diff --git a/change-notes/2021-02-09-html-templates.md b/change-notes/2021-02-09-html-templates.md new file mode 100644 index 00000000000..d742ea4630e --- /dev/null +++ b/change-notes/2021-02-09-html-templates.md @@ -0,0 +1,2 @@ +lgtm,codescanning +* Improved our modeling of Go's builtin `html/template` package to understand that these templates provide context-sensitive escaping of HTML and Javascript special characters. This may reduce false-positives seen by the `go/reflected-xss` query, as well as other queries for which HTML escaping is relevant. diff --git a/change-notes/2021-02-10-cfg-equality-panic-edges.md b/change-notes/2021-02-10-cfg-equality-panic-edges.md new file mode 100644 index 00000000000..4a4e41b89ae --- /dev/null +++ b/change-notes/2021-02-10-cfg-equality-panic-edges.md @@ -0,0 +1,2 @@ +lgtm,codescanning +* Improved the Go control-flow graph to exclude more edges representing panics due to comparisons when the types of the compared values indicate a panic is impossible (for example, comparing integers cannot panic). This may reduce false-positives or false-negatives for any query for which control-flow is relevant.