Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit fc3d6a1

Browse files
MathiasVPMathiasVP
committed
Merge branch 'replace-ast-with-ir-use-usedataflow' into fix-ssa-flow
2 parents 23d6eb6 + 7658df9 commit fc3d6a1

613 files changed

Lines changed: 51511 additions & 20018 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/ISSUE_TEMPLATE/lgtm-com---false-positive.md‎

Lines changed: 0 additions & 24 deletions
This file was deleted.

‎.github/ISSUE_TEMPLATE/ql--false-positive.md‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
---
2+
name: CodeQL False positive
3+
about: Report CodeQL alerts that you think should not have been detected (not applicable, not exploitable, etc.)
4+
title: False positive
5+
labels: false-positive
6+
assignees: ''
7+
8+
---
9+
10+
**Description of the false positive**
11+
12+
<!-- Please explain briefly why you think it shouldn't be included. -->
13+
14+
**Code samples or links to source code**
15+
16+
<!--
17+
For open source code: file links with line numbers on GitHub, for example:
18+
https://github.com/github/codeql/blob/dc440aaee6695deb0d9676b87e06ea984e1b4ae5/javascript/ql/test/query-tests/Security/CWE-078/CommandInjection/exec-sh2.js#L10
19+
20+
For closed source code: (redacted) code samples that illustrate the problem, for example:
21+
22+
```
23+
function execSh(command, options) {
24+
return cp.spawn(getShell(), ["-c", command], options) // <- command line injection
25+
};
26+
```
27+
-->
28+
29+
**URL to the alert on GitHub code scanning (optional)**
30+
31+
<!--
32+
1. Open the project on GitHub.com.
33+
2. Switch to the `Security` tab.
34+
3. Browse to the alert that you would like to report.
35+
4. Copy and paste the page URL here.
36+
-->

‎.github/workflows/compile-queries.yml‎

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ jobs:
2626
if: ${{ github.event_name == 'pull_request' }}
2727
uses: actions/cache@v3
2828
with:
29-
path: '*/ql/src/.cache'
29+
path: '**/.cache'
3030
key: codeql-compile-pr-${{ github.sha }} # deliberately not using the `compile-compile-main` keys here.
3131
restore-keys: |
3232
codeql-compile-${{ github.base_ref }}-${{ env.merge-base }}
@@ -36,7 +36,7 @@ jobs:
3636
if: ${{ github.event_name != 'pull_request' }}
3737
uses: actions/cache@v3
3838
with:
39-
path: '*/ql/src/.cache'
39+
path: '**/.cache'
4040
key: codeql-compile-${{ github.ref_name }}-${{ github.sha }} # just fill on main
4141
restore-keys: | # restore from another random commit, to speed up compilation.
4242
codeql-compile-${{ github.ref_name }}-
@@ -51,9 +51,21 @@ jobs:
5151
# run with --check-only if running in a PR (github.sha != main)
5252
if : ${{ github.event_name == 'pull_request' }}
5353
shell: bash
54-
run: codeql query compile -j0 */ql/src --keep-going --warnings=error --check-only
54+
run: codeql query compile -j0 */ql/{src,examples} --keep-going --warnings=error --check-only
5555
- name: compile queries - full
5656
# do full compile if running on main - this populates the cache
5757
if : ${{ github.event_name != 'pull_request' }}
5858
shell: bash
59-
run: codeql query compile -j0 */ql/src --keep-going --warnings=error
59+
run: |
60+
# Move all the existing cache into another folder, so we only preserve the cache for the current queries.
61+
mkdir -p ${COMBINED_CACHE_DIR}
62+
rm -f */ql/{src,examples}/.cache/{lock,size} # -f to avoid errors if the cache is empty.
63+
# copy the contents of the .cache folders into the combined cache folder.
64+
cp -r */ql/{src,examples}/.cache/* ${COMBINED_CACHE_DIR}/ || : # ignore missing files
65+
# clean up the .cache folders
66+
rm -rf */ql/{src,examples}/.cache/*
67+
68+
# compile the queries
69+
codeql query compile -j0 */ql/{src,examples} --keep-going --warnings=error --compilation-cache ${COMBINED_CACHE_DIR}
70+
env:
71+
COMBINED_CACHE_DIR: ${{ github.workspace }}/compilation-dir

