+Biometric local authentication such as fingerprint recognistion can be used to protect sensitive data or actions within an application.
+However, if this authentication does not make use of a KeyStore-backed key, it is able to be bypassed by a privileged malicious application or an attacker with physical access.
+
+
+
+
+
+Generate a secure key in the Android KeyStore and ensure that the onAuthenticaionSuccess callback for a biometric prompt uses it
+in a way that is required for the sensitive parts of the application to function, such as by using it to decrypt sensitive data or credentials.
+
+
+
+
+
In the following (bad) case, no CryptoObject is required for the biometric prompt to grant access, so it can be bypassed.
+
+
In he following (good) case, a secret key is generated in the Android KeyStore that is required for the application to grant access.
+
+
+
diff --git a/java/ql/src/Security/CWE/CWE-287/AndroidInsecureLocalAuthenticationBad.java b/java/ql/src/Security/CWE/CWE-287/AndroidInsecureLocalAuthenticationBad.java
new file mode 100644
index 00000000000..464153ccbee
--- /dev/null
+++ b/java/ql/src/Security/CWE/CWE-287/AndroidInsecureLocalAuthenticationBad.java
@@ -0,0 +1,11 @@
+biometricPrompt.authenticate(
+ cancellationSignal,
+ executor,
+ new BiometricPrompt.AuthenticationCallback {
+ @Override
+ // BAD: This authentication callback does not make use of a `CryptoObject` from the `result`.
+ public void onAuthenticationSucceeded(BiometricPrompt.AuthenticationResult result) {
+ grantAccess()
+ }
+ }
+)
\ No newline at end of file
diff --git a/java/ql/src/Security/CWE/CWE-287/AndroidInsecureLocalAuthenticationGood.java b/java/ql/src/Security/CWE/CWE-287/AndroidInsecureLocalAuthenticationGood.java
new file mode 100644
index 00000000000..0f41b31a292
--- /dev/null
+++ b/java/ql/src/Security/CWE/CWE-287/AndroidInsecureLocalAuthenticationGood.java
@@ -0,0 +1,48 @@
+private void generateSecretKey() {
+ KeyGenParameterSpec keyGenParameterSpec = new KeyGenParameterSpec.Builder(
+ "MySecretKey",
+ KeyProperties.PURPOSE_ENCRYPT | KeyProperties.PURPOSE_DECRYPT)
+ .setBlockModes(KeyProperties.BLOCK_MODE_CBC)
+ .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_PKCS7)
+ .setUserAuthenticationRequired(true)
+ .setInvalidatedByBiometricEnrollment(true)
+ .build();
+ KeyGenerator keyGenerator = KeyGenerator.getInstance(
+ KeyProperties.KEY_ALGORITHM_AES, "AndroidKeyStore");
+ keyGenerator.init(keyGenParameterSpec);
+ keyGenerator.generateKey();
+}
+
+
+private SecretKey getSecretKey() {
+ KeyStore keyStore = KeyStore.getInstance("AndroidKeyStore");
+ keyStore.load(null);
+ return ((SecretKey)keyStore.getKey("MySecretKey", null));
+}
+
+private Cipher getCipher() {
+ return Cipher.getInstance(KeyProperties.KEY_ALGORITHM_AES + "/"
+ + KeyProperties.BLOCK_MODE_CBC + "/"
+ + KeyProperties.ENCRYPTION_PADDING_PKCS7);
+}
+
+public prompt() {
+ Cipher cipher = getCipher();
+ SecretKey secretKey = getSecretKey();
+ cipher.init(Cipher.DECRYPT_MODE, secretKey);
+
+ biometricPrompt.authenticate(
+ new BiometricPrompt.CryptoObject(cipher);
+ cancellationSignal,
+ executor,
+ new BiometricPrompt.AuthenticationCallback {
+ @Override
+ // GOOD: This authentication callback uses the result to decrypt some data.
+ public void onAuthenticationSucceeded(BiometricPrompt.AuthenticationResult result) {
+ Cipher cipher = result.getCryptoObject().getCipher();
+ byte[] decryptedData = cipher.doFinal(encryptedData);
+ grantAccessWithData(decryptedData);
+ }
+ }
+ );
+}
\ No newline at end of file
From 514a92d5bd1e24e4b7367d64430762ffd1ffbe7f Mon Sep 17 00:00:00 2001
From: Nick Rolfe
Date: Wed, 1 Nov 2023 22:33:21 +0000
Subject: [PATCH 023/113] Tree-sitter extractors: use fresh IDs for locations
Since locations for any given source file are never referenced in any
TRAP files besides the one for that particular source file, it's not
necessary to use global IDs. Using fresh IDs will reduce the size of the
ID pool (both on disk and in memory) and the speed of multi-threaded
TRAP import.
The one exception is the empty location, which still uses a global ID.
---
.../src/extractor/mod.rs | 128 ++++++++++++------
shared/tree-sitter-extractor/src/trap.rs | 22 +++
2 files changed, 105 insertions(+), 45 deletions(-)
diff --git a/shared/tree-sitter-extractor/src/extractor/mod.rs b/shared/tree-sitter-extractor/src/extractor/mod.rs
index 913e637d92b..0d493ebd9e1 100644
--- a/shared/tree-sitter-extractor/src/extractor/mod.rs
+++ b/shared/tree-sitter-extractor/src/extractor/mod.rs
@@ -43,7 +43,16 @@ fn populate_empty_file(writer: &mut trap::Writer) -> trap::Label {
pub fn populate_empty_location(writer: &mut trap::Writer) {
let file_label = populate_empty_file(writer);
- location(writer, file_label, 0, 0, 0, 0);
+ global_location(
+ writer,
+ file_label,
+ trap::Location {
+ start_line: 0,
+ start_column: 0,
+ end_line: 0,
+ end_column: 0,
+ },
+ );
}
pub fn populate_parent_folders(
@@ -85,17 +94,19 @@ pub fn populate_parent_folders(
}
}
-fn location(
+/** Get the label for the given location, defining it a global ID if it doesn't exist yet. */
+fn global_location(
writer: &mut trap::Writer,
file_label: trap::Label,
- start_line: usize,
- start_column: usize,
- end_line: usize,
- end_column: usize,
+ location: trap::Location,
) -> trap::Label {
let (loc_label, fresh) = writer.global_id(&format!(
"loc,{{{}}},{},{},{},{}",
- file_label, start_line, start_column, end_line, end_column
+ file_label,
+ location.start_line,
+ location.start_column,
+ location.end_line,
+ location.end_column
));
if fresh {
writer.add_tuple(
@@ -103,10 +114,34 @@ fn location(
vec![
trap::Arg::Label(loc_label),
trap::Arg::Label(file_label),
- trap::Arg::Int(start_line),
- trap::Arg::Int(start_column),
- trap::Arg::Int(end_line),
- trap::Arg::Int(end_column),
+ trap::Arg::Int(location.start_line),
+ trap::Arg::Int(location.start_column),
+ trap::Arg::Int(location.end_line),
+ trap::Arg::Int(location.end_column),
+ ],
+ );
+ }
+ loc_label
+}
+
+/** Get the label for the given location, creating it as a fresh ID if we haven't seen the location
+ * yet for this file. */
+fn location_label(
+ writer: &mut trap::Writer,
+ file_label: trap::Label,
+ location: trap::Location,
+) -> trap::Label {
+ let (loc_label, fresh) = writer.location_label(location);
+ if fresh {
+ writer.add_tuple(
+ "locations_default",
+ vec![
+ trap::Arg::Label(loc_label),
+ trap::Arg::Label(file_label),
+ trap::Arg::Int(location.start_line),
+ trap::Arg::Int(location.start_column),
+ trap::Arg::Int(location.end_line),
+ trap::Arg::Int(location.end_column),
],
);
}
@@ -245,26 +280,25 @@ impl<'a> Visitor<'a> {
node: Node,
status_page: bool,
) {
- let (start_line, start_column, end_line, end_column) = location_for(self, node);
- let loc = location(
- self.trap_writer,
- self.file_label,
- start_line,
- start_column,
- end_line,
- end_column,
- );
+ let loc = location_for(self, node);
+ let loc_label = location_label(self.trap_writer, self.file_label, loc);
let mut mesg = self.diagnostics_writer.new_entry(
"parse-error",
"Could not process some files due to syntax errors",
);
mesg.severity(diagnostics::Severity::Warning)
- .location(self.path, start_line, start_column, end_line, end_column)
+ .location(
+ self.path,
+ loc.start_line,
+ loc.start_column,
+ loc.end_line,
+ loc.end_column,
+ )
.message(message, args);
if status_page {
mesg.status_page();
}
- self.record_parse_error(loc, &mesg);
+ self.record_parse_error(loc_label, &mesg);
}
fn enter_node(&mut self, node: Node) -> bool {
@@ -298,15 +332,8 @@ impl<'a> Visitor<'a> {
return;
}
let (id, _, child_nodes) = self.stack.pop().expect("Vistor: empty stack");
- let (start_line, start_column, end_line, end_column) = location_for(self, node);
- let loc = location(
- self.trap_writer,
- self.file_label,
- start_line,
- start_column,
- end_line,
- end_column,
- );
+ let loc = location_for(self, node);
+ let loc_label = location_label(self.trap_writer, self.file_label, loc);
let table = self
.schema
.get(&TypeName {
@@ -333,7 +360,7 @@ impl<'a> Visitor<'a> {
trap::Arg::Label(id),
trap::Arg::Label(parent_id),
trap::Arg::Int(parent_index),
- trap::Arg::Label(loc),
+ trap::Arg::Label(loc_label),
],
);
self.trap_writer.add_tuple(
@@ -356,7 +383,7 @@ impl<'a> Visitor<'a> {
trap::Arg::Label(id),
trap::Arg::Label(parent_id),
trap::Arg::Int(parent_index),
- trap::Arg::Label(loc),
+ trap::Arg::Label(loc_label),
],
);
let mut all_args = vec![trap::Arg::Label(id)];
@@ -366,14 +393,20 @@ impl<'a> Visitor<'a> {
}
_ => {
self.record_parse_error(
- loc,
+ loc_label,
self.diagnostics_writer
.new_entry(
"parse-error",
"Could not process some files due to syntax errors",
)
.severity(diagnostics::Severity::Warning)
- .location(self.path, start_line, start_column, end_line, end_column)
+ .location(
+ self.path,
+ loc.start_line,
+ loc.start_column,
+ loc.end_line,
+ loc.end_column,
+ )
.message(
"Unknown table type: {}",
&[diagnostics::MessageArg::Code(node.kind())],
@@ -555,7 +588,7 @@ fn sliced_source_arg(source: &[u8], n: Node) -> trap::Arg {
// Emit a pair of `TrapEntry`s for the provided node, appropriately calibrated.
