Commit Graph

87608 Commits

Author SHA1 Message Date
Geoffrey White
ea711b032b Javascript: Accept test changes (regression). 2026-05-07 10:13:09 +01:00
Geoffrey White
0f8b0a7fdd Swift: Accept test changes (improvement). 2026-05-07 10:12:48 +01:00
Geoffrey White
7c728981f1 Merge remote-tracking branch 'upstream/main' into extsensitive 2026-05-07 10:02:15 +01:00
Geoffrey White
809da0f8e7 Shared: Autoformat. 2026-05-07 10:01:56 +01:00
Taus
957c89b478 yeast: Support multi-phase desugaring via DesugaringConfig::add_phase
Extend the desugaring config from a single flat list of rules to an
ordered sequence of named Phases. Each phase runs to completion (a
full traversal applying its rules) before the next phase starts.
Rules in different phases never compete for matches.

The config is built via the new chainable API:

    DesugaringConfig::new()
        .add_phase("cleanup", cleanup_rules)
        .add_phase("desugar", desugar_rules)
        .with_output_node_types_yaml(yaml);

Single-phase configs are just .add_phase(...) called once.

A single FreshScope is shared across phases so generated identifier
names (e.g. $tmp-N) are unique throughout the run.

Phase names appear in error messages, e.g. "Phase `desugar`:
exceeded maximum rewrite depth".

Add two regression tests: one verifying basic two-phase chained
desugaring, and one verifying that errors include the failing phase
name.
2026-05-06 21:17:31 +00:00
Geoffrey White
f2f4f4cce3 Shared: Add 'security_code' sensitive data heuristic. 2026-05-06 14:48:55 +01:00
Geoffrey White
5ed78d1a4a Shared: Fix and simplify the exclusion for 'encrypted' values. 2026-05-06 14:43:52 +01:00
Geoffrey White
6e2fb6f0ff Shared: Fix for 'coauthor'. 2026-05-06 14:34:18 +01:00
Geoffrey White
213ab902cd Shared: Fix for 'api_tok'. 2026-05-06 14:34:15 +01:00
Geoffrey White
b60ce3cf04 Shared: Fix for 'profile'. 2026-05-06 14:33:25 +01:00
Geoffrey White
cb84e633fa Shared: Fix for 'wildcard'. 2026-05-06 14:32:24 +01:00
Geoffrey White
07d4df18b9 Shared: Add 'card.?no' sensitive data heuristic. 2026-05-06 14:32:21 +01:00
Geoffrey White
d95001f406 Rust: Additional test cases for sensitive data heuristics. 2026-05-06 14:31:47 +01:00
Taus
9a94836974 yeast: Add per-rule .repeated() flag to opt into iterative matching
Previously, after a rule fired the engine would always re-try that
same rule on the result root. A rule whose output matched its own
query (intentionally or by accident) would loop until the global
MAX_REWRITE_DEPTH safety net kicked in.

Make the default behavior fire-once-per-node: after a rule fires on
node N, the engine no longer tries that same rule on the result root.
Other rules and child traversal are unaffected. Rules that
intentionally rewrite iteratively can opt into the old behavior via
the new Rule::repeated() builder method.

Add two regression tests using a self-swapping assignment rule:
- with .repeated(), the swap loops and trips the depth limit
- without it (default), the swap fires once and terminates
2026-05-06 12:33:18 +00:00
Taus
a0a0e9e9a7 yeast: Add test for chained rules with output-only kinds
Adds a regression test verifying that desugaring rules can chain across
output-only node kinds: a first rule rewrites an input kind to an
output-only kind, and a second rule then rewrites that output-only
kind into another output-only kind. This exercises the schema lookup
for query patterns whose root kind is not present in the input
tree-sitter grammar.
2026-05-06 11:45:53 +00:00
Taus
60dcf88b50 yeast: Add Bazel build rules for yeast crates
Add BUILD.bazel files for the yeast and yeast-macros crates, register
them as dependencies of the shared tree-sitter extractor, and refresh
the vendored crate dependencies via update_tree_sitter_extractors_deps.sh.
2026-05-06 11:34:09 +00:00
Taus
82bbdee832 yeast: Support separate output node types in extractor generator
Language and LanguageSpec gain optional output_node_types field.
When set, the generator produces dbscheme/QL from the output types
and the extractor validates TRAP against them.

All existing extractors pass None (no behavior change).
Ruby extract() calls gain vec![] for the new rules parameter.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-05-06 11:34:09 +00:00
Taus
9ad431dea1 yeast: Integrate yeast with shared tree-sitter extractor
extract() gains a rules parameter. When empty, uses tree-sitter native
traversal (no behavior change). When non-empty, runs yeast desugaring
and extracts via traverse_yeast.

Adds AstNode trait abstracting over tree_sitter::Node and yeast::Node,
with minimal changes to existing Visitor methods (Node -> &N in 6
signatures).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-05-06 11:34:09 +00:00
Taus
cc28ff9a48 yeast: Add yeast documentation
Covers architecture, query language, template language
(tree!/trees!/rule!),
capture semantics, fresh identifiers, and extractor integration.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-05-06 11:34:09 +00:00
Taus
6e580446fd yeast: Add yeast test suite
12 tests covering parsing, queries, tree building, desugaring rules,
cursor navigation, and the shorthand rule! syntax.

