Skip to content

Commit a007230

Browse files
redsun82redsun82
committed
Merge branch 'main' into redsun82/cargo-upgrade-2
2 parents 2765026 + 0a67902 commit a007230

File tree

135 files changed

+8946
-4645
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

135 files changed

+8946
-4645
lines changed

‎.bazelrc‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,13 @@ common --registry=https://bcr.bazel.build
3030

3131
common --@rules_dotnet//dotnet/settings:strict_deps=false
3232

33+
# we only configure a nightly toolchain
34+
common --@rules_rust//rust/toolchain/channel=nightly
35+
36+
# rust does not like the gold linker, while bazel does by default, so let's avoid using it
37+
common:linux --linkopt=-fuse-ld=lld
38+
common:macos --linkopt=-fuse-ld=lld
39+
3340
# Reduce this eventually to empty, once we've fixed all our usages of java, and https://github.com/bazel-contrib/rules_go/issues/4193 is fixed
3441
common --incompatible_autoload_externally="+@rules_java,+@rules_shell"
3542

‎MODULE.bazel‎

Lines changed: 25 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ bazel_dep(name = "rules_kotlin", version = "2.1.3-codeql.1")
2828
bazel_dep(name = "gazelle", version = "0.40.0")
2929
bazel_dep(name = "rules_dotnet", version = "0.17.4")
3030
bazel_dep(name = "googletest", version = "1.14.0.bcr.1")
31-
bazel_dep(name = "rules_rust", version = "0.58.0")
31+
bazel_dep(name = "rules_rust", version = "0.63.0")
3232
bazel_dep(name = "zstd", version = "1.5.5.bcr.1")
3333

3434
bazel_dep(name = "buildifier_prebuilt", version = "6.4.0", dev_dependency = True)
@@ -38,7 +38,10 @@ bazel_dep(name = "buildifier_prebuilt", version = "6.4.0", dev_dependency = True
3838
RUST_EDITION = "2024"
3939

4040
# run buildutils-internal/scripts/fill-rust-sha256s.py when updating (internal repo)
41-
RUST_VERSION = "1.88.0"
41+
# a nightly toolchain is required to enable experimental_use_cc_common_link, which we require internally
42+
# we prefer to run the same version as internally, even if experimental_use_cc_common_link is not really
43+
# required in this repo
44+
RUST_VERSION = "nightly/2025-08-01"
4245

