Skip to content

Commit 7cfed3c

Browse files
redsun82redsun82
authored
Merge branch 'main' into redsun82/rust-analyzer-update
2 parents bd201af + 36ed96f commit 7cfed3c

File tree

112 files changed

+7673
-1052
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

112 files changed

+7673
-1052
lines changed

‎.github/workflows/go-tests-rtjo.yml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: "Go: Run RTJO Tests"
2+
on:
3+
pull_request:
4+
types:
5+
- labeled
6+
7+
permissions:
8+
contents: read
9+
10+
jobs:
11+
test-linux:
12+
if: "github.repository_owner == 'github' && github.event.label.name == 'Run: RTJO Language Tests'"
13+
name: RTJO Test Linux (Ubuntu)
14+
runs-on: ubuntu-latest-xl
15+
steps:
16+
- name: Check out code
17+
uses: actions/checkout@v4
18+
- name: Run tests
19+
uses: ./go/actions/test
20+
with:
21+
run-code-checks: true
22+
dynamic-join-order-mode: all

‎.github/workflows/ruby-qltest-rtjo.yml

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
name: "Ruby: Run RTJO Language Tests"
2+
3+
on:
4+
pull_request:
5+
types:
6+
- opened
7+
- synchronize
8+
- reopened
9+
- labeled
10+
11+
env:
12+
CARGO_TERM_COLOR: always
13+
14+
defaults:
15+
run:
16+
working-directory: ruby
17+
18+
permissions:
19+
contents: read
20+
21+
jobs:
22+
qltest-rtjo:
23+
if: "github.repository_owner == 'github' && github.event.label.name == 'Run: RTJO Language Tests'"
24+
runs-on: ubuntu-latest-xl
25+
strategy:
26+
fail-fast: false
27+
steps:
28+
- uses: actions/checkout@v4
29+
- uses: ./.github/actions/fetch-codeql
30+
- uses: ./ruby/actions/create-extractor-pack
31+
- name: Cache compilation cache
32+
id: query-cache
33+
uses: ./.github/actions/cache-query-compilation
34+
with:
35+
key: ruby-qltest
36+
- name: Run QL tests
37+
run: |
38+
codeql test run --dynamic-join-order-mode=all --threads=0 --ram 50000 --search-path "${{ github.workspace }}" --check-databases --check-undefined-labels --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --consistency-queries ql/consistency-queries ql/test --compilation-cache "${{ steps.query-cache.outputs.cache-dir }}"
39+
env:
40+
GITHUB_TOKEN: ${{ github.token }}

‎actions/ql/lib/change-notes/2025-03-20.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
category: fix
3+
---
4+
* The query `actions/code-injection/medium` now produces alerts for injection
5+
vulnerabilities on `pull_request` events.

‎actions/ql/lib/ext/config/context_event_map.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,9 @@ extensions:
3030
- ["pull_request_review_comment", "github.event.review"]
3131
- ["pull_request_review_comment", "github.head_ref"]
3232
- ["pull_request_review_comment", "github.event.changes"]
33+
- ["pull_request", "github.event.pull_request"]
34+
- ["pull_request", "github.head_ref"]
35+
- ["pull_request", "github.event.changes"]
3336
- ["pull_request_target", "github.event.pull_request"]
3437
- ["pull_request_target", "github.head_ref"]
3538
- ["pull_request_target", "github.event.changes"]

‎actions/ql/lib/ext/config/externally_triggereable_events.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ extensions:
1212
- ["pull_request_comment"]
1313
- ["pull_request_review"]
1414
- ["pull_request_review_comment"]
15+
- ["pull_request"]
1516
- ["pull_request_target"]
1617
- ["workflow_run"] # depending on branch filter
1718
- ["workflow_call"] # depending on caller

