Merge branch 'main' into post-release-prep/codeql-cli-2.20.0

cpp/ql/src/change-notes/2024-12-05-wrong-number-format-arguments.md

@@ -1,4 +1,4 @@
 ---
 category: minorAnalysis
 ---
-* The "Too few arguments to formatting function" query (`cpp/wrong-number-format-arguments`) query no longer produces results if an argument has an extraction error.
+* The "Too few arguments to formatting function" query (`cpp/wrong-number-format-arguments`) no longer produces results if an argument has an extraction error.

csharp/BUILD.bazel

@@ -74,8 +74,10 @@ test_suite(
     name = "unit-tests",
     tags = ["csharp"],
     tests = [
-        "//csharp/autobuilder/Semmle.Autobuild.CSharp.Tests",
-        "//csharp/autobuilder/Semmle.Autobuild.Cpp.Tests",
-        "//csharp/extractor/Semmle.Extraction.Tests",
+        "//csharp/autobuilder/Semmle.Autobuild.CSharp.Tests:acst",
+        "//csharp/autobuilder/Semmle.Autobuild.Cpp.Tests:acpt",
+        "//csharp/extractor/Semmle.Extraction.Tests:et",
+        # this test suite currently fails, disable for now
+        # "//csharp/extractor/Semmle.Util.Tests:ut",
     ],
 )

csharp/autobuilder/Semmle.Autobuild.CSharp.Tests/BUILD.bazel

@@ -4,7 +4,8 @@ load(
 )
 
 codeql_xunit_test(
-    name = "Semmle.Autobuild.CSharp.Tests",
+    # short name as we run into long path limitations on Windows
+    name = "acst",
     srcs = glob([
         "*.cs",
     ]),

csharp/autobuilder/Semmle.Autobuild.CSharp/BUILD.bazel

@@ -17,6 +17,5 @@ codeql_csharp_binary(
         "//csharp/extractor/Semmle.Extraction.CSharp.Standalone:bin/Semmle.Extraction.CSharp.Standalone",
         "//csharp/extractor/Semmle.Util",
         "@paket.main//microsoft.build",
-        "@paket.main//newtonsoft.json",
     ],
 )

csharp/autobuilder/Semmle.Autobuild.CSharp/paket.references

@@ -1,2 +1 @@
-Newtonsoft.Json
 Microsoft.Build

csharp/autobuilder/Semmle.Autobuild.Cpp.Tests/BUILD.bazel

@@ -4,7 +4,8 @@ load(
 )
 
 codeql_xunit_test(
-    name = "Semmle.Autobuild.Cpp.Tests",
+    # short name as we run into long path limitations on Windows
+    name = "acpt",
     srcs = glob([
         "*.cs",
     ]),

csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/BUILD.bazel

@@ -10,11 +10,11 @@ codeql_csharp_library(
         "SourceGenerators/**/*.cs",
     ]),
     allow_unsafe_blocks = True,
-    internals_visible_to = ["Semmle.Extraction.Tests"],
-    nowarn = ["CA1822"],
+    internals_visible_to = ["et"],
     visibility = ["//csharp:__subpackages__"],
     deps = [
         "//csharp/extractor/Semmle.Extraction.CSharp",
         "//csharp/extractor/Semmle.Util",
+        "@paket.main//newtonsoft.json",
     ],
 )

csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/paket.references

@@ -0,0 +1 @@
+Newtonsoft.Json

csharp/extractor/Semmle.Extraction.CSharp.StubGenerator/BUILD.bazel

@@ -8,7 +8,7 @@ codeql_csharp_library(
     srcs = glob([
         "*.cs",
     ]),
-    internals_visible_to = ["Semmle.Extraction.Tests"],
+    internals_visible_to = ["et"],
     visibility = ["//csharp:__subpackages__"],
     deps = [
         "//csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching",

csharp/extractor/Semmle.Extraction.Tests/BUILD.bazel

@@ -4,7 +4,8 @@ load(
 )
 
