mirror of
https://github.com/github/codeql.git
synced 2026-05-05 13:45:19 +02:00
Revert "Release preparation for version 2.17.0"
This commit is contained in:
Chuan-kai Lin
@@ -1,7 +1,3 @@
|
||||
## 0.0.20
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
## 0.0.19
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
@@ -1,3 +0,0 @@
|
||||
## 0.0.20
|
||||
|
||||
No user-facing changes.
|
||||
@@ -1,2 +1,2 @@
|
||||
---
|
||||
lastReleaseVersion: 0.0.20
|
||||
lastReleaseVersion: 0.0.19
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
name: codeql/java-automodel-queries
|
||||
version: 0.0.20
|
||||
version: 0.0.20-dev
|
||||
groups:
|
||||
- java
|
||||
- automodel
|
||||
|
||||
@@ -1,16 +1,3 @@
|
||||
## 0.9.0
|
||||
|
||||
### Breaking Changes
|
||||
|
||||
* The Java extractor no longer supports the `ODASA_SNAPSHOT` legacy environment variable.
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
* Increased the precision of some dataflow models of the class `java.net.URL` by distinguishing the parts of a URL.
|
||||
* The Java extractor and QL libraries now support Java 22, including support for anonymous variables, lambda parameters and patterns.
|
||||
* Pattern cases with multiple patterns and that fall through to or from other pattern cases are now supported. The `PatternCase` class gains the new `getPatternAtIndex` and `getAPattern` predicates, and deprecates `getPattern`.
|
||||
* Added a `path-injection` sink for the `open` methods of the `android.os.ParcelFileDescriptor` class.
|
||||
|
||||
## 0.8.12
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Added a `path-injection` sink for the `open` methods of the `android.os.ParcelFileDescriptor` class.
|
||||
4
java/ql/lib/change-notes/2024-03-21-env-vars.md
Normal file
4
java/ql/lib/change-notes/2024-03-21-env-vars.md
Normal file
@@ -0,0 +1,4 @@
|
||||
---
|
||||
category: breaking
|
||||
---
|
||||
* The Java extractor no longer supports the `ODASA_SNAPSHOT` legacy environment variable.
|
||||
@@ -0,0 +1,5 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* The Java extractor and QL libraries now support Java 22, including support for anonymous variables, lambda parameters and patterns.
|
||||
* Pattern cases with multiple patterns and that fall through to or from other pattern cases are now supported. The `PatternCase` class gains the new `getPatternAtIndex` and `getAPattern` predicates, and deprecates `getPattern`.
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Increased the precision of some dataflow models of the class `java.net.URL` by distinguishing the parts of a URL.
|
||||
@@ -1,12 +0,0 @@
|
||||
## 0.9.0
|
||||
|
||||
### Breaking Changes
|
||||
|
||||
* The Java extractor no longer supports the `ODASA_SNAPSHOT` legacy environment variable.
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
* Increased the precision of some dataflow models of the class `java.net.URL` by distinguishing the parts of a URL.
|
||||
* The Java extractor and QL libraries now support Java 22, including support for anonymous variables, lambda parameters and patterns.
|
||||
* Pattern cases with multiple patterns and that fall through to or from other pattern cases are now supported. The `PatternCase` class gains the new `getPatternAtIndex` and `getAPattern` predicates, and deprecates `getPattern`.
|
||||
* Added a `path-injection` sink for the `open` methods of the `android.os.ParcelFileDescriptor` class.
|
||||
@@ -1,2 +1,2 @@
|
||||
---
|
||||
lastReleaseVersion: 0.9.0
|
||||
lastReleaseVersion: 0.8.12
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
name: codeql/java-all
|
||||
version: 0.9.0
|
||||
version: 0.8.13-dev
|
||||
groups: java
|
||||
dbscheme: config/semmlecode.dbscheme
|
||||
extractor: java
|
||||
|
||||
@@ -1,18 +1,3 @@
|
||||
## 0.8.13
|
||||
|
||||
### New Queries
|
||||
|
||||
* The query `java/unsafe-url-forward-dispatch-load` has been promoted from experimental to the main query pack as `java/unvalidated-url-forward`. Its results will now appear by default. This query was originally submitted as an experimental query [by @haby0](https://github.com/github/codeql/pull/6240) and [by @luchua-bc](https://github.com/github/codeql/pull/7286).
|
||||
|
||||
### Major Analysis Improvements
|
||||
|
||||
* The `java/missing-case-in-switch` query now gives only a single alert for each switch statement, giving some examples of the missing cases as well as a count of how many are missing.
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
* Variables named `tokenImage` are no longer sources for the `java/sensitive-log` query. This is because this variable name is used in parsing code generated by JavaCC, so it causes a large number of false positive alerts.
|
||||
* Added sanitizers for relative URLs, `List.contains()`, and checking the host of a URI to the `java/ssrf` and `java/unvalidated-url-redirection` queries.
|
||||
|
||||
## 0.8.12
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
4
java/ql/src/change-notes/2024-03-06-url-forward-query.md
Normal file
4
java/ql/src/change-notes/2024-03-06-url-forward-query.md
Normal file
@@ -0,0 +1,4 @@
|
||||
---
|
||||
category: newQuery
|
||||
---
|
||||
* The query `java/unsafe-url-forward-dispatch-load` has been promoted from experimental to the main query pack as `java/unvalidated-url-forward`. Its results will now appear by default. This query was originally submitted as an experimental query [by @haby0](https://github.com/github/codeql/pull/6240) and [by @luchua-bc](https://github.com/github/codeql/pull/7286).
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Added sanitizers for relative URLs, `List.contains()`, and checking the host of a URI to the `java/ssrf` and `java/unvalidated-url-redirection` queries.
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Variables named `tokenImage` are no longer sources for the `java/sensitive-log` query. This is because this variable name is used in parsing code generated by JavaCC, so it causes a large number of false positive alerts.
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
category: majorAnalysis
|
||||
---
|
||||
* The `java/missing-case-in-switch` query now gives only a single alert for each switch statement, giving some examples of the missing cases as well as a count of how many are missing.
|
||||
@@ -1,14 +0,0 @@
|
||||
## 0.8.13
|
||||
|
||||
### New Queries
|
||||
|
||||
* The query `java/unsafe-url-forward-dispatch-load` has been promoted from experimental to the main query pack as `java/unvalidated-url-forward`. Its results will now appear by default. This query was originally submitted as an experimental query [by @haby0](https://github.com/github/codeql/pull/6240) and [by @luchua-bc](https://github.com/github/codeql/pull/7286).
|
||||
|
||||
### Major Analysis Improvements
|
||||
|
||||
* The `java/missing-case-in-switch` query now gives only a single alert for each switch statement, giving some examples of the missing cases as well as a count of how many are missing.
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
* Variables named `tokenImage` are no longer sources for the `java/sensitive-log` query. This is because this variable name is used in parsing code generated by JavaCC, so it causes a large number of false positive alerts.
|
||||
* Added sanitizers for relative URLs, `List.contains()`, and checking the host of a URI to the `java/ssrf` and `java/unvalidated-url-redirection` queries.
|
||||
@@ -1,2 +1,2 @@
|
||||
---
|
||||
lastReleaseVersion: 0.8.13
|
||||
lastReleaseVersion: 0.8.12
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
name: codeql/java-queries
|
||||
version: 0.8.13
|
||||
version: 0.8.13-dev
|
||||
groups:
|
||||
- java
|
||||
- queries
|
||||
|
||||
Reference in New Issue
Block a user