Taus
414e689291
Python: Add AST node wrappers
2025-12-16 23:57:58 +01:00
Taus
652c335d30
Python: Regenerate AST and dbscheme files
2025-12-16 23:57:58 +01:00
Taus
28e733e335
Python: Support template strings in rest of extractor
...
Adds three new AST nodes to the mix:
- `TemplateString` represents a t-string in Python 3.14
- `TemplateStringPart` represents one of the string constituents of a
t-string. (The interpolated expressions are represented as `Expr` nodes,
just like f-strings.)
- `JoinedTemplateString` represents an implicit concatenation of
template strings.
Importantly, we _completely avoid_ the complicated construction we
currently do for format strings (as well as the confusing nomenclature).
No extra injection of empty strings (so that a template string is a
strict alternation of strings and expressions). A `JoinedTemplateString`
simply has a list of template string children, and a `TemplateString`
has a list of "values" which may be either `Expr` or
`TemplateStringPart` nodes.
If we ever find that we actually want the more complicated interface for
these strings, then I would much rather we reconstruct this inside of QL
rather than in the parser.
2025-12-16 23:57:58 +01:00
Taus
cd7ae34380
Python: Regenerate parser files
2025-12-16 23:57:58 +01:00
Taus
7768ebe8b8
Python: Add parser support for template strings
...
- Extends the scanner with a new token kind representing the start of a
template string. This is used to distinguish template strings from
regular strings (because only a template string will start with a
`_template_string_start` external token).
- Cleans up the logic surrounding interpolations (and the method names)
so that format strings and template strings behave the same in this
case.
Finally, we add two new node types in the tree-sitter grammar:
- `template_string` behaves like format strings, but is a distinct type
(mainly so that an implicit concatenation between template strings and
regular strings becomes a syntax error).
- `concatenated_template_string` is the counterpart of
`concatenated_string`.
However, internally, the string parts of a template strings are just the
same `string_content` nodes that are used in regular format strings. We
will disambiguate these inside `tsg-python`.
2025-12-16 23:57:58 +01:00
Jon Janego
576f270753
Update PathCombine.ql
2025-12-16 16:39:06 -06:00
Jon Janego
44d896abaf
Merge pull request #21054 from github/changedocs-2.23.8
...
Changedocs 2.23.8
2025-12-16 12:18:59 -06:00
Jon Janego
c7ec175e10
Minor change to 2.23.1 rst
2025-12-16 11:36:34 -06:00
Jon Janego
92bb40d7e4
Minor revert to 2.23.1 rst
2025-12-16 11:35:35 -06:00
Jon Janego
ff0a0ed373
Adds changelog docs for 2.23.7 and 2.23.8
2025-12-16 11:28:34 -06:00
Jon Janego
30673a2fc8
Enhance PathCombine metadata with detailed description
...
Updated the `name` and `description` of PathCombine.ql to provide more details about the issue.
2025-12-16 10:37:53 -06:00
Jon Janego
84a501d360
Update csharp/ql/src/Bad Practices/PathCombine.ql
...
Co-authored-by: Tom Hvitved <hvitved@github.com >
2025-12-16 09:10:39 -06:00
Simon Friis Vindum
420dd9ab61
Rust: Add change note for Axum models
2025-12-16 15:15:22 +01:00
Simon Friis Vindum
e53bdb11be
Rust: Accept changes to expected files for consistency check
2025-12-16 13:15:34 +01:00
Simon Friis Vindum
63329b47d8
Merge pull request #21036 from paldepind/rust/prioritize-manual-summaries
...
Rust: Don't apply generated models for functions that have a manual model
2025-12-16 12:47:27 +01:00
Simon Friis Vindum
cbdab99497
Rust: Add XSS sink for Axum HTML response creation
2025-12-16 12:41:44 +01:00
Simon Friis Vindum
fbf9f7eda7
Rust: Add models for Axum
2025-12-16 12:41:32 +01:00
Simon Friis Vindum
0ea06aca06
Rust: Introduce more functions in Axum test
2025-12-16 12:32:40 +01:00
Paolo Tranquilli
6fc963177c
codegen: mention Rust in the README
...
Updated README to reflect support for the Rust extractor and added details about Rust generated files.
2025-12-16 11:05:39 +01:00
Michael Nebel
7df1d7a13f
C#: Address review comment.
2025-12-16 10:21:08 +01:00
Simon Friis Vindum
8c4b81ebc7
Rust: Fix typo in comment
...
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2025-12-16 10:19:01 +01:00
yoff
cbc0100675
Apply suggestion from @Copilot
2025-12-16 10:11:05 +01:00
yoff
50e9057db1
java: add change note
2025-12-16 10:11:05 +01:00
yoff
c6240e5a99
java: understand more initializers
...
