Merge upstream codeql-cli-2.22.3

[chanel-y]

Accepted incoming for the following merge conflicts:

TaintedPathQuery doesn't seem to be changing functionality, just accomodating the deprecation of the AbstractValue (4f6528a)

ZipSlipQuery.qll is just adding more sources and sinks

TaintedPathQuery.qll

class PathCheck extends Sanitizer {
  Guard g;

  PathCheck() {
<<<<<<< HEAD
    // This expression is structurally replicated in a dominating guard
    exists(AbstractValues::BooleanValue v | g = this.(GuardedDataFlowNode).getAGuard(_, v))
  }

  override predicate isBarrier(TaintedPathConfig::FlowState state) {
    g.(WeakGuard).isBarrier(state)
    or
    not g instanceof WeakGuard
=======
    // This expression is structurally replicated in a dominating guard which is not a "weak" check
    exists(Guard g, GuardValue v |
      g = this.(GuardedDataFlowNode).getAGuard(_, v) and
      exists(v.asBooleanValue()) and
      not g instanceof WeakGuard
    )
>>>>>>> codeql-cli/latest
  }
}

ZipSlipQuery.qll

/**
 * A taint tracking module for Zip Slip.
 */
<<<<<<< HEAD
module ZipSlip = TaintTracking::Global<ZipSlipConfig>;
=======
module ZipSlip = TaintTracking::Global<ZipSlipConfig>;

/** An access to the `FullName` property of a `ZipArchiveEntry`. */
class ArchiveFullNameSource extends Source {
  ArchiveFullNameSource() {
    exists(PropertyAccess pa | this.asExpr() = pa |
      pa.getTarget()
          .getDeclaringType()
          .hasFullyQualifiedName("System.IO.Compression", "ZipArchiveEntry") and
      pa.getTarget().getName() = "FullName"
    )
  }
}

/** An argument to the `ExtractToFile` extension method. */
class ExtractToFileArgSink extends Sink {
  ExtractToFileArgSink() {
    exists(MethodCall mc |
      mc.getTarget()
          .hasFullyQualifiedName("System.IO.Compression", "ZipFileExtensions", "ExtractToFile") and
      this.asExpr() = mc.getArgumentForName("destinationFileName")
    )
  }
}

/** A path argument to a `File.Open`, `File.OpenWrite`, or `File.Create` method call. */
class FileOpenArgSink extends Sink {
  FileOpenArgSink() {
    exists(MethodCall mc |
      mc.getTarget().hasFullyQualifiedName("System.IO", "File", "Open") or
      mc.getTarget().hasFullyQualifiedName("System.IO", "File", "OpenWrite") or
      mc.getTarget().hasFullyQualifiedName("System.IO", "File", "Create")
    |
      this.asExpr() = mc.getArgumentForName("path")
    )
  }
}

/** A path argument to a call to the `FileStream` constructor. */
class FileStreamArgSink extends Sink {
  FileStreamArgSink() {
    exists(ObjectCreation oc |
      oc.getTarget().getDeclaringType().hasFullyQualifiedName("System.IO", "FileStream")
    |
      this.asExpr() = oc.getArgumentForName("path")
    )
  }
}

/**
 * A path argument to a call to the `FileStream` constructor.
 *
 * This constructor can accept a tainted file name and subsequently be used to open a file stream.
 */
class FileInfoArgSink extends Sink {
  FileInfoArgSink() {
    exists(ObjectCreation oc |
      oc.getTarget().getDeclaringType().hasFullyQualifiedName("System.IO", "FileInfo")
    |
      this.asExpr() = oc.getArgumentForName("fileName")
    )
  }
}

/**
 * A call to `GetFileName`.
 *
 * This is considered a sanitizer because it extracts just the file name, not the full path.
 */
class GetFileNameSanitizer extends Sanitizer {
  GetFileNameSanitizer() {
    exists(MethodCall mc |
      mc.getTarget().hasFullyQualifiedName("System.IO", "Path", "GetFileName")
    |
      this.asExpr() = mc
    )
  }
}

