Skip to content

Commit 752b126

Browse files
nickrolfenickrolfe
committed
Merge remote-tracking branch 'origin/main' into nickrolfe/regex_injection
2 parents 9034d74 + f6baab6 commit 752b126

File tree

649 files changed

+26485
-6278
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

649 files changed

+26485
-6278
lines changed

‎.codeqlmanifest.json

Lines changed: 16 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,16 @@
1-
{ "provide": [ "ruby/.codeqlmanifest.json",
2-
"*/ql/src/qlpack.yml",
3-
"*/ql/lib/qlpack.yml",
4-
"*/ql/test/qlpack.yml",
5-
"cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/qlpack.yml",
6-
"*/ql/examples/qlpack.yml",
7-
"*/upgrades/qlpack.yml",
8-
"javascript/ql/experimental/adaptivethreatmodeling/lib/qlpack.yml",
9-
"javascript/ql/experimental/adaptivethreatmodeling/src/qlpack.yml",
10-
"misc/legacy-support/*/qlpack.yml",
11-
"misc/suite-helpers/qlpack.yml" ] }
1+
{
2+
"provide": [
3+
"*/ql/src/qlpack.yml",
4+
"*/ql/lib/qlpack.yml",
5+
"*/ql/test/qlpack.yml",
6+
"*/ql/examples/qlpack.yml",
7+
"*/upgrades/qlpack.yml",
8+
"cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/qlpack.yml",
9+
"javascript/ql/experimental/adaptivethreatmodeling/lib/qlpack.yml",
10+
"javascript/ql/experimental/adaptivethreatmodeling/src/qlpack.yml",
11+
"misc/legacy-support/*/qlpack.yml",
12+
"misc/suite-helpers/qlpack.yml",
13+
"ruby/ql/consistency-queries/qlpack.yml",
14+
"ruby/extractor-pack/codeql-extractor.yml"
15+
]
16+
}

‎.github/actions/fetch-codeql/action.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ runs:
88
run: |
99
LATEST=$(gh release list --repo https://github.com/github/codeql-cli-binaries | cut -f 1 | grep -v beta | sort --version-sort | tail -1)
1010
gh release download --repo https://github.com/github/codeql-cli-binaries --pattern codeql-linux64.zip "$LATEST"
11-
unzip -q codeql-linux64.zip
12-
echo "${{ github.workspace }}/codeql" >> $GITHUB_PATH
11+
unzip -q -d "${RUNNER_TEMP}" codeql-linux64.zip
12+
echo "${RUNNER_TEMP}/codeql" >> "${GITHUB_PATH}"
1313
env:
1414
GITHUB_TOKEN: ${{ github.token }}

‎.github/workflows/post-pr-comment.yml

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
name: Post pull-request comment
2+
on:
3+
workflow_run:
4+
workflows: ["Query help preview"]
5+
types:
6+
- completed
7+
8+
permissions:
9+
pull-requests: write
10+
11+
jobs:
12+
post_comment:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Download artifact
16+
run: gh run download "${WORKFLOW_RUN_ID}" --repo "${GITHUB_REPOSITORY}" --name "comment"
17+
env:
18+
GITHUB_TOKEN: ${{ github.token }}
19+
WORKFLOW_RUN_ID: ${{ github.event.workflow_run.id }}
20+
- run: |
21+
PR="$(grep -o '^[0-9]\+$' pr.txt)"
22+
PR_HEAD_SHA="$(gh api "/repos/${GITHUB_REPOSITORY}/pulls/${PR}" --jq .head.sha)"
23+
# Check that the pull-request head SHA matches the head SHA of the workflow run
24+
if [ "${WORKFLOW_RUN_HEAD_SHA}" != "${PR_HEAD_SHA}" ]; then
25+
echo "PR head SHA ${PR_HEAD_SHA} does not match workflow_run event SHA ${WORKFLOW_RUN_HEAD_SHA}. Stopping." 1>&2
26+
exit 1
27+
fi
28+
gh pr comment "${PR}" --repo "${GITHUB_REPOSITORY}" -F comment.txt
29+
env:
30+
GITHUB_TOKEN: ${{ github.token }}
31+
WORKFLOW_RUN_HEAD_SHA: ${{ github.event.workflow_run.head_commit.id }}

‎.github/workflows/qhelp-pr-preview.yml

Lines changed: 38 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,39 +1,63 @@
11
name: Query help preview
22

3+
permissions:
4+
contents: read
5+
36
on:
47
pull_request:
58
branches:
69
- main
7-
- 'rc/*'
10+
- "rc/*"
811
paths:
912
- "ruby/**/*.qhelp"
1013

