Skip to content

Commit df10a7e

Browse files
ghsecuritylabghsecuritylab
authored
Merge branch 'main' into amammad-js-bombs
2 parents 32859eb + 01b8950 commit df10a7e

File tree

10,863 files changed

+1028957
-427152
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

10,863 files changed

+1028957
-427152
lines changed

‎.bazelversion

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
6.1.2
1+
6.3.1

‎.gitattributes

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,3 +71,6 @@ go/extractor/opencsv/CSVReader.java -text
7171
# `javascript/ql/experimental/adaptivethreatmodeling/test/update_endpoint_test_files.py`.
7272
javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_large_scale/autogenerated/**/*.js linguist-generated=true -merge
7373
javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_large_scale/autogenerated/**/*.ts linguist-generated=true -merge
74+
75+
# Auto-generated modeling for Python
76+
python/ql/lib/semmle/python/frameworks/data/internal/subclass-capture/*.yml linguist-generated=true

‎.github/dependabot.yml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,3 +17,26 @@ updates:
1717
ignore:
1818
- dependency-name: '*'
1919
update-types: ['version-update:semver-patch', 'version-update:semver-minor']
20+
21+
- package-ecosystem: "gomod"
22+
directory: "go/extractor"
23+
schedule:
24+
interval: "daily"
25+
allow:
26+
- dependency-name: "golang.org/x/mod"
27+
- dependency-name: "golang.org/x/tools"
28+
groups:
29+
extractor-dependencies:
30+
patterns:
31+
- "golang.org/x/*"
32+
reviewers:
33+
- "github/codeql-go"
34+
35+
- package-ecosystem: "gomod"
36+
directory: "go/ql/test"
37+
schedule:
38+
interval: "monthly"
39+
ignore:
40+
- dependency-name: "*"
41+
reviewers:
42+
- "github/codeql-go"

‎.github/labeler.yml

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -45,11 +45,7 @@ documentation:
4545

4646
# Since these are all shared files that need to be synced, just pick _one_ copy of each.
4747
"DataFlow Library":
48-
- "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl.qll"
49-
- "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll"
50-
- "java/ql/lib/semmle/code/java/dataflow/internal/tainttracking1/TaintTrackingImpl.qll"
51-
- "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImplConsistency.qll"
52-
- "java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll"
48+
- "shared/dataflow/**/*"
5349

5450
"ATM":
5551
- javascript/ql/experimental/adaptivethreatmodeling/**/*

‎.github/workflows/check-change-note.yml

Lines changed: 24 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -9,26 +9,42 @@ on:
99
- "*/ql/lib/**/*.ql"
1010
- "*/ql/lib/**/*.qll"
1111
- "*/ql/lib/**/*.yml"
12+
- "shared/**/*.ql"
13+
- "shared/**/*.qll"
1214
- "!**/experimental/**"
1315
- "!ql/**"
1416
- ".github/workflows/check-change-note.yml"
1517