‎actions/ql/test/query-tests/Security/CWE-094/CodeInjectionCritical.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -400,6 +400,7 @@ nodes
400400
| .github/workflows/level0.yml:44:20:44:49 | github.event.issue.body | semmle.label | github.event.issue.body |
401401
| .github/workflows/level0.yml:69:35:69:66 | github.event.comment.body | semmle.label | github.event.comment.body |
402402
| .github/workflows/level1.yml:37:38:37:81 | github.event.workflow_run.head_branch | semmle.label | github.event.workflow_run.head_branch |
403+
| .github/workflows/priv_pull_request.yml:14:21:14:57 | github.event.pull_request.body | semmle.label | github.event.pull_request.body |
403404
| .github/workflows/pull_request_review.yml:7:19:7:56 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |
404405
| .github/workflows/pull_request_review.yml:8:19:8:55 | github.event.pull_request.body | semmle.label | github.event.pull_request.body |
405406
| .github/workflows/pull_request_review.yml:9:19:9:61 | github.event.pull_request.head.label | semmle.label | github.event.pull_request.head.label |
@@ -629,6 +630,7 @@ nodes
629630
| .github/workflows/test19.yml:124:9:129:6 | Run Step: title3 [title] | semmle.label | Run Step: title3 [title] |
630631
| .github/workflows/test19.yml:125:14:128:50 | TITLE=$(gh issue view "$ISSUE_NUMBER" --json title,author)\nTITLE=$(echo $TITLE \| jq -r '.title')\necho "title=$TITLE" >> "$GITHUB_OUTPUT"\n | semmle.label | TITLE=$(gh issue view "$ISSUE_NUMBER" --json title,author)\nTITLE=$(echo $TITLE \| jq -r '.title')\necho "title=$TITLE" >> "$GITHUB_OUTPUT"\n |
631632
| .github/workflows/test19.yml:129:21:129:52 | steps.title3.outputs.title | semmle.label | steps.title3.outputs.title |
633+
| .github/workflows/test20.yml:15:54:15:94 | github.event.pull_request.head.ref | semmle.label | github.event.pull_request.head.ref |
632634
| .github/workflows/test21.yml:22:35:22:73 | github.event.head_commit.message | semmle.label | github.event.head_commit.message |
633635
| .github/workflows/test21.yml:23:36:23:74 | github.event.head_commit.message | semmle.label | github.event.head_commit.message |
634636
| .github/workflows/test21.yml:24:50:24:88 | github.event.head_commit.message | semmle.label | github.event.head_commit.message |

