Skip to content

Commit 85e27ca

Browse files
yoffyoff
authored
Merge branch 'main' into ruby/refine-uninitialised-local
2 parents eb0f8e9 + 2dc88d8 commit 85e27ca

File tree

63 files changed

+947
-162
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

63 files changed

+947
-162
lines changed

‎actions/extractor/tools/autobuild-impl.ps1

Lines changed: 24 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,28 @@
1-
if (($null -ne $env:LGTM_INDEX_INCLUDE) -or ($null -ne $env:LGTM_INDEX_EXCLUDE) -or ($null -ne $env:LGTM_INDEX_FILTERS)) {
2-
Write-Output 'Path filters set. Passing them through to the JavaScript extractor.'
3-
} else {
4-
Write-Output 'No path filters set. Using the default filters.'
5-
# Note: We're adding the `reusable_workflows` subdirectories to proactively
6-
# record workflows that were called cross-repo, check them out locally,
7-
# and enable an interprocedural analysis across the workflow files.
8-
# These workflows follow the convention `.github/reusable_workflows/<nwo>/*.ya?ml`
9-
$DefaultPathFilters = @(
10-
'exclude:**/*',
11-
'include:.github/workflows/*.yml',
12-
'include:.github/workflows/*.yaml',
13-
'include:.github/reusable_workflows/**/*.yml',
14-
'include:.github/reusable_workflows/**/*.yaml',
15-
'include:**/action.yml',
16-
'include:**/action.yaml'
17-
)
1+
# Note: We're adding the `reusable_workflows` subdirectories to proactively
2+
# record workflows that were called cross-repo, check them out locally,
3+
# and enable an interprocedural analysis across the workflow files.
4+
# These workflows follow the convention `.github/reusable_workflows/<nwo>/*.ya?ml`
5+
$DefaultPathFilters = @(
6+
'exclude:**/*',
7+
'include:.github/workflows/*.yml',
8+
'include:.github/workflows/*.yaml',
9+
'include:.github/reusable_workflows/**/*.yml',
10+
'include:.github/reusable_workflows/**/*.yaml',
11+
'include:**/action.yml',
12+
'include:**/action.yaml'
13+
)
1814

15+
if ($null -ne $env:LGTM_INDEX_FILTERS) {
16+
Write-Output 'LGTM_INDEX_FILTERS set. Using the default filters together with the user-provided filters, and passing through to the JavaScript extractor.'
17+
# Begin with the default path inclusions only,
18+
# followed by the user-provided filters.
19+
# If the user provided `paths`, those patterns override the default inclusions
20+
# (because `LGTM_INDEX_FILTERS` will begin with `exclude:**/*`).
21+
# If the user provided `paths-ignore`, those patterns are excluded.
22+
$PathFilters = ($DefaultPathFilters -join "`n") + "`n" + $env:LGTM_INDEX_FILTERS
23+
$env:LGTM_INDEX_FILTERS = $PathFilters
24+
} else {
25+
Write-Output 'LGTM_INDEX_FILTERS not set. Using the default filters, and passing through to the JavaScript extractor.'
1926
$env:LGTM_INDEX_FILTERS = $DefaultPathFilters -join "`n"
2027
}
2128

‎actions/extractor/tools/autobuild.sh

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,22 @@ include:**/action.yaml
1717
END
1818
)
1919