 codeql_xunit_test(
-    name = "Semmle.Extraction.Tests",
+    # short name as we run into long path limitations on Windows
+    name = "et",
     srcs = glob([
         "*.cs",
     ]),

csharp/extractor/Semmle.Util.Tests/BUILD.bazel

@@ -4,7 +4,8 @@ load(
 )
 
 codeql_xunit_test(
-    name = "Semmle.Util.Tests",
+    # short name as we run into long path limitations on Windows
+    name = "ut",
     srcs = glob([
         "*.cs",
     ]),

csharp/ql/lib/change-notes/2024-12-05-aspnetcore-mvc-model.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added flow summaries for the `Microsoft.AspNetCore.Mvc.Controller::View` method.

csharp/ql/lib/ext/Microsoft.AspNetCore.Mvc.model.yml

@@ -0,0 +1,7 @@
+extensions:
+  - addsTo:
+      pack: codeql/csharp-all
+      extensible: summaryModel
+    data:
+      - ["Microsoft.AspNetCore.Mvc", "Controller", True, "View", "", "", "Argument[this].Property[Microsoft.AspNetCore.Mvc.Controller.ViewData].Element.Property[System.Collections.Generic.KeyValuePair`2.Value]", "ReturnValue.Property[Microsoft.AspNetCore.Mvc.Controller.ViewData].Element.Property[System.Collections.Generic.KeyValuePair`2.Value]", "value", "manual"]
+      - ["Microsoft.AspNetCore.Mvc", "Controller", True, "View", "", "", "Argument[this].Property[Microsoft.AspNetCore.Mvc.Controller.ViewBag]", "ReturnValue.Property[Microsoft.AspNetCore.Mvc.Controller.ViewData].Element.Property[System.Collections.Generic.KeyValuePair`2.Value]", "value", "manual"]

