Merge branch 'main' into feature/python-mcp-remote-sources

Author: Tito0015

cpp/ql/test/library-tests/ir/ir/PrintAST.expected

@@ -4367,18 +4367,6 @@ destructors_for_temps.cpp:
 #  109|               getArrayBase().getFullyConverted(): [ArrayToPointerConversion] array to pointer conversion
 #  109|                   Type = [IntPointerType] int *
 #  109|                   ValueCategory = prvalue
-#  109|             getImplicitDestructorCall(0): [DestructorCall] call to ~ClassWithArrayAndDestructor
-#  109|                 Type = [VoidType] void
-#  109|                 ValueCategory = prvalue
-#  109|               getQualifier(): [ReuseExpr] reuse of temporary object
-#  109|                   Type = [Struct] ClassWithArrayAndDestructor
-#  109|                   ValueCategory = xvalue
-#  109|             getImplicitDestructorCall(1): [DestructorCall] call to ~ClassWithArrayAndDestructor
-#  109|                 Type = [VoidType] void
-#  109|                 ValueCategory = prvalue
-#  109|               getQualifier(): [ReuseExpr] reuse of temporary object
-#  109|                   Type = [Struct] ClassWithArrayAndDestructor
-#  109|                   ValueCategory = xvalue
 #  109|           getExpr().getFullyConverted(): [ReferenceToExpr] (reference to)
 #  109|               Type = [LValueReferenceType] const int &
 #  109|               ValueCategory = prvalue
@@ -4387,6 +4375,18 @@ destructors_for_temps.cpp:
 #  109|                 Type = [SpecifiedType] const int
 #  109|                 ValueCategory = lvalue
 #  110|     getStmt(1): [ReturnStmt] return ...
+#  111|       getImplicitDestructorCall(0): [DestructorCall] call to ~ClassWithArrayAndDestructor
+#  111|           Type = [VoidType] void
+#  111|           ValueCategory = prvalue
+#  111|         getQualifier(): [ReuseExpr] reuse of temporary object
+#  111|             Type = [Struct] ClassWithArrayAndDestructor
+#  111|             ValueCategory = xvalue
+#  111|       getImplicitDestructorCall(1): [DestructorCall] call to ~ClassWithArrayAndDestructor
+#  111|           Type = [VoidType] void
+#  111|           ValueCategory = prvalue
+#  111|         getQualifier(): [ReuseExpr] reuse of temporary object
+#  111|             Type = [Struct] ClassWithArrayAndDestructor
+#  111|             ValueCategory = xvalue
 generic.c:
 #    1| [TopLevelFunction] void c11_generic_test_with_load(unsigned int, int)
 #    1|   <params>: 
@@ -15082,6 +15082,9 @@ ir.cpp:
 # 1476|               getQualifier(): [FunctionCall] call to returnValue
 # 1476|                   Type = [Struct] UnusualFields
 # 1476|                   ValueCategory = prvalue
+#-----|               getQualifier().getFullyConverted(): [TemporaryObjectExpr] temporary object
+#-----|                   Type = [Struct] UnusualFields
+#-----|                   ValueCategory = prvalue(load)
 # 1476|             getArrayOffset(): [Literal] 3
 # 1476|                 Type = [IntType] int
 # 1476|                 Value = [Literal] 3