‎actions/ql/test/query-tests/Security/CWE-094/CodeInjectionMedium.expected

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -400,6 +400,7 @@ nodes
400400
| .github/workflows/level0.yml:44:20:44:49 | github.event.issue.body | semmle.label | github.event.issue.body |
401401
| .github/workflows/level0.yml:69:35:69:66 | github.event.comment.body | semmle.label | github.event.comment.body |
402402
| .github/workflows/level1.yml:37:38:37:81 | github.event.workflow_run.head_branch | semmle.label | github.event.workflow_run.head_branch |
403+
| .github/workflows/priv_pull_request.yml:14:21:14:57 | github.event.pull_request.body | semmle.label | github.event.pull_request.body |
403404
| .github/workflows/pull_request_review.yml:7:19:7:56 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |
404405
| .github/workflows/pull_request_review.yml:8:19:8:55 | github.event.pull_request.body | semmle.label | github.event.pull_request.body |
405406
| .github/workflows/pull_request_review.yml:9:19:9:61 | github.event.pull_request.head.label | semmle.label | github.event.pull_request.head.label |
@@ -629,6 +630,7 @@ nodes
629630
| .github/workflows/test19.yml:124:9:129:6 | Run Step: title3 [title] | semmle.label | Run Step: title3 [title] |
630631
| .github/workflows/test19.yml:125:14:128:50 | TITLE=$(gh issue view "$ISSUE_NUMBER" --json title,author)\nTITLE=$(echo $TITLE \| jq -r '.title')\necho "title=$TITLE" >> "$GITHUB_OUTPUT"\n | semmle.label | TITLE=$(gh issue view "$ISSUE_NUMBER" --json title,author)\nTITLE=$(echo $TITLE \| jq -r '.title')\necho "title=$TITLE" >> "$GITHUB_OUTPUT"\n |
631632
| .github/workflows/test19.yml:129:21:129:52 | steps.title3.outputs.title | semmle.label | steps.title3.outputs.title |
633+
| .github/workflows/test20.yml:15:54:15:94 | github.event.pull_request.head.ref | semmle.label | github.event.pull_request.head.ref |
632634
| .github/workflows/test21.yml:22:35:22:73 | github.event.head_commit.message | semmle.label | github.event.head_commit.message |
633635
| .github/workflows/test21.yml:23:36:23:74 | github.event.head_commit.message | semmle.label | github.event.head_commit.message |
634636
| .github/workflows/test21.yml:24:50:24:88 | github.event.head_commit.message | semmle.label | github.event.head_commit.message |
@@ -706,6 +708,7 @@ subpaths
706708
| .github/workflows/inter-job2.yml:45:20:45:53 | needs.job1.outputs.job_output | .github/workflows/inter-job2.yml:22:9:26:6 | Uses Step: source | .github/workflows/inter-job2.yml:45:20:45:53 | needs.job1.outputs.job_output | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/inter-job2.yml:45:20:45:53 | needs.job1.outputs.job_output | ${{needs.job1.outputs.job_output}} |
707709
| .github/workflows/inter-job4.yml:44:20:44:53 | needs.job1.outputs.job_output | .github/workflows/inter-job4.yml:22:9:26:6 | Uses Step: source | .github/workflows/inter-job4.yml:44:20:44:53 | needs.job1.outputs.job_output | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/inter-job4.yml:44:20:44:53 | needs.job1.outputs.job_output | ${{needs.job1.outputs.job_output}} |
708710
| .github/workflows/inter-job5.yml:45:20:45:53 | needs.job1.outputs.job_output | .github/workflows/inter-job5.yml:45:20:45:53 | needs.job1.outputs.job_output | .github/workflows/inter-job5.yml:45:20:45:53 | needs.job1.outputs.job_output | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/inter-job5.yml:45:20:45:53 | needs.job1.outputs.job_output | ${{needs.job1.outputs.job_output}} |
711+
| .github/workflows/priv_pull_request.yml:14:21:14:57 | github.event.pull_request.body | .github/workflows/priv_pull_request.yml:14:21:14:57 | github.event.pull_request.body | .github/workflows/priv_pull_request.yml:14:21:14:57 | github.event.pull_request.body | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/priv_pull_request.yml:14:21:14:57 | github.event.pull_request.body | ${{ github.event.pull_request.body }} |
709712
| .github/workflows/push.yml:7:19:7:57 | github.event.commits[11].message | .github/workflows/push.yml:7:19:7:57 | github.event.commits[11].message | .github/workflows/push.yml:7:19:7:57 | github.event.commits[11].message | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/push.yml:7:19:7:57 | github.event.commits[11].message | ${{ github.event.commits[11].message }} |
710713
| .github/workflows/push.yml:8:19:8:62 | github.event.commits[11].author.email | .github/workflows/push.yml:8:19:8:62 | github.event.commits[11].author.email | .github/workflows/push.yml:8:19:8:62 | github.event.commits[11].author.email | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/push.yml:8:19:8:62 | github.event.commits[11].author.email | ${{ github.event.commits[11].author.email }} |
711714
| .github/workflows/push.yml:9:19:9:61 | github.event.commits[11].author.name | .github/workflows/push.yml:9:19:9:61 | github.event.commits[11].author.name | .github/workflows/push.yml:9:19:9:61 | github.event.commits[11].author.name | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/push.yml:9:19:9:61 | github.event.commits[11].author.name | ${{ github.event.commits[11].author.name }} |

‎csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs

Lines changed: 18 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@ public HashSet<AssemblyLookupLocation> Restore()
109109
if (checkNugetFeedResponsiveness && !CheckFeeds(out explicitFeeds))
110110
{
111111
// todo: we could also check the reachability of the inherited nuget feeds, but to use those in the fallback we would need to handle authentication too.
112-
var unresponsiveMissingPackageLocation = DownloadMissingPackagesFromSpecificFeeds(explicitFeeds);
112+
var unresponsiveMissingPackageLocation = DownloadMissingPackagesFromSpecificFeeds([], explicitFeeds);
113113
return unresponsiveMissingPackageLocation is null
114114
? []
115115
: [unresponsiveMissingPackageLocation];
@@ -166,11 +166,11 @@ public HashSet<AssemblyLookupLocation> Restore()
166166
.ToList();
167167
assemblyLookupLocations.UnionWith(paths.Select(p => new AssemblyLookupLocation(p)));
168168

