Skip to content

Sync upstream v2.23.8 - #308

Merged
Josh Brown (ropwareJB) merged 667 commits into
mainfrom
jb1/sync-upstream-2-23-8
Dec 15, 2025
Merged

Sync upstream v2.23.8#308
Josh Brown (ropwareJB) merged 667 commits into
mainfrom
jb1/sync-upstream-2-23-8

Conversation

@ropwareJB

Copy link
Copy Markdown
Collaborator

Syncs with upstream codeql-cli/v2.23.8.

```
Evaluated relational algebra for predicate DataFlowPrivate::storeStepImpl/4#b2c79f9a@13be12rc with tuple counts:
9 ~0% {3} r1 = JOIN `FlowSummaryImpl::Private::Steps::summaryStoreStep/3#5c2d4899` WITH DataFlowUtil::TFlowSummaryNode#40da8361 ON FIRST 1 OUTPUT Lhs.2, Lhs.1, Rhs.1
9 ~0% {4} | JOIN WITH DataFlowUtil::TFlowSummaryNode#40da8361 ON FIRST 1 OUTPUT Lhs.2, Lhs.1, Rhs.1, _
9 ~12% {4} | REWRITE WITH Out.3 := true
1853420 ~0% {3} r2 = SCAN `DataFlowPrivate::nodeHasInstruction/3#f469bb06` OUTPUT In.1, In.0, In.2
100282 ~0% {3} | JOIN WITH `Instruction::StoreInstruction.getDestinationAddressOperand/0#dispred#596a4aba` ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Lhs.2
127910 ~0% {6} | JOIN WITH `DataFlowPrivate::numberOfLoadsFromOperand/4#7e555666_1023#join_rhs` ON FIRST 1 OUTPUT _, Lhs.1, Rhs.1, Rhs.3, Lhs.2, Rhs.2
127910 ~0% {4} | REWRITE WITH Tmp.0 := 1, Out.0 := (Tmp.0 + In.4 + In.5) KEEPING 4
4178182721 ~1% {4} | JOIN WITH `DataFlowUtil::FieldContent.getIndirectionIndex/0#dispred#cc69866f_10#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Lhs.2, Lhs.3
4290552803 ~0% {5} | JOIN WITH `DataFlowUtil::FieldContent.getAField/0#dispred#ba1c91e5` ON FIRST 1 OUTPUT Lhs.2, Lhs.1, Lhs.3, Lhs.0, Rhs.1
3033745816 ~5% {7} | JOIN WITH DataFlowUtil::PostFieldUpdateNode#b86f3a84_1023#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Lhs.2, Lhs.3, Lhs.4, Rhs.2, Rhs.3
3033745816 ~3% {9} | JOIN WITH DataFlowUtil::TPostUpdateNodeImpl#f5e76b7a_21#join_rhs ON FIRST 1 OUTPUT Lhs.1, Lhs.2, Lhs.3, Lhs.4, Lhs.0, Lhs.5, Lhs.6, Rhs.1, _
{8} | REWRITE WITH Tmp.8 := 1, TEST InOut.7 = Tmp.8 KEEPING 8
1516872908 ~0% {7} | SCAN OUTPUT In.4, In.5, In.6, In.0, In.1, In.2, In.3
2409090286 ~1% {6} | JOIN WITH DataFlowUtil::PostFieldUpdateNode#b86f3a84_0231#join_rhs ON FIRST 3 OUTPUT Rhs.3, Lhs.6, Lhs.3, Lhs.4, Lhs.5, Lhs.0
66016 ~45% {4} | JOIN WITH `DataFlowUtil::FieldAddress.getField/0#dispred#bdd01c1a` ON FIRST 2 OUTPUT Lhs.2, Lhs.4, Lhs.5, Lhs.3
66025 ~45% {4} r3 = r1 UNION r2
return r3
```
The check for QLDoc comments was unfortunately broken for some time, so
we missed this.
The fix was accidentially lost when rebasing the branch that introduced this
predicate.
This make the predicate give back sensible results on (upgraded) databases
where we do not have expanded arguments, and avoid having to write case
distinctions in places where we would want to use `getExpandedArgument`.
Rust: Handle string literals with line breaks
…rlay.qll
C/C++ overlay: Add basic `Overlay.qll` file
Add changelog entry for CodeQL CLI version 2.23.6
…-2.23.7
Update branch with previous release notes, and fix date format in change note file
…cli-2.23.7
Post-release preparation for codeql-cli-2.23.7
…-sap
Java: Add change note for Maven compiler flags
JS: Use question-mark variant in all overlay annotations
Comment threadcsharp/ql/src/Security Features/CWE-1004/Web.config Dismissed
Comment on lines +54 to +57
catch (Exception exc)
{
logger.LogInfo($"Couldn't delete {userReportedDirectoryPurpose} directory {exc.Message}");
}

Check notice

Code scanning / CodeQL

Generic catch clause Note

Generic catch clause.

