hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 17:25:19 +02:00
Code Issues Packages Projects Releases Wiki Activity
81,893 Commits 1,741 Branches 165 Tags
d5e029899919db069537f29c81d8fedbfa99dee9
Commit Graph

81893 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Taus
d5e0298999 Python: Add support for Psycopg2 database connection pools 
Our current modelling only treated `psycopg2` insofar as it implemented
PEP 249 (which does not define any notion of connection pool), which
meant we were missing database connections that arose from such pools.

With these changes, we add support for the three classes relating to
database pools that are defined in `psycopg2`. (Note that
`getAnInstance` automatically looks at subclasses, which means this
should also handle cases where the user has defined a new subclass that
inherits from one of these three classes.)
 2025-08-25 12:35:57 +00:00
Tom Hvitved
88059d97c8 Merge pull request #20275 from hvitved/python/fix-print-ast-yaml 
Python: Only include relevant YAML in `printAst.ql`
 2025-08-25 14:22:14 +02:00
Tom Hvitved
bf7e3dabd6 Python: Only include relevant YAML in printAst.ql 2025-08-25 13:54:19 +02:00
Anders Schack-Mulligen
4be995dc19 Merge pull request #20267 from aschackmull/java/nullness-fix 
Java: Add more nullness tests and fix a bug causing false negatives.
 2025-08-25 09:13:25 +02:00
Anders Schack-Mulligen
891ce62948 Merge pull request #17660 from knewbury01/knewbury01/improve-quality-java-set 
Remove unnecessary query
 2025-08-25 08:37:02 +02:00
Paolo Tranquilli
e20c8e139c Merge pull request #20250 from github/redsun82/redsun82/no-lld 
Bazel: do not force `lld` and fix `platforms` warning
 2025-08-25 08:32:25 +02:00
Henning Makholm
3134c0aa38 Merge pull request #20269 from github/hmakholm/pr/test-run-output 
rust integration test: use all output from codeql test run
 2025-08-22 15:47:33 +02:00
Henning Makholm
2e69417d67 rust integration test: use all output from codeql test run 
The integration test expectes to find a certain phrase from the
extractor repeated in the _stderr_ of `codeql test run`. However, that
subcommand is about to start reproducing the extractor output as-is,
which means the phrase will instead appear in _stdout_.

Change the integration test to capture all of the output, so it
will keep passing across the change.
 2025-08-22 15:27:37 +02:00
Geoffrey White
49c4c34882 Merge pull request #20221 from github/copilot/fix-20220 
Rust: Implement a new query for Log Injection
 2025-08-22 14:01:49 +01:00
Anders Schack-Mulligen
e343fd32d3 Java: Add change note. 2025-08-22 14:29:27 +02:00
Jeroen Ketema
374c547fa2 Merge pull request #18722 from superboy-zjc/main 
Fix the broken reference
 2025-08-22 12:26:59 +02:00
Jeroen Ketema
6ce3aac7b7 Merge pull request #12660 from moshekaplan/patch-1 
Correct menu title name of "Open Workspace"
 2025-08-22 12:08:06 +02:00
Jeroen Ketema
6d7f6ff77d Merge branch 'main' into patch-1 2025-08-22 11:51:33 +02:00
Anders Schack-Mulligen
f2352f76c0 Java: Teach guards that exceptions in catch-clauses are non-null. 2025-08-22 10:16:42 +02:00
Anders Schack-Mulligen
02452704b2 Java: Fix bug in nullness 2025-08-22 10:15:22 +02:00
Anders Schack-Mulligen
9fc0793d6a Java: More nullness qltests, including highlight of FN bug. 2025-08-22 10:12:48 +02:00
Anders Schack-Mulligen
1c724372f2 Java: More nullness qltests. 2025-08-22 10:08:17 +02:00
Anders Schack-Mulligen
ba252cb5cf Java: Add a couple of difficult condition correlation tests. 2025-08-22 10:08:00 +02:00
Chris Smowton
2d9470ded8 Merge pull request #20264 from github/smowton/admin/merge-rc319-into-main 
Merge rc/3.19 into main
 2025-08-21 17:06:17 +01:00
Chris Smowton
1829060fab Merge remote-tracking branch 'origin/main' into smowton/admin/merge-rc319-into-main 2025-08-21 16:33:37 +01:00
Tom Hvitved
7a4bc80582 Merge pull request #20248 from hvitved/rust/jump-to-def-generic-args 
Rust: Adjust jump-to-def for paths with generic arguments
 2025-08-21 16:00:51 +02:00
Tom Hvitved
0144c77dd1 Merge pull request #20234 from hvitved/type-inference/rename-vars 
Type inference: Rename some variables
 2025-08-21 16:00:31 +02:00
Michael Nebel
c89f2e309d Merge pull request #20089 from michaelnebel/csharp/allowsinkimplicitread 
C#: Allow implicit collection reads in sink nodes.
 2025-08-21 15:29:52 +02:00
Jami
771d7cb171 Merge pull request #20095 from jcogs33/jcogs33/java/finalizers-on-exit-and-garbage-collection 
Java: Add `previous-id` and adjust tags for `java/garbage-collection` and `java/run-finalizers-on-exit`
 2025-08-21 08:10:36 -04:00
Owen Mansel-Chan
f1c6064f4e Merge pull request #20188 from github/dependabot/go_modules/go/extractor/extractor-dependencies-c0b353d580 
Bump the extractor-dependencies group in /go/extractor with 2 updates
 2025-08-21 12:44:15 +01:00
Mathias Vorreiter Pedersen
dfda5a0793 Merge pull request #20249 from MathiasVP/type-tracking-for-cpp-3 
C++: Use the shared type-tracking library for virtual dispatch resolution
 2025-08-21 11:14:12 +02:00
Napalys Klicius
3369e16b1b Merge pull request #20254 from Napalys/cs/ldap-injection-qhelp 
CS: Update `cs/ldap-injection` qhelp
 2025-08-21 08:57:03 +02:00
Michael Nebel
ebfbc71104 C#: Address more review comments. 2025-08-21 08:07:17 +02:00
dependabot[bot]
e99b423e28 Bump the extractor-dependencies group in /go/extractor with 2 updates 
Bumps the extractor-dependencies group in /go/extractor with 2 updates: [golang.org/x/mod](https://github.com/golang/mod) and [golang.org/x/tools](https://github.com/golang/tools).


