Skip to content

Commit c821f27

Browse files
geoffw0geoffw0
committed
Merge branch 'main' into badalloc
2 parents 10ad578 + 8631371 commit c821f27

File tree

225 files changed

+4481
-1255
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

225 files changed

+4481
-1255
lines changed

‎.bazelversion

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
8.0.0
1+
8.1.1

‎actions/extractor/tools/autobuild-impl.ps1

Lines changed: 26 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,34 @@
1-
if (($null -ne $env:LGTM_INDEX_INCLUDE) -or ($null -ne $env:LGTM_INDEX_EXCLUDE) -or ($null -ne $env:LGTM_INDEX_FILTERS)) {
2-
Write-Output 'Path filters set. Passing them through to the JavaScript extractor.'
3-
} else {
4-
Write-Output 'No path filters set. Using the default filters.'
5-
# Note: We're adding the `reusable_workflows` subdirectories to proactively
6-
# record workflows that were called cross-repo, check them out locally,
7-
# and enable an interprocedural analysis across the workflow files.
8-
# These workflows follow the convention `.github/reusable_workflows/<nwo>/*.ya?ml`
9-
$DefaultPathFilters = @(
10-
'exclude:**/*',
11-
'include:.github/workflows/*.yml',
12-
'include:.github/workflows/*.yaml',
13-
'include:.github/reusable_workflows/**/*.yml',
14-
'include:.github/reusable_workflows/**/*.yaml',
15-
'include:**/action.yml',
16-
'include:**/action.yaml'
17-
)
1+
# Note: We're adding the `reusable_workflows` subdirectories to proactively
2+
# record workflows that were called cross-repo, check them out locally,
3+
# and enable an interprocedural analysis across the workflow files.
4+
# These workflows follow the convention `.github/reusable_workflows/<nwo>/*.ya?ml`
5+
$DefaultPathFilters = @(
6+
'exclude:**/*',
7+
'include:.github/workflows/*.yml',
8+
'include:.github/workflows/*.yaml',
9+
'include:.github/reusable_workflows/**/*.yml',
10+
'include:.github/reusable_workflows/**/*.yaml',
11+
'include:**/action.yml',
12+
'include:**/action.yaml'
13+
)
1814

15+
if ($null -ne $env:LGTM_INDEX_FILTERS) {
16+
Write-Output 'LGTM_INDEX_FILTERS set. Using the default filters together with the user-provided filters, and passing through to the JavaScript extractor.'
17+
# Begin with the default path inclusions only,
18+
# followed by the user-provided filters.
19+
# If the user provided `paths`, those patterns override the default inclusions
20+
# (because `LGTM_INDEX_FILTERS` will begin with `exclude:**/*`).
21+
# If the user provided `paths-ignore`, those patterns are excluded.
22+
$PathFilters = ($DefaultPathFilters -join "`n") + "`n" + $env:LGTM_INDEX_FILTERS
23+
$env:LGTM_INDEX_FILTERS = $PathFilters
24+
} else {
25+
Write-Output 'LGTM_INDEX_FILTERS not set. Using the default filters, and passing through to the JavaScript extractor.'
1926
$env:LGTM_INDEX_FILTERS = $DefaultPathFilters -join "`n"
2027
}
2128

2229
# Find the JavaScript extractor directory via `codeql resolve extractor`.
2330
$CodeQL = Join-Path $env:CODEQL_DIST 'codeql.exe'
24-
$env:CODEQL_EXTRACTOR_JAVASCRIPT_ROOT = &$CodeQL resolve extractor --language javascript
31+
$env:CODEQL_EXTRACTOR_JAVASCRIPT_ROOT = &"$CodeQL" resolve extractor --language javascript
2532
if ($LASTEXITCODE -ne 0) {
2633
throw 'Failed to resolve JavaScript extractor.'
2734
}
@@ -40,7 +47,7 @@ $env:CODEQL_EXTRACTOR_JAVASCRIPT_SOURCE_ARCHIVE_DIR = $env:CODEQL_EXTRACTOR_ACTI
4047
$env:CODEQL_EXTRACTOR_JAVASCRIPT_TRAP_DIR = $env:CODEQL_EXTRACTOR_ACTIONS_TRAP_DIR
4148
$env:CODEQL_EXTRACTOR_JAVASCRIPT_WIP_DATABASE = $env:CODEQL_EXTRACTOR_ACTIONS_WIP_DATABASE
4249

