Commit Graph

88515 Commits

Author SHA1 Message Date
Anders Fugmann
b8a16923ba kotlin-extractor: converge local variable entity locations across language versions
The local variable declaration expression (extractVariableExpr) computed its
location via getPsiBasedLocation(v as IrElement). The `as IrElement` cast forced
overload resolution to the generic getPsiBasedLocation(IrElement), which resolves
the PSI element straight from the IR element's raw source offsets via
PsiSourceManager.findPsiElement. Those offsets differ between the two frontend
language versions:

  fun f(param: Int) {
      val local1 = 2 + 3   // line 6: `        val local1 = 2 + 3`
  }

- With -language-version 1.9 the IrVariable offsets cover only the name, so
  findPsiElement returns the name leaf and the variable is located at 6:13:6:18.
- With -language-version 2.0 the IrVariable offsets cover the whole declaration,
  so it is located at 6:9:6:26 (the `val` keyword through the initialiser).

The IrVariable-specific overload getPsiBasedLocation(IrVariable) is frontend
stable: it finds the leaf at the variable's start offset, walks up to the
enclosing KtVariableDeclaration and returns the span from the `val`/`var` keyword
to the end of the declaration. Using it for the entity location makes both
language versions emit the full declaration span 6:9:6:26.

This is the same helper already used for the enclosing localvariabledeclstmt
location; this change applies it to the variable entity (localvars / the
localvariabledeclexpr) as well, so the two are consistent.

Effect: 12 test-kotlin1 expected files move toward the test-kotlin2 output (all
strictly reduce the tk1-vs-tk2 difference; e.g. variables 16->4, reflection
111->67, exprs 1759->1363 diff lines). test-kotlin2 output is unchanged (the
overload produces the same span there as the generic one did). Both suites pass
all 3333 tests with --check-databases.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Also update the enhanced-nullability Kotlin integration test expected: its
local variable declaration expression now spans the val/var keyword to the
initialiser (user.kt:2:7:2:7 -> user.kt:2:3:2:16), consistent with the
library-test convergence.
2026-07-10 22:35:20 +02:00
Anders Fugmann
7eb71807cd fix property and accessor locations using PSI
K1 IrProperty.startOffset includes leading modifiers (private, abstract,
lateinit, annotations) in the span start; K2 already starts at val/var.
Walk the PSI tree from p.startOffset to the enclosing KtProperty, then use
valOrVarKeyword.startOffset as the declaration start, giving a consistent
start in both K1 and K2.

Two related but distinct locations are derived from the KtProperty:

- The property itself spans val/var through the end of the full
  declaration (KtProperty.endOffset), including an explicit getter/setter
  body on a following line. This is getPsiBasedLocation(IrProperty).
- Synthesised accessors (DEFAULT_PROPERTY_ACCESSOR origin) span val/var
  through the end of the property name (KtProperty.nameIdentifier.endOffset)
  via getPsiBasedAccessorLocation, applied through accessorOverride().
  Explicit getter/setter bodies keep their own independently computed
  location.

This makes K1 accessor locations match K2 and gives each synthesised
accessor a precise span, rather than the property's full declaration span.

Example (properties.kt line 3, "var modifiableInt = 1"):
  property  modifiableInt     -> 3:5:3:25   (val/var .. end of "= 1")
  accessor  getModifiableInt  -> 3:5:3:21   (val/var .. end of name)
  accessor  setModifiableInt  -> 3:5:3:21

Because accessor locations appear wherever accessors are reported, this
refinement updates many expected files (property listings, modifiers,
methods, reflection, control-flow and expression dumps). Every change is a
location-coordinate change only: no result tuple is added or removed.

The PSI-based location is restricted to unspecialised extractions
(classTypeArgsIncludingOuterClasses.isNullOrEmpty()). Specialised generic
instances (e.g. C<String>.prop) continue to use the binary whole-file
location returned by getLocation(p, typeArgs), preserving the existing
behaviour that keeps them absent from fromSource() queries.

