Merge branch 'main' into feat/csharp-missed-firstordefault-opprtunity

Author: baywet

cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasedSSA.qll

@@ -295,6 +295,11 @@ abstract class MemoryLocation0 extends TMemoryLocation {
  */
 abstract class VirtualVariable extends MemoryLocation0 { }
 
+pragma[nomagic]
+private VirtualVariable getAllocationMemoryLocation(Allocation alloc) {
+  result.getAnAllocation() = alloc
+}
+
 abstract class AllocationMemoryLocation extends MemoryLocation0 {
   Allocation var;
   boolean isMayAccess;
@@ -313,7 +318,7 @@ abstract class AllocationMemoryLocation extends MemoryLocation0 {
       result = getGroupedMemoryLocation(var, false, false).getVirtualVariable()
       or
       not exists(getGroupedMemoryLocation(var, false, false)) and
-      result.(AllocationMemoryLocation).getAnAllocation() = var
+      result = getAllocationMemoryLocation(var)
     )
   }
 

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedInitialization.qll

@@ -618,6 +618,11 @@ class TranslatedExplicitFieldInitialization extends TranslatedNonDefaultFieldIni
   override int getPosition() { result = position }
 }
 
+pragma[nomagic]
+private Instruction getCallInstruction(TranslatedDefaultFieldInitialization tdfi) {
+  result = tdfi.getInstruction(CallTag())
+}
+
 /**
  * The IR translation of the initialization of a field from an element of an initializer
  * list where default initialization is used.
@@ -642,7 +647,7 @@ class TranslatedDefaultFieldInitialization extends TranslatedFieldInitialization
 
   override Instruction getInstructionSuccessorInternal(InstructionTag tag, EdgeKind kind) {
     tag = CallTargetTag() and
-    result = this.getInstruction(CallTag())
+    result = getCallInstruction(this)
     or
     tag = CallTag() and
     result = this.getSideEffects().getFirstInstruction(kind)

docs/codeql/reusables/supported-versions-compilers.rst

@@ -4,9 +4,9 @@
    :stub-columns: 1
 
    Language,Variants,Compilers,Extensions
-   C/C++,"C89, C99, C11, C17, C23, C++98, C++03, C++11, C++14, C++17, C++20, C++23 [1]_ [2]_ [3]_","Clang (including clang-cl and armclang) extensions (up to Clang 21),
+   C/C++,"C89, C99, C11, C17, C23, C++98, C++03, C++11, C++14, C++17, C++20, C++23 [1]_ [2]_ [3]_","Clang (including clang-cl and armclang) extensions (up to Clang 22),
 
-   GNU extensions (up to GCC 15),
+   GNU extensions (up to GCC 16),
 
    Microsoft extensions (up to VS 2022),
 

go/ql/lib/semmle/go/dependencies/SemVer.qll

@@ -5,6 +5,7 @@ overlay[local?]
 module;
 
 import semmle.go.dependencies.Dependencies
+private import codeql.util.SemVer
 
 /**
  * A SemVer-formatted version string in a dependency.
@@ -17,63 +18,42 @@ class DependencySemVer extends string {
 
   DependencySemVer() {
     this = dep.getDepVersion() and
-    normalized = normalizeSemver(this)
+    normalized = padSemVer(this)
   }
 
   /**
    * Holds if this version may be before `last`.
    */
   bindingset[last]
-  predicate maybeBefore(string last) { normalized < normalizeSemver(last) }
+  predicate maybeBefore(string last) { normalized < padSemVer(last) }
 
   /**
    * Holds if this version may be after `first`.
    */
   bindingset[first]
-  predicate maybeAfter(string first) { normalizeSemver(first) < normalized }
+  predicate maybeAfter(string first) { padSemVer(first) < normalized }
 
   /**
    * Holds if this version may be between `first` (inclusive) and `last` (exclusive).
    */
   bindingset[first, last]
   predicate maybeBetween(string first, string last) {
-    normalizeSemver(first) <= normalized and
-    normalized < normalizeSemver(last)
+    padSemVer(first) <= normalized and
+    normalized < padSemVer(last)
   }
 
   /**
    * Holds if this version is equivalent to `other`.
    */
   bindingset[other]
-  predicate is(string other) { normalized = normalizeSemver(other) }
+  predicate is(string other) { normalized = padSemVer(other) }
 
   /**
    * Gets the dependency that uses this string.
    */
   Dependency getDependency() { result = dep }
 }
 
