Skip to content

Commit 0869a11

Browse files
author
Dilan
committed
Merge tag 'codeql-cli/latest'
Compatible with the latest released version of the CodeQL CLI
2 parents 4ddc425 + dbffe91 commit 0869a11

File tree

650 files changed

+18714
-7781
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

650 files changed

+18714
-7781
lines changed

‎.bazelrc

+3
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,9 @@ common --override_module=semmle_code=%workspace%/misc/bazel/semmle_code_stub
1212

1313
build --repo_env=CC=clang --repo_env=CXX=clang++
1414

15+
# print test output, like sembuild does.
16+
# Set to `errors` if this is too verbose.
17+
test --test_output all
1518
# we use transitions that break builds of `...`, so for `test` to work with that we need the following
1619
test --build_tests_only
1720

‎.github/workflows/go-tests-other-os.yml

+1
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ on:
33
pull_request:
44
paths:
55
- "go/**"
6+
- "!go/documentation/**"
67
- "!go/ql/**" # don't run other-os if only ql/ files changed
78
- .github/workflows/go-tests-other-os.yml
89
- .github/actions/**

‎.github/workflows/go-tests.yml

+2
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ on:
33
push:
44
paths:
55
- "go/**"
6+
- "!go/documentation/**"
67
- "shared/**"
78
- .github/workflows/go-tests.yml
89
- .github/actions/**
@@ -13,6 +14,7 @@ on:
1314
pull_request:
1415
paths:
1516
- "go/**"
17+
- "!go/documentation/**"
1618
- "shared/**"
1719
- .github/workflows/go-tests.yml
1820
- .github/actions/**

‎LICENSE

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
MIT License
22

3-
Copyright (c) 2006-2020 GitHub, Inc.
3+
Copyright (c) 2006-2025 GitHub, Inc.
44

55
Permission is hereby granted, free of charge, to any person obtaining a copy
66
of this software and associated documentation files (the "Software"), to deal

‎MODULE.bazel

+6-9
Original file line numberDiff line numberDiff line change
@@ -58,15 +58,12 @@ register_toolchains("@rust_toolchains//:all")
5858
py_deps = use_extension("//misc/bazel/3rdparty:py_deps_extension.bzl", "p")
5959
use_repo(
6060
py_deps,
61-
"vendor__anyhow-1.0.44",
62-
"vendor__cc-1.0.70",
63-
"vendor__clap-2.33.3",
64-
"vendor__regex-1.5.5",
65-
"vendor__smallvec-1.6.1",
66-
"vendor__string-interner-0.12.2",
67-
"vendor__thiserror-1.0.29",
68-
"vendor__tree-sitter-0.20.4",
69-
"vendor__tree-sitter-graph-0.7.0",
61+
"vendor_py__anyhow-1.0.95",
62+
"vendor_py__cc-1.2.14",
63+
"vendor_py__clap-4.5.30",
64+
"vendor_py__regex-1.11.1",
65+
"vendor_py__tree-sitter-0.20.4",
66+
"vendor_py__tree-sitter-graph-0.7.0",
7067
)
7168

7269
# deps for ruby+rust

‎actions/extractor/BUILD.bazel

+3-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,9 @@ codeql_pkg_files(
44
name = "extractor",
55
srcs = [
66
"codeql-extractor.yml",
7-
] + glob(["tools/**"]),
7+
"//:LICENSE",
8+
],
9+
exes = glob(["tools/**"]),
810
strip_prefix = strip_prefix.from_pkg(),
911
visibility = ["//actions:__pkg__"],
1012
)

‎actions/ql/extensions/immutable-actions-list/ext/immutable_actions.yml

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/actions-all
4+
extensible: immutableActionsDataModel
5+
data:
6+
- ["actions/checkout"]
7+
- ["actions/cache"]
8+
- ["actions/setup-node"]
9+
- ["actions/upload-artifact"]
10+
- ["actions/setup-python"]
11+
- ["actions/download-artifact"]
12+
- ["actions/github-script"]
13+
- ["actions/setup-java"]
14+
- ["actions/setup-go"]
15+
- ["actions/upload-pages-artifact"]
16+
- ["actions/deploy-pages"]
17+
- ["actions/setup-dotnet"]
18+
- ["actions/stale"]
19+
- ["actions/labeler"]
20+
- ["actions/create-github-app-token"]
21+
- ["actions/configure-pages"]
22+
- ["github/codeql-action/analyze"]
23+
- ["github/codeql-action/autobuild"]
24+
- ["github/codeql-action/init"]
25+
- ["github/codeql-action/resolve-environment"]
26+
- ["github/codeql-action/start-proxy"]
27+
- ["github/codeql-action/upload-sarif"]
28+
- ["octokit/request-action"]

