From 3a381b2fbff6a059fe8729f17565c2bf2275bcf8 Mon Sep 17 00:00:00 2001 From: intrigus Date: Wed, 1 Apr 2020 16:15:09 +0200 Subject: [PATCH] Add change note --- change-notes/1.24/analysis-go.md | 1 + 1 file changed, 1 insertion(+) diff --git a/change-notes/1.24/analysis-go.md b/change-notes/1.24/analysis-go.md index 1a9dc1caeb8..dba6fb514e2 100644 --- a/change-notes/1.24/analysis-go.md +++ b/change-notes/1.24/analysis-go.md @@ -18,6 +18,7 @@ The CodeQL library for Go now contains a folder of simple "cookbook" queries tha | Incomplete URL scheme check (`go/incomplete-url-scheme-check`) | correctness, security, external/cwe/cwe-020 | Highlights checks for `javascript` URLs that do not take `data` or `vbscript` URLs into account. Results are shown on LGTM by default. | | Potentially unsafe quoting (`go/unsafe-quoting`) | correctness, security, external/cwe/cwe-078, external/cwe/cwe-089, external/cwe/cwe-094 | Highlights code that constructs a quoted string literal containing data that may itself contain quotes. Results are shown on LGTM by default. | | Size computation for allocation may overflow (`go/allocation-size-overflow`) | correctness, security, external/cwe/cwe-190 | Highlights code that computes the size of an allocation based on the size of a potentially large object. Results are shown on LGTM by default. | +| XPath injection (`go/xml/xpath-injection`) | security, external/cwe/cwe-643 | Highlights code that uses remote input in an XPath expression. Results are shown on LGTM by default. | ## Changes to existing queries