1618
jobs:
1719
check-change-note:
20+
env:
21+
REPO: ${{ github.repository }}
22+
PULL_REQUEST_NUMBER: ${{ github.event.number }}
23+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
1824
runs-on: ubuntu-latest
1925
steps:
26+
2027
- name: Fail if no change note found. To fix, either add one, or add the `no-change-note-required` label.
2128
if: |
2229
github.event.pull_request.draft == false &&
2330
!contains(github.event.pull_request.labels.*.name, 'no-change-note-required')
24-
env:
25-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
2631
run: |
27-
gh api 'repos/${{github.repository}}/pulls/${{github.event.number}}/files' --paginate --jq 'any(.[].filename ; test("/change-notes/.*[.]md$"))' |
28-
grep true -c
32+
change_note_files=$(gh api "repos/$REPO/pulls/$PULL_REQUEST_NUMBER/files" --paginate --jq '.[].filename | select(test("/change-notes/.*[.]md$"))')
33+
34+
if [ -z "$change_note_files" ]; then
35+
echo "No change note found. Either add one, or add the 'no-change-note-required' label."
36+
exit 1
37+
fi
38+
39+
echo "Change notes found:"
40+
echo "$change_note_files"
41+
2942
- name: Fail if the change note filename doesn't match the expected format. The file name must be of the form 'YYYY-MM-DD.md', 'YYYY-MM-DD-{title}.md', where '{title}' is arbitrary text, or released/x.y.z.md for released change-notes
30-
env:
31-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
3243
run: |
33-
gh api 'repos/${{github.repository}}/pulls/${{github.event.number}}/files' --paginate --jq '[.[].filename | select(test("/change-notes/.*[.]md$"))] | all(test("/change-notes/[0-9]{4}-[0-9]{2}-[0-9]{2}.*[.]md$") or test("/change-notes/released/[0-9]*[.][0-9]*[.][0-9]*[.]md$"))' |
34-
grep true -c
44+
bad_change_note_file_names=$(gh api "repos/$REPO/pulls/$PULL_REQUEST_NUMBER/files" --paginate --jq '[.[].filename | select(test("/change-notes/.*[.]md$"))][] | select((test("/change-notes/[0-9]{4}-[0-9]{2}-[0-9]{2}.*[.]md$") or test("/change-notes/released/[0-9]*[.][0-9]*[.][0-9]*[.]md$")) | not)')
45+
46+
if [ -n "$bad_change_note_file_names" ]; then
47+
echo "The following change note file names are invalid:"
48+
echo "$bad_change_note_file_names"
49+
exit 1
50+
fi

‎.github/workflows/check-implicit-this.yml

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
name: "Check implicit this warnings"
2+
3+
on:
4+
workflow_dispatch:
5+
pull_request:
6+
paths:
7+
- "**qlpack.yml"
8+
branches:
9+
- main
10+
- "rc/*"
11+
12+
jobs:
13+
check:
14+
runs-on: ubuntu-latest
15+
steps:
16+
- uses: actions/checkout@v4
17+
- name: Check that implicit this warnings is enabled for all packs
18+
shell: bash
19+
run: |
20+
EXIT_CODE=0
21+
packs="$(find . -iname 'qlpack.yml')"
22+
for pack_file in ${packs}; do
23+
option="$(yq '.warnOnImplicitThis' ${pack_file})"
24+
if [ "${option}" != "true" ]; then
25+
echo "::error file=${pack_file}::warnOnImplicitThis property must be set to 'true' for pack ${pack_file}"
26+
EXIT_CODE=1
27+
fi
28+
done
29+
exit "${EXIT_CODE}"

‎.github/workflows/check-qldoc.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515
runs-on: ubuntu-latest
1616

1717
steps:
18-
- uses: actions/checkout@v3
18+
- uses: actions/checkout@v4
1919
with:
2020
fetch-depth: 2
2121

‎.github/workflows/check-query-ids.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,6 @@ jobs:
1616
name: Check query IDs
1717
runs-on: ubuntu-latest
1818
steps:
19-
- uses: actions/checkout@v3
19+
- uses: actions/checkout@v4
2020
- name: Check for duplicate query IDs
2121
run: python3 misc/scripts/check-query-ids.py

‎.github/workflows/close-stale.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
runs-on: ubuntu-latest
1313

1414
steps:
15-
- uses: actions/stale@v8
15+
- uses: actions/stale@v9
1616
with:
1717
repo-token: ${{ secrets.GITHUB_TOKEN }}
1818
stale-issue-message: 'This issue is stale because it has been open 14 days with no activity. Comment or remove the `Stale` label in order to avoid having this issue closed in 7 days.'