43-
&$JavaScriptAutoBuild
50+
&"$JavaScriptAutoBuild"
4451
if ($LASTEXITCODE -ne 0) {
4552
throw "JavaScript autobuilder failed."
4653
}

‎actions/extractor/tools/autobuild.cmd

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
@echo off
22
rem All of the work is done in the PowerShell script
3-
powershell.exe %~dp0autobuild-impl.ps1
3+
echo "Running PowerShell script at '%~dp0autobuild-impl.ps1'"
4+
powershell.exe -File "%~dp0autobuild-impl.ps1"

‎actions/extractor/tools/autobuild.sh

Lines changed: 17 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,16 +17,28 @@ include:**/action.yaml
1717
END
1818
)
1919

20-
if [ -n "${LGTM_INDEX_INCLUDE:-}" ] || [ -n "${LGTM_INDEX_EXCLUDE:-}" ] || [ -n "${LGTM_INDEX_FILTERS:-}" ] ; then
21-
echo "Path filters set. Passing them through to the JavaScript extractor."
20+
if [ -n "${LGTM_INDEX_FILTERS:-}" ]; then
21+
echo "LGTM_INDEX_FILTERS set. Using the default filters together with the user-provided filters, and passing through to the JavaScript extractor."
22+
# Begin with the default path inclusions only,
23+
# followed by the user-provided filters.
24+
# If the user provided `paths`, those patterns override the default inclusions
25+
# (because `LGTM_INDEX_FILTERS` will begin with `exclude:**/*`).
26+
# If the user provided `paths-ignore`, those patterns are excluded.
27+
PATH_FILTERS="$(cat << END
28+
${DEFAULT_PATH_FILTERS}
29+
${LGTM_INDEX_FILTERS}
30+
END
31+
)"
32+
LGTM_INDEX_FILTERS="${PATH_FILTERS}"
33+
export LGTM_INDEX_FILTERS
2234
else
23-
echo "No path filters set. Using the default filters."
35+
echo "LGTM_INDEX_FILTERS not set. Using the default filters, and passing through to the JavaScript extractor."
2436
LGTM_INDEX_FILTERS="${DEFAULT_PATH_FILTERS}"
2537
export LGTM_INDEX_FILTERS
2638
fi
2739

2840
# Find the JavaScript extractor directory via `codeql resolve extractor`.
29-
CODEQL_EXTRACTOR_JAVASCRIPT_ROOT="$($CODEQL_DIST/codeql resolve extractor --language javascript)"
41+
CODEQL_EXTRACTOR_JAVASCRIPT_ROOT="$("${CODEQL_DIST}/codeql" resolve extractor --language javascript)"
3042
export CODEQL_EXTRACTOR_JAVASCRIPT_ROOT
3143

3244
echo "Found JavaScript extractor at '${CODEQL_EXTRACTOR_JAVASCRIPT_ROOT}'."
@@ -42,4 +54,4 @@ env CODEQL_EXTRACTOR_JAVASCRIPT_DIAGNOSTIC_DIR="${CODEQL_EXTRACTOR_ACTIONS_DIAGN
4254
CODEQL_EXTRACTOR_JAVASCRIPT_SOURCE_ARCHIVE_DIR="${CODEQL_EXTRACTOR_ACTIONS_SOURCE_ARCHIVE_DIR}" \
4355
CODEQL_EXTRACTOR_JAVASCRIPT_TRAP_DIR="${CODEQL_EXTRACTOR_ACTIONS_TRAP_DIR}" \
4456
CODEQL_EXTRACTOR_JAVASCRIPT_WIP_DATABASE="${CODEQL_EXTRACTOR_ACTIONS_WIP_DATABASE}" \
45-
${JAVASCRIPT_AUTO_BUILD}
57+
"${JAVASCRIPT_AUTO_BUILD}"