20-
if [ -n "${LGTM_INDEX_INCLUDE:-}" ] || [ -n "${LGTM_INDEX_EXCLUDE:-}" ] || [ -n "${LGTM_INDEX_FILTERS:-}" ] ; then
21-
echo "Path filters set. Passing them through to the JavaScript extractor."
20+
if [ -n "${LGTM_INDEX_FILTERS:-}" ]; then
21+
echo "LGTM_INDEX_FILTERS set. Using the default filters together with the user-provided filters, and passing through to the JavaScript extractor."
22+
# Begin with the default path inclusions only,
23+
# followed by the user-provided filters.
24+
# If the user provided `paths`, those patterns override the default inclusions
25+
# (because `LGTM_INDEX_FILTERS` will begin with `exclude:**/*`).
26+
# If the user provided `paths-ignore`, those patterns are excluded.
27+
PATH_FILTERS="$(cat << END
28+
${DEFAULT_PATH_FILTERS}
29+
${LGTM_INDEX_FILTERS}
30+
END
31+
)"
32+
LGTM_INDEX_FILTERS="${PATH_FILTERS}"
33+
export LGTM_INDEX_FILTERS
2234
else
23-
echo "No path filters set. Using the default filters."
35+
echo "LGTM_INDEX_FILTERS not set. Using the default filters, and passing through to the JavaScript extractor."
2436
LGTM_INDEX_FILTERS="${DEFAULT_PATH_FILTERS}"
2537
export LGTM_INDEX_FILTERS
2638
fi

‎actions/ql/integration-tests/filters-default/test.py

Lines changed: 0 additions & 2 deletions
This file was deleted.

‎actions/ql/integration-tests/filters/actions.default-filters.expected

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
| src/.github/action.yaml:1:1:11:32 | name: ' ... action' |
2+
| src/.github/actions/action-name/action.yml:1:1:11:32 | name: ' ... action' |
3+
| src/.github/workflows/workflow.yml:1:1:12:33 | name: A workflow |
4+
| src/action.yml:1:1:11:32 | name: ' ... action' |
5+
| src/excluded/action.yml:1:1:11:32 | name: ' ... action' |
6+
| src/included/action.yml:1:1:11:32 | name: ' ... action' |

‎actions/ql/integration-tests/filters/actions.paths-and-paths-ignore.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
| src/included/action.yml:1:1:11:32 | name: ' ... action' |
2+
| src/included/unreachable-workflow.yml:1:1:12:33 | name: A ... orkflow |

‎actions/ql/integration-tests/filters-default/actions.expected renamed to ‎actions/ql/integration-tests/filters/actions.paths-ignore-only.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,3 +2,4 @@
22
| src/.github/actions/action-name/action.yml:1:1:11:32 | name: ' ... action' |
33
| src/.github/workflows/workflow.yml:1:1:12:33 | name: A workflow |
44
| src/action.yml:1:1:11:32 | name: ' ... action' |
5+
| src/included/action.yml:1:1:11:32 | name: ' ... action' |

‎actions/ql/integration-tests/filters/actions.paths-only.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
| src/included/action.yml:1:1:11:32 | name: ' ... action' |
2+
| src/included/unreachable-workflow.yml:1:1:12:33 | name: A ... orkflow |

‎actions/ql/integration-tests/filters/actions.ql

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
import actions
2+
3+
from AstNode n
4+
where n instanceof Workflow or n instanceof CompositeAction
5+
select n

‎actions/ql/integration-tests/filters/codeql-config.paths-and-paths-ignore.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
paths:
2+
- 'included'
3+
paths-ignore:
4+
- 'excluded'

‎actions/ql/integration-tests/filters/codeql-config.paths-ignore-only.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
paths-ignore:
2+
- 'excluded'

‎actions/ql/integration-tests/filters/codeql-config.paths-only.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
paths:
2+
- 'included'

‎actions/ql/integration-tests/filters/source_archive.default-filters.expected

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
src/.github/action.yaml
2+
src/.github/actions/action-name/action.yml
3+
src/.github/workflows/workflow.yml
4+
src/action.yml
5+
src/excluded/action.yml
6+
src/included/action.yml

‎actions/ql/integration-tests/filters/source_archive.paths-and-paths-ignore.expected

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
src/included/action.yml
2+
src/included/not-an-action.yml
3+
src/included/unreachable-workflow.yml

‎actions/ql/integration-tests/filters/source_archive.paths-ignore-only.expected

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
src/.github/action.yaml
2+
src/.github/actions/action-name/action.yml
3+
src/.github/workflows/workflow.yml
4+
src/action.yml
5+
src/included/action.yml

‎actions/ql/integration-tests/filters/source_archive.paths-only.expected

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
src/included/action.yml
2+
src/included/not-an-action.yml
3+
src/included/unreachable-workflow.yml

‎actions/ql/integration-tests/filters-default/src/.github/action.yaml renamed to ‎actions/ql/integration-tests/filters/src/.github/action.yaml

File renamed without changes.

