Commit Graph

86161 Commits

Author SHA1 Message Date
Mathias Vorreiter Pedersen
b14ece72be C++: Add range analysis test demonstrating missing measuring bounds. 2026-02-11 16:58:18 +00:00
Tom Hvitved
9f5b8141f0 Rust: Fix bad join
Before
```
Pipeline standard for TypeInference::NonMethodResolution::NonMethodArgsAreInstantiationsOfBlanket::argsAreInstantiationsOfToIndex/4#f6ff35dc@be110b6w was evaluated in 512 iterations totaling 114ms (delta sizes total: 10942).
            8395   ~0%    {5} r1 = JOIN `TypeInference::NonMethodResolution::NonMethodArgsAreInstantiationsOfBlanket::argsAreInstantiationsOfToIndex/4#f6ff35dc#prev_delta` WITH `TypeInference::NonMethodResolution::NonMethodCall.resolveCallTargetBlanketCand/1#dispred#f8b86f2d#prev` ON FIRST 3 OUTPUT Lhs.1, Lhs.2, _, Lhs.0, Lhs.3
            8395   ~0%    {4}    | REWRITE WITH Tmp.2 := 1, Out.2 := (Tmp.2 + In.4) KEEPING 4
            8448   ~0%    {5}    | JOIN WITH `project#TypeInference::NonMethodResolution::NonMethodArgsAreInstantiationsOfBlanket::toCheckRanked/5#52f6d5e0#2_0132#join_rhs` ON FIRST 3 OUTPUT Lhs.3, Rhs.3, Lhs.0, Lhs.1, Lhs.2
            7440   ~0%    {5}    | JOIN WITH TypeInference::NonMethodResolution::NonMethodArgsAreInstantiationsOfBlanket::MkCallAndPos#53e3fb94#prev ON FIRST 2 OUTPUT Rhs.2, Lhs.2, Lhs.0, Lhs.3, Lhs.4
               0   ~0%    {4}    | JOIN WITH `TypeInference::NonMethodResolution::NonMethodArgsAreInstantiationsOfBlanket::ArgIsInstantiationOfToIndex::ArgSubstIsInstantiationOf::isInstantiationOf/3#5154f0d6#prev` ON FIRST 2 OUTPUT Lhs.2, Lhs.1, Lhs.3, Lhs.4

            2937   ~0%    {5} r2 = JOIN TypeInference::NonMethodResolution::NonMethodArgsAreInstantiationsOfBlanket::MkCallAndPos#53e3fb94#prev_delta WITH `TypeInference::NonMethodResolution::NonMethodCall.resolveCallTargetBlanketCand/1#dispred#f8b86f2d#prev` ON FIRST 1 OUTPUT Lhs.2, Rhs.1, Lhs.0, Lhs.1, Rhs.2
               0   ~0%    {4}    | JOIN WITH `TypeInference::NonMethodResolution::NonMethodArgsAreInstantiationsOfBlanket::ArgIsInstantiationOfToIndex::ArgSubstIsInstantiationOf::isInstantiationOf/3#5154f0d6#prev` ON FIRST 2 OUTPUT Lhs.1, Lhs.4, Lhs.3, Lhs.2

               0   ~0%    {6} r3 = JOIN r2 WITH `project#TypeInference::NonMethodResolution::NonMethodArgsAreInstantiationsOfBlanket::toCheckRanked/5#52f6d5e0#2` ON FIRST 3 OUTPUT Lhs.3, Lhs.2, Lhs.0, Lhs.1, Rhs.3, _
                          {5}    | REWRITE WITH Tmp.5 := 0, TEST InOut.4 = Tmp.5 KEEPING 5
               0   ~0%    {5}    | SCAN OUTPUT In.2, In.3, In.1, _, In.0
               0   ~0%    {5}    | REWRITE WITH Out.3 := 0