‎actions/ql/integration-tests/filters-default/actions.ql

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
import actions
2+
3+
from AstNode n
4+
where n instanceof Workflow or n instanceof CompositeAction
5+
select n

‎actions/ql/integration-tests/filters/actions.default-filters.expected

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
| src/.github/action.yaml:1:1:11:32 | name: ' ... action' |
2+
| src/.github/actions/action-name/action.yml:1:1:11:32 | name: ' ... action' |
3+
| src/.github/workflows/workflow.yml:1:1:12:33 | name: A workflow |
4+
| src/action.yml:1:1:11:32 | name: ' ... action' |
5+
| src/excluded/action.yml:1:1:11:32 | name: ' ... action' |
6+
| src/included/action.yml:1:1:11:32 | name: ' ... action' |

‎actions/ql/integration-tests/filters/actions.paths-and-paths-ignore.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
| src/included/action.yml:1:1:11:32 | name: ' ... action' |
2+
| src/included/unreachable-workflow.yml:1:1:12:33 | name: A ... orkflow |

‎actions/ql/integration-tests/filters/actions.paths-ignore-only.expected

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
| src/.github/action.yaml:1:1:11:32 | name: ' ... action' |
2+
| src/.github/actions/action-name/action.yml:1:1:11:32 | name: ' ... action' |
3+
| src/.github/workflows/workflow.yml:1:1:12:33 | name: A workflow |
4+
| src/action.yml:1:1:11:32 | name: ' ... action' |
5+
| src/included/action.yml:1:1:11:32 | name: ' ... action' |

‎actions/ql/integration-tests/filters/actions.paths-only.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
| src/included/action.yml:1:1:11:32 | name: ' ... action' |
2+
| src/included/unreachable-workflow.yml:1:1:12:33 | name: A ... orkflow |

‎actions/ql/integration-tests/filters/actions.ql

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
import actions
2+
3+
from AstNode n
4+
where n instanceof Workflow or n instanceof CompositeAction
5+
select n

‎actions/ql/integration-tests/filters/codeql-config.paths-and-paths-ignore.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
paths:
2+
- 'included'
3+
paths-ignore:
4+
- 'excluded'

‎actions/ql/integration-tests/filters/codeql-config.paths-ignore-only.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
paths-ignore:
2+
- 'excluded'

‎actions/ql/integration-tests/filters/codeql-config.paths-only.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
paths:
2+
- 'included'

‎actions/ql/integration-tests/filters/source_archive.default-filters.expected

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
src/.github/action.yaml
2+
src/.github/actions/action-name/action.yml
3+
src/.github/workflows/workflow.yml
4+
src/action.yml
5+
src/excluded/action.yml
6+
src/included/action.yml

‎actions/ql/integration-tests/filters/source_archive.paths-and-paths-ignore.expected

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
src/included/action.yml
2+
src/included/not-an-action.yml
3+
src/included/unreachable-workflow.yml

‎actions/ql/integration-tests/filters/source_archive.paths-ignore-only.expected

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
src/.github/action.yaml
2+
src/.github/actions/action-name/action.yml
3+
src/.github/workflows/workflow.yml
4+
src/action.yml
5+
src/included/action.yml

‎actions/ql/integration-tests/filters/source_archive.paths-only.expected

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
src/included/action.yml
2+
src/included/not-an-action.yml
3+
src/included/unreachable-workflow.yml

