hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-06-03 04:40:14 +02:00
Code Issues Packages Projects Releases Wiki Activity
87,727 Commits 1,773 Branches 168 Tags
ac5fa629ef495c8d5d70b270b4d65ad34eb1481c
Commit Graph

87727 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
yoff
ac5fa629ef Python: inline init_module_submodule_defn into ImportResolution 
The new-dataflow ImportResolution module only used
semmle.python.essa.SsaDefinitions for the 5-line helper predicate
SsaSource::init_module_submodule_defn. Inline it locally and drop the
dependency on legacy SsaDefinitions. This is the only remaining direct
import of semmle.python.essa.* in the new dataflow stack, so dropping
it makes the layering cleaner.

Semantic noop on the current SSA: SsaSourceVariable.getName() and
GlobalVariable.getId() both project the same DB column
(variable(_,_,result)), and the old call's 'init.getEntryNode() = f'
join was just constraining init = package via Scope.getEntryNode()'s
functional uniqueness. RA dump of accesses.ql confirms only the
expected predicate-rename shuffle; all 70 dataflow + ApiGraphs library
tests pass.

This factors out commit 8cab5a20f2 from the larger shared-CFG
migration #21925.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-06-02 08:24:17 +00:00
yoff
5fb75ac987 Python: simplify decorator-detection predicates to pure AST match 
The internal predicates that identify `@staticmethod`, `@classmethod` and
`@property` decorators previously required the decorator's `NameNode` to
satisfy `isGlobal()` (i.e. no SSA def reaches the decorator's name use).
That filter was correct but unnecessarily indirect: these three names
are builtins, and even when a class body redefines one, the class body
has not started executing at the decorator position, so Python uses the
builtin.

Match the decorator's AST `Name` directly instead, dropping the CFG/SSA
detour. The slight semantic change — `isGlobal()` would have rejected
module-level shadowing of these builtins — is negligible in practice
and explicitly documented in the change note.

