Release preparation for version 2.7.4

python/ql/lib/CHANGELOG.md

@@ -1,3 +1,14 @@
+## 0.0.5
+
+### Minor Analysis Improvements
+
+* Added modeling of many functions from the `os` module that uses file system paths, such as `os.stat`, `os.chdir`, `os.mkdir`, and so on.
+* Added modeling of the `tempfile` module for creating temporary files and directories, such as the functions `tempfile.NamedTemporaryFile` and `tempfile.TemporaryDirectory`.
+* Extended the modeling of FastAPI such that custom subclasses of `fastapi.APIRouter` are recognized.
+* Extended the modeling of FastAPI such that `fastapi.responses.FileResponse` are considered `FileSystemAccess`.
+* Added modeling of the `posixpath`, `ntpath`, and `genericpath` modules for path operations (although these are not supposed to be used), resulting in new sinks.
+* Added modeling of `wsgiref.simple_server` applications, leading to new remote flow sources.
+
 ## 0.0.4
 
 ### Major Analysis Improvements

python/ql/lib/change-notes/2021-11-15-model-wsgiref-simple-server-app.md

@@ -1,5 +0,0 @@
----
-category: minorAnalysis
-tags: [lgtm,codescanning]
----
-* Added modeling of `wsgiref.simple_server` applications, leading to new remote flow sources.

python/ql/lib/change-notes/2021-11-16-posixpath.md

@@ -1,5 +0,0 @@
----
-category: minorAnalysis
-tags: [lgtm,codescanning]
----
-* Added modeling of the `posixpath`, `ntpath`, and `genericpath` modules for path operations (although these are not supposed to be used), resulting in new sinks.

python/ql/lib/change-notes/2021-11-24-FastAPI-Custom-APIRouter-Subclass.md

@@ -1,5 +0,0 @@
----
-category: minorAnalysis
-tags: [lgtm,codescanning]
----
-* Extended the modeling of FastAPI such that custom subclasses of `fastapi.APIRouter` are recognized.

python/ql/lib/change-notes/2021-11-24-FastAPI-FileResponse-FileSystemAccess.md

@@ -1,5 +0,0 @@
----
-category: minorAnalysis
-tags: [lgtm,codescanning]
----
-* Extended the modeling of FastAPI such that `fastapi.responses.FileResponse` are considered `FileSystemAccess`.

python/ql/lib/change-notes/2021-11-26-os-file-access.md

@@ -1,5 +0,0 @@
----
-category: minorAnalysis
-tags: [lgtm,codescanning]
----
-* Added modeling of many functions from the `os` module that uses file system paths, such as `os.stat`, `os.chdir`, `os.mkdir`, and so on.

python/ql/lib/change-notes/2021-11-26-tempfile-file-access.md

@@ -1,5 +0,0 @@
----
-category: minorAnalysis
-tags: [lgtm,codescanning]
----
-* Added modeling of the `tempfile` module for creating temporary files and directories, such as the functions `tempfile.NamedTemporaryFile` and `tempfile.TemporaryDirectory`.

python/ql/lib/change-notes/released/0.0.5.md

@@ -0,0 +1,10 @@
+## 0.0.5
+
+### Minor Analysis Improvements
+
+* Added modeling of many functions from the `os` module that uses file system paths, such as `os.stat`, `os.chdir`, `os.mkdir`, and so on.
+* Added modeling of the `tempfile` module for creating temporary files and directories, such as the functions `tempfile.NamedTemporaryFile` and `tempfile.TemporaryDirectory`.
+* Extended the modeling of FastAPI such that custom subclasses of `fastapi.APIRouter` are recognized.
+* Extended the modeling of FastAPI such that `fastapi.responses.FileResponse` are considered `FileSystemAccess`.
+* Added modeling of the `posixpath`, `ntpath`, and `genericpath` modules for path operations (although these are not supposed to be used), resulting in new sinks.
+* Added modeling of `wsgiref.simple_server` applications, leading to new remote flow sources.

python/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.0.4
+lastReleaseVersion: 0.0.5

python/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/python-all
-version: 0.0.5-dev
+version: 0.0.5
 groups: python
 dbscheme: semmlecode.python.dbscheme
 extractor: python

python/ql/src/CHANGELOG.md

@@ -1,3 +1,13 @@
+## 0.0.5
+
+### Minor Analysis Improvements
+
+* Added modeling of many functions from the `os` module that uses file system paths, such as `os.stat`, `os.chdir`, `os.mkdir`, and so on. All of these are new sinks for the _Uncontrolled data used in path expression_ (`py/path-injection`) query.
+* Added modeling of the `tempfile` module for creating temporary files and directories, such as the functions `tempfile.NamedTemporaryFile` and `tempfile.TemporaryDirectory`. The `suffix`, `prefix`, and `dir` arguments are all vulnerable to path-injection, and these are new sinks for the _Uncontrolled data used in path expression_ (`py/path-injection`) query.
+* Extended the modeling of FastAPI such that `fastapi.responses.FileResponse` are considered `FileSystemAccess`, making them sinks for the _Uncontrolled data used in path expression_ (`py/path-injection`) query.
+* Added modeling of the `posixpath`, `ntpath`, and `genericpath` modules for path operations (although these are not supposed to be used), resulting in new sinks for the _Uncontrolled data used in path expression_ (`py/path-injection`) query.
+* Added modeling of `wsgiref.simple_server` applications, leading to new remote flow sources.
+
 ## 0.0.4
 