               0   ~0%    {4}    | JOIN WITH `project#TypeInference::NonMethodResolution::NonMethodArgsAreInstantiationsOfBlanket::toCheckRanked/5#52f6d5e0#2` ON FIRST 4 OUTPUT Lhs.4, Lhs.0, Lhs.1, _
               0   ~0%    {4}    | REWRITE WITH Out.3 := 0

           12463   ~0%    {2} r4 = SCAN `TypeInference::NonMethodResolution::NonMethodArgsAreInstantiationsOfBlanket::ArgIsInstantiationOfToIndex::ArgSubstIsInstantiationOf::isInstantiationOf/3#5154f0d6#prev_delta` OUTPUT In.1, In.0
        22532135   ~0%    {4}    | JOIN WITH `TypeInference::NonMethodResolution::NonMethodCall.resolveCallTargetBlanketCand/1#dispred#f8b86f2d#reorder_1_0_2#prev` ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Lhs.0, Rhs.2
           12463   ~0%    {4}    | JOIN WITH TypeInference::NonMethodResolution::NonMethodArgsAreInstantiationsOfBlanket::MkCallAndPos#53e3fb94#reorder_0_2_1#prev ON FIRST 2 OUTPUT Lhs.2, Lhs.3, Rhs.2, Lhs.0

           12463   ~2%    {6} r5 = JOIN r4 WITH `project#TypeInference::NonMethodResolution::NonMethodArgsAreInstantiationsOfBlanket::toCheckRanked/5#52f6d5e0#2` ON FIRST 3 OUTPUT Lhs.0, Lhs.3, Lhs.1, Lhs.2, Rhs.3, _
                          {5}    | REWRITE WITH Tmp.5 := 0, TEST InOut.4 = Tmp.5 KEEPING 5
            4285   ~0%    {5}    | SCAN OUTPUT In.0, In.2, In.3, _, In.1
            4285   ~0%    {5}    | REWRITE WITH Out.3 := 0
            4285   ~1%    {4}    | JOIN WITH `project#TypeInference::NonMethodResolution::NonMethodArgsAreInstantiationsOfBlanket::toCheckRanked/5#52f6d5e0#2` ON FIRST 4 OUTPUT Lhs.4, Lhs.0, Lhs.1, _
            4285   ~1%    {4}    | REWRITE WITH Out.3 := 0

               0   ~0%    {4} r6 = JOIN r2 WITH `project#TypeInference::NonMethodResolution::NonMethodArgsAreInstantiationsOfBlanket::toCheckRanked/5#52f6d5e0#2` ON FIRST 3 OUTPUT Lhs.3, Lhs.0, Lhs.1, Rhs.3
               0   ~0%    {6}    | JOIN WITH `TypeInference::NonMethodResolution::NonMethodArgsAreInstantiationsOfBlanket::argsAreInstantiationsOfToIndex/4#f6ff35dc#prev` ON FIRST 3 OUTPUT Lhs.0, Lhs.1, Lhs.2, Lhs.3, Rhs.3, _
                          {6}    | REWRITE WITH Tmp.5 := 1, Out.5 := (InOut.3 - Tmp.5), TEST Out.5 = InOut.4
               0   ~0%    {4}    | SCAN OUTPUT In.0, In.1, In.2, In.3

           12463  ~45%    {4} r7 = JOIN r4 WITH `project#TypeInference::NonMethodResolution::NonMethodArgsAreInstantiationsOfBlanket::toCheckRanked/5#52f6d5e0#2` ON FIRST 3 OUTPUT Lhs.3, Lhs.0, Lhs.1, Rhs.3
            8178  ~50%    {6}    | JOIN WITH `TypeInference::NonMethodResolution::NonMethodArgsAreInstantiationsOfBlanket::argsAreInstantiationsOfToIndex/4#f6ff35dc#prev` ON FIRST 3 OUTPUT Lhs.1, Lhs.0, Lhs.2, Lhs.3, Rhs.3, _
