Skip to content

Commit ec48d0a

Browse files
mr-shermanmr-sherman
committed
Merge remote-tracking branch 'upstream/main' into service-stack-remote-sink
merging from main because it fell way behind.
2 parents bf2d7b3 + 6e9d744 commit ec48d0a

File tree

5,005 files changed

+387641
-117571
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

5,005 files changed

+387641
-117571
lines changed

‎.github/workflows/check-change-note.yml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: Check change note
2+
3+
on:
4+
pull_request_target:
5+
types: [labeled, unlabeled, opened, synchronize, reopened, ready_for_review]
6+
paths:
7+
- "*/ql/src/**/*.ql"
8+
- "*/ql/src/**/*.qll"
9+
- "!**/experimental/**"
10+
11+
jobs:
12+
check-change-note:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Fail if no change note found. To fix, either add one, or add the `no-change-note-required` label.
16+
if: |
17+
github.event.pull_request.draft == false &&
18+
!contains(github.event.pull_request.labels.*.name, 'no-change-note-required')
19+
env:
20+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
21+
run: |
22+
gh api 'repos/${{github.repository}}/pulls/${{github.event.number}}/files' --paginate |
23+
jq 'any(.[].filename ; test("/change-notes/.*[.]md$"))' --exit-status

‎.github/workflows/close-stale.yml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
name: Mark stale issues
2+
3+
on:
4+
workflow_dispatch:
5+
schedule:
6+
- cron: "30 1 * * *"
7+
8+
jobs:
9+
stale:
10+
if: github.repository == 'github/codeql'
11+
12+
runs-on: ubuntu-latest
13+
14+
steps:
15+
- uses: actions/stale@v3
16+
with:
17+
repo-token: ${{ secrets.GITHUB_TOKEN }}
18+
stale-issue-message: 'This issue is stale because it has been open 14 days with no activity. Comment or remove the `Stale` label in order to avoid having this issue closed in 7 days.'
19+
close-issue-message: 'This issue was closed because it has been inactive for 7 days.'
20+
days-before-stale: 14
21+
days-before-close: 7
22+
only-labels: awaiting-response
23+
24+
# do not mark PRs as stale
25+
days-before-pr-stale: -1
26+
days-before-pr-close: -1
27+
28+
# Uncomment for dry-run
29+
# debug-only: true
30+
# operations-per-run: 1000

‎.github/workflows/codeql-analysis.yml

Lines changed: 17 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,15 @@ name: "Code scanning - action"
22

33
on:
44
push:
5+
branches:
6+
- main
7+
- 'rc/*'
58
pull_request:
9+
branches:
10+
- main
11+
- 'rc/*'
12+
paths:
13+
- 'csharp/**'
614
schedule:
715
- cron: '0 9 * * 1'
816

@@ -11,22 +19,18 @@ jobs:
1119

1220
runs-on: ubuntu-latest
1321

22+
permissions:
23+
contents: read
24+
security-events: write
25+
pull-requests: read
26+
1427
steps:
1528
- name: Checkout repository
1629
uses: actions/checkout@v2
17-
with:
18-
# We must fetch at least the immediate parents so that if this is
19-
# a pull request then we can checkout the head.
20-
fetch-depth: 2
21-
22-
# If this run was triggered by a pull request event, then checkout
23-
# the head of the pull request instead of the merge commit.
24-
- run: git checkout HEAD^2
25-
if: ${{ github.event_name == 'pull_request' }}
26-
30+
2731
# Initializes the CodeQL tools for scanning.
2832
- name: Initialize CodeQL
29-
uses: github/codeql-action/init@v1
33+
uses: github/codeql-action/init@main
3034
# Override language selection by uncommenting this and choosing your languages
3135
with:
3236
languages: csharp
@@ -35,7 +39,7 @@ jobs:
3539
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
3640
# If this step fails, then you should remove it and run the build manually (see below)
3741
- name: Autobuild
38-
uses: github/codeql-action/autobuild@v1
42+
uses: github/codeql-action/autobuild@main
3943

