Skip to content

Commit 11c89ad

Browse files
tausbntausbn
authored
Merge branch 'main' into timing-attack-py
2 parents 6a578c6 + f1fe7af commit 11c89ad

File tree

14,348 files changed

+1243747
-527874
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

14,348 files changed

+1243747
-527874
lines changed

‎.bazelrc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
build --repo_env=CC=clang --repo_env=CXX=clang++ --copt="-std=c++17"
1+
build --repo_env=CC=clang --repo_env=CXX=clang++ --cxxopt="-std=c++17"
22

33
try-import %workspace%/local.bazelrc

‎.git-blame-ignore-revs

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# .git-blame-ignore-revs
2+
# Auto-formatted Java
3+
730eae952139209fe9fdf598541d608f4c0c0c84
4+
# Auto-formatted C#
5+
5ad7ed49dd3de03ec6dcfcb6848758a6a987e11c
6+
# Auto-formatted C/C++
7+
ef97e539ec1971494d4bba5cafe82e00bc8217ac
8+
# Auto-formatted Python
9+
21d5fa836b3a7d020ba45e8b8168b145a9772131
10+
# Auto-formatted JavaScript
11+
8d97fe9ed327a9546ff2eaf515cf0f5214deddd9
12+
# Auto-formatted Ruby
13+
a5d229903d2f12d45f2c2c38822f1d0e7504ae7f
14+
# Auto-formatted Go
15+
08c658e66bf867090033ea096e244a93d46c0aa7
16+
# Auto-formatted Swift
17+
711d7057f79fb7d72fc3b35e010bd018f9009169
18+
# Auto-formatted shared ql packs
19+
3640b6d3a8ce9edf8e1d3ed106fe8526cf255bc0
20+
# Auto-formatted taint tracking files
21+
159d8e978c51959b380838c080d891b66e763b19

‎.github/ISSUE_TEMPLATE/lgtm-com---false-positive.md

Lines changed: 0 additions & 24 deletions
This file was deleted.

‎.github/ISSUE_TEMPLATE/ql---general.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,5 +10,5 @@ assignees: ''
1010
**Description of the issue**
1111

1212
<!-- Please explain briefly what is the problem.
13-
If it is about an LGTM project, please include its URL.-->
13+
If it is about a GitHub project, please include its URL. -->
1414

‎.github/ISSUE_TEMPLATE/ql--false-positive.md

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
---
2+
name: CodeQL false positive
3+
about: Report CodeQL alerts that you think should not have been detected (not applicable, not exploitable, etc.)
4+
title: False positive
5+
labels: false-positive
6+
assignees: ''
7+
8+
---
9+
10+
**Description of the false positive**
11+
12+
<!-- Please explain briefly why you think it shouldn't be included. -->
13+
14+
**Code samples or links to source code**
15+
16+
<!--
17+
For open source code: file links with line numbers on GitHub, for example:
18+
https://github.com/github/codeql/blob/dc440aaee6695deb0d9676b87e06ea984e1b4ae5/javascript/ql/test/query-tests/Security/CWE-078/CommandInjection/exec-sh2.js#L10
19+
20+
For closed source code: (redacted) code samples that illustrate the problem, for example:
21+
22+
```
23+
function execSh(command, options) {
24+
return cp.spawn(getShell(), ["-c", command], options) // <- command line injection
25+
};
26+
```
27+
-->
28+
29+
**URL to the alert on GitHub code scanning (optional)**
30+
31+
<!--
32+
1. Open the project on GitHub.com.
33+
2. Switch to the `Security` tab.
34+
3. Browse to the alert that you would like to report.
35+
4. Copy and paste the page URL here.
36+
-->

