hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-12 05:01:06 +01:00
Code Issues Packages Projects Releases Wiki Activity
85,799 Commits 1,690 Branches 160 Tags
c15ad31b07bb417d12a7de165edd2e6be052d097
Commit Graph

85799 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Owen Mansel-Chan
a0c35516bd Add change note 2026-01-27 15:48:04 +00:00
Owen Mansel-Chan
42cbe0734e Specify what lock types are considered in qhelp 2026-01-27 15:39:03 +00:00
Owen Mansel-Chan
516b84b59a Add test for *Pool exclusion 2026-01-27 15:38:29 +00:00
Owen Mansel-Chan
4f1ad0ff5d Exclude *Pool classes from LockType 2026-01-27 15:38:06 +00:00
Jon Janego
ccc4d8ae3f Update docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.24.0.rst 
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2026-01-27 09:18:25 -06:00
Simon Friis Vindum
2cb0e81da0 Rust: Remove duplicated inclusion of getAdditionalPathTypeAt 2026-01-27 16:17:52 +01:00
Simon Friis Vindum
aae5333325 Rust: Add test with type inference inconsistency 2026-01-27 16:17:51 +01:00
Simon Friis Vindum
fa59a8ae24 Rust: Implement TypeMention for paths that access associated types on concrete types 2026-01-27 16:17:49 +01:00
Simon Friis Vindum
4526afc29f Rust: Paths to associated types resolve to the associated type if implementation is unclear 2026-01-27 16:17:48 +01:00
Jon Janego
1c5a9053f9 Fix typo in call graph description in change notes 2026-01-27 09:17:40 -06:00
Jon Janego
5a08adc06c Update docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.23.1.rst 
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2026-01-27 09:11:01 -06:00
Jon Janego
0b8b75ac25 Update codeql-cli-2.23.1.rst 2026-01-27 09:10:37 -06:00
Mads Navntoft
b7125a009e Merge pull request #21221 from github/navntoft/struts 
Java: Add support for Struts 7.x package names
 2026-01-27 15:53:26 +01:00
Owen Mansel-Chan
97a0b9f0ca (trivial) Remove double spaces in qhelp 2026-01-27 14:40:23 +00:00
Ian Lynagh
46a5035543 Merge pull request #21200 from github/igfoo/rename-holdsInBase-to-isBase 
C++: Rename `holdsInBase` to `isBase`
 2026-01-27 13:50:04 +00:00
Ian Lynagh
bb71790a53 Merge pull request #21199 from github/igfoo/refactorOverlayFunctionCalls 
C++ overlay: Simplify QL
 2026-01-27 13:03:01 +00:00
Mathias Vorreiter Pedersen
db3f22a2e8 C++: Another small refactor. 2026-01-27 12:46:52 +00:00
Mathias Vorreiter Pedersen
3d445be926 C++: Small refactor. 2026-01-27 12:46:48 +00:00
Mads Navntoft
ede05b54ea Java: Add change note for Struts 7.x package name support 2026-01-27 13:00:16 +01:00
Mads Navntoft
9a94d0474c Java: Add support for Struts 7.x package names 
Updates Struts library to recognize both legacy xwork2 and new struts2
packages:
- StrutsActions.qll: Add org.apache.struts2 alternatives for Action,
  Preparable, ActionSupport
- StrutsConventions.qll: Add org.apache.struts2.action.Action
  alternative

This maintains backward compatibility for analyzing Struts 2.x-6.x apps
while supporting Struts 7.x which renamed packages from
com.opensymphony.xwork2 to org.apache.struts2.
 2026-01-27 12:57:55 +01:00
Mathias Vorreiter Pedersen
9e9d57bac5 Merge pull request #21219 from MathiasVP/force-more-uniquess-in-buffer-overflow 
C++: Enforce more uniqueness in `Buffer.qll`
 2026-01-27 11:00:40 +00:00
Owen Mansel-Chan
8e3c373548 Merge pull request #21223 from github/workflow/coverage/update 
Update CSV framework coverage reports
 2026-01-27 10:35:28 +00:00
Owen Mansel-Chan
5bfeede364 Add dependency on shared controlflow library 2026-01-27 09:43:19 +00:00
github-actions[bot]
f49531b3ca Add changed framework coverage reports 2026-01-27 00:28:39 +00:00
github-actions[bot]
0f4f0b880a update codeql documentation 2026-01-26 22:32:02 +00:00
Mathias Vorreiter Pedersen
e0a7889b71 C++: Undo the hack. 2026-01-26 21:28:21 +00:00
Mathias Vorreiter Pedersen
bd09aad7d5 C++: Add tests. 2026-01-26 21:24:22 +00:00
Mathias Vorreiter Pedersen
980c4cf5f4 Update cpp/ql/lib/semmle/code/cpp/commons/Buffer.qll 
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2026-01-26 19:12:38 +00:00
Mathias Vorreiter Pedersen
544015d0a6 C++: Add change note. 2026-01-26 19:12:14 +00:00
Tom Hvitved
b974a84bef Merge pull request #21051 from hvitved/shared/flow-summary-provenance-filtering 
Shared: Provenance-based filtering of flow summaries
 2026-01-26 17:24:34 +01:00
Mathias Vorreiter Pedersen
aed0e688f5 C++: Remove uniqueness since it is enforced earlier now. 2026-01-26 15:01:40 +00:00
