Commit Graph

9455 Commits

Author SHA1 Message Date
Taus
f6732a927b Python: Bump extractor version 2025-09-03 11:56:54 +00:00
Taus
13a93c7e32 Python: Add suggestions from Copilot 2025-09-03 11:55:49 +00:00
Taus
9802ad77dc Python: Update types_new.py and test output 2025-09-02 12:41:57 +00:00
Taus
235822d782 Python: Improve handling of syntax errors
Rather than relying on matching arbitrary nodes inside tree-sitter-graph
and then checking whether they are of type ERROR or MISSING (which seems
to have stopped working in later versions of tree-sitter), we now
explicitly go through the tree-sitter tree, locating all of the error
and missing nodes along the way. We then add these on to the graph
output in the same format as was previously produced by
tree-sitter-graph.

Note that it's very likely that some of the syntax errors will move
around a bit as a consequence of this change. In general, we don't
expect syntax errors to have stable locations, as small changes in the
grammar can cause an error to appear in a different position, even if
the underlying (erroneous) code has not changed.
2025-09-02 12:41:57 +00:00
Taus
b108d47b26 Python: Update parser test output
It seems that with a newer version of tree-sitter, we no longer parse
the (not actually valid!) syntax `Spam[**P2]` as if the `**` is an
exponentiation operation (with a missing left operand).
2025-09-02 12:41:55 +00:00
Taus
76f15a890c Python: Update tree-sitter dependency
Updates the Python extractor to depend on version 0.24.7 of tree-sitter
(and 0.12.0 of tree-sitter-graph).

A few changes were needed in order to make the code build and run after
updating the dependencies:

- In `main.rs`, the `Language` parameter is now passed as a reference.
- In `python.tsg`, many queries had captures that were not actually used
in the body of the stanza. This is no longer allowed (unless the
captures start with an underscore), as it may indicate an error. To fix
this, I added underscores in the appropriate places (and verified that
none of these unused captures were in fact bugs).
2025-09-02 12:40:20 +00:00
Michael Nebel
31852985e5 Merge pull request #20335 from michaelnebel/shared/ql4ql
Shared and Sync: Fix some Ql4Ql violations.
2025-09-02 14:37:34 +02:00
Arthur Baars
0bb7fdccf6 Merge pull request #20347 from github/post-release-prep/codeql-cli-2.23.0
Post-release preparation for codeql-cli-2.23.0
2025-09-02 14:14:03 +02:00
Anders Schack-Mulligen
f833fe0e6e Merge pull request #20300 from aschackmull/cfg/successortype
Shared: Add a shared SuccessorType implementation
2025-09-02 14:09:35 +02:00
Michael Nebel
d3d737b383 Merge pull request #20330 from michaelnebel/python/ql4ql
Python: Fix some Ql4Ql violations.
2025-09-02 14:01:54 +02:00
Michael Nebel
7490d8ddd2 Shared and Sync: Fix some Ql4Ql violations. 2025-09-02 13:54:22 +02:00
github-actions[bot]
e8a2600a0c Post-release preparation for codeql-cli-2.23.0 2025-09-02 11:46:23 +00:00
github-actions[bot]
0bfa93828b Release preparation for version 2.23.0 2025-09-02 11:09:32 +00:00
Michael Nebel
90caded4fe Apply suggestion from @aschackmull
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
2025-09-02 13:08:31 +02:00
Henry Mercer
d71991fdc0 Merge pull request #20320 from github/henrymercer/default-queries
Specify default queries in `codeql-extractor.yml`
2025-09-01 15:52:47 +01:00
Michael Nebel
dbd31259b3 Python: Fix some Ql4Ql violations. 2025-09-01 15:16:25 +02:00
Anders Schack-Mulligen
144e34c669 Shared: Use shared SuccessorType in shared Cfg and BasicBlock libs. 2025-09-01 13:43:32 +02:00
Anders Schack-Mulligen
09b2c5abf0 BasicBlock: Replace entryBlock predicate with subclass. 2025-09-01 11:48:44 +02:00
Anders Schack-Mulligen
f459ddc40a Languages: Adapt to api changes. 2025-09-01 11:26:33 +02:00
Anders Schack-Mulligen
bb3abc815f SSA: Update input to use member predicates. 2025-09-01 11:19:48 +02:00
Henry Mercer
55869f28c3 Specify default queries in codeql-extractor.yml 2025-08-29 17:34:45 +01:00
Taus
f89fae39c5 Merge pull request #20276 from github/tausbn/python-model-psycopg2-connection-pools
Python: Add support for Psycopg2 database connection pools
2025-08-29 13:52:59 +02:00
Napalys Klicius
bafe22c50c Merge pull request #20048 from Napalys/js/xml_bomb_sinks
JS: Exclude patched libraries from `xml-bomb` sink
2025-08-29 08:10:55 +02:00
Joe Farebrother
7ef2b01119 Merge pull request #20142 from joefarebrother/python-qual-subclass-shadow
Python: Modernise Superclass attribute shadows subclass method query
2025-08-28 13:40:26 +01:00
Tom Hvitved
fa7295f0a1 Merge pull request #20303 from hvitved/python/jump-to-def-unpack-tests
Python: Add jump-to-def tests for unpacking assignments
2025-08-28 12:03:55 +02:00
Tom Hvitved
bf47f66691 Python: Add jump-to-def tests for unpacking assignments 2025-08-28 10:38:21 +02:00
Joe Farebrother
bde143e4c1 Merge pull request #20038 from joefarebrother/python-qual-comparison
Python: Modernize 3 quality queries for comparison methods
2025-08-28 09:37:20 +01:00
Joe Farebrother
45910b9505 Merge remote-tracking branch 'origin/python-qual-subclass-shadow' into python-qual-subclass-shadow 2025-08-28 09:23:42 +01:00
Joe Farebrother
c6ababd262 Fix test output 2025-08-28 08:49:34 +01:00
Joe Farebrother
ada0b372c6 Merge pull request #20120 from joefarebrother/python-qual-unexpected-raise-special
Python: Modernize Unexpected Raise In Special Method query
2025-08-27 15:01:46 +01:00
Joe Farebrother
2c6b2df7cc Update python/ql/src/Classes/SubclassShadowing/SubclassShadowing.qhelp
Co-authored-by: Taus <tausbn@github.com>
2025-08-27 13:20:54 +01:00
Joe Farebrother
5b0beb91d1 Update python/ql/src/Functions/IncorrectRaiseInSpecialMethod.qhelp
Co-authored-by: Taus <tausbn@github.com>
2025-08-27 13:19:55 +01:00
Taus
1008ca9744 Python: Add psycopg2.pool tests 2025-08-25 14:14:16 +00:00
Taus
d5e0298999 Python: Add support for Psycopg2 database connection pools
Our current modelling only treated `psycopg2` insofar as it implemented
PEP 249 (which does not define any notion of connection pool), which
meant we were missing database connections that arose from such pools.