‎actions/ql/integration-tests/filters/src/.github/action.yaml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
name: 'A composite action'
2+
description: 'Do something'
3+
runs:
4+
using: "composite"
5+
steps:
6+
- name: Print
7+
run: echo "Hello world"
8+
shell: bash
9+
10+
- name: Checkout
11+
uses: actions/checkout@v4

‎actions/ql/integration-tests/filters/src/.github/actions/action-name/action.yml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
name: 'A composite action'
2+
description: 'Do something'
3+
runs:
4+
using: "composite"
5+
steps:
6+
- name: Print
7+
run: echo "Hello world"
8+
shell: bash
9+
10+
- name: Checkout
11+
uses: actions/checkout@v4

‎actions/ql/integration-tests/filters/src/.github/unreachable-workflow.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
name: An unreachable workflow
2+
on:
3+
push:
4+
branches:
5+
- main
6+
7+
jobs:
8+
job:
9+
runs-on: ubuntu-latest
10+
steps:
11+
- name: Checkout code
12+
uses: actions/checkout@v4

‎actions/ql/integration-tests/filters/src/.github/workflows/workflow.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
name: A workflow
2+
on:
3+
push:
4+
branches:
5+
- main
6+
7+
jobs:
8+
job:
9+
runs-on: ubuntu-latest
10+
steps:
11+
- name: Checkout code
12+
uses: actions/checkout@v4

‎actions/ql/integration-tests/filters/src/action.yml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
name: 'A composite action'
2+
description: 'Do something'
3+
runs:
4+
using: "composite"
5+
steps:
6+
- name: Print
7+
run: echo "Hello world"
8+
shell: bash
9+
10+
- name: Checkout
11+
uses: actions/checkout@v4

‎actions/ql/integration-tests/filters/src/excluded/action.yml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
name: 'A composite action'
2+
description: 'Do something'
3+
runs:
4+
using: "composite"
5+
steps:
6+
- name: Print
7+
run: echo "Hello world"
8+
shell: bash
9+
10+
- name: Checkout
11+
uses: actions/checkout@v4

‎actions/ql/integration-tests/filters/src/excluded/unreachable-workflow.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
name: An unreachable workflow
2+
on:
3+
push:
4+
branches:
5+
- main
6+
7+
jobs:
8+
job:
9+
runs-on: ubuntu-latest
10+
steps:
11+
- name: Checkout code
12+
uses: actions/checkout@v4

‎actions/ql/integration-tests/filters/src/included/action.yml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
name: 'A composite action'
2+
description: 'Do something'
3+
runs:
4+
using: "composite"
5+
steps:
6+
- name: Print
7+
run: echo "Hello world"
8+
shell: bash
9+
10+
- name: Checkout
11+
uses: actions/checkout@v4

‎actions/ql/integration-tests/filters/src/included/not-an-action.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
name: 'Not an action, just a YAML file'

‎actions/ql/integration-tests/filters/src/included/unreachable-workflow.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
name: An unreachable workflow
2+
on:
3+
push:
4+
branches:
5+
- main
6+
7+
jobs:
8+
job:
9+
runs-on: ubuntu-latest
10+
steps:
11+
- name: Checkout code
12+
uses: actions/checkout@v4

‎actions/ql/integration-tests/filters/src/unreachable-workflow.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
name: An unreachable workflow
2+
on:
3+
push:
4+
branches:
5+
- main
6+
7+
jobs:
8+
job:
9+
runs-on: ubuntu-latest
10+
steps:
11+
- name: Checkout code
12+
uses: actions/checkout@v4