-bindingset[str]
-private string leftPad(string str) { result = ("000" + str).suffix(str.length()) }
-
-/**
- * Normalizes a SemVer string such that the lexicographical ordering
- * of two normalized strings is consistent with the SemVer ordering.
- *
- * Pre-release information and build metadata is not yet supported.
- */
-bindingset[orig]
-private string normalizeSemver(string orig) {
-  exists(string pattern, string major, string minor, string patch |
-    pattern = "v?(\\d+)\\.(\\d+)\\.(\\d+)(\\D.*)?" and
-    major = orig.regexpCapture(pattern, 1) and
-    minor = orig.regexpCapture(pattern, 2) and
-    patch = orig.regexpCapture(pattern, 3)
-  |
-    result = leftPad(major) + "." + leftPad(minor) + "." + leftPad(patch)
-  )
-}
-
 /**
  * A version string in a dependency that has a SemVer, but also contains a git commit SHA.
  *

java/kotlin-extractor/src/main/java/com/semmle/util/files/FileUtil.java

@@ -1244,8 +1244,8 @@ public static File tryMakeCanonical (File f)
 		try {
 			// getCanonicalFile does not canonicalize subst drives on Windows, so do this separately. This
 			// is a no-op on non-Windows platforms.
-			return SubstResolver.resolve(f.getCanonicalFile());		}
-		catch (IOException ignored) {
+			return SubstResolver.resolve(f.getCanonicalFile());
+		} catch (IOException ignored) {
 			Exceptions.ignore(ignored, "Can't log error: Could be too verbose.");
 			return new File(simplifyPath(f));
 		}

java/ql/integration-tests/java/gradle-sample-without-wrapper-or-gradle-buildless/test.py

@@ -6,7 +6,9 @@
 # The version of gradle used doesn't work on java 17
 def test(codeql, use_java_11, java, environment, check_diagnostics):
     check_diagnostics.redact += ["attributes.java_vendor"]
-    check_diagnostics.replacements = [("11\\.[0-9]+\\.[0-9]+", "11")]
+    # the JDK build provided by the CI runner image may report any number of version components
+    # (e.g. `11.0.32` or `11.0.32.1`), so keep only the feature version
+    check_diagnostics.replacements = [(r'"11(\.[0-9]+)+"', '"11"')]
     gradle_override_dir = pathlib.Path(tempfile.mkdtemp())
     if runs_on.windows:
         (gradle_override_dir / "gradle.bat").write_text("@echo off\nexit /b 2\n")

javascript/ql/lib/semmle/javascript/dependencies/SemVer.qll

@@ -3,6 +3,7 @@
  */
 
 import semmle.javascript.dependencies.Dependencies
+private import codeql.util.SemVer
 
 /**
  * A SemVer-formatted version string in a dependency.
@@ -15,59 +16,38 @@ class DependencySemVer extends string {
 
   DependencySemVer() {
     dep.info(_, this) and
-    normalized = normalizeSemver(this)
+    normalized = padSemVer(this)
   }
 
   /**
    * Holds if this version may be before `last`.
    */
   bindingset[last]
-  predicate maybeBefore(string last) { normalized < normalizeSemver(last) }
+  predicate maybeBefore(string last) { normalized < padSemVer(last) }
 
   /**
    * Holds if this version may be after `first`.
    */
   bindingset[first]
-  predicate maybeAfter(string first) { normalizeSemver(first) < normalized }
+  predicate maybeAfter(string first) { padSemVer(first) < normalized }
 
   /**
    * Holds if this version may be between `first` (inclusive) and `last` (exclusive).
    */
   bindingset[first, last]
   predicate maybeBetween(string first, string last) {
-    normalizeSemver(first) <= normalized and
-    normalized < normalizeSemver(last)
+    padSemVer(first) <= normalized and
+    normalized < padSemVer(last)
   }
 
   /**
    * Holds if this version is equivalent to `other`.
    */
   bindingset[other]
-  predicate is(string other) { normalized = normalizeSemver(other) }
+  predicate is(string other) { normalized = padSemVer(other) }
 
   /**
    * Gets the dependency that uses this string.
    */
   Dependency getDependency() { result = dep }
 }
-
-bindingset[str]
-private string leftPad(string str) { result = ("000" + str).suffix(str.length()) }
-
-/**
- * Normalizes a SemVer string such that the lexicographical ordering
- * of two normalized strings is consistent with the SemVer ordering.
- *
- * Pre-release information and build metadata is not yet supported.
- */
-bindingset[orig]
-private string normalizeSemver(string orig) {
-  exists(string pattern, string major, string minor, string patch |
-    pattern = "(\\d+)\\.(\\d+)\\.(\\d+)" and
-    major = orig.regexpCapture(pattern, 1) and
-    minor = orig.regexpCapture(pattern, 2) and
-    patch = orig.regexpCapture(pattern, 3)
-  |
-    result = leftPad(major) + "." + leftPad(minor) + "." + leftPad(patch)
-  )
-}

ruby/ql/lib/codeql/ruby/frameworks/Gemfile.qll

@@ -3,6 +3,7 @@
  */
 
 private import codeql.ruby.AST
+private import codeql.util.SemVer
 
 /**
  * Provides classes and predicates for Gemfiles, including version constraint logic.
@@ -138,7 +139,7 @@ module Gemfile {
       exists(int thisMajor, int thisMinor, int otherMajor, int otherMinor |
         thisMajor = this.getVersion().getMajor() and
         thisMinor = this.getVersion().getMinor() and
-        exists(string maj, string mi | normalizeSemver(other, _, maj, mi, _) |
+        exists(string maj, string mi | exists(padSemVer(other, maj, mi, _)) |
           otherMajor = maj.toInt() and otherMinor = mi.toInt()
         )
       |
@@ -171,26 +172,26 @@ module Gemfile {
 
