Merge branch 'main' into repeatedWord

go/ql/lib/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 0.2.2
+
+## 0.2.1
+
 ## 0.2.0
 
 ### Deprecated APIs

go/ql/lib/change-notes/released/0.2.1.md

@@ -0,0 +1 @@
+## 0.2.1

go/ql/lib/change-notes/released/0.2.2.md

@@ -0,0 +1 @@
+## 0.2.2

go/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.2.0
+lastReleaseVersion: 0.2.2

go/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/go-all
-version: 0.2.1-dev
+version: 0.2.3-dev
 groups: go
 dbscheme: go.dbscheme
 extractor: go

go/ql/lib/semmle/go/security/TaintedPathCustomizations.qll

@@ -70,6 +70,15 @@ module TaintedPath {
     PathAsSink() { this = any(FileSystemAccess fsa).getAPathArgument() }
   }
 
+  /**
+   * A numeric- or boolean-typed node, considered a sanitizer for path traversal.
+   */
+  class NumericOrBooleanSanitizer extends Sanitizer {
+    NumericOrBooleanSanitizer() {
+      this.getType() instanceof NumericType or this.getType() instanceof BoolType
+    }
+  }
+
   /**
    * A call to `filepath.Rel`, considered as a sanitizer for path traversal.
    */

go/ql/src/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 0.2.2
+
+## 0.2.1
+
 ## 0.2.0
 
 ## 0.1.4

go/ql/src/change-notes/2022-08-02-path-injection-sanitizer.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The query `go/path-injection` no longer considers user-controlled numeric or boolean-typed data as potentially dangerous.

go/ql/src/change-notes/released/0.2.1.md

@@ -0,0 +1 @@
+## 0.2.1

go/ql/src/change-notes/released/0.2.2.md

@@ -0,0 +1 @@
+## 0.2.2

go/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.2.0
+lastReleaseVersion: 0.2.2

go/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/go-queries
-version: 0.2.1-dev
+version: 0.2.3-dev
 groups:
   - go
   - queries