‎actions/ql/extensions/immutable-actions-list/qlpack.yml

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# Model pack containing the list of known immutable actions. The Immutable Actions feature is not
2+
# yet released, so this pack will only be used within GitHub. Once the feature is available to
3+
# customers, we will move the contents of this pack back into the standard library pack.
4+
name: codeql/immutable-actions-list
5+
version: 0.0.1-dev
6+
library: true
7+
warnOnImplicitThis: true
8+
extensionTargets:
9+
# We expect to need this model pack even after GA of Actions analysis, so make it compatible with
10+
# all future prereleases plus 1.x.x. We should be able to remove this back before we need to
11+
# bump the major version to 2.
12+
codeql/actions-all: ">=0.4.3 <2.0.0"
13+
dataExtensions:
14+
- ext/**/*.yml

‎actions/ql/lib/CHANGELOG.md

+4
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
## 0.4.4
2+
3+
No user-facing changes.
4+
15
## 0.4.3
26

37
### New Features

‎actions/ql/lib/change-notes/released/0.4.4.md

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
## 0.4.4
2+
3+
No user-facing changes.

‎actions/ql/lib/codeql-pack.release.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
---
2-
lastReleaseVersion: 0.4.3
2+
lastReleaseVersion: 0.4.4

‎actions/ql/lib/ext/config/immutable_actions.yml

+6-18
Original file line numberDiff line numberDiff line change
@@ -2,21 +2,9 @@ extensions:
22
- addsTo:
33
pack: codeql/actions-all
44
extensible: immutableActionsDataModel
5-
data:
6-
- ["actions/checkout"]
7-
- ["actions/cache"]
8-
- ["actions/setup-node"]
9-
- ["actions/upload-artifact"]
10-
- ["actions/setup-python"]
11-
- ["actions/download-artifact"]
12-
- ["actions/github-script"]
13-
- ["actions/setup-java"]
14-
- ["actions/setup-go"]
15-
- ["actions/upload-pages-artifact"]
16-
- ["actions/deploy-pages"]
17-
- ["actions/setup-dotnet"]
18-
- ["actions/stale"]
19-
- ["actions/labeler"]
20-
- ["actions/create-github-app-token"]
21-
- ["actions/configure-pages"]
22-
- ["octokit/request-action"]
5+
# Since the Immutable Actions feature is not yet available to customers, we won't alert about
6+
# any unversioned immutable action references for now. Within GitHub, we'll include the
7+
# `codeql/immutable-actions-list` model pack, which will provide the necessary list of actions
8+
# for internal use. Once the feature is available to customers, we'll move that list back into
9+
# this file.
10+
data: []

‎actions/ql/lib/ext/config/trusted_actions_owner.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,4 @@ extensions:
55
data:
66
- ["actions"]
77
- ["github"]
8-
- ["advanced-security"]
8+
- ["advanced-security"]

‎actions/ql/lib/qlpack.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
name: codeql/actions-all
2-
version: 0.4.3
2+
version: 0.4.4
33
library: true
44
warnOnImplicitThis: true
55
dependencies:

‎actions/ql/src/CHANGELOG.md

+9
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,12 @@
1+
## 0.5.1
2+
3+
### Bug Fixes
4+
5+
* The `actions/unversioned-immutable-action` query will no longer report any alerts, since the
6+
Immutable Actions feature is not yet available for customer use. The query remains in the
7+
default Code Scanning suites for use internal to GitHub. Once the Immutable Actions feature is
8+
available, the query will be updated to report alerts again.
9+
110
## 0.5.0
211

312
### Breaking Changes

‎actions/ql/src/change-notes/released/0.5.1.md

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
## 0.5.1
2+
3+
### Bug Fixes
4+
5+
* The `actions/unversioned-immutable-action` query will no longer report any alerts, since the
6+
Immutable Actions feature is not yet available for customer use. The query remains in the
7+
default Code Scanning suites for use internal to GitHub. Once the Immutable Actions feature is
8+
available, the query will be updated to report alerts again.

‎actions/ql/src/codeql-pack.release.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
---
2-
lastReleaseVersion: 0.5.0
2+
lastReleaseVersion: 0.5.1

‎actions/ql/src/qlpack.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
name: codeql/actions-queries
2-
version: 0.5.0
2+
version: 0.5.1
33
library: false
44
warnOnImplicitThis: true
55
groups: [actions, queries]

‎actions/ql/test/qlpack.yml

+4
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,10 @@ groups: [codeql, test]
33
dependencies:
44
codeql/actions-all: ${workspace}
55
codeql/actions-queries: ${workspace}
6+
# Use the `immutable-actions-list` model pack so that we have some actual data to test against.
7+
# We can remove this dependency when we incorporate the data from that model pack back into the
8+
# standard library pack.
9+
codeql/immutable-actions-list: ${workspace}
610
extractor: actions
711
tests: .
812
warnOnImplicitThis: true