csharp/ql/test/library-tests/dataflow/library/FlowSummaries.expected

@@ -1506,6 +1506,14 @@ summary
 | Microsoft.AspNetCore.Mvc;ApiBehaviorOptions;GetEnumerator;();Argument[this].Element;ReturnValue.Property[System.Collections.IEnumerator.Current];value;manual |
 | Microsoft.AspNetCore.Mvc;ApiBehaviorOptions;set_InvalidModelStateResponseFactory;(System.Func<Microsoft.AspNetCore.Mvc.ActionContext,Microsoft.AspNetCore.Mvc.IActionResult>);Argument[0];Argument[0].Parameter[delegate-self];value;hq-generated |
 | Microsoft.AspNetCore.Mvc;Controller;OnActionExecutionAsync;(Microsoft.AspNetCore.Mvc.Filters.ActionExecutingContext,Microsoft.AspNetCore.Mvc.Filters.ActionExecutionDelegate);Argument[1];Argument[1].Parameter[delegate-self];value;hq-generated |
+| Microsoft.AspNetCore.Mvc;Controller;View;();Argument[this].Property[Microsoft.AspNetCore.Mvc.Controller.ViewBag];ReturnValue.Property[Microsoft.AspNetCore.Mvc.Controller.ViewData].Element.Property[System.Collections.Generic.KeyValuePair`2.Value];value;manual |
+| Microsoft.AspNetCore.Mvc;Controller;View;();Argument[this].Property[Microsoft.AspNetCore.Mvc.Controller.ViewData].Element.Property[System.Collections.Generic.KeyValuePair`2.Value];ReturnValue.Property[Microsoft.AspNetCore.Mvc.Controller.ViewData].Element.Property[System.Collections.Generic.KeyValuePair`2.Value];value;manual |
+| Microsoft.AspNetCore.Mvc;Controller;View;(System.Object);Argument[this].Property[Microsoft.AspNetCore.Mvc.Controller.ViewBag];ReturnValue.Property[Microsoft.AspNetCore.Mvc.Controller.ViewData].Element.Property[System.Collections.Generic.KeyValuePair`2.Value];value;manual |
+| Microsoft.AspNetCore.Mvc;Controller;View;(System.Object);Argument[this].Property[Microsoft.AspNetCore.Mvc.Controller.ViewData].Element.Property[System.Collections.Generic.KeyValuePair`2.Value];ReturnValue.Property[Microsoft.AspNetCore.Mvc.Controller.ViewData].Element.Property[System.Collections.Generic.KeyValuePair`2.Value];value;manual |
+| Microsoft.AspNetCore.Mvc;Controller;View;(System.String);Argument[this].Property[Microsoft.AspNetCore.Mvc.Controller.ViewBag];ReturnValue.Property[Microsoft.AspNetCore.Mvc.Controller.ViewData].Element.Property[System.Collections.Generic.KeyValuePair`2.Value];value;manual |
+| Microsoft.AspNetCore.Mvc;Controller;View;(System.String);Argument[this].Property[Microsoft.AspNetCore.Mvc.Controller.ViewData].Element.Property[System.Collections.Generic.KeyValuePair`2.Value];ReturnValue.Property[Microsoft.AspNetCore.Mvc.Controller.ViewData].Element.Property[System.Collections.Generic.KeyValuePair`2.Value];value;manual |
+| Microsoft.AspNetCore.Mvc;Controller;View;(System.String,System.Object);Argument[this].Property[Microsoft.AspNetCore.Mvc.Controller.ViewBag];ReturnValue.Property[Microsoft.AspNetCore.Mvc.Controller.ViewData].Element.Property[System.Collections.Generic.KeyValuePair`2.Value];value;manual |
+| Microsoft.AspNetCore.Mvc;Controller;View;(System.String,System.Object);Argument[this].Property[Microsoft.AspNetCore.Mvc.Controller.ViewData].Element.Property[System.Collections.Generic.KeyValuePair`2.Value];ReturnValue.Property[Microsoft.AspNetCore.Mvc.Controller.ViewData].Element.Property[System.Collections.Generic.KeyValuePair`2.Value];value;manual |
 | Microsoft.AspNetCore.Mvc;ControllerBase;TryUpdateModelAsync;(System.Object,System.Type,System.String,Microsoft.AspNetCore.Mvc.ModelBinding.IValueProvider,System.Func<Microsoft.AspNetCore.Mvc.ModelBinding.ModelMetadata,System.Boolean>);Argument[4];Argument[4].Parameter[delegate-self];value;hq-generated |
 | Microsoft.AspNetCore.Mvc;ControllerBase;TryUpdateModelAsync<TModel>;(TModel,System.String,Microsoft.AspNetCore.Mvc.ModelBinding.IValueProvider,System.Func<Microsoft.AspNetCore.Mvc.ModelBinding.ModelMetadata,System.Boolean>);Argument[3];Argument[3].Parameter[delegate-self];value;hq-generated |
 | Microsoft.AspNetCore.Mvc;ControllerBase;TryUpdateModelAsync<TModel>;(TModel,System.String,System.Func<Microsoft.AspNetCore.Mvc.ModelBinding.ModelMetadata,System.Boolean>);Argument[2];Argument[2].Parameter[delegate-self];value;hq-generated |

