Skip to content

Commit a7d3feb

Browse files
krishnprakashkrishnprakash
authored
Merge branch 'github:main' into main-1
2 parents 579038f + 93b1114 commit a7d3feb

File tree

157 files changed

+7408
-2740
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

157 files changed

+7408
-2740
lines changed

‎.github/workflows/go-tests-other-os.yml

+1
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ on:
33
pull_request:
44
paths:
55
- "go/**"
6+
- "!go/documentation/**"
67
- "!go/ql/**" # don't run other-os if only ql/ files changed
78
- .github/workflows/go-tests-other-os.yml
89
- .github/actions/**

‎.github/workflows/go-tests.yml

+2
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ on:
33
push:
44
paths:
55
- "go/**"
6+
- "!go/documentation/**"
67
- "shared/**"
78
- .github/workflows/go-tests.yml
89
- .github/actions/**
@@ -13,6 +14,7 @@ on:
1314
pull_request:
1415
paths:
1516
- "go/**"
17+
- "!go/documentation/**"
1618
- "shared/**"
1719
- .github/workflows/go-tests.yml
1820
- .github/actions/**

‎actions/ql/extensions/immutable-actions-list/ext/immutable_actions.yml

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/actions-all
4+
extensible: immutableActionsDataModel
5+
data:
6+
- ["actions/checkout"]
7+
- ["actions/cache"]
8+
- ["actions/setup-node"]
9+
- ["actions/upload-artifact"]
10+
- ["actions/setup-python"]
11+
- ["actions/download-artifact"]
12+
- ["actions/github-script"]
13+
- ["actions/setup-java"]
14+
- ["actions/setup-go"]
15+
- ["actions/upload-pages-artifact"]
16+
- ["actions/deploy-pages"]
17+
- ["actions/setup-dotnet"]
18+
- ["actions/stale"]
19+
- ["actions/labeler"]
20+
- ["actions/create-github-app-token"]
21+
- ["actions/configure-pages"]
22+
- ["github/codeql-action/analyze"]
23+
- ["github/codeql-action/autobuild"]
24+
- ["github/codeql-action/init"]
25+
- ["github/codeql-action/resolve-environment"]
26+
- ["github/codeql-action/start-proxy"]
27+
- ["github/codeql-action/upload-sarif"]
28+
- ["octokit/request-action"]

‎actions/ql/extensions/immutable-actions-list/qlpack.yml

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# Model pack containing the list of known immutable actions. The Immutable Actions feature is not
2+
# yet released, so this pack will only be used within GitHub. Once the feature is available to
3+
# customers, we will move the contents of this pack back into the standard library pack.
4+
name: codeql/immutable-actions-list
5+
version: 0.0.1-dev
6+
library: true
7+
warnOnImplicitThis: true
8+
extensionTargets:
9+
# We expect to need this model pack even after GA of Actions analysis, so make it compatible with
10+
# all future prereleases plus 1.x.x. We should be able to remove this back before we need to
11+
# bump the major version to 2.
12+
codeql/actions-all: ">=0.4.3 <2.0.0"
13+
dataExtensions:
14+
- ext/**/*.yml

‎actions/ql/lib/ext/config/immutable_actions.yml

+6-18
Original file line numberDiff line numberDiff line change
@@ -2,21 +2,9 @@ extensions:
22
- addsTo:
33
pack: codeql/actions-all
44
extensible: immutableActionsDataModel
5-
data:
6-
- ["actions/checkout"]
7-
- ["actions/cache"]
8-
- ["actions/setup-node"]
9-
- ["actions/upload-artifact"]
10-
- ["actions/setup-python"]
11-
- ["actions/download-artifact"]
12-
- ["actions/github-script"]
13-
- ["actions/setup-java"]
14-
- ["actions/setup-go"]
15-
- ["actions/upload-pages-artifact"]
16-
- ["actions/deploy-pages"]
17-
- ["actions/setup-dotnet"]
18-
- ["actions/stale"]
19-
- ["actions/labeler"]
20-
- ["actions/create-github-app-token"]
21-
- ["actions/configure-pages"]
22-
- ["octokit/request-action"]
5+
# Since the Immutable Actions feature is not yet available to customers, we won't alert about
6+
# any unversioned immutable action references for now. Within GitHub, we'll include the
7+
# `codeql/immutable-actions-list` model pack, which will provide the necessary list of actions
8+
# for internal use. Once the feature is available to customers, we'll move that list back into
9+
# this file.
10+
data: []

‎actions/ql/lib/ext/config/trusted_actions_owner.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,4 @@ extensions:
55
data:
66
- ["actions"]
77
- ["github"]
8-
- ["advanced-security"]
8+
- ["advanced-security"]

‎actions/ql/src/change-notes/2025-02-27-immutable-actions-list.md

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
category: fix
3+
---
4+
* The `actions/unversioned-immutable-action` query will no longer report any alerts, since the
5+
Immutable Actions feature is not yet available for customer use. The query remains in the
6+
default Code Scanning suites for use internal to GitHub. Once the Immutable Actions feature is
7+
available, the query will be updated to report alerts again.

