Skip to content

Commit 2a65917

Browse files
mrthankyoumrthankyou
authored
Merge pull request #1 from RasmusWL/python-use-sqlalchemy
Minor updates to SQL alchemy PR
2 parents 3ace495 + a5a7f3e commit 2a65917

File tree

2,573 files changed

+241458
-30001
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

2,573 files changed

+241458
-30001
lines changed

‎.codeqlmanifest.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
{ "provide": [ "*/ql/src/qlpack.yml",
22
"*/ql/test/qlpack.yml",
3+
"cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/qlpack.yml",
34
"*/ql/examples/qlpack.yml",
45
"*/upgrades/qlpack.yml",
56
"misc/legacy-support/*/qlpack.yml",

‎.github/workflows/check-change-note.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,5 +19,5 @@ jobs:
1919
env:
2020
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
2121
run: |
22-
gh api 'repos/${{github.repository}}/pulls/${{github.event.number}}/files' --paginate |
23-
jq 'any(.[].filename ; test("/change-notes/.*[.]md$"))' --exit-status
22+
gh api 'repos/${{github.repository}}/pulls/${{github.event.number}}/files' --paginate --jq 'any(.[].filename ; test("/change-notes/.*[.]md$"))' |
23+
grep true -c

‎.github/workflows/close-stale.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,16 +15,16 @@ jobs:
1515
- uses: actions/stale@v3
1616
with:
1717
repo-token: ${{ secrets.GITHUB_TOKEN }}
18-
stale-issue-message: 'This issue is stale because it has been open 14 days with no activity. Comment or remove the `stale` label in order to avoid having this issue closed in 7 days.'
18+
stale-issue-message: 'This issue is stale because it has been open 14 days with no activity. Comment or remove the `Stale` label in order to avoid having this issue closed in 7 days.'
1919
close-issue-message: 'This issue was closed because it has been inactive for 7 days.'
2020
days-before-stale: 14
2121
days-before-close: 7
22-
only-labels: question
23-
22+
only-labels: awaiting-response
23+
2424
# do not mark PRs as stale
2525
days-before-pr-stale: -1
2626
days-before-pr-close: -1
27-
27+
2828
# Uncomment for dry-run
2929
# debug-only: true
3030
# operations-per-run: 1000

‎.github/workflows/codeql-analysis.yml

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,13 +19,18 @@ jobs:
1919

2020
runs-on: ubuntu-latest
2121

22+
permissions:
23+
contents: read
24+
security-events: write
25+
pull-requests: read
26+
2227
steps:
2328
- name: Checkout repository
2429
uses: actions/checkout@v2
2530

2631
# Initializes the CodeQL tools for scanning.
2732
- name: Initialize CodeQL
28-
uses: github/codeql-action/init@v1
33+
uses: github/codeql-action/init@main
2934
# Override language selection by uncommenting this and choosing your languages
3035
with:
3136
languages: csharp
@@ -34,7 +39,7 @@ jobs:
3439
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
3540
# If this step fails, then you should remove it and run the build manually (see below)
3641
- name: Autobuild
37-
uses: github/codeql-action/autobuild@v1
42+
uses: github/codeql-action/autobuild@main
3843

3944
# ℹ️ Command-line programs to run using the OS shell.
4045
# 📚 https://git.io/JvXDl
@@ -48,4 +53,4 @@ jobs:
4853
# make release
4954

5055
- name: Perform CodeQL Analysis
51-
uses: github/codeql-action/analyze@v1
56+
uses: github/codeql-action/analyze@main