                          {6}    | REWRITE WITH Tmp.5 := 1, Out.5 := (InOut.3 - Tmp.5), TEST Out.5 = InOut.4
            7428  ~58%    {4}    | SCAN OUTPUT In.1, In.0, In.2, In.3

            4264   ~0%    {3} r8 = SCAN `TypeInference::NonMethodResolution::NonMethodCall.resolveCallTargetBlanketCand/1#dispred#f8b86f2d#prev_delta` OUTPUT In.1, In.2, In.0

            4312   ~0%    {5} r9 = JOIN r8 WITH `_project#TypeInference::NonMethodResolution::NonMethodArgsAreInstantiationsOfBlanket::toCheckRanked/__#join_rhs#1` ON FIRST 2 OUTPUT Lhs.0, Lhs.1, Rhs.2, _, Lhs.2
            4312   ~0%    {5}    | REWRITE WITH Out.3 := 0
            4312   ~0%    {5}    | JOIN WITH `project#TypeInference::NonMethodResolution::NonMethodArgsAreInstantiationsOfBlanket::toCheckRanked/5#52f6d5e0#2` ON FIRST 4 OUTPUT Lhs.4, Lhs.2, Lhs.0, Lhs.1, _
            4312   ~0%    {5}    | REWRITE WITH Out.4 := 0

           12760   ~0%    {5} r10 = JOIN r8 WITH `project#TypeInference::NonMethodResolution::NonMethodArgsAreInstantiationsOfBlanket::toCheckRanked/5#52f6d5e0#2` ON FIRST 2 OUTPUT Lhs.2, Lhs.0, Lhs.1, Rhs.2, Rhs.3
               0   ~0%    {7}    | JOIN WITH `TypeInference::NonMethodResolution::NonMethodArgsAreInstantiationsOfBlanket::argsAreInstantiationsOfToIndex/4#f6ff35dc#prev` ON FIRST 3 OUTPUT Lhs.1, Lhs.2, Lhs.3, Lhs.4, Lhs.0, Rhs.3, _
                          {7}    | REWRITE WITH Tmp.6 := 1, Out.6 := (InOut.3 - Tmp.6), TEST Out.6 = InOut.5
               0   ~0%    {5}    | SCAN OUTPUT In.4, In.2, In.0, In.1, In.3

            4312   ~0%    {5} r11 = r9 UNION r10
            4288   ~0%    {5}    | JOIN WITH TypeInference::NonMethodResolution::NonMethodArgsAreInstantiationsOfBlanket::MkCallAndPos#53e3fb94#prev ON FIRST 2 OUTPUT Rhs.2, Lhs.2, Lhs.3, Lhs.4, Lhs.0
               0   ~0%    {4}    | JOIN WITH `TypeInference::NonMethodResolution::NonMethodArgsAreInstantiationsOfBlanket::ArgIsInstantiationOfToIndex::ArgSubstIsInstantiationOf::isInstantiationOf/3#5154f0d6#prev` ON FIRST 2 OUTPUT Lhs.4, Lhs.1, Lhs.2, Lhs.3

           11713  ~36%    {4} r12 = r1 UNION r3 UNION r5 UNION r6 UNION r7 UNION r11
           10942  ~39%    {4}    | AND NOT `TypeInference::NonMethodResolution::NonMethodArgsAreInstantiationsOfBlanket::argsAreInstantiationsOfToIndex/4#f6ff35dc#prev`(FIRST 4)
                          return r12
```

After
```
Pipeline standard for TypeInference::NonMethodResolution::NonMethodArgsAreInstantiationsOfBlanket::argsAreInstantiationsOfToIndex/4#f6ff35dc@07309ry7 was evaluated in 168 iterations totaling 145ms (delta sizes total: 8395).
