Skip to content

Sync upstream v2.23.8 #308

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ropwareJB merged 667 commits into from
Dec 15, 2025

Manual merge javascript/ql/lib/semmle/javascript/dataflow/internal/Da…

cffde88
Select commit
Loading
Failed to load commit list.
Merged

Sync upstream v2.23.8 #308

Manual merge javascript/ql/lib/semmle/javascript/dataflow/internal/Da…
cffde88
Select commit
Loading
Failed to load commit list.
GitHub Advanced Security / CodeQL failed Dec 15, 2025 in 2s

5 configurations not found

Warning: Code scanning may not have found all the alerts introduced by this pull request, because 5 configurations present on refs/heads/main were not found:

Actions workflow (rust-analysis.yml)

  • ❓  .github/workflows/rust-analysis.yml:analyze/language:rust

Actions workflow (csv-coverage-metrics.yml)

  • ❓  .github/workflows/csv-coverage-metrics.yml:publish-csharp
  • ❓  .github/workflows/csv-coverage-metrics.yml:publish-java

API upload

  • ❓  <default>

Actions workflow (cpp-swift-analysis.yml)

  • ❓  .github/workflows/cpp-swift-analysis.yml:CodeQL-Build

New alerts in code changed by this pull request

Security Alerts:

  • 4 high

Other Alerts:

  • 1 warning
  • 55 notes

Alerts not introduced by this pull request might have been detected because the code changes were too large.

See annotations below for details.

View all branch alerts.

Annotations

Check failure on line 4 in csharp/ql/test/query-tests/Security Features/CWE-614/InsecureCookie/SystemWeb/RequireSSLFalse/Web.config

See this annotation in the file changed.

Code scanning / CodeQL

'requireSSL' attribute is not set to true High test

The 'requireSSL' attribute is not set to 'true'.

Check failure on line 4 in csharp/ql/test/query-tests/Security Features/CWE-1004/HttpOnlyCookie/SystemWeb/HttpOnlyCookiesTrue/Web.config

See this annotation in the file changed.

Code scanning / CodeQL

'requireSSL' attribute is not set to true High test

The 'requireSSL' attribute is not set to 'true'.

Check failure on line 4 in csharp/ql/test/query-tests/Security Features/CWE-1004/HttpOnlyCookie/SystemWeb/HttpOnlyCookiesFalse/Web.config

See this annotation in the file changed.

Code scanning / CodeQL

'requireSSL' attribute is not set to true High test

The 'requireSSL' attribute is not set to 'true'.

Check failure on line 4 in csharp/ql/src/Security Features/CWE-1004/Web.config

See this annotation in the file changed.

Code scanning / CodeQL

'requireSSL' attribute is not set to true High

The 'requireSSL' attribute is not set to 'true'.

Check warning on line 619 in csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs

See this annotation in the file changed.

Code scanning / CodeQL

Useless assignment to local variable Warning

This assignment to
bytesRead
Loading
is useless, since its value is never read.

Check notice on line 220 in csharp/extractor/Semmle.Extraction.CSharp/Extractor/Analyser.cs

See this annotation in the file changed.

Code scanning / CodeQL

Generic catch clause Note

Generic catch clause.

Check notice on line 179 in csharp/extractor/Semmle.Extraction.CSharp/Extractor/Analyser.cs

See this annotation in the file changed.

Code scanning / CodeQL

Generic catch clause Note

Generic catch clause.

Check notice on line 172 in csharp/extractor/Semmle.Extraction.CSharp/Extractor/Analyser.cs

See this annotation in the file changed.

Code scanning / CodeQL

Nested 'if' statements can be combined Note

These 'if' statements can be combined.

Check notice on line 117 in csharp/extractor/Semmle.Extraction.CSharp/Extractor/Analyser.cs

See this annotation in the file changed.

Code scanning / CodeQL

Generic catch clause Note

Generic catch clause.

Check notice on line 589 in csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/Type.cs

See this annotation in the file changed.