4346
rust = use_extension("@rules_rust//rust:extensions.bzl", "rust")
4447
rust.toolchain(
@@ -50,26 +53,26 @@ rust.toolchain(
5053
],
5154
# generated by buildutils-internal/scripts/fill-rust-sha256s.py (internal repo)
5255
sha256s = {
53-
"rustc-1.88.0-x86_64-unknown-linux-gnu.tar.xz": "b049fd57fce274d10013e2cf0e05f215f68f6580865abc52178f66ae9bf43fd8",
54-
"rustc-1.88.0-x86_64-apple-darwin.tar.xz": "c8f1ea4fc3e507c8e733809bd3ad91a00f5b209d85620be9013bea5f97f31f24",
55-
"rustc-1.88.0-aarch64-apple-darwin.tar.xz": "249f4cacd3fac1f718af19373c73e9d3b9a595965972d8b1f3947c578110f520",
56-
"rustc-1.88.0-x86_64-pc-windows-msvc.tar.xz": "238616f0a578d6d4c034ffb8897064fa8df68a3823df201df48ab2baf68a639f",
57-
"clippy-1.88.0-x86_64-unknown-linux-gnu.tar.xz": "db09c9e4a8a0b486781d87403f74a203a58d9ef0a58ba10c39264916d93ac603",
58-
"clippy-1.88.0-x86_64-apple-darwin.tar.xz": "d25711565eccaf1ead038a626f14eddb8e7db114fb73c24e93264dae4d4298d3",
59-
"clippy-1.88.0-aarch64-apple-darwin.tar.xz": "9ad90cddc3ebd892c9d69c9ecd45c30d236e1e4af5993312c6f4538af9dcf3e7",
60-
"clippy-1.88.0-x86_64-pc-windows-msvc.tar.xz": "0d02a7b3a8eb407c6a62c75a56f365b312f8ec2732cac5ecfc7a062526fddbe3",
61-
"cargo-1.88.0-x86_64-unknown-linux-gnu.tar.xz": "856962610ee821648cee32e3d6abac667af7bb7ea6ec6f3d184cc31e66044f6b",
62-
"cargo-1.88.0-x86_64-apple-darwin.tar.xz": "e7f672132591df180b58f8e7af875e1971a10fe71243f7d84f9b3f6742f998bc",
63-
"cargo-1.88.0-aarch64-apple-darwin.tar.xz": "71c08c8fab9b7a9cd13b6119886d50ce48efa8261d08e1fd328ed3ee1c84e2e0",
64-
"cargo-1.88.0-x86_64-pc-windows-msvc.tar.xz": "5e3b21d77733e0dbb5542015f89b15de1844bd6e3270fdc90bb821b2a04b1cda",
65-
"llvm-tools-1.88.0-x86_64-unknown-linux-gnu.tar.xz": "16e8d9b4187cc3936feddd9ceccde0157a4a1b2be98ca9c202cda304e0e81853",
66-
"llvm-tools-1.88.0-x86_64-apple-darwin.tar.xz": "92780b5be0950c206d998a6f7094d4ee29b992d1d2f46371465e8bdaa4e619a4",
67-
"llvm-tools-1.88.0-aarch64-apple-darwin.tar.xz": "c9bf981651b573d2abb619a5b3ae038686772e51e7ec53a8b5e585c51c1431e5",
68-
"llvm-tools-1.88.0-x86_64-pc-windows-msvc.tar.xz": "6522371a06d183effaf080c59d2a8c0720088157ae693123386bc7070ba62a73",
69-
"rust-std-1.88.0-x86_64-unknown-linux-gnu.tar.xz": "36d7eacf46bd5199cb433e49a9ed9c9b380d82f8a0ebc05e89b43b51c070c955",
70-
"rust-std-1.88.0-x86_64-apple-darwin.tar.xz": "2570350a6651e60a2fe0aa438be5cd123ed3543b4b44c916284ff7e7e331d16a",
71-
"rust-std-1.88.0-aarch64-apple-darwin.tar.xz": "532be07511af557cb67f33bfc77044a787363ab281b963752542bc837ce90e96",
72-
"rust-std-1.88.0-x86_64-pc-windows-msvc.tar.xz": "6b65df769259ad18428271aea110ec1a5027e922f3e36d77923dc69a38ff6318",
56+
"2025-08-01/rustc-nightly-x86_64-unknown-linux-gnu.tar.xz": "9bbeaf5d3fc7247d31463a9083aa251c995cc50662c8219e7a2254d76a72a9a4",
57+
"2025-08-01/rustc-nightly-x86_64-apple-darwin.tar.xz": "c9ea539a8eff0d5d162701f99f9e1aabe14dd0dfb420d62362817a5d09219de7",
58+
"2025-08-01/rustc-nightly-aarch64-apple-darwin.tar.xz": "ae83feebbc39cfd982e4ecc8297731fe79c185173aee138467b334c5404b3773",
59+
"2025-08-01/rustc-nightly-x86_64-pc-windows-msvc.tar.xz": "9f170c30d802a349be60cf52ec46260802093cb1013ad667fc0d528b7b10152f",
60+
"2025-08-01/clippy-nightly-x86_64-unknown-linux-gnu.tar.xz": "9ae5f3cd8f557c4f6df522597c69d14398cf604cfaed2b83e767c4b77a7eaaf6",
61+
"2025-08-01/clippy-nightly-x86_64-apple-darwin.tar.xz": "983cb9ee0b6b968188e04ab2d33743d54764b2681ce565e1b3f2b9135c696a3e",
62+
"2025-08-01/clippy-nightly-aarch64-apple-darwin.tar.xz": "ed2219dbc49d088225e1b7c5c4390fa295066e071fddaa2714018f6bb39ddbf0",
63+
"2025-08-01/clippy-nightly-x86_64-pc-windows-msvc.tar.xz": "911f40ab5cbdd686f40e00965271fe47c4805513a308ed01f30eafb25b448a50",
64+
"2025-08-01/cargo-nightly-x86_64-unknown-linux-gnu.tar.xz": "106463c284e48e4904c717471eeec2be5cc83a9d2cae8d6e948b52438cad2e69",
65+
"2025-08-01/cargo-nightly-x86_64-apple-darwin.tar.xz": "6ad35c40efc41a8c531ea43235058347b6902d98a9693bf0aed7fc16d5590cef",
66+
"2025-08-01/cargo-nightly-aarch64-apple-darwin.tar.xz": "dd28c365e9d298abc3154c797720ad36a0058f131265c9978b4c8e4e37012c8a",
67+
"2025-08-01/cargo-nightly-x86_64-pc-windows-msvc.tar.xz": "7b431286e12d6b3834b038f078389a00cac73f351e8c3152b2504a3c06420b3b",
68+
"2025-08-01/llvm-tools-nightly-x86_64-unknown-linux-gnu.tar.xz": "e342e305d7927cc288d386983b2bc253cfad3776b113386e903d0b302648ef47",
69+
"2025-08-01/llvm-tools-nightly-x86_64-apple-darwin.tar.xz": "e44dd3506524d85c37b3a54bcc91d01378fd2c590b2db5c5974d12f05c1b84d1",
70+
"2025-08-01/llvm-tools-nightly-aarch64-apple-darwin.tar.xz": "0c1b5f46dd81be4a9227b10283a0fcaa39c14fea7e81aea6fd6d9887ff6cdc41",
71+
"2025-08-01/llvm-tools-nightly-x86_64-pc-windows-msvc.tar.xz": "423e5fd11406adccbc31b8456ceb7375ce055cdf45e90d2c3babeb2d7f58383f",
72+
"2025-08-01/rust-std-nightly-x86_64-unknown-linux-gnu.tar.xz": "3c0ceb46a252647a1d4c7116d9ccae684fa5e42aaf3296419febd2c962c3b41d",
73+
"2025-08-01/rust-std-nightly-x86_64-apple-darwin.tar.xz": "3be416003cab10f767390a753d1d16ae4d26c7421c03c98992cf1943e5b0efe8",
74+
"2025-08-01/rust-std-nightly-aarch64-apple-darwin.tar.xz": "4046ac0ef951cb056b5028a399124f60999fa37792eab69d008d8d7965f389b4",
75+
"2025-08-01/rust-std-nightly-x86_64-pc-windows-msvc.tar.xz": "191ed9d8603c3a4fe5a7bbbc2feb72049078dae2df3d3b7d5dedf3abbf823e6e",
7376
},
7477
versions = [RUST_VERSION],
7578
)