// The first is the location and label definition, and the second is the
// 'Located' entry.
-fn location_for(visitor: &mut Visitor, n: Node) -> (usize, usize, usize, usize) {
+fn location_for(visitor: &mut Visitor, n: Node) -> trap::Location {
// Tree-sitter row, column values are 0-based while CodeQL starts
// counting at 1. In addition Tree-sitter's row and column for the
// end position are exclusive while CodeQL's end positions are inclusive.
@@ -565,16 +598,16 @@ fn location_for(visitor: &mut Visitor, n: Node) -> (usize, usize, usize, usize)
// the end column is 0 (start of a line). In such cases the end position must be
// set to the end of the previous line.
let start_line = n.start_position().row + 1;
- let start_col = n.start_position().column + 1;
+ let start_column = n.start_position().column + 1;
let mut end_line = n.end_position().row + 1;
- let mut end_col = n.end_position().column;
- if start_line > end_line || start_line == end_line && start_col > end_col {
+ let mut end_column = n.end_position().column;
+ if start_line > end_line || start_line == end_line && start_column > end_column {
// the range is empty, clip it to sensible values
end_line = start_line;
- end_col = start_col - 1;
- } else if end_col == 0 {
+ end_column = start_column - 1;
+ } else if end_column == 0 {
let source = visitor.source;
- // end_col = 0 means that we are at the start of a line
+ // end_column = 0 means that we are at the start of a line
// unfortunately 0 is invalid as column number, therefore
// we should update the end location to be the end of the
// previous line
@@ -591,10 +624,10 @@ fn location_for(visitor: &mut Visitor, n: Node) -> (usize, usize, usize, usize)
);
}
end_line -= 1;
- end_col = 1;
+ end_column = 1;
while index > 0 && source[index - 1] != b'\n' {
index -= 1;
- end_col += 1;
+ end_column += 1;
}
} else {
visitor.diagnostics_writer.write(
@@ -612,7 +645,12 @@ fn location_for(visitor: &mut Visitor, n: Node) -> (usize, usize, usize, usize)
);
}
}
- (start_line, start_col, end_line, end_col)
+ trap::Location {
+ start_line,
+ start_column,
+ end_line,
+ end_column,
+ }
}
fn traverse(tree: &Tree, visitor: &mut Visitor) {
diff --git a/shared/tree-sitter-extractor/src/trap.rs b/shared/tree-sitter-extractor/src/trap.rs
index 135e336338f..64c06539ecb 100644
--- a/shared/tree-sitter-extractor/src/trap.rs
+++ b/shared/tree-sitter-extractor/src/trap.rs
@@ -5,6 +5,14 @@ use std::path::Path;
use flate2::write::GzEncoder;
+#[derive(Clone, Copy, Eq, PartialEq, PartialOrd, Ord, Hash)]
+pub struct Location {
+ pub start_line: usize,
+ pub start_column: usize,
+ pub end_line: usize,
+ pub end_column: usize,
+}
+
pub struct Writer {
/// The accumulated trap entries
trap_output: Vec,
@@ -12,6 +20,8 @@ pub struct Writer {
counter: u32,
/// cache of global keys
global_keys: std::collections::HashMap,
+ /// Labels for locations, which don't use global keys
+ location_labels: std::collections::HashMap,
}
impl Writer {
@@ -20,6 +30,7 @@ impl Writer {
counter: 0,
trap_output: Vec::new(),
global_keys: std::collections::HashMap::new(),
+ location_labels: std::collections::HashMap::new(),
}
}
@@ -50,6 +61,17 @@ impl Writer {
(label, true)
}
+ /// Gets the label for the given location. The first call for a given location will define it as
+ /// a fresh (star) ID.
+ pub fn location_label(&mut self, loc: Location) -> (Label, bool) {
+ if let Some(label) = self.location_labels.get(&loc) {
+ return (*label, false);
+ }
+ let label = self.fresh_id();
+ self.location_labels.insert(loc, label);
+ (label, true)
+ }
+
pub fn add_tuple(&mut self, table_name: &str, args: Vec) {
self.trap_output
.push(Entry::GenericTuple(table_name.to_owned(), args))
From 71852868acda81fb9e321924a0d7d7a2880b4304 Mon Sep 17 00:00:00 2001
From: Joe Farebrother
Date: Fri, 2 Feb 2024 17:19:20 +0000
Subject: [PATCH 024/113] Add case for androidx.biometric api
---
.../java/security/AndroidLocalAuthQuery.qll | 2 +
.../query-tests/security/CWE-287/Test2.java | 47 +++++++++++
.../identity/PresentationSession.java | 9 +++
.../androidx/biometric/BiometricPrompt.java | 79 +++++++++++++++++++
4 files changed, 137 insertions(+)
create mode 100644 java/ql/test/query-tests/security/CWE-287/Test2.java
create mode 100644 java/ql/test/stubs/google-android-9.0.0/android/security/identity/PresentationSession.java
create mode 100644 java/ql/test/stubs/google-android-9.0.0/androidx/biometric/BiometricPrompt.java
diff --git a/java/ql/lib/semmle/code/java/security/AndroidLocalAuthQuery.qll b/java/ql/lib/semmle/code/java/security/AndroidLocalAuthQuery.qll
index 8c052fc58ee..46b391559f1 100644
--- a/java/ql/lib/semmle/code/java/security/AndroidLocalAuthQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/AndroidLocalAuthQuery.qll
@@ -9,6 +9,8 @@ private class AuthenticationCallbackClass extends Class {
"FingerprintManager$AuthenticationCallback")
or
this.hasQualifiedName("android.hardware.biometrics", "BiometricPrompt$AuthenticationCallback")
+ or
+ this.hasQualifiedName("androidx.biometric", "BiometricPrompt$AuthenticationCallback")
}
}
diff --git a/java/ql/test/query-tests/security/CWE-287/Test2.java b/java/ql/test/query-tests/security/CWE-287/Test2.java
new file mode 100644
index 00000000000..10308a2f2d3
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-287/Test2.java
@@ -0,0 +1,47 @@
+import androidx.biometric.BiometricPrompt;
+
+class TestC {
+ public static void useKey(BiometricPrompt.CryptoObject key) {}
+
+
+ // GOOD: result is used
+ class Test1 extends BiometricPrompt.AuthenticationCallback {
+ @Override
+ public void onAuthenticationSucceeded(BiometricPrompt.AuthenticationResult result) {
+ TestC.useKey(result.getCryptoObject());
+ }
+ }
+
+ // BAD: result is not used
+ class Test2 extends BiometricPrompt.AuthenticationCallback {
+ @Override
+ public void onAuthenticationSucceeded(BiometricPrompt.AuthenticationResult result) { // $insecure-auth
+
+ }
+ }
+
+ // BAD: result is only used in a super call
+ class Test3 extends BiometricPrompt.AuthenticationCallback {
+ @Override
+ public void onAuthenticationSucceeded(BiometricPrompt.AuthenticationResult result) { // $insecure-auth
+ super.onAuthenticationSucceeded(result);
+ }
+ }
+
+ // GOOD: result is used
+ class Test4 extends BiometricPrompt.AuthenticationCallback {
+ @Override
+ public void onAuthenticationSucceeded(BiometricPrompt.AuthenticationResult result) {
+ super.onAuthenticationSucceeded(result);
+ TestC.useKey(result.getCryptoObject());
+ }
+ }
+
+ // GOOD: result is used in a super call to a class other than the base class
+ class Test5 extends Test1 {
+ @Override
+ public void onAuthenticationSucceeded(BiometricPrompt.AuthenticationResult result) {
+ super.onAuthenticationSucceeded(result);
+ }
+ }
+}
\ No newline at end of file
diff --git a/java/ql/test/stubs/google-android-9.0.0/android/security/identity/PresentationSession.java b/java/ql/test/stubs/google-android-9.0.0/android/security/identity/PresentationSession.java
new file mode 100644
index 00000000000..9227f8fe5d3
--- /dev/null
+++ b/java/ql/test/stubs/google-android-9.0.0/android/security/identity/PresentationSession.java
@@ -0,0 +1,9 @@
+// Generated automatically from android.security.identity.PresentationSession for testing purposes
+
+package android.security.identity;
+
+
+public class PresentationSession
+{
+ protected PresentationSession() {}
+}
diff --git a/java/ql/test/stubs/google-android-9.0.0/androidx/biometric/BiometricPrompt.java b/java/ql/test/stubs/google-android-9.0.0/androidx/biometric/BiometricPrompt.java
new file mode 100644
index 00000000000..16bf2e661ee
--- /dev/null
+++ b/java/ql/test/stubs/google-android-9.0.0/androidx/biometric/BiometricPrompt.java
@@ -0,0 +1,79 @@
+// Generated automatically from androidx.biometric.BiometricPrompt for testing purposes
+
+package androidx.biometric;
+
+import android.security.identity.IdentityCredential;
+import android.security.identity.PresentationSession;
+import androidx.fragment.app.Fragment;
+import androidx.fragment.app.FragmentActivity;
+import java.security.Signature;
+import java.util.concurrent.Executor;
+import javax.crypto.Cipher;
+import javax.crypto.Mac;
+
+public class BiometricPrompt
+{
+ protected BiometricPrompt() {}
+ abstract static public class AuthenticationCallback
+ {
+ public AuthenticationCallback(){}
+ public void onAuthenticationError(int p0, CharSequence p1){}
+ public void onAuthenticationFailed(){}
+ public void onAuthenticationSucceeded(BiometricPrompt.AuthenticationResult p0){}
+ }
+ public BiometricPrompt(Fragment p0, BiometricPrompt.AuthenticationCallback p1){}
+ public BiometricPrompt(Fragment p0, Executor p1, BiometricPrompt.AuthenticationCallback p2){}
+ public BiometricPrompt(FragmentActivity p0, BiometricPrompt.AuthenticationCallback p1){}
+ public BiometricPrompt(FragmentActivity p0, Executor p1, BiometricPrompt.AuthenticationCallback p2){}
+ public static int AUTHENTICATION_RESULT_TYPE_BIOMETRIC = 0;
+ public static int AUTHENTICATION_RESULT_TYPE_DEVICE_CREDENTIAL = 0;
+ public static int AUTHENTICATION_RESULT_TYPE_UNKNOWN = 0;
+ public static int ERROR_CANCELED = 0;
+ public static int ERROR_HW_NOT_PRESENT = 0;