‎.github/workflows/ql-for-ql-tests.yml‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -47,8 +47,3 @@ jobs:
4747
find ql/ql/src "(" -name "*.ql" -or -name "*.qll" ")" -print0 | xargs -0 "${CODEQL}" query format --check-only
4848
env:
4949
CODEQL: ${{ steps.find-codeql.outputs.codeql-path }}
50-
- name: Check QL compilation
51-
run: |
52-
"${CODEQL}" query compile --check-only --threads=4 --warnings=error --search-path "${{ github.workspace }}/ql/extractor-pack" "ql/ql/src" "ql/ql/examples"
53-
env:
54-
CODEQL: ${{ steps.find-codeql.outputs.codeql-path }}

‎.github/workflows/ruby-build.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,7 @@ jobs:
9797
run: |
9898
codeql pack create ../shared/ssa --output target/packs
9999
codeql pack create ../misc/suite-helpers --output target/packs
100+
codeql pack create ../shared/regex --output target/packs
100101
codeql pack create ql/lib --output target/packs
101102
codeql pack create ql/src --output target/packs
102103
PACK_FOLDER=$(readlink -f target/packs/codeql/ruby-queries/*)

‎.github/workflows/ruby-qltest.yml‎

Lines changed: 1 addition & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -28,16 +28,6 @@ defaults:
2828
working-directory: ruby
2929

3030
jobs:
31-
qlcompile:
32-
runs-on: ubuntu-latest
33-
steps:
34-
- uses: actions/checkout@v3
35-
- uses: ./.github/actions/fetch-codeql
36-
- name: Check QL compilation
37-
run: |
38-
codeql query compile --check-only --threads=0 --ram 5000 --warnings=error "ql/src" "ql/examples"
39-
env:
40-
GITHUB_TOKEN: ${{ github.token }}
4131
qlupgrade:
4232
runs-on: ubuntu-latest
4333
steps:
@@ -69,6 +59,6 @@ jobs:
6959
- uses: ./ruby/actions/create-extractor-pack
7060
- name: Run QL tests
7161
run: |
72-
codeql test run --threads=0 --ram 5000 --slice ${{ matrix.slice }} --search-path "${{ github.workspace }}/ruby/extractor-pack" --check-databases --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --consistency-queries ql/consistency-queries ql/test
62+
codeql test run --threads=0 --ram 5000 --slice ${{ matrix.slice }} --search-path "${{ github.workspace }}/ruby/extractor-pack" --check-databases --check-undefined-labels --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --consistency-queries ql/consistency-queries ql/test
7363
env:
7464
GITHUB_TOKEN: ${{ github.token }}

‎.github/workflows/swift.yml‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ jobs:
2727
with:
2828
filters: |
2929
codegen:
30-
- 'github/workflows/swift.yml'
30+
- '.github/workflows/swift.yml'
3131
- "misc/bazel/**"
3232
- "*.bazel*"
3333
- 'swift/actions/setup-env/**'
@@ -39,6 +39,7 @@ jobs:
3939
- 'swift/ql/lib/codeql/swift/elements/**'
4040
- 'swift/ql/lib/codeql/swift/generated/**'
4141
- 'swift/ql/test/extractor-tests/generated/**'
42+
- 'swift/ql/.generated.list'
4243
ql:
4344
- 'github/workflows/swift.yml'
4445
- 'swift/**/*.ql'
@@ -111,4 +112,10 @@ jobs:
111112
- uses: actions/upload-artifact@v3
112113
with:
113114
name: swift-generated-cpp-files
114-
path: swift/generated-cpp-files/**
115+
path: generated-cpp-files/**
116+
database-upgrade-scripts:
117+
runs-on: ubuntu-latest
118+
steps:
119+
- uses: actions/checkout@v3
120+
- uses: ./.github/actions/fetch-codeql
121+
- uses: ./swift/actions/database-upgrade-scripts

‎.pre-commit-config.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ repos:
1919
rev: v1.6.0
2020
hooks:
2121
- id: autopep8
22-
files: ^swift/codegen/.*\.py
22+
files: ^swift/.*\.py
2323

