CodeQL cpp/comparison-with-wider-type (4 high-severity alerts, #69-#72) flagged
two loops in the vendored ObjectScript scanner (objectscript_common.h, in both
the _routine and _udl grammar copies) where a uint8_t counter is compared
against an int length: the reverse_marker scan and the html_marker_buffer
reversal. Both lengths are hard-bounded by MARKER_BUFFER_MAX_LEN (30), so the
uint8_t counter can never wrap and the flagged infinite loop is unreachable in
practice — but widening the counters to int removes the pattern and clears the
gate. Provably behavior-neutral (int holds every uint8_t value; length <= 30).
Recorded as a local modification in the vendored grammar MANIFEST so it is
re-applied on the next re-vendor.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
An unbounded whole-graph OPTIONAL MATCH or a GROUP BY that produces roughly one
group per node does O(bindings x groups) work in execute_return_agg and can run
for minutes on a large graph before emitting a single row. The 100k row ceiling
never fires (no rows are produced), so query_graph just hangs with no partial
result and no error (#601).
Arm a monotonic wall-clock budget (default 30s) at query entry and check it
(throttled, every 1024 iterations) in the scan, relationship-expansion and
aggregation hot loops. On expiry the query aborts with a clear, actionable error
instead of hanging. A thread-local test hook forces the budget so the guard is
covered by a deterministic reproduce-first test; a companion test confirms the
default budget does not false-positive on a normal query.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
cbm_pipeline_fqn_compute stripped the file extension for EVERY qualified
name, including File-node QNs (name=="__file__"). Two different files
whose names share a stem therefore collided on the File QN and the
graph kept only one node per stem:
- .env / .env.local / .env.production all strip to ".env" — only one
survives per directory (#1077).
- a C/C++ header and its same-stem source (NodeController.h vs .cpp)
strip to the same stem, so the header got no File node of its own,
leaving it disconnected (#964's remaining half after #983 fixed the
include→Class resolution).
File-node QNs now keep the full filename (tokenize_path splits on '/'
only, so the extension rides in the last segment and stays unique).
Extension stripping is retained for MODULE/symbol QNs (name==NULL or a
symbol name) — that stem unification is load-bearing for C/C++
declaration↔definition cross-file resolution, and is left untouched.
All 26 __file__ QN sites route through this one function, so node
creation and every lookup stay consistent.
Reproduce-first:
- fqn_file_qn_preserves_dotfile_variants_issue1077 and
fqn_file_qn_distinguishes_same_stem_header_source_issue964 assert the
distinct File QNs (RED before: both collide to the stripped stem).
- fqn_module_qn_still_strips_extension guards that module QNs are
unaffected.
- repro_issue964 now asserts the header keeps its own File node AND is
connected (CONTAINS_FILE + DEFINES the class it declares), matching
the reporter's zero-inbound disconnection metric — GREEN.
Closes#1077Closes#964
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
The #913 GLR recursion cap patches vendored ts_runtime/src/stack.c;
document it in THIRD_PARTY.md so the vendored modification is on record
and re-applied on the next ts_runtime re-vendor (Stage 4: 0.26.x). The
patch is marked inline; this adds the provenance-level note the policy
requires for any change to vendored code.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
The parallel resolver dropped a CALLS edge whenever the LSP produced a
resolution whose callee_qn was not a node in the graph buffer: the
registry fallback lived in an else that ran only when NO LSP resolution
existed, so an LSP-with-unresolvable-target left res empty and the edge
was discarded outright. The sequential pass falls THROUGH to the
registry resolver in the same situation.
This diverged the two pipelines on the exact intersection the reporter
identified (#1085): a JSX component imported through a tsconfig paths
alias. The TS LSP resolves the element ref to an alias-path QN that
never matches a def node, so lsp_target is NULL and the parallel path
dropped it — while sequential resolved it via the import_map /
unique_name registry path. On a Next.js repo this silently removed
~21% of the call graph (every alias-imported JSX composition edge), and
the parallel path is the default above 50 files, so the default index
was the broken one.
The fix runs the registry fallback whenever the LSP did not yield a
gbuf-resolvable target, matching the sequential fall-through and
restoring seq/parallel parity.
Reproduce-first: calls_jsx_component_via_tsconfig_alias_parallel_issue1085
indexes the alias+JSX shape through the parallel path (et_index_parallel
pads past the 50-file threshold) and asserts the CALLS edges land on the
component. RED before (0 edges), GREEN after.
Closes#1085
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
json_extract_prop() scanned a non-string property up to the first ',' and a
string property up to the first '"', ignoring nesting and backslash escapes.
Any array/object property was therefore truncated at its first INTERNAL comma,
and any string containing an escaped quote was cut short.
decorators: ["@Roles('OWNER', 'ADMIN')","@Get()"]
projected as: ["@Roles('OWNER'
This makes decorator/route/authz queries unusable on frameworks whose
decorators take multiple arguments (NestJS, Angular, Spring). Values are now
copied as balanced constructs, honoring string state and escape pairs; scalar
and plain-string paths are unchanged.
Signed-off-by: KolisCode <jhohantma@gmail.com>
Two review items applied maintainer-side to save a roundtrip:
1. Restore both vendored ObjectScript scanner.c files to the pristine
upstream bytes (a formatter pass had rewritten indentation/braces).
Vendored grammar files stay byte-for-byte upstream except for the
include repoint documented in MANIFEST.md - style churn breaks
upstream diffability on re-vendor.
2. The Studio Export XML sniff in detect_file_language used a raw
fopen on a repository path; cbm_fopen keeps it working on
non-ASCII Windows paths (project rule, same class as #996).
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
JAX-RS splits a route across two annotations: the verb comes from a bare
@GET/@POST/... and the path from a sibling @Path. The annotation scan
returned on the first mapping annotation, so the @GET matched, defaulted
the path to "/" and the sibling @Path was never read. Class-level @Path
was never recognized as a prefix either, because a lone @Path carries no
verb and the scan reported no route.
scan_route_annotations() now collects the whole annotation set (mapping
verb + optional inline path, and a separate JAX-RS @Path), then:
- method-level: verb required; path = inline mapping path, else @Path,
else "/"
- class-level prefix: inline mapping path, else @Path
Also recognizes bare @HEAD/@OPTIONS verbs.
Spring behavior is unchanged (mapping annotations keep their inline
path); covered by the existing test suite plus a new regression test.
Signed-off-by: Charles Queiroz <fcqueiroz@liquibase.com>
Keep the live database visible until a synced temporary generation can
replace it. Preserve destination sidecars on replacement failure and use
UTF-8-safe Windows file operations.
Signed-off-by: Nikita Bige <wargloom@gmail.com>
Martin Vogel