‎.github/workflows/codeql-analysis.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,12 +28,12 @@ jobs:
2828

2929
steps:
3030
- name: Setup dotnet
31-
uses: actions/setup-dotnet@v3
31+
uses: actions/setup-dotnet@v4
3232
with:
33-
dotnet-version: 7.0.102
33+
dotnet-version: 8.0.100
3434

3535
- name: Checkout repository
36-
uses: actions/checkout@v3
36+
uses: actions/checkout@v4
3737

3838
# Initializes the CodeQL tools for scanning.
3939
- name: Initialize CodeQL

‎.github/workflows/compile-queries.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ jobs:
1313
runs-on: ubuntu-latest-xl
1414

1515
steps:
16-
- uses: actions/checkout@v3
16+
- uses: actions/checkout@v4
1717
- name: Setup CodeQL
1818
uses: ./.github/actions/fetch-codeql
1919
with:
@@ -29,9 +29,9 @@ jobs:
2929
# run with --check-only if running in a PR (github.sha != main)
3030
if : ${{ github.event_name == 'pull_request' }}
3131
shell: bash
32-
run: codeql query compile -q -j0 */ql/{src,examples} --keep-going --warnings=error --check-only --compilation-cache "${{ steps.query-cache.outputs.cache-dir }}"
32+
run: codeql query compile -q -j0 */ql/{src,examples} --keep-going --warnings=error --check-only --compilation-cache "${{ steps.query-cache.outputs.cache-dir }}" --compilation-cache-size=500
3333
- name: compile queries - full
3434
# do full compile if running on main - this populates the cache
3535
if : ${{ github.event_name != 'pull_request' }}
3636
shell: bash
37-
run: codeql query compile -q -j0 */ql/{src,examples} --keep-going --warnings=error --compilation-cache "${{ steps.query-cache.outputs.cache-dir }}"
37+
run: codeql query compile -q -j0 */ql/{src,examples} --keep-going --warnings=error --compilation-cache "${{ steps.query-cache.outputs.cache-dir }}" --compilation-cache-size=500

