Release preparation for version 2.13.0

cpp/ql/lib/CHANGELOG.md

@@ -1,3 +1,29 @@
+## 0.7.0
+
+### Breaking Changes
+
+* The internal `SsaConsistency` module has been moved from `SSAConstruction` to `SSAConsitency`, and the deprecated `SSAConsistency` module has been removed.
+
+### Deprecated APIs
+
+* The predicates single-parameter predicates `ArrayOrVectorAggregateLiteral.getElementExpr` and `ClassAggregateLiteral.getFieldExpr` have been deprecated in favor of `ArrayOrVectorAggregateLiteral.getAnElementExpr` and `ClassAggregateLiteral.getAFieldExpr`.
+* The recently introduced new data flow and taint tracking APIs have had a
+  number of module and predicate renamings. The old APIs remain in place for
+  now.
+* The `SslContextCallAbstractConfig`, `SslContextCallConfig`, `SslContextCallBannedProtocolConfig`, `SslContextCallTls12ProtocolConfig`, `SslContextCallTls13ProtocolConfig`, `SslContextCallTlsProtocolConfig`, `SslContextFlowsToSetOptionConfig`, `SslOptionConfig` dataflow configurations from `BoostorgAsio` have been deprecated. Please use `SslContextCallConfigSig`, `SslContextCallGlobal`, `SslContextCallFlow`, `SslContextCallBannedProtocolFlow`, `SslContextCallTls12ProtocolFlow`, `SslContextCallTls13ProtocolFlow`, `SslContextCallTlsProtocolFlow`, `SslContextFlowsToSetOptionFlow`.
+
+### New Features
+
+* Added overridable predicates `getSizeExpr` and `getSizeMult` to the `BufferAccess` class (`semmle.code.cpp.security.BufferAccess.qll`). This makes it possible to model a larger class of buffer reads and writes using the library.
+
+### Minor Analysis Improvements
+
+* The `BufferAccess` library (`semmle.code.cpp.security.BufferAccess`) no longer matches buffer accesses inside unevaluated contexts (such as inside `sizeof` or `decltype` expressions). As a result, queries using this library may see fewer false positives.
+
+### Bug Fixes
+
+* Fixed some accidental predicate visibility in the backwards-compatible wrapper for data flow configurations. In particular `DataFlow::hasFlowPath`, `DataFlow::hasFlow`, `DataFlow::hasFlowTo`, and `DataFlow::hasFlowToExpr` were accidentally exposed in a single version.
+
 ## 0.6.1
 
 No user-facing changes.

cpp/ql/lib/change-notes/2013-03-20-ssa-consistency.md

@@ -1,4 +0,0 @@
----
-category: breaking
----
-* The internal `SsaConsistency` module has been moved from `SSAConstruction` to `SSAConsitency`, and the deprecated `SSAConsistency` module has been removed.

cpp/ql/lib/change-notes/2023-03-20-boost-deprecated-dataflow-configurations.md

@@ -1,4 +0,0 @@
----
-category: deprecated
----
-* The `SslContextCallAbstractConfig`, `SslContextCallConfig`, `SslContextCallBannedProtocolConfig`, `SslContextCallTls12ProtocolConfig`, `SslContextCallTls13ProtocolConfig`, `SslContextCallTlsProtocolConfig`, `SslContextFlowsToSetOptionConfig`, `SslOptionConfig` dataflow configurations from `BoostorgAsio` have been deprecated. Please use `SslContextCallConfigSig`, `SslContextCallGlobal`, `SslContextCallFlow`, `SslContextCallBannedProtocolFlow`, `SslContextCallTls12ProtocolFlow`, `SslContextCallTls13ProtocolFlow`, `SslContextCallTlsProtocolFlow`, `SslContextFlowsToSetOptionFlow`.

cpp/ql/lib/change-notes/2023-03-21-buffer-access.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The `BufferAccess` library (`semmle.code.cpp.security.BufferAccess`) no longer matches buffer accesses inside unevaluated contexts (such as inside `sizeof` or `decltype` expressions). As a result, queries using this library may see fewer false positives.

cpp/ql/lib/change-notes/2023-03-23-dataflow-renaming.md

@@ -1,6 +0,0 @@
----
-category: deprecated
----
-* The recently introduced new data flow and taint tracking APIs have had a
-  number of module and predicate renamings. The old APIs remain in place for
-  now.

cpp/ql/lib/change-notes/2023-03-30-bufferaccess.md

@@ -1,4 +0,0 @@
----
-category: feature
----
-* Added overridable predicates `getSizeExpr` and `getSizeMult` to the `BufferAccess` class (`semmle.code.cpp.security.BufferAccess.qll`). This makes it possible to model a larger class of buffer reads and writes using the library.

cpp/ql/lib/change-notes/2023-04-04-repeated-initializers.md

@@ -1,4 +0,0 @@
----
-category: deprecated
----
-* The predicates single-parameter predicates `ArrayOrVectorAggregateLiteral.getElementExpr` and `ClassAggregateLiteral.getFieldExpr` have been deprecated in favor of `ArrayOrVectorAggregateLiteral.getAnElementExpr` and `ClassAggregateLiteral.getAFieldExpr`.