‎.github/workflows/csv-coverage-pr-artifacts.yml

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
name: Check framework coverage changes
2+
3+
on:
4+
pull_request:
5+
paths:
6+
- '.github/workflows/csv-coverage-pr-comment.yml'
7+
- '*/ql/src/**/*.ql'
8+
- '*/ql/src/**/*.qll'
9+
- 'misc/scripts/library-coverage/*.py'
10+
# input data files
11+
- '*/documentation/library-coverage/cwe-sink.csv'
12+
- '*/documentation/library-coverage/frameworks.csv'
13+
branches:
14+
- main
15+
- 'rc/*'
16+
17+
jobs:
18+
generate:
19+
name: Generate framework coverage artifacts
20+
21+
runs-on: ubuntu-latest
22+
23+
steps:
24+
- name: Dump GitHub context
25+
env:
26+
GITHUB_CONTEXT: ${{ toJSON(github.event) }}
27+
run: echo "$GITHUB_CONTEXT"
28+
- name: Clone self (github/codeql) - MERGE
29+
uses: actions/checkout@v2
30+
with:
31+
path: merge
32+
- name: Clone self (github/codeql) - BASE
33+
uses: actions/checkout@v2
34+
with:
35+
fetch-depth: 2
36+
path: base
37+
- run: |
38+
git checkout HEAD^1
39+
git log -1 --format='%H'
40+
working-directory: base
41+
- name: Set up Python 3.8
42+
uses: actions/setup-python@v2
43+
with:
44+
python-version: 3.8
45+
- name: Download CodeQL CLI
46+
env:
47+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
48+
run: |
49+
gh release download --repo "github/codeql-cli-binaries" --pattern "codeql-linux64.zip"
50+
- name: Unzip CodeQL CLI
51+
run: unzip -d codeql-cli codeql-linux64.zip
52+
- name: Generate CSV files on merge commit of the PR
53+
run: |
54+
echo "Running generator on merge"
55+
PATH="$PATH:codeql-cli/codeql" python merge/misc/scripts/library-coverage/generate-report.py ci merge merge
56+
mkdir out_merge
57+
cp framework-coverage-*.csv out_merge/
58+
cp framework-coverage-*.rst out_merge/
59+
- name: Generate CSV files on base commit of the PR
60+
run: |
61+
echo "Running generator on base"
62+
PATH="$PATH:codeql-cli/codeql" python base/misc/scripts/library-coverage/generate-report.py ci base base
63+
mkdir out_base
64+
cp framework-coverage-*.csv out_base/
65+
cp framework-coverage-*.rst out_base/
66+
- name: Generate diff of coverage reports
67+
run: |
68+
python base/misc/scripts/library-coverage/compare-folders.py out_base out_merge comparison.md
69+
- name: Upload CSV package list
70+
uses: actions/upload-artifact@v2
71+
with:
72+
name: csv-framework-coverage-merge
73+
path: |
74+
out_merge/framework-coverage-*.csv
75+
out_merge/framework-coverage-*.rst
76+
- name: Upload CSV package list
77+
uses: actions/upload-artifact@v2
78+
with:
79+
name: csv-framework-coverage-base
80+
path: |
81+
out_base/framework-coverage-*.csv
82+
out_base/framework-coverage-*.rst
83+
- name: Upload comparison results
84+
uses: actions/upload-artifact@v2
85+
with:
86+
name: comparison
87+
path: |
88+
comparison.md
89+
- name: Save PR number
90+
run: |
91+
mkdir -p pr
92+
echo ${{ github.event.pull_request.number }} > pr/NR
93+
- name: Upload PR number
94+
uses: actions/upload-artifact@v2
95+
with:
96+
name: pr
97+
path: pr/

‎.github/workflows/csv-coverage-pr-comment.yml

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
name: Comment on PR with framework coverage changes
2+
3+
on:
4+
workflow_run:
5+
workflows: ["Check framework coverage changes"]
6+
types:
7+
- completed
8+
9+
jobs:
10+
check:
11+
name: Check framework coverage differences and comment
12+
runs-on: ubuntu-latest
13+
if: >
14+
${{ github.event.workflow_run.event == 'pull_request' &&
15+
github.event.workflow_run.conclusion == 'success' }}
16+
17+
steps:
18+
- name: Dump GitHub context
19+
env:
20+
GITHUB_CONTEXT: ${{ toJSON(github.event) }}
21+
run: echo "$GITHUB_CONTEXT"
22+
- name: Clone self (github/codeql)
23+
uses: actions/checkout@v2
24+
- name: Set up Python 3.8
25+
uses: actions/setup-python@v2
26+
with:
27+
python-version: 3.8
28+
29+
- name: Check coverage difference file and comment
30+
env:
31+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
32+
RUN_ID: ${{ github.event.workflow_run.id }}
33+
run: |
34+
python misc/scripts/library-coverage/comment-pr.py "$GITHUB_REPOSITORY" "$RUN_ID"

