hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-14 11:19:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'github:main' into fix/path-injection-read-subkind

Browse Source
This commit is contained in:
Kaixuan Li
2026-04-21 22:59:53 +10:00
committed by GitHub
parent 6d10b1582f 6efb21314a
commit 07e97e20d8
197 changed files with 1499 additions and 623 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
java/ql/lib/change-notes/2026-03-20-data-extensions-barriers.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: feature
---
* Data flow barriers and barrier guards can now be added using data extensions. For more information see [Customizing library models for Java and Kotlin](https://codeql.github.com/docs/codeql-language-guides/customizing-library-models-for-java-and-kotlin/).

4
java/ql/lib/change-notes/2026-04-04-sensitive-log-fp-reduction.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* The `java/sensitive-log` query now excludes additional common variable naming patterns that do not hold sensitive data, reducing false positives. This includes pagination/iteration tokens (`nextToken`, `pageToken`, `continuationToken`), token metadata (`tokenType`, `tokenEndpoint`, `tokenCount`), and secret metadata (`secretName`, `secretId`, `secretVersion`).

7
java/ql/lib/change-notes/2026-04-16-woodstox-xxe.md → java/ql/lib/change-notes/released/9.0.4.md
View File

@@ -1,4 +1,5 @@
---
category: minorAnalysis
---
## 9.0.4
### Minor Analysis Improvements
* The queries "Resolving XML external entity in user-controlled data" (`java/xxe`) and "Resolving XML external entity in user-controlled data from local source" (`java/xxe-local`) now recognize sinks in the Woodstox StAX library when `com.ctc.wstx.stax.WstxInputFactory` or `org.codehaus.stax2.XMLInputFactory2` are used directly.