1114
jobs:
1215
qhelp:
1316
runs-on: ubuntu-latest
1417
steps:
18+
- run: echo "${{ github.event.number }}" > pr.txt
19+
- uses: actions/upload-artifact@v2
20+
with:
21+
name: comment
22+
path: pr.txt
23+
retention-days: 1
1524
- uses: actions/checkout@v2
1625
with:
1726
fetch-depth: 2
27+
persist-credentials: false
28+
- uses: ./.github/actions/fetch-codeql
1829
- name: Determine changed files
1930
id: changes
2031
run: |
21-
echo -n "::set-output name=qhelp_files::"
22-
(git diff --name-only --diff-filter=ACMRT HEAD~1 HEAD | grep .qhelp$ | grep -v .inc.qhelp;
23-
git diff --name-only --diff-filter=ACMRT HEAD~1 HEAD | grep .inc.qhelp$ | xargs -d '\n' -rn1 basename | xargs -d '\n' -rn1 git grep -l) |
24-
sort -u | xargs -d '\n' -n1 printf "'%s' "
25-
26-
- uses: ./.github/actions/fetch-codeql
32+
(git diff -z --name-only --diff-filter=ACMRT HEAD~1 HEAD | grep -z '.qhelp$' | grep -z -v '.inc.qhelp';
33+
git diff -z --name-only --diff-filter=ACMRT HEAD~1 HEAD | grep -z '.inc.qhelp$' | xargs --null -rn1 basename | xargs --null -rn1 git grep -z -l) |
34+
grep -z '.qhelp$' | grep -z -v '^-' | sort -z -u > "${RUNNER_TEMP}/paths.txt"
2735
2836
- name: QHelp preview
29-
if: ${{ steps.changes.outputs.qhelp_files }}
3037
run: |
31-
( echo "QHelp previews:";
32-
for path in ${{ steps.changes.outputs.qhelp_files }} ; do
38+
EXIT_CODE=0
39+
echo "QHelp previews:" > comment.txt
40+
while read -r -d $'\0' path; do
41+
if [ ! -f "${path}" ]; then
42+
exit 1
43+
fi
3344
echo "<details> <summary>${path}</summary>"
3445
echo
35-
codeql generate query-help --format=markdown ${path}
46+
codeql generate query-help --format=markdown -- "./${path}" 2> errors.txt || EXIT_CODE="$?"
47+
if [ -s errors.txt ]; then
48+
echo "# errors/warnings:"
49+
echo '```'
50+
cat errors.txt
51+
cat errors.txt 1>&2
52+
echo '```'
53+
fi
3654
echo "</details>"
37-
done) | gh pr comment "${{ github.event.pull_request.number }}" -F -
38-
env:
39-
GITHUB_TOKEN: ${{ github.token }}
55+
done < "${RUNNER_TEMP}/paths.txt" >> comment.txt
56+
exit "${EXIT_CODE}"
57+
58+
- if: always()
59+
uses: actions/upload-artifact@v2
60+
with:
61+
name: comment
62+
path: comment.txt
63+
retention-days: 1

‎.github/workflows/ruby-build.yml

Lines changed: 6 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -3,16 +3,18 @@ name: "Ruby: Build"
33
on:
44
push:
55
paths:
6-
- 'ruby/**'
6+
- "ruby/**"
7+
- .github/workflows/ruby-build.yml
78
branches:
89
- main
9-
- 'rc/*'
10+
- "rc/*"
1011
pull_request:
1112
paths:
12-
- 'ruby/**'
13+
- "ruby/**"
14+
- .github/workflows/ruby-build.yml
1315
branches:
1416
- main
15-
- 'rc/*'
17+
- "rc/*"
1618
workflow_dispatch:
1719
inputs:
1820
tag:
@@ -100,16 +102,6 @@ jobs:
100102
PACK_FOLDER=$(readlink -f target/packs/codeql/ruby-queries/*)
101103
codeql/codeql generate query-help --format=sarifv2.1.0 --output="${PACK_FOLDER}/rules.sarif" ql/src
102104
(cd ql/src; find queries \( -name '*.qhelp' -o -name '*.rb' -o -name '*.erb' \) -exec bash -c 'mkdir -p "'"${PACK_FOLDER}"'/$(dirname "{}")"' \; -exec cp "{}" "${PACK_FOLDER}/{}" \;)
103-
- name: Compile with previous CodeQL versions
104-
run: |
105-
for version in $(gh release list --repo https://github.com/github/codeql-cli-binaries | cut -f 1 | sort --version-sort | tail -3 | head -2); do
106-
rm -f codeql-linux64.zip
107-
gh release download --repo https://github.com/github/codeql-cli-binaries --pattern codeql-linux64.zip "$version"
108-
rm -rf codeql; unzip -q codeql-linux64.zip
109-
codeql/codeql query compile target/packs/*
110-
done
111-
env:
112-
GITHUB_TOKEN: ${{ github.token }}
113105
- uses: actions/upload-artifact@v2
114106
with:
115107
name: codeql-ruby-queries