Tests use a custom output node-types.yml with named fields for all
children (parameter, stmt, index), loaded via
schema_from_yaml_with_language.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-05-06 11:34:09 +00:00
Taus
4c5548363c yeast: Add AST dumper for human-readable tree output
Produces indented text showing node kinds, named fields, and leaf
content. Unnamed tokens are hidden unless inside a named field.
Used by tests for readable assertions.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-05-06 11:34:09 +00:00
Taus
8a9e53cc58 yeast: Add YAML node-types format and converter
Human-friendly YAML alternative to tree-sitter node-types.json with
three sections: supertypes, named, unnamed. Supports bidirectional
conversion and building Schema objects from YAML.

Includes CLI binary (node_types_yaml) and documentation.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-05-06 11:34:09 +00:00
Taus
04f587190e yeast: AST desugaring framework with proc-macro DSL
YEAST (YEAST Elaborates Abstract Syntax Trees) is a framework for
transforming tree-sitter parse trees before CodeQL extraction.

Core components:
- shared/yeast/ — Ast, Node, Schema, query matching engine, captures,
  FreshScope, BuildCtx
- shared/yeast-macros/ — proc macros: query!, tree!, trees!, rule!

The query language is inspired by tree-sitter queries:
  (assignment left: (_) @lhs right: (_) @rhs)

Templates support embedded Rust ({expr}), splicing ({..expr}),
computed literals (#{expr}), and fresh identifiers ($name).

The rule! macro combines query and transform:
  rule!((for pattern: (_) @pat ...) => (call receiver: {val} ...))

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-05-06 11:34:09 +00:00
Owen Mansel-Chan
e6f587e761 Merge pull request #21715 from knewbury01/knewbury01/adjust-actions-queries-untrusted-checkout
Improve actions/ql/src/Security/CWE-829/UntrustedCheckoutX queries
2026-05-06 11:52:30 +01:00
Jack Nørskov Jørgensen
2d2b690b5d Merge pull request #21799 from github/jacknojo/fix_python_formatting
Fix issue with Python formatting and expand scope of python-tooling
2026-05-06 12:24:21 +02:00
Geoffrey White
dc863c39a9 Swift: Add test cases for an alternative pattern of calls to Insecure.MD5.hash. 2026-05-06 10:27:54 +01:00
Geoffrey White
b6155ff443 Swift: Test spacing. 2026-05-06 10:27:06 +01:00
Jack Nørskov Jørgensen
52b02a0581 Fix path to generated models 2026-05-06 08:39:41 +02:00
Tom Hvitved
00fb11b028 Merge pull request #21778 from hvitved/rust/type-inference-verbose-type-path-expectations
Rust: Use verbose type paths in inline expectation comments
2026-05-05 20:23:25 +02:00
Kristen Newbury
3f44a23cf2 Adjust alert location UntrustedCheckoutCritical 2026-05-05 13:35:52 -04:00
Kristen Newbury
6a8f9a950c Fix unit test expected file 2026-05-05 13:27:09 -04:00
Jack Nørskov Jørgensen
ebc759d830 Fix issue with Python formatting and expand scope of python-tooling 2026-05-05 16:14:05 +02:00
github-actions[bot]
7610277199 Post-release preparation for codeql-cli-2.25.4 2026-05-05 10:10:06 +00:00
Paolo Tranquilli
6a95251206 Merge pull request #21793 from github/release-prep/2.25.4
Release preparation for version 2.25.4
codeql-cli/v2.25.4
2026-05-05 11:39:13 +02:00
github-actions[bot]
88e1d86c27 Release preparation for version 2.25.4 2026-05-05 09:34:30 +00:00
Tom Hvitved
4c1461ad5b Merge pull request #21786 from hvitved/inline-test-ignore-tags
Inline test expectations: Rename `tagIsOptional` to `tagIsIgnored`
2026-05-05 09:01:58 +02:00
Kristen Newbury
f9f1349a0d Undo larger change in this PR 2026-05-04 16:50:55 -04:00
Kristen Newbury
39b6cf9468 Address review comments 2026-05-04 16:47:44 -04:00
Anders Schack-Mulligen
b67ebd11e0 Merge pull request #21762 from aschackmull/csharp/ssa2
C#: Replace SSA classes with shared code.
2026-05-04 14:21:01 +02:00
MarkLee131
467394123c Merge branch 'main' into fix/path-injection-read-subkind 2026-05-04 18:56:12 +08:00
Anders Schack-Mulligen
02f5fe9a42 C#: Address some review comments. 2026-05-04 11:49:24 +02:00
Tom Hvitved
04a8ef0f81 Merge pull request #21777 from hvitved/swift/type-inference-tests
Swift: Add type inference tests
2026-05-04 11:45:32 +02:00
Anders Schack-Mulligen
f663eccf66 Merge pull request #21781 from aschackmull/java/rm-deprecated
Java: Delete old deprecated code.
2026-05-04 11:35:09 +02:00
Tom Hvitved
80ccdcc696 Inline test expectations: Rename tagIsOptional to tagIsIgnored 2026-05-04 11:21:33 +02:00
Tom Hvitved
224934645e Swift: Add type inference tests for key path expressions 2026-05-04 11:00:38 +02:00
Tom Hvitved
038f9a2c2f Swift: Split type inference tests into multiple files 2026-05-04 10:55:06 +02:00
Anders Schack-Mulligen
c7904b12c8 Java: Fix reference in deprecated code. 2026-05-04 10:52:27 +02:00
Anders Schack-Mulligen
17fded4aa5 Java: Delete old deprecated code. 2026-05-04 10:52:27 +02:00
Paolo Tranquilli
77cdafd55e Merge pull request #21785 from github/codeql-spark-run-25308467256
Update changelog documentation site for codeql-cli-2.25.3
2026-05-04 10:42:33 +02:00
Paolo Tranquilli
1c20e78593 Docs: replace build mode: none with build-mode: none 2026-05-04 10:26:50 +02:00