hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-12 05:01:06 +01:00
Code Issues Packages Projects Releases Wiki Activity
85,574 Commits 1,690 Branches 160 Tags
eb37255c4b9ce8935e12fd930efab482a86f5502
Commit Graph

85574 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Anders Fugmann
eb37255c4b Kotlin: Create IrSimpleType factory function to support constructor changes introduced in Kotlin 2.3 2026-01-28 09:30:18 +01:00
Anders Fugmann
164cae845d Kotlin: Strip prefix when building plugin 2026-01-28 09:30:18 +01:00
Anders Fugmann
b8d01ed21b Kotlin: Fix bazel format and address copilot review comments 2026-01-28 09:30:18 +01:00
Anders Fugmann
cc25d30fed Kotlin: Update compiler plugin for Kotlin 2.3.0 2026-01-28 09:30:17 +01:00
Anders Fugmann
07e5479aff Kotlin: Add support for Kotlin 2.3.0 2026-01-28 09:30:17 +01:00
Anders Fugmann
bc419fd35c Kotlin: Silence compilation warnings 2026-01-28 09:30:16 +01:00
Anders Fugmann
772503bad8 Kotlin: Remove resource_strip_prefix for kotlin extraction 2026-01-28 09:30:16 +01:00
Anders Fugmann
beff080ee7 Kotlin: Update kotlin_rules to 2.2.0 and remove support for Kotlin 1.6 and 1.7 2026-01-28 09:30:16 +01:00
Anders Peter Fugmann
f4edff9452 Merge pull request #21216 from github/andersfugmann/kotlin_extractor_load_last 
Kotlin: Load kotlin extractor last
 2026-01-28 09:22:46 +01:00
Henry Mercer
2214a944bb Merge pull request #21225 from github/rc/3.20 
Merge `rc/3.20` back to `main`
 2026-01-27 07:56:58 -08:00
Mads Navntoft
b7125a009e Merge pull request #21221 from github/navntoft/struts 
Java: Add support for Struts 7.x package names
 2026-01-27 15:53:26 +01:00
Ian Lynagh
46a5035543 Merge pull request #21200 from github/igfoo/rename-holdsInBase-to-isBase 
C++: Rename `holdsInBase` to `isBase`
 2026-01-27 13:50:04 +00:00
Ian Lynagh
bb71790a53 Merge pull request #21199 from github/igfoo/refactorOverlayFunctionCalls 
C++ overlay: Simplify QL
 2026-01-27 13:03:01 +00:00
Mads Navntoft
ede05b54ea Java: Add change note for Struts 7.x package name support 2026-01-27 13:00:16 +01:00
Mads Navntoft
9a94d0474c Java: Add support for Struts 7.x package names 
Updates Struts library to recognize both legacy xwork2 and new struts2
packages:
- StrutsActions.qll: Add org.apache.struts2 alternatives for Action,
  Preparable, ActionSupport
- StrutsConventions.qll: Add org.apache.struts2.action.Action
  alternative

This maintains backward compatibility for analyzing Struts 2.x-6.x apps
while supporting Struts 7.x which renamed packages from
com.opensymphony.xwork2 to org.apache.struts2.
 2026-01-27 12:57:55 +01:00
Mathias Vorreiter Pedersen
9e9d57bac5 Merge pull request #21219 from MathiasVP/force-more-uniquess-in-buffer-overflow 
C++: Enforce more uniqueness in `Buffer.qll`
 2026-01-27 11:00:40 +00:00
Owen Mansel-Chan
8e3c373548 Merge pull request #21223 from github/workflow/coverage/update 
Update CSV framework coverage reports
 2026-01-27 10:35:28 +00:00
github-actions[bot]
f49531b3ca Add changed framework coverage reports 2026-01-27 00:28:39 +00:00
Mathias Vorreiter Pedersen
980c4cf5f4 Update cpp/ql/lib/semmle/code/cpp/commons/Buffer.qll 
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2026-01-26 19:12:38 +00:00
Mathias Vorreiter Pedersen
544015d0a6 C++: Add change note. 2026-01-26 19:12:14 +00:00
Tom Hvitved
b974a84bef Merge pull request #21051 from hvitved/shared/flow-summary-provenance-filtering 
Shared: Provenance-based filtering of flow summaries
 2026-01-26 17:24:34 +01:00
Mathias Vorreiter Pedersen
aed0e688f5 C++: Remove uniqueness since it is enforced earlier now. 2026-01-26 15:01:40 +00:00
Mathias Vorreiter Pedersen
13a5249a9d C++: Enforce uniqueness in the other branch of 'getSize'. 2026-01-26 15:00:58 +00:00
Mathias Vorreiter Pedersen
91752e5307 C++: Enforce uniqueness in 'getVariableSize'. 2026-01-26 15:00:00 +00:00
Anders Fugmann
73850f1b56 Kotlin: Add changenote 2026-01-26 13:27:34 +01:00
yoff
2bd4ccee45 Merge pull request #21004 from yoff/python/mad-barriers 
Python: MaD barriers
 2026-01-26 13:11:21 +01:00
Tom Hvitved
df09f02981 Shared: Shadow hasManualModel in RelevantSummarizedCallable 2026-01-26 12:40:25 +01:00
Tom Hvitved
732c60c07c C#: Revert change to getASummarizedCallableTarget 2026-01-26 12:40:24 +01:00
Tom Hvitved
0f6bae0ae1 Add change notes 2026-01-26 12:40:22 +01:00
Tom Hvitved
93dad867cd JS: Adapt to changes in FlowSummaryImpl 2026-01-26 12:40:21 +01:00
Tom Hvitved
3b1e062985 C++: Adapt to changes in FlowSummaryImpl 2026-01-26 12:40:20 +01:00
Tom Hvitved
0adece7cde Python: Adapt to changes in FlowSummaryImpl 2026-01-26 12:40:19 +01:00
Tom Hvitved
739748c29b Go: Adapt to changes in FlowSummaryImpl 2026-01-26 12:40:18 +01:00
