Skip to content
Closed
Show file tree
Hide file tree
Changes from 7 commits
Commits
Show all changes
85 commits
Select commit Hold shift + click to select a range
9a048c9
Prepare to share PrintGraph.qll with DFG viewer
asgerf Feb 23, 2026
dc2c8f3
Update PrintCfg queries to use new interface
asgerf Feb 23, 2026
2017f84
Add getOrderDisambiguation to signature and use it
asgerf Feb 23, 2026
71f4436
Move PrintGraph to codeql.util
asgerf Feb 23, 2026
aa587c0
Refactor 'getASuccessor' to edges/3
asgerf Feb 23, 2026
61ae276
Add PrintDfg.qll
asgerf Feb 23, 2026
c236ace
Add 'View DFG' queries for JS, Java, Ruby, C#, Rust
asgerf Feb 23, 2026
2698b44
C++: Add simple range analysis test with repeated if-else statements
paldepind Feb 16, 2026
09fb85d
C++: Include the actual number of lower/upper bounds for added contex…
paldepind Feb 16, 2026
0521eb4
C++: Divide nr of bounds between branches for phi nodes
paldepind Feb 16, 2026
0050ed6
C++: Improve clarity in comment
paldepind Feb 20, 2026
dfe4486
C++: Fix typo
paldepind Feb 20, 2026
d2ffb00
C++: Add more tests for modified years with and without leap year che…
bdrodes Feb 6, 2026
e6c5266
C++: Refactor leap year logic for UncheckedLeapYearAfterYearModificat…
bdrodes Feb 6, 2026
9b2161b
C++. Accept test changes. One false positive introduced, and one fals…
bdrodes Feb 6, 2026
84aaafd
C++: Correct false positive. Only TimeConversionFunction that do not …
bdrodes Feb 6, 2026
24c1a61
C++: Accept test changes.
bdrodes Feb 6, 2026
cfd00a6
C++: Add missing DateTime models for PTIME_FIELDS and TIME_FIELDS
bdrodes Feb 6, 2026
59e8c3b
C++: Accept test changes (removing false negative)
bdrodes Feb 6, 2026
04426ae
C++: Add change note.
bdrodes Feb 6, 2026
6d1f5c8
C++: Addressing Copilot PR suggestions.
bdrodes Feb 9, 2026
b6a4b1b
C++: Change log missing .md extension.
bdrodes Feb 9, 2026
2311d2a
C++: Updating comment per PR reveiw suggestions.
bdrodes Feb 12, 2026
7dcd0a4
C++: misc comment clean up per PR suggestions. Unified additional flo…
bdrodes Feb 12, 2026
38d67c6
Update cpp/ql/src/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearMod…
bdrodes Feb 12, 2026
2fce632
Update cpp/ql/lib/change-notes/2026-02-06-UncheckedLeapYearAfterModif…
bdrodes Feb 12, 2026
9efa4d9
C++ Suggested code clean up.
bdrodes Feb 12, 2026
9c9c157
Update cpp/ql/src/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearMod…
bdrodes Feb 12, 2026
b8d8611
Update cpp/ql/src/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearMod…
bdrodes Feb 12, 2026
35b4b75
Apply suggestion from @geoffw0
bdrodes Feb 12, 2026
3b17084
Apply suggestion from @geoffw0
bdrodes Feb 12, 2026
0839f43
Apply suggestion from @geoffw0
bdrodes Feb 12, 2026
f846daf
C++: Removing unnecessary post update node.
bdrodes Feb 12, 2026
ddb116e
Update cpp/ql/src/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearMod…
bdrodes Feb 17, 2026
ca433e0
Update cpp/ql/src/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearMod…
bdrodes Feb 17, 2026
cb16d0b
Apply suggestion from @geoffw0
bdrodes Feb 17, 2026
6748a1f
Update cpp/ql/src/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearMod…
bdrodes Feb 17, 2026
7f1d04b
Update cpp/ql/src/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearMod…
bdrodes Feb 17, 2026
49c2e09
Apply suggestion from @bdrodes
bdrodes Feb 17, 2026
cab1081
Address more non-ascii characters.
geoffw0 Feb 18, 2026
1cb3b62
C++: Fixing FP in unit tests.
bdrodes Feb 19, 2026
0f3bd28
chore: upgrade Bazel to 9.0.0
redsun82 Feb 5, 2026