csharp/ql/test/library-tests/dataflow/library/FlowSummariesFiltered.expected

@@ -555,6 +555,14 @@
 | Microsoft.AspNetCore.Mvc.ViewFeatures;TryGetValueDelegate;BeginInvoke;(System.Object,System.String,System.Object,System.AsyncCallback,System.Object);Argument[3];Argument[3].Parameter[delegate-self];value;hq-generated |
 | Microsoft.AspNetCore.Mvc.ViewFeatures;ViewDataInfo;ViewDataInfo;(System.Object,System.Reflection.PropertyInfo,System.Func<System.Object>);Argument[2];Argument[2].Parameter[delegate-self];value;hq-generated |
 | Microsoft.AspNetCore.Mvc;ApiBehaviorOptions;set_InvalidModelStateResponseFactory;(System.Func<Microsoft.AspNetCore.Mvc.ActionContext,Microsoft.AspNetCore.Mvc.IActionResult>);Argument[0];Argument[0].Parameter[delegate-self];value;hq-generated |
+| Microsoft.AspNetCore.Mvc;Controller;View;();Argument[this].Property[Microsoft.AspNetCore.Mvc.Controller.ViewBag];ReturnValue.Property[Microsoft.AspNetCore.Mvc.Controller.ViewData].Element.Property[System.Collections.Generic.KeyValuePair`2.Value];value;manual |
+| Microsoft.AspNetCore.Mvc;Controller;View;();Argument[this].Property[Microsoft.AspNetCore.Mvc.Controller.ViewData].Element.Property[System.Collections.Generic.KeyValuePair`2.Value];ReturnValue.Property[Microsoft.AspNetCore.Mvc.Controller.ViewData].Element.Property[System.Collections.Generic.KeyValuePair`2.Value];value;manual |
+| Microsoft.AspNetCore.Mvc;Controller;View;(System.Object);Argument[this].Property[Microsoft.AspNetCore.Mvc.Controller.ViewBag];ReturnValue.Property[Microsoft.AspNetCore.Mvc.Controller.ViewData].Element.Property[System.Collections.Generic.KeyValuePair`2.Value];value;manual |
+| Microsoft.AspNetCore.Mvc;Controller;View;(System.Object);Argument[this].Property[Microsoft.AspNetCore.Mvc.Controller.ViewData].Element.Property[System.Collections.Generic.KeyValuePair`2.Value];ReturnValue.Property[Microsoft.AspNetCore.Mvc.Controller.ViewData].Element.Property[System.Collections.Generic.KeyValuePair`2.Value];value;manual |
+| Microsoft.AspNetCore.Mvc;Controller;View;(System.String);Argument[this].Property[Microsoft.AspNetCore.Mvc.Controller.ViewBag];ReturnValue.Property[Microsoft.AspNetCore.Mvc.Controller.ViewData].Element.Property[System.Collections.Generic.KeyValuePair`2.Value];value;manual |
+| Microsoft.AspNetCore.Mvc;Controller;View;(System.String);Argument[this].Property[Microsoft.AspNetCore.Mvc.Controller.ViewData].Element.Property[System.Collections.Generic.KeyValuePair`2.Value];ReturnValue.Property[Microsoft.AspNetCore.Mvc.Controller.ViewData].Element.Property[System.Collections.Generic.KeyValuePair`2.Value];value;manual |
+| Microsoft.AspNetCore.Mvc;Controller;View;(System.String,System.Object);Argument[this].Property[Microsoft.AspNetCore.Mvc.Controller.ViewBag];ReturnValue.Property[Microsoft.AspNetCore.Mvc.Controller.ViewData].Element.Property[System.Collections.Generic.KeyValuePair`2.Value];value;manual |
+| Microsoft.AspNetCore.Mvc;Controller;View;(System.String,System.Object);Argument[this].Property[Microsoft.AspNetCore.Mvc.Controller.ViewData].Element.Property[System.Collections.Generic.KeyValuePair`2.Value];ReturnValue.Property[Microsoft.AspNetCore.Mvc.Controller.ViewData].Element.Property[System.Collections.Generic.KeyValuePair`2.Value];value;manual |
 | Microsoft.AspNetCore.Mvc;ControllerBase;TryUpdateModelAsync;(System.Object,System.Type,System.String,Microsoft.AspNetCore.Mvc.ModelBinding.IValueProvider,System.Func<Microsoft.AspNetCore.Mvc.ModelBinding.ModelMetadata,System.Boolean>);Argument[4];Argument[4].Parameter[delegate-self];value;hq-generated |
 | Microsoft.AspNetCore.Mvc;ControllerBase;TryUpdateModelAsync<TModel>;(TModel,System.String,Microsoft.AspNetCore.Mvc.ModelBinding.IValueProvider,System.Func<Microsoft.AspNetCore.Mvc.ModelBinding.ModelMetadata,System.Boolean>);Argument[3];Argument[3].Parameter[delegate-self];value;hq-generated |
 | Microsoft.AspNetCore.Mvc;ControllerBase;TryUpdateModelAsync<TModel>;(TModel,System.String,System.Func<Microsoft.AspNetCore.Mvc.ModelBinding.ModelMetadata,System.Boolean>);Argument[2];Argument[2].Parameter[delegate-self];value;hq-generated |