‎.github/workflows/csv-coverage-timeseries.yml

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
name: Build framework coverage timeseries reports
2+
3+
on:
4+
workflow_dispatch:
5+
6+
jobs:
7+
build:
8+
9+
runs-on: ubuntu-latest
10+
11+
steps:
12+
- name: Clone self (github/codeql)
13+
uses: actions/checkout@v2
14+
with:
15+
path: script
16+
- name: Clone self (github/codeql) for analysis
17+
uses: actions/checkout@v2
18+
with:
19+
path: codeqlModels
20+
fetch-depth: 0
21+
- name: Set up Python 3.8
22+
uses: actions/setup-python@v2
23+
with:
24+
python-version: 3.8
25+
- name: Download CodeQL CLI
26+
env:
27+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
28+
run: |
29+
gh release download --repo "github/codeql-cli-binaries" --pattern "codeql-linux64.zip"
30+
- name: Unzip CodeQL CLI
31+
run: unzip -d codeql-cli codeql-linux64.zip
32+
- name: Build modeled package list
33+
run: |
34+
CLI=$(realpath "codeql-cli/codeql")
35+
echo $CLI
36+
PATH="$PATH:$CLI" python script/misc/scripts/library-coverage/generate-timeseries.py codeqlModels
37+
- name: Upload timeseries CSV
38+
uses: actions/upload-artifact@v2
39+
with:
40+
name: framework-coverage-timeseries
41+
path: framework-coverage-timeseries-*.csv
42+

‎.github/workflows/csv-coverage-update.yml

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
name: Update framework coverage reports
2+
3+
on:
4+
workflow_dispatch:
5+
schedule:
6+
- cron: "0 0 * * *"
7+
8+
jobs:
9+
update:
10+
name: Update framework coverage report
11+
if: github.event.repository.fork == false
12+
runs-on: ubuntu-latest
13+
14+
steps:
15+
- name: Dump GitHub context
16+
env:
17+
GITHUB_CONTEXT: ${{ toJSON(github.event) }}
18+
run: echo "$GITHUB_CONTEXT"
19+
- name: Clone self (github/codeql)
20+
uses: actions/checkout@v2
21+
with:
22+
path: ql
23+
fetch-depth: 0
24+
- name: Set up Python 3.8
25+
uses: actions/setup-python@v2
26+
with:
27+
python-version: 3.8
28+
- name: Download CodeQL CLI
29+
env:
30+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
31+
run: |
32+
gh release download --repo "github/codeql-cli-binaries" --pattern "codeql-linux64.zip"
33+
- name: Unzip CodeQL CLI
34+
run: unzip -d codeql-cli codeql-linux64.zip
35+
36+
- name: Generate coverage files
37+
run: |
38+
PATH="$PATH:codeql-cli/codeql" python ql/misc/scripts/library-coverage/generate-report.py ci ql ql
39+
40+
- name: Create pull request with changes
41+
env:
42+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
43+
run: |
44+
python ql/misc/scripts/library-coverage/create-pr.py ql "$GITHUB_REPOSITORY"