        12517   ~0%    {6} r1 = SCAN `TypeInference::NonMethodResolution::NonMethodArgsAreInstantiationsOfBlanket::argIsInstantiationOf/5#efdc1fbb#reorder_0_2_3_4_1#prev_delta` OUTPUT In.0, In.1, In.2, In.3, In.4, _
         4337   ~0%    {5}    | REWRITE WITH Tmp.5 := 0, TEST InOut.3 = Tmp.5 KEEPING 5
         4285   ~1%    {4}    | JOIN WITH `TypeInference::NonMethodResolution::NonMethodCall.resolveCallTargetBlanketCand/1#dispred#f8b86f2d#prev` ON FIRST 3 OUTPUT Lhs.0, Lhs.1, Lhs.2, _
         4285   ~1%    {4}    | REWRITE WITH Out.3 := 0

            0   ~0%    {4} r2 = JOIN `TypeInference::NonMethodResolution::NonMethodCall.resolveCallTargetBlanketCand/1#dispred#f8b86f2d#prev_delta` WITH `TypeInference::NonMethodResolution::NonMethodArgsAreInstantiationsOfBlanket::argIsInstantiationOf/5#efdc1fbb#reorder_0_2_3_4_1#prev` ON FIRST 3 OUTPUT Lhs.0, Lhs.1, Lhs.2, Rhs.3

            0   ~0%    {5} r3 = SCAN r2 OUTPUT In.0, In.1, In.2, In.3, _
                       {4}    | REWRITE WITH Tmp.4 := 0, TEST InOut.3 = Tmp.4 KEEPING 4
            0   ~0%    {4}    | SCAN OUTPUT In.0, In.1, In.2, _
            0   ~0%    {4}    | REWRITE WITH Out.3 := 0

         8395   ~0%    {5} r4 = JOIN `TypeInference::NonMethodResolution::NonMethodArgsAreInstantiationsOfBlanket::argsAreInstantiationsOfToIndex/4#f6ff35dc#prev_delta` WITH `TypeInference::NonMethodResolution::NonMethodCall.resolveCallTargetBlanketCand/1#dispred#f8b86f2d#prev` ON FIRST 3 OUTPUT Lhs.0, Lhs.1, Lhs.2, _, Lhs.3
         8395   ~0%    {4}    | REWRITE WITH Tmp.3 := 1, Out.3 := (Tmp.3 + In.4) KEEPING 4
            0   ~0%    {4}    | JOIN WITH `TypeInference::NonMethodResolution::NonMethodArgsAreInstantiationsOfBlanket::argIsInstantiationOf/5#efdc1fbb#reorder_0_2_3_4_1#prev` ON FIRST 4 OUTPUT Lhs.0, Lhs.1, Lhs.2, Lhs.3

            0   ~0%    {6} r5 = JOIN r2 WITH `TypeInference::NonMethodResolution::NonMethodArgsAreInstantiationsOfBlanket::argsAreInstantiationsOfToIndex/4#f6ff35dc#prev` ON FIRST 3 OUTPUT Lhs.0, Lhs.1, Lhs.2, Lhs.3, Rhs.3, _
                       {6}    | REWRITE WITH Tmp.5 := 1, Out.5 := (InOut.3 - Tmp.5), TEST Out.5 = InOut.4
            0   ~0%    {4}    | SCAN OUTPUT In.0, In.1, In.2, In.3

        12517  ~18%    {4} r6 = SCAN `TypeInference::NonMethodResolution::NonMethodArgsAreInstantiationsOfBlanket::argIsInstantiationOf/5#efdc1fbb#reorder_0_2_3_4_1#prev_delta` OUTPUT In.0, In.1, In.2, In.3
        11759  ~12%    {4}    | JOIN WITH `TypeInference::NonMethodResolution::NonMethodCall.resolveCallTargetBlanketCand/1#dispred#f8b86f2d#prev` ON FIRST 3 OUTPUT Lhs.0, Lhs.1, Lhs.2, Lhs.3
         9874  ~12%    {6}    | JOIN WITH `TypeInference::NonMethodResolution::NonMethodArgsAreInstantiationsOfBlanket::argsAreInstantiationsOfToIndex/4#f6ff35dc#prev` ON FIRST 3 OUTPUT Lhs.0, Lhs.1, Lhs.2, Lhs.3, Rhs.3, _
                       {6}    | REWRITE WITH Tmp.5 := 1, Out.5 := (InOut.3 - Tmp.5), TEST Out.5 = InOut.4
         7476  ~18%    {4}    | SCAN OUTPUT In.0, In.1, In.2, In.3

        11761  ~12%    {4} r7 = r1 UNION r3 UNION r4 UNION r5 UNION r6
         8395   ~0%    {4}    | AND NOT `TypeInference::NonMethodResolution::NonMethodArgsAreInstantiationsOfBlanket::argsAreInstantiationsOfToIndex/4#f6ff35dc#prev`(FIRST 4)
                       return r7
```
2026-02-11 16:11:30 +01:00
Owen Mansel-Chan
6a8204d28c "dataflow" -> "data flow" in QLDoc 2026-02-11 13:41:14 +00:00
Owen Mansel-Chan
1ee5728311 Add missing QLDoc 2026-02-11 13:40:20 +00:00
Owen Mansel-Chan
a22fd39230 Use RegexExecution in sanitizer definitions (expands scope) 2026-02-11 13:09:48 +00:00
Owen Mansel-Chan
fa3fba4a00 Use new regex-related classes (no functional change) 2026-02-11 13:09:46 +00:00
Owen Mansel-Chan
44eeee5757 Add and improve classes for regex-related methods 2026-02-11 13:09:45 +00:00
Owen Mansel-Chan
e6dbd525c3 Add RegexExecution in Concepts.qll 2026-02-11 13:09:42 +00:00
Simon Friis Vindum
522e4d64de Merge pull request #21273 from paldepind/rust/tp-assoc
Rust: Implement support for associated types accessed on type parameters
2026-02-11 13:39:55 +01:00
Chris Smowton
bed1ec8981 Enhance path validation recommendations
Expanded recommendations for validating user input when constructing file paths, including normalization and using allowlists.