+ public static int ERROR_HW_UNAVAILABLE = 0;
+ public static int ERROR_LOCKOUT = 0;
+ public static int ERROR_LOCKOUT_PERMANENT = 0;
+ public static int ERROR_NEGATIVE_BUTTON = 0;
+ public static int ERROR_NO_BIOMETRICS = 0;
+ public static int ERROR_NO_DEVICE_CREDENTIAL = 0;
+ public static int ERROR_NO_SPACE = 0;
+ public static int ERROR_SECURITY_UPDATE_REQUIRED = 0;
+ public static int ERROR_TIMEOUT = 0;
+ public static int ERROR_UNABLE_TO_PROCESS = 0;
+ public static int ERROR_USER_CANCELED = 0;
+ public static int ERROR_VENDOR = 0;
+ public void authenticate(BiometricPrompt.PromptInfo p0){}
+ public void authenticate(BiometricPrompt.PromptInfo p0, BiometricPrompt.CryptoObject p1){}
+ public void cancelAuthentication(){}
+ static public class AuthenticationResult
+ {
+ protected AuthenticationResult() {}
+ public BiometricPrompt.CryptoObject getCryptoObject(){ return null; }
+ public int getAuthenticationType(){ return 0; }
+ }
+ static public class CryptoObject
+ {
+ protected CryptoObject() {}
+ public Cipher getCipher(){ return null; }
+ public CryptoObject(Cipher p0){}
+ public CryptoObject(IdentityCredential p0){}
+ public CryptoObject(Mac p0){}
+ public CryptoObject(PresentationSession p0){}
+ public CryptoObject(Signature p0){}
+ public IdentityCredential getIdentityCredential(){ return null; }
+ public Mac getMac(){ return null; }
+ public PresentationSession getPresentationSession(){ return null; }
+ public Signature getSignature(){ return null; }
+ }
+ static public class PromptInfo
+ {
+ protected PromptInfo() {}
+ public CharSequence getDescription(){ return null; }
+ public CharSequence getNegativeButtonText(){ return null; }
+ public CharSequence getSubtitle(){ return null; }
+ public CharSequence getTitle(){ return null; }
+ public boolean isConfirmationRequired(){ return false; }
+ public boolean isDeviceCredentialAllowed(){ return false; }
+ public int getAllowedAuthenticators(){ return 0; }
+ }
+}
From 5022adba562db5543b5d8de8fea512e7d2020029 Mon Sep 17 00:00:00 2001
From: Joe Farebrother
Date: Fri, 2 Feb 2024 17:26:00 +0000
Subject: [PATCH 025/113] Fixes to qhelp example
---
.../CWE/CWE-287/AndroidInsecureLocalAuthenticationGood.java | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/java/ql/src/Security/CWE/CWE-287/AndroidInsecureLocalAuthenticationGood.java b/java/ql/src/Security/CWE/CWE-287/AndroidInsecureLocalAuthenticationGood.java
index 0f41b31a292..2ffcbbb6e26 100644
--- a/java/ql/src/Security/CWE/CWE-287/AndroidInsecureLocalAuthenticationGood.java
+++ b/java/ql/src/Security/CWE/CWE-287/AndroidInsecureLocalAuthenticationGood.java
@@ -26,16 +26,16 @@ private Cipher getCipher() {
+ KeyProperties.ENCRYPTION_PADDING_PKCS7);
}
-public prompt() {
+public prompt(byte[] encryptedData) {
Cipher cipher = getCipher();
SecretKey secretKey = getSecretKey();
cipher.init(Cipher.DECRYPT_MODE, secretKey);
biometricPrompt.authenticate(
- new BiometricPrompt.CryptoObject(cipher);
+ new BiometricPrompt.CryptoObject(cipher),
cancellationSignal,
executor,
- new BiometricPrompt.AuthenticationCallback {
+ new BiometricPrompt.AuthenticationCallback() {
@Override
// GOOD: This authentication callback uses the result to decrypt some data.
public void onAuthenticationSucceeded(BiometricPrompt.AuthenticationResult result) {
From 596f48ca951f54c5e3eda6b7793450e04dc2cf98 Mon Sep 17 00:00:00 2001
From: Joe Farebrother
Date: Fri, 2 Feb 2024 17:35:07 +0000
Subject: [PATCH 026/113] Add change note
---
.../change-notes/2024-02-02-android-insecure-local-auth.md | 5 +++++
1 file changed, 5 insertions(+)
create mode 100644 java/ql/src/change-notes/2024-02-02-android-insecure-local-auth.md
diff --git a/java/ql/src/change-notes/2024-02-02-android-insecure-local-auth.md b/java/ql/src/change-notes/2024-02-02-android-insecure-local-auth.md
new file mode 100644
index 00000000000..dc7ebcaade3
--- /dev/null
+++ b/java/ql/src/change-notes/2024-02-02-android-insecure-local-auth.md
@@ -0,0 +1,5 @@
+
+---
+category: newQuery
+---
+* Added a new query `java/android/insecure-local-authentication` for finding uses of biometric authentication APIs that do not make use of a `KeyStore`-backed key and thus may be bypassed.
\ No newline at end of file
From b8dc6338646935c32f6a69aeb573ccce0acb8b9b Mon Sep 17 00:00:00 2001
From: erik-krogh
Date: Mon, 5 Feb 2024 11:16:16 +0100
Subject: [PATCH 027/113] add cs/path-injection as markdown to make nicer diffs
---
.../Security Features/CWE-022/TaintedPath.md | 50 +++++++++++++++++++
1 file changed, 50 insertions(+)
create mode 100644 csharp/ql/src/Security Features/CWE-022/TaintedPath.md
diff --git a/csharp/ql/src/Security Features/CWE-022/TaintedPath.md b/csharp/ql/src/Security Features/CWE-022/TaintedPath.md
new file mode 100644
index 00000000000..ddd80d92051
--- /dev/null
+++ b/csharp/ql/src/Security Features/CWE-022/TaintedPath.md
@@ -0,0 +1,50 @@
+# Uncontrolled data used in path expression
+Accessing paths controlled by users can allow an attacker to access unexpected resources. This can result in sensitive information being revealed or deleted, or an attacker being able to influence behavior by modifying unexpected files.
+
+Paths that are naively constructed from data controlled by a user may contain unexpected special characters, such as "..". Such a path may potentially point to any directory on the file system.
+
+
+## Recommendation
+Validate user input before using it to construct a file path. Ideally, follow these rules:
+
+* Do not allow more than a single "." character.
+* Do not allow directory separators such as "/" or "\\" (depending on the file system).
+* Do not rely on simply replacing problematic sequences such as "../". For example, after applying this filter to ".../...//" the resulting string would still be "../".
+* Use a whitelist of known good patterns.
+* Sanitize potentially tainted paths using `HttpRequest.MapPath`.
+
+## Example
+In the first example, a file name is read from a `HttpRequest` and then used to access a file. However, a malicious user could enter a file name which is an absolute path - for example, "/etc/passwd". In the second example, it appears that the user is restricted to opening a file within the "user" home directory. However, a malicious user could enter a filename which contains special characters. For example, the string "../../etc/passwd" will result in the code reading the file located at "/home/\[user\]/../../etc/passwd", which is the system's password file. This file would then be sent back to the user, giving them access to all the system's passwords.
+
+
+```csharp
+using System;
+using System.IO;
+using System.Web;
+
+public class TaintedPathHandler : IHttpHandler
+{
+ public void ProcessRequest(HttpContext ctx)
+ {
+ String path = ctx.Request.QueryString["path"];
+ // BAD: This could read any file on the filesystem.
+ ctx.Response.Write(File.ReadAllText(path));
+
+ // BAD: This could still read any file on the filesystem.
+ ctx.Response.Write(File.ReadAllText("/home/user/" + path));
+
+ // GOOD: MapPath ensures the path is safe to read from.
+ string safePath = ctx.Request.MapPath(path, ctx.Request.ApplicationPath, false);
+ ctx.Response.Write(File.ReadAllText(safePath));
+ }
+}
+
+```
+
+## References
+* OWASP: [Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal).
+* Common Weakness Enumeration: [CWE-22](https://cwe.mitre.org/data/definitions/22.html).
+* Common Weakness Enumeration: [CWE-23](https://cwe.mitre.org/data/definitions/23.html).
+* Common Weakness Enumeration: [CWE-36](https://cwe.mitre.org/data/definitions/36.html).
+* Common Weakness Enumeration: [CWE-73](https://cwe.mitre.org/data/definitions/73.html).
+* Common Weakness Enumeration: [CWE-99](https://cwe.mitre.org/data/definitions/99.html).
From 9dfac3a4ccf14fb304ca8b13243a9dc8dec07174 Mon Sep 17 00:00:00 2001
From: erik-krogh
Date: Mon, 5 Feb 2024 11:20:24 +0100
Subject: [PATCH 028/113] move qhelp samples to an `examples` folder
---
csharp/ql/src/Security Features/CWE-022/TaintedPath.qhelp | 2 +-
csharp/ql/src/Security Features/CWE-022/ZipSlip.qhelp | 4 ++--
.../Security Features/CWE-022/{ => examples}/TaintedPath.cs | 0
.../Security Features/CWE-022/{ => examples}/ZipSlipBad.cs | 0
.../Security Features/CWE-022/{ => examples}/ZipSlipGood.cs | 0
5 files changed, 3 insertions(+), 3 deletions(-)
rename csharp/ql/src/Security Features/CWE-022/{ => examples}/TaintedPath.cs (100%)
rename csharp/ql/src/Security Features/CWE-022/{ => examples}/ZipSlipBad.cs (100%)
rename csharp/ql/src/Security Features/CWE-022/{ => examples}/ZipSlipGood.cs (100%)
diff --git a/csharp/ql/src/Security Features/CWE-022/TaintedPath.qhelp b/csharp/ql/src/Security Features/CWE-022/TaintedPath.qhelp
index e838d8c56a4..3ff4e5447cd 100644
--- a/csharp/ql/src/Security Features/CWE-022/TaintedPath.qhelp
+++ b/csharp/ql/src/Security Features/CWE-022/TaintedPath.qhelp
@@ -34,7 +34,7 @@ enter a filename which contains special characters. For example, the string "../
reading the file located at "/home/[user]/../../etc/passwd", which is the system's password file. This file would then be
sent back to the user, giving them access to all the system's passwords.