 ### Query Metadata Changes

python/ql/src/change-notes/2021-11-15-model-wsgiref-simple-server-app.md

@@ -1,5 +0,0 @@
----
-category: minorAnalysis
-tags: [lgtm,codescanning]
----
-* Added modeling of `wsgiref.simple_server` applications, leading to new remote flow sources.

python/ql/src/change-notes/2021-11-16-posixpath.md

@@ -1,5 +0,0 @@
----
-category: minorAnalysis
-tags: [lgtm,codescanning]
----
-* Added modeling of the `posixpath`, `ntpath`, and `genericpath` modules for path operations (although these are not supposed to be used), resulting in new sinks for the _Uncontrolled data used in path expression_ (`py/path-injection`) query.

python/ql/src/change-notes/2021-11-24-FastAPI-FileResponse-FileSystemAccess.md

@@ -1,5 +0,0 @@
----
-category: minorAnalysis
-tags: [lgtm,codescanning]
----
-* Extended the modeling of FastAPI such that `fastapi.responses.FileResponse` are considered `FileSystemAccess`, making them sinks for the _Uncontrolled data used in path expression_ (`py/path-injection`) query.

python/ql/src/change-notes/2021-11-26-os-file-access.md

@@ -1,5 +0,0 @@
----
-category: minorAnalysis
-tags: [lgtm,codescanning]
----
-* Added modeling of many functions from the `os` module that uses file system paths, such as `os.stat`, `os.chdir`, `os.mkdir`, and so on. All of these are new sinks for the _Uncontrolled data used in path expression_ (`py/path-injection`) query.

python/ql/src/change-notes/2021-11-26-tempfile-file-access.md

@@ -1,5 +0,0 @@
----
-category: minorAnalysis
-tags: [lgtm,codescanning]
----
-* Added modeling of the `tempfile` module for creating temporary files and directories, such as the functions `tempfile.NamedTemporaryFile` and `tempfile.TemporaryDirectory`. The `suffix`, `prefix`, and `dir` arguments are all vulnerable to path-injection, and these are new sinks for the _Uncontrolled data used in path expression_ (`py/path-injection`) query.

python/ql/src/change-notes/released/0.0.5.md

@@ -0,0 +1,9 @@
+## 0.0.5
+
+### Minor Analysis Improvements
+
+* Added modeling of many functions from the `os` module that uses file system paths, such as `os.stat`, `os.chdir`, `os.mkdir`, and so on. All of these are new sinks for the _Uncontrolled data used in path expression_ (`py/path-injection`) query.
+* Added modeling of the `tempfile` module for creating temporary files and directories, such as the functions `tempfile.NamedTemporaryFile` and `tempfile.TemporaryDirectory`. The `suffix`, `prefix`, and `dir` arguments are all vulnerable to path-injection, and these are new sinks for the _Uncontrolled data used in path expression_ (`py/path-injection`) query.
+* Extended the modeling of FastAPI such that `fastapi.responses.FileResponse` are considered `FileSystemAccess`, making them sinks for the _Uncontrolled data used in path expression_ (`py/path-injection`) query.
+* Added modeling of the `posixpath`, `ntpath`, and `genericpath` modules for path operations (although these are not supposed to be used), resulting in new sinks for the _Uncontrolled data used in path expression_ (`py/path-injection`) query.
+* Added modeling of `wsgiref.simple_server` applications, leading to new remote flow sources.

python/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.0.4
+lastReleaseVersion: 0.0.5

python/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/python-queries
-version: 0.0.5-dev
+version: 0.0.5
 groups: python
 dependencies:
     codeql/python-all: "*"

python/upgrades/CHANGELOG.md

@@ -1 +1,3 @@
+## 0.0.5
+
 ## 0.0.4

python/upgrades/change-notes/released/0.0.5.md

@@ -0,0 +1 @@
+## 0.0.5

python/upgrades/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.0.4
+lastReleaseVersion: 0.0.5

python/upgrades/qlpack.yml

@@ -2,4 +2,4 @@ name: codeql/python-upgrades
 groups: python
 upgrades: .
 library: true
-version: 0.0.5-dev
+version: 0.0.5