cpp/ql/test/library-tests/ir/ir/aliased_ir.expected

@@ -12179,19 +12179,19 @@ ir.cpp:
 # 1474|     r1474_10(int)                 = Load[?]                       : &:r1474_9, ~m1474_5
 # 1474|     m1474_11(int)                 = Store[x]                      : &:r1474_1, r1474_10
 # 1476|     r1476_1(glval<float &>)       = VariableAddress[rf]           : 
+#-----|     r0_1(glval<UnusualFields>)    = VariableAddress[#temp0:0]     : 
 # 1476|     r1476_2(glval<unknown>)       = FunctionAddress[returnValue]  : 
 # 1476|     r1476_3(UnusualFields)        = Call[returnValue]             : func:r1476_2
 # 1476|     m1476_4(unknown)              = ^CallSideEffect               : ~m1474_5
 # 1476|     m1476_5(unknown)              = Chi                           : total:m1474_5, partial:m1476_4
-# 1476|     r1476_6(glval<UnusualFields>) = VariableAddress[#temp1476:23] : 
-# 1476|     m1476_7(UnusualFields)        = Store[#temp1476:23]           : &:r1476_6, r1476_3
-# 1476|     r1476_8(glval<float[10]>)     = FieldAddress[a]               : r1476_6
-# 1476|     r1476_9(float *)              = Convert                       : r1476_8
-# 1476|     r1476_10(int)                 = Constant[3]                   : 
-# 1476|     r1476_11(glval<float>)        = PointerAdd[4]                 : r1476_9, r1476_10
-# 1476|     r1476_12(glval<float>)        = Convert                       : r1476_11
-# 1476|     r1476_13(float &)             = CopyValue                     : r1476_12
-# 1476|     m1476_14(float &)             = Store[rf]                     : &:r1476_1, r1476_13
+# 1476|     m1476_6(UnusualFields)        = Store[#temp0:0]               : &:r0_1, r1476_3
+# 1476|     r1476_7(glval<float[10]>)     = FieldAddress[a]               : r0_1
+# 1476|     r1476_8(float *)              = Convert                       : r1476_7
+# 1476|     r1476_9(int)                  = Constant[3]                   : 
+# 1476|     r1476_10(glval<float>)        = PointerAdd[4]                 : r1476_8, r1476_9
+# 1476|     r1476_11(glval<float>)        = Convert                       : r1476_10
+# 1476|     r1476_12(float &)             = CopyValue                     : r1476_11
+# 1476|     m1476_13(float &)             = Store[rf]                     : &:r1476_1, r1476_12
 # 1477|     r1477_1(glval<float>)         = VariableAddress[f]            : 
 # 1477|     r1477_2(glval<unknown>)       = FunctionAddress[returnValue]  : 
 # 1477|     r1477_3(UnusualFields)        = Call[returnValue]             : func:r1477_2

cpp/ql/test/library-tests/ir/ir/raw_ir.expected

@@ -11173,18 +11173,18 @@ ir.cpp:
 # 1474|     r1474_9(int)                  = Load[?]                       : &:r1474_8, ~m?
 # 1474|     mu1474_10(int)                = Store[x]                      : &:r1474_1, r1474_9
 # 1476|     r1476_1(glval<float &>)       = VariableAddress[rf]           : 
+#-----|     r0_1(glval<UnusualFields>)    = VariableAddress[#temp0:0]     : 
 # 1476|     r1476_2(glval<unknown>)       = FunctionAddress[returnValue]  : 
 # 1476|     r1476_3(UnusualFields)        = Call[returnValue]             : func:r1476_2
 # 1476|     mu1476_4(unknown)             = ^CallSideEffect               : ~m?
-# 1476|     r1476_5(glval<UnusualFields>) = VariableAddress[#temp1476:23] : 
-# 1476|     mu1476_6(UnusualFields)       = Store[#temp1476:23]           : &:r1476_5, r1476_3
-# 1476|     r1476_7(glval<float[10]>)     = FieldAddress[a]               : r1476_5
-# 1476|     r1476_8(float *)              = Convert                       : r1476_7
-# 1476|     r1476_9(int)                  = Constant[3]                   : 
-# 1476|     r1476_10(glval<float>)        = PointerAdd[4]                 : r1476_8, r1476_9
-# 1476|     r1476_11(glval<float>)        = Convert                       : r1476_10
-# 1476|     r1476_12(float &)             = CopyValue                     : r1476_11
-# 1476|     mu1476_13(float &)            = Store[rf]                     : &:r1476_1, r1476_12
+# 1476|     mu1476_5(UnusualFields)       = Store[#temp0:0]               : &:r0_1, r1476_3
+# 1476|     r1476_6(glval<float[10]>)     = FieldAddress[a]               : r0_1
+# 1476|     r1476_7(float *)              = Convert                       : r1476_6
+# 1476|     r1476_8(int)                  = Constant[3]                   : 
+# 1476|     r1476_9(glval<float>)         = PointerAdd[4]                 : r1476_7, r1476_8
+# 1476|     r1476_10(glval<float>)        = Convert                       : r1476_9
+# 1476|     r1476_11(float &)             = CopyValue                     : r1476_10
+# 1476|     mu1476_12(float &)            = Store[rf]                     : &:r1476_1, r1476_11
 # 1477|     r1477_1(glval<float>)         = VariableAddress[f]            : 
 # 1477|     r1477_2(glval<unknown>)       = FunctionAddress[returnValue]  : 
 # 1477|     r1477_3(UnusualFields)        = Call[returnValue]             : func:r1477_2