-
+
diff --git a/csharp/ql/src/Security Features/CWE-022/ZipSlip.qhelp b/csharp/ql/src/Security Features/CWE-022/ZipSlip.qhelp
index a1f39d27b8c..d75ababa6a8 100644
--- a/csharp/ql/src/Security Features/CWE-022/ZipSlip.qhelp
+++ b/csharp/ql/src/Security Features/CWE-022/ZipSlip.qhelp
@@ -50,7 +50,7 @@ the result is within the destination directory. If provided with a zip file cont
path like ..\sneaky-file, then this file would be written outside the destination
directory.
-
+
To fix this vulnerability, we need to make three changes. Firstly, we need to resolve any
directory traversal or other special characters in the path by using Path.GetFullPath.
@@ -59,7 +59,7 @@ Secondly, we need to identify the destination output directory, again using
the resolved output starts with the resolved destination directory, and throw an exception if this
is not the case.
-
+
diff --git a/csharp/ql/src/Security Features/CWE-022/TaintedPath.cs b/csharp/ql/src/Security Features/CWE-022/examples/TaintedPath.cs
similarity index 100%
rename from csharp/ql/src/Security Features/CWE-022/TaintedPath.cs
rename to csharp/ql/src/Security Features/CWE-022/examples/TaintedPath.cs
diff --git a/csharp/ql/src/Security Features/CWE-022/ZipSlipBad.cs b/csharp/ql/src/Security Features/CWE-022/examples/ZipSlipBad.cs
similarity index 100%
rename from csharp/ql/src/Security Features/CWE-022/ZipSlipBad.cs
rename to csharp/ql/src/Security Features/CWE-022/examples/ZipSlipBad.cs
diff --git a/csharp/ql/src/Security Features/CWE-022/ZipSlipGood.cs b/csharp/ql/src/Security Features/CWE-022/examples/ZipSlipGood.cs
similarity index 100%
rename from csharp/ql/src/Security Features/CWE-022/ZipSlipGood.cs
rename to csharp/ql/src/Security Features/CWE-022/examples/ZipSlipGood.cs
From 8160291be1e4ca30795b1a61f3e22e3b49cbe370 Mon Sep 17 00:00:00 2001
From: erik-krogh
Date: Mon, 5 Feb 2024 13:08:21 +0100
Subject: [PATCH 029/113] copy (and adjust) the path-injection QHelp from Java
to C#
---
.../CWE-022/TaintedPath.qhelp | 53 +++++++++++++------
.../CWE-022/examples/TaintedPath.cs | 11 +---
.../CWE-022/examples/TaintedPathGoodFolder.cs | 24 +++++++++
.../examples/TaintedPathGoodNormalize.cs | 20 +++++++
4 files changed, 82 insertions(+), 26 deletions(-)
create mode 100644 csharp/ql/src/Security Features/CWE-022/examples/TaintedPathGoodFolder.cs
create mode 100644 csharp/ql/src/Security Features/CWE-022/examples/TaintedPathGoodNormalize.cs
diff --git a/csharp/ql/src/Security Features/CWE-022/TaintedPath.qhelp b/csharp/ql/src/Security Features/CWE-022/TaintedPath.qhelp
index 3ff4e5447cd..bf3132a9719 100644
--- a/csharp/ql/src/Security Features/CWE-022/TaintedPath.qhelp
+++ b/csharp/ql/src/Security Features/CWE-022/TaintedPath.qhelp
@@ -7,35 +7,54 @@
can result in sensitive information being revealed or deleted, or an attacker being able to influence
behavior by modifying unexpected files.
-
Paths that are naively constructed from data controlled by a user may contain unexpected special characters,
-such as "..". Such a path may potentially point to any directory on the file system.
+
Paths that are naively constructed from data controlled by a user may be absolute paths, or may contain
+unexpected special characters such as "..". Such a path could point anywhere on the file system.
-
Validate user input before using it to construct a file path. Ideally, follow these rules:
+
Validate user input before using it to construct a file path.
-
-
Do not allow more than a single "." character.
-
Do not allow directory separators such as "/" or "\" (depending on the file system).
-
Do not rely on simply replacing problematic sequences such as "../". For example, after applying this filter to
-".../...//" the resulting string would still be "../".
-
Use a whitelist of known good patterns.
-
Sanitize potentially tainted paths using HttpRequest.MapPath.
-
+
Common validation methods include checking that the normalized path is relative and does not contain
+any ".." components, or checking that the path is contained within a safe folder. The method you should use depends
+on how the path is used in the application, and whether the path should be a single path component.
+
+
+
If the path should be a single path component (such as a file name), you can check for the existence
+of any path separators ("/" or "\"), or ".." sequences in the input, and reject the input if any are found.
+
+
+
+Note that removing "../" sequences is not sufficient, since the input could still contain a path separator
+followed by "..". For example, the input ".../...//" would still result in the string "../" if only "../" sequences
+are removed.
+
+
+
Finally, the simplest (but most restrictive) option is to use an allow list of safe patterns and make sure that
+the user input matches one of these patterns.
-
In the first example, a file name is read from a HttpRequest and then used to access a file. However, a
-malicious user could enter a file name which is an absolute path - for example, "/etc/passwd". In the second example, it
-appears that the user is restricted to opening a file within the "user" home directory. However, a malicious user could
-enter a filename which contains special characters. For example, the string "../../etc/passwd" will result in the code
-reading the file located at "/home/[user]/../../etc/passwd", which is the system's password file. This file would then be
-sent back to the user, giving them access to all the system's passwords.
+
In this example, a user-provided file name is read from a HTTP request and then used to access a file
+and send it back to the user. However, a malicious user could enter a file name anywhere on the file system,
+such as "/etc/passwd" or "../../../etc/passwd".
+
+If the input should only be a file name, you can check that it doesn't contain any path separators or ".." sequences.
+
+
+
+
+
+If the input should be within a specific directory, you can check that the resolved path
+is still contained within that directory.
+
+
+
+
diff --git a/csharp/ql/src/Security Features/CWE-022/examples/TaintedPath.cs b/csharp/ql/src/Security Features/CWE-022/examples/TaintedPath.cs
index ac2add1b9b0..c185267a038 100644
--- a/csharp/ql/src/Security Features/CWE-022/examples/TaintedPath.cs
+++ b/csharp/ql/src/Security Features/CWE-022/examples/TaintedPath.cs
@@ -6,15 +6,8 @@ public class TaintedPathHandler : IHttpHandler
{
public void ProcessRequest(HttpContext ctx)
{
- String path = ctx.Request.QueryString["path"];
+ String filename = ctx.Request.QueryString["path"];
// BAD: This could read any file on the filesystem.
- ctx.Response.Write(File.ReadAllText(path));
-
- // BAD: This could still read any file on the filesystem.
- ctx.Response.Write(File.ReadAllText("/home/user/" + path));
-
- // GOOD: MapPath ensures the path is safe to read from.
- string safePath = ctx.Request.MapPath(path, ctx.Request.ApplicationPath, false);
- ctx.Response.Write(File.ReadAllText(safePath));
+ ctx.Response.Write(File.ReadAllText(filename));
}
}
diff --git a/csharp/ql/src/Security Features/CWE-022/examples/TaintedPathGoodFolder.cs b/csharp/ql/src/Security Features/CWE-022/examples/TaintedPathGoodFolder.cs
new file mode 100644
index 00000000000..33443abb717
--- /dev/null
+++ b/csharp/ql/src/Security Features/CWE-022/examples/TaintedPathGoodFolder.cs
@@ -0,0 +1,24 @@
+using System;
+using System.IO;
+using System.Web;
+
+public class TaintedPathHandler : IHttpHandler
+{
+ public void ProcessRequest(HttpContext ctx)
+ {
+ String filename = ctx.Request.QueryString["path"];
+
+ string publicFolder = Path.GetFullPath("/home/" + user + "/public");
+ string filePath = Path.GetFullPath(Path.Combine(publicFolder, filename));
+
+ // GOOD: ensure that the path stays within the public folder
+ if (!filePath.StartsWith(publicFolder + Path.DirectorySeparatorChar))
+ {
+ ctx.Response.StatusCode = 400;
+ ctx.Response.StatusDescription = "Bad Request";
+ ctx.Response.Write("Invalid path");
+ return;
+ }
+ ctx.Response.Write(File.ReadAllText(filename));
+ }
+}
diff --git a/csharp/ql/src/Security Features/CWE-022/examples/TaintedPathGoodNormalize.cs b/csharp/ql/src/Security Features/CWE-022/examples/TaintedPathGoodNormalize.cs
new file mode 100644
index 00000000000..939ceffff23
--- /dev/null
+++ b/csharp/ql/src/Security Features/CWE-022/examples/TaintedPathGoodNormalize.cs
@@ -0,0 +1,20 @@
+using System;
+using System.IO;
+using System.Web;
+
+public class TaintedPathHandler : IHttpHandler
+{
+ public void ProcessRequest(HttpContext ctx)
+ {
+ String filename = ctx.Request.QueryString["path"];
+ // GOOD: ensure that the filename has no path separators or parent directory references
+ if (filename.Contains("..") || filename.Contains("/") || filename.Contains("\\"))
+ {
+ ctx.Response.StatusCode = 400;
+ ctx.Response.StatusDescription = "Bad Request";
+ ctx.Response.Write("Invalid path");
+ return;
+ }
+ ctx.Response.Write(File.ReadAllText(filename));
+ }
+}
From a240618ae490a88225b190f1f728ff476a614603 Mon Sep 17 00:00:00 2001
From: erik-krogh
Date: Mon, 5 Feb 2024 13:09:02 +0100
Subject: [PATCH 030/113] generate the new rendered markdown
---
.../Security Features/CWE-022/TaintedPath.md | 82 +++++++++++++++----
1 file changed, 67 insertions(+), 15 deletions(-)
diff --git a/csharp/ql/src/Security Features/CWE-022/TaintedPath.md b/csharp/ql/src/Security Features/CWE-022/TaintedPath.md
index ddd80d92051..c6204c2914e 100644
--- a/csharp/ql/src/Security Features/CWE-022/TaintedPath.md
+++ b/csharp/ql/src/Security Features/CWE-022/TaintedPath.md
@@ -1,20 +1,23 @@
# Uncontrolled data used in path expression
Accessing paths controlled by users can allow an attacker to access unexpected resources. This can result in sensitive information being revealed or deleted, or an attacker being able to influence behavior by modifying unexpected files.