cpp/ql/lib/change-notes/released/0.7.0.md

@@ -0,0 +1,25 @@
+## 0.7.0
+
+### Breaking Changes
+
+* The internal `SsaConsistency` module has been moved from `SSAConstruction` to `SSAConsitency`, and the deprecated `SSAConsistency` module has been removed.
+
+### Deprecated APIs
+
+* The predicates single-parameter predicates `ArrayOrVectorAggregateLiteral.getElementExpr` and `ClassAggregateLiteral.getFieldExpr` have been deprecated in favor of `ArrayOrVectorAggregateLiteral.getAnElementExpr` and `ClassAggregateLiteral.getAFieldExpr`.
+* The recently introduced new data flow and taint tracking APIs have had a
+  number of module and predicate renamings. The old APIs remain in place for
+  now.
+* The `SslContextCallAbstractConfig`, `SslContextCallConfig`, `SslContextCallBannedProtocolConfig`, `SslContextCallTls12ProtocolConfig`, `SslContextCallTls13ProtocolConfig`, `SslContextCallTlsProtocolConfig`, `SslContextFlowsToSetOptionConfig`, `SslOptionConfig` dataflow configurations from `BoostorgAsio` have been deprecated. Please use `SslContextCallConfigSig`, `SslContextCallGlobal`, `SslContextCallFlow`, `SslContextCallBannedProtocolFlow`, `SslContextCallTls12ProtocolFlow`, `SslContextCallTls13ProtocolFlow`, `SslContextCallTlsProtocolFlow`, `SslContextFlowsToSetOptionFlow`.
+
+### New Features
+
+* Added overridable predicates `getSizeExpr` and `getSizeMult` to the `BufferAccess` class (`semmle.code.cpp.security.BufferAccess.qll`). This makes it possible to model a larger class of buffer reads and writes using the library.
+
+### Minor Analysis Improvements
+
+* The `BufferAccess` library (`semmle.code.cpp.security.BufferAccess`) no longer matches buffer accesses inside unevaluated contexts (such as inside `sizeof` or `decltype` expressions). As a result, queries using this library may see fewer false positives.
+
+### Bug Fixes
+
+* Fixed some accidental predicate visibility in the backwards-compatible wrapper for data flow configurations. In particular `DataFlow::hasFlowPath`, `DataFlow::hasFlow`, `DataFlow::hasFlowTo`, and `DataFlow::hasFlowToExpr` were accidentally exposed in a single version.

cpp/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.6.1
+lastReleaseVersion: 0.7.0

cpp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 0.7.0-dev
+version: 0.7.0
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp

cpp/ql/src/CHANGELOG.md

@@ -1,3 +1,13 @@
+## 0.6.0
+
+### New Queries
+
+* The query `cpp/redundant-null-check-simple` has been promoted to Code Scanning. The query finds cases where a pointer is compared to null after it has already been dereferenced. Such comparisons likely indicate a bug at the place where the pointer is dereferenced, or where the pointer is compared to null.
+
+### Minor Analysis Improvements
+
+* The query `cpp/tainted-arithmetic` now also flags possible overflows in arithmetic assignment operations.
+
 ## 0.5.6
 
 No user-facing changes.

cpp/ql/src/change-notes/2023-04-06-arith-tainted-assign-operations.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The query `cpp/tainted-arithmetic` now also flags possible overflows in arithmetic assignment operations.

cpp/ql/src/change-notes/released/0.6.0.md

@@ -1,4 +1,9 @@
----
-category: newQuery
----
-* The query `cpp/redundant-null-check-simple` has been promoted to Code Scanning. The query finds cases where a pointer is compared to null after it has already been dereferenced. Such comparisons likely indicate a bug at the place where the pointer is dereferenced, or where the pointer is compared to null.
+## 0.6.0
+
+### New Queries
+
+* The query `cpp/redundant-null-check-simple` has been promoted to Code Scanning. The query finds cases where a pointer is compared to null after it has already been dereferenced. Such comparisons likely indicate a bug at the place where the pointer is dereferenced, or where the pointer is compared to null.
+
+### Minor Analysis Improvements
+
+* The query `cpp/tainted-arithmetic` now also flags possible overflows in arithmetic assignment operations.

cpp/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.5.6
+lastReleaseVersion: 0.6.0

cpp/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-queries
-version: 0.6.0-dev
+version: 0.6.0
 groups: 
   - cpp
   - queries

csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 1.5.0
+
+No user-facing changes.
+
 ## 1.4.6
 
 No user-facing changes.

csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.5.0.md

@@ -0,0 +1,3 @@
+## 1.5.0
+
+No user-facing changes.

csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.4.6
+lastReleaseVersion: 1.5.0

csharp/ql/campaigns/Solorigate/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-all
-version: 1.5.0-dev
+version: 1.5.0
 groups:
     - csharp
     - solorigate

csharp/ql/campaigns/Solorigate/src/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 1.5.0
+
+No user-facing changes.
+
 ## 1.4.6
 
 No user-facing changes.

csharp/ql/campaigns/Solorigate/src/change-notes/released/1.5.0.md

@@ -0,0 +1,3 @@
+## 1.5.0
+
+No user-facing changes.

csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.4.6
+lastReleaseVersion: 1.5.0

csharp/ql/campaigns/Solorigate/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-queries
-version: 1.5.0-dev
+version: 1.5.0
 groups:
     - csharp
     - solorigate

csharp/ql/lib/CHANGELOG.md

@@ -1,3 +1,15 @@
+## 0.6.0
+
+### Deprecated APIs
+
+* The recently introduced new data flow and taint tracking APIs have had a
+  number of module and predicate renamings. The old APIs remain in place for
+  now.
+
+### Bug Fixes
+
+* Fixed some accidental predicate visibility in the backwards-compatible wrapper for data flow configurations. In particular `DataFlow::hasFlowPath`, `DataFlow::hasFlow`, `DataFlow::hasFlowTo`, and `DataFlow::hasFlowToExpr` were accidentally exposed in a single version.
+
 ## 0.5.6
 
 No user-facing changes.

csharp/ql/lib/change-notes/2023-03-23-dataflow-renaming.md

@@ -1,6 +0,0 @@
----
-category: deprecated
----
-* The recently introduced new data flow and taint tracking APIs have had a
-  number of module and predicate renamings. The old APIs remain in place for
-  now.

csharp/ql/lib/change-notes/released/0.6.0.md

@@ -1,4 +1,11 @@
----
-category: fix
----
+## 0.6.0
+
+### Deprecated APIs
+
+* The recently introduced new data flow and taint tracking APIs have had a
+  number of module and predicate renamings. The old APIs remain in place for
+  now.
+
+### Bug Fixes
+
 * Fixed some accidental predicate visibility in the backwards-compatible wrapper for data flow configurations. In particular `DataFlow::hasFlowPath`, `DataFlow::hasFlow`, `DataFlow::hasFlowTo`, and `DataFlow::hasFlowToExpr` were accidentally exposed in a single version.

csharp/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.5.6
+lastReleaseVersion: 0.6.0

csharp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-all
-version: 0.6.0-dev
+version: 0.6.0
 groups: csharp
 dbscheme: semmlecode.csharp.dbscheme
 extractor: csharp

csharp/ql/src/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 0.6.0
+
+### Minor Analysis Improvements
+
+* The query `cs/web/debug-binary` now disregards the `debug` attribute in case there is a transformation that removes it.
+
 ## 0.5.6
 
 No user-facing changes.

csharp/ql/src/change-notes/2023-03-23-cs-web-debug-binary.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The query `cs/web/debug-binary` now disregards the `debug` attribute in case there is a transformation that removes it.

csharp/ql/src/change-notes/released/0.6.0.md

@@ -0,0 +1,5 @@
+## 0.6.0
+
+### Minor Analysis Improvements
+
+* The query `cs/web/debug-binary` now disregards the `debug` attribute in case there is a transformation that removes it.

csharp/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.5.6
+lastReleaseVersion: 0.6.0

csharp/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-queries
-version: 0.6.0-dev
+version: 0.6.0
 groups: 
   - csharp
   - queries

go/ql/lib/CHANGELOG.md

@@ -1,3 +1,15 @@
+## 0.5.0
+
+### Deprecated APIs
+
+* The recently introduced new data flow and taint tracking APIs have had a
+  number of module and predicate renamings. The old APIs remain in place for
+  now.
+
+### Bug Fixes
+
+* Fixed some accidental predicate visibility in the backwards-compatible wrapper for data flow configurations. In particular `DataFlow::hasFlowPath`, `DataFlow::hasFlow`, `DataFlow::hasFlowTo`, and `DataFlow::hasFlowToExpr` were accidentally exposed in a single version.
+
 ## 0.4.6
 
 No user-facing changes.

go/ql/lib/change-notes/2023-03-23-dataflow-renaming.md

@@ -1,6 +0,0 @@
----
-category: deprecated
----
-* The recently introduced new data flow and taint tracking APIs have had a
-  number of module and predicate renamings. The old APIs remain in place for
-  now.

go/ql/lib/change-notes/2023-03-28-dataflow-rm-footgun.md

@@ -1,4 +0,0 @@
----
-category: fix
----
-* Fixed some accidental predicate visibility in the backwards-compatible wrapper for data flow configurations. In particular `DataFlow::hasFlowPath`, `DataFlow::hasFlow`, `DataFlow::hasFlowTo`, and `DataFlow::hasFlowToExpr` were accidentally exposed in a single version.

go/ql/lib/change-notes/released/0.5.0.md

@@ -1,4 +1,11 @@
----
-category: fix
----
+## 0.5.0
+
+### Deprecated APIs
+
+* The recently introduced new data flow and taint tracking APIs have had a
+  number of module and predicate renamings. The old APIs remain in place for
+  now.
+
+### Bug Fixes
+
 * Fixed some accidental predicate visibility in the backwards-compatible wrapper for data flow configurations. In particular `DataFlow::hasFlowPath`, `DataFlow::hasFlow`, `DataFlow::hasFlowTo`, and `DataFlow::hasFlowToExpr` were accidentally exposed in a single version.

go/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.4.6
+lastReleaseVersion: 0.5.0

go/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/go-all
-version: 0.5.0-dev
+version: 0.5.0
 groups: go
 dbscheme: go.dbscheme
 extractor: go

go/ql/src/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 0.5.0
+
+### Minor Analysis Improvements
+
+* The receiver arguments of `net/http.Header.Set` and `.Del` are no longer flagged by query `go/untrusted-data-to-external-api`.
+
 ## 0.4.6
 
 No user-facing changes.

go/ql/src/change-notes/released/0.5.0.md

@@ -1,4 +1,5 @@
----
-category: minorAnalysis
----
+## 0.5.0
+
+### Minor Analysis Improvements
+
 * The receiver arguments of `net/http.Header.Set` and `.Del` are no longer flagged by query `go/untrusted-data-to-external-api`.

