Merge branch 'main' into rbPoly

ruby/ql/src/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 0.5.2
+
+### New Queries
+
+* Added a new query, `rb/html-constructed-from-input`, to detect libraries that unsafely construct HTML from their inputs.
+
 ## 0.5.1
 
 ### New Queries

ruby/ql/src/change-notes/released/0.5.2.md

@@ -1,4 +1,5 @@
----
-category: newQuery
----
+## 0.5.2
+
+### New Queries
+
 * Added a new query, `rb/html-constructed-from-input`, to detect libraries that unsafely construct HTML from their inputs.

ruby/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.5.1
+lastReleaseVersion: 0.5.2

ruby/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/ruby-queries
-version: 0.5.2-dev
+version: 0.5.3-dev
 groups: 
   - ruby
   - queries

ruby/ql/src/queries/security/cwe-1333/ReDoSIntroduction.inc.qhelp

@@ -19,6 +19,12 @@
       shape, increasing the input length by ten characters may make the
       automaton about 1000 times slower.
     </p>
+    <p>
+      Note that Ruby 3.2 and later have implemented a caching mechanism that
+      completely eliminates the worst-case time complexity for the regular
+      expressions flagged by this query. The regular expressions flagged by this
+      query are therefore only problematic for Ruby versions prior to 3.2.
+    </p>
     <p>
       Typically, a regular expression is affected by this problem if it contains
       a repetition of the form <code>r*</code> or <code>r+</code> where the