‎actions/ql/integration-tests/filters-default/src/.github/actions/action-name/action.yml renamed to ‎actions/ql/integration-tests/filters/src/.github/actions/action-name/action.yml

File renamed without changes.

‎actions/ql/integration-tests/filters-default/src/.github/unreachable-workflow.yml renamed to ‎actions/ql/integration-tests/filters/src/.github/unreachable-workflow.yml

File renamed without changes.

‎actions/ql/integration-tests/filters-default/src/.github/workflows/workflow.yml renamed to ‎actions/ql/integration-tests/filters/src/.github/workflows/workflow.yml

File renamed without changes.

‎actions/ql/integration-tests/filters-default/src/action.yml renamed to ‎actions/ql/integration-tests/filters/src/action.yml

File renamed without changes.

‎actions/ql/integration-tests/filters/src/excluded/action.yml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
name: 'A composite action'
2+
description: 'Do something'
3+
runs:
4+
using: "composite"
5+
steps:
6+
- name: Print
7+
run: echo "Hello world"
8+
shell: bash
9+
10+
- name: Checkout
11+
uses: actions/checkout@v4

‎actions/ql/integration-tests/filters-default/src/unreachable-workflow.yml renamed to ‎actions/ql/integration-tests/filters/src/excluded/unreachable-workflow.yml

File renamed without changes.

‎actions/ql/integration-tests/filters/src/included/action.yml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
name: 'A composite action'
2+
description: 'Do something'
3+
runs:
4+
using: "composite"
5+
steps:
6+
- name: Print
7+
run: echo "Hello world"
8+
shell: bash
9+
10+
- name: Checkout
11+
uses: actions/checkout@v4

‎actions/ql/integration-tests/filters/src/included/not-an-action.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
name: 'Not an action, just a YAML file'

‎actions/ql/integration-tests/filters/src/included/unreachable-workflow.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
name: An unreachable workflow
2+
on:
3+
push:
4+
branches:
5+
- main
6+
7+
jobs:
8+
job:
9+
runs-on: ubuntu-latest
10+
steps:
11+
- name: Checkout code
12+
uses: actions/checkout@v4

‎actions/ql/integration-tests/filters/src/unreachable-workflow.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
name: An unreachable workflow
2+
on:
3+
push:
4+
branches:
5+
- main
6+
7+
jobs:
8+
job:
9+
runs-on: ubuntu-latest
10+
steps:
11+
- name: Checkout code
12+
uses: actions/checkout@v4

‎actions/ql/integration-tests/filters/test.py

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
import pytest
2+
3+
@pytest.mark.ql_test(expected=".default-filters.expected")
4+
def test_default_filters(codeql, actions, check_source_archive):
5+
check_source_archive.expected_suffix = ".default-filters.expected"
6+
codeql.database.create(source_root="src")
7+
8+
@pytest.mark.ql_test(expected=".paths-only.expected")
9+
def test_config_paths_only(codeql, actions):
10+
codeql.database.create(source_root="src", codescanning_config="codeql-config.paths-only.yml")
11+
12+
@pytest.mark.ql_test(expected=".paths-ignore-only.expected")
13+
def test_config_paths_ignore_only(codeql, actions):
14+
codeql.database.create(source_root="src", codescanning_config="codeql-config.paths-ignore-only.yml")
15+
16+
@pytest.mark.ql_test(expected=".paths-and-paths-ignore.expected")
17+
def test_config_paths_and_paths_ignore(codeql, actions):
18+
codeql.database.create(source_root="src", codescanning_config="codeql-config.paths-and-paths-ignore.yml")