go/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.4.6
+lastReleaseVersion: 0.5.0

go/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/go-queries
-version: 0.5.0-dev
+version: 0.5.0
 groups:
   - go
   - queries

java/ql/lib/CHANGELOG.md

@@ -1,3 +1,76 @@
+## 0.6.0
+
+### Deprecated APIs
+
+* The `execTainted` predicate in `CommandLineQuery.qll` has been deprecated and replaced with the predicate `execIsTainted`.
+* The recently introduced new data flow and taint tracking APIs have had a
+  number of module and predicate renamings. The old APIs remain in place for
+  now.
+* The `WebViewDubuggingQuery` library has been renamed to `WebViewDebuggingQuery` to fix the typo in the file name. `WebViewDubuggingQuery` is now deprecated. 
+
+### New Features
+
+* Predicates `Compilation.getExpandedArgument` and `Compilation.getAnExpandedArgument` has been added.
+
+### Minor Analysis Improvements
+
+* Fixed a bug in the regular expression used to identify sensitive information in `SensitiveActions::getCommonSensitiveInfoRegex`. This may affect the results of the queries `java/android/sensitive-communication`, `java/android/sensitive-keyboard-cache`, and `java/sensitive-log`. 
+* Added a summary model for the `java.lang.UnsupportedOperationException(String)` constructor.
+* The filenames embedded in `Compilation.toString()` now use `/` as the path separator on all platforms.
+* Added models for the following packages:
+  * java.lang
+  * java.net
+  * java.nio.file
+* Added models for the following packages:
+  * java.io
+  * java.lang.module
+  * org.apache.commons.io
+* Added the `TaintedPathQuery.qll` library to provide the `TaintedPathFlow` and `TaintedPathLocalFlow` taint-tracking modules to reason about tainted path vulnerabilities.
+* Added the `ZipSlipQuery.qll` library to provide the `ZipSlipFlow` taint-tracking module to reason about zip-slip vulnerabilities.
+* Added the `InsecureBeanValidationQuery.qll` library to provide the `BeanValidationFlow` taint-tracking module to reason about bean validation vulnerabilities.
+* Added the `XssQuery.qll` library to provide the `XssFlow` taint-tracking module to reason about cross site scripting vulnerabilities.
+* Added the `LdapInjectionQuery.qll` library to provide the `LdapInjectionFlow` taint-tracking module to reason about LDAP injection vulnerabilities.
+* Added the `ResponseSplittingQuery.qll` library to provide the `ResponseSplittingFlow` taint-tracking module to reason about response splitting vulnerabilities.
+* Added the `ExternallyControlledFormatStringQuery.qll` library to provide the `ExternallyControlledFormatStringFlow` taint-tracking module to reason about externally controlled format string vulnerabilities.
+* Improved the handling of addition in the range analysis. This can cause in minor changes to the results produced by `java/index-out-of-bounds` and `java/constant-comparison`.
+* A new models as data sink kind `command-injection` has been added.
+* The queries `java/command-line-injection` and `java/concatenated-command-line` now can be extended using the `command-injection` models as data sink kind.
+* Added models for the following packages:
+
+  * com.google.common.io
+  * java.lang
+  * java.nio.file
+  * kotlin.io
+  * org.apache.commons.httpclient.util
+  * org.apache.http.client
+  * org.eclipse.jetty.client
+* Added more sink and summary dataflow models for the following packages:
+  * `hudson.model`
+  * `hudson.scm`
+  * `hudson.util`
+* Added more sink and summary dataflow models for the following packages:
+  * `hudson.cli`
+  * `hudson.lifecycle`
+  * `hudson`
+  * `hudson.util.io`
+* Added the extensible abstract class `JndiInjectionSanitizer`. Now this class can be extended to add more sanitizers to the `java/jndi-injection` query.
+* Added more sink and summary dataflow models for the following packages:
+  * `java.net`
+  * `java.nio.file`
+  * `javax.imageio.stream`
+  * `javax.naming`
+  * `javax.servlet`
+  * `org.geogebra.web.full.main`
+* Added a summary model for the `nativeSQL` method of the `java.sql.Connection` interface.
+* Added sink and summary dataflow models for the Jenkins and Netty frameworks.
+* The Models as Data syntax for selecting the qualifier has been changed from `-1` to `this` (e.g. `Argument[-1]` is now written as `Argument[this]`).
+* Added sources and flow step models for the Netty framework up to version 4.1.
+* Added more dataflow models for frequently-used JDK APIs.
+
+### Bug Fixes
+
+* Fixed some accidental predicate visibility in the backwards-compatible wrapper for data flow configurations. In particular `DataFlow::hasFlowPath`, `DataFlow::hasFlow`, `DataFlow::hasFlowTo`, and `DataFlow::hasFlowToExpr` were accidentally exposed in a single version.
+
 ## 0.5.6
 
 No user-facing changes.

java/ql/lib/change-notes/2023-02-15-add-top-jdk-models.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Added more dataflow models for frequently-used JDK APIs.

java/ql/lib/change-notes/2023-02-28-netty.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Added sources and flow step models for the Netty framework up to version 4.1.

java/ql/lib/change-notes/2023-03-17-madargumentthis.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The Models as Data syntax for selecting the qualifier has been changed from `-1` to `this` (e.g. `Argument[-1]` is now written as `Argument[this]`).