2b4afa3
feat: add rules_cc and rules_java module dependencies
redsun82 Feb 5, 2026
46d76f4
feat: add Python 3.12 toolchain registration
redsun82 Feb 5, 2026
f4b9021
feat: add rules_cc to autoload configuration
redsun82 Feb 5, 2026
dd6da08
refactor: migrate Starlark files to explicit rules_cc imports
redsun82 Feb 5, 2026
8bf9f23
refactor: migrate BUILD files to explicit rules_cc imports
redsun82 Feb 5, 2026
05490b9
refactor: migrate BUILD files to explicit rules_java imports
redsun82 Feb 5, 2026
29b0616
refactor: migrate C++ runfiles API from bazel_tools to rules_cc
redsun82 Feb 5, 2026
06a077b
fix: disable Android SDK auto-detection for Bazel 9 compatibility
redsun82 Feb 5, 2026
d4ed4f5
fix: upgrade rules_kotlin to 2.2.2 for Windows compatibility
redsun82 Feb 6, 2026
c584895
fix: sort use_repo alphabetically in rules_kotlin MODULE.bazel
redsun82 Feb 6, 2026
782c05f
address review
redsun82 Feb 11, 2026
5bd670c
Python: Add overlay annotations to AST classes
tausbn Dec 5, 2025
7aea5b6
Python: Fix broken queries
tausbn Dec 5, 2025
d108ce8
Python: Simple dataflow annotations
tausbn Jan 30, 2026
474535b
Python: `LocalSources.qll` annotations
tausbn Jan 30, 2026
c7f4787
Python: `DataFlowPublic.qll` annotations
tausbn Jan 30, 2026
d76b786
Python: `DataFlowPrivate.qll` annotations
tausbn Jan 30, 2026
972b637
Python: `DataFlowDispatch.qll` annotations
tausbn Jan 30, 2026
24e134a
Python: Fix `frameworks/data/warnings.ql`
tausbn Jan 30, 2026
876fe05
Python: Add more `overlay[caller]` to `Flow.qll`
tausbn Feb 2, 2026
b9e8e5a
Python: Fix bad join in `OutgoingRequestCall`
tausbn Feb 3, 2026
2d6dec9
Python: Fix bad join in `missing_imported_module`
tausbn Feb 3, 2026
47c77ef
Python: Fix bad join in `returnStep`
tausbn Feb 16, 2026
16de6a7
Python: Add change note
tausbn Feb 18, 2026
d43969a
Accept MaD sanitizers for queries with MaD sinks
owen-mc Feb 17, 2026
e6fe4bf
Change how sql-injection barriers are accepted
owen-mc Feb 17, 2026
6341535
Improve Mysql2 test
owen-mc Feb 17, 2026
3e83a53
Move Mysql2 flow model to MaD and remove ql sanitizer
owen-mc Feb 17, 2026
0200e12
Reinstate Mysql2 sanitizer in MaD
owen-mc Feb 17, 2026
01a9b61
Improve Sqlite3 test
owen-mc Feb 17, 2026
d7c8b9a
Move SQLite3 flow model to MaD and remove ql sanitizer
owen-mc Feb 17, 2026
b4ec560
Reinstate SQLite3 sanitizer in MaD
owen-mc Feb 17, 2026
fb21533
Remove Shellwords sanitizer in ql
owen-mc Feb 17, 2026
5b3737e
Model flow through Shellwords escape and shellescape
owen-mc Feb 17, 2026
23ac9fc
Add MaD barriers for Shellwords.escape and shellescape
owen-mc Feb 17, 2026
f4cacc3
Reinstate ql model for `String#shellescape`
owen-mc Feb 17, 2026
36848cf
Add change note
owen-mc Feb 17, 2026
1ee2534
Update other test in same folder
owen-mc Feb 18, 2026
8925535
Update taintstep test for models becoming MaD
owen-mc Feb 18, 2026
03e4dfd
Use postprocessing queries for unrelated test
owen-mc Feb 18, 2026
b01efe1
C++: Update expected test results after extractor changes
jketema Jan 8, 2026
b6614c0
fixup JS
asgerf Feb 23, 2026
7b83da4
Update some tests
asgerf Feb 24, 2026
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
53 changes: 53 additions & 0 deletions csharp/ql/lib/printDfg.ql
Original file line number Diff line number Diff line change
@@ -0,0 +1,53 @@
/**
* @name Print DFG
* @description Produces a representation of a file's Data Flow Graph.
* This query is used by the VS Code extension.
* @id cs/print-dfg
* @kind graph
* @tags ide-contextual-queries/print-dfg
*/