‎.github/workflows/ruby-dataset-measure.yml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,15 +4,17 @@ on:
44
push:
55
branches:
66
- main
7-
- 'rc/*'
7+
- "rc/*"
88
paths:
99
- ruby/ql/lib/ruby.dbscheme
10+
- .github/workflows/ruby-dataset-measure.yml
1011
pull_request:
1112
branches:
1213
- main
13-
- 'rc/*'
14+
- "rc/*"
1415
paths:
1516
- ruby/ql/lib/ruby.dbscheme
17+
- .github/workflows/ruby-dataset-measure.yml
1618
workflow_dispatch:
1719

1820
jobs:

‎.github/workflows/ruby-qltest.yml

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,16 +3,18 @@ name: "Ruby: Run QL Tests"
33
on:
44
push:
55
paths:
6-
- 'ruby/**'
6+
- "ruby/**"
7+
- .github/workflows/ruby-qltest.yml
78
branches:
89
- main
9-
- 'rc/*'
10+
- "rc/*"
1011
pull_request:
1112
paths:
12-
- 'ruby/**'
13+
- "ruby/**"
14+
- .github/workflows/ruby-qltest.yml
1315
branches:
1416
- main
15-
- 'rc/*'
17+
- "rc/*"
1618

1719
env:
1820
CARGO_TERM_COLOR: always
@@ -30,7 +32,7 @@ jobs:
3032
- uses: ./ruby/actions/create-extractor-pack
3133
- name: Run QL tests
3234
run: |
33-
codeql test run --check-databases --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --search-path "${{ github.workspace }}/ruby" --additional-packs "${{ github.workspace }}" --consistency-queries ql/consistency-queries ql/test
35+
codeql test run --check-databases --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --consistency-queries ql/consistency-queries ql/test
3436
env:
3537
GITHUB_TOKEN: ${{ github.token }}
3638
- name: Check QL formatting
@@ -44,5 +46,5 @@ jobs:
4446
run: |
4547
echo >empty.trap
4648
codeql dataset import -S ql/lib/upgrades/initial/ruby.dbscheme testdb empty.trap
47-
codeql dataset upgrade testdb --additional-packs ql/lib/upgrades
49+
codeql dataset upgrade testdb --additional-packs ql/lib
4850
diff -q testdb/ruby.dbscheme ql/lib/ruby.dbscheme

‎.gitignore

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,3 +27,6 @@ csharp/extractor/Semmle.Extraction.CSharp.Driver/Properties/launchSettings.json
2727

2828
# Avoid committing cached package components
2929
.codeql
30+
31+
# Compiled class file
32+
*.class

‎config/identical-files.json

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -449,7 +449,8 @@
449449
"csharp/ql/lib/semmle/code/csharp/controlflow/internal/pressa/SsaImplCommon.qll",
450450
"csharp/ql/lib/semmle/code/csharp/dataflow/internal/basessa/SsaImplCommon.qll",
451451
"csharp/ql/lib/semmle/code/cil/internal/SsaImplCommon.qll",
452-
"ruby/ql/lib/codeql/ruby/dataflow/internal/SsaImplCommon.qll"
452+
"ruby/ql/lib/codeql/ruby/dataflow/internal/SsaImplCommon.qll",
453+
"cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaImplCommon.qll"
453454
],
454455
"CryptoAlgorithms Python/JS": [
455456
"javascript/ql/lib/semmle/javascript/security/CryptoAlgorithms.qll",
@@ -470,7 +471,12 @@
470471
"ReDoS Polynomial Python/JS": [
471472
"javascript/ql/lib/semmle/javascript/security/performance/SuperlinearBackTracking.qll",
472473
"python/ql/lib/semmle/python/security/performance/SuperlinearBackTracking.qll",
473-
"ruby/ql/lib/codeql/ruby/regexp/SuperlinearBackTracking.qll"
474+
"ruby/ql/lib/codeql/ruby/security/performance/SuperlinearBackTracking.qll"
475+
],
476+
"BadTagFilterQuery Python/JS/Ruby": [
477+
"javascript/ql/lib/semmle/javascript/security/BadTagFilterQuery.qll",
478+
"python/ql/lib/semmle/python/security/BadTagFilterQuery.qll",
479+
"ruby/ql/lib/codeql/ruby/security/BadTagFilterQuery.qll"
474480
],
475481
"CFG": [
476482
"csharp/ql/lib/semmle/code/csharp/controlflow/internal/ControlFlowGraphImplShared.qll",

‎cpp/change-notes/2021-11-09-use-of-http.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm,codescanning
2+
* A new query `cpp/non-https-url` has been added for C/C++. The query flags uses of `http` URLs that might be better replaced with `https`.

0 commit comments

Comments
 (0)