java/ql/lib/change-notes/2023-03-20-dataflow-models.md

@@ -1,10 +0,0 @@
----
-category: minorAnalysis
----
-* Added more sink and summary dataflow models for the following packages:
-  * `java.net`
-  * `java.nio.file`
-  * `javax.imageio.stream`
-  * `javax.naming`
-  * `javax.servlet`
-  * `org.geogebra.web.full.main`

java/ql/lib/change-notes/2023-03-20-nativesql-summary.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Added a summary model for the `nativeSQL` method of the `java.sql.Connection` interface.

java/ql/lib/change-notes/2023-03-20-netty-hudson-models.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Added sink and summary dataflow models for the Jenkins and Netty frameworks.

java/ql/lib/change-notes/2023-03-22-deprecate-webviewdubuggingenabledquery.md

@@ -1,4 +0,0 @@
----
-category: deprecated
----
-* The `WebViewDubuggingQuery` library has been renamed to `WebViewDebuggingQuery` to fix the typo in the file name. `WebViewDubuggingQuery` is now deprecated. 

java/ql/lib/change-notes/2023-03-22-expanded-args.md

@@ -1,4 +0,0 @@
----
-category: feature
----
-* Predicates `Compilation.getExpandedArgument` and `Compilation.getAnExpandedArgument` has been added.

java/ql/lib/change-notes/2023-03-23-dataflow-renaming.md

@@ -1,6 +0,0 @@
----
-category: deprecated
----
-* The recently introduced new data flow and taint tracking APIs have had a
-  number of module and predicate renamings. The old APIs remain in place for
-  now.

java/ql/lib/change-notes/2023-03-23-jndi-sanitizer.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Added the extensible abstract class `JndiInjectionSanitizer`. Now this class can be extended to add more sanitizers to the `java/jndi-injection` query.

java/ql/lib/change-notes/2023-03-27-hudson-models.md

@@ -1,7 +0,0 @@
----
-category: minorAnalysis
----
-* Added more sink and summary dataflow models for the following packages:
-  * `hudson.model`
-  * `hudson.scm`
-  * `hudson.util`

java/ql/lib/change-notes/2023-03-27-more-hudson-models.md

@@ -1,8 +0,0 @@
----
-category: minorAnalysis
----
-* Added more sink and summary dataflow models for the following packages:
-  * `hudson.cli`
-  * `hudson.lifecycle`
-  * `hudson`
-  * `hudson.util.io`

java/ql/lib/change-notes/2023-03-28-cmdi-queries-models-as-data.md

@@ -1,5 +0,0 @@
----
-category: minorAnalysis
----
-* A new models as data sink kind `command-injection` has been added.
-* The queries `java/command-line-injection` and `java/concatenated-command-line` now can be extended using the `command-injection` models as data sink kind.

java/ql/lib/change-notes/2023-03-28-dataflow-rm-footgun.md

@@ -1,4 +0,0 @@
----
-category: fix
----
-* Fixed some accidental predicate visibility in the backwards-compatible wrapper for data flow configurations. In particular `DataFlow::hasFlowPath`, `DataFlow::hasFlow`, `DataFlow::hasFlowTo`, and `DataFlow::hasFlowToExpr` were accidentally exposed in a single version.

java/ql/lib/change-notes/2023-03-28-deprecated-exectainted.md

@@ -1,5 +0,0 @@
----
-category: deprecated
----
-* The `execTainted` predicate in `CommandLineQuery.qll` has been deprecated and replaced with the predicate `execIsTainted`.
-

java/ql/lib/change-notes/2023-03-28-new-models.md

@@ -1,12 +0,0 @@
----
-category: minorAnalysis
----
-* Added models for the following packages:
-
-  * com.google.common.io
-  * java.lang
-  * java.nio.file
-  * kotlin.io
-  * org.apache.commons.httpclient.util
-  * org.apache.http.client
-  * org.eclipse.jetty.client

java/ql/lib/change-notes/2023-03-29-moved-configurations-for-queries.md

@@ -1,10 +0,0 @@
----
-category: minorAnalysis
----
-* Added the `TaintedPathQuery.qll` library to provide the `TaintedPathFlow` and `TaintedPathLocalFlow` taint-tracking modules to reason about tainted path vulnerabilities.
-* Added the `ZipSlipQuery.qll` library to provide the `ZipSlipFlow` taint-tracking module to reason about zip-slip vulnerabilities.
-* Added the `InsecureBeanValidationQuery.qll` library to provide the `BeanValidationFlow` taint-tracking module to reason about bean validation vulnerabilities.
-* Added the `XssQuery.qll` library to provide the `XssFlow` taint-tracking module to reason about cross site scripting vulnerabilities.
-* Added the `LdapInjectionQuery.qll` library to provide the `LdapInjectionFlow` taint-tracking module to reason about LDAP injection vulnerabilities.
-* Added the `ResponseSplittingQuery.qll` library to provide the `ResponseSplittingFlow` taint-tracking module to reason about response splitting vulnerabilities.
-* Added the `ExternallyControlledFormatStringQuery.qll` library to provide the `ExternallyControlledFormatStringFlow` taint-tracking module to reason about externally controlled format string vulnerabilities.