2424
- repo: local
2525
hooks:
@@ -44,7 +44,7 @@ repos:
4444

4545
- id: swift-codegen
4646
name: Run Swift checked in code generation
47-
files: ^swift/(codegen/|.*/generated/|ql/lib/(swift\.dbscheme$|codeql/swift/elements))
47+
files: ^swift/(schema.py$|codegen/|.*/generated/|ql/lib/(swift\.dbscheme$|codeql/swift/elements)|ql/\.generated.list)
4848
language: system
4949
entry: bazel run //swift/codegen -- --quiet
5050
pass_filenames: false

‎CODEOWNERS‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,4 +45,4 @@ WORKSPACE.bazel @github/codeql-ci-reviewers
4545
/.github/workflows/js-ml-tests.yml @github/codeql-ml-powered-queries-reviewers
4646
/.github/workflows/ql-for-ql-* @github/codeql-ql-for-ql-reviewers
4747
/.github/workflows/ruby-* @github/codeql-ruby
48-
/.github/workflows/swift-* @github/codeql-c
48+
/.github/workflows/swift.yml @github/codeql-c

‎config/identical-files.json‎

Lines changed: 0 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -486,40 +486,6 @@
486486
"python/ql/lib/semmle/python/security/internal/SensitiveDataHeuristics.qll",
487487
"ruby/ql/lib/codeql/ruby/security/internal/SensitiveDataHeuristics.qll"
488488
],
489-
"ReDoS Util Python/JS/Ruby/Java": [
490-
"javascript/ql/lib/semmle/javascript/security/regexp/NfaUtils.qll",
491-
"python/ql/lib/semmle/python/security/regexp/NfaUtils.qll",
492-
"ruby/ql/lib/codeql/ruby/security/regexp/NfaUtils.qll",
493-
"java/ql/lib/semmle/code/java/security/regexp/NfaUtils.qll"
494-
],
495-
"ReDoS Exponential Python/JS/Ruby/Java": [
496-
"javascript/ql/lib/semmle/javascript/security/regexp/ExponentialBackTracking.qll",
497-
"python/ql/lib/semmle/python/security/regexp/ExponentialBackTracking.qll",
498-
"ruby/ql/lib/codeql/ruby/security/regexp/ExponentialBackTracking.qll",
499-
"java/ql/lib/semmle/code/java/security/regexp/ExponentialBackTracking.qll"
500-
],
501-
"ReDoS Polynomial Python/JS/Ruby/Java": [
502-
"javascript/ql/lib/semmle/javascript/security/regexp/SuperlinearBackTracking.qll",
503-
"python/ql/lib/semmle/python/security/regexp/SuperlinearBackTracking.qll",
504-
"ruby/ql/lib/codeql/ruby/security/regexp/SuperlinearBackTracking.qll",
505-
"java/ql/lib/semmle/code/java/security/regexp/SuperlinearBackTracking.qll"
506-
],
507-
"RegexpMatching Python/JS/Ruby": [
508-
"javascript/ql/lib/semmle/javascript/security/regexp/RegexpMatching.qll",
509-
"python/ql/lib/semmle/python/security/regexp/RegexpMatching.qll",
510-
"ruby/ql/lib/codeql/ruby/security/regexp/RegexpMatching.qll"
511-
],
512-
"BadTagFilterQuery Python/JS/Ruby": [
513-
"javascript/ql/lib/semmle/javascript/security/BadTagFilterQuery.qll",
514-
"python/ql/lib/semmle/python/security/BadTagFilterQuery.qll",
515-
"ruby/ql/lib/codeql/ruby/security/BadTagFilterQuery.qll"
516-
],
517-
"OverlyLargeRange Python/JS/Ruby/Java": [
518-
"javascript/ql/lib/semmle/javascript/security/OverlyLargeRangeQuery.qll",
519-
"python/ql/lib/semmle/python/security/OverlyLargeRangeQuery.qll",
520-
"ruby/ql/lib/codeql/ruby/security/OverlyLargeRangeQuery.qll",
521-
"java/ql/lib/semmle/code/java/security/OverlyLargeRangeQuery.qll"
522-
],
523489
"CFG": [
524490
"csharp/ql/lib/semmle/code/csharp/controlflow/internal/ControlFlowGraphImplShared.qll",
525491
"ruby/ql/lib/codeql/ruby/controlflow/internal/ControlFlowGraphImplShared.qll",

0 commit comments

Comments
 (0)