‎.github/actions/cache-query-compilation/action.yml

Lines changed: 149 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
name: Cache query compilation
2+
description: Caches CodeQL compilation caches - should be run both on PRs and pushes to main.
3+
4+
inputs:
5+
key:
6+
description: 'The cache key to use - should be unique to the workflow'
7+
required: true
8+
9+
outputs:
10+
cache-dir:
11+
description: "The directory where the cache was stored"
12+
value: ${{ steps.output-compilation-dir.outputs.compdir }}
13+
14+
runs:
15+
using: composite
16+
steps:
17+
# calculate the merge-base with main, in a way that works both on PRs and pushes to main.
18+
- name: Calculate merge-base
19+
shell: bash
20+
if: ${{ github.event_name == 'pull_request' }}
21+
env:
22+
BASE_BRANCH: ${{ github.base_ref }}
23+
run: |
24+
MERGE_BASE=$(git cat-file commit $GITHUB_SHA | grep '^parent ' | head -1 | cut -f 2 -d " ")
25+
echo "merge_base=$MERGE_BASE" >> $GITHUB_ENV
26+
- name: Restore cache (PR)
27+
if: ${{ github.event_name == 'pull_request' }}
28+
uses: actions/cache/restore@v3
29+
with:
30+
path: |
31+
**/.cache
32+
~/.codeql/compile-cache
33+
key: codeql-compile-${{ inputs.key }}-pr-${{ github.sha }}
34+
restore-keys: |
35+
codeql-compile-${{ inputs.key }}-${{ github.base_ref }}-${{ env.merge_base }}
36+
codeql-compile-${{ inputs.key }}-${{ github.base_ref }}-
37+
codeql-compile-${{ inputs.key }}-main-
38+
- name: Fill cache (only branch push)
39+
if: ${{ github.event_name != 'pull_request' }}
40+
uses: actions/cache@v3
41+
with:
42+
path: |
43+
**/.cache
44+
~/.codeql/compile-cache
45+
key: codeql-compile-${{ inputs.key }}-${{ github.ref_name }}-${{ github.sha }} # just fill on main
46+
restore-keys: | # restore the latest cache if the exact cache is unavailable, to speed up compilation.
47+
codeql-compile-${{ inputs.key }}-${{ github.ref_name }}-
48+
codeql-compile-${{ inputs.key }}-main-
49+
- name: Output-compilationdir
50+
id: output-compilation-dir
51+
shell: bash
52+
run: |
53+
echo "compdir=${COMBINED_CACHE_DIR}" >> $GITHUB_OUTPUT
54+
env:
55+
COMBINED_CACHE_DIR: ${{ runner.temp }}/compilation-dir
56+
- name: Fill compilation cache directory
57+
id: fill-compilation-dir
58+
uses: actions/github-script@v6
59+
env:
60+
COMBINED_CACHE_DIR: ${{ runner.temp }}/compilation-dir
61+
with:
62+
script: |
63+
// # Move all the existing cache into another folder, so we only preserve the cache for the current queries.
64+
// mkdir -p ${COMBINED_CACHE_DIR}
65+
// rm -f **/.cache/{lock,size} # -f to avoid errors if the cache is empty.
66+
// # copy the contents of the .cache folders into the combined cache folder.
67+
// cp -r **/.cache/* ${COMBINED_CACHE_DIR}/ || : # ignore missing files
68+
// # clean up the .cache folders
69+
// rm -rf **/.cache/*
70+
71+
const fs = require("fs");
72+
const path = require("path");
73+
const os = require("os");
74+
75+
// the first argv is the cache folder to create.
76+
const COMBINED_CACHE_DIR = process.env.COMBINED_CACHE_DIR;
77+
78+
function* walkCaches(dir) {
79+
const files = fs.readdirSync(dir, { withFileTypes: true });
80+
for (const file of files) {
81+
if (file.isDirectory()) {
82+
const filePath = path.join(dir, file.name);
83+
yield* walkCaches(filePath);
84+
if (file.name === ".cache") {
85+
yield filePath;
86+
}
87+
}
88+
}
89+
}
90+
91+
async function copyDir(src, dest) {
92+
for await (const file of await fs.promises.readdir(src, { withFileTypes: true })) {
93+
const srcPath = path.join(src, file.name);
94+
const destPath = path.join(dest, file.name);
95+
if (file.isDirectory()) {
96+
if (!fs.existsSync(destPath)) {
97+
fs.mkdirSync(destPath);
98+
}
99+
await copyDir(srcPath, destPath);
100+
} else {
101+
await fs.promises.copyFile(srcPath, destPath);
102+
}
103+
}
104+
}
105+
106+
async function main() {
107+
const cacheDirs = [...walkCaches(".")];
108+
109+
for (const dir of cacheDirs) {
110+
console.log(`Found .cache dir at ${dir}`);
111+
}
112+
113+
const globalCacheDir = path.join(os.homedir(), ".codeql", "compile-cache");
114+
if (fs.existsSync(globalCacheDir)) {
115+
console.log("Found global home dir: " + globalCacheDir);
116+
cacheDirs.push(globalCacheDir);
117+
}
118+
119+
if (cacheDirs.length === 0) {
120+
console.log("No cache dirs found");
121+
return;
122+
}
123+
124+
// mkdir -p ${COMBINED_CACHE_DIR}
125+
fs.mkdirSync(COMBINED_CACHE_DIR, { recursive: true });
126+
127+
// rm -f **/.cache/{lock,size} # -f to avoid errors if the cache is empty.
128+
await Promise.all(
129+
cacheDirs.map((cacheDir) =>
130+
(async function () {
131+
await fs.promises.rm(path.join(cacheDir, "lock"), { force: true });
132+
await fs.promises.rm(path.join(cacheDir, "size"), { force: true });
133+
})()
134+
)
135+
);
136+
137+
// # copy the contents of the .cache folders into the combined cache folder.
138+
// cp -r **/.cache/* ${COMBINED_CACHE_DIR}/ || : # ignore missing files
139+
await Promise.all(
140+
cacheDirs.map((cacheDir) => copyDir(cacheDir, COMBINED_CACHE_DIR))
141+
);
142+
143+
// # clean up the .cache folders
144+
// rm -rf **/.cache/*
145+
await Promise.all(
146+
cacheDirs.map((cacheDir) => fs.promises.rm(cacheDir, { recursive: true }))
147+
);
148+
}
149+
main();