-Paths that are naively constructed from data controlled by a user may contain unexpected special characters, such as "..". Such a path may potentially point to any directory on the file system.
+Paths that are naively constructed from data controlled by a user may be absolute paths, or may contain unexpected special characters such as "..". Such a path could point anywhere on the file system.
## Recommendation
-Validate user input before using it to construct a file path. Ideally, follow these rules:
+Validate user input before using it to construct a file path.
+
+Common validation methods include checking that the normalized path is relative and does not contain any ".." components, or checking that the path is contained within a safe folder. The method you should use depends on how the path is used in the application, and whether the path should be a single path component.
+
+If the path should be a single path component (such as a file name), you can check for the existence of any path separators ("/" or "\\"), or ".." sequences in the input, and reject the input if any are found.
+
+Note that removing "../" sequences is *not* sufficient, since the input could still contain a path separator followed by "..". For example, the input ".../...//" would still result in the string "../" if only "../" sequences are removed.
+
+Finally, the simplest (but most restrictive) option is to use an allow list of safe patterns and make sure that the user input matches one of these patterns.
-* Do not allow more than a single "." character.
-* Do not allow directory separators such as "/" or "\\" (depending on the file system).
-* Do not rely on simply replacing problematic sequences such as "../". For example, after applying this filter to ".../...//" the resulting string would still be "../".
-* Use a whitelist of known good patterns.
-* Sanitize potentially tainted paths using `HttpRequest.MapPath`.
## Example
-In the first example, a file name is read from a `HttpRequest` and then used to access a file. However, a malicious user could enter a file name which is an absolute path - for example, "/etc/passwd". In the second example, it appears that the user is restricted to opening a file within the "user" home directory. However, a malicious user could enter a filename which contains special characters. For example, the string "../../etc/passwd" will result in the code reading the file located at "/home/\[user\]/../../etc/passwd", which is the system's password file. This file would then be sent back to the user, giving them access to all the system's passwords.
+In this example, a user-provided file name is read from a HTTP request and then used to access a file and send it back to the user. However, a malicious user could enter a file name anywhere on the file system, such as "/etc/passwd" or "../../../etc/passwd".
```csharp
@@ -26,16 +29,65 @@ public class TaintedPathHandler : IHttpHandler
{
public void ProcessRequest(HttpContext ctx)
{
- String path = ctx.Request.QueryString["path"];
+ String filename = ctx.Request.QueryString["path"];
// BAD: This could read any file on the filesystem.
- ctx.Response.Write(File.ReadAllText(path));
+ ctx.Response.Write(File.ReadAllText(filename));
+ }
+}
- // BAD: This could still read any file on the filesystem.
- ctx.Response.Write(File.ReadAllText("/home/user/" + path));
+```
+If the input should only be a file name, you can check that it doesn't contain any path separators or ".." sequences.
- // GOOD: MapPath ensures the path is safe to read from.
- string safePath = ctx.Request.MapPath(path, ctx.Request.ApplicationPath, false);
- ctx.Response.Write(File.ReadAllText(safePath));
+
+```csharp
+using System;
+using System.IO;
+using System.Web;
+
+public class TaintedPathHandler : IHttpHandler
+{
+ public void ProcessRequest(HttpContext ctx)
+ {
+ String filename = ctx.Request.QueryString["path"];
+ // GOOD: ensure that the filename has no path separators or parent directory references
+ if (filename.Contains("..") || filename.Contains("/") || filename.Contains("\\"))
+ {
+ ctx.Response.StatusCode = 400;
+ ctx.Response.StatusDescription = "Bad Request";
+ ctx.Response.Write("Invalid path");
+ return;
+ }
+ ctx.Response.Write(File.ReadAllText(filename));
+ }
+}
+
+```
+If the input should be within a specific directory, you can check that the resolved path is still contained within that directory.
+
+
+```csharp
+using System;
+using System.IO;
+using System.Web;
+
+public class TaintedPathHandler : IHttpHandler
+{
+ public void ProcessRequest(HttpContext ctx)
+ {
+ String filename = ctx.Request.QueryString["path"];
+
+ string publicFolder = Path.GetFullPath("/home/" + user + "/public");
+ string filePath = Path.GetFullPath(Path.Combine(publicFolder, filename));
+
+ // GOOD: ensure that the path stays within the public folder
+ if (!filePath.StartsWith(publicFolder + Path.DirectorySeparatorChar))
+ {
+ ctx.Response.StatusCode = 400;
+ ctx.Response.StatusDescription = "Bad Request";
+ ctx.Response.Write("Invalid path");
+ return;
+ }
+ ctx.Response.Write(File.ReadAllText(filename));
}
}
From a6b094cf533075e48aed6107ef7c26600751826e Mon Sep 17 00:00:00 2001
From: erik-krogh
Date: Mon, 5 Feb 2024 13:54:13 +0100
Subject: [PATCH 031/113] delete the rendered markdown again
---
.../Security Features/CWE-022/TaintedPath.md | 102 ------------------
1 file changed, 102 deletions(-)
delete mode 100644 csharp/ql/src/Security Features/CWE-022/TaintedPath.md
diff --git a/csharp/ql/src/Security Features/CWE-022/TaintedPath.md b/csharp/ql/src/Security Features/CWE-022/TaintedPath.md
deleted file mode 100644
index c6204c2914e..00000000000
--- a/csharp/ql/src/Security Features/CWE-022/TaintedPath.md
+++ /dev/null
@@ -1,102 +0,0 @@
-# Uncontrolled data used in path expression
-Accessing paths controlled by users can allow an attacker to access unexpected resources. This can result in sensitive information being revealed or deleted, or an attacker being able to influence behavior by modifying unexpected files.
-
-Paths that are naively constructed from data controlled by a user may be absolute paths, or may contain unexpected special characters such as "..". Such a path could point anywhere on the file system.
-
-
-## Recommendation
-Validate user input before using it to construct a file path.
-
-Common validation methods include checking that the normalized path is relative and does not contain any ".." components, or checking that the path is contained within a safe folder. The method you should use depends on how the path is used in the application, and whether the path should be a single path component.
-
-If the path should be a single path component (such as a file name), you can check for the existence of any path separators ("/" or "\\"), or ".." sequences in the input, and reject the input if any are found.
-
-Note that removing "../" sequences is *not* sufficient, since the input could still contain a path separator followed by "..". For example, the input ".../...//" would still result in the string "../" if only "../" sequences are removed.
-
-Finally, the simplest (but most restrictive) option is to use an allow list of safe patterns and make sure that the user input matches one of these patterns.
-
-
-## Example
-In this example, a user-provided file name is read from a HTTP request and then used to access a file and send it back to the user. However, a malicious user could enter a file name anywhere on the file system, such as "/etc/passwd" or "../../../etc/passwd".
-
-
-```csharp
-using System;
-using System.IO;
-using System.Web;
-
-public class TaintedPathHandler : IHttpHandler
-{
- public void ProcessRequest(HttpContext ctx)
- {
- String filename = ctx.Request.QueryString["path"];
- // BAD: This could read any file on the filesystem.
- ctx.Response.Write(File.ReadAllText(filename));
- }
-}
-
-```
-If the input should only be a file name, you can check that it doesn't contain any path separators or ".." sequences.
-
-
-```csharp
-using System;
-using System.IO;
-using System.Web;
-
-public class TaintedPathHandler : IHttpHandler
-{
- public void ProcessRequest(HttpContext ctx)
- {
- String filename = ctx.Request.QueryString["path"];
- // GOOD: ensure that the filename has no path separators or parent directory references
- if (filename.Contains("..") || filename.Contains("/") || filename.Contains("\\"))
- {
- ctx.Response.StatusCode = 400;
- ctx.Response.StatusDescription = "Bad Request";
- ctx.Response.Write("Invalid path");
- return;
- }
- ctx.Response.Write(File.ReadAllText(filename));
- }
-}
-
-```
-If the input should be within a specific directory, you can check that the resolved path is still contained within that directory.
-
-
-```csharp
-using System;
-using System.IO;
-using System.Web;
-
-public class TaintedPathHandler : IHttpHandler
-{
- public void ProcessRequest(HttpContext ctx)
- {
- String filename = ctx.Request.QueryString["path"];
-
- string publicFolder = Path.GetFullPath("/home/" + user + "/public");
- string filePath = Path.GetFullPath(Path.Combine(publicFolder, filename));
-
- // GOOD: ensure that the path stays within the public folder
- if (!filePath.StartsWith(publicFolder + Path.DirectorySeparatorChar))
- {
- ctx.Response.StatusCode = 400;
- ctx.Response.StatusDescription = "Bad Request";
- ctx.Response.Write("Invalid path");
- return;
- }
- ctx.Response.Write(File.ReadAllText(filename));
- }
-}
-
-```
-
-## References
-* OWASP: [Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal).
-* Common Weakness Enumeration: [CWE-22](https://cwe.mitre.org/data/definitions/22.html).
-* Common Weakness Enumeration: [CWE-23](https://cwe.mitre.org/data/definitions/23.html).
-* Common Weakness Enumeration: [CWE-36](https://cwe.mitre.org/data/definitions/36.html).
-* Common Weakness Enumeration: [CWE-73](https://cwe.mitre.org/data/definitions/73.html).
-* Common Weakness Enumeration: [CWE-99](https://cwe.mitre.org/data/definitions/99.html).
