hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-07-09 21:45:33 +02:00
Code Issues Packages Projects Releases Wiki Activity
88,267 Commits 1,801 Branches 170 Tags
codeql-cli/v2.26.0
Commit Graph

88267 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael Nebel
d9be99c73d C#: Simplify the implementation to avoid introducing synthetic assignments. 2026-06-12 09:41:05 +02:00
Michael Nebel
330b4e7ebc C#: Address other CoPilot review comments. 2026-06-12 09:41:02 +02:00
Michael Nebel
0f7e36958d C#: Add test case. 2026-06-12 09:40:59 +02:00
Michael Nebel
02c37321d0 C#: Add case for open ended range. 2026-06-12 09:40:54 +02:00
Michael Nebel
2f473572fa C#: Add more testcases and update expected output. 2026-06-12 09:40:51 +02:00
Michael Nebel
edc1c150a0 C#: Update change note. 2026-06-12 09:40:47 +02:00
Michael Nebel
d9152392ce C#: Add test case and expected output. 2026-06-12 09:40:42 +02:00
Michael Nebel
9c9c89615e C#: Extract Slice and Substring operations and synthesize the call arguments, when using indexers in conjunction with ranges on spans and strings. 2026-06-12 09:40:39 +02:00
Michael Nebel
b8edde6d44 C#: Add change-note. 2026-06-12 09:40:35 +02:00
Michael Nebel
5c8857ada2 C#: Update DB quality expected test output. 2026-06-12 09:40:32 +02:00
Michael Nebel
01fe081f36 C#: Extract the indexer as the call target when using range expressions with spans. 2026-06-12 09:40:29 +02:00
Jaroslav Lobačevski
9078b511c6 Update regex for GitHub hosted runner matching 
Fixes false positives (of critical severity). New label naming conventions were introduced since the query was initially written.
 2026-06-12 09:37:18 +03:00
dependabot[bot]
1ac079d066 Bump golang.org/x/tools 
Bumps the extractor-dependencies group in /go/extractor with 1 update: [golang.org/x/tools](https://github.com/golang/tools).


Updates `golang.org/x/tools` from 0.45.0 to 0.46.0
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](https://github.com/golang/tools/compare/v0.45.0...v0.46.0)

---
updated-dependencies:
- dependency-name: golang.org/x/tools
  dependency-version: 0.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: extractor-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-12 03:03:31 +00:00
copilot-swe-agent[bot]
de281fc00c Initial plan 2026-06-11 22:21:25 +00:00
Owen Mansel-Chan
29b0c286a7 Fix 3 more tests 2026-06-11 23:40:14 +02:00
Asger F
ad18659373 Merge pull request #21796 from mattcosta7/patch-1 
Add UseMemoDirective and UseNoMemoDirective classes
 2026-06-11 23:01:29 +02:00
Owen Mansel-Chan
a4bf2b8f58 Fix 3 tests 2026-06-11 22:59:39 +02:00
copilot-swe-agent[bot]
838d06c53f Fix changelog copy errors in change-notes and CHANGELOG.md files (codeql-cli-2.25.6) 2026-06-11 22:45:33 +02:00
Owen Mansel-Chan
913dcb1190 Add change note 2026-06-11 22:20:52 +02:00
Owen Mansel-Chan
a375e186ed Third pass 2026-06-11 21:53:22 +02:00
Matthew Costabile
923fe2dcb9 Merge branch 'main' into patch-1 2026-06-11 15:19:58 -04:00
Owen Mansel-Chan
befb557bfd Accept fixed MISSING tests 2026-06-11 15:44:20 +02:00
Jeroen Ketema
642259cd51 Merge pull request #21968 from jketema/jketema/namequalifiers 
C++: Fix `NameQualifyingElement` db inconsistency
 2026-06-11 15:11:51 +02:00
copilot-swe-agent[bot]
73bc2d70ae Model instance-attribute type flow 
Use a field level step like JS and Ruby.
 2026-06-11 14:48:55 +02:00
Owen Mansel-Chan
0d984588f9 Merge pull request #21965 from owen-mc/go/convert-to-inline-expectation-tests 
Go: convert all qlref tests to inline expectation tests using postprocessing
 2026-06-11 13:27:06 +01:00
Sotiris Dragonas
17dbf03c6d Merge branch 'main' into bazookamusic/cwe-1427 2026-06-11 12:05:57 +02:00
BazookaMusic
ef5678708c Update not_included_in_qls.expected for promoted prompt injection queries 
UserPromptInjection moved from experimental to stable (precision low, so not in any well-known suite); the old experimental path no longer exists.
 2026-06-11 12:01:56 +02:00
BazookaMusic
7bd5abf809 Refine SystemPromptInjection alert message and move test to stable 
Update the alert message to "This system prompt depends on a $@." matching the SQL injection query style, and move the test out of experimental into Security/CWE-1427 to mirror the stable query location.
 2026-06-11 11:51:25 +02:00
BazookaMusic
e612db2ec9 Promote user prompt injection query to stable security 
Move UserPromptInjection out of experimental into stable JavaScript security locations.

