hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 10:45:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Apply suggestions from code review

Browse Source
This commit is contained in:
Jeroen Ketema
2023-01-05 17:57:19 +01:00
committed by GitHub
parent 6e07076151
commit 170242f79c
8 changed files with 25 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
go/ql/lib/CHANGELOG.md
View File

@@ -2,7 +2,7 @@
### Breaking Changes
The signature of `allowImplicitRead` on `DataFlow::Configuration` and `TaintTracking::Configuration` has changed from `allowImplicitRead(DataFlow::Node node, DataFlow::Content c)` to `allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c)`.
* The signature of `allowImplicitRead` on `DataFlow::Configuration` and `TaintTracking::Configuration` has changed from `allowImplicitRead(DataFlow::Node node, DataFlow::Content c)` to `allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c)`.
### Deprecated APIs
@@ -11,11 +11,7 @@ The signature of `allowImplicitRead` on `DataFlow::Configuration` and `TaintTrac
### Minor Analysis Improvements
* The predicate `getNumParameter` on `FuncTypeExpr` has been changed to actually give the number of parameters. It previously gave the number of parameter declarations. `getNumParameterDecl` has been introduced to preserve this functionality.
The definition of `mayHaveSideEffects` for `ReturnStmt` was incorrect when more
than one expression was being returned. Such return statements were
effectively considered to never have side effects. This has now been fixed.
In rare circumstances `globalValueNumber` may have incorrectly treated two
values as the same when they were in fact distinct.
* The definition of `mayHaveSideEffects` for `ReturnStmt` was incorrect when more than one expression was being returned. Such return statements were effectively considered to never have side effects. This has now been fixed. In rare circumstances `globalValueNumber` may have incorrectly treated two values as the same when they were in fact distinct.
* Queries that care about SQL, such as `go/sql-injection`, now recognise SQL-consuming functions belonging to the `gorqlite` and `GoFrame` packages.
* `rsync` has been added to the list of commands which may evaluate its parameters as a shell command.

10
go/ql/lib/change-notes/released/0.4.0.md
View File

@@ -2,7 +2,7 @@
### Breaking Changes
The signature of `allowImplicitRead` on `DataFlow::Configuration` and `TaintTracking::Configuration` has changed from `allowImplicitRead(DataFlow::Node node, DataFlow::Content c)` to `allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c)`.
* The signature of `allowImplicitRead` on `DataFlow::Configuration` and `TaintTracking::Configuration` has changed from `allowImplicitRead(DataFlow::Node node, DataFlow::Content c)` to `allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c)`.
### Deprecated APIs
@@ -11,13 +11,9 @@ The signature of `allowImplicitRead` on `DataFlow::Configuration` and `TaintTrac
### Minor Analysis Improvements
* The predicate `getNumParameter` on `FuncTypeExpr` has been changed to actually give the number of parameters. It previously gave the number of parameter declarations. `getNumParameterDecl` has been introduced to preserve this functionality.
The definition of `mayHaveSideEffects` for `ReturnStmt` was incorrect when more
than one expression was being returned. Such return statements were
effectively considered to never have side effects. This has now been fixed.
In rare circumstances `globalValueNumber` may have incorrectly treated two
values as the same when they were in fact distinct.
* The definition of `mayHaveSideEffects` for `ReturnStmt` was incorrect when more than one expression was being returned. Such return statements were effectively considered to never have side effects. This has now been fixed. In rare circumstances `globalValueNumber` may have incorrectly treated two values as the same when they were in fact distinct.
* Queries that care about SQL, such as `go/sql-injection`, now recognise SQL-consuming functions belonging to the `gorqlite` and `GoFrame` packages.
* `rsync` has been added to the list of commands which may evaluate its parameters as a shell command.
* `rsync` has been added to the list of commands which may evaluate its parameters as a shell command.
### Bug Fixes