     Version() {
       this = any(Gem c).getAVersionConstraint().getVersionString() and
-      normalized = normalizeSemver(this)
+      normalized = padSemVer(this)
     }
 
     /**
      * Holds if this version is strictly before the version defined by `other`.
      */
     bindingset[other]
-    predicate before(string other) { normalized < normalizeSemver(other) }
+    predicate before(string other) { normalized < padSemVer(other) }
 
     /**
      * Holds if this versino is equal to the version defined by `other`.
      */
     bindingset[other]
-    predicate equal(string other) { normalized = normalizeSemver(other) }
+    predicate equal(string other) { normalized = padSemVer(other) }
 
     /**
      * Holds if this version is strictly after the version defined by `other`.
      */
     bindingset[other]
-    predicate after(string other) { normalized > normalizeSemver(other) }
+    predicate after(string other) { normalized > padSemVer(other) }
 
     /**
      * Holds if this version defines a patch number.
@@ -212,43 +213,4 @@ module Gemfile {
      */
     int getPatch() { result = getPatch(normalized).toInt() }
   }
-
-  /**
-   * Normalizes a SemVer string such that the lexicographical ordering
-   * of two normalized strings is consistent with the SemVer ordering.
-   *
-   * Pre-release information and build metadata is not supported.
-   */
-  bindingset[orig]
-  private predicate normalizeSemver(
-    string orig, string normalized, string major, string minor, string patch
-  ) {
-    major = getMajor(orig) and
-    (
-      minor = getMinor(orig)
-      or
-      not exists(getMinor(orig)) and minor = "0"
-    ) and
-    (
-      patch = getPatch(orig)
-      or
-      not exists(getPatch(orig)) and patch = "0"
-    ) and
-    normalized = leftPad(major) + "." + leftPad(minor) + "." + leftPad(patch)
-  }
-
-  bindingset[orig]
-  private string normalizeSemver(string orig) { normalizeSemver(orig, result, _, _, _) }
-
-  bindingset[s]
-  private string getMajor(string s) { result = s.regexpCapture("(\\d+).*", 1) }
-
-  bindingset[s]
-  private string getMinor(string s) { result = s.regexpCapture("(\\d+)\\.(\\d+).*", 2) }
-
-  bindingset[s]
-  private string getPatch(string s) { result = s.regexpCapture("(\\d+)\\.(\\d+)\\.(\\d+).*", 3) }
-
-  bindingset[str]
-  private string leftPad(string str) { result = ("000" + str).suffix(str.length()) }
 }

rust/ql/lib/codeql/rust/internal/PathResolution.qll

@@ -48,6 +48,7 @@ private import codeql.rust.elements.internal.CallExprImpl::Impl as CallExprImpl
 private import codeql.rust.internal.CachedStages
 private import codeql.rust.frameworks.stdlib.Builtins as Builtins
 private import codeql.util.Option
+private import codeql.util.SemVer
 
 private newtype TNamespace =
   TTypeNamespace() or
@@ -568,6 +569,16 @@ class CrateItemNode extends NamedItemNode instanceof Crate {
     )
   }
 
+  pragma[nomagic]
+  predicate isLatestVersion(string name) {
+    this =
+      max(CrateItemNode c, string ver |
+        name = c.getName() and ver = padSemVer(c.(Crate).getVersion())
+      |
+        c order by ver
+      )
+  }
+
   override string getName() { result = Crate.super.getName() }
 
   override Namespace getNamespace() {
@@ -1529,11 +1540,11 @@ private predicate crateDependencyEdge(SourceFileItemNode file, string name, Crat
   crateDependency(file, name, dep)
   or
   // As a fallback, give all files access to crates that do not conflict with known dependencies
-  // and declarations. This is in order to workaround incomplete crate dependency information
-  // provided by the extractor, as well as `CrateItemNode.getASourceFile()` being unable to map
-  // a given file to its crate (for example, if the file is `mod` imported inside a macro that the
-  // extractor is unable to expand).
-  name = dep.getName() and
+  // and declarations, as long as those crates have a unique latest version.
+  // This is in order to workaround incomplete crate dependency information provided by the extractor,
+  // as well as `CrateItemNode.getASourceFile()` being unable to map a given file to its crate (for
+  // example, if the file is `mod` imported inside a macro that the extractor is unable to expand).
+  dep = unique(CrateItemNode dep0 | dep0.isLatestVersion(name)) and
   not hasDeclOrDep(file, name)
 }
 
@@ -2385,6 +2396,11 @@ private module Debug {
     useImportEdge(use, name, item, kind)
   }
 
+  predicate debugCrateDependencyEdge(SourceFileItemNode file, string name, CrateItemNode dep) {
+    file = getRelevantLocatable() and
+    crateDependencyEdge(file, name, dep)
+  }
+
   ItemNode debugGetASuccessor(ItemNode i, string name, SuccessorKind kind) {
     i = getRelevantLocatable() and
     result = i.getASuccessor(name, kind, _)