import csharp
private import semmle.code.csharp.dataflow.internal.DataFlowImplSpecific as DF
private import semmle.code.csharp.dataflow.internal.TaintTrackingImplSpecific as TT
private import codeql.dataflow.PrintDfg
private import MakePrintDfg<Location, DF::CsharpDataFlow, TT::CsharpTaintTracking>

external string selectedSourceFile();

private predicate selectedSourceFileAlias = selectedSourceFile/0;

external int selectedSourceLine();

private predicate selectedSourceLineAlias = selectedSourceLine/0;

external int selectedSourceColumn();

private predicate selectedSourceColumnAlias = selectedSourceColumn/0;

module ViewDfgQueryInput implements ViewGraphQueryInputSig<File> {
predicate selectedSourceFile = selectedSourceFileAlias/0;

predicate selectedSourceLine = selectedSourceLineAlias/0;

predicate selectedSourceColumn = selectedSourceColumnAlias/0;

predicate callableSpan(
DF::CsharpDataFlow::DataFlowCallable callable, File file, int startLine, int startColumn,
int endLine, int endColumn
) {
exists(Callable c |
c = callable.asCallable(_) and
file = c.getFile() and
callable.getLocation().getStartLine() = startLine and
callable.getLocation().getStartColumn() = startColumn and
exists(Location loc |
loc.getEndLine() = endLine and
loc.getEndColumn() = endColumn and
loc = c.getBody().getLocation()
)
)
}
}

import ViewGraphQuery<File, ViewDfgQueryInput>
7 changes: 4 additions & 3 deletions java/ql/lib/printCfg.ql
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
*/

import java
import PrintCfg

external string selectedSourceFile();

Expand All @@ -21,14 +22,14 @@ external int selectedSourceColumn();

private predicate selectedSourceColumnAlias = selectedSourceColumn/0;

module ViewCfgQueryInput implements ViewCfgQueryInputSig<File> {
module ViewCfgQueryInput implements ViewGraphQueryInputSig<File> {
predicate selectedSourceFile = selectedSourceFileAlias/0;

predicate selectedSourceLine = selectedSourceLineAlias/0;

predicate selectedSourceColumn = selectedSourceColumnAlias/0;

predicate cfgScopeSpan(
predicate callableSpan(
Callable callable, File file, int startLine, int startColumn, int endLine, int endColumn
) {
file = callable.getFile() and
Expand All @@ -42,4 +43,4 @@ module ViewCfgQueryInput implements ViewCfgQueryInputSig<File> {
}
}