‎actions/ql/integration-tests/filters/test.py

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
import pytest
2+
3+
@pytest.mark.ql_test(expected=".default-filters.expected")
4+
def test_default_filters(codeql, actions, check_source_archive):
5+
check_source_archive.expected_suffix = ".default-filters.expected"
6+
codeql.database.create(source_root="src")
7+
8+
@pytest.mark.ql_test(expected=".paths-only.expected")
9+
def test_config_paths_only(codeql, actions):
10+
codeql.database.create(source_root="src", codescanning_config="codeql-config.paths-only.yml")
11+
12+
@pytest.mark.ql_test(expected=".paths-ignore-only.expected")
13+
def test_config_paths_ignore_only(codeql, actions):
14+
codeql.database.create(source_root="src", codescanning_config="codeql-config.paths-ignore-only.yml")
15+
16+
@pytest.mark.ql_test(expected=".paths-and-paths-ignore.expected")
17+
def test_config_paths_and_paths_ignore(codeql, actions):
18+
codeql.database.create(source_root="src", codescanning_config="codeql-config.paths-and-paths-ignore.yml")

‎cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll

Lines changed: 16 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -465,7 +465,7 @@ private predicate isFunctionConstructedFrom(Function f, Function templateFunc) {
465465
}
466466

467467
/** Gets the fully templated version of `f`. */
468-
private Function getFullyTemplatedFunction(Function f) {
468+
Function getFullyTemplatedFunction(Function f) {
469469
not f.isFromUninstantiatedTemplate(_) and
470470
(
471471
exists(Class c, Class templateClass, int i |
@@ -559,27 +559,35 @@ private string getTypeName(Type t, boolean needsSpace) {
559559

560560
/**
561561
* Gets a type name for the `n`'th parameter of `f` without any template
562-
* arguments. The result may be a string representing a type for which the
563-
* typedefs have been resolved.
562+
* arguments.
563+
*
564+
* If `canonical = false` then the result may be a string representing a type
565+
* for which the typedefs have been resolved. If `canonical = true` then the
566+
* result will be a string representing a type without resolving `typedefs`.
564567
*/
565568
bindingset[f]
566569
pragma[inline_late]
567-
string getParameterTypeWithoutTemplateArguments(Function f, int n) {
570+
string getParameterTypeWithoutTemplateArguments(Function f, int n, boolean canonical) {
568571
exists(string s, string base, string specifiers, Type t |
569572
t = f.getParameter(n).getType() and
570573
// The name of the string can either be the possibly typedefed name
571574
// or an alternative name where typedefs has been resolved.
572575
// `getTypeName(t, _)` is almost equal to `t.resolveTypedefs().getName()`,
573576
// except that `t.resolveTypedefs()` doesn't have a result when the
574577
// resulting type doesn't appear in the database.
575-
s = [t.getName(), getTypeName(t, _)] and
578+
(
579+
s = t.getName() and canonical = true
580+
or
581+
s = getTypeName(t, _) and canonical = false
582+
) and
576583
parseAngles(s, base, _, specifiers) and
577584
result = base + specifiers
578585
)
579586
or
580587
f.isVarargs() and
581588
n = f.getNumberOfParameters() and
582-
result = "..."
589+
result = "..." and
590+
canonical = true
583591
}
584592

585593
/**
@@ -590,7 +598,7 @@ private string getTypeNameWithoutFunctionTemplates(Function f, int n, int remain
590598
exists(Function templateFunction |
591599
templateFunction = getFullyTemplatedFunction(f) and
592600
remaining = templateFunction.getNumberOfTemplateArguments() and
593-
result = getParameterTypeWithoutTemplateArguments(templateFunction, n)
601+
result = getParameterTypeWithoutTemplateArguments(templateFunction, n, _)
594602
)
595603
or
596604
exists(string mid, TypeTemplateParameter tp, Function templateFunction |
@@ -627,7 +635,7 @@ private string getTypeNameWithoutClassTemplates(Function f, int n, int remaining
627635
}
628636

629637
/** Gets the string representation of the `i`'th parameter of `c`. */
630-
private string getParameterTypeName(Function c, int i) {
638+
string getParameterTypeName(Function c, int i) {
631639
result = getTypeNameWithoutClassTemplates(c, i, 0)
632640
}
633641

0 commit comments

Comments
 (0)