The visibility merge in extractFunction is extended to accept an
overriddenAttributes parameter from the caller; the internal fake-override
visibility adjustment (DescriptorVisibilities.PUBLIC for Java binary Object
methods) is merged with any caller-supplied attributes so that neither
overrides the other silently.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-10 19:59:14 +02:00
Anders Fugmann
19092fbed7 kotlin-extractor: fix K1 local variable locations to span from val/var to initializer
In K1 mode, IrVariable.startOffset points to the name identifier and
IrVariable.endOffset is also at the name end, giving a location that
covers only the variable name (e.g. "local1") rather than the full
declaration ("val local1 = 2 + 3").

In K2 mode the IR offsets already point from the val/var keyword to the
end of the initializer, matching the intuitive source span.

Fix this for K1 by adding an IrVariable-specific overload of
getPsiBasedLocation that:
1. finds the leaf PSI element at v.startOffset (the name identifier)
2. walks up to the enclosing KtVariableDeclaration (KtProperty)
3. uses the val/var keyword position as the start offset to exclude
   any leading annotations from the span

This matches the K2 IR behavior and gives a more complete location for
variable declarations when used in CodeQL queries.

The fix applies to both K1 and K2 since the overload is unconditional;
for K2 the walk-up gives the same result as before.

Expected updates in test-kotlin1:
- variables: local variable locations now span from val/var to initializer
- exprs, stmts, methods, modifiers, reflection: same local variable span
- controlflow/basic: CFG node references updated for new variable spans
  (the "var ...;" node now starts at the val/var keyword)

Class member and top-level properties (IrProperty, not IrVariable) are
not affected by this change and retain their existing location behaviour.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-10 19:59:13 +02:00
Anders Fugmann
1e24a5fb97 kotlin-extractor: fix NotNullExpr start offset to span from operand
In K1 mode, the IrCall node for the !! operator stores startOffset at
the '!' character rather than at the start of the operand. This means
that x!! was previously reported as spanning from '!' to the end of the
expression, omitting the operand from the location.

Fix this by computing the NotNullExpr location from the value argument's
startOffset (the operand) to c.endOffset. This matches the K2 behaviour
where the IrCall.startOffset already points at the operand.

The fix guards against invalid (< 0) offsets on either side and falls
back to the default IrCall location in those cases.

Updated expected files in test-kotlin1:
- exprs/unaryOp.expected: !! locations now start at operand column
- exprs/exprs.expected: same (NotNullExpr entries corrected)
- exprs/binop.expected: !! child locations now correct (parent binop
  location for s!!.plus(5) still differs due to a separate K1 IR
  limitation where the enclosing call inherits the wrong receiver offset)
- controlflow/basic/bbStmts.expected: CFG references to !! now use the
  improved location
- controlflow/basic/getASuccessor.expected: same

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-10 19:58:42 +02:00
Anders Fugmann
bb17e31801 kotlin-extractor: PSI-backed source locations for expression-level nodes
K1 and K2 IR backends compute source locations differently. K1 uses the IR
node's synthetic startOffset/endOffset, while K2 reconstructs source positions
from PSI. For expression-level nodes this causes location differences across
the two language modes.

Introduce PSI-backed location lookup as the preferred source for spans wherever
PSI is available:

  getPsiBasedLocation(element) ?: tw.getLocation(element)

getPsiBasedLocation() resolves the PSI element for the IR node via
psi2Ir.findPsiElement() and builds a location from its startOffset..endOffset.
currentIrFile is tracked in extractFileContents so the PSI lookup has the
file context it needs.

Applied to expression-level nodes (both K1 and K2 modes):
- local variable declarations (extractVariable, extractVariableExpr)
- IrLocalDelegatedProperty blocks
- IrWhen expressions and when-branches
- IrGetValue (varaccess) expressions
- IrFunctionExpression (lambda) nodes
- Block statements (extractBlock)
- this/super access expressions (extractThisAccess)
- String literals

Declaration-level nodes (class, function, property) are guarded with
if (usesK2) to avoid a regression in K1 mode where the PSI lookup causes
parameterised type instantiations to appear as fromSource(), inflating
generic-type query results. The K1 IR frontend does not map all declaration
nodes cleanly to source PSI elements; for these nodes we keep the original
IR-based location in K1 mode.