Mathias Vorreiter Pedersen
13a5249a9d C++: Enforce uniqueness in the other branch of 'getSize'. 2026-01-26 15:00:58 +00:00
Mathias Vorreiter Pedersen
91752e5307 C++: Enforce uniqueness in 'getVariableSize'. 2026-01-26 15:00:00 +00:00
Simon Friis Vindum
330505c524 Rust: Add tests for associated types 2026-01-26 15:03:07 +01:00
Anders Fugmann
73850f1b56 Kotlin: Add changenote 2026-01-26 13:27:34 +01:00
yoff
2bd4ccee45 Merge pull request #21004 from yoff/python/mad-barriers 
Python: MaD barriers
 2026-01-26 13:11:21 +01:00
Tom Hvitved
df09f02981 Shared: Shadow hasManualModel in RelevantSummarizedCallable 2026-01-26 12:40:25 +01:00
Tom Hvitved
732c60c07c C#: Revert change to getASummarizedCallableTarget 2026-01-26 12:40:24 +01:00
Tom Hvitved
0f6bae0ae1 Add change notes 2026-01-26 12:40:22 +01:00
Tom Hvitved
93dad867cd JS: Adapt to changes in FlowSummaryImpl 2026-01-26 12:40:21 +01:00
Tom Hvitved
3b1e062985 C++: Adapt to changes in FlowSummaryImpl 2026-01-26 12:40:20 +01:00
Tom Hvitved
0adece7cde Python: Adapt to changes in FlowSummaryImpl 2026-01-26 12:40:19 +01:00
Tom Hvitved
739748c29b Go: Adapt to changes in FlowSummaryImpl 2026-01-26 12:40:18 +01:00
Tom Hvitved
47d9e8a357 Swift: Adapt to changes in FlowSummaryImpl 2026-01-26 12:40:17 +01:00
Tom Hvitved
7024b07dd2 Java: Adapt to changes in FlowSummaryImpl 
Missing manual models were added using the following code added to `FlowSummaryImpl.qll`:

```ql
    private predicate testsummaryElement(
      Input::SummarizedCallableBase c, string namespace, string type, boolean subtypes, string name,
      string signature, string ext, string originalInput, string originalOutput, string kind,
      string provenance, string model, boolean isExact
    ) {
      exists(string input, string output, Callable baseCallable |
        summaryModel(namespace, type, subtypes, name, signature, ext, originalInput, originalOutput,
          kind, provenance, model) and
        baseCallable = interpretElement(namespace, type, subtypes, name, signature, ext, isExact) and
        (
          c.asCallable() = baseCallable and input = originalInput and output = originalOutput
          or
          correspondingKotlinParameterDefaultsArgSpec(baseCallable, c.asCallable(), originalInput,
            input) and
          correspondingKotlinParameterDefaultsArgSpec(baseCallable, c.asCallable(), originalOutput,
            output)
        )
      )
    }

    private predicate testsummaryElement2(
      string namespace, string type, boolean subtypes, string name, string signature, string ext,
      string originalInput, string originalOutput, string kind, string provenance, string model,
      string namespace2, string type2
    ) {
      exists(Input::SummarizedCallableBase c |
        testsummaryElement(c, namespace2, type2, _, _, _, ext, originalInput, originalOutput, kind,
          provenance, model, false) and
        testsummaryElement(c, namespace, type, subtypes, name, _, _, _, _, _, provenance, _, true) and
        signature = paramsString(c.asCallable()) and
        not testsummaryElement(c, _, _, _, _, _, _, originalInput, originalOutput, kind, provenance,
          _, true)
      )
    }

    private string getAMissingManualModel(string namespace2, string type2) {
      exists(
        string namespace, string type, boolean subtypes, string name, string signature, string ext,
        string originalInput, string originalOutput, string kind, string provenance, string model
      |
        testsummaryElement2(namespace, type, subtypes, name, signature, ext, originalInput,
          originalOutput, kind, provenance, model, namespace2, type2) and
        result =
          "- [\"" + namespace + "\", \"" + type + "\", True, \"" + name + "\", \"" + signature +
            "\", \"\", \"" + originalInput + "\", \"" + originalOutput + "\", \"" + kind + "\", \"" +
            provenance + "\"]"
      )
    }
```
 2026-01-26 12:40:15 +01:00
Tom Hvitved
c975ae5231 Ruby: Adapt to changes in FlowSummaryImpl 2026-01-26 12:40:14 +01:00
Tom Hvitved
c4e0dda178 Rust: Adapt to changes in FlowSummaryImpl 2026-01-26 12:40:10 +01:00
Tom Hvitved
b11b091559 C#: Adapt to changes in FlowSummaryImpl 2026-01-26 12:39:38 +01:00
Tom Hvitved
4ce04e4749 Shared: Provenance-based filtering of flow summaries 2026-01-26 12:39:37 +01:00
Simon Friis Vindum
01cc19cffc Rust: Add trait visibility test using Self 2026-01-26 12:31:16 +01:00