‎codeql-workspace.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ provide:
1717
- "misc/legacy-support/*/qlpack.yml"
1818
- "misc/suite-helpers/qlpack.yml"
1919
- ".github/codeql/extensions/**/codeql-pack.yml"
20-
20+
- "actions/ql/extensions/**/qlpack.yml"
2121
versionPolicies:
2222
default:
2323
requireChangeNotes: true

‎cpp/ql/lib/CHANGELOG.md

+7
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,10 @@
1+
## 4.0.2
2+
3+
### Minor Analysis Improvements
4+
5+
* Modified the `getBufferSize` predicate in `commons/Buffer.qll` to be more tolerant in some cases involving member variables in a larger struct or class.
6+
* Fixed an issue where the `getBufferSize` predicate in `commons/Buffer.qll` was returning results for references inside `offsetof` expressions, which are not accesses to a buffer.
7+
18
## 4.0.1
29

310
No user-facing changes.

‎cpp/ql/lib/change-notes/released/4.0.2.md

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
## 4.0.2
2+
3+
### Minor Analysis Improvements
4+
5+
* Modified the `getBufferSize` predicate in `commons/Buffer.qll` to be more tolerant in some cases involving member variables in a larger struct or class.
6+
* Fixed an issue where the `getBufferSize` predicate in `commons/Buffer.qll` was returning results for references inside `offsetof` expressions, which are not accesses to a buffer.

‎cpp/ql/lib/codeql-pack.release.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
---
2-
lastReleaseVersion: 4.0.1
2+
lastReleaseVersion: 4.0.2

‎cpp/ql/lib/qlpack.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
name: codeql/cpp-all
2-
version: 4.0.1
2+
version: 4.0.2
33
groups: cpp
44
dbscheme: semmlecode.cpp.dbscheme
55
extractor: cpp

‎cpp/ql/lib/semmle/code/cpp/Location.qll

+4-1
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,10 @@ class Location extends @location {
7575

7676
/** Holds if `this` comes on a line strictly before `l`. */
7777
pragma[inline]
78-
predicate isBefore(Location l) { this.isBefore(l, false) }
78+
predicate isBefore(Location l) {
79+
this.getFile() = l.getFile() and
80+
this.getEndLine() < l.getStartLine()
81+
}
7982

8083
/**
8184
* Holds if `this` comes strictly before `l`. The boolean `sameLine` is

‎cpp/ql/lib/semmle/code/cpp/commons/Buffer.qll

+12-3
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ private int getSize(VariableAccess va) {
7171
result = t.getSize()
7272
)
7373
or
74-
exists(Class c |
74+
exists(Class c, int trueSize |
7575
// Otherwise, we find the "outermost" object and compute the size
7676
// as the difference between the size of the type of the "outermost
7777
// object" and the offset of the field relative to that type.
@@ -91,7 +91,9 @@ private int getSize(VariableAccess va) {
9191
// of `y` relative to the type `S2` (i.e., `4`). So the size of the
9292
// buffer is `12 - 4 = 8`.
9393
c = getRootType(va) and
94-
result = c.getSize() - v.(Field).getOffsetInClass(c)
94+
// we calculate the size based on the last field, to avoid including any padding after it
95+
trueSize = max(Field f | | f.getOffsetInClass(c) + f.getUnspecifiedType().getSize()) and
96+
result = trueSize - v.(Field).getOffsetInClass(c)
9597
)
9698
)
9799
}
@@ -105,9 +107,16 @@ private int getSize(VariableAccess va) {
105107
private int isSource(Expr bufferExpr, Element why) {
106108
exists(Variable bufferVar | bufferVar = bufferExpr.(VariableAccess).getTarget() |
107109
// buffer is a fixed size array
108-
result = bufferVar.getUnspecifiedType().(ArrayType).getSize() and
110+
exists(bufferVar.getUnspecifiedType().(ArrayType).getSize()) and
111+
result =
112+
unique(int size | // more generous than .getSize() itself, when the array is a class field or similar.
113+
size = getSize(bufferExpr)
114+
|
115+
size
116+
) and
109117
why = bufferVar and
110118
not memberMayBeVarSize(_, bufferVar) and
119+
not exists(BuiltInOperationBuiltInOffsetOf offsetof | offsetof.getAChild*() = bufferExpr) and
111120
// zero sized arrays are likely to have special usage, for example
112121
// behaving a bit like a 'union' overlapping other fields.
113122
not result = 0