import ViewCfgQuery<File, ViewCfgQueryInput>
import ViewGraphQuery<File, ViewCfgQueryInput>
50 changes: 50 additions & 0 deletions java/ql/lib/printDfg.ql
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
/**
* @name Print DFG
* @description Produces a representation of a file's Data Flow Graph.
* This query is used by the VS Code extension.
* @id java/print-cfg
* @kind graph
* @tags ide-contextual-queries/print-dfg
*/

import java
private import semmle.code.java.dataflow.internal.DataFlowImplSpecific as DF
private import semmle.code.java.dataflow.internal.TaintTrackingImplSpecific as TT
private import codeql.dataflow.PrintDfg
private import MakePrintDfg<Location, DF::JavaDataFlow, TT::JavaTaintTracking>

external string selectedSourceFile();

private predicate selectedSourceFileAlias = selectedSourceFile/0;

external int selectedSourceLine();

private predicate selectedSourceLineAlias = selectedSourceLine/0;

external int selectedSourceColumn();

private predicate selectedSourceColumnAlias = selectedSourceColumn/0;

module ViewDfgQueryInput implements ViewGraphQueryInputSig<File> {
predicate selectedSourceFile = selectedSourceFileAlias/0;

predicate selectedSourceLine = selectedSourceLineAlias/0;

predicate selectedSourceColumn = selectedSourceColumnAlias/0;

predicate callableSpan(
DF::JavaDataFlow::DataFlowCallable callable, File file, int startLine, int startColumn,
int endLine, int endColumn
) {
file = callable.asCallable().getFile() and
callable.getLocation().getStartLine() = startLine and
callable.getLocation().getStartColumn() = startColumn and
exists(Location loc |
loc.getEndLine() = endLine and
loc.getEndColumn() = endColumn and
loc = callable.asCallable().getBody().getLocation()
)
}
}

import ViewGraphQuery<File, ViewDfgQueryInput>
20 changes: 16 additions & 4 deletions java/ql/lib/semmle/code/java/ControlFlowGraph.qll
Original file line number Diff line number Diff line change
Expand Up @@ -1776,16 +1776,28 @@ class ConditionNode extends ControlFlow::Node {
ExprParent getCondition() { result = this.asExpr() or result = this.asStmt() }
}

private import codeql.controlflow.PrintGraph as PrintGraph
private import codeql.util.PrintGraph as PrintGraph

private module PrintGraphInput implements PrintGraph::InputSig<Location> {
private import java as J

class Callable = J::Callable;

class ControlFlowNode = J::ControlFlowNode;
final private class FinalControlFlowNode = J::ControlFlowNode;

ControlFlowNode getASuccessor(ControlFlowNode n, SuccessorType t) { result = n.getASuccessor(t) }
class Node extends FinalControlFlowNode {
string getOrderDisambiguation() { result = "" }
}

predicate edge(Node node1, string s, Node node2) {
exists(SuccessorType t |
node2 = node1.getASuccessor(t) and
if t instanceof DirectSuccessor then s = "" else s = t.toString()
)
}
}

import PrintGraph::PrintGraph<Location, PrintGraphInput>
/** Provides utilities for visualising the CFG. */
module PrintCfg {
import PrintGraph::PrintGraph<Location, PrintGraphInput>
}
48 changes: 48 additions & 0 deletions javascript/ql/lib/printDfg.ql
Original file line number Diff line number Diff line change
@@ -0,0 +1,48 @@
/**
* @name Print DFG
* @description Produces a representation of a file's Data Flow Graph.
* This query is used by the VS Code extension.
* @id js/print-dfg
* @kind graph
* @tags ide-contextual-queries/print-dfg
*/

private import javascript
private import semmle.javascript.dataflow.internal.sharedlib.DataFlowArg
private import codeql.dataflow.PrintDfg
import MakePrintDfg<Location, JSDataFlow, JSTaintFlow>

external string selectedSourceFile();

Check warning

Code scanning / CodeQL

Dead code Warning

This code is never used, and it's not publicly exported.

private predicate selectedSourceFileAlias = selectedSourceFile/0;