rust/ql/src/queries/unusedentities/UnusedVariable.qll

@@ -23,4 +23,7 @@ predicate isUnused(Variable v) {
 predicate isAllowableUnused(Variable v) {
   // in a macro expansion
   v.getPat().isInMacroExpansion()
+  or
+  // a 'self' variable
+  v.getName() = "self"
 }

rust/ql/test/query-tests/unusedentities/UnusedValue.expected

@@ -8,13 +8,13 @@
 | main.rs:65:5:65:5 | f | Variable $@ is assigned a value that is never used. | main.rs:34:13:34:13 | f | f |
 | main.rs:67:5:67:5 | f | Variable $@ is assigned a value that is never used. | main.rs:34:13:34:13 | f | f |
 | main.rs:69:5:69:5 | g | Variable $@ is assigned a value that is never used. | main.rs:35:9:35:9 | g | g |
-| main.rs:91:9:91:9 | a | Variable $@ is assigned a value that is never used. | main.rs:91:9:91:9 | a | a |
-| main.rs:112:9:112:10 | is | Variable $@ is assigned a value that is never used. | main.rs:112:9:112:10 | is | is |
-| main.rs:135:13:135:17 | total | Variable $@ is assigned a value that is never used. | main.rs:135:13:135:17 | total | total |
-| main.rs:280:13:280:17 | total | Variable $@ is assigned a value that is never used. | main.rs:248:13:248:17 | total | total |
-| main.rs:373:9:373:9 | x | Variable $@ is assigned a value that is never used. | main.rs:373:9:373:9 | x | x |
-| main.rs:381:17:381:17 | x | Variable $@ is assigned a value that is never used. | main.rs:381:17:381:17 | x | x |
-| main.rs:482:9:482:9 | c | Variable $@ is assigned a value that is never used. | main.rs:482:9:482:9 | c | c |
+| main.rs:95:9:95:9 | a | Variable $@ is assigned a value that is never used. | main.rs:95:9:95:9 | a | a |
+| main.rs:116:9:116:10 | is | Variable $@ is assigned a value that is never used. | main.rs:116:9:116:10 | is | is |
+| main.rs:139:13:139:17 | total | Variable $@ is assigned a value that is never used. | main.rs:139:13:139:17 | total | total |
+| main.rs:284:13:284:17 | total | Variable $@ is assigned a value that is never used. | main.rs:252:13:252:17 | total | total |
+| main.rs:377:9:377:9 | x | Variable $@ is assigned a value that is never used. | main.rs:377:9:377:9 | x | x |
+| main.rs:385:17:385:17 | x | Variable $@ is assigned a value that is never used. | main.rs:385:17:385:17 | x | x |
+| main.rs:486:9:486:9 | c | Variable $@ is assigned a value that is never used. | main.rs:486:9:486:9 | c | c |
 | more.rs:44:9:44:14 | a_ptr4 | Variable $@ is assigned a value that is never used. | more.rs:44:9:44:14 | a_ptr4 | a_ptr4 |
 | more.rs:59:9:59:13 | d_ptr | Variable $@ is assigned a value that is never used. | more.rs:59:9:59:13 | d_ptr | d_ptr |
 | more.rs:65:9:65:17 | f_ptr | Variable $@ is assigned a value that is never used. | more.rs:65:13:65:17 | f_ptr | f_ptr |