Expected output changes (both suites):
- controlflow/basic/bbStmts, bbStrictDominance, bbSuccessor, getASuccessor,
  strictDominance: when-branch and varaccess location improvements
- java-kotlin-collection-type-generic-methods/test: new stdlib entries from
  JDK update (AbstractCollection<Runnable> methods)
- annotation_classes/PrintAst: variable access location improvement in K1
- classes/genericExprTypes: location improvement in K1
- compilation-units/cus: removed two internal JDK inner-class entries (stdlib
  version change)
- reflection/reflection: removed a few external-class entries (stdlib version)

Verified: all 285 tests pass for both test-kotlin1 (kotlinc 2.3.20 / K1) and
test-kotlin2 (kotlinc 2.4.0 / K2).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-10 19:58:41 +02:00
Anders Fugmann
1778b15936 kotlin tests: sync dataflow/foreach test inputs and K2 expected output
Copy K1's richer C2.kt (which includes test2, test3 and l.get(0) in test)
into test-kotlin2. K2 in -language 2.0 mode already tracks dataflow through
array.set() and indirect wrapper calls, so the additional tests produce results
identical to K1.

The expected files for test-kotlin1 and test-kotlin2 are now byte-identical for
this test.

Verified:
- test-kotlin1 (kotlinc 2.3.20 / -language 1.9): all tests pass
- test-kotlin2 (kotlinc 2.4.0 / -language 2.0): all tests pass

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-10 19:58:27 +02:00
Anders Fugmann
bf8b4ab8b7 kotlin tests: sync generated-throws.kt source between test-kotlin1 and test-kotlin2
Remove the K1-only comment '// This doesn't generate a throw statement in
Kotlin 1 mode' from test-kotlin1/library-tests/generated-throws/generated-throws.kt
so the source files are byte-identical between the two suites.

The expected outputs still legitimately differ: in K2 mode the compiler generates
an implicit throw NoWhenBranchMatchedException for the exhaustive sealed-class when
expression, but the K1 frontend does not emit this node. This is a mode-specific
behaviour difference that cannot be bridged by an extractor change.

Both tests continue to pass:
- test-kotlin1 (kotlinc 2.3.20 / -language 1.9): 0 throw results (unchanged)
- test-kotlin2 (kotlinc 2.4.0 / -language 2.0): 1 throw result (unchanged)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-10 19:58:27 +02:00
Anders Fugmann
da28c40a5d kotlin extractor: fold unaryMinus(IrConst) into a signed literal in K2
In K2 mode the frontend emits `-123L` as IrCall(unaryMinus, IrConst(123L))
rather than IrConst(-123L) as in K1. Queries that search for negative numeric
literals therefore need to match both a UnaryMinusExpr wrapping a literal and a
plain literal, depending on language mode.

Fix: when extractCallExpression encounters an isNumericFunction(unaryMinus) call
whose dispatchReceiver is already an IrConst, fold the negation into the constant
before extracting. The resulting literal node is identical to what K1 emits.

Location: extend the span one character to the left to cover the `-` sign.
In K2 the IrCall's startOffset equals the receiver's startOffset, so we recover
the minus by subtracting one from the receiver offset.

K1 is unaffected: the K1 frontend folds the sign into the constant before IR
generation, so this new branch never triggers when compiling with -language 1.9.

Expected output changes:
- test-kotlin2/library-tests/literals/literals.expected: negative long, float and
  double literals now appear as plain typed literals instead of as UnaryMinus nodes.
  The file is now byte-identical to test-kotlin1/library-tests/literals/literals.expected.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-10 19:58:26 +02:00
Anders Fugmann
6465078bfe kotlin tests: synchronise test inputs between test-kotlin1 and test-kotlin2
- Port ministdlib from test-kotlin1 to test-kotlin2. The ministdlib test
  exercises a minimal Kotlin standard library written from scratch. Its
  options file is updated to include -language-version 2.0 so the test
  runs in K2 mode when the K2 compiler is active.

