Skip to content

Commit d127d21

Browse files
RasmusWLRasmusWL
committed
Merge branch 'main' into jorgectf/python/insecure-cookie
2 parents 840cded + 2b6e0cf commit d127d21

File tree

7,451 files changed

+710971
-231754
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

7,451 files changed

+710971
-231754
lines changed

‎.bazelrc

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
build --repo_env=CC=clang --repo_env=CXX=clang++ --copt="-std=c++17"
2+
3+
try-import %workspace%/local.bazelrc

‎.bazelversion

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
5.0.0

‎.codeqlmanifest.json

Lines changed: 27 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,27 @@
1-
{ "provide": [ "ruby/.codeqlmanifest.json",
2-
"*/ql/src/qlpack.yml",
3-
"*/ql/lib/qlpack.yml",
4-
"*/ql/test/qlpack.yml",
5-
"cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/qlpack.yml",
6-
"*/ql/examples/qlpack.yml",
7-
"*/upgrades/qlpack.yml",
8-
"javascript/ql/experimental/adaptivethreatmodeling/lib/qlpack.yml",
9-
"javascript/ql/experimental/adaptivethreatmodeling/src/qlpack.yml",
10-
"misc/legacy-support/*/qlpack.yml",
11-
"misc/suite-helpers/qlpack.yml" ] }
1+
{
2+
"provide": [
3+
"*/ql/src/qlpack.yml",
4+
"*/ql/lib/qlpack.yml",
5+
"*/ql/test/qlpack.yml",
6+
"*/ql/examples/qlpack.yml",
7+
"*/ql/consistency-queries/qlpack.yml",
8+
"cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/qlpack.yml",
9+
"javascript/ql/experimental/adaptivethreatmodeling/lib/qlpack.yml",
10+
"javascript/ql/experimental/adaptivethreatmodeling/modelbuilding/qlpack.yml",
11+
"javascript/ql/experimental/adaptivethreatmodeling/src/qlpack.yml",
12+
"csharp/ql/campaigns/Solorigate/lib/qlpack.yml",
13+
"csharp/ql/campaigns/Solorigate/src/qlpack.yml",
14+
"csharp/ql/campaigns/Solorigate/test/qlpack.yml",
15+
"misc/legacy-support/*/qlpack.yml",
16+
"misc/suite-helpers/qlpack.yml",
17+
"ruby/extractor-pack/codeql-extractor.yml",
18+
"ql/extractor-pack/codeql-extractor.yml"
19+
],
20+
"versionPolicies": {
21+
"default": {
22+
"requireChangeNotes": true,
23+
"committedPrereleaseSuffix": "dev",
24+
"committedVersion": "nextPatchRelease"
25+
}
26+
}
27+
}

‎.gitattributes

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,4 +50,15 @@
5050
*.pdb -text
5151

5252
java/ql/test/stubs/**/*.java linguist-generated=true
53-
java/ql/test/experimental/stubs/**/*.java linguist-generated=true
53+
java/ql/test/experimental/stubs/**/*.java linguist-generated=true
54+
55+
# For some languages, upgrade script testing references really old dbscheme
56+
# files from legacy upgrades that have CRLF line endings. Since upgrade
57+
# resolution relies on object hashes, we must suppress line ending conversion
58+
# for those testing dbscheme files.
59+
*/ql/lib/upgrades/initial/*.dbscheme -text
60+
61+
# Generated test files - these are synced from the standard JavaScript libraries using
62+
# `javascript/ql/experimental/adaptivethreatmodeling/test/update_endpoint_test_files.py`.
63+
javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_large_scale/autogenerated/**/*.js linguist-generated=true -merge
64+
javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_large_scale/autogenerated/**/*.ts linguist-generated=true -merge

‎.github/actions/fetch-codeql/action.yml

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,22 @@ description: Fetches the latest version of CodeQL
33
runs:
44
using: composite
55
steps:
6+
- name: Select platform - Linux
7+
if: runner.os == 'Linux'
8+
shell: bash
9+
run: echo "GA_CODEQL_CLI_PLATFORM=linux64" >> $GITHUB_ENV
10+
11+
- name: Select platform - MacOS
12+
if: runner.os == 'MacOS'
13+
shell: bash
14+
run: echo "GA_CODEQL_CLI_PLATFORM=osx64" >> $GITHUB_ENV
15+
616
- name: Fetch CodeQL
717
shell: bash
818
run: |
919
LATEST=$(gh release list --repo https://github.com/github/codeql-cli-binaries | cut -f 1 | grep -v beta | sort --version-sort | tail -1)
10-
gh release download --repo https://github.com/github/codeql-cli-binaries --pattern codeql-linux64.zip "$LATEST"
11-
unzip -q codeql-linux64.zip
12-
echo "${{ github.workspace }}/codeql" >> $GITHUB_PATH
20+
gh release download --repo https://github.com/github/codeql-cli-binaries --pattern codeql-$GA_CODEQL_CLI_PLATFORM.zip "$LATEST"
21+
unzip -q -d "${RUNNER_TEMP}" codeql-$GA_CODEQL_CLI_PLATFORM.zip
22+
echo "${RUNNER_TEMP}/codeql" >> "${GITHUB_PATH}"
1323
env:
1424
GITHUB_TOKEN: ${{ github.token }}