4044
# ℹ️ Command-line programs to run using the OS shell.
4145
# 📚 https://git.io/JvXDl
@@ -49,4 +53,4 @@ jobs:
4953
# make release
5054

5155
- name: Perform CodeQL Analysis
52-
uses: github/codeql-action/analyze@v1
56+
uses: github/codeql-action/analyze@main

‎.github/workflows/csv-coverage.yml

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
name: Build/check CSV flow coverage report
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
qlModelShaOverride:
7+
description: 'github/codeql repo SHA used for looking up the CSV models'
8+
required: false
9+
push:
10+
branches:
11+
- main
12+
- 'rc/**'
13+
pull_request:
14+
paths:
15+
- '.github/workflows/csv-coverage.yml'
16+
- '*/ql/src/**/*.ql'
17+
- '*/ql/src/**/*.qll'
18+
- 'misc/scripts/library-coverage/*.py'
19+
# input data files
20+
- '*/documentation/library-coverage/cwe-sink.csv'
21+
- '*/documentation/library-coverage/frameworks.csv'
22+
# coverage report files
23+
- '*/documentation/library-coverage/flow-model-coverage.csv'
24+
- '*/documentation/library-coverage/flow-model-coverage.rst'
25+
26+
jobs:
27+
build:
28+
29+
runs-on: ubuntu-latest
30+
31+
steps:
32+
- name: Clone self (github/codeql)
33+
uses: actions/checkout@v2
34+
with:
35+
path: script
36+
- name: Clone self (github/codeql) at a given SHA for analysis
37+
if: github.event.inputs.qlModelShaOverride != ''
38+
uses: actions/checkout@v2
39+
with:
40+
path: codeqlModels
41+
ref: github.event.inputs.qlModelShaOverride
42+
- name: Clone self (github/codeql) for analysis
43+
if: github.event.inputs.qlModelShaOverride == ''
44+
uses: actions/checkout@v2
45+
with:
46+
path: codeqlModels
47+
- name: Set up Python 3.8
48+
uses: actions/setup-python@v2
49+
with:
50+
python-version: 3.8
51+
- name: Download CodeQL CLI
52+
uses: dsaltares/fetch-gh-release-asset@aa37ae5c44d3c9820bc12fe675e8670ecd93bd1c
53+
with:
54+
repo: "github/codeql-cli-binaries"
55+
version: "latest"
56+
file: "codeql-linux64.zip"
57+
token: ${{ secrets.GITHUB_TOKEN }}
58+
- name: Unzip CodeQL CLI
59+
run: unzip -d codeql-cli codeql-linux64.zip
60+
- name: Build modeled package list
61+
run: |
62+
PATH="$PATH:codeql-cli/codeql" python script/misc/scripts/library-coverage/generate-report.py ci codeqlModels script
63+
- name: Upload CSV package list
64+
uses: actions/upload-artifact@v2
65+
with:
66+
name: csv-flow-model-coverage
67+
path: flow-model-coverage-*.csv
68+
- name: Upload RST package list
69+
uses: actions/upload-artifact@v2
70+
with:
71+
name: rst-flow-model-coverage
72+
path: flow-model-coverage-*.rst
73+
- name: Check coverage files
74+
if: github.event.pull_request
75+
run: |
76+
python script/misc/scripts/library-coverage/compare-files.py codeqlModels
77+

‎.github/workflows/generate-query-help-docs.yml

Lines changed: 0 additions & 57 deletions
This file was deleted.