‎.github/workflows/csharp-qltest.yml

Lines changed: 32 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ jobs:
2929
qlupgrade:
3030
runs-on: ubuntu-latest
3131
steps:
32-
- uses: actions/checkout@v3
32+
- uses: actions/checkout@v4
3333
- uses: ./.github/actions/fetch-codeql
3434
- name: Check DB upgrade scripts
3535
run: |
@@ -52,8 +52,7 @@ jobs:
5252
matrix:
5353
slice: ["1/2", "2/2"]
5454
steps:
55-
- uses: actions/checkout@v3
56-
- uses: ./.github/actions/fetch-codeql
55+
- uses: actions/checkout@v4
5756
- uses: ./csharp/actions/create-extractor-pack
5857
- name: Cache compilation cache
5958
id: query-cache
@@ -62,25 +61,41 @@ jobs:
6261
key: csharp-qltest-${{ matrix.slice }}
6362
- name: Run QL tests
6463
run: |
65-
CODEQL_PATH=$(gh codeql version --format=json | jq -r .unpackedLocation)
66-
# The legacy ASP extractor is not in this repo, so take the one from the nightly build
67-
mv "$CODEQL_PATH/csharp/tools/extractor-asp.jar" "${{ github.workspace }}/csharp/extractor-pack/tools"
68-
# Safe guard against using the bundled extractor
69-
rm -rf "$CODEQL_PATH/csharp"
70-
codeql test run --threads=0 --ram 50000 --slice ${{ matrix.slice }} --search-path "${{ github.workspace }}/csharp/extractor-pack" --check-databases --check-undefined-labels --check-repeated-labels --check-redefined-labels --consistency-queries ql/consistency-queries ql/test --compilation-cache "${{ steps.query-cache.outputs.cache-dir }}"
64+
codeql test run --threads=0 --ram 50000 --slice ${{ matrix.slice }} --search-path extractor-pack --check-databases --check-undefined-labels --check-repeated-labels --check-redefined-labels --consistency-queries ql/consistency-queries ql/test --compilation-cache "${{ steps.query-cache.outputs.cache-dir }}"
7165
env:
7266
GITHUB_TOKEN: ${{ github.token }}
7367
unit-tests:
74-
runs-on: ubuntu-latest
68+
strategy:
69+
matrix:
70+
os: [ubuntu-latest, windows-2019]
71+
runs-on: ${{ matrix.os }}
7572
steps:
76-
- uses: actions/checkout@v3
73+
- uses: actions/checkout@v4
7774
- name: Setup dotnet
78-
uses: actions/setup-dotnet@v3
75+
uses: actions/setup-dotnet@v4
7976
with:
80-
dotnet-version: 7.0.102
77+
dotnet-version: 8.0.100
8178
- name: Extractor unit tests
8279
run: |
83-
dotnet test -p:RuntimeFrameworkVersion=7.0.2 "${{ github.workspace }}/csharp/extractor/Semmle.Util.Tests"
84-
dotnet test -p:RuntimeFrameworkVersion=7.0.2 "${{ github.workspace }}/csharp/extractor/Semmle.Extraction.Tests"
85-
dotnet test -p:RuntimeFrameworkVersion=7.0.2 "${{ github.workspace }}/csharp/autobuilder/Semmle.Autobuild.CSharp.Tests"
86-
dotnet test -p:RuntimeFrameworkVersion=7.0.2 "${{ github.workspace }}/cpp/autobuilder/Semmle.Autobuild.Cpp.Tests"
80+
dotnet test -p:RuntimeFrameworkVersion=8.0.0 extractor/Semmle.Util.Tests
81+
dotnet test -p:RuntimeFrameworkVersion=8.0.0 extractor/Semmle.Extraction.Tests
82+
dotnet test -p:RuntimeFrameworkVersion=8.0.0 autobuilder/Semmle.Autobuild.CSharp.Tests
83+
dotnet test -p:RuntimeFrameworkVersion=8.0.0 "${{ github.workspace }}/cpp/autobuilder/Semmle.Autobuild.Cpp.Tests"
84+
shell: bash
85+
stubgentest:
86+
runs-on: ubuntu-latest
87+
steps:
88+
- uses: actions/checkout@v4
89+
- uses: ./csharp/actions/create-extractor-pack
90+
- name: Run stub generator tests
91+
run: |
92+
# Generate (Asp)NetCore stubs
93+
STUBS_PATH=stubs_output
94+
python3 scripts/stubs/make_stubs_nuget.py webapp Swashbuckle.AspNetCore.Swagger 6.5.0 "$STUBS_PATH"
95+
rm -rf ql/test/resources/stubs/_frameworks
96+
# Update existing stubs in the repo with the freshly generated ones
97+
mv "$STUBS_PATH/output/stubs/_frameworks" ql/test/resources/stubs/
98+
git status
99+
codeql test run --threads=0 --search-path extractor-pack --check-databases --check-undefined-labels --check-repeated-labels --check-redefined-labels --consistency-queries ql/consistency-queries -- ql/test/library-tests/dataflow/flowsources/aspremote
100+
env:
101+
GITHUB_TOKEN: ${{ github.token }}

‎.github/workflows/csv-coverage-metrics.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ jobs:
1919
runs-on: ubuntu-latest
2020
steps:
2121
- name: Checkout repository
22-
uses: actions/checkout@v3
22+
uses: actions/checkout@v4
2323
- name: Setup CodeQL
2424
uses: ./.github/actions/fetch-codeql
2525
- name: Create empty database
@@ -47,7 +47,7 @@ jobs:
4747
runs-on: ubuntu-latest
4848
steps:
4949
- name: Checkout repository
50-
uses: actions/checkout@v3
50+
uses: actions/checkout@v4
5151
- name: Setup CodeQL
5252
uses: ./.github/actions/fetch-codeql
5353
- name: Create empty database

