This PR enables diff-informed mode on queries that select a location other than dataflow source or sink. This entails adding a non-trivial location override that returns the locations that are actually selected.

Prior work includes PRs like#19663,#19759, and#19817. This PR uses the same patch script as those PRs to find candidate queries to convert to diff-enabled. This is the final step in mass-enabling diff-informed queries on all the languages.

Commit-by-commit reviewing is recommended.

I have split the commits that add/modify tests from the ones that enable/disable diff-informed queries.
If the commit modifies a .qll file, in the commit message I've included links to the queries that depend on that .qll for easier reviewing.
Feel free to delegate parts of the review to others who may be more specialized in certain languages.

Potentially tricky cases:

[TEST] C++: CWE-020/ExternalAPI: add tests based on qlhelp: I wasn't able to get alerts to show up for the qhelp-based tests; can someone from the language team chip in to what a useful test would look like? Similar case with thePython TimingAttackAgainstHash test. In contrast, in[TEST] Java: CWE-020/ExternalAPI I was able to get alerts just from the qhelp example, and in[TEST] C++: CleartextSqliteDatabase I was able to get alerts from a mostly Copilot-written test.
[DIFF-INFORMED] C++: (IR) ExternalAPIs: config used in two queries, but one of them without a location; I guess that's fine?
[DIFF-INFORMED] C++: SSLResultConflation: query uses a secondary config (i.e. calls the same config twice), but this does pass tests, unlike the other queries with secondary configs. Can I get a sanity check here? Let me know if you find other cases of secondary configs that are passing tests.
[DIFF-INFORMED] Java: LogInjection: disabled because of mysterious OOM during--check-diff-informed locally and in CI. Should create a follow-up issue.
I'm not sure how important it is to have the location overrides be as precise as possible by including all the clauses from thewhere, or if it's good enough to overapproximate and just pass the--check-diff-informed tests.

github-actionsbot added C# JS C++ Java Python Go Ruby Rust

Pull requests that update Rust code

Swift ActionsAnalysis of GitHub Actions labels

Jul 2, 2025

github-advanced-securitybot found potential problems

Jul 2, 2025

View reviewed changes

cpp/ql/src/Security/CWE/CWE-119/OverrunWriteProductFlow.ql FixedShow fixedHide fixed

cpp/ql/src/experimental/Likely Bugs/ArrayAccessProductFlow.ql FixedShow fixedHide fixed

d10c force-pushed thed10c/diff-informed-phase-3 branch fromff3a4b9 to95fe462Compare

July 3, 2025 15:50

github-advanced-securitybot found potential problems

Jul 3, 2025

View reviewed changes

actions/ql/lib/codeql/actions/security/EnvPathInjectionQuery.qll FixedShow fixedHide fixed

d10c force-pushed thed10c/diff-informed-phase-3 branch 3 times, most recently fromaff62c2 to6d0ae3aCompare

July 4, 2025 14:20

github-advanced-securitybot found potential problems

Jul 4, 2025

View reviewed changes

...erimental/query-tests/Security/CWE-208/TimingAttackAgainstHash/TimingAttackAgainstHash.qlref

		@@ -0,0 +1 @@
		experimental/Security/CWE-208/TimingAttackAgainstHash/TimingAttackAgainstHash.ql

Check warning

Code scanning / CodeQL

Query test without inline test expectations Warning test

Query test does not use inline test expectations.

d10c force-pushed thed10c/diff-informed-phase-3 branch 2 times, most recently fromc871f5e to276c7f0Compare

July 7, 2025 09:42

github-advanced-securitybot found potential problems

Jul 7, 2025

View reviewed changes

go/ql/lib/semmle/go/security/HardcodedCredentials.qll FixedShow fixedHide fixed

d10c force-pushed thed10c/diff-informed-phase-3 branch 2 times, most recently fromcb2db2f toc70036dCompare

July 8, 2025 15:30

github-advanced-securitybot found potential problems

Jul 8, 2025

View reviewed changes

java/ql/lib/semmle/code/java/security/SqlConcatenatedQuery.qll FixedShow fixedHide fixed

java/ql/lib/semmle/code/java/security/TempDirLocalInformationDisclosureQuery.qll FixedShow fixedHide fixed

java/ql/lib/semmle/code/java/security/UnsafeCertTrustQuery.qll FixedShow fixedHide fixed

d10c force-pushed thed10c/diff-informed-phase-3 branch fromc70036d to08c4cc2Compare

July 9, 2025 16:47

github-advanced-securitybot found potential problems

Jul 9, 2025

View reviewed changes

cpp/ql/src/Security/CWE/CWE-732/UnsafeDaclSecurityDescriptor.ql FixedShow fixedHide fixed

d10c force-pushed thed10c/diff-informed-phase-3 branch 2 times, most recently from857b583 to3e3e856Compare

July 11, 2025 12:49

Copy link

ContributorAuthor

d10c commentedJul 15, 2025

DCA results: some slowdowns on Python, but they don't seem to be related to these changes. Java had some timeout-related failures, so I'll restart that. Overall, no negative performance impact on empty-diff.

d10c force-pushed thed10c/diff-informed-phase-3 branch 2 times, most recently from443655d to5112a9cCompare

July 16, 2025 15:36

d10c added26 commits

July 17, 2025 10:55

[DIFF-INFORMED] Java: MaybeBrokenCryptoAlgorithm

0b9d638

https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/java/ql/src/Security/CWE/CWE-327/MaybeBrokenCryptoAlgorithm.ql#L25