From f792b5842125560303ecc0019017262e0b3e3400 Mon Sep 17 00:00:00 2001
From: Harry Maclean
Date: Mon, 5 Feb 2024 16:45:59 +0000
Subject: [PATCH 032/113] Ruby: Recognise more ActiveRecord connections
---
.../codeql/ruby/frameworks/ActiveRecord.qll | 6 +-
.../active_record/ActiveRecord.expected | 227 +++++++++---------
.../frameworks/active_record/ActiveRecord.rb | 4 +
3 files changed, 125 insertions(+), 112 deletions(-)
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/ActiveRecord.qll b/ruby/ql/lib/codeql/ruby/frameworks/ActiveRecord.qll
index 843eb4f8d6e..4596c432070 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/ActiveRecord.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/ActiveRecord.qll
@@ -77,7 +77,11 @@ private predicate isUnlikelyExternalCall(API::MethodAccessNode node) {
}
private API::Node activeRecordConnectionInstance() {
- result = activeRecordBaseClass().getReturn("connection")
+ result =
+ [
+ activeRecordBaseClass().getReturn("connection"),
+ activeRecordBaseClass().getInstance().getReturn("connection")
+ ]
}
/**
diff --git a/ruby/ql/test/library-tests/frameworks/active_record/ActiveRecord.expected b/ruby/ql/test/library-tests/frameworks/active_record/ActiveRecord.expected
index d7195d11ad7..b273bddbee6 100644
--- a/ruby/ql/test/library-tests/frameworks/active_record/ActiveRecord.expected
+++ b/ruby/ql/test/library-tests/frameworks/active_record/ActiveRecord.expected
@@ -1,7 +1,7 @@
activeRecordModelClasses
| ActiveRecord.rb:1:1:3:3 | UserGroup |
-| ActiveRecord.rb:5:1:15:3 | User |
-| ActiveRecord.rb:17:1:21:3 | Admin |
+| ActiveRecord.rb:5:1:19:3 | User |
+| ActiveRecord.rb:21:1:25:3 | Admin |
| associations.rb:1:1:3:3 | Author |
| associations.rb:5:1:9:3 | Post |
| associations.rb:11:1:13:3 | Tag |
@@ -10,17 +10,20 @@ activeRecordInstances
| ActiveRecord.rb:9:5:9:68 | call to find |
| ActiveRecord.rb:13:5:13:40 | call to find_by |
| ActiveRecord.rb:13:5:13:46 | call to users |
-| ActiveRecord.rb:35:5:35:51 | call to authenticate |
-| ActiveRecord.rb:36:5:36:30 | call to find_by_name |
-| ActiveRecord.rb:55:5:57:7 | if ... |
-| ActiveRecord.rb:55:43:56:40 | then ... |
-| ActiveRecord.rb:56:7:56:40 | call to find_by |
-| ActiveRecord.rb:60:5:60:33 | call to find_by |
-| ActiveRecord.rb:62:5:62:34 | call to find |
-| ActiveRecord.rb:72:5:72:24 | call to create |
-| ActiveRecord.rb:76:5:76:66 | call to create |
-| ActiveRecord.rb:80:5:80:68 | call to create |
-| ActiveRecord.rb:84:5:84:16 | call to create |
+| ActiveRecord.rb:16:3:18:5 | self (exec) |
+| ActiveRecord.rb:16:3:18:5 | self in exec |
+| ActiveRecord.rb:17:5:17:14 | self |
+| ActiveRecord.rb:39:5:39:51 | call to authenticate |
+| ActiveRecord.rb:40:5:40:30 | call to find_by_name |
+| ActiveRecord.rb:59:5:61:7 | if ... |
+| ActiveRecord.rb:59:43:60:40 | then ... |
+| ActiveRecord.rb:60:7:60:40 | call to find_by |
+| ActiveRecord.rb:64:5:64:33 | call to find_by |
+| ActiveRecord.rb:66:5:66:34 | call to find |
+| ActiveRecord.rb:76:5:76:24 | call to create |
+| ActiveRecord.rb:80:5:80:66 | call to create |
+| ActiveRecord.rb:84:5:84:68 | call to create |
+| ActiveRecord.rb:88:5:88:16 | call to create |
| associations.rb:19:1:19:7 | author1 |
| associations.rb:19:1:19:20 | ... = ... |
| associations.rb:19:11:19:20 | call to new |
@@ -105,46 +108,47 @@ activeRecordInstances
| associations.rb:53:1:53:34 | call to find |
activeRecordSqlExecutionRanges
| ActiveRecord.rb:9:33:9:67 | "name='#{...}' and pass='#{...}'" |
-| ActiveRecord.rb:19:16:19:24 | condition |
-| ActiveRecord.rb:28:30:28:44 | ...[...] |
-| ActiveRecord.rb:29:20:29:42 | "id = '#{...}'" |
-| ActiveRecord.rb:30:21:30:45 | call to [] |
-| ActiveRecord.rb:31:16:31:21 | <<-SQL |
-| ActiveRecord.rb:34:20:34:47 | "user.id = '#{...}'" |
-| ActiveRecord.rb:46:20:46:32 | ... + ... |
-| ActiveRecord.rb:52:16:52:28 | "name #{...}" |
-| ActiveRecord.rb:56:20:56:39 | "username = #{...}" |
-| ActiveRecord.rb:68:21:68:44 | ...[...] |
-| ActiveRecord.rb:106:27:106:76 | "this is an unsafe annotation:..." |
+| ActiveRecord.rb:17:24:17:24 | q |
+| ActiveRecord.rb:23:16:23:24 | condition |
+| ActiveRecord.rb:32:30:32:44 | ...[...] |
+| ActiveRecord.rb:33:20:33:42 | "id = '#{...}'" |
+| ActiveRecord.rb:34:21:34:45 | call to [] |
+| ActiveRecord.rb:35:16:35:21 | <<-SQL |
+| ActiveRecord.rb:38:20:38:47 | "user.id = '#{...}'" |
+| ActiveRecord.rb:50:20:50:32 | ... + ... |
+| ActiveRecord.rb:56:16:56:28 | "name #{...}" |
+| ActiveRecord.rb:60:20:60:39 | "username = #{...}" |
+| ActiveRecord.rb:72:21:72:44 | ...[...] |
+| ActiveRecord.rb:110:27:110:76 | "this is an unsafe annotation:..." |
activeRecordModelClassMethodCalls
| ActiveRecord.rb:2:3:2:17 | call to has_many |
| ActiveRecord.rb:6:3:6:24 | call to belongs_to |
| ActiveRecord.rb:9:5:9:68 | call to find |
| ActiveRecord.rb:13:5:13:40 | call to find_by |
| ActiveRecord.rb:13:5:13:46 | call to users |
-| ActiveRecord.rb:19:5:19:25 | call to destroy_by |
-| ActiveRecord.rb:28:5:28:45 | call to calculate |
-| ActiveRecord.rb:29:5:29:43 | call to delete_by |
-| ActiveRecord.rb:30:5:30:46 | call to destroy_by |
-| ActiveRecord.rb:31:5:31:35 | call to where |
-| ActiveRecord.rb:34:5:34:14 | call to where |
-| ActiveRecord.rb:34:5:34:48 | call to not |
-| ActiveRecord.rb:36:5:36:30 | call to find_by_name |
-| ActiveRecord.rb:37:5:37:36 | call to not_a_find_by_method |
-| ActiveRecord.rb:46:5:46:33 | call to delete_by |
-| ActiveRecord.rb:52:5:52:29 | call to order |
-| ActiveRecord.rb:56:7:56:40 | call to find_by |
-| ActiveRecord.rb:60:5:60:33 | call to find_by |
-| ActiveRecord.rb:62:5:62:34 | call to find |
-| ActiveRecord.rb:72:5:72:24 | call to create |
-| ActiveRecord.rb:76:5:76:66 | call to create |
-| ActiveRecord.rb:80:5:80:68 | call to create |
-| ActiveRecord.rb:84:5:84:16 | call to create |
-| ActiveRecord.rb:88:5:88:27 | call to update |
-| ActiveRecord.rb:92:5:92:69 | call to update |
-| ActiveRecord.rb:96:5:96:71 | call to update |
-| ActiveRecord.rb:102:13:102:54 | call to annotate |
-| ActiveRecord.rb:106:13:106:77 | call to annotate |
+| ActiveRecord.rb:23:5:23:25 | call to destroy_by |
+| ActiveRecord.rb:32:5:32:45 | call to calculate |
+| ActiveRecord.rb:33:5:33:43 | call to delete_by |
+| ActiveRecord.rb:34:5:34:46 | call to destroy_by |
+| ActiveRecord.rb:35:5:35:35 | call to where |
+| ActiveRecord.rb:38:5:38:14 | call to where |
+| ActiveRecord.rb:38:5:38:48 | call to not |
+| ActiveRecord.rb:40:5:40:30 | call to find_by_name |
+| ActiveRecord.rb:41:5:41:36 | call to not_a_find_by_method |
+| ActiveRecord.rb:50:5:50:33 | call to delete_by |
+| ActiveRecord.rb:56:5:56:29 | call to order |
+| ActiveRecord.rb:60:7:60:40 | call to find_by |
+| ActiveRecord.rb:64:5:64:33 | call to find_by |
+| ActiveRecord.rb:66:5:66:34 | call to find |
+| ActiveRecord.rb:76:5:76:24 | call to create |
+| ActiveRecord.rb:80:5:80:66 | call to create |
+| ActiveRecord.rb:84:5:84:68 | call to create |
+| ActiveRecord.rb:88:5:88:16 | call to create |
+| ActiveRecord.rb:92:5:92:27 | call to update |
+| ActiveRecord.rb:96:5:96:69 | call to update |
+| ActiveRecord.rb:100:5:100:71 | call to update |
+| ActiveRecord.rb:106:13:106:54 | call to annotate |
+| ActiveRecord.rb:110:13:110:77 | call to annotate |
| associations.rb:2:3:2:17 | call to has_many |
| associations.rb:6:3:6:20 | call to belongs_to |
| associations.rb:7:3:7:20 | call to has_many |
@@ -200,41 +204,41 @@ activeRecordModelClassMethodCalls
activeRecordModelClassMethodCallsReplacement
| ActiveRecord.rb:1:1:3:3 | UserGroup | ActiveRecord.rb:2:3:2:17 | call to has_many |
| ActiveRecord.rb:1:1:3:3 | UserGroup | ActiveRecord.rb:13:5:13:40 | call to find_by |