docs/codeql/reusables/supported-versions-compilers.rst

@@ -4,11 +4,11 @@
    :stub-columns: 1
 
    Language,Variants,Compilers,Extensions
-   C/C++,"C89, C99, C11, C17, C23, C++98, C++03, C++11, C++14, C++17, C++20, C++23 [1]_ [2]_ [3]_","Clang (including clang-cl and armclang) extensions (up to Clang 22),
+   C/C++,"C89, C99, C11, C17, C23, C++98, C++03, C++11, C++14, C++17, C++20, C++23 [1]_ [2]_ [3]_","Clang (including clang-cl and armclang) extensions (up to Clang 23),
 
    GNU extensions (up to GCC 16),
 
-   Microsoft extensions (up to VS 2022),
+   Microsoft extensions (up to VS 2026),
 
    Arm Compiler 5 [4]_","``.cpp``, ``.c++``, ``.cxx``, ``.hpp``, ``.hh``, ``.h++``, ``.hxx``, ``.c``, ``.cc``, ``.h``"
    C#,C# up to 14,"Microsoft Visual Studio up to 2019 with .NET up to 4.8,

unified/ql/lib/codeql/unified/internal/dataflow/DataFlowGraph.qll

@@ -176,14 +176,26 @@ module DebugGraph<relevantNodeSig/1 relevantNode> {
     value = node.toString()
   }
 
+  private predicate isBypassedStoreReadStep(Step s) {
+    exists(ContentSet contents |
+      s.read(contents)
+      or
+      s.store(contents)
+    |
+      bypassContentSet(contents)
+    )
+  }
+
   query predicate edges(Node node1, Node node2, string key, string value) {
     key = "semmle.label" and
     relevantDataFlowNode(node1) and
     relevantDataFlowNode(node2) and
     (
       exists(Step step |
         step(node1, step, node2) and
-        value = step.toString()
+        if isBypassedStoreReadStep(step)
+        then value = "value [bypassed " + step.toString() + "]"
+        else value = step.toString()
       )
       or
       exists(boolean isUseStep |

unified/ql/lib/codeql/unified/internal/dataflow/DataFlowInstantiation.qll

@@ -127,20 +127,33 @@ module DataFlowInput implements InputSig<Location> {
   //
   // Steps
   //
+  pragma[nomagic]
+  private Step valueStepEx() {
+    result.value()
+    or
+    exists(ContentSet contents | bypassContentSet(contents) |
+      result.read(contents)
+      or
+      result.store(contents)
+    )
+  }
+
   predicate simpleLocalFlowStep(Node node1, Node node2, string model) {
-    step(node1, any(Step s | s.value()), node2) and model = ""
+    step(node1, valueStepEx(), node2) and model = ""
     or
     localSsaStep(node1, node2, _) and model = ""
   }
 
   predicate jumpStep(Node node1, Node node2) { step(node1, any(Step s | s.jump()), node2) }
 
   predicate readStep(Node node1, ContentSet c, Node node2) {
-    step(node1, any(Step s | s.read(c)), node2)
+    step(node1, any(Step s | s.read(c)), node2) and
+    not bypassContentSet(c)
   }
 