java/ql/lib/change-notes/2023-03-29-rangeanalysis-add.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Improved the handling of addition in the range analysis. This can cause in minor changes to the results produced by `java/index-out-of-bounds` and `java/constant-comparison`.

java/ql/lib/change-notes/2023-03-31-compilation-names.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The filenames embedded in `Compilation.toString()` now use `/` as the path separator on all platforms.

java/ql/lib/change-notes/2023-03-31-new-models-tr2284.md

@@ -1,7 +0,0 @@
----
-category: minorAnalysis
----
-* Added models for the following packages:
-  * java.io
-  * java.lang.module
-  * org.apache.commons.io

java/ql/lib/change-notes/2023-03-31-new-models.md

@@ -1,7 +0,0 @@
----
-category: minorAnalysis
----
-* Added models for the following packages:
-  * java.lang
-  * java.net
-  * java.nio.file

java/ql/lib/change-notes/2023-04-03-UnsupportedOperationException-summary.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Added a summary model for the `java.lang.UnsupportedOperationException(String)` constructor.

java/ql/lib/change-notes/2023-04-13-sensitive-actions-fix-regex.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Fixed a bug in the regular expression used to identify sensitive information in `SensitiveActions::getCommonSensitiveInfoRegex`. This may affect the results of the queries `java/android/sensitive-communication`, `java/android/sensitive-keyboard-cache`, and `java/sensitive-log`. 

java/ql/lib/change-notes/released/0.6.0.md

@@ -0,0 +1,72 @@
+## 0.6.0
+
+### Deprecated APIs
+
+* The `execTainted` predicate in `CommandLineQuery.qll` has been deprecated and replaced with the predicate `execIsTainted`.
+* The recently introduced new data flow and taint tracking APIs have had a
+  number of module and predicate renamings. The old APIs remain in place for
+  now.
+* The `WebViewDubuggingQuery` library has been renamed to `WebViewDebuggingQuery` to fix the typo in the file name. `WebViewDubuggingQuery` is now deprecated. 
+
+### New Features
+
+* Predicates `Compilation.getExpandedArgument` and `Compilation.getAnExpandedArgument` has been added.
+
+### Minor Analysis Improvements
+
+* Fixed a bug in the regular expression used to identify sensitive information in `SensitiveActions::getCommonSensitiveInfoRegex`. This may affect the results of the queries `java/android/sensitive-communication`, `java/android/sensitive-keyboard-cache`, and `java/sensitive-log`. 
+* Added a summary model for the `java.lang.UnsupportedOperationException(String)` constructor.
+* The filenames embedded in `Compilation.toString()` now use `/` as the path separator on all platforms.
+* Added models for the following packages:
+  * java.lang
+  * java.net
+  * java.nio.file
+* Added models for the following packages:
+  * java.io
+  * java.lang.module
+  * org.apache.commons.io
+* Added the `TaintedPathQuery.qll` library to provide the `TaintedPathFlow` and `TaintedPathLocalFlow` taint-tracking modules to reason about tainted path vulnerabilities.
+* Added the `ZipSlipQuery.qll` library to provide the `ZipSlipFlow` taint-tracking module to reason about zip-slip vulnerabilities.
+* Added the `InsecureBeanValidationQuery.qll` library to provide the `BeanValidationFlow` taint-tracking module to reason about bean validation vulnerabilities.
+* Added the `XssQuery.qll` library to provide the `XssFlow` taint-tracking module to reason about cross site scripting vulnerabilities.
+* Added the `LdapInjectionQuery.qll` library to provide the `LdapInjectionFlow` taint-tracking module to reason about LDAP injection vulnerabilities.
+* Added the `ResponseSplittingQuery.qll` library to provide the `ResponseSplittingFlow` taint-tracking module to reason about response splitting vulnerabilities.
+* Added the `ExternallyControlledFormatStringQuery.qll` library to provide the `ExternallyControlledFormatStringFlow` taint-tracking module to reason about externally controlled format string vulnerabilities.
+* Improved the handling of addition in the range analysis. This can cause in minor changes to the results produced by `java/index-out-of-bounds` and `java/constant-comparison`.
+* A new models as data sink kind `command-injection` has been added.
+* The queries `java/command-line-injection` and `java/concatenated-command-line` now can be extended using the `command-injection` models as data sink kind.
+* Added models for the following packages:
+
+  * com.google.common.io
+  * java.lang
+  * java.nio.file
+  * kotlin.io
+  * org.apache.commons.httpclient.util
+  * org.apache.http.client
+  * org.eclipse.jetty.client
+* Added more sink and summary dataflow models for the following packages:
+  * `hudson.model`
+  * `hudson.scm`
+  * `hudson.util`
+* Added more sink and summary dataflow models for the following packages:
+  * `hudson.cli`
+  * `hudson.lifecycle`
+  * `hudson`
+  * `hudson.util.io`
+* Added the extensible abstract class `JndiInjectionSanitizer`. Now this class can be extended to add more sanitizers to the `java/jndi-injection` query.
+* Added more sink and summary dataflow models for the following packages:
+  * `java.net`
+  * `java.nio.file`
+  * `javax.imageio.stream`
+  * `javax.naming`
+  * `javax.servlet`
+  * `org.geogebra.web.full.main`
+* Added a summary model for the `nativeSQL` method of the `java.sql.Connection` interface.
+* Added sink and summary dataflow models for the Jenkins and Netty frameworks.
+* The Models as Data syntax for selecting the qualifier has been changed from `-1` to `this` (e.g. `Argument[-1]` is now written as `Argument[this]`).
+* Added sources and flow step models for the Netty framework up to version 4.1.
+* Added more dataflow models for frequently-used JDK APIs.
+
+### Bug Fixes
+
+* Fixed some accidental predicate visibility in the backwards-compatible wrapper for data flow configurations. In particular `DataFlow::hasFlowPath`, `DataFlow::hasFlow`, `DataFlow::hasFlowTo`, and `DataFlow::hasFlowToExpr` were accidentally exposed in a single version.