-| ActiveRecord.rb:5:1:15:3 | User | ActiveRecord.rb:6:3:6:24 | call to belongs_to |
-| ActiveRecord.rb:5:1:15:3 | User | ActiveRecord.rb:9:5:9:68 | call to find |
-| ActiveRecord.rb:5:1:15:3 | User | ActiveRecord.rb:19:5:19:25 | call to destroy_by |
-| ActiveRecord.rb:5:1:15:3 | User | ActiveRecord.rb:28:5:28:45 | call to calculate |
-| ActiveRecord.rb:5:1:15:3 | User | ActiveRecord.rb:29:5:29:43 | call to delete_by |
-| ActiveRecord.rb:5:1:15:3 | User | ActiveRecord.rb:30:5:30:46 | call to destroy_by |
-| ActiveRecord.rb:5:1:15:3 | User | ActiveRecord.rb:31:5:31:35 | call to where |
-| ActiveRecord.rb:5:1:15:3 | User | ActiveRecord.rb:34:5:34:14 | call to where |
-| ActiveRecord.rb:5:1:15:3 | User | ActiveRecord.rb:35:5:35:51 | call to authenticate |
-| ActiveRecord.rb:5:1:15:3 | User | ActiveRecord.rb:36:5:36:30 | call to find_by_name |
-| ActiveRecord.rb:5:1:15:3 | User | ActiveRecord.rb:37:5:37:36 | call to not_a_find_by_method |
-| ActiveRecord.rb:5:1:15:3 | User | ActiveRecord.rb:46:5:46:33 | call to delete_by |
-| ActiveRecord.rb:5:1:15:3 | User | ActiveRecord.rb:52:5:52:29 | call to order |
-| ActiveRecord.rb:5:1:15:3 | User | ActiveRecord.rb:56:7:56:40 | call to find_by |
-| ActiveRecord.rb:5:1:15:3 | User | ActiveRecord.rb:60:5:60:33 | call to find_by |
-| ActiveRecord.rb:5:1:15:3 | User | ActiveRecord.rb:62:5:62:34 | call to find |
-| ActiveRecord.rb:5:1:15:3 | User | ActiveRecord.rb:68:5:68:45 | call to delete_by |
-| ActiveRecord.rb:5:1:15:3 | User | ActiveRecord.rb:72:5:72:24 | call to create |
-| ActiveRecord.rb:5:1:15:3 | User | ActiveRecord.rb:76:5:76:66 | call to create |
-| ActiveRecord.rb:5:1:15:3 | User | ActiveRecord.rb:80:5:80:68 | call to create |
-| ActiveRecord.rb:5:1:15:3 | User | ActiveRecord.rb:84:5:84:16 | call to create |
-| ActiveRecord.rb:5:1:15:3 | User | ActiveRecord.rb:88:5:88:27 | call to update |
-| ActiveRecord.rb:5:1:15:3 | User | ActiveRecord.rb:92:5:92:69 | call to update |
-| ActiveRecord.rb:5:1:15:3 | User | ActiveRecord.rb:96:5:96:71 | call to update |
-| ActiveRecord.rb:5:1:15:3 | User | ActiveRecord.rb:102:13:102:54 | call to annotate |
-| ActiveRecord.rb:5:1:15:3 | User | ActiveRecord.rb:106:13:106:77 | call to annotate |
-| ActiveRecord.rb:17:1:21:3 | Admin | ActiveRecord.rb:19:5:19:25 | call to destroy_by |
-| ActiveRecord.rb:17:1:21:3 | Admin | ActiveRecord.rb:68:5:68:45 | call to delete_by |
-| ActiveRecord.rb:17:1:21:3 | Admin | ActiveRecord.rb:72:5:72:24 | call to create |
-| ActiveRecord.rb:17:1:21:3 | Admin | ActiveRecord.rb:76:5:76:66 | call to create |
-| ActiveRecord.rb:17:1:21:3 | Admin | ActiveRecord.rb:80:5:80:68 | call to create |
-| ActiveRecord.rb:17:1:21:3 | Admin | ActiveRecord.rb:84:5:84:16 | call to create |
-| ActiveRecord.rb:17:1:21:3 | Admin | ActiveRecord.rb:88:5:88:27 | call to update |
-| ActiveRecord.rb:17:1:21:3 | Admin | ActiveRecord.rb:92:5:92:69 | call to update |
-| ActiveRecord.rb:17:1:21:3 | Admin | ActiveRecord.rb:96:5:96:71 | call to update |
+| ActiveRecord.rb:5:1:19:3 | User | ActiveRecord.rb:6:3:6:24 | call to belongs_to |
+| ActiveRecord.rb:5:1:19:3 | User | ActiveRecord.rb:9:5:9:68 | call to find |
+| ActiveRecord.rb:5:1:19:3 | User | ActiveRecord.rb:23:5:23:25 | call to destroy_by |
+| ActiveRecord.rb:5:1:19:3 | User | ActiveRecord.rb:32:5:32:45 | call to calculate |
+| ActiveRecord.rb:5:1:19:3 | User | ActiveRecord.rb:33:5:33:43 | call to delete_by |
+| ActiveRecord.rb:5:1:19:3 | User | ActiveRecord.rb:34:5:34:46 | call to destroy_by |
+| ActiveRecord.rb:5:1:19:3 | User | ActiveRecord.rb:35:5:35:35 | call to where |
+| ActiveRecord.rb:5:1:19:3 | User | ActiveRecord.rb:38:5:38:14 | call to where |
+| ActiveRecord.rb:5:1:19:3 | User | ActiveRecord.rb:39:5:39:51 | call to authenticate |
+| ActiveRecord.rb:5:1:19:3 | User | ActiveRecord.rb:40:5:40:30 | call to find_by_name |
+| ActiveRecord.rb:5:1:19:3 | User | ActiveRecord.rb:41:5:41:36 | call to not_a_find_by_method |
+| ActiveRecord.rb:5:1:19:3 | User | ActiveRecord.rb:50:5:50:33 | call to delete_by |
+| ActiveRecord.rb:5:1:19:3 | User | ActiveRecord.rb:56:5:56:29 | call to order |
+| ActiveRecord.rb:5:1:19:3 | User | ActiveRecord.rb:60:7:60:40 | call to find_by |
+| ActiveRecord.rb:5:1:19:3 | User | ActiveRecord.rb:64:5:64:33 | call to find_by |
+| ActiveRecord.rb:5:1:19:3 | User | ActiveRecord.rb:66:5:66:34 | call to find |
+| ActiveRecord.rb:5:1:19:3 | User | ActiveRecord.rb:72:5:72:45 | call to delete_by |
+| ActiveRecord.rb:5:1:19:3 | User | ActiveRecord.rb:76:5:76:24 | call to create |
+| ActiveRecord.rb:5:1:19:3 | User | ActiveRecord.rb:80:5:80:66 | call to create |
+| ActiveRecord.rb:5:1:19:3 | User | ActiveRecord.rb:84:5:84:68 | call to create |
+| ActiveRecord.rb:5:1:19:3 | User | ActiveRecord.rb:88:5:88:16 | call to create |
+| ActiveRecord.rb:5:1:19:3 | User | ActiveRecord.rb:92:5:92:27 | call to update |
+| ActiveRecord.rb:5:1:19:3 | User | ActiveRecord.rb:96:5:96:69 | call to update |
+| ActiveRecord.rb:5:1:19:3 | User | ActiveRecord.rb:100:5:100:71 | call to update |
+| ActiveRecord.rb:5:1:19:3 | User | ActiveRecord.rb:106:13:106:54 | call to annotate |
+| ActiveRecord.rb:5:1:19:3 | User | ActiveRecord.rb:110:13:110:77 | call to annotate |
+| ActiveRecord.rb:21:1:25:3 | Admin | ActiveRecord.rb:23:5:23:25 | call to destroy_by |
+| ActiveRecord.rb:21:1:25:3 | Admin | ActiveRecord.rb:72:5:72:45 | call to delete_by |
+| ActiveRecord.rb:21:1:25:3 | Admin | ActiveRecord.rb:76:5:76:24 | call to create |
+| ActiveRecord.rb:21:1:25:3 | Admin | ActiveRecord.rb:80:5:80:66 | call to create |
+| ActiveRecord.rb:21:1:25:3 | Admin | ActiveRecord.rb:84:5:84:68 | call to create |
+| ActiveRecord.rb:21:1:25:3 | Admin | ActiveRecord.rb:88:5:88:16 | call to create |
+| ActiveRecord.rb:21:1:25:3 | Admin | ActiveRecord.rb:92:5:92:27 | call to update |
+| ActiveRecord.rb:21:1:25:3 | Admin | ActiveRecord.rb:96:5:96:69 | call to update |
+| ActiveRecord.rb:21:1:25:3 | Admin | ActiveRecord.rb:100:5:100:71 | call to update |
| associations.rb:1:1:3:3 | Author | associations.rb:2:3:2:17 | call to has_many |
| associations.rb:1:1:3:3 | Author | associations.rb:19:11:19:20 | call to new |
| associations.rb:5:1:9:3 | Post | associations.rb:6:3:6:20 | call to belongs_to |
@@ -244,28 +248,29 @@ activeRecordModelClassMethodCallsReplacement
| associations.rb:15:1:17:3 | Comment | associations.rb:16:3:16:18 | call to belongs_to |
potentiallyUnsafeSqlExecutingMethodCall
| ActiveRecord.rb:9:5:9:68 | call to find |
-| ActiveRecord.rb:19:5:19:25 | call to destroy_by |
-| ActiveRecord.rb:28:5:28:45 | call to calculate |
-| ActiveRecord.rb:29:5:29:43 | call to delete_by |
-| ActiveRecord.rb:30:5:30:46 | call to destroy_by |
-| ActiveRecord.rb:31:5:31:35 | call to where |
-| ActiveRecord.rb:34:5:34:48 | call to not |
-| ActiveRecord.rb:46:5:46:33 | call to delete_by |
-| ActiveRecord.rb:52:5:52:29 | call to order |
-| ActiveRecord.rb:56:7:56:40 | call to find_by |
-| ActiveRecord.rb:106:13:106:77 | call to annotate |
+| ActiveRecord.rb:23:5:23:25 | call to destroy_by |
+| ActiveRecord.rb:32:5:32:45 | call to calculate |
+| ActiveRecord.rb:33:5:33:43 | call to delete_by |
+| ActiveRecord.rb:34:5:34:46 | call to destroy_by |
+| ActiveRecord.rb:35:5:35:35 | call to where |
+| ActiveRecord.rb:38:5:38:48 | call to not |
+| ActiveRecord.rb:50:5:50:33 | call to delete_by |
+| ActiveRecord.rb:56:5:56:29 | call to order |
+| ActiveRecord.rb:60:7:60:40 | call to find_by |
+| ActiveRecord.rb:110:13:110:77 | call to annotate |
activeRecordModelInstantiations
-| ActiveRecord.rb:9:5:9:68 | call to find | ActiveRecord.rb:5:1:15:3 | User |