‎cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll

Lines changed: 16 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -465,7 +465,7 @@ private predicate isFunctionConstructedFrom(Function f, Function templateFunc) {
465465
}
466466

467467
/** Gets the fully templated version of `f`. */
468-
private Function getFullyTemplatedFunction(Function f) {
468+
Function getFullyTemplatedFunction(Function f) {
469469
not f.isFromUninstantiatedTemplate(_) and
470470
(
471471
exists(Class c, Class templateClass, int i |
@@ -559,27 +559,35 @@ private string getTypeName(Type t, boolean needsSpace) {
559559

560560
/**
561561
* Gets a type name for the `n`'th parameter of `f` without any template
562-
* arguments. The result may be a string representing a type for which the
563-
* typedefs have been resolved.
562+
* arguments.
563+
*
564+
* If `canonical = false` then the result may be a string representing a type
565+
* for which the typedefs have been resolved. If `canonical = true` then the
566+
* result will be a string representing a type without resolving `typedefs`.
564567
*/
565568
bindingset[f]
566569
pragma[inline_late]
567-
string getParameterTypeWithoutTemplateArguments(Function f, int n) {
570+
string getParameterTypeWithoutTemplateArguments(Function f, int n, boolean canonical) {
568571
exists(string s, string base, string specifiers, Type t |
569572
t = f.getParameter(n).getType() and
570573
// The name of the string can either be the possibly typedefed name
571574
// or an alternative name where typedefs has been resolved.
572575
// `getTypeName(t, _)` is almost equal to `t.resolveTypedefs().getName()`,
573576
// except that `t.resolveTypedefs()` doesn't have a result when the
574577
// resulting type doesn't appear in the database.
575-
s = [t.getName(), getTypeName(t, _)] and
578+
(
579+
s = t.getName() and canonical = true
580+
or
581+
s = getTypeName(t, _) and canonical = false
582+
) and
576583
parseAngles(s, base, _, specifiers) and
577584
result = base + specifiers
578585
)
579586
or
580587
f.isVarargs() and
581588
n = f.getNumberOfParameters() and
582-
result = "..."
589+
result = "..." and
590+
canonical = true
583591
}
584592

585593
/**
@@ -590,7 +598,7 @@ private string getTypeNameWithoutFunctionTemplates(Function f, int n, int remain
590598
exists(Function templateFunction |
591599
templateFunction = getFullyTemplatedFunction(f) and
592600
remaining = templateFunction.getNumberOfTemplateArguments() and
593-
result = getParameterTypeWithoutTemplateArguments(templateFunction, n)
601+
result = getParameterTypeWithoutTemplateArguments(templateFunction, n, _)
594602
)
595603
or
596604
exists(string mid, TypeTemplateParameter tp, Function templateFunction |
@@ -627,7 +635,7 @@ private string getTypeNameWithoutClassTemplates(Function f, int n, int remaining
627635
}
628636

629637
/** Gets the string representation of the `i`'th parameter of `c`. */
630-
private string getParameterTypeName(Function c, int i) {
638+
string getParameterTypeName(Function c, int i) {
631639
result = getTypeNameWithoutClassTemplates(c, i, 0)
632640
}
633641

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll

Lines changed: 42 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -371,7 +371,7 @@ private class PrimaryArgumentNode extends ArgumentNode, OperandNode {
371371
PrimaryArgumentNode() { exists(CallInstruction call | op = call.getAnArgumentOperand()) }
372372

373373
override predicate argumentOf(DataFlowCall call, ArgumentPosition pos) {
374-
op = call.getArgumentOperand(pos.(DirectPosition).getIndex())
374+
op = call.getArgumentOperand(pos.(DirectPosition).getArgumentIndex())
375375
}
376376
}
377377