‎.github/actions/fetch-codeql/action.yml

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,24 @@
11
name: Fetch CodeQL
22
description: Fetches the latest version of CodeQL
3+
4+
inputs:
5+
channel:
6+
description: 'The CodeQL channel to use'
7+
required: false
8+
default: 'nightly'
9+
310
runs:
411
using: composite
512
steps:
6-
- name: Select platform - Linux
7-
if: runner.os == 'Linux'
8-
shell: bash
9-
run: echo "GA_CODEQL_CLI_PLATFORM=linux64" >> $GITHUB_ENV
10-
11-
- name: Select platform - MacOS
12-
if: runner.os == 'MacOS'
13-
shell: bash
14-
run: echo "GA_CODEQL_CLI_PLATFORM=osx64" >> $GITHUB_ENV
15-
1613
- name: Fetch CodeQL
1714
shell: bash
18-
run: |
19-
LATEST=$(gh release list --repo https://github.com/github/codeql-cli-binaries | cut -f 1 | grep -v beta | sort --version-sort | tail -1)
20-
gh release download --repo https://github.com/github/codeql-cli-binaries --pattern codeql-$GA_CODEQL_CLI_PLATFORM.zip "$LATEST"
21-
unzip -q -d "${RUNNER_TEMP}" codeql-$GA_CODEQL_CLI_PLATFORM.zip
22-
echo "${RUNNER_TEMP}/codeql" >> "${GITHUB_PATH}"
2315
env:
2416
GITHUB_TOKEN: ${{ github.token }}
17+
CHANNEL: ${{ inputs.channel }}
18+
run: |
19+
gh extension install github/gh-codeql
20+
gh codeql set-channel "$CHANNEL"
21+
gh codeql version
22+
printf "CODEQL_FETCHED_CODEQL_PATH=" >> "${GITHUB_ENV}"
23+
gh codeql version --format=json | jq -r .unpackedLocation >> "${GITHUB_ENV}"
24+
gh codeql version --format=json | jq -r .unpackedLocation >> "${GITHUB_PATH}"

‎.github/actions/os-version/action.yml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: OS Version
2+
description: Get OS version.
3+
4+
outputs:
5+
version:
6+
description: "OS version"
7+
value: ${{ steps.version.outputs.version }}
8+
9+
runs:
10+
using: composite
11+
steps:
12+
- if: runner.os == 'Linux'
13+
shell: bash
14+
run: |
15+
. /etc/os-release
16+
echo "VERSION=${NAME} ${VERSION}" >> $GITHUB_ENV
17+
- if: runner.os == 'Windows'
18+
shell: powershell
19+
run: |
20+
$objects = systeminfo.exe /FO CSV | ConvertFrom-Csv
21+
"VERSION=$($objects.'OS Name') $($objects.'OS Version')" >> $env:GITHUB_ENV
22+
- if: runner.os == 'macOS'
23+
shell: bash
24+
run: |
25+
echo "VERSION=$(sw_vers -productName) $(sw_vers -productVersion)" >> $GITHUB_ENV
26+
- name: Emit OS version
27+
id: version
28+
shell: bash
29+
run: |
30+
echo "$VERSION"
31+
echo "version=${VERSION}" >> $GITHUB_OUTPUT
32+

‎.github/dependabot.yml

Lines changed: 3 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,12 @@
11
version: 2
22
updates:
33
- package-ecosystem: "cargo"
4-
directory: "ruby/node-types"
5-
schedule:
6-
interval: "daily"
7-
- package-ecosystem: "cargo"
8-
directory: "ruby/generator"
9-
schedule:
10-
interval: "daily"
11-
- package-ecosystem: "cargo"
12-
directory: "ruby/extractor"
4+
directory: "ruby"
135
schedule:
146
interval: "daily"
7+
158
- package-ecosystem: "cargo"
16-
directory: "ruby/autobuilder"
9+
directory: "ql"
1710
schedule:
1811
interval: "daily"
1912

‎.github/labeler.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,3 +42,15 @@ documentation:
4242

4343
"QL-for-QL":
4444
- ql/**/*
45+
- .github/workflows/ql-for-ql*
46+
47+
# Since these are all shared files that need to be synced, just pick _one_ copy of each.
48+
"DataFlow Library":
49+
- "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl.qll"
50+
- "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll"
51+
- "java/ql/lib/semmle/code/java/dataflow/internal/tainttracking1/TaintTrackingImpl.qll"
52+
- "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImplConsistency.qll"
53+
- "java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll"
54+
55+
"ATM":
56+
- javascript/ql/experimental/adaptivethreatmodeling/**/*

0 commit comments

Comments
 (0)