Initial plan

actions/ql/lib/change-notes/2026-06-12-self_hosted_runners.md

@@ -1,4 +0,0 @@
----
-category: fix
----
-* The query `actions/pr-on-self-hosted-runner` was updated to the latest standard runner labels reducing false positive results.

actions/ql/lib/codeql/actions/security/SelfHostedQuery.qll

@@ -2,12 +2,10 @@ import actions
 
 bindingset[runner]
 predicate isGithubHostedRunner(string runner) {
-  // The list of github hosted repos:
+  // list of github hosted repos: https://github.com/actions/runner-images/blob/main/README.md#available-images
-  // https://github.com/actions/runner-images/blob/main/README.md#available-images
+  runner
-  // https://docs.github.com/en/enterprise-cloud@latest/actions/how-tos/write-workflows/choose-where-workflows-run/choose-the-runner-for-a-job#standard-github-hosted-runners-for-public-repositories
+      .toLowerCase()
-  runner.toLowerCase().regexpMatch("^ubuntu-([0-9.]+|latest|slim)(-arm)?$") or
+      .regexpMatch("^(ubuntu-([0-9.]+|latest)|macos-([0-9]+|latest)(-x?large)?|windows-([0-9.]+|latest))$")
-  runner.toLowerCase().regexpMatch("^macos-([0-9]+|latest)(-x?large|-intel)?$") or
-  runner.toLowerCase().regexpMatch("^windows-([0-9.]+|latest)(-vs[0-9.]+)?(-arm)?$")
 }
 
 bindingset[runner]

actions/ql/test/query-tests/Security/CWE-284/.github/workflows/test3.yml

@@ -1,43 +0,0 @@
-name: test
-
-on:
-  pull_request:
-
-jobs:
-  test:
-    strategy:
-      fail-fast: false
-      matrix:
-        os:
-          - ubuntu-latest
-          - ubuntu-24.04
-          - ubuntu-24.04-arm
-          - ubuntu-22.04
-          - ubuntu-22.04-arm
-          - ubuntu-26.04
-          - ubuntu-26.04-arm
-          - ubuntu-slim
-          - macos-26
-          - macos-26-xlarge
-          - macos-26-intel
-          - macos-26-large
-          - macos-latest-large
-          - macos-15-large
-          - macos-15
-          - macos-15-intel
-          - macos-latest
-          - macos-15
-          - macos-15-xlarge
-          - macos-14-large
-          - macos-14
-          - macos-14-xlarge
-          - windows-2025-vs2026
-          - windows-latest
-          - windows-2025
-          - windows-2022
-          - windows-11
-          - windows-11-arm
-          - windows-11-vs2026-arm
-    runs-on: ${{ matrix.os }}
-    steps:
-      - run: cmd

csharp/ql/lib/semmle/code/csharp/controlflow/internal/ControlFlowGraph.qll

@@ -203,7 +203,7 @@ module Ast implements AstSig<Location> {
   final private class FinalTryStmt = CS::TryStmt;
 
   class TryStmt extends FinalTryStmt {
-    AstNode getBody(int index) { index = 0 and result = this.getBlock() }
+    Stmt getBody() { result = this.getBlock() }
 
     CatchClause getCatch(int index) { result = this.getCatchClause(index) }
 

java/ql/lib/semmle/code/java/ControlFlowGraph.qll

@@ -117,18 +117,15 @@ private module Ast implements AstSig<Location> {
   final private class FinalTryStmt = J::TryStmt;
 
   class TryStmt extends FinalTryStmt {
-    AstNode getBody(int index) {
+    Stmt getBody() { result = super.getBlock() }
-      result = super.getResource(index)
-      or
-      index = count(super.getAResource()) and
-      result = super.getBlock()
-    }
 
     CatchClause getCatch(int index) { result = super.getCatchClause(index) }
 
     Stmt getFinally() { result = super.getFinally() }
   }
 
+  AstNode getTryInit(TryStmt try, int index) { result = try.getResource(index) }
+
   final private class FinalCatchClause = J::CatchClause;
 
   class CatchClause extends FinalCatchClause {

shared/controlflow/codeql/controlflow/ControlFlowGraph.qll

@@ -185,12 +185,8 @@ signature module AstSig<LocationSig Location> {
 
   /** A `try` statement with `catch` and/or `finally` clauses. */
   class TryStmt extends Stmt {
-    /**
+    /** Gets the body of this `try` statement. */
-     * Gets the body of this `try` statement at the specified (zero-based)
+    Stmt getBody();
-     * position `index`. In some languages, there is only ever a single body
-     * (with `index` 0).
-     */
-    AstNode getBody(int index);
 
     /**
      * Gets the `catch` clause at the specified (zero-based) position `index`
@@ -202,6 +198,15 @@ signature module AstSig<LocationSig Location> {
     Stmt getFinally();
   }
 
+  /**
+   * Gets the initializer of this `try` statement at the specified (zero-based)
+   * position `index`, if any.
+   *
+   * An example of this are resource declarations in Java's try-with-resources
+   * statement.
+   */
+  default AstNode getTryInit(TryStmt try, int index) { none() }
+
   /**
    * Gets the `else` block of this `try` statement, if any.
    *
@@ -694,7 +699,7 @@ module Make0<LocationSig Location, AstSig<Location> Ast> {
       or
       exists(TryStmt trystmt |
         trystmt = n and
-        cannotTerminateNormally(trystmt.getBody(_)) and
+        cannotTerminateNormally(trystmt.getBody()) and
         forall(CatchClause catch | trystmt.getCatch(_) = catch |
           cannotTerminateNormally(catch.getBody())
         )
@@ -1251,7 +1256,11 @@ module Make0<LocationSig Location, AstSig<Location> Ast> {
           )
         )
         or
-        exists(TryStmt trystmt | ast = trystmt.getBody(_) |
+        exists(TryStmt trystmt |
+          ast = getTryInit(trystmt, _)
+          or
+          ast = trystmt.getBody()
+        |
           c.getSuccessorType() instanceof ExceptionSuccessor and
           (
             n.isBefore(trystmt.getCatch(0))
@@ -1626,11 +1635,16 @@ module Make0<LocationSig Location, AstSig<Location> Ast> {
         or
         exists(TryStmt trystmt |
           n1.isBefore(trystmt) and
-          n2.isBefore(trystmt.getBody(0))
+          (
+            n2.isBefore(getTryInit(trystmt, 0))
+            or
+            not exists(getTryInit(trystmt, _)) and n2.isBefore(trystmt.getBody())
+          )
           or
-          exists(int i |
+          exists(int i | n1.isAfter(getTryInit(trystmt, i)) |
-            n1.isAfter(trystmt.getBody(i)) and
+            n2.isBefore(getTryInit(trystmt, i + 1))
-            n2.isBefore(trystmt.getBody(i + 1))
+            or
+            not exists(getTryInit(trystmt, i + 1)) and n2.isBefore(trystmt.getBody())
           )
           or
           exists(PreControlFlowNode beforeElse, PreControlFlowNode beforeFinally |
@@ -1645,11 +1659,8 @@ module Make0<LocationSig Location, AstSig<Location> Ast> {
               not exists(trystmt.getFinally()) and beforeFinally.isAfter(trystmt)
             )
           |
-            exists(int i |
+            n1.isAfter(trystmt.getBody()) and
-              n1.isAfter(trystmt.getBody(i)) and
+            n2 = beforeElse
-              not exists(trystmt.getBody(i + 1)) and
-              n2 = beforeElse
-            )
             or
             n1.isAfter(getTryElse(trystmt)) and
             n2 = beforeFinally