@@ -410,8 +410,16 @@ class ParameterPosition = Position;
410410
class ArgumentPosition = Position;
411411

412412
abstract class Position extends TPosition {
413+
/** Gets a textual representation of this position. */
413414
abstract string toString();
414415

416+
/**
417+
* Gets the argument index of this position. The qualifier of a call has
418+
* argument index `-1`.
419+
*/
420+
abstract int getArgumentIndex();
421+
422+
/** Gets the indirection index of this position. */
415423
abstract int getIndirectionIndex();
416424
}
417425

@@ -428,7 +436,7 @@ class DirectPosition extends Position, TDirectPosition {
428436
result = index.toString()
429437
}
430438

431-
int getIndex() { result = index }
439+
override int getArgumentIndex() { result = index }
432440

433441
final override int getIndirectionIndex() { result = 0 }
434442
}
@@ -445,16 +453,29 @@ class IndirectionPosition extends Position, TIndirectionPosition {
445453
else result = repeatStars(indirectionIndex) + argumentIndex.toString()
446454
}
447455

448-
int getArgumentIndex() { result = argumentIndex }
456+
override int getArgumentIndex() { result = argumentIndex }
449457

450458
final override int getIndirectionIndex() { result = indirectionIndex }
451459
}
452460

453461
newtype TPosition =
454-
TDirectPosition(int argumentIndex) { exists(any(CallInstruction c).getArgument(argumentIndex)) } or
462+
TDirectPosition(int argumentIndex) {
463+
exists(any(CallInstruction c).getArgument(argumentIndex))
464+
or
465+
// Handle the rare case where there is a function definition but no call to
466+
// the function.
467+
exists(any(Cpp::Function f).getParameter(argumentIndex))
468+
} or
455469
TIndirectionPosition(int argumentIndex, int indirectionIndex) {
456470
Ssa::hasIndirectOperand(any(CallInstruction call).getArgumentOperand(argumentIndex),
457471
indirectionIndex)
472+
or
473+
// Handle the rare case where there is a function definition but no call to
474+
// the function.
475+
exists(Cpp::Function f, Cpp::Parameter p |
476+
p = f.getParameter(argumentIndex) and
477+
indirectionIndex = [1 .. Ssa::getMaxIndirectionsForType(p.getUnspecifiedType()) - 1]
478+
)
458479
}
459480

460481
private newtype TReturnKind =
@@ -501,6 +522,15 @@ class ReturnKind extends TReturnKind {
501522

502523
/** Gets a textual representation of this return kind. */
503524
abstract string toString();
525+
526+
/** Holds if this `ReturnKind` is generated from a `return` statement. */
527+
abstract predicate isNormalReturn();
528+
529+
/**
530+
* Holds if this `ReturnKind` is generated from a write to the parameter with
531+
* index `argumentIndex`
532+
*/
533+
abstract predicate isIndirectReturn(int argumentIndex);
504534
}
505535

506536
/**
@@ -514,6 +544,10 @@ class NormalReturnKind extends ReturnKind, TNormalReturnKind {
514544
override int getIndirectionIndex() { result = indirectionIndex }
515545

516546
override string toString() { result = "indirect return" }
547+
548+
override predicate isNormalReturn() { any() }
549+
550+
override predicate isIndirectReturn(int argumentIndex) { none() }
517551
}
518552

519553
/**
@@ -528,6 +562,10 @@ private class IndirectReturnKind extends ReturnKind, TIndirectReturnKind {
528562
override int getIndirectionIndex() { result = indirectionIndex }
529563

530564
override string toString() { result = "indirect outparam[" + argumentIndex.toString() + "]" }
565+
566+
override predicate isNormalReturn() { none() }
567+
568+
override predicate isIndirectReturn(int argumentIndex_) { argumentIndex_ = argumentIndex }
531569
}
532570

533571
/** A data flow node that occurs as the result of a `ReturnStmt`. */

0 commit comments

Comments
 (0)