   predicate storeStep(Node node1, ContentSet c, Node node2) {
-    step(node1, any(Step s | s.store(c)), node2)
+    step(node1, any(Step s | s.store(c)), node2) and
+    not bypassContentSet(c)
   }
 
   predicate clearsContent(Node n, ContentSet c) { none() } // TODO

unified/ql/lib/codeql/unified/internal/dataflow/DataFlowPlugin.qll

@@ -13,4 +13,16 @@ private module Plugins {
 class DataFlowPlugin extends Unit {
   /** Holds if there is a language-specific step from `node1 -> step -> node2`. */
   predicate step(Node node1, Step step, Node node2) { none() }
+
+  /**
+   * Holds if a read/store step with the given `contents` should be converted to a value step.
+   *
+   * This affects the steps generated by the language-agnostic code as well as steps from the plugin itself.
+   */
+  predicate bypassContentSet(ContentSet contents) { none() }
 }
+
+/**
+ * Holds if a read/store step with the given `contents` should be converted to a value step.
+ */
+predicate bypassContentSet(ContentSet contents) { any(DataFlowPlugin p).bypassContentSet(contents) }

unified/ql/lib/codeql/unified/internal/dataflow/DataFlowPluginSwift.qll

@@ -6,6 +6,10 @@ private import unified
 private import AllDataFlow
 
 private class SwiftDataFlowPlugin extends DataFlowPlugin {
+  override predicate bypassContentSet(ContentSet contents) {
+    contents.asSingleton().asNamedMember() = "some.0"
+  }
+
   // Note: For now we assume all code is Swift, but in the future we must restrict these rules to Swift-files
   override predicate step(Node node1, Step step, Node node2) {
     exists(BinaryExpr expr |
@@ -27,33 +31,31 @@ private class SwiftDataFlowPlugin extends DataFlowPlugin {
     )
     or
     exists(UnaryExpr expr |
-      expr.getOperator().(PostfixOperator).getValue() = "!" and
-      node1.isResultValue(expr.getOperand()) and
-      (step.readName("some.0") or step.taint()) and
-      node2.isResultValue(expr)
+      expr.getOperator().(PostfixOperator).getValue() = "!"
       or
-      expr.getOperator().(PrefixOperator).getValue() = ["try", "try!", "await"] and
+      expr.getOperator().(PrefixOperator).getValue() = ["try", "try!", "try?", "await"]
+    |
       node1.isResultValue(expr.getOperand()) and
       step.value() and
       node2.isResultValue(expr)
-      or
-      expr.getOperator().(PrefixOperator).getValue() = "try?" and
-      // TODO: preserve the value of some.0 if it is already stored in that
-      node1.isResultValue(expr.getOperand()) and
-      step.storeName("some.0") and
-      node2.isResultValue(expr)
     )
     or
     exists(TypeCastExpr expr |
-      // The `as?` type cast boxes the incoming value in Optional depending on whether the type cast succeeded
-      expr.getOperator().getValue() = "as?" and
+      // Type-cast operators:
+      // - "as": Safe upcast conversion
+      // - "as?": Wrap in Optional<T> if cast succeeds
+      // - "as!": Throw if cast fails
+      //
+      // Since we bypass Optional<T> content, we model all of these as value steps.
+      expr.getOperator().getValue() = ["as", "as?", "as!"] and
       node1.isResultValue(expr.getExpr()) and
-      step.storeName("some.0") and
+      step.value() and
       node2.isResultValue(expr)
-      or
-      // Safe upcast conversion ("as") and downcast-or-throw ("as!") propagate the value directly
-      expr.getOperator().getValue() = ["as", "as!"] and
-      node1.isResultValue(expr.getExpr()) and
+    )
+    or
+    exists(NullCoalescingExpr expr |
+      // We bypass Optional<T> content so we add value-flow out of both operands of "??"
+      node1.isResultValue(expr.getAnOperand()) and
       step.value() and
       node2.isResultValue(expr)
     )