- Port nested_types from test-kotlin2 to test-kotlin1. The nested_types
  test exercises type-alias and inner-type queries. Expected output is
  identical in K1 and K2 modes so no expected-file changes are needed.

- Add test-kotlin2/options with codeql-extractor-kotlin-options:
  -language-version 2.0. The CodeQL CLI adds -language-version 1.9 by
  default in legacy test extraction mode. Without this override the K2
  test suite would run in K1 mode, defeating the purpose of the split.

Both ministdlib and nested_types produce byte-identical expected output
across K1 (2.3.20, -language-version 1.9) and K2 (2.4.0, default K2).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-09 15:59:06 +02:00
Jack Nørskov Jørgensen
d5712ef19a Merge pull request #22130 from github/jacknojo/apache_poi_mads
Add MaDs for Apache POI @ bd97feb849ab86670fe5b5513d4066c46b599797
2026-07-09 08:56:54 +02:00
Owen Mansel-Chan
a238aeeb59 Merge pull request #22141 from github/dependabot/go_modules/go/extractor/extractor-dependencies-017d72eac4
Bump golang.org/x/mod from 0.37.0 to 0.38.0 in /go/extractor in the extractor-dependencies group
2026-07-09 07:16:05 +01:00
dependabot[bot]
6da42a2456 Bump golang.org/x/mod
Bumps the extractor-dependencies group in /go/extractor with 1 update: [golang.org/x/mod](https://github.com/golang/mod).


Updates `golang.org/x/mod` from 0.37.0 to 0.38.0
- [Commits](https://github.com/golang/mod/compare/v0.37.0...v0.38.0)

---
updated-dependencies:
- dependency-name: golang.org/x/mod
  dependency-version: 0.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: extractor-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-07-09 03:03:43 +00:00
Tom Hvitved
f4773e9dc2 Merge pull request #22114 from hvitved/type-inference-join
Type inference: Small join-order tweak
2026-07-08 20:19:48 +02:00
Florin Coada
11be07952e Merge pull request #22139 from github/codeql-spark-run-28955698948
Update changelog documentation site for codeql-cli-2.26.0
2026-07-08 17:00:03 +01:00
github-actions[bot]
47ea9b49cc update codeql documentation 2026-07-08 15:46:33 +00:00
Owen Mansel-Chan
25cd352de7 Merge pull request #22123 from owen-mc/csharp/convert-qlref-tests-to-inline-expectations
C#: Convert qlref tests to inline expectations
2026-07-08 14:47:04 +01:00
Geoffrey White
8bb12d1507 Merge pull request #22005 from github/dependabot/pip/misc/codegen/pip-02f7ad5a4b
Bump the pip group across 2 directories with 2 updates
2026-07-08 14:37:05 +01:00
Tom Hvitved
15c7428593 Address review comment 2026-07-08 15:08:46 +02:00
Owen Mansel-Chan
aba008dcd7 Remove comments "// BAD: but flagged by cs/constant-condition" 2026-07-08 14:00:57 +01:00
Owen Mansel-Chan
7b96f66d34 Also run cs/constant-condition on test for cs/comparison-of-identical-expressions 2026-07-08 14:00:55 +01:00
Taus
3c3f740a25 Merge pull request #22120 from asgerf/unified/local-scoping
Unified: implement local scoping
2026-07-08 14:33:14 +02:00
Owen Mansel-Chan
85d800f317 Apply suggestions from code review
Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
2026-07-08 13:02:20 +01:00
Owen Mansel-Chan
134e30260d Merge pull request #22119 from owen-mc/java/fix-tainted-path-pattern-sanitization
Java: fix `@Pattern` sanitization for `java/path-injection`
2026-07-08 11:37:15 +01:00
Owen Mansel-Chan
a16e19a3b1 Merge pull request #22127 from owen-mc/cpp/convert-qlref-inline-expectations
C++: Convert qlref tests to inline expectations
2026-07-08 11:36:35 +01:00
Owen Mansel-Chan
69ed2da241 Merge pull request #22134 from github/workflow/coverage/update
Update CSV framework coverage reports
2026-07-08 11:19:06 +01:00
Jack Nørskov Jørgensen
6c7b9f71d6 Remove main entries 2026-07-08 09:28:47 +02:00
github-actions[bot]
bc966f62e2 Add changed framework coverage reports 2026-07-08 00:38:59 +00:00
Owen Mansel-Chan
b6d588c1a8 Revert inline expectations for blazor integration tests with BMN 2026-07-08 00:56:43 +01:00
Owen Mansel-Chan
5ba1fe315d Accept updated .expected output 2026-07-08 00:56:16 +01:00
Owen Mansel-Chan
8363d2d66d Merge pull request #22132 from joshimar/java/spring-webclient-uri-ssrf-sink
Java: Model Spring reactive `WebClient.uri` as a request forgery sink
2026-07-08 00:40:33 +01:00
Luis Azanza
b8f8370c33 Update java/ql/lib/change-notes/2026-06-30-spring-webclient-uri-ssrf.md
Update change note to be more technically accurate

Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com>
2026-07-07 16:21:09 -07:00
Luis Azanza
6ff2a4c0d6 Apply suggestion from @owen-mc
Removing Apple Inc notice per feedback provided by GitHub

Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com>
2026-07-07 16:10:05 -07:00
Luis Azanza
1db31327a7 Java: Model Spring reactive WebClient.uri as a request forgery sink 2026-07-07 13:30:48 -07:00
Owen Mansel-Chan
19745e13b5 Fix some lines with // $ ... // $ MISSING:
Note that when a line is marked `// BAD [NOT DETECTED]` but actually has
an alert, I assume that the `[NOT DETECTED]` is outdated and should be
deleted.
2026-07-07 20:48:39 +01:00
Owen Mansel-Chan
9d9590623d Address review comments 2026-07-07 20:48:36 +01:00
Geoffrey White
117a0bb87e Copilot fix for missing module pygments - regenerating the lockfile fully. 2026-07-07 16:02:36 +01:00
Owen Mansel-Chan
f67b7299f9 Update query example (synced file) 2026-07-07 14:09:50 +01:00
Owen Mansel-Chan
366d70bfee Convert qlref tests to inline expectations 2026-07-07 14:09:48 +01:00
Owen Mansel-Chan
a812e4aa99 Refactor creating barriers with annotations 2026-07-07 12:44:19 +01:00
Owen Mansel-Chan
fa16728522 Fix comments in one test 2026-07-07 12:06:43 +01:00
Owen Mansel-Chan
76d8ae8694 Add MISSING: tag 2026-07-07 10:59:21 +01:00
Owen Mansel-Chan
843ac7c6b0 Add SPURIOUS: tags 2026-07-07 10:54:11 +01:00
Owen Mansel-Chan
a2c5d4c818 C++: Convert qlref tests to inline expectations 2026-07-07 09:49:50 +01:00
Jack Nørskov Jørgensen
0ca353dc7f Add Changenote 2026-07-06 20:40:08 +02:00
Owen Mansel-Chan
8f026b1dc2 Allow inline expectation comments in more file formats 2026-07-06 13:43:31 +01:00
Asger F
bfb3ead314 Apply suggestions from code review
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
2026-07-03 14:29:54 +02:00
Owen Mansel-Chan
e5bd62dbd3 Add change note 2026-07-03 11:34:11 +01:00
Owen Mansel-Chan
76b4f4f223 Fix @Pattern sanitizer for TaintedPath 2026-07-03 11:34:06 +01:00
Owen Mansel-Chan
077b531e41 Add failing TaintedPath test for @Pattern sanitizer 2026-07-03 11:34:03 +01:00
Asger F
c23c3d9e79 unified: Translate bare names in patterns correctly
- Context is fully reset when stepping into an expr/stmt/body.
- Binding modifier is rolled into outer_modifiers.
2026-07-03 11:59:58 +02:00