‎cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll

+5-6
Original file line numberDiff line numberDiff line change
@@ -869,12 +869,11 @@ private predicate elementSpecMatchesSignature(
869869
bindingset[nameWithoutArgs]
870870
pragma[inline_late]
871871
private Class getClassAndNameImpl(Function method, string nameWithoutArgs) {
872-
exists(string memberName | result = method.getClassAndName(memberName) |
873-
nameWithoutArgs = "operator " + method.(ConversionOperator).getDestType()
874-
or
875-
not method instanceof ConversionOperator and
876-
memberName = nameWithoutArgs
877-
)
872+
result = method.getDeclaringType() and
873+
nameWithoutArgs = "operator " + method.(ConversionOperator).getDestType()
874+
or
875+
result = method.getClassAndName(nameWithoutArgs) and
876+
not method instanceof ConversionOperator
878877
}
879878

880879
/**

‎cpp/ql/src/CHANGELOG.md

+7
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,10 @@
1+
## 1.3.5
2+
3+
### Minor Analysis Improvements
4+
5+
* Due to changes in libraries the query "Static array access may cause overflow" (`cpp/static-buffer-overflow`) will no longer report cases where multiple fields of a struct or class are written with a single `memset` or similar operation.
6+
* The query "Call to memory access function may overflow buffer" (`cpp/overflow-buffer`) has been added to the security-extended query suite. The query detects a range of buffer overflow and underflow issues.
7+
18
## 1.3.4
29

310
No user-facing changes.

‎cpp/ql/src/Security/CWE/CWE-078/ExecTainted.ql

+16-2
Original file line numberDiff line numberDiff line change
@@ -49,11 +49,17 @@ predicate interestingConcatenation(DataFlow::Node incoming, DataFlow::Node outgo
4949
call.getTarget() = op and
5050
op.hasQualifiedName("std", "operator+") and
5151
op.getType().(UserType).hasQualifiedName("std", "basic_string") and
52-
incoming.asIndirectArgument() = call.getArgument(1) and // left operand
52+
incoming.asIndirectArgument() = call.getArgument(1) and // right operand
5353
call = outgoing.asInstruction().getUnconvertedResultExpression()
5454
)
5555
}
5656

57+
/**
58+
* A state will represent the most recent concatenation that occurred in the data flow.
59+
* - `TConcatState` if the concetenation has not yet occurred.
60+
* - `TExecState(incoming, outgoing)`, representing the concatenation of data from `incoming`
61+
* into result `outgoing`.
62+
*/
5763
newtype TState =
5864
TConcatState() or
5965
TExecState(DataFlow::Node incoming, DataFlow::Node outgoing) {
@@ -74,7 +80,9 @@ class ExecState extends TExecState {
7480

7581
DataFlow::Node getOutgoingNode() { result = outgoing }
7682

77-
/** Holds if this is a possible `ExecState` for `sink`. */
83+
/**
84+
* Holds if this is a possible `ExecState` at `sink`, that is, if `outgoing` flows to `sink`.
85+
*/
7886
predicate isFeasibleForSink(DataFlow::Node sink) { ExecState::flow(outgoing, sink) }
7987

8088
string toString() { result = "ExecState" }
@@ -110,6 +118,12 @@ module ExecStateConfig implements DataFlow::ConfigSig {
110118

111119
module ExecState = TaintTracking::Global<ExecStateConfig>;
112120

121+
/**
122+
* A full `TaintTracking` configuration from source to concatenation to sink, using a flow
123+
* state to remember the concatenation. It's important that we track flow to the sink even though
124+
* as soon as we reach the concatenation we know it will get there (due to the check of
125+
* `isFeasibleForSink`), because this way we get a complete flow path.
126+
*/
113127
module ExecTaintConfig implements DataFlow::StateConfigSig {
114128
class FlowState = TState;
115129

‎cpp/ql/src/Security/CWE/CWE-119/OverflowBuffer.ql

+2-1
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,9 @@
55
* buffer.
66
* @kind problem
77
* @id cpp/overflow-buffer
8-
* @problem.severity recommendation
8+
* @problem.severity warning
99
* @security-severity 9.3
10+
* @precision medium
1011
* @tags security
1112
* external/cwe/cwe-119
1213
* external/cwe/cwe-121

‎cpp/ql/src/change-notes/released/1.3.5.md

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
## 1.3.5
2+
3+
### Minor Analysis Improvements
4+
5+
* Due to changes in libraries the query "Static array access may cause overflow" (`cpp/static-buffer-overflow`) will no longer report cases where multiple fields of a struct or class are written with a single `memset` or similar operation.
6+
* The query "Call to memory access function may overflow buffer" (`cpp/overflow-buffer`) has been added to the security-extended query suite. The query detects a range of buffer overflow and underflow issues.

0 commit comments

Comments
 (0)