java/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.5.6
+lastReleaseVersion: 0.6.0

java/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/java-all
-version: 0.6.0-dev
+version: 0.6.0
 groups: java
 dbscheme: config/semmlecode.dbscheme
 extractor: java

java/ql/src/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 0.6.0
+
+### New Queries
+
+* The query `java/insecure-ldap-auth` has been promoted from experimental to the main query pack. This query detects transmission of cleartext credentials in LDAP authentication. Insecure LDAP authentication causes sensitive information to be vulnerable to remote attackers. This query was originally [submitted as an experimental query by @luchua-bc](https://github.com/github/codeql/pull/4854)
+
 ## 0.5.6
 
 No user-facing changes.

java/ql/src/change-notes/released/0.6.0.md

@@ -1,4 +1,5 @@
----
-category: newQuery
----
-* The query `java/insecure-ldap-auth` has been promoted from experimental to the main query pack. This query detects transmission of cleartext credentials in LDAP authentication. Insecure LDAP authentication causes sensitive information to be vulnerable to remote attackers. This query was originally [submitted as an experimental query by @luchua-bc](https://github.com/github/codeql/pull/4854)
+## 0.6.0
+
+### New Queries
+
+* The query `java/insecure-ldap-auth` has been promoted from experimental to the main query pack. This query detects transmission of cleartext credentials in LDAP authentication. Insecure LDAP authentication causes sensitive information to be vulnerable to remote attackers. This query was originally [submitted as an experimental query by @luchua-bc](https://github.com/github/codeql/pull/4854)

java/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.5.6
+lastReleaseVersion: 0.6.0

java/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/java-queries
-version: 0.6.0-dev
+version: 0.6.0
 groups: 
   - java
   - queries

javascript/ql/lib/CHANGELOG.md

@@ -1,3 +1,14 @@
+## 0.6.0
+
+### Major Analysis Improvements
+
+* Added support for TypeScript 5.0.
+
+### Minor Analysis Improvements
+
+* `router.push` and `router.replace` in `Next.js` are now considered as XSS sink.
+* The crypto-js module in `CryptoLibraries.qll` now supports progressive hashing with algo.update().
+
 ## 0.5.2
 
 No user-facing changes.

javascript/ql/lib/change-notes/2023-01-27-typescript-5-0.md

@@ -1,4 +0,0 @@
----
-category: majorAnalysis
----
-* Added support for TypeScript 5.0.

javascript/ql/lib/change-notes/2023-03-26-CryptoJS-progressive-hashing.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The crypto-js module in `CryptoLibraries.qll` now supports progressive hashing with algo.update().

javascript/ql/lib/change-notes/2023-04-08-NextJS-router-push.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* `router.push` and `router.replace` in `Next.js` are now considered as XSS sink.

javascript/ql/lib/change-notes/released/0.6.0.md

@@ -0,0 +1,10 @@
+## 0.6.0
+
+### Major Analysis Improvements
+
+* Added support for TypeScript 5.0.
+
+### Minor Analysis Improvements
+
+* `router.push` and `router.replace` in `Next.js` are now considered as XSS sink.
+* The crypto-js module in `CryptoLibraries.qll` now supports progressive hashing with algo.update().

javascript/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.5.2
+lastReleaseVersion: 0.6.0

javascript/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/javascript-all
-version: 0.6.0-dev
+version: 0.6.0
 groups: javascript
 dbscheme: semmlecode.javascript.dbscheme
 extractor: javascript

javascript/ql/src/CHANGELOG.md

@@ -1,3 +1,18 @@
+## 0.6.0
+
+### Minor Analysis Improvements
+
+* The `DisablingCertificateValidation.ql` query has been updated to check `createServer` from `https` for disabled certificate validation.
+* Improved the model of jQuery to account for XSS sinks where the HTML string
+  is provided via a callback. This may lead to more results for the `js/xss` query.
+* The `js/weak-cryptographic-algorithm` query now flags cryptograhic operations using a weak block mode,
+  such as AES-ECB.
+
+### Bug Fixes
+
+* Fixed a bug where a destructuring pattern could not be parsed if it had a property
+  named `get` or `set` with a default value.
+
 ## 0.5.6
 
 No user-facing changes.

javascript/ql/src/change-notes/2023-03-16-block-modes.md

@@ -1,5 +0,0 @@
----
-category: minorAnalysis
----
-* The `js/weak-cryptographic-algorithm` query now flags cryptograhic operations using a weak block mode,
-  such as AES-ECB.

javascript/ql/src/change-notes/2023-03-27-disabling-certificate-validation.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The `DisablingCertificateValidation.ql` query has been updated to check `createServer` from `https` for disabled certificate validation.

javascript/ql/src/change-notes/2023-03-27-jquery-callback-sinks.md

@@ -1,5 +0,0 @@
----
-category: minorAnalysis
----
-* Improved the model of jQuery to account for XSS sinks where the HTML string
-  is provided via a callback. This may lead to more results for the `js/xss` query.