‎actions/ql/test/qlpack.yml

+4
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,10 @@ groups: [codeql, test]
33
dependencies:
44
codeql/actions-all: ${workspace}
55
codeql/actions-queries: ${workspace}
6+
# Use the `immutable-actions-list` model pack so that we have some actual data to test against.
7+
# We can remove this dependency when we incorporate the data from that model pack back into the
8+
# standard library pack.
9+
codeql/immutable-actions-list: ${workspace}
610
extractor: actions
711
tests: .
812
warnOnImplicitThis: true

‎codeql-workspace.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ provide:
1717
- "misc/legacy-support/*/qlpack.yml"
1818
- "misc/suite-helpers/qlpack.yml"
1919
- ".github/codeql/extensions/**/codeql-pack.yml"
20-
20+
- "actions/ql/extensions/**/qlpack.yml"
2121
versionPolicies:
2222
default:
2323
requireChangeNotes: true

‎docs/codeql/reusables/supported-versions-compilers.rst

+1-1
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
.NET Core up to 3.1
1717

1818
.NET 5, .NET 6, .NET 7, .NET 8, .NET 9","``.sln``, ``.csproj``, ``.cs``, ``.cshtml``, ``.xaml``"
19-
Go (aka Golang), "Go up to 1.23", "Go 1.11 or more recent", ``.go``
19+
Go (aka Golang), "Go up to 1.24", "Go 1.11 or more recent", ``.go``
2020
Java,"Java 7 to 22 [5]_","javac (OpenJDK and Oracle JDK),
2121

2222
Eclipse compiler for Java (ECJ) [6]_",``.java``

‎go/.gitignore

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# artifacts of running `make test`
2+
data/
3+
lock
4+
size

‎go/documentation/library-coverage/coverage.csv

+1-1
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ github.com/spf13/afero,34,,,,,,,,34,,,,,,,,,,,,,,,,,,
9595
github.com/square/go-jose,3,,4,,2,1,,,,,,,,,,,,,,,,,,,,4,
9696
github.com/uptrace/bun,63,,,,,,,,,,,,,,63,,,,,,,,,,,,
9797
github.com/valyala/fasthttp,35,50,5,,,,,,8,,,,17,8,,2,,,,,,,,50,,5,
98-
go.mongodb.org/mongo-driver/mongo,14,,,,,,,14,,,,,,,,,,,,,,,,,,,
98+
go.mongodb.org/mongo-driver/mongo,14,11,5,,,,,14,,,,,,,,,,,,,11,,,,,5,
9999
go.uber.org/zap,33,,11,,,,33,,,,,,,,,,,,,,,,,,,11,
100100
golang.org/x/crypto/ssh,4,,,4,,,,,,,,,,,,,,,,,,,,,,,
101101
golang.org/x/net/context,,,5,,,,,,,,,,,,,,,,,,,,,,,5,

‎go/documentation/library-coverage/coverage.rst

+2-2
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ Go framework & library support
2828
`Kubernetes <https://kubernetes.io/>`_,"``k8s.io/api*``, ``k8s.io/apimachinery*``",,57,
2929
`Logrus <https://github.com/sirupsen/logrus>`_,"``github.com/Sirupsen/logrus*``, ``github.com/sirupsen/logrus*``",,,290
3030
`Macaron <https://gopkg.in/macaron.v1>`_,``gopkg.in/macaron*``,12,1,1
31-
`MongoDB Go Driver <https://www.mongodb.com/docs/drivers/go/current/>`_,``go.mongodb.org/mongo-driver*``,,,14
31+
`MongoDB Go Driver <https://www.mongodb.com/docs/drivers/go/current/>`_,``go.mongodb.org/mongo-driver*``,11,5,14
3232
`Revel <http://revel.github.io/>`_,"``github.com/revel/revel*``, ``github.com/robfig/revel*``",46,20,4
3333
`SendGrid <https://github.com/sendgrid/sendgrid-go>`_,``github.com/sendgrid/sendgrid-go*``,,1,
3434
`Squirrel <https://github.com/Masterminds/squirrel>`_,"``github.com/Masterminds/squirrel*``, ``github.com/lann/squirrel*``, ``gopkg.in/Masterminds/squirrel``",,,96
@@ -73,5 +73,5 @@ Go framework & library support
7373
`xpathparser <https://github.com/santhosh-tekuri/xpathparser>`_,``github.com/santhosh-tekuri/xpathparser*``,,,2
7474
`yaml <https://gopkg.in/yaml.v3>`_,``gopkg.in/yaml*``,,9,
7575
`zap <https://go.uber.org/zap>`_,``go.uber.org/zap*``,,11,33
76-
Totals,,459,947,1532
76+
Totals,,470,952,1532
7777

‎go/ql/lib/change-notes/2025-02-25-go-database-rqlite-sources.md

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Added `database` source models for the `github.com/rqlite/gorqlite` package.

