Merge branch 'main' into rust-cwe-502-unsafe-deserialization

Author: geoffw0

csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs

@@ -18,7 +18,6 @@ internal sealed partial class NugetPackageRestorer : IDisposable
         private readonly IFileProvider fileProvider;
         private readonly FileContent fileContent;
         private readonly IDotNet dotnet;
-        private readonly IRegistryProxy? registryProxy;
         private readonly IDiagnosticsWriter diagnosticsWriter;
         private readonly DependencyDirectory legacyPackageDirectory;
         private readonly DependencyDirectory missingPackageDirectory;
@@ -41,7 +40,6 @@ public NugetPackageRestorer(
             this.fileProvider = fileProvider;
             this.fileContent = fileContent;
             this.dotnet = dotnet;
-            this.registryProxy = registryProxy;
             this.diagnosticsWriter = diagnosticsWriter;
             this.logger = logger;
             this.compilationInfoContainer = compilationInfoContainer;
@@ -135,7 +133,7 @@ public HashSet<AssemblyLookupLocation> Restore()
 
             try
             {
-                var packagesConfigRestore = PackagesConfigRestoreFactory.Create(fileProvider, legacyPackageDirectory, logger, feedManager, registryProxy);
+                var packagesConfigRestore = PackagesConfigRestoreFactory.Create(fileProvider, legacyPackageDirectory, logger, feedManager);
                 var count = packagesConfigRestore.InstallPackages();
                 if (packagesConfigRestore.PackageCount > 0)
                 {

csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/PackagesConfigRestorer.cs

@@ -33,11 +33,11 @@ internal interface IPackagesConfigRestore
     /// </summary>
     internal class PackagesConfigRestoreFactory
     {
-        public static IPackagesConfigRestore Create(IFileProvider fileProvider, DependencyDirectory packageDirectory, Semmle.Util.Logging.ILogger logger, FeedManager feedManager, IRegistryProxy? registryProxy)
+        public static IPackagesConfigRestore Create(IFileProvider fileProvider, DependencyDirectory packageDirectory, Semmle.Util.Logging.ILogger logger, FeedManager feedManager)
         {
             if (SystemBuildActions.Instance.IsWindows() || SystemBuildActions.Instance.IsMonoInstalled())
             {
-                return new NugetExeWrapper(fileProvider, packageDirectory, logger, feedManager, registryProxy);
+                return new NugetExeWrapper(fileProvider, packageDirectory, logger, feedManager);
             }
 
             return new NoOpPackagesConfig(fileProvider.PackagesConfigs, logger);
@@ -52,7 +52,6 @@ private class NugetExeWrapper : IPackagesConfigRestore
         {
             private readonly string? nugetExe;
             private readonly Semmle.Util.Logging.ILogger logger;
-            private readonly IRegistryProxy? registryProxy;
 
             public int PackageCount => fileProvider.PackagesConfigs.Count;
 
@@ -71,13 +70,12 @@ private class NugetExeWrapper : IPackagesConfigRestore
             /// <summary>
             /// Create the package manager for a specified source tree.
             /// </summary>
-            public NugetExeWrapper(IFileProvider fileProvider, DependencyDirectory packageDirectory, Semmle.Util.Logging.ILogger logger, FeedManager feedManager, IRegistryProxy? registryProxy)
+            public NugetExeWrapper(IFileProvider fileProvider, DependencyDirectory packageDirectory, Semmle.Util.Logging.ILogger logger, FeedManager feedManager)
             {
                 this.fileProvider = fileProvider;
                 this.packageDirectory = packageDirectory;
                 this.logger = logger;
                 this.feedManager = feedManager;
-                this.registryProxy = registryProxy;
 
                 if (fileProvider.PackagesConfigs.Count > 0)
                 {
@@ -211,9 +209,6 @@ private bool TryRestoreNugetPackage(string packagesConfig)
                     UseShellExecute = false
                 };
 
-                // Configure the proxy settings, if applicable.
-                registryProxy?.SetProcessEnvironment(pi);
-
                 var threadId = Environment.CurrentManagedThreadId;
                 void onOut(string s) => logger.LogDebug(s, threadId);
                 void onError(string s) => logger.LogError(s, threadId);

csharp/ql/lib/change-notes/2026-10-26-nugetcli-proxy-config-rollback.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Rolled back the change that set proxy and certificate environment variables for the subprocess that invokes the NuGet CLI because the environment variables were only partially respected by the target process in some cases.

misc/scripts/check-query-ids.py

@@ -20,7 +20,8 @@ def main():
     query_ids: Dict[str, List[str]] = {}
 
     # Just check src folders for now to avoid churn
-    for query_path in Path().glob("**/src/**/*.ql"):
+    # The glob can yield the same file more than once when its path contains several `src` folders.
+    for query_path in sorted(set(Path().glob("**/src/**/*.ql"))):
         # Skip compiled query packs
         if any(p == ".codeql" for p in query_path.parts):
             continue

rust/ql/lib/change-notes/2026-10-25-neutral-models-actix-connection-info.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added neutral models to inhibit spurious generated sink models for `actix_web::HttpRequest::connection_info` and the methods built on it, such as `full_url` and `url_for`. This fixes some false positive results from queries such as `rust/uncontrolled-allocation-size` and `rust/log-injection`.

rust/ql/lib/codeql/rust/frameworks/actix-web.model.yml

@@ -15,4 +15,15 @@ extensions:
       pack: codeql/rust-all
       extensible: summaryModel
     data:
-        - ["<actix_web::types::path::Path>::into_inner", "Argument[self]", "ReturnValue", "taint", "manual"]
+        - ["<actix_web::types::path::Path>::into_inner", "Argument[self]", "ReturnValue", "taint", "manual"]
+  - addsTo:
+      pack: codeql/rust-all
+      extensible: neutralModel
+    data:
+      - ["<actix_web::info::ConnectionInfo as actix_web::extract::FromRequest>::from_request", "sink", "manual"]
+      - ["<actix_web::request::HttpRequest>::connection_info", "sink", "manual"]
+      - ["<actix_web::request::HttpRequest>::full_url", "sink", "manual"]
+      - ["<actix_web::request::HttpRequest>::url_for", "sink", "manual"]
+      - ["<actix_web::request::HttpRequest>::url_for_static", "sink", "manual"]
+      - ["<actix_web::rmap::ResourceMap>::url_for", "sink", "manual"]
+      - ["<actix_web::service::ServiceRequest>::connection_info", "sink", "manual"]