hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-14 19:29:28 +02:00
Code Issues Packages Projects Releases Wiki Activity
87,136 Commits 1,758 Branches 167 Tags
c53b2f589b137a3c7674644dac0afba6c3e3c5f4
Commit Graph

12105 Commits

Author SHA1 Message Date
Henry Mercer
f1a9637d1f Merge pull request #21571 from github/henrymercer/yaml-regression-test 
JS: Add regression test for YAML extraction
 2026-04-27 11:09:37 +01:00
Owen Mansel-Chan
6efb21314a Merge pull request #21523 from owen-mc/docs/mad/barriers 
Document models-as-data barriers and barrier guards and add change notes
 2026-04-21 13:49:19 +01:00
github-actions[bot]
a0bab539bb Post-release preparation for codeql-cli-2.25.3 2026-04-20 12:40:34 +00:00
github-actions[bot]
c861d99802 Release preparation for version 2.25.3 2026-04-20 09:27:23 +00:00
Owen Mansel-Chan
8f17b73796 Fix link formatting in change notes 2026-04-14 15:27:37 +01:00
Owen Mansel-Chan
c86ba38a4e Add change notes 2026-04-14 15:27:31 +01:00
Henry Mercer
43c9b95e6f Merge branch 'main' into post-release-prep/codeql-cli-2.25.2 2026-04-14 13:56:52 +01:00
Owen Mansel-Chan
7458674470 Merge pull request #21584 from owen-mc/shared/update-mad-comments 
Shared: update code comments explaining models-as-data format to include barriers and barrier guards
 2026-04-14 09:30:28 +01:00
Tom Hvitved
fcfb8c9c6b Add change note 2026-04-13 12:22:30 +02:00
Tom Hvitved
7a48409e38 JS: Recognize Fastify per-route rate limiting 2026-04-13 11:31:34 +02:00
Tom Hvitved
fef582c858 JS: Add test case for Fastify per-route rate limiting 2026-04-13 11:24:41 +02:00
github-actions[bot]
242090e0ac Post-release preparation for codeql-cli-2.25.2 2026-04-06 13:49:20 +00:00
github-actions[bot]
4fe2f6d2b4 Release preparation for version 2.25.2 2026-04-06 10:30:38 +00:00
github-actions[bot]
ce6e6d5db3 Post-release preparation for codeql-cli-2.25.1 2026-03-30 08:43:48 +00:00
Owen Mansel-Chan
37aac05964 Replace branch with acceptingValue 2026-03-27 22:39:10 +00:00
Owen Mansel-Chan
10fddc7b96 Add barriers and barrier guards to MaD format explanations 2026-03-27 09:47:24 +00:00
github-actions[bot]
fb011842c9 Release preparation for version 2.25.1 2026-03-25 23:43:06 +00:00
github-actions[bot]
8cf0954796 Release preparation for version 2.25.1 2026-03-25 08:28:30 +00:00
Henry Mercer
c9fcdf3e80 JS: Add regression test for YAML extraction 
SnakeYAML 2.3 has [a bug](https://bitbucket.org/snakeyaml/snakeyaml/issues/1098) where it crashes with an `IndexOutOfBoundsException` when a Unicode surrogate pair (e.g. an emoji) straddles the 1024 character internal buffer boundary.  This happens because the high surrogate can end up as the last character in the data window, and the reader tries to read the low surrogate past the end of the buffer.

This caused languages that extract YAML, most notably JavaScript and Actions, to fail when the codebase contained a YAML file with an emoji at an unlucky position in the file.
 2026-03-24 18:47:52 +00:00
github-actions[bot]
e3dbf5b022 Post-release preparation for codeql-cli-2.25.0 2026-03-16 16:03:22 +00:00
github-actions[bot]
d6055754b6 Release preparation for version 2.25.0 2026-03-16 12:15:34 +00:00
Asger F
22f16dda85 Merge pull request #21368 from asgerf/browser-sources 
JS: Add 'browser' source kinds
 2026-03-16 09:24:54 +01:00
Asger F
821cc0e875 JS: Address PR review comments 
- Fix misplaced semicolons in test files (was inside comment, moved before it)
- Update QLdoc comments to reference new browser source kind names
- Update docs to list browser source kinds and fix outdated 'only remote' note

