hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-07-09 21:45:33 +02:00
Code Issues Packages Projects Releases Wiki Activity
88,267 Commits 1,801 Branches 170 Tags
codeql-cli/v2.26.0
Commit Graph

88267 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Sotiris Dragonas
8f965a9614 Grammar 
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-06-16 11:57:58 +03:00
Sotiris Dragonas
d72372c246 Fix system prompt injection description and title 
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-06-16 11:57:37 +03:00
Jeroen Ketema
ef67311af2 Swift: Filter more clang options not recognized by off-the-shelf clang 2026-06-16 10:56:32 +02:00
Tom Hvitved
ae57ca7e65 Merge pull request #21907 from hvitved/ruby/implicit-local-fix 
Ruby: Fix bug in `implicitAssignmentNode`
 2026-06-16 09:41:12 +02:00
Tom Hvitved
d287f0cf0b Merge pull request #21987 from hvitved/type-flow-ranking 
Java: Fix performance issue in type flow library
 2026-06-16 09:39:30 +02:00
Tom Hvitved
f143dad1b2 Apply suggestions from code review 
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-06-16 08:57:37 +02:00
Michael Nebel
01454d76c2 Merge pull request #21881 from michaelnebel/csharp/propertycalls 
C#: Property- and Indexer call targets for partial overrides.
 2026-06-16 08:46:33 +02:00
Michael Nebel
859ad1d8d0 Merge pull request #21877 from michaelnebel/csharp/spanaccessrange 
C#: Extract `.Slice` method call when using a span in conjunction with a range.
 2026-06-16 08:42:57 +02:00
Owen Mansel-Chan
b10abb63d9 Add SPURIOUS and MISSING to some comments 2026-06-16 00:28:40 +01:00
copilot-swe-agent[bot]
44e23638a4 Convert Swift .qlref tests to inline expectation tests 2026-06-16 00:08:39 +01:00
Owen Mansel-Chan
5e606b7bef Don't use inline expectations when alerts in erb files 2026-06-15 23:03:50 +01:00
copilot-swe-agent[bot]
84e7c2de6c Convert Ruby qlref tests to inline expectations 2026-06-15 23:03:46 +01:00
Owen Mansel-Chan
0df9aac69c Merge pull request #21988 from owen-mc/ql/convert-qlref-tests-inline-expectations 
QL: Convert qlref tests to inline expectations
 2026-06-15 21:09:44 +01:00
Owen Mansel-Chan
bc9fa6ba13 Fix bug in inline expectations test implementation 
This was stopping trailing comments, as in `// $ Alert // some comment`, from working.
 2026-06-15 21:08:08 +01:00
Chad Bentz
c08c0e9ae5 Merge branch 'main' into felickz/razor-page-handler-sources 2026-06-15 11:35:54 -04:00
Chad Bentz
4f1d6f472d Fix test comments: replace GOOD/BAD markers with flow source descriptions 
Per review feedback, GOOD/BAD markers don't apply to flow source
enumeration tests. Use descriptive comments instead.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-06-15 11:34:43 -04:00
Owen Mansel-Chan
78d95719a5 Do not convert test that is example of not using inline expectations 2026-06-15 16:18:24 +01:00
Michael Nebel
c31b594bbc C#: Address review comments. 2026-06-15 16:17:46 +02:00
Michael Nebel
66db0d42a9 C#: Address review comment. 2026-06-15 15:41:19 +02:00
Asger F
7039c4a2be Merge pull request #21981 from asgerf/yeast/comments 
Yeast/Unified: Extract comments
 2026-06-15 15:25:35 +02:00
Michael Nebel
746631d3dc Merge pull request #21989 from michaelnebel/csharp/compoundmad 
C#: Add models as data tests for compound assignment operators.
 2026-06-15 14:57:04 +02:00
Jeroen Ketema
b9b15af308 Java: Use fixture for filtering diagnostics 2026-06-15 14:51:52 +02:00
copilot-swe-agent[bot]
f658bc9b39 Update expected files for CaseElseBranch AST node change 2026-06-15 12:11:22 +00:00
copilot-swe-agent[bot]
8cb4b9b118 Add CaseElseBranch AST node for Ruby case else branches 2026-06-15 11:42:13 +00:00
Michael Nebel
175c4f1b0d C#: Add models as data tests for compound assignment operators. 2026-06-15 13:26:39 +02:00
Michael Nebel
ab4f170780 Merge pull request #21909 from michaelnebel/csharp/refactoroperations 
C#: Refactor- and rename operation expressions.
 2026-06-15 12:35:39 +02:00
Owen Mansel-Chan
4ad3a44aab QL: Convert qlref tests to inline expectations 2026-06-15 11:15:16 +01:00
Tom Hvitved
686e98c6ff Update java/ql/lib/semmle/code/java/dataflow/TypeFlow.qll 
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
 2026-06-15 11:37:14 +02:00
Owen Mansel-Chan
14c72def96 Merge pull request #21983 from owen-mc/java/convert-to-inline-expectation-tests 
Java: Improve inline expectations test comments
 2026-06-15 10:31:56 +01:00
Michael Nebel
d0841d2283 C#: Address review comments. 2026-06-15 11:04:59 +02:00
Tom Hvitved
568de02e98 Update shared/typeflow/codeql/typeflow/UniversalFlow.qll 
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
 2026-06-15 10:58:48 +02:00
Asger F
1d8e682e5f Reset mappings 2026-06-15 10:49:37 +02:00
Asger F
0baa126473 Add ability to prepend fields in Yeast 2026-06-15 10:49:35 +02:00
Asger F
d11b428292 yeast-macros: desugar 'field: @cap' to 'field: _ @cap' 
When a field pattern has a bare capture with no preceding pattern
atom (i.e. `foo: @bar`), implicitly use a true wildcard (`_`,
match_unnamed: true) as the node pattern, making it equivalent to
`foo: _ @bar`.