‎.github/workflows/csv-coverage-pr-artifacts.yml

Lines changed: 26 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,11 +31,11 @@ jobs:
3131
GITHUB_CONTEXT: ${{ toJSON(github.event) }}
3232
run: echo "$GITHUB_CONTEXT"
3333
- name: Clone self (github/codeql) - MERGE
34-
uses: actions/checkout@v3
34+
uses: actions/checkout@v4
3535
with:
3636
path: merge
3737
- name: Clone self (github/codeql) - BASE
38-
uses: actions/checkout@v3
38+
uses: actions/checkout@v4
3939
with:
4040
fetch-depth: 2
4141
path: base
@@ -89,9 +89,32 @@ jobs:
8989
- name: Save PR number
9090
run: |
9191
mkdir -p pr
92-
echo ${{ github.event.pull_request.number }} > pr/NR
92+
echo ${PR_NUMBER} > pr/NR
93+
env:
94+
PR_NUMBER: ${{ github.event.pull_request.number }}
9395
- name: Upload PR number
9496
uses: actions/upload-artifact@v3
9597
with:
9698
name: pr
9799
path: pr/
100+
- name: Save comment ID (if it exists)
101+
run: |
102+
# Find the latest comment starting with COMMENT_PREFIX
103+
COMMENT_PREFIX=":warning: The head of this PR and the base branch were compared for differences in the framework coverage reports."
104+
COMMENT_ID=$(gh api "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" --paginate | jq --arg prefix "${COMMENT_PREFIX}" 'map(select(.body|startswith($prefix)) | .id) | max // empty')
105+
if [[ -z ${COMMENT_ID} ]]
106+
then
107+
echo "Comment not found. Not uploading 'comment/ID' artifact."
108+
else
109+
mkdir -p comment
110+
echo ${COMMENT_ID} > comment/ID
111+
fi
112+
env:
113+
GITHUB_TOKEN: ${{ github.token }}
114+
PR_NUMBER: ${{ github.event.pull_request.number }}
115+
- name: Upload comment ID (if it exists)
116+
uses: actions/upload-artifact@v3
117+
with:
118+
name: comment
119+
path: comment/
120+
if-no-files-found: ignore

‎.github/workflows/csv-coverage-pr-comment.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ jobs:
2020
GITHUB_CONTEXT: ${{ toJSON(github.event) }}
2121
run: echo "$GITHUB_CONTEXT"
2222
- name: Clone self (github/codeql)
23-
uses: actions/checkout@v3
23+
uses: actions/checkout@v4
2424
- name: Set up Python 3.8
2525
uses: actions/setup-python@v4
2626
with:

‎.github/workflows/csv-coverage-timeseries.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,11 @@ jobs:
99

1010
steps:
1111
- name: Clone self (github/codeql)
12-
uses: actions/checkout@v3
12+
uses: actions/checkout@v4
1313
with:
1414
path: script
1515
- name: Clone self (github/codeql) for analysis
16-
uses: actions/checkout@v3
16+
uses: actions/checkout@v4
1717
with:
1818
path: codeqlModels
1919
fetch-depth: 0

‎.github/workflows/csv-coverage-update.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717
GITHUB_CONTEXT: ${{ toJSON(github.event) }}
1818
run: echo "$GITHUB_CONTEXT"
1919
- name: Clone self (github/codeql)
20-
uses: actions/checkout@v3
20+
uses: actions/checkout@v4
2121
with:
2222
path: ql
2323
fetch-depth: 0

‎.github/workflows/csv-coverage.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,11 @@ jobs:
1313

1414
steps:
1515
- name: Clone self (github/codeql)
16-
uses: actions/checkout@v3
16+
uses: actions/checkout@v4
1717
with:
1818
path: script
1919
- name: Clone self (github/codeql) for analysis
20-
uses: actions/checkout@v3
20+
uses: actions/checkout@v4
2121
with:
2222
path: codeqlModels
2323
ref: ${{ github.event.inputs.qlModelShaOverride || github.ref }}

‎.github/workflows/fast-forward.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ jobs:
2525
exit 1
2626
2727
- name: Checkout
28-
uses: actions/checkout@v3
28+
uses: actions/checkout@v4
2929

3030
- name: Git config
3131
shell: bash

0 commit comments

Comments
 (0)