hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-27 17:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Add change note

Browse Source
This commit is contained in:
Asger F
2025-01-22 11:49:48 +01:00
parent 8771bf81b3
commit 051fa66af1
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
javascript/ql/src/change-notes/2025-01-22-view-component-inputs.md Normal file
View File

@@ -0,0 +1,7 @@
---
category: majorAnalysis
---
* Added a new threat model kind called `view-component-input`, which can enabled with [advanced setup](https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#extending-codeql-coverage-with-threat-models).
When enabled, all React props, Vue props, and input fields in an Angular component are seen as taint sources, even if none of the corresponding instantiation sites appear to pass in a tainted value.
Some users may prefer this as a "defense in depth" option but note that it may result in false positives.
Regardless of whether the threat model is enabled, CodeQL will propagate taint from the instantiation sites of such components into the components themselves.