Set js/user-prompt-injection precision to low and remove experimental tagging.

Move supporting dataflow libraries, qhelp/examples, and tests to stable paths and update references.
 2026-06-11 11:28:14 +02:00
copilot-swe-agent[bot]
a4585d8d94 Add test documenting missing PEP249 alerts for connection stored in self attribute 2026-06-11 05:48:40 +00:00
copilot-swe-agent[bot]
7795884946 Initial plan 2026-06-11 05:30:20 +00:00
Owen Mansel-Chan
b4a9689341 Convert .qlref test to inline expectations 2026-06-11 07:15:54 +02:00
Owen Mansel-Chan
6a8e20a0c8 Fix pre-existing whitespace issues in go test files 2026-06-11 07:15:09 +02:00
Owen Mansel-Chan
4c411bbcb5 Convert hand-rolled inline expectations test 2026-06-11 07:13:48 +02:00
Asger F
b60bf8c79f Merge pull request #21950 from tonghuaroot/experimental-ssrf-ipv6-transition-js 
Add experimental query: SSRF host guard missing IPv6-transition unwrap (CWE-918/CWE-1389)
 2026-06-10 21:42:54 +02:00
Jeroen Ketema
ef00aa2567 C++: Add upgrade and downgrade scripts 2026-06-10 14:38:15 +02:00
Jeroen Ketema
6d0968744b C++: Fix NameQualifyingElement db inconsistency 2026-06-10 14:35:36 +02:00
Jeroen Ketema
98f147556a C++: Add namequalifier test with inconsistency 
While where the remove the file restriction in QL.
 2026-06-10 14:27:56 +02:00
Owen Mansel-Chan
3693185b6b Second pass 2026-06-10 09:14:47 +02:00
Owen Mansel-Chan
1c1d26453d First pass converting qlref tests to inline expectation with postprocess 2026-06-10 07:46:42 +02:00
tonghuaroot (童话)
4c1a0058bf Add SsrfIpv6TransitionIncompleteGuard.ql to not_included_in_qls.expected 
Fix the JS integration test failure flagged in review by listing the new
experimental CWE-918 query in the expected not-included-in-qls suite, in
sorted order.
 2026-06-10 08:42:42 +08:00
Tom Hvitved
f5919875b7 Merge pull request #21941 from hvitved/python/content-approx 
Python: Implement `ContentApprox`
 2026-06-09 15:46:04 +02:00
Owen Mansel-Chan
990913519d Make comment clearer 2026-06-09 12:20:10 +02:00
Owen Mansel-Chan
e22f9fadd7 Fix mistakes in change notes 
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-06-09 12:20:08 +02:00
Owen Mansel-Chan
071a0e3d7d Add change notes 2026-06-09 12:20:06 +02:00
Owen Mansel-Chan
a92349683e Deprecate FuncTypeExpr.getResultDecl() 
It is unused in this library. It could easily be used incorrectly and
silently omit results when `getNumResult() > 1`.
 2026-06-09 12:20:04 +02:00
Owen Mansel-Chan
8ce543bf4d Fix: getNumResult() was wrong in some cases 
It was the number of result declarations, which is
different from the number of results when one
result declaration declares more than one
variable, as in `x, y int`.
 2026-06-09 12:20:02 +02:00
Owen Mansel-Chan
da777a455d Improve QLDoc 2026-06-09 12:19:58 +02:00
Owen Mansel-Chan
f4f17b01c1 Fix result node and remove SPURIOUS test result 2026-06-09 12:19:56 +02:00
Owen Mansel-Chan
1c47084479 Add result node test with SPURIOUS result 2026-06-09 12:19:51 +02:00