‎.github/dependabot.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,3 +16,11 @@ updates:
1616
directory: "ruby/autobuilder"
1717
schedule:
1818
interval: "daily"
19+
20+
- package-ecosystem: "github-actions"
21+
directory: "/"
22+
schedule:
23+
interval: "daily"
24+
ignore:
25+
- dependency-name: '*'
26+
update-types: ['version-update:semver-patch', 'version-update:semver-minor']

‎.github/labeler.yml

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ Java:
1111
- change-notes/**/*java.*
1212

1313
JS:
14-
- javascript/**/*
14+
- any: [ 'javascript/**/*', '!javascript/ql/experimental/adaptivethreatmodeling/**/*' ]
1515
- change-notes/**/*javascript*
1616

1717
Python:
@@ -21,8 +21,15 @@ Python:
2121
Ruby:
2222
- ruby/**/*
2323
- change-notes/**/*ruby*
24+
25+
Swift:
26+
- swift/**/*
27+
- change-notes/**/*swift*
2428

2529
documentation:
2630
- "**/*.qhelp"
2731
- "**/*.md"
2832
- docs/**/*
33+
34+
"QL-for-QL":
35+
- ql/**/*

‎.github/workflows/check-change-note.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,11 @@ on:
66
paths:
77
- "*/ql/src/**/*.ql"
88
- "*/ql/src/**/*.qll"
9+
- "*/ql/lib/**/*.ql"
10+
- "*/ql/lib/**/*.qll"
911
- "!**/experimental/**"
12+
- "!ql/**"
13+
- ".github/workflows/check-change-note.yml"
1014

1115
jobs:
1216
check-change-note:

‎.github/workflows/check-qldoc.yml

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
name: "Check QLdoc coverage"
2+
3+
on:
4+
pull_request:
5+
paths:
6+
- "*/ql/lib/**"
7+
- .github/workflows/check-qldoc.yml
8+
branches:
9+
- main
10+
- "rc/*"
11+
12+
jobs:
13+
qldoc:
14+
runs-on: ubuntu-latest
15+
16+
steps:
17+
- name: Install CodeQL
18+
run: |
19+
gh extension install github/gh-codeql
20+
gh codeql set-channel nightly
21+
gh codeql version
22+
env:
23+
GITHUB_TOKEN: ${{ github.token }}
24+
25+
- uses: actions/checkout@v3
26+
with:
27+
fetch-depth: 2
28+
29+
- name: Check QLdoc coverage
30+
shell: bash
31+
run: |
32+
EXIT_CODE=0
33+
# TODO: remove the swift exception from the regex when we fix generated QLdoc
34+
changed_lib_packs="$(git diff --name-only --diff-filter=ACMRT HEAD^ HEAD | { grep -Po '^(?!swift)[a-z]*/ql/lib' || true; } | sort -u)"
35+
for pack_dir in ${changed_lib_packs}; do
36+
lang="${pack_dir%/ql/lib}"
37+
gh codeql generate library-doc-coverage --output="${RUNNER_TEMP}/${lang}-current.txt" --dir="${pack_dir}"
38+
done
39+
git checkout HEAD^
40+
for pack_dir in ${changed_lib_packs}; do
41+
# When we add a new language, pack_dir would not exist in HEAD^.
42+
# In this case the right thing to do is to skip the check.
43+
[[ ! -d "${pack_dir}" ]] && continue
44+
lang="${pack_dir%/ql/lib}"
45+
gh codeql generate library-doc-coverage --output="${RUNNER_TEMP}/${lang}-baseline.txt" --dir="${pack_dir}"
46+
awk -F, '{gsub(/"/,""); if ($4==0 && $6=="public") print "\""$3"\"" }' "${RUNNER_TEMP}/${lang}-current.txt" | sort -u > "${RUNNER_TEMP}/current-undocumented.txt"
47+
awk -F, '{gsub(/"/,""); if ($4==0 && $6=="public") print "\""$3"\"" }' "${RUNNER_TEMP}/${lang}-baseline.txt" | sort -u > "${RUNNER_TEMP}/baseline-undocumented.txt"
48+
UNDOCUMENTED="$(grep -f <(comm -13 "${RUNNER_TEMP}/baseline-undocumented.txt" "${RUNNER_TEMP}/current-undocumented.txt") "${RUNNER_TEMP}/${lang}-current.txt" || true)"
49+
if [ -n "$UNDOCUMENTED" ]; then
50+
echo "$UNDOCUMENTED" | awk -F, '{gsub(/"/,""); print "::warning file='"${pack_dir}"'/"$1",line="$2"::Missing QLdoc for "$5, $3 }'
51+
EXIT_CODE=1
52+
fi
53+
done
54+
exit "${EXIT_CODE}"

‎.github/workflows/close-stale.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
runs-on: ubuntu-latest
1313

1414
steps:
15-
- uses: actions/stale@v3
15+
- uses: actions/stale@v5
1616
with:
1717
repo-token: ${{ secrets.GITHUB_TOKEN }}
1818
stale-issue-message: 'This issue is stale because it has been open 14 days with no activity. Comment or remove the `Stale` label in order to avoid having this issue closed in 7 days.'

0 commit comments

Comments
 (0)