Check warning

Code scanning / CodeQL

Dead code Warning

This code is never used, and it's not publicly exported.

external int selectedSourceLine();

Check warning

Code scanning / CodeQL

Dead code Warning

This code is never used, and it's not publicly exported.

private predicate selectedSourceLineAlias = selectedSourceLine/0;

Check warning

Code scanning / CodeQL

Dead code Warning

This code is never used, and it's not publicly exported.

external int selectedSourceColumn();

Check warning

Code scanning / CodeQL

Dead code Warning

This code is never used, and it's not publicly exported.

private predicate selectedSourceColumnAlias = selectedSourceColumn/0;

Check warning

Code scanning / CodeQL

Dead code Warning

This code is never used, and it's not publicly exported.

module ViewCfgQueryInput implements ViewGraphQueryInputSig<File> {

Check warning

Code scanning / CodeQL

Dead code Warning

This code is never used, and it's not publicly exported.
predicate selectedSourceFile = selectedSourceFileAlias/0;

predicate selectedSourceLine = selectedSourceLineAlias/0;

predicate selectedSourceColumn = selectedSourceColumnAlias/0;

/**
* Holds if `callable` spans column `startColumn` of line `startLine` to
* column `endColumn` of line `endLine` in `file`.
*/
predicate callableSpan(
JSDataFlow::DataFlowCallable callable, File file, int startLine, int startColumn, int endLine,
int endColumn
) {
callable
.getLocation()
.hasLocationInfo(file.getAbsolutePath(), startLine, startColumn, endLine, endColumn)
}
}

import ViewGraphQuery<File, ViewGraphInput>
7 changes: 4 additions & 3 deletions ruby/ql/lib/ide-contextual-queries/printCfg.ql
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@
private import codeql.Locations
private import codeql.ruby.controlflow.internal.ControlFlowGraphImpl
private import codeql.ruby.controlflow.ControlFlowGraph
private import PrintCfg

external string selectedSourceFile();

Expand All @@ -23,19 +24,19 @@

private predicate selectedSourceColumnAlias = selectedSourceColumn/0;

module ViewCfgQueryInput implements ViewCfgQueryInputSig<File> {
module ViewCfgQueryInput implements ViewGraphQueryInputSig<File> {
predicate selectedSourceFile = selectedSourceFileAlias/0;

predicate selectedSourceLine = selectedSourceLineAlias/0;

predicate selectedSourceColumn = selectedSourceColumnAlias/0;

predicate cfgScopeSpan(
predicate callableSpan(

Check warning

Code scanning / CodeQL

Dead code Warning

This code is never used, and it's not publicly exported.
CfgScope scope, File file, int startLine, int startColumn, int endLine, int endColumn
) {
file = scope.getFile() and
scope.getLocation().hasLocationInfo(_, startLine, startColumn, endLine, endColumn)
}
}

import ViewCfgQuery<File, ViewCfgQueryInput>
import ViewGraphQuery<File, ViewCfgQueryInput>
44 changes: 44 additions & 0 deletions ruby/ql/lib/ide-contextual-queries/printDfg.ql
Original file line number Diff line number Diff line change
@@ -0,0 +1,44 @@
/**
* @name Print DFG
* @description Produces a representation of a file's Data Flow Graph.
* This query is used by the VS Code extension.
* @id rb/print-dfg
* @kind graph
* @tags ide-contextual-queries/print-dfg
*/

private import codeql.Locations
private import codeql.ruby.dataflow.internal.DataFlowImplSpecific as DF
private import codeql.ruby.dataflow.internal.TaintTrackingImplSpecific as TT
private import codeql.dataflow.PrintDfg
private import MakePrintDfg<Location, DF::RubyDataFlow, TT::RubyTaintTracking>

external string selectedSourceFile();

private predicate selectedSourceFileAlias = selectedSourceFile/0;

external int selectedSourceLine();