[DIFF-INFORMED] Java: SensitiveLogging

9cb55f3

https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/java/ql/src/Security/CWE/CWE-532/SensitiveInfoLog.ql#L20

[DIFF-INFORMED] Java: SqlConcatenated

5228767

https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/java/ql/src/Security/CWE/CWE-089/SqlConcatenated.ql#L27

[DIFF-INFORMED] Java: TaintedEnvironmentVariable

3197508

https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/java/ql/src/Security/CWE/CWE-078/ExecTaintedEnvironment.ql#L22

[DIFF-INFORMED] Java: TempDirLocalInformationDisclosure

69e93eb

https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/java/ql/src/Security/CWE/CWE-200/TempDirLocalInformationDisclosure.ql#L56

[DIFF-INFORMED] Java: TrustBoundaryViolation

f10210c

https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/java/ql/src/Security/CWE/CWE-501/TrustBoundaryViolation.ql#L18

[DIFF-INFORMED] Java: UnsafeCertTrust

5e05aeb

https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/java/ql/src/Security/CWE/CWE-273/UnsafeCertTrust.ql#L21

[DIFF-INFORMED] Java: AndroidWebViewSettingsAllowsContentAccess

06add01

[DIFF-INFORMED] JS: IndirectCommandInjection

89dd8a8

https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/javascript/ql/src/Security/CWE-078/IndirectCommandInjection.ql#L25

[DIFF-INFORMED] JS: ShellCommandInjectionFromEnvironment

2a5eae2

https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/javascript/ql/src/Security/CWE-078/ShellCommandInjectionFromEnvironment.ql#L26

[DIFF-INFORMED] JS: EnvValueAndKeyInjection

81bbcda

https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/javascript/ql/src/experimental/Security/CWE-099/EnvValueAndKeyInjection.ql#L68

[DIFF-INFORMED] JS: decodeJwtWithoutVerification

272a97d

[DIFF-INFORMED] Python: (Possible)TimingAttackAgainstHash

e7b6ad2

[DIFF-INFORMED] Ruby: MissingFullAnchor

9f72a2f

https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/ruby/ql/src/queries/security/cwe-020/MissingFullAnchor.ql#L18

[DIFF-INFORMED] Rust: RegexInjection

2ba8234

[DIFF-INFORMED] Rust: TaintedPath

2afffd3

[DIFF-INFORMED] Rust: SqlInjection

7e4f37f

[DIFF-INFORMED] Rust: CleartextTransmission

b3f76ce

[DIFF-INFORMED] Rust: CleartextLogging

d25c8cd

[DIFF-INFORMED] Rust: UncontrolledAllocationSize

ca1848e

[DIFF-INFORMED] Rust: AccessAfterLifetime

ab6be38

[DIFF-INFORMED] Rust: AccessInvalidPointer

a0215ae

[DIFF-INFORMED] Swift: CleartextStorageDatabase

162781d

https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/swift/ql/src/queries/Security/CWE-311/CleartextStorageDatabase.ql#L33

[DIFF-INFORMED] Swift: CleartextStoragePreferences

37e6e2c

https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/swift/ql/src/queries/Security/CWE-312/CleartextStoragePreferences.ql#L32

[DIFF-INFORMED] Swift: InsecureTLS

649df5b

https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/swift/ql/src/queries/Security/CWE-757/InsecureTLS.ql#L18

[DIFF-INFORMED] Swift: UnsafeWebViewFetch

085720a

https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/swift/ql/src/queries/Security/CWE-079/UnsafeWebViewFetch.ql#L24

d10c force-pushed thed10c/diff-informed-phase-3 branch from5112a9c to085720aCompare

July 17, 2025 08:57

Copy link

Contributor

michaelnebel commentedJul 17, 2025

This is a very large diff for a single PR. Would it be a lot of extra work to split this into one PR per language? Then it will also be possible to merge a bit at the time (there might be issues with getting DCA running successfully for this many languages and it will be a shame to block merging changes while waiting for DCA/review for other languages).

Copy link

ContributorAuthor

d10c commentedJul 17, 2025

Sure, I can split it off into separate PRs per language.

Copy link

Contributor

michaelnebel commentedJul 17, 2025

Sure, I can split it off into separate PRs per language.

Thank you - that will be really appreciated. You also structured the commits very nicely, so it seems doable 😄

Labels

Actions

Analysis of GitHub Actions

C#C++Go Java JS Python Ruby Rust

Pull requests that update Rust code

Swift

3 participants

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Diff-informed queries: phase 3 (non-trivial locations)#19957

Are you sure you want to change the base?

Diff-informed queries: phase 3 (non-trivial locations)#19957

Uh oh!

Conversation

d10c commentedJul 2, 2025•
edited
Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Check warning

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

d10c commentedJul 15, 2025

Uh oh!

michaelnebel commentedJul 17, 2025

Uh oh!

d10c commentedJul 17, 2025

Uh oh!

michaelnebel commentedJul 17, 2025

Uh oh!

Uh oh!

Movatterモバイル変換

Diff-informed queries: phase 3 (non-trivial locations)#19957

Are you sure you want to change the base?

Diff-informed queries: phase 3 (non-trivial locations)#19957

Uh oh!

Conversation

d10c commentedJul 2, 2025• editedLoading Uh oh!There was an error while loading.Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Check warning

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

d10c commentedJul 15, 2025

Uh oh!

michaelnebel commentedJul 17, 2025

Uh oh!

d10c commentedJul 17, 2025

Uh oh!

michaelnebel commentedJul 17, 2025

Uh oh!

Uh oh!

d10c commentedJul 2, 2025•
edited
Loading