`hasContextmanagerDecorator` and `hasOverloadDecorator` keep the
`NameNode.isGlobal()` check because their target names (`contextmanager`,
`overload`) are imported, not builtin, and local shadowing is a real
concern.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-06-01 14:04:43 +00:00
Jeroen Ketema
ab4a575243 Merge pull request #21899 from MathiasVP/use-new-prototype-extensionals 
C++: Use the new `prototype`-related extensionals in MaD
 2026-06-01 10:24:19 +02:00
Mathias Vorreiter Pedersen
22b08f1ea4 C++: Add a test with a kind of "partial function template" instantiation. 2026-05-31 12:47:31 +02:00
Mathias Vorreiter Pedersen
e18448dd59 C++: Add more tests. 2026-05-29 18:22:13 +02:00
Henry Mercer
a16f1c555c Merge pull request #21912 from github/post-release-prep/codeql-cli-2.25.6 
Post-release preparation for codeql-cli-2.25.6
 2026-05-29 14:43:56 +01:00
Geoffrey White
43c1152634 Merge pull request #21905 from geoffw0/swiftflow2 
Swift: Update the new metatype sinks
 2026-05-29 14:18:45 +01:00
github-actions[bot]
cfb18c2477 Post-release preparation for codeql-cli-2.25.6 2026-05-29 12:04:35 +00:00
Henry Mercer
1a82a682e9 Merge pull request #21911 from github/release-prep/2.25.6 
Release preparation for version 2.25.6
 2026-05-29 12:28:44 +01:00
github-actions[bot]
8b6f969cdb Release preparation for version 2.25.6 2026-05-29 11:27:54 +00:00
Henry Mercer
f4da0df3c7 Merge pull request #21910 from github/revert-21892-release-prep/2.25.6 
Revert "Release preparation for version 2.25.6"
 2026-05-29 12:25:55 +01:00
Henry Mercer
9bc0c1b1ab Revert "Release preparation for version 2.25.6" 2026-05-29 12:13:50 +01:00
Anders Schack-Mulligen
4c31866910 Merge pull request #21867 from aschackmull/ruby/callable-body 
Ruby: Split callable and its body into two AST nodes.
 2026-05-29 10:16:19 +02:00
Taus
6165623cbf Merge pull request #21724 from github/tausbn/python-add-self-validating-cfg-tests 2026-05-28 22:07:55 +02:00
Michael Nebel
2eac8890d3 Merge pull request #21893 from michaelnebel/cshar/updateroslyn 
C#: Update Roslyn and other pinned depenencies.
 2026-05-28 13:49:29 +02:00
Mathias Vorreiter Pedersen
2d581504f7 C++: Fix Copilot comments. 2026-05-28 13:34:18 +02:00
Mathias Vorreiter Pedersen
9f211cebd5 C++: Accept test changes. 2026-05-28 13:34:16 +02:00
Mathias Vorreiter Pedersen
8393b40b59 C++: Use the new extensionals to map template functions and classes to their fully templated versions. 2026-05-28 13:34:12 +02:00
Geoffrey White
f8ab76e1ba Swift: Update the new metatype sinks to not rely on name matching '.Type'. 2026-05-28 12:14:10 +01:00
Geoffrey White
34d4e9a8e2 Merge pull request #21898 from geoffw0/swiftflow 
Swift: Extend swift/weak-sensitive-data-hashing, swift/weak-password-hashing sinks
 2026-05-28 11:52:32 +01:00
Michael Nebel
ed8b9c29cc Merge pull request #21866 from michaelnebel/csharp/refreturnindexerproperty 
C#: Property- and Indexer calls for ref return properties and indexers.
 2026-05-28 12:31:17 +02:00
Asger F
17fe3e4e31 Merge pull request #21901 from asgerf/unified-fix-test 
Unified: fix test output
 2026-05-27 22:19:17 +02:00
Asger F
313500e581 Unified: update test outputs 2026-05-27 21:27:09 +02:00
Asger F
ad56ebd361 Unified: update test output 2026-05-27 21:25:32 +02:00
Asger F
6be9e2315d Merge pull request #21841 from github/tausbn/unified-swift-named-body-fields 
Unified: Get rid of all `$children` fields
 2026-05-27 21:25:11 +02:00
Geoffrey White
5c2488e304 Swift: Fix typo. 2026-05-27 16:29:48 +01:00
Geoffrey White
4fbea4ef95 Swift: Autoformat. 2026-05-27 16:28:21 +01:00
Taus
35faec3db1 Python: Address review comments 
- Get rid of unnecessary parentheses
- Use call syntax in the relevant test
- Get rid of `dead(2)` annotation
 2026-05-27 15:27:19 +00:00
Mathias Vorreiter Pedersen
5f54a8691d C++: Small cleanup. This has no effect on semantics. 2026-05-27 17:16:22 +02:00
Taus
41fd59c1c1 Unified: regenerate Ast.qll and dbscheme 2026-05-27 15:02:28 +00:00
Taus
d6e7e38e1c Unified: merge in main 
Keeps our version of the conflicting files. They will be regenerated in
the next commit.
 2026-05-27 15:01:03 +00:00
Jeroen Ketema
7723324687 Merge pull request #21896 from jketema/jketema/deprecated 
C++: Remove deprecated code
 2026-05-27 14:11:10 +02:00
Michael Nebel
d4c7b5b6fe C#: Update encoding of SBCS to UTF8 with BOM. 2026-05-27 14:01:34 +02:00
Michael Nebel
6b55f865cd C#: Update integration test expected output. 2026-05-27 13:24:45 +02:00
Jeroen Ketema
42c4d8a98b Merge pull request #21897 from jketema/jketema/missing-friend 
C++: Update expected test results after extractor changes
 2026-05-27 12:54:00 +02:00
Geoffrey White
f962eac914 Swift: Fill the simple gaps in modelling. 2026-05-27 11:20:00 +01:00
Geoffrey White
c6c3e1474c Swift: Add a few more test cases for simple missing models. 2026-05-27 11:15:28 +01:00
Geoffrey White
94e6ec6511 Swift: Widen the new sinks to cover more cases the MaD sinks are missing. 2026-05-27 10:34:12 +01:00
Geoffrey White
c902c75651 Swift: Add change note. 2026-05-27 10:33:42 +01:00
Geoffrey White
2b4ea18dfe Swift: Add a similar sink for password hashing as well. 2026-05-27 10:33:41 +01:00
Geoffrey White
98b7659cc1 Swift: Add a special case sink for weak sensitive data hashing sinks that are calls through a metatype. 2026-05-27 10:33:39 +01:00
Geoffrey White
d9c0b9ca31 Swift: Additional test cases for CryptoKit. 2026-05-27 10:33:37 +01:00
Geoffrey White
b44bca9ea7 Swift: Add HashFunction protocol and other realism to the CryptoKit test stubs (this is needed for new cases to work as intended). 2026-05-27 10:33:31 +01:00
Jeroen Ketema
e66b1e4beb Potential fix for pull request finding 
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-05-27 10:58:05 +02:00
Jeroen Ketema
362c48cc6d C++: Add change note 2026-05-27 10:44:44 +02:00
Jeroen Ketema
35364a087a C++: Update expected test results after extractor changes 2026-05-27 10:23:16 +02:00
Anders Schack-Mulligen
780591d42a Ruby: Remove spurious parent-child edges for Ruby::SimpleSymbol. 
These treesitter nodes translate to multiple AstNodes, but we only want
those that are Stmts.
 2026-05-27 10:06:15 +02:00
Anders Schack-Mulligen
3aa69823af Ruby: Skip BodyStmt in ErbDirective.getAChildStmt. 2026-05-27 10:06:14 +02:00
Asger F
f18cdcfec6 Merge pull request #21848 from asgerf/asgerf/swift-yeast 
Unified: Add schema checking and corpus-style tests
 2026-05-26 22:00:21 +02:00
Jeroen Ketema
7862922e5c C++: Remove deprecated code 2026-05-26 17:54:51 +02:00