private predicate selectedSourceLineAlias = selectedSourceLine/0;

external int selectedSourceColumn();

private predicate selectedSourceColumnAlias = selectedSourceColumn/0;

module ViewDfgQueryInput implements ViewGraphQueryInputSig<File> {
predicate selectedSourceFile = selectedSourceFileAlias/0;

predicate selectedSourceLine = selectedSourceLineAlias/0;

predicate selectedSourceColumn = selectedSourceColumnAlias/0;

predicate callableSpan(
DF::RubyDataFlow::DataFlowCallable callable, File file, int startLine, int startColumn,
int endLine, int endColumn
) {
file = callable.asCfgScope().getFile() and
callable.getLocation().hasLocationInfo(_, startLine, startColumn, endLine, endColumn)
}
}

import ViewGraphQuery<File, ViewDfgQueryInput>
7 changes: 4 additions & 3 deletions rust/ql/lib/ide-contextual-queries/PrintCfg.ql
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@
private import codeql.files.FileSystem
private import codeql.rust.controlflow.internal.ControlFlowGraphImpl
private import codeql.rust.controlflow.ControlFlowGraph
private import PrintCfg

/**
* Gets the source file to generate a CFG from.
Expand All @@ -32,19 +33,19 @@ external int selectedSourceColumn();

private predicate selectedSourceColumnAlias = selectedSourceColumn/0;

private module ViewCfgQueryInput implements ViewCfgQueryInputSig<File> {
private module ViewCfgQueryInput implements ViewGraphQueryInputSig<File> {
predicate selectedSourceFile = selectedSourceFileAlias/0;

predicate selectedSourceLine = selectedSourceLineAlias/0;

predicate selectedSourceColumn = selectedSourceColumnAlias/0;

predicate cfgScopeSpan(
predicate callableSpan(
CfgScope scope, File file, int startLine, int startColumn, int endLine, int endColumn
) {
file = scope.getFile() and
scope.getLocation().hasLocationInfo(_, startLine, startColumn, endLine, endColumn)
}
}

import ViewCfgQuery<File, ViewCfgQueryInput>
import ViewGraphQuery<File, ViewCfgQueryInput>
44 changes: 44 additions & 0 deletions rust/ql/lib/ide-contextual-queries/PrintDfg.ql
Original file line number Diff line number Diff line change
@@ -0,0 +1,44 @@
/**
* @name Print DFG
* @description Produces a representation of a file's Data Flow Graph.
* This query is used by the VS Code extension.
* @id rust/print-dfg
* @kind graph
* @tags ide-contextual-queries/print-dfg
*/

private import rust
private import codeql.rust.dataflow.internal.DataFlowImpl as DF
private import codeql.rust.dataflow.internal.TaintTrackingImpl as TT
private import codeql.dataflow.PrintDfg
private import MakePrintDfg<Location, DF::RustDataFlow, TT::RustTaintTracking>

external string selectedSourceFile();

private predicate selectedSourceFileAlias = selectedSourceFile/0;

external int selectedSourceLine();

private predicate selectedSourceLineAlias = selectedSourceLine/0;

external int selectedSourceColumn();

private predicate selectedSourceColumnAlias = selectedSourceColumn/0;

private module ViewDfgQueryInput implements ViewGraphQueryInputSig<File> {
predicate selectedSourceFile = selectedSourceFileAlias/0;

predicate selectedSourceLine = selectedSourceLineAlias/0;

predicate selectedSourceColumn = selectedSourceColumnAlias/0;

predicate callableSpan(
DF::RustDataFlow::DataFlowCallable callable, File file, int startLine, int startColumn,
int endLine, int endColumn
) {
file = callable.asCfgScope().getFile() and
callable.getLocation().hasLocationInfo(_, startLine, startColumn, endLine, endColumn)
}
}

import ViewGraphQuery<File, ViewDfgQueryInput>
Loading
Loading