‎actions/ql/src/Security/CWE-829/UntrustedCheckoutCritical.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
## Overview
22

3-
GitHub workflows can be triggered through various repository events, including incoming pull requests (PRs) or comments on Issues/PRs. A potentially dangerous misuse of the triggers such as `pull_request_target` or `issue_comment` followed by an explicit checkout of untrusted code (Pull Request HEAD) may lead to repository compromise if untrusted code gets executed in a privileged job.
3+
GitHub workflows can be triggered through various repository events, including incoming pull requests (PRs) or comments on Issues/PRs. A potentially dangerous misuse of the triggers such as `pull_request_target` or `issue_comment` followed by an explicit checkout of untrusted code (Pull Request HEAD) may lead to repository compromise if untrusted code gets executed (e.g., due to a modified build script) in a privileged job.
44

55
## Recommendation
66

@@ -32,7 +32,7 @@ jobs:
3232

3333
- uses: actions/setup-node@v1
3434
- run: |
35-
npm install
35+
npm install # scripts in package.json from PR would be executed here
3636
npm build
3737
3838
- uses: completely/fakeaction@v2

‎actions/ql/src/Security/CWE-829/UntrustedCheckoutHigh.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
## Overview
22

3-
GitHub workflows can be triggered through various repository events, including incoming pull requests (PRs) or comments on Issues/PRs. A potentially dangerous misuse of the triggers such as `pull_request_target` or `issue_comment` followed by an explicit checkout of untrusted code (Pull Request HEAD) may lead to repository compromise if untrusted code gets executed in a privileged job.
3+
GitHub workflows can be triggered through various repository events, including incoming pull requests (PRs) or comments on Issues/PRs. A potentially dangerous misuse of the triggers such as `pull_request_target` or `issue_comment` followed by an explicit checkout of untrusted code (Pull Request HEAD) may lead to repository compromise if untrusted code gets executed (e.g., due to a modified build script) in a privileged job.
44

55
## Recommendation
66

@@ -32,7 +32,7 @@ jobs:
3232

3333
- uses: actions/setup-node@v1
3434
- run: |
35-
npm install
35+
npm install # scripts in package.json from PR would be executed here
3636
npm build
3737
3838
- uses: completely/fakeaction@v2

‎actions/ql/src/Security/CWE-829/UntrustedCheckoutMedium.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
## Overview
22

3-
GitHub workflows can be triggered through various repository events, including incoming pull requests (PRs) or comments on Issues/PRs. A potentially dangerous misuse of the triggers such as `pull_request_target` or `issue_comment` followed by an explicit checkout of untrusted code (Pull Request HEAD) may lead to repository compromise if untrusted code gets executed in a privileged job.
3+
GitHub workflows can be triggered through various repository events, including incoming pull requests (PRs) or comments on Issues/PRs. A potentially dangerous misuse of the triggers such as `pull_request_target` or `issue_comment` followed by an explicit checkout of untrusted code (Pull Request HEAD) may lead to repository compromise if untrusted code gets executed (e.g., due to a modified build script) in a privileged job.
44