With these changes, we add support for the three classes relating to
database pools that are defined in `psycopg2`. (Note that
`getAnInstance` automatically looks at subclasses, which means this
should also handle cases where the user has defined a new subclass that
inherits from one of these three classes.)
2025-08-25 12:35:57 +00:00
Tom Hvitved
bf7e3dabd6 Python: Only include relevant YAML in printAst.ql 2025-08-25 13:54:19 +02:00
github-actions[bot]
42e3d31c49 Post-release preparation for codeql-cli-2.22.4 2025-08-18 14:42:42 +00:00
github-actions[bot]
90d29994c8 Release preparation for version 2.22.4 2025-08-18 14:06:09 +00:00
Nora Dimitrijević
4199859eaa Merge pull request #20079 from d10c/d10c/diff-informed-phase-3-python
Python: Diff-informed queries: phase 3 (non-trivial locations)
2025-08-18 09:33:57 +02:00
github-actions[bot]
fb4b0aac53 Post-release preparation for codeql-cli-2.22.3 2025-08-04 17:18:08 +00:00
github-actions[bot]
fd82aeb1f8 Release preparation for version 2.22.3 2025-08-04 15:47:57 +00:00
Joe Farebrother
5e09c1d3d3 Merge remote-tracking branch 'origin/python-qual-subclass-shadow' into python-qual-subclass-shadow 2025-08-01 12:39:30 +01:00
Joe Farebrother
bc60914ed7 Update test output 2025-08-01 12:37:51 +01:00
Joe Farebrother
d8083add3e Doc updates 2025-08-01 12:35:01 +01:00
Joe Farebrother
79d1deb28d Update python/ql/src/Classes/SubclassShadowing/SubclassShadowing.ql
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2025-07-31 06:05:48 +01:00
Joe Farebrother
71a6b22815 Update python/ql/src/Classes/SubclassShadowing/examples/SubclassShadowingBad.py
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2025-07-31 06:05:25 +01:00
Joe Farebrother
1efc09bbba Update integration tests 2025-07-30 15:54:39 +01:00
Joe Farebrother
63577f0cca Add extra example 2025-07-30 15:52:26 +01:00
Joe Farebrother
2516f9452e Move to subfolder 2025-07-30 15:17:19 +01:00
Joe Farebrother
34317d2d4a Update documentation 2025-07-30 13:56:28 +01:00
Joe Farebrother
796a6060b2 Exclude setters and update tests 2025-07-30 13:56:05 +01:00