 0] - [0, 2]
      interpolation [0, 2] - [0, 10]
        "{" [0, 2] - [0, 3]
        expression: named_expression [0, 3] - [0, 9]
          name: identifier [0, 3] - [0, 4]
          ":=" [0, 4] - [0, 6]
          ERROR [0, 6] - [0, 7]
            "^" [0, 6] - [0, 7]
          value: integer [0, 7] - [0, 9]
        "}" [0, 9] - [0, 10]
      string_end [0, 10] - [0, 11]
```
Observe that we've managed to combine the format specifier token `:` and
the fill character `=` in a single token (which doesn't match the `:` we
expect in the grammar rule), and hence we get a syntax error.

If we change the `=` to some other character (e.g. a `-`), we instead
get

```
module [0, 0] - [2, 0]
  expression_statement [0, 0] - [0, 11]
    string [0, 0] - [0, 11]
      string_start [0, 0] - [0, 2]
      interpolation [0, 2] - [0, 10]
        "{" [0, 2] - [0, 3]
        expression: identifier [0, 3] - [0, 4]
        format_specifier: format_specifier [0, 4] - [0, 9]
          ":" [0, 4] - [0, 5]
        "}" [0, 9] - [0, 10]
      string_end [0, 10] - [0, 11]
```
and in particular no syntax error.

To fix this, we want to ensure that the `:` is lexed on its own, and the
`token(prec(1, ...))` construction can be used to do exactly this.

Finally, you may wonder why `=` is special here. I think what's going on
is that the lexer knows that `:=` is a token on its own (because it's
used in the walrus operator), and so it greedily consumes the following
`=` with this in mind.
 2026-02-05 13:45:54 +00:00
Paolo Tranquilli
05bef12ddd Merge pull request #21265 from github/redsun82/csharp-csrf-inheritance 
C#: Fix CSRF query to check antiforgery attributes on base classes
 2026-02-05 14:20:30 +01:00
Idriss Riouak
1df3adf021 Merge pull request #21244 from github/idrissrio/cpp/overlay/changes-json 
C/C++ overlay: use files table instead of `overlayChangedFiles` for overlay discard
 2026-02-05 13:15:07 +01:00
idrissrio
e26c199426 C/C++ overlay: use files table instead of overlayChangedFiles for overlay discard 2026-02-05 12:43:01 +01:00
Tom Hvitved
1203da1b66 Merge pull request #21253 from paldepind/rust/as-path-trait 
Rust: Resolve `as` paths to trait
 2026-02-05 12:38:16 +01:00
Paolo Tranquilli
f79bd3f4cf C#: accept location changes in test 2026-02-05 12:14:59 +01:00
Mathias Vorreiter Pedersen
476df7de73 Merge pull request #21260 from MathiasVP/add-windows-remote-flow-sources 
C++: Add more Win32 and Azure SDK remote flow sources
 2026-02-05 10:47:03 +00:00
Anders Schack-Mulligen
29e01748b7 Merge pull request #21267 from aschackmull/java/rename-misc 
Java: Rename several AST predicates.
 2026-02-05 11:15:29 +01:00
Anders Schack-Mulligen
11003e685d Java: Fix qldoc 2026-02-05 10:37:19 +01:00
Geoffrey White
9de5f5c72b Rust: Clean up and change note. 2026-02-05 08:58:08 +00:00
Anders Schack-Mulligen
e4daeec2ca Merge pull request #21268 from aschackmull/java/view-cfg 
Java: Add support for "View CFG" in VSCode.
 2026-02-05 09:48:14 +01:00
Anders Schack-Mulligen
81977f11a1 Cfg: qldoc + overlay fixups. 2026-02-05 08:59:28 +01:00
Anders Schack-Mulligen
32fe12a6dd Java: Delay deprecation a bit. 2026-02-05 08:51:27 +01:00
Geoffrey White
d40071321a Rust: Implement neutral models for Rust. 2026-02-04 18:58:09 +00:00
Geoffrey White
97f7dcb04a Rust: Add dataflow test cases for neutral models. 2026-02-04 17:43:05 +00:00
Anders Schack-Mulligen
83adf793e4 Cfg: Fix compilation. 2026-02-04 15:28:37 +01:00
Simon Friis Vindum
52dc58172d Merge branch 'main' into rust/as-path-trait 2026-02-04 14:47:57 +01:00
Owen Mansel-Chan
544931f73f Merge pull request #21266 from owen-mc/python/pretty-print-models-in-test 
Python: Pretty print models in test
 2026-02-04 13:46:51 +00:00
Anders Schack-Mulligen
2d02908e7f Java: Add change note. 2026-02-04 14:43:32 +01:00
Anders Schack-Mulligen
4fcf3fbff8 Java: Make loop classes extend LoopStmt and use getBody instead of getStmt. 2026-02-04 14:43:31 +01:00
Anders Schack-Mulligen
6f40ac15b4 Java: Rename ReturnStmt.getResult to getExpr. 2026-02-04 14:43:31 +01:00
Simon Friis Vindum
55ea55a44f Merge pull request #21247 from paldepind/rust/self-types 
Rust: Resolve `Self` paths in type definitions
 2026-02-04 13:41:53 +01:00
Anders Schack-Mulligen
36fa0a22f9 Java: Rename getTrueExpr/getFalseExpr on ConditionalExpr to getThen/getElse. 2026-02-04 13:38:11 +01:00
Owen Mansel-Chan
3f08ff88a4 Pretty print models in test 
Otherwise the tests breaks when unrelated changes are made because the
model numbers change
 2026-02-04 10:52:44 +00:00
Anders Schack-Mulligen
5e6e64b2b7 Java: Rename UnaryExpr.getExpr to getOperand. 2026-02-04 10:50:49 +01:00
Paolo Tranquilli
4973523404 C#: Fix CSRF query to check antiforgery attributes on base classes 
Fixes https://github.com/github/codeql/discussions/21255
 2026-02-04 09:42:20 +01:00
Anders Schack-Mulligen
2d61fc5309 Java: Add support for "View CFG". 2026-02-03 15:49:27 +01:00
Michael B. Gale
8e39ed079e Merge pull request #21252 from github/mbg/go/private-registry-diagnostic 
Go: Add diagnostic for private registry usage
 2026-02-03 14:36:19 +00:00
Anders Schack-Mulligen
389cd5d648 Cfg: Extract CFG pretty-printing code. 2026-02-03 15:33:55 +01:00
Mathias Vorreiter Pedersen
092d25451f C++: Fix Copilot comments. 2026-02-03 11:45:30 +00:00