‎go/ql/lib/change-notes/2025-02-26-location-info-changed.md

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* The location info for the following classes has been changed slightly to match a location that is in the database: `BasicBlock`, `ControlFlow::EntryNode`, `ControlFlow::ExitNode`, `ControlFlow::ConditionGuardNode`, `IR::ImplicitLiteralElementIndexInstruction`, `IR::EvalImplicitTrueInstruction`, `SsaImplicitDefinition`, `SsaPhiNode`.

‎go/ql/lib/change-notes/2025-02-27-go-version-1-24.md

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: majorAnalysis
3+
---
4+
* Go 1.24 is now supported. This includes the new language feature of generic type aliases.

‎go/ql/lib/change-notes/2025-02-27-haslocationinfo-deprecated.md

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: deprecated
3+
---
4+
* The member predicate `hasLocationInfo` has been deprecated on the following classes: `BasicBlock`, `Callable`, `Content`, `ContentSet`, `ControlFlow::Node`, `DataFlowCallable`, `DataFlow::Node`, `Entity`, `GVN`, `HtmlTemplate::TemplateStmt`, `IR:WriteTarget`, `SourceSinkInterpretationInput::SourceOrSinkElement`, `SourceSinkInterpretationInput::InterpretNode`, `SsaVariable`, `SsaDefinition`, `SsaWithFields`, `StringOps::ConcatenationElement`, `Type`, and `VariableWithFields`. Use `getLocation()` instead.

‎go/ql/lib/ext/github.com.rqlite.gorqlite.model.yml

+19
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,21 @@ extensions:
33
pack: codeql/go-all
44
extensible: packageGrouping
55
data:
6+
- ["gorqlite", "github.com/kanikanema/gorqlite"]
67
- ["gorqlite", "github.com/rqlite/gorqlite"]
78
- ["gorqlite", "github.com/raindog308/gorqlite"]
9+
- addsTo:
10+
pack: codeql/go-all
11+
extensible: sourceModel
12+
data:
13+
- ["group:gorqlite", "Connection", True, "Query", "", "", "ReturnValue[0]", "database", "manual"]
14+
- ["group:gorqlite", "Connection", True, "QueryContext", "", "", "ReturnValue[0]", "database", "manual"]
15+
- ["group:gorqlite", "Connection", True, "QueryOne", "", "", "ReturnValue[0]", "database", "manual"]
16+
- ["group:gorqlite", "Connection", True, "QueryOneContext", "", "", "ReturnValue[0]", "database", "manual"]
17+
- ["group:gorqlite", "Connection", True, "QueryOneParameterized", "", "", "ReturnValue[0]", "database", "manual"]
18+
- ["group:gorqlite", "Connection", True, "QueryOneParameterizedContext", "", "", "ReturnValue[0]", "database", "manual"]
19+
- ["group:gorqlite", "Connection", True, "QueryParameterized", "", "", "ReturnValue[0]", "database", "manual"]
20+
- ["group:gorqlite", "Connection", True, "QueryParameterizedContext", "", "", "ReturnValue[0]", "database", "manual"]
821
- addsTo:
922
pack: codeql/go-all
1023
extensible: sinkModel
@@ -33,3 +46,9 @@ extensions:
3346
- ["group:gorqlite", "Connection", True, "WriteOneParameterizedContext", "", "", "Argument[1]", "sql-injection", "manual"]
3447
- ["group:gorqlite", "Connection", True, "WriteParameterized", "", "", "Argument[0]", "sql-injection", "manual"]
3548
- ["group:gorqlite", "Connection", True, "WriteParameterizedContext", "", "", "Argument[1]", "sql-injection", "manual"]
49+
- addsTo:
50+
pack: codeql/go-all
51+
extensible: summaryModel
52+
data:
53+
- ["group:gorqlite", "QueryResult", True, "Map", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]
54+
- ["group:gorqlite", "QueryResult", True, "Slice", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]

‎go/ql/lib/semmle/go/DiagnosticsReporting.qll

+4-13
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
/** Provides classes for working with errors and warnings recorded during extraction. */
22