This is a convenience shorthand: in practice every `field: _ @cap`
in the Swift rules can now be written more concisely as `field: @cap`.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-06-15 10:49:33 +02:00
Asger F
ddc9516e92 Yeast: better support for rewriting unnamed nodes 
- Ensure the full wildcard _ supports quantifiers
- Also rewrite unnamed nodes in one-shot phases
 2026-06-15 10:49:31 +02:00
Asger F
00068948c1 yeast-macros: add .reduce_left(first -> init, acc, elem -> fold) chain 
A left fold over an iterable where the first element seeds the accumulator:
- first -> init  : converts the first element to the initial accumulator
- acc, elem -> fold : fold step; acc = current accumulator, elem = next element
- Empty iterable produces nothing (0-element splice)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-06-15 10:49:29 +02:00
Asger F
28c879f58c yeast-macros: add .map(p -> tpl) chain syntax for tree templates 
After a {expr} or {..expr} placeholder, an optional chain of
.<builtin>() calls may follow. Currently the only builtin is:

  .map(param -> template)

which applies the template to each element of the iterable and
collects the resulting node IDs. A chain auto-splices into the
enclosing field/child position.

Example:
  path: {parts}.map(p -> (identifier #{p}))

The framework is extensible: additional builtins can be added by
matching on the method name in parse_chain_suffix.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-06-15 10:49:27 +02:00
Tom Hvitved
651770b412 Java: Fix performance issue in type flow library 2026-06-15 10:35:16 +02:00
Sotiris Dragonas
7c11f19445 Merge branch 'main' into bazookamusic/cwe-1427 2026-06-15 10:15:16 +02:00
Sotiris Dragonas
7ae03377cd Add new MaD kinds 2026-06-15 11:14:25 +03:00
Anders Schack-Mulligen
6934aa0e39 Merge pull request #21980 from aschackmull/cfg/unless-until 
Cfg: Add support for unless and until statements
 2026-06-15 09:58:03 +02:00
Jaroslav Lobačevski
d51a9a3e1a Support nested reusable workflows 2026-06-15 06:52:13 +00:00
Jaroslav Lobačevski
048884bb78 Remove redundant cast 2026-06-15 06:12:45 +00:00
Jaroslav Lobačevski
2eed6c1736 Fix dominates() false positive in reusable workflows 2026-06-15 05:42:59 +00:00
Owen Mansel-Chan
9c65082189 Fix MISSING alert 2026-06-15 00:14:52 +01:00
Owen Mansel-Chan
359e272577 Merge pull request #21979 from owen-mc/code-owners-rasmuswl 
Remove @RasmusWL from CODEOWNERS
 2026-06-14 23:50:05 +01:00
Chad Bentz
23567eba3d C#: Add change note for Razor Page handler flow sources 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-06-12 19:53:00 -04:00
Chad Bentz
ce9e61dbfd C#: Add Razor Page handler method parameters as remote flow sources 
ASP.NET Core Razor Page handler method parameters (OnGet, OnPost, etc.)
were not modeled as remote flow sources, causing security queries like
SQL injection to miss vulnerabilities in PageModel subclasses.

This adds AspNetCorePageHandlerMethodParameter, analogous to the existing
AspNetCoreActionMethodParameter for MVC controllers, using the existing
PageModelClass.getAHandlerMethod() from Razor.qll.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-06-12 19:50:12 -04:00
Owen Mansel-Chan
99538f0f07 Delete unused predicate (leftover from old implementation) 2026-06-12 22:21:07 +01:00
Owen Mansel-Chan
0dc95deca4 Test changes to investigate 2026-06-12 22:21:05 +01:00