Code scanning / CodeQL

Missed opportunity to use Where Note

This foreach loop
implicitly filters its target sequence
Loading
- consider filtering the sequence explicitly using '.Where(...)'.

Check notice on line 52 in csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/TupleType.cs

See this annotation in the file changed.

Code scanning / CodeQL

Missed opportunity to use Where Note

This foreach loop
implicitly filters its target sequence
Loading
- consider filtering the sequence explicitly using '.Where(...)'.

Check notice on line 121 in csharp/extractor/Semmle.Extraction.CSharp/Entities/TypeMention.cs

See this annotation in the file changed.

Code scanning / CodeQL

Local scope variable shadows member Note

Local scope variable 'type' shadows
TypeMention.type
Loading
.

Check notice on line 121 in csharp/extractor/Semmle.Extraction.CSharp/Entities/TypeMention.cs

See this annotation in the file changed.

Code scanning / CodeQL

Local scope variable shadows member Note

Local scope variable 'parent' shadows
TypeMention.parent
Loading
.

Check notice on line 121 in csharp/extractor/Semmle.Extraction.CSharp/Entities/TypeMention.cs

See this annotation in the file changed.

Code scanning / CodeQL

Local scope variable shadows member Note

Local scope variable 'loc' shadows
TypeMention.loc
Loading
.

Check notice on line 25 in csharp/extractor/Semmle.Extraction.CSharp/Entities/TypeMention.cs

See this annotation in the file changed.

Code scanning / CodeQL

Local scope variable shadows member Note

Local scope variable 'type' shadows
TypeMention.type
Loading
.

Check notice on line 47 in csharp/extractor/Semmle.Extraction.CSharp/Entities/Property.cs

See this annotation in the file changed.

Code scanning / CodeQL

Local scope variable shadows member Note

Local scope variable 'type' shadows
Property.type
Loading
.

Check notice on line 177 in csharp/extractor/Semmle.Extraction.CSharp/Entities/Parameter.cs

See this annotation in the file changed.

Code scanning / CodeQL

Nested 'if' statements can be combined Note

These 'if' statements can be combined.

Check notice on line 57 in csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DependencyDirectory.cs

See this annotation in the file changed.

Code scanning / CodeQL

Generic catch clause Note

Generic catch clause.

Check notice on line 251 in csharp/extractor/Semmle.Extraction.CSharp/Extractor/Analyser.cs

See this annotation in the file changed.

Code scanning / CodeQL

Generic catch clause Note

Generic catch clause.

Check notice on line 189 in csharp/extractor/Semmle.Extraction.CSharp/Extractor/Context.cs

See this annotation in the file changed.

Code scanning / CodeQL

Generic catch clause Note

Generic catch clause.

Check notice on line 459 in csharp/extractor/Semmle.Extraction.CSharp/Extractor/Context.cs

See this annotation in the file changed.

Code scanning / CodeQL

Generic catch clause Note

Generic catch clause.

Check notice on line 507 in csharp/extractor/Semmle.Extraction.CSharp/Extractor/Context.cs

See this annotation in the file changed.

Code scanning / CodeQL

Missed opportunity to use Select Note

This foreach loop immediately
maps its iteration variable to another variable
Loading
- consider mapping the sequence explicitly using '.Select(...)'.

Check notice on line 669 in csharp/extractor/Semmle.Extraction.CSharp/Extractor/Context.cs

See this annotation in the file changed.

Code scanning / CodeQL

Call to System.IO.Path.Combine Note

Call to 'System.IO.Path.Combine'.

Check notice on line 677 in csharp/extractor/Semmle.Extraction.CSharp/Extractor/Context.cs

See this annotation in the file changed.

Code scanning / CodeQL

Generic catch clause Note

Generic catch clause.

Check notice on line 124 in csharp/extractor/Semmle.Extraction.CSharp/Extractor/Extractor.cs

See this annotation in the file changed.

Code scanning / CodeQL

Generic catch clause Note

Generic catch clause.