hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-07-03 10:35:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

Revert "Release preparation for version 2.26.0"

Browse Source
This commit is contained in:
Mario Campos
2026-06-30 13:21:27 -05:00
committed by GitHub
parent 7c73de0e3c
commit 41f2e7b6f6
188 changed files with 196 additions and 509 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
javascript/ql/src/CHANGELOG.md
View File

@@ -1,10 +1,3 @@
## 2.4.0
### New Queries
* Added a new query, `js/system-prompt-injection`, to detect cases where untrusted, user-provided values flow into the system prompt of an AI model, allowing an attacker to manipulate the model's behavior.
* Added a new experimental query, `javascript/ssrf-ipv6-transition-incomplete-guard`, to detect SSRF host-validation guards that reject private IPv4 ranges but fail to unwrap IPv6-transition forms (IPv4-mapped `::ffff:`, NAT64 `64:ff9b::`, 6to4 `2002::`), allowing the guard to be bypassed by wrapping an internal IPv4 address in a transition literal.
## 2.3.11
No user-facing changes.

8
javascript/ql/src/change-notes/released/2.4.0.md → javascript/ql/src/change-notes/2026-06-06-ssrf-ipv6-transition-incomplete-guard.md
View File

@@ -1,6 +1,4 @@
## 2.4.0
### New Queries
* Added a new query, `js/system-prompt-injection`, to detect cases where untrusted, user-provided values flow into the system prompt of an AI model, allowing an attacker to manipulate the model's behavior.
---
category: newQuery
---
* Added a new experimental query, `javascript/ssrf-ipv6-transition-incomplete-guard`, to detect SSRF host-validation guards that reject private IPv4 ranges but fail to unwrap IPv6-transition forms (IPv4-mapped `::ffff:`, NAT64 `64:ff9b::`, 6to4 `2002::`), allowing the guard to be bypassed by wrapping an internal IPv4 address in a transition literal.

5
javascript/ql/src/change-notes/2026-06-08-new-system-prompt-injection-query.md Normal file
View File

@@ -0,0 +1,5 @@
---
category: newQuery
---
* Added a new query, `js/system-prompt-injection`, to detect cases where untrusted, user-provided values flow into the system prompt of an AI model, allowing an attacker to manipulate the model's behavior.

2
javascript/ql/src/codeql-pack.release.yml
View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 2.4.0
lastReleaseVersion: 2.3.11

2
javascript/ql/src/qlpack.yml
View File

@@ -1,5 +1,5 @@
name: codeql/javascript-queries
version: 2.4.0
version: 2.3.12-dev
groups:
- javascript
- queries