rust/ql/test/query-tests/unusedentities/UnusedVariable.expected

@@ -1,22 +1,22 @@
 | main.rs:29:9:29:9 | a | Variable 'a' is not used. |
-| main.rs:94:13:94:13 | d | Variable 'd' is not used. |
-| main.rs:143:5:143:5 | y | Variable 'y' is not used. |
-| main.rs:170:9:170:9 | x | Variable 'x' is not used. |
-| main.rs:250:17:250:17 | a | Variable 'a' is not used. |
-| main.rs:258:20:258:22 | val | Variable 'val' is not used. |
-| main.rs:272:14:272:16 | val | Variable 'val' is not used. |
-| main.rs:287:22:287:24 | val | Variable 'val' is not used. |
-| main.rs:294:24:294:26 | val | Variable 'val' is not used. |
-| main.rs:302:13:302:15 | num | Variable 'num' is not used. |
-| main.rs:317:12:317:12 | j | Variable 'j' is not used. |
-| main.rs:337:25:337:25 | y | Variable 'y' is not used. |
-| main.rs:340:28:340:28 | a | Variable 'a' is not used. |
-| main.rs:343:9:343:9 | p | Variable 'p' is not used. |
-| main.rs:361:9:361:13 | right | Variable 'right' is not used. |
-| main.rs:367:9:367:14 | right2 | Variable 'right2' is not used. |
-| main.rs:374:13:374:13 | y | Variable 'y' is not used. |
-| main.rs:382:21:382:21 | y | Variable 'y' is not used. |
-| main.rs:427:26:427:28 | val | Variable 'val' is not used. |
-| main.rs:430:21:430:23 | acc | Variable 'acc' is not used. |
-| main.rs:451:9:451:14 | unused | Variable 'unused' is not used. |
+| main.rs:98:13:98:13 | d | Variable 'd' is not used. |
+| main.rs:147:5:147:5 | y | Variable 'y' is not used. |
+| main.rs:174:9:174:9 | x | Variable 'x' is not used. |
+| main.rs:254:17:254:17 | a | Variable 'a' is not used. |
+| main.rs:262:20:262:22 | val | Variable 'val' is not used. |
+| main.rs:276:14:276:16 | val | Variable 'val' is not used. |
+| main.rs:291:22:291:24 | val | Variable 'val' is not used. |
+| main.rs:298:24:298:26 | val | Variable 'val' is not used. |
+| main.rs:306:13:306:15 | num | Variable 'num' is not used. |
+| main.rs:321:12:321:12 | j | Variable 'j' is not used. |
+| main.rs:341:25:341:25 | y | Variable 'y' is not used. |
+| main.rs:344:28:344:28 | a | Variable 'a' is not used. |
+| main.rs:347:9:347:9 | p | Variable 'p' is not used. |
+| main.rs:365:9:365:13 | right | Variable 'right' is not used. |
+| main.rs:371:9:371:14 | right2 | Variable 'right2' is not used. |
+| main.rs:378:13:378:13 | y | Variable 'y' is not used. |
+| main.rs:386:21:386:21 | y | Variable 'y' is not used. |
+| main.rs:431:26:431:28 | val | Variable 'val' is not used. |
+| main.rs:434:21:434:23 | acc | Variable 'acc' is not used. |
+| main.rs:455:9:455:14 | unused | Variable 'unused' is not used. |
 | more.rs:24:9:24:11 | val | Variable 'val' is not used. |

rust/ql/test/query-tests/unusedentities/main.rs

@@ -85,6 +85,10 @@ impl MyStruct {
     fn my_get(&mut self) -> i64 {
         return self.val;
     }
+
+    fn get_flags(&self) -> i64 {
+        return 0;
+    }
 }
 
 fn structs() {