33
import go
4-
private import semmle.go.internal.Locations
54

65
/** Gets the SARIF severity level that indicates an error. */
76
private int getErrorSeverity() { result = 2 }
@@ -20,18 +19,10 @@ private class Diagnostic extends @diagnostic {
2019
string getMessage() { diagnostics(this, _, _, result, _, _) }
2120

2221
/** Gets the file that this error is associated with, if any. */
23-
File getFile() { this.hasLocationInfo(result.getAbsolutePath(), _, _, _, _) }
22+
File getFile() { result = this.getLocation().getFile() }
2423

25-
/**
26-
* Holds if this element is at the specified location.
27-
* The location spans column `startcolumn` of line `startline` to
28-
* column `endcolumn` of line `endline` in file `filepath`.
29-
* For more information, see
30-
* [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
31-
*/
32-
predicate hasLocationInfo(string path, int sl, int sc, int el, int ec) {
33-
getDiagnosticLocation(this).hasLocationInfo(path, sl, sc, el, ec)
34-
}
24+
/** Gets the location for this error. */
25+
Location getLocation() { diagnostics(this, _, _, _, _, result) }
3526

3627
string toString() { result = this.getMessage() }
3728
}
@@ -68,7 +59,7 @@ predicate reportableDiagnostics(Diagnostic d, string msg, int sev) {
6859
exists(File f | f = d.getFile() |
6960
exists(f.getAChild()) and
7061
msg =
71-
"Extraction failed in " + d.getFile().getRelativePath() + " with error " +
62+
"Extraction failed in " + f.getRelativePath() + " with error " +
7263
removeAbsolutePaths(d.getMessage())
7364
)
7465
or

‎go/ql/lib/semmle/go/Locations.qll

+11-12
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
/** Provides classes for working with locations and program elements that have locations. */
22

33
import go
4-
private import internal.Locations
54

65
/**
76
* A location as given by a file, a start line, a start column,
@@ -11,21 +10,21 @@ private import internal.Locations
1110
*
1211
* For more information about locations see [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
1312
*/
14-
class DbLocation extends TDbLocation {
13+
class Location extends @location {
1514
/** Gets the file for this location. */
16-
File getFile() { dbLocationInfo(this, result, _, _, _, _) }
15+
File getFile() { locations_default(this, result, _, _, _, _) }
1716

1817
/** Gets the 1-based line number (inclusive) where this location starts. */
19-
int getStartLine() { dbLocationInfo(this, _, result, _, _, _) }
18+
int getStartLine() { locations_default(this, _, result, _, _, _) }
2019

2120
/** Gets the 1-based column number (inclusive) where this location starts. */
22-
int getStartColumn() { dbLocationInfo(this, _, _, result, _, _) }
21+
int getStartColumn() { locations_default(this, _, _, result, _, _) }
2322

2423
/** Gets the 1-based line number (inclusive) where this location ends. */
25-
int getEndLine() { dbLocationInfo(this, _, _, _, result, _) }
24+
int getEndLine() { locations_default(this, _, _, _, result, _) }
2625

2726
/** Gets the 1-based column number (inclusive) where this location ends. */
28-
int getEndColumn() { dbLocationInfo(this, _, _, _, _, result) }
27+
int getEndColumn() { locations_default(this, _, _, _, _, result) }
2928

3029
/** Gets the number of lines covered by this location. */
3130
int getNumLines() { result = this.getEndLine() - this.getStartLine() + 1 }
@@ -48,22 +47,22 @@ class DbLocation extends TDbLocation {
4847
predicate hasLocationInfo(
4948
string filepath, int startline, int startcolumn, int endline, int endcolumn
5049
) {
51-
exists(File f |
52-
dbLocationInfo(this, f, startline, startcolumn, endline, endcolumn) and
50+
exists(File f | locations_default(this, f, startline, startcolumn, endline, endcolumn) |
5351
filepath = f.getAbsolutePath()
5452
)
5553
}
5654
}
5755

58-
final class Location = LocationImpl;
59-
6056
/** A program element with a location. */
6157
class Locatable extends @locatable {
6258
/** Gets the file this program element comes from. */
6359
File getFile() { result = this.getLocation().getFile() }
6460

6561
/** Gets this element's location. */
66-
final DbLocation getLocation() { result = getLocatableLocation(this) }
62+
final Location getLocation() {
63+
has_location(this, result) or
64+
xmllocations(this, result)
65+
}
6766

6867
/** Gets the number of lines covered by this element. */
6968
int getNumLines() { result = this.getLocation().getNumLines() }

0 commit comments

Comments
 (0)