Updates `golang.org/x/mod` from 0.26.0 to 0.27.0
- [Commits](https://github.com/golang/mod/compare/v0.26.0...v0.27.0)

Updates `golang.org/x/tools` from 0.35.0 to 0.36.0
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](https://github.com/golang/tools/compare/v0.35.0...v0.36.0)

---
updated-dependencies:
- dependency-name: golang.org/x/mod
  dependency-version: 0.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: extractor-dependencies
- dependency-name: golang.org/x/tools
  dependency-version: 0.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: extractor-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-08-21 03:46:43 +00:00
Jeroen Ketema
b79f0a2cf2 Merge pull request #20252 from knewbury01/knewbury01/add-uniform-Customizations 
Add extra Customizations files
 2025-08-20 20:14:02 +02:00
Kristen Newbury
cf0342410d Merge branch 'knewbury01/add-uniform-Customizations' of https://github.com/knewbury01/codeql into knewbury01/add-uniform-Customizations 2025-08-20 13:19:16 -04:00
Kristen Newbury
854a5b5871 Add changenotes customizations addition 2025-08-20 13:18:17 -04:00
Napalys Klicius
71a8e10f3d CS: added extra guidance in recommendation section for LDAPInjection 2025-08-20 13:37:02 +02:00
Napalys Klicius
c475bedf73 CS: removed dead links from LDAPInjection qhelp 2025-08-20 12:58:54 +02:00
Mathias Vorreiter Pedersen
70d3e69ce5 C++: Rename 'lambda' to 'virtual'. 2025-08-20 10:38:22 +02:00
Paolo Tranquilli
fd7668d94a Merge pull request #20251 from github/redsun82/rust-remove-warning 
Rust: update README to remove experimental warning
 2025-08-20 10:12:19 +02:00
Michael Nebel
3e03728ffe Merge pull request #20244 from github/workflow/coverage/update 
Update CSV framework coverage reports
 2025-08-20 08:55:48 +02:00
Michael Nebel
b42c366250 C#: Address review comments. 2025-08-20 08:50:23 +02:00
Jeroen Ketema
c9f0e3a377 Apply suggestions from code review 2025-08-20 08:07:10 +02:00
github-actions[bot]
e74116b347 Add changed framework coverage reports 2025-08-20 00:23:14 +00:00
Kristen Newbury
d630e32ce9 Format Customizations.qll 2025-08-19 15:27:29 -04:00
Kristen Newbury
49ef6939d4 Add extra Customizations files 2025-08-19 14:49:31 -04:00
Paolo Tranquilli
65e5ded80d Rust: update README to remove experimental warning 2025-08-19 16:02:45 +02:00
Paolo Tranquilli
d6f845ee17 Bazel: do not force lld and fix platforms warning 
This was meant to avoid using `gold`, but `lld` might not be installed.
Having `gold` installed results in the following warning:
```
warning: the gold linker is deprecated and has known bugs with Rust
  |
  = help: consider using LLD or ld from GNU binutils instead
```

* if a user sees this warning, they can provide the `lld` or whatever
  linker they prefer themselves, or make sure to uninstall `gold`
* in any case, this is not what we use for releasing (where we are sure
  we don't use `gold`).
 2025-08-19 15:56:16 +02:00
Geoffrey White
963e028645 Merge pull request #20238 from geoffw0/scinit 
Rust: Update StreamCipherInit to use getCanonicalPath.
 2025-08-19 13:18:10 +01:00
Mathias Vorreiter Pedersen
02bf923f7e C++: Add change note. 2025-08-19 13:57:15 +02:00
Mathias Vorreiter Pedersen
0631bd7466 C++: Add object/flow conflation for unions when resolving function pointers. 2025-08-19 13:57:13 +02:00
Mathias Vorreiter Pedersen
16508b1800 C++: Fix off-by-one error in getType on 'FinalGlobalValue' nodes and accept test changes. 2025-08-19 13:57:11 +02:00
Mathias Vorreiter Pedersen
302d35bedc C++: Accept test changes. 2025-08-19 13:57:10 +02:00
Mathias Vorreiter Pedersen
cca5bd9ada C++: Update 'mayBenefitFromCallContext' to not use the old virtual dispatch local flow predicate. 2025-08-19 13:57:07 +02:00