2026-02-11 12:10:08 +00:00
Simon Friis Vindum
6c67475352 Rust: Minor tweaks in type inference 2026-02-11 12:32:54 +01:00
Simon Friis Vindum
287a8717a8 Rust: Apply suggestions from code review
Co-authored-by: Tom Hvitved <hvitved@github.com>
2026-02-11 12:19:22 +01:00
Philip Ginsbach-Chen
9ed22610a3 Merge pull request #21306 from github/ginsbach/avoid-nontrivially-shadowing-toString
Avoid non-trivially shadowing `string.toString()`
2026-02-11 11:03:07 +00:00
Tom Hvitved
36c3084435 Merge pull request #21305 from hvitved/rust/type-inference-speedup
Rust: Speedup `inferMethodCallTypeSelf`
2026-02-11 11:03:06 +01:00
Tom Hvitved
37af38eed5 Merge pull request #21282 from hvitved/rust/path-resolution/type-inference-expectations
Rust: Distinguish path resolution expectations from type inference expectations
2026-02-11 11:00:28 +01:00
Tom Hvitved
89e9a253eb Rust: Distinguish path resolution expectations from type inference expectations 2026-02-11 10:33:41 +01:00
Paolo Tranquilli
40b908494c Merge branch 'main' into redsun82/bazel-9 2026-02-11 09:29:52 +01:00
Paolo Tranquilli
000d8244c4 address review 2026-02-11 09:29:42 +01:00
Simon Friis Vindum
2fa71f0c17 Rust: Add examples with associated type accessed on associated type 2026-02-11 09:10:21 +01:00
Simon Friis Vindum
2b10c8aef3 Rust: Fix gramar in qldoc 2026-02-11 09:09:34 +01:00
Michael Nebel
0ac1bc4c57 Merge pull request #21299 from microsoft/lwsimpkins/csharp-mad-httputility-upstream
Update MaD for System.Web.HttpUtility
2026-02-11 08:47:29 +01:00
Anders Schack-Mulligen
cfa62ae434 Merge pull request #21304 from aschackmull/java/deprecation-followup
Java: Add delayed deprecation annotation.
2026-02-11 08:40:01 +01:00
Owen Mansel-Chan
766dc94444 Merge pull request #21150 from github/jketema/go-1.26
Go: Update to 1.26
2026-02-11 04:37:31 +00:00
Owen Mansel-Chan
542d4631d7 restore ~ in action.yml version 2026-02-10 22:32:36 +00:00
Owen Mansel-Chan
f01d5840b0 Update to 1.26.0 2026-02-10 22:32:33 +00:00
Owen Mansel-Chan
936c4cc79f Fix edge case in MaD validation
If the db contains no pointer types then we were getting spurious model
validation errors.