169-
LogAllUnusedPackages(dependencies);
169+
var usedPackageNames = GetAllUsedPackageDirNames(dependencies);
170170

171171
var missingPackageLocation = checkNugetFeedResponsiveness
172-
? DownloadMissingPackagesFromSpecificFeeds(explicitFeeds)
173-
: DownloadMissingPackages();
172+
? DownloadMissingPackagesFromSpecificFeeds(usedPackageNames, explicitFeeds)
173+
: DownloadMissingPackages(usedPackageNames);
174174

175175
if (missingPackageLocation is not null)
176176
{
@@ -297,21 +297,21 @@ private void RestoreProjects(IEnumerable<string> projects, out ConcurrentBag<Dep
297297
compilationInfoContainer.CompilationInfos.Add(("Failed project restore with package source error", nugetSourceFailures.ToString()));
298298
}
299299

300-
private AssemblyLookupLocation? DownloadMissingPackagesFromSpecificFeeds(HashSet<string>? feedsFromNugetConfigs)
300+
private AssemblyLookupLocation? DownloadMissingPackagesFromSpecificFeeds(IEnumerable<string> usedPackageNames, HashSet<string>? feedsFromNugetConfigs)
301301
{
302302
var reachableFallbackFeeds = GetReachableFallbackNugetFeeds(feedsFromNugetConfigs);
303303
if (reachableFallbackFeeds.Count > 0)
304304
{
305-
return DownloadMissingPackages(fallbackNugetFeeds: reachableFallbackFeeds);
305+
return DownloadMissingPackages(usedPackageNames, fallbackNugetFeeds: reachableFallbackFeeds);
306306
}
307307

308308
logger.LogWarning("Skipping download of missing packages from specific feeds as no fallback Nuget feeds are reachable.");
309309
return null;
310310
}
311311

312-
private AssemblyLookupLocation? DownloadMissingPackages(IEnumerable<string>? fallbackNugetFeeds = null)
312+
private AssemblyLookupLocation? DownloadMissingPackages(IEnumerable<string> usedPackageNames, IEnumerable<string>? fallbackNugetFeeds = null)
313313
{
314-
var alreadyDownloadedPackages = GetRestoredPackageDirectoryNames(PackageDirectory.DirInfo);
314+
var alreadyDownloadedPackages = usedPackageNames.Select(p => p.ToLowerInvariant());
315315
var alreadyDownloadedLegacyPackages = GetRestoredLegacyPackageNames();
316316

317317
var notYetDownloadedPackages = new HashSet<PackageReference>(fileContent.AllPackages);
@@ -418,17 +418,23 @@ private void RestoreProjects(IEnumerable<string> projects, out ConcurrentBag<Dep
418418
return nugetConfig;
419419
}
420420

421-
private void LogAllUnusedPackages(DependencyContainer dependencies)
421+
private IEnumerable<string> GetAllUsedPackageDirNames(DependencyContainer dependencies)
422422
{
423423
var allPackageDirectories = GetAllPackageDirectories();
424424

425425
logger.LogInfo($"Restored {allPackageDirectories.Count} packages");
426426
logger.LogInfo($"Found {dependencies.Packages.Count} packages in project.assets.json files");
427427

428-
allPackageDirectories
429-
.Where(package => !dependencies.Packages.Contains(package))
428+
var usage = allPackageDirectories.Select(package => (package, isUsed: dependencies.Packages.Contains(package)));
429+
430+
usage
431+
.Where(package => !package.isUsed)
430432
.Order()
431-
.ForEach(package => logger.LogDebug($"Unused package: {package}"));
433+
.ForEach(package => logger.LogDebug($"Unused package: {package.package}"));
434+
435+
return usage
436+
.Where(package => package.isUsed)
437+
.Select(package => package.package);
432438
}
433439

434440
private ICollection<string> GetAllPackageDirectories()

‎csharp/paket.dependencies

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ source https://api.nuget.org/v3/index.json
44
# behave like nuget in choosing transitive dependency versions
55
strategy: max
66

7-
nuget Basic.CompilerLog.Util
7+
nuget Basic.CompilerLog.Util 0.9.8
88
nuget Mono.Posix.NETStandard
99
nuget Newtonsoft.Json
1010
nuget xunit

‎csharp/paket.lock

Lines changed: 6 additions & 6 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)