Whne a fiels is assigned a safe type in a constructor,
that field is not exposed.
2025-12-16 10:11:05 +01:00
yoff
a65d385297
java: add tests for thread safe initialisation
...
Co-authored-by: Raúl Pardo <raul.pardo@protonmail.com >
2025-12-16 10:11:05 +01:00
Simon Friis Vindum
477e1cd96c
Rust: Fix manual model for PathBuf::as_path
2025-12-16 09:25:42 +01:00
Jon Janego
bd9b657e91
Update csharp/ql/src/Bad Practices/PathCombine.ql
...
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2025-12-15 15:20:52 -06:00
Jon Janego
f6e3e192ca
Clarify Path.Combine call behavior in documentation
...
Updated the name and description to clarify the issue with Path.Combine.
2025-12-15 15:18:34 -06:00
Tom Hvitved
d709343d38
Merge pull request #21011 from aschackmull/mad/shared-externalflow
...
Java/C++/Go/C#: Share parts of ExternalFlow.qll
2025-12-15 20:27:04 +01:00
Tom Hvitved
74ed18a89f
Merge pull request #21035 from hvitved/rust/ord-models
...
Rust: Add models for `core::cmp::Ord::{min,max,clamp}`
2025-12-15 17:09:33 +01:00
Jeroen Ketema
294de742a4
Swift: Update to Swift 6.2.3
2025-12-15 17:00:50 +01:00
Simon Friis Vindum
1b70111dd2
Rust: Don't apply generated models for functions that have a manual model
2025-12-15 14:25:49 +01:00
Simon Friis Vindum
d2cfd53933
Rust: Add test with wrong generated model
2025-12-15 14:23:48 +01:00
Tom Hvitved
86a4d42316
Rust: Remove obsolete comment from test
2025-12-15 13:10:41 +01:00
Tom Hvitved
3239afb278
Rust: Also use specialized types when inferring types for calls
2025-12-15 13:10:37 +01:00
Tom Hvitved
8e2d9d50b7
Rust: Add type inference test
2025-12-15 13:09:21 +01:00
Óscar San José
2824c98efb
Merge pull request #21025 from github/oscarsj/mergeback-rc-3-20-into-main
...
Mergeback rc/3.20 into main
2025-12-15 11:59:58 +01:00
Tom Hvitved
fc49360e81
Rust: Add models for core::cmp::Ord::{min,max,clamp}
2025-12-15 11:52:05 +01:00
Michael Nebel
70447c6483
Merge pull request #21026 from michaelnebel/csharp/migratesolution
...
C#: Migrate our own solution file to `.slnx`.
2025-12-15 11:01:35 +01:00
Geoffrey White
93e8534d0a
Merge pull request #21009 from geoffw0/varfps
...
Rust: Fix some false positives for rust/unused-variable and rust/unused-value
2025-12-15 09:48:47 +00:00
Geoffrey White
01f9b42472
Merge branch 'main' into varfps
2025-12-15 08:49:16 +00:00
Michael Nebel
949cfc3fbd
Merge pull request #21031 from github/workflow/coverage/update
...
Update CSV framework coverage reports
2025-12-15 09:12:24 +01:00
github-actions[bot]
f7bbddec24
Add changed framework coverage reports
2025-12-15 00:27:40 +00:00
Owen Mansel-Chan
af2fbd8dda
Merge pull request #20929 from owen-mc/go/fix-data-flow-consistency-checks
...
Go: fix small issues highlighted by data flow consistency checks
2025-12-12 17:01:43 +00:00
Mathias Vorreiter Pedersen
3ea92eada6
Merge pull request #21024 from MathiasVP/csharp-implicit-map-value-reads
...
C#: Add implicit `System.Collections.Generic.KeyValuePair2.Value` reads at taint sinks
2025-12-12 16:46:12 +00:00
Tom Hvitved
b61a439491
Merge pull request #21020 from hvitved/shared/source-sink-provenance-prio
...
Shared: Prefer source/sink models with manual provenance over generated
2025-12-12 16:01:06 +01:00
Michael Nebel
e417938860
C#: Exclude all test projects from the Release build configuration.
2025-12-12 14:25:15 +01:00
Michael Nebel
7f1a9b57f1
C#: Update the default solution to point to the .slnx file instead.
2025-12-12 14:23:23 +01:00
Michael Nebel
1e43d06c6d
C#: Migrate CSharp.sln to CSharp.slnx (as is).
2025-12-12 14:22:51 +01:00
Anders Schack-Mulligen
64a48e4e7b
MaD: Use "namespace" instead "package" in shared code.
2025-12-12 13:57:02 +01:00