Tom Hvitved
47d9e8a357 Swift: Adapt to changes in FlowSummaryImpl 2026-01-26 12:40:17 +01:00
Tom Hvitved
7024b07dd2 Java: Adapt to changes in FlowSummaryImpl 
Missing manual models were added using the following code added to `FlowSummaryImpl.qll`:

```ql
    private predicate testsummaryElement(
      Input::SummarizedCallableBase c, string namespace, string type, boolean subtypes, string name,
      string signature, string ext, string originalInput, string originalOutput, string kind,
      string provenance, string model, boolean isExact
    ) {
      exists(string input, string output, Callable baseCallable |
        summaryModel(namespace, type, subtypes, name, signature, ext, originalInput, originalOutput,
          kind, provenance, model) and
        baseCallable = interpretElement(namespace, type, subtypes, name, signature, ext, isExact) and
        (
          c.asCallable() = baseCallable and input = originalInput and output = originalOutput
          or
          correspondingKotlinParameterDefaultsArgSpec(baseCallable, c.asCallable(), originalInput,
            input) and
          correspondingKotlinParameterDefaultsArgSpec(baseCallable, c.asCallable(), originalOutput,
            output)
        )
      )
    }

    private predicate testsummaryElement2(
      string namespace, string type, boolean subtypes, string name, string signature, string ext,
      string originalInput, string originalOutput, string kind, string provenance, string model,
      string namespace2, string type2
    ) {
      exists(Input::SummarizedCallableBase c |
        testsummaryElement(c, namespace2, type2, _, _, _, ext, originalInput, originalOutput, kind,
          provenance, model, false) and
        testsummaryElement(c, namespace, type, subtypes, name, _, _, _, _, _, provenance, _, true) and
        signature = paramsString(c.asCallable()) and
        not testsummaryElement(c, _, _, _, _, _, _, originalInput, originalOutput, kind, provenance,
          _, true)
      )
    }

    private string getAMissingManualModel(string namespace2, string type2) {
      exists(
        string namespace, string type, boolean subtypes, string name, string signature, string ext,
        string originalInput, string originalOutput, string kind, string provenance, string model
      |
        testsummaryElement2(namespace, type, subtypes, name, signature, ext, originalInput,
          originalOutput, kind, provenance, model, namespace2, type2) and
        result =
          "- [\"" + namespace + "\", \"" + type + "\", True, \"" + name + "\", \"" + signature +
            "\", \"\", \"" + originalInput + "\", \"" + originalOutput + "\", \"" + kind + "\", \"" +
            provenance + "\"]"
      )
    }
```
 2026-01-26 12:40:15 +01:00
Tom Hvitved
c975ae5231 Ruby: Adapt to changes in FlowSummaryImpl 2026-01-26 12:40:14 +01:00
Tom Hvitved
c4e0dda178 Rust: Adapt to changes in FlowSummaryImpl 2026-01-26 12:40:10 +01:00
Tom Hvitved
b11b091559 C#: Adapt to changes in FlowSummaryImpl 2026-01-26 12:39:38 +01:00
Tom Hvitved
4ce04e4749 Shared: Provenance-based filtering of flow summaries 2026-01-26 12:39:37 +01:00
Simon Friis Vindum
793d2c79de Merge pull request #21215 from paldepind/shared/type-mention-tree 
Shared, Rust: Use `HasTypeTreeSig` for `TypeMention`
 2026-01-26 12:00:02 +01:00
Michael B. Gale
f76211c64a Merge pull request #21136 from github/mbg/java/maven-plugin-repo-changenote 
Java: Add change note for plugin repo support
 2026-01-26 10:44:51 +00:00
Michael B. Gale
ffa700c825 Merge pull request #21214 from github/mbg/go/diagnostics-unit-tests 
Go: Make diagnostics unit-testable and add test for `EmitCannotFindPackages`
 2026-01-26 10:44:03 +00:00
Michael B. Gale
bd8a127565 Merge pull request #21213 from github/mbg/go/improve-package-not-found 2026-01-26 09:59:01 +00:00
Anders Fugmann
c488086135 Kotlin: Ensure the kotlin extractor is loaded as the last extension to be able to capture expansions from other extensions 2026-01-26 10:38:11 +01:00
Simon Friis Vindum
452d307fd5 Rust: Make TypeMention directly satisfy HasTypeTree 2026-01-26 09:46:33 +01:00
Simon Friis Vindum
7100ca4262 Rust: Adapt to changes in shared type inference library 2026-01-26 09:33:50 +01:00
Simon Friis Vindum
a7fecaaa1b Shared: Use HasTypeTreeSig for TypeMention 2026-01-26 09:29:51 +01:00
Michael B. Gale
45e0a929a8 Move nil check into FileDiagnosticsWriter implementation of WriteDiagnostic 2026-01-25 15:33:26 +00:00
Michael B. Gale
8e7d62600d Make EmitCannotFindPackages testable and add tests 2026-01-25 15:24:43 +00:00
Michael B. Gale
f1f4ddb76c Add dependency on testify/assert 2026-01-25 15:20:06 +00:00