/**
 * A call to `Substring`.
 *
 * This is considered a sanitizer because `Substring` may be used to extract a single component
 * of a path to avoid ZipSlip.
 */
class SubstringSanitizer extends Sanitizer {
  SubstringSanitizer() {
    exists(MethodCall mc | mc.getTarget().hasFullyQualifiedName("System", "String", "Substring") |
      this.asExpr() = mc
    )
  }
}

private predicate stringCheckGuard(Guard g, Expr e, GuardValue v) {
  g.(MethodCall).getTarget().hasFullyQualifiedName("System", "String", "StartsWith") and
  g.(MethodCall).getQualifier() = e and
  // A StartsWith check against Path.Combine is not sufficient, because the ".." elements have
  // not yet been resolved.
  not exists(MethodCall combineCall |
    combineCall.getTarget().hasFullyQualifiedName("System.IO", "Path", "Combine") and
    DataFlow::localExprFlow(combineCall, e)
  ) and
  v.asBooleanValue() = true
}

/**
 * A call to `String.StartsWith()` that indicates that the tainted path value is being
 * validated to ensure that it occurs within a permitted output path.
 */
class StringCheckSanitizer extends Sanitizer {
  StringCheckSanitizer() { this = DataFlow::BarrierGuard<stringCheckGuard/3>::getABarrierNode() }
}
>>>>>>> codeql-cli/latest

[Copilot]

Pull Request Overview

This PR merges upstream CodeQL changes from version 2.22.3, primarily consisting of auto-generated stub files for the Microsoft.Identity.ServiceEssentials.SDK package and related test configuration updates.

• Added auto-generated C# stub files for Microsoft Identity and IdentityModel libraries (version 6.34.0.0 and 1.19.6.0)
• Added test query reference files for JWT security validation queries
• All changes are generated stub files intended to be correct by design

Reviewed Changes

Copilot reviewed 258 out of 4384 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
Microsoft.IdentityModel.S2S.cs	Auto-generated stub for S2S authentication protocol handlers and validation classes
Microsoft.IdentityModel.S2S.Tokens.cs	Auto-generated stub for S2S token management, logging, and validation utilities
Microsoft.IdentityModel.Protocols.cs	Auto-generated stub for OpenID Connect protocol configuration and retrieval
Microsoft.IdentityModel.Protocols.SignedHttpRequest.cs	Auto-generated stub for signed HTTP request validation and creation
Microsoft.IdentityModel.Protocols.OpenIdConnect.cs	Auto-generated stub for OpenID Connect message handling and configuration
Microsoft.IdentityModel.Logging.cs	Auto-generated stub for identity model event logging and telemetry
Microsoft.IdentityModel.JsonWebTokens.cs	Auto-generated stub for JWT token handling and validation
Microsoft.IdentityModel.Abstractions.cs	Auto-generated stub for identity model logging abstractions
Microsoft.Identity.ServiceEssentials.TokenAcquisition.cs	Auto-generated stub for token acquisition functionality
Microsoft.Identity.ServiceEssentials.Modules.TrV2Module.cs	Auto-generated stub for tenant restrictions v2 module
Microsoft.Identity.ServiceEssentials.Core.cs	Auto-generated stub for core service essentials types
Microsoft.Identity.ServiceEssentials.Caching.cs	Auto-generated stub for caching functionality
Microsoft.Identity.ServiceEssentials.Authentication.cs	Auto-generated stub for authentication ticket providers
Microsoft.Identity.Abstractions.cs	Auto-generated stub for identity abstractions and token acquisition
Microsoft.Extensions.Primitives.cs	Auto-generated stub for extension primitive types
Microsoft.Extensions.Options.cs	Auto-generated stub for options pattern types
Microsoft.Extensions.Options.ConfigurationExtensions.cs	Auto-generated stub for configuration binding extensions
Microsoft.Extensions.Logging.cs	Auto-generated stub for logging infrastructure
Microsoft.Extensions.Logging.Abstractions.cs	Auto-generated stub for logging abstraction interfaces
Microsoft.Extensions.DependencyInjection.cs	Auto-generated stub for dependency injection container
AadIssuerValidationDataFlow.qlref	Test query reference for AAD issuer validation data flow analysis
security-validation-disabled.qlref	Test query reference for JWT security validation checks

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-advanced-security]

CodeQL found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

[jketema]

Wrong repository, I believe. Closing.