55
## Recommendation
66

@@ -32,7 +32,7 @@ jobs:
3232

3333
- uses: actions/setup-node@v1
3434
- run: |
35-
npm install
35+
npm install # scripts in package.json from PR would be executed here
3636
npm build
3737
3838
- uses: completely/fakeaction@v2

‎cpp/ql/lib/change-notes/2025-08-02-gvn.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* The global value numbering library (`semmle.code.cpp.valuenumbering.GlobalValueNumbering` and `semmle.code.cpp.ir.ValueNumbering`) has been improved so more expressions are assigned the same value number.

‎cpp/ql/lib/change-notes/2025-08-11-global-variable-flow.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Improved dataflow through global variables in the new dataflow library (`semmle.code.cpp.dataflow.new.DataFlow` and `semmle.code.cpp.dataflow.new.TaintTracking`). Queries based on these libraries will produce more results on codebases with many global variables.

‎cpp/ql/lib/semmle/code/cpp/commons/Buffer.qll‎

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -57,19 +57,27 @@ private Class getRootType(FieldAccess fa) {
5757
)
5858
}
5959

60+
/**
61+
* Gets the size of `v`. This predicate does not have a result when the
62+
* unspecified type of `v` is a `ReferenceType`.
63+
*/
64+
private int getVariableSize(Variable v) {
65+
exists(Type t |
66+
t = v.getUnspecifiedType() and
67+
not t instanceof ReferenceType and
68+
result = t.getSize()
69+
)
70+
}
71+
6072
/**
6173
* Gets the size of the buffer access at `va`.
6274
*/
6375
private int getSize(VariableAccess va) {
6476
exists(Variable v | va.getTarget() = v |
6577
// If `v` is not a field then the size of the buffer is just
6678
// the size of the type of `v`.
67-
exists(Type t |
68-
t = v.getUnspecifiedType() and
69-
not v instanceof Field and
70-
not t instanceof ReferenceType and
71-
result = t.getSize()
72-
)
79+
not v instanceof Field and
80+
result = getVariableSize(v)
7381
or
7482
exists(Class c, int trueSize |
7583
// Otherwise, we find the "outermost" object and compute the size
@@ -92,7 +100,7 @@ private int getSize(VariableAccess va) {
92100
// buffer is `12 - 4 = 8`.
93101
c = getRootType(va) and
94102
// we calculate the size based on the last field, to avoid including any padding after it
95-
trueSize = max(Field f | | f.getOffsetInClass(c) + f.getUnspecifiedType().getSize()) and
103+
trueSize = max(Field f | | f.getOffsetInClass(c) + getVariableSize(f)) and
96104
result = trueSize - v.(Field).getOffsetInClass(c)
97105
)
98106
)

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -332,6 +332,13 @@ private module IndirectInstructions {
332332

333333
import IndirectInstructions
334334

335+
predicate isPostUpdateNodeImpl(Operand operand, int indirectionIndex) {
336+
operand = any(FieldAddress fa).getObjectAddressOperand() and
337+
indirectionIndex = [0 .. Ssa::countIndirectionsForCppType(Ssa::getLanguageType(operand))]
338+
or
339+
Ssa::isModifiableByCall(operand, indirectionIndex)
340+
}
341+
335342
/** Gets the callable in which this node occurs. */
336343
DataFlowCallable nodeGetEnclosingCallable(Node n) { result = n.getEnclosingCallable() }
337344

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -42,11 +42,7 @@ private newtype TIRDataFlowNode =
4242
[getMinIndirectionsForType(var.getUnspecifiedType()) .. SsaImpl::getMaxIndirectionsForType(var.getUnspecifiedType())]
4343
} or
4444
TPostUpdateNodeImpl(Operand operand, int indirectionIndex) {
45-
operand = any(FieldAddress fa).getObjectAddressOperand() and
46-
indirectionIndex =
47-
[0 .. SsaImpl::countIndirectionsForCppType(SsaImpl::getLanguageType(operand))]
48-
or
49-
SsaImpl::isModifiableByCall(operand, indirectionIndex)
45+
isPostUpdateNodeImpl(operand, indirectionIndex)
5046
} or
5147
TSsaSynthNode(SsaImpl::SynthNode n) or
5248
TSsaIteratorNode(IteratorFlow::IteratorFlowNode n) or

0 commit comments

Comments
 (0)