Copilot Autofix

AI 9 months ago

To fix this problem, the catch clause in the Dispose method should be limited to only those exception types that are expected when deleting directories: typically IOException, UnauthorizedAccessException, and optionally DirectoryNotFoundException.

Steps:

  1. Replace the broad catch (Exception exc) with multiple specific catch blocks for each anticipated exception.
  2. In each catch block, log as before, including the relevant exception message.
  3. Optionally, a final generic catch could be used if you still want to ensure nothing escapes, but it's safer to avoid that unless strictly necessary.
  4. No new imports are needed since the required exception types are in System, which is already imported.

Only code within the Dispose method, in the catch clause around DirInfo.Delete(true), needs to be modified.


Suggested changeset 1
csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DependencyDirectory.cs

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DependencyDirectory.cs b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DependencyDirectory.cs
--- a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DependencyDirectory.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DependencyDirectory.cs
@@ -51,10 +51,18 @@
{
DirInfo.Delete(true);
}
- catch (Exception exc)
+ catch (IOException exc)
{
- logger.LogInfo($"Couldn't delete {userReportedDirectoryPurpose} directory {exc.Message}");
+ logger.LogInfo($"Couldn't delete {userReportedDirectoryPurpose} directory (IO error): {exc.Message}");
}
+ catch (UnauthorizedAccessException exc)
+ {
+ logger.LogInfo($"Couldn't delete {userReportedDirectoryPurpose} directory (access denied): {exc.Message}");
+ }
+ catch (DirectoryNotFoundException exc)
+ {
+ logger.LogInfo($"Couldn't delete {userReportedDirectoryPurpose} directory (not found): {exc.Message}");
+ }
}
public override string ToString() => DirInfo.FullName;
EOF
@@ -51,10 +51,18 @@
{
DirInfo.Delete(true);
}
catch(Exceptionexc)
catch(IOExceptionexc)
{
logger.LogInfo($"Couldn't delete {userReportedDirectoryPurpose} directory {exc.Message}");
logger.LogInfo($"Couldn't delete {userReportedDirectoryPurpose} directory (IO error): {exc.Message}");
}
catch(UnauthorizedAccessExceptionexc)
{
logger.LogInfo($"Couldn't delete {userReportedDirectoryPurpose} directory (access denied): {exc.Message}");
}
catch(DirectoryNotFoundExceptionexc)
{
logger.LogInfo($"Couldn't delete {userReportedDirectoryPurpose} directory (not found): {exc.Message}");
}
}

publicoverridestringToString()=>DirInfo.FullName;
Copilot is powered by AI and may make mistakes. Always verify output.
Comment threadcsharp/extractor/Semmle.Extraction.CSharp/Extractor/OverlayInfo.cs Dismissed
Comment threadcsharp/extractor/Semmle.Extraction.CSharp.Standalone/Extractor.cs Dismissed
Comment threadcsharp/extractor/Semmle.Extraction.CSharp.Standalone/Extractor.cs Dismissed
Comment threadcsharp/extractor/Semmle.Extraction.CSharp.Standalone/Extractor.cs Dismissed
@ropwareJB
Josh Brown (ropwareJB) merged commit 1dd488b into mainDec 15, 2025
15 of 16 checks passed
@ropwareJB
Josh Brown (ropwareJB) deleted the jb1/sync-upstream-2-23-8 branch December 15, 2025 21:16
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

20 participants

@ropwareJB@dilanbhalla@github-advanced-security@hvitved@redsun82@MathiasVP@michaelnebel@jketema@paldepind@asgerf@owen-mc@igfoo@szsam@Eliav2@aegilops@aschackmull@geoffw0@akoeplinger@joefarebrother@felicitymay