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-03-13 14:58:04 +01:00
Asger F
b8c44be599 Add QL test for bun/tsx shebang recognition in TypeScript files 
Add test files with #!/usr/bin/env bun, #!/usr/bin/env tsx, and
#!/usr/bin/env node shebangs. The query lists extracted .ts files,
verifying that all three shebangs are recognized and the files are
not skipped by the extractor.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-03-12 10:09:56 +01:00
Asger F
84d1828a9c JavaScript extractor: recognise bun and tsx in shebang lines 
Update the shebang regexp (renamed NODE_INVOCATION -> JS_INVOCATION) to
also match 'bun' and 'tsx' so that scripts using these runtimes are
correctly identified as JavaScript files.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-03-12 09:35:36 +01:00
Asger F
5db30c9947 JS: Add change note 2026-03-11 15:40:07 +01:00
Asger F
4a001f960f JS: Add tests in request forgery queries 2026-03-11 13:53:25 +01:00
Asger F
1253553aec JS: Add browser source kinds 2026-03-11 13:50:07 +01:00
Óscar San José
3b9eba2afc Merge branch 'main' of https://github.com/github/codeql into oscarsj/merge-back-rc-3.21 2026-03-06 16:20:36 +01:00
Asger F
c9fa7fa283 Merge pull request #21369 from asgerf/js/this-bindings 
JS: Emit variables for 'this'
 2026-03-05 13:36:38 +01:00
Owen Mansel-Chan
c82f75604a Add change notes 2026-03-05 10:34:30 +00:00
Owen Mansel-Chan
99a4fe4828 Update expected test output column numbers 2026-03-04 15:02:53 +00:00
Owen Mansel-Chan
ea30f02271 js: Inline expectation should have space before $ 2026-03-04 13:11:35 +00:00
Owen Mansel-Chan
0eccd902c2 js: Inline expectation should have space after $ 
This was a regex-find-replace from `// \$(?! )` (using a negative lookahead) to `// $ `.
 2026-03-04 12:45:03 +00:00
github-actions[bot]
e152f08468 Post-release preparation for codeql-cli-2.24.3 2026-03-02 22:51:27 +00:00
github-actions[bot]
7795badd18 Release preparation for version 2.24.3 2026-03-02 13:23:40 +00:00
Asger F
f2cc0da936 JS: Add upgrade/downgrade scripts but with 'partial' compatibility 2026-03-02 11:09:19 +01:00
Asger F
d440b5fa85 JS: Update TRAP files 2026-02-27 14:15:34 +01:00
Asger F
47895b3334 JS: Update test for UniquePropertyNames test 
This query now reports the alert previously found by DuplicateProperty
 2026-02-27 13:37:29 +01:00
Asger F
71fb6bf915 JS: Mark corresponding lost result for the getter 2026-02-27 13:35:43 +01:00
Asger F
c673bd9151 JS: Document a missing alert due to limitation in structural comparison 2026-02-27 13:34:55 +01:00
Asger F
0f2de46648 JS: Emit variable bindings for 'this' expressions 2026-02-27 11:44:54 +01:00
Asger F
f0f58dacb3 JS: Also emit 'this' variable for class scopes 2026-02-27 11:44:31 +01:00
Asger F
4a3b86c652 JS: Update test output 2026-02-27 11:13:50 +01:00
Asger F
e0ab5ce49b JS: Emit variables for 'this' 
The extractor does not emit bindings for 'this', we just ensure that a variable exists for it
 2026-02-25 10:17:02 +01:00
Asger F
f0e665d08c Merge pull request #21349 from asgerf/mobx-wrapper 
Support React components wrapped by 'mobx-react'
 2026-02-25 09:24:45 +01:00
Owen Mansel-Chan
ada9c452f0 Merge pull request #21336 from owen-mc/js/accept-mad-sanitizers 
JS: Accept MaD sanitizers for queries with MaD sinks
 2026-02-23 13:44:54 +00:00
Asger F
27638c7029 JS: Add change note 2026-02-20 11:20:46 +01:00
Asger F
a684943bb7 JS: Model mobx-react{-lite} as higher-order component builders 2026-02-19 11:26:46 +01:00
Asger F
a0099d64c8 JS: Add mobx-react and mobx-react-lite tests 2026-02-19 11:26:44 +01:00