‎.gitignore

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@
1717
# Byte-compiled python files
1818
*.pyc
1919

20+
# python virtual environment folder
21+
.venv/
22+
2023
# It's useful (though not required) to be able to unpack codeql in the ql checkout itself
2124
/codeql/
2225

‎.vscode/settings.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
{
22
"omnisharp.autoStart": false
3-
}
3+
}

‎CODEOWNERS

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -4,17 +4,16 @@
44
/javascript/ @github/codeql-javascript
55
/python/ @github/codeql-python
66

7-
# Assign query help for docs review
8-
/cpp/**/*.qhelp @hubwriter
9-
/csharp/**/*.qhelp @jf205
10-
/java/**/*.qhelp @felicitymay
11-
/javascript/**/*.qhelp @mchammer01
12-
/python/**/*.qhelp @felicitymay
13-
/docs/language/ @shati-patel @jf205
7+
# Make @xcorail (GitHub Security Lab) a code owner for experimental queries so he gets pinged when we promote a query out of experimental
8+
/cpp/**/experimental/**/* @github/codeql-c-analysis @xcorail
9+
/csharp/**/experimental/**/* @github/codeql-csharp @xcorail
10+
/java/**/experimental/**/* @github/codeql-java @xcorail
11+
/javascript/**/experimental/**/* @github/codeql-javascript @xcorail
12+
/python/**/experimental/**/* @github/codeql-python @xcorail
1413

15-
# Exclude help for experimental queries from docs review
16-
/cpp/**/experimental/**/*.qhelp @github/codeql-c-analysis
17-
/csharp/**/experimental/**/*.qhelp @github/codeql-csharp
18-
/java/**/experimental/**/*.qhelp @github/codeql-java
19-
/javascript/**/experimental/**/*.qhelp @github/codeql-javascript
20-
/python/**/experimental/**/*.qhelp @github/codeql-python
14+
# Notify members of codeql-go about PRs to the shared data-flow library files
15+
/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll @github/codeql-java @github/codeql-go
16+
/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl2.qll @github/codeql-java @github/codeql-go
17+
/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll @github/codeql-java @github/codeql-go
18+
/java/ql/src/semmle/code/java/dataflow/internal/tainttracking1/TaintTrackingImpl.qll @github/codeql-java @github/codeql-go
19+
/java/ql/src/semmle/code/java/dataflow/internal/tainttracking2/TaintTrackingImpl.qll @github/codeql-java @github/codeql-go

‎CONTRIBUTING.md

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,8 @@ If you have an idea for a query that you would like to share with other CodeQL u
3838

3939
- The queries and libraries must be autoformatted, for example using the "Format Document" command in [CodeQL for Visual Studio Code](https://help.semmle.com/codeql/codeql-for-vscode/procedures/about-codeql-for-vscode.html).
4040

41+
If you prefer, you can use this [pre-commit hook](misc/scripts/pre-commit) that automatically checks whether your files are correctly formatted. See the [pre-commit hook installation guide](docs/pre-commit-hook-setup.md) for instructions on how to install the hook.
42+
4143
4. **Compilation**
4244

4345
- Compilation of the query and any associated libraries and tests must be resilient to future development of the [supported](docs/supported-queries.md) libraries. This means that the functionality cannot use internal libraries, cannot depend on the output of `getAQlClass`, and cannot make use of regexp matching on `toString`.
@@ -47,7 +49,11 @@ If you have an idea for a query that you would like to share with other CodeQL u
4749

4850
- The query must have at least one true positive result on some revision of a real project.
4951

50-
Experimental queries and libraries may not be actively maintained as the [supported](docs/supported-queries.md) libraries evolve. They may also be changed in backwards-incompatible ways or may be removed entirely in the future without deprecation warnings.
52+
6. **Query help files and unit tests**
53+
54+
- Query help (`.qhelp`) files and unit tests are optional (but strongly encouraged!) for queries in the `experimental` directories. For more information about contributing query help files and unit tests, see [Supported CodeQL queries and libraries](docs/supported-queries.md).
55+
56+
Experimental queries and libraries may not be actively maintained as the supported libraries evolve. They may also be changed in backwards-incompatible ways or may be removed entirely in the future without deprecation warnings.
5157

5258
After the experimental query is merged, we welcome pull requests to improve it. Before a query can be moved out of the `experimental` subdirectory, it must satisfy [the requirements for being a supported query](docs/supported-queries.md).
5359

0 commit comments

Comments
 (0)