‎.github/workflows/csv-coverage.yml

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
name: Build framework coverage reports
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
qlModelShaOverride:
7+
description: 'github/codeql repo SHA used for looking up the CSV models'
8+
required: false
9+
10+
jobs:
11+
build:
12+
13+
runs-on: ubuntu-latest
14+
15+
steps:
16+
- name: Clone self (github/codeql)
17+
uses: actions/checkout@v2
18+
with:
19+
path: script
20+
- name: Clone self (github/codeql) for analysis
21+
uses: actions/checkout@v2
22+
with:
23+
path: codeqlModels
24+
ref: ${{ github.event.inputs.qlModelShaOverride || github.ref }}
25+
- name: Set up Python 3.8
26+
uses: actions/setup-python@v2
27+
with:
28+
python-version: 3.8
29+
- name: Download CodeQL CLI
30+
env:
31+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
32+
run: |
33+
gh release download --repo "github/codeql-cli-binaries" --pattern "codeql-linux64.zip"
34+
- name: Unzip CodeQL CLI
35+
run: unzip -d codeql-cli codeql-linux64.zip
36+
- name: Build modeled package list
37+
run: |
38+
PATH="$PATH:codeql-cli/codeql" python script/misc/scripts/library-coverage/generate-report.py ci codeqlModels script
39+
- name: Upload CSV package list
40+
uses: actions/upload-artifact@v2
41+
with:
42+
name: framework-coverage-csv
43+
path: framework-coverage-*.csv
44+
- name: Upload RST package list
45+
uses: actions/upload-artifact@v2
46+
with:
47+
name: framework-coverage-rst
48+
path: framework-coverage-*.rst
49+

‎config/identical-files.json

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
"java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl3.qll",
66
"java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl4.qll",
77
"java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl5.qll",
8+
"java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl6.qll",
89
"cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll",
910
"cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll",
1011
"cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll",
@@ -249,6 +250,10 @@
249250
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll",
250251
"csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll"
251252
],
253+
"SSA PrintAliasAnalysis": [
254+
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/PrintAliasAnalysis.qll",
255+
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/PrintAliasAnalysis.qll"
256+
],
252257
"C++ SSA AliasAnalysisImports": [
253258
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysisImports.qll",
254259
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysisImports.qll"
@@ -438,6 +443,10 @@
438443
],
439444
"CryptoAlgorithms Python/JS": [
440445
"javascript/ql/src/semmle/javascript/security/CryptoAlgorithms.qll",
441-
"python/ql/src/semmle/crypto/Crypto.qll"
446+
"python/ql/src/semmle/python/concepts/CryptoAlgorithms.qll"
447+
],
448+
"SensitiveDataHeuristics Python/JS": [
449+
"javascript/ql/src/semmle/javascript/security/internal/SensitiveDataHeuristics.qll",
450+
"python/ql/src/semmle/python/security/internal/SensitiveDataHeuristics.qll"
442451
]
443-
}
452+
}

‎cpp/change-notes/2021-03-11-overflow-abs.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm
2+
* The `cpp/tainted-arithmetic`, `cpp/arithmetic-with-extreme-values`, and `cpp/uncontrolled-arithmetic` queries now recognize more functions as returning the absolute value of their input. As a result, they produce fewer false positives.

‎cpp/change-notes/2021-04-09-unsigned-difference-expression-compared-zero.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm,codescanning
2+
* The 'Unsigned difference expression compared to zero' (cpp/unsigned-difference-expression-compared-zero) query has been improved to produce fewer false positive results.

‎cpp/change-notes/2021-04-13-arithmetic-queries.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm
2+
* The queries cpp/tainted-arithmetic, cpp/uncontrolled-arithmetic, and cpp/arithmetic-with-extreme-values have been improved to produce fewer false positives.

‎cpp/change-notes/2021-04-21-return-stack-allocated-object.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
codescanning
2+
* The 'Pointer to stack object used as return value' (cpp/return-stack-allocated-object) query has been deprecated, and any uses should be replaced with `Returning stack-allocated memory` (cpp/return-stack-allocated-memory).

‎cpp/change-notes/2021-04-26-more-sound-expr-might-overflow.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm,codescanning
2+
* The `exprMightOverflowPositively` and `exprMightOverflowNegatively` predicates from the `SimpleRangeAnalysis` library now recognize more expressions that might overflow.

‎cpp/change-notes/2021-05-10-comparison-with-wider-type.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm,codescanning
2+
* The 'Comparison with wider type' (cpp/comparison-with-wider-type) query has been improved to produce fewer false positives.

‎cpp/change-notes/2021-05-12-uncontrolled-arithmetic.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm,codescanning
2+
* The query "Uncontrolled arithmetic" (`cpp/uncontrolled-arithmetic`) has been improved to produce fewer false positives.

0 commit comments

Comments
 (0)