2026-02-10 22:32:31 +00:00
Owen Mansel-Chan
e1bddd9365 Model newly added functions 2026-02-10 22:32:30 +00:00
Owen Mansel-Chan
22e9c212d6 Add failing tests for newly added functions 2026-02-10 22:32:28 +00:00
Owen Mansel-Chan
26ef33212d Test builtins like standard library 2026-02-10 22:32:27 +00:00
Jeroen Ketema
700543b30b Go: Update supported versions to include 1.26 2026-02-10 22:31:11 +00:00
Jeroen Ketema
22e9b42808 Go: Add change note 2026-02-10 22:31:10 +00:00
Jeroen Ketema
50ed0af9da Go: Bump maxGoVersion to 1.26 2026-02-10 22:31:08 +00:00
Jeroen Ketema
e00e3a87ff Update Go version in tests to 1.26.0 2026-02-10 22:31:00 +00:00
Tom Hvitved
8955fd0bf4 Merge pull request #21303 from hvitved/rust/add-telemetry-tags
Rust: Add `telemtry` tags to queries
2026-02-10 20:13:40 +01:00
REDMOND\brodes
9f9c353806 Update expected files. Copilot suggestions broke unit test expected results (column numbers). 2026-02-10 11:47:23 -05:00
REDMOND\brodes
4bb110beb8 More copilot suggestions. 2026-02-10 11:46:16 -05:00
REDMOND\brodes
a91cf6b7cb Applying copilot PR suggestions. 2026-02-10 11:37:11 -05:00
Ben Rodes
9f8ed710e2 Update python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/test_path_validation.py
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2026-02-10 11:09:25 -05:00
Philip Ginsbach
f60d759a65 Avoid non-trivially shadowing string.toString()
Prepare libraries for a possible deprecation warning on shadowing
string.toString().

These instanceof classes were using this.(Type).method() to call
supertype methods, but super.method() is clearer and equivalent
for instanceof supertypes.
2026-02-10 15:46:10 +00:00
Paolo Tranquilli
e4871fc519 Merge branch 'main' into redsun82/bazel-9 2026-02-10 16:20:28 +01:00
Ian Lynagh
00acff293a Merge pull request #21281 from igfoo/igfoo/discarding
C++ overlay: Discarding elements
2026-02-10 15:14:58 +00:00
Tom Hvitved
49f24ca8ec Rust: Avoid using regexpCapture with multiple capture groups 2026-02-10 16:11:49 +01:00
Tom Hvitved
564a3bd444 Rust: Simplify inferMethodCallTypeSelf 2026-02-10 15:30:56 +01:00
Michael Nebel
ece85854cd Merge pull request #21285 from michaelnebel/csharp14/implicittypedlambdaparametermodifiers
C# 14: [TEST ONLY] Simple lambda parameters with modifiers.
2026-02-10 14:16:19 +01:00
Michael Nebel
c15ad31b07 Merge pull request #21220 from michaelnebel/csharp14/extension
C# 14: Support `extension` types.
2026-02-10 14:15:57 +01:00
Anders Schack-Mulligen
5116b0c1e5 Java: Add delayed deprecation annotation. 2026-02-10 14:02:48 +01:00
Paolo Tranquilli
37261b2f5c fix: sort use_repo alphabetically in rules_kotlin MODULE.bazel 2026-02-10 13:44:07 +01:00
Paolo Tranquilli
b38c3268fb fix: upgrade rules_kotlin to 2.2.2 for Windows compatibility
Upgrade from 2.2.0-codeql.1 to 2.2.2-codeql.1 which includes:
- Fix Windows bzlmod builder classpath issue
- Move to official bazel worker api

This eliminates the need for --legacy_external_runfiles on Windows.

Also fix codegen templates to be included in runfiles.
2026-02-10 13:44:07 +01:00
Paolo Tranquilli
ca90de2bed fix: disable Android SDK auto-detection for Bazel 9 compatibility
rules_android has repository visibility issues with Bazel 9 when the
Android SDK is present. Since we don't use Android, disable detection
by setting ANDROID_HOME to empty.
2026-02-10 13:44:07 +01:00
Paolo Tranquilli
f8ed810a44 refactor: migrate C++ runfiles API from bazel_tools to rules_cc
Bazel 9 moves the C++ runfiles library from @bazel_tools to @rules_cc.
Update zipmerge_test.cpp:
- Change include from tools/cpp/runfiles to rules_cc/cc/runfiles
- Update namespace from bazel::tools::cpp::runfiles to rules_cc::cc::runfiles

Note: The BUILD.bazel dependency change is in a separate commit.
2026-02-10 13:44:06 +01:00