javascript/ql/src/change-notes/2023-04-04-getset-in-pattern.md

@@ -1,5 +0,0 @@
----
-category: fix
----
-* Fixed a bug where a destructuring pattern could not be parsed if it had a property
-  named `get` or `set` with a default value.

javascript/ql/src/change-notes/released/0.6.0.md

@@ -0,0 +1,14 @@
+## 0.6.0
+
+### Minor Analysis Improvements
+
+* The `DisablingCertificateValidation.ql` query has been updated to check `createServer` from `https` for disabled certificate validation.
+* Improved the model of jQuery to account for XSS sinks where the HTML string
+  is provided via a callback. This may lead to more results for the `js/xss` query.
+* The `js/weak-cryptographic-algorithm` query now flags cryptograhic operations using a weak block mode,
+  such as AES-ECB.
+
+### Bug Fixes
+
+* Fixed a bug where a destructuring pattern could not be parsed if it had a property
+  named `get` or `set` with a default value.

javascript/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.5.6
+lastReleaseVersion: 0.6.0

javascript/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/javascript-queries
-version: 0.6.0-dev
+version: 0.6.0
 groups: 
   - javascript
   - queries

misc/suite-helpers/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 0.5.0
+
+No user-facing changes.
+
 ## 0.4.6
 
 No user-facing changes.

misc/suite-helpers/change-notes/released/0.5.0.md

@@ -0,0 +1,3 @@
+## 0.5.0
+
+No user-facing changes.

misc/suite-helpers/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.4.6
+lastReleaseVersion: 0.5.0

misc/suite-helpers/qlpack.yml

@@ -1,3 +1,3 @@
 name: codeql/suite-helpers
-version: 0.5.0-dev
+version: 0.5.0
 groups: shared

python/ql/lib/CHANGELOG.md

@@ -1,3 +1,20 @@
+## 0.9.0
+
+### Deprecated APIs
+
+* The recently introduced new data flow and taint tracking APIs have had a
+  number of module and predicate renamings. The old APIs remain in place for
+  now.
+
+### Minor Analysis Improvements
+
+* Added modeling of SQL execution in the packages `sqlite3.dbapi2`, `cassandra-driver`, `aiosqlite`, and the functions `sqlite3.Connection.executescript`/`sqlite3.Cursor.executescript` and `asyncpg.connection.connect()`.
+* Fixed module resolution so we allow imports of definitions that have had an attribute assigned to it, such as `class Foo; Foo.bar = 42`.
+
+### Bug Fixes
+
+* Fixed some accidental predicate visibility in the backwards-compatible wrapper for data flow configurations. In particular `DataFlow::hasFlowPath`, `DataFlow::hasFlow`, `DataFlow::hasFlowTo`, and `DataFlow::hasFlowToExpr` were accidentally exposed in a single version.
+
 ## 0.8.3
 
 No user-facing changes.

python/ql/lib/change-notes/2023-02-17-import-refined-variable.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Fixed module resolution so we allow imports of definitions that have had an attribute assigned to it, such as `class Foo; Foo.bar = 42`.

python/ql/lib/change-notes/2023-03-22-database-modeling.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Added modeling of SQL execution in the packages `sqlite3.dbapi2`, `cassandra-driver`, `aiosqlite`, and the functions `sqlite3.Connection.executescript`/`sqlite3.Cursor.executescript` and `asyncpg.connection.connect()`.

python/ql/lib/change-notes/2023-03-23-dataflow-renaming.md

@@ -1,6 +0,0 @@
----
-category: deprecated
----
-* The recently introduced new data flow and taint tracking APIs have had a
-  number of module and predicate renamings. The old APIs remain in place for
-  now.

python/ql/lib/change-notes/2023-03-28-dataflow-rm-footgun.md

@@ -1,4 +0,0 @@
----
-category: fix
----
-* Fixed some accidental predicate visibility in the backwards-compatible wrapper for data flow configurations. In particular `DataFlow::hasFlowPath`, `DataFlow::hasFlow`, `DataFlow::hasFlowTo`, and `DataFlow::hasFlowToExpr` were accidentally exposed in a single version.

python/ql/lib/change-notes/released/0.9.0.md

@@ -0,0 +1,16 @@
+## 0.9.0
+
+### Deprecated APIs
+
+* The recently introduced new data flow and taint tracking APIs have had a
+  number of module and predicate renamings. The old APIs remain in place for
+  now.
+
+### Minor Analysis Improvements
+
+* Added modeling of SQL execution in the packages `sqlite3.dbapi2`, `cassandra-driver`, `aiosqlite`, and the functions `sqlite3.Connection.executescript`/`sqlite3.Cursor.executescript` and `asyncpg.connection.connect()`.
+* Fixed module resolution so we allow imports of definitions that have had an attribute assigned to it, such as `class Foo; Foo.bar = 42`.
+
+### Bug Fixes
+
+* Fixed some accidental predicate visibility in the backwards-compatible wrapper for data flow configurations. In particular `DataFlow::hasFlowPath`, `DataFlow::hasFlow`, `DataFlow::hasFlowTo`, and `DataFlow::hasFlowToExpr` were accidentally exposed in a single version.

python/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.8.3
+lastReleaseVersion: 0.9.0