+| ActiveRecord.rb:9:5:9:68 | call to find | ActiveRecord.rb:5:1:19:3 | User |
| ActiveRecord.rb:13:5:13:40 | call to find_by | ActiveRecord.rb:1:1:3:3 | UserGroup |
-| ActiveRecord.rb:13:5:13:46 | call to users | ActiveRecord.rb:5:1:15:3 | User |
-| ActiveRecord.rb:36:5:36:30 | call to find_by_name | ActiveRecord.rb:5:1:15:3 | User |
-| ActiveRecord.rb:56:7:56:40 | call to find_by | ActiveRecord.rb:5:1:15:3 | User |
-| ActiveRecord.rb:60:5:60:33 | call to find_by | ActiveRecord.rb:5:1:15:3 | User |
-| ActiveRecord.rb:62:5:62:34 | call to find | ActiveRecord.rb:5:1:15:3 | User |
-| ActiveRecord.rb:72:5:72:24 | call to create | ActiveRecord.rb:17:1:21:3 | Admin |
-| ActiveRecord.rb:76:5:76:66 | call to create | ActiveRecord.rb:17:1:21:3 | Admin |
-| ActiveRecord.rb:80:5:80:68 | call to create | ActiveRecord.rb:17:1:21:3 | Admin |
-| ActiveRecord.rb:84:5:84:16 | call to create | ActiveRecord.rb:17:1:21:3 | Admin |
+| ActiveRecord.rb:13:5:13:46 | call to users | ActiveRecord.rb:5:1:19:3 | User |
+| ActiveRecord.rb:16:3:18:5 | self in exec | ActiveRecord.rb:5:1:19:3 | User |
+| ActiveRecord.rb:40:5:40:30 | call to find_by_name | ActiveRecord.rb:5:1:19:3 | User |
+| ActiveRecord.rb:60:7:60:40 | call to find_by | ActiveRecord.rb:5:1:19:3 | User |
+| ActiveRecord.rb:64:5:64:33 | call to find_by | ActiveRecord.rb:5:1:19:3 | User |
+| ActiveRecord.rb:66:5:66:34 | call to find | ActiveRecord.rb:5:1:19:3 | User |
+| ActiveRecord.rb:76:5:76:24 | call to create | ActiveRecord.rb:21:1:25:3 | Admin |
+| ActiveRecord.rb:80:5:80:66 | call to create | ActiveRecord.rb:21:1:25:3 | Admin |
+| ActiveRecord.rb:84:5:84:68 | call to create | ActiveRecord.rb:21:1:25:3 | Admin |
+| ActiveRecord.rb:88:5:88:16 | call to create | ActiveRecord.rb:21:1:25:3 | Admin |
| associations.rb:19:11:19:20 | call to new | associations.rb:1:1:3:3 | Author |
| associations.rb:21:9:21:21 | call to posts | associations.rb:5:1:9:3 | Post |
| associations.rb:21:9:21:28 | call to create | associations.rb:5:1:9:3 | Post |
@@ -307,13 +312,13 @@ activeRecordModelInstantiations
| associations.rb:53:1:53:13 | call to posts | associations.rb:5:1:9:3 | Post |
| associations.rb:53:1:53:20 | call to reload | associations.rb:5:1:9:3 | Post |
persistentWriteAccesses
-| ActiveRecord.rb:72:5:72:24 | call to create | ActiveRecord.rb:72:18:72:23 | call to params |
-| ActiveRecord.rb:76:5:76:66 | call to create | ActiveRecord.rb:76:24:76:36 | ...[...] |
-| ActiveRecord.rb:76:5:76:66 | call to create | ActiveRecord.rb:76:49:76:65 | ...[...] |
-| ActiveRecord.rb:80:5:80:68 | call to create | ActiveRecord.rb:80:25:80:37 | ...[...] |
-| ActiveRecord.rb:80:5:80:68 | call to create | ActiveRecord.rb:80:50:80:66 | ...[...] |
-| ActiveRecord.rb:88:5:88:27 | call to update | ActiveRecord.rb:88:21:88:26 | call to params |
-| ActiveRecord.rb:92:5:92:69 | call to update | ActiveRecord.rb:92:27:92:39 | ...[...] |
-| ActiveRecord.rb:92:5:92:69 | call to update | ActiveRecord.rb:92:52:92:68 | ...[...] |
-| ActiveRecord.rb:96:5:96:71 | call to update | ActiveRecord.rb:96:21:96:70 | call to [] |
+| ActiveRecord.rb:76:5:76:24 | call to create | ActiveRecord.rb:76:18:76:23 | call to params |
+| ActiveRecord.rb:80:5:80:66 | call to create | ActiveRecord.rb:80:24:80:36 | ...[...] |
+| ActiveRecord.rb:80:5:80:66 | call to create | ActiveRecord.rb:80:49:80:65 | ...[...] |
+| ActiveRecord.rb:84:5:84:68 | call to create | ActiveRecord.rb:84:25:84:37 | ...[...] |
+| ActiveRecord.rb:84:5:84:68 | call to create | ActiveRecord.rb:84:50:84:66 | ...[...] |
+| ActiveRecord.rb:92:5:92:27 | call to update | ActiveRecord.rb:92:21:92:26 | call to params |
+| ActiveRecord.rb:96:5:96:69 | call to update | ActiveRecord.rb:96:27:96:39 | ...[...] |
+| ActiveRecord.rb:96:5:96:69 | call to update | ActiveRecord.rb:96:52:96:68 | ...[...] |
+| ActiveRecord.rb:100:5:100:71 | call to update | ActiveRecord.rb:100:21:100:70 | call to [] |
| associations.rb:31:16:31:22 | ... = ... | associations.rb:31:16:31:22 | author2 |
diff --git a/ruby/ql/test/library-tests/frameworks/active_record/ActiveRecord.rb b/ruby/ql/test/library-tests/frameworks/active_record/ActiveRecord.rb
index 8e5961c8771..dca8f3c43d3 100644
--- a/ruby/ql/test/library-tests/frameworks/active_record/ActiveRecord.rb
+++ b/ruby/ql/test/library-tests/frameworks/active_record/ActiveRecord.rb
@@ -12,6 +12,10 @@ class User < ApplicationRecord
def self.from(user_group_id)
UserGroup.find_by(id: user_group_id).users
end
+
+ def exec(q)
+ connection.execute(q)
+ end
end
class Admin < User
From c1b35fbf475dbb89785ca6041492cf6eb1339981 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
Date: Mon, 5 Feb 2024 17:58:57 +0000
Subject: [PATCH 033/113] Release preparation for version 2.16.2
---
cpp/ql/lib/CHANGELOG.md | 7 +++++++
.../lib/change-notes/2024-01-30-throwing-model.md | 4 ----
.../0.12.5.md} | 8 +++++---
cpp/ql/lib/codeql-pack.release.yml | 2 +-
cpp/ql/lib/qlpack.yml | 2 +-
cpp/ql/src/CHANGELOG.md | 11 +++++++++++
.../change-notes/2024-01-19-extracted-files.md | 4 ----
...e_positive_incorrect_string_type_conversion.md | 4 ----
.../2024-01-29-incorrectly-checked-scanf-2.md | 4 ----
.../2024-01-29-incorrectly-checked-scanf.md | 4 ----
...24-01-29-uninitialized-local-false-positive.md | 5 -----
cpp/ql/src/change-notes/released/0.9.4.md | 10 ++++++++++
cpp/ql/src/codeql-pack.release.yml | 2 +-
cpp/ql/src/qlpack.yml | 2 +-
csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md | 4 ++++
.../Solorigate/lib/change-notes/released/1.7.8.md | 3 +++
.../Solorigate/lib/codeql-pack.release.yml | 2 +-
csharp/ql/campaigns/Solorigate/lib/qlpack.yml | 2 +-
csharp/ql/campaigns/Solorigate/src/CHANGELOG.md | 4 ++++
.../Solorigate/src/change-notes/released/1.7.8.md | 3 +++
.../Solorigate/src/codeql-pack.release.yml | 2 +-
csharp/ql/campaigns/Solorigate/src/qlpack.yml | 2 +-
csharp/ql/lib/CHANGELOG.md | 11 +++++++++++
.../2024-01-25-extractor-option-logging.md | 6 ------
.../2024-01-26-collection-expression.md | 4 ----
.../2024-01-31-compilation-expanded-args.md | 5 -----
csharp/ql/lib/change-notes/released/0.8.8.md | 10 ++++++++++
csharp/ql/lib/codeql-pack.release.yml | 2 +-
csharp/ql/lib/qlpack.yml | 2 +-
csharp/ql/src/CHANGELOG.md | 6 ++++++
.../0.8.8.md} | 7 ++++---
csharp/ql/src/codeql-pack.release.yml | 2 +-
csharp/ql/src/qlpack.yml | 2 +-
go/ql/consistency-queries/CHANGELOG.md | 4 ++++
.../change-notes/released/0.0.7.md | 3 +++
go/ql/consistency-queries/codeql-pack.release.yml | 2 +-
go/ql/consistency-queries/qlpack.yml | 2 +-
go/ql/lib/CHANGELOG.md | 4 ++++
go/ql/lib/change-notes/released/0.7.8.md | 3 +++
go/ql/lib/codeql-pack.release.yml | 2 +-
go/ql/lib/qlpack.yml | 2 +-
go/ql/src/CHANGELOG.md | 4 ++++
go/ql/src/change-notes/released/0.7.8.md | 3 +++
go/ql/src/codeql-pack.release.yml | 2 +-
go/ql/src/qlpack.yml | 2 +-
java/ql/automodel/src/CHANGELOG.md | 4 ++++
.../automodel/src/change-notes/released/0.0.14.md | 3 +++
java/ql/automodel/src/codeql-pack.release.yml | 2 +-
java/ql/automodel/src/qlpack.yml | 2 +-
java/ql/lib/CHANGELOG.md | 10 ++++++++++
java/ql/lib/change-notes/2024-01-24-new-models.md | 7 -------
.../0.8.8.md} | 11 ++++++++---
java/ql/lib/codeql-pack.release.yml | 2 +-
java/ql/lib/qlpack.yml | 2 +-
java/ql/src/CHANGELOG.md | 15 +++++++++++----
...-01-15-android-sensitive-notification-query.md | 4 ----
...24-01-29-android-sensitive-text-field-query.md | 4 ----
java/ql/src/change-notes/released/0.8.8.md | 6 ++++++
java/ql/src/codeql-pack.release.yml | 2 +-
java/ql/src/qlpack.yml | 2 +-
javascript/ql/lib/CHANGELOG.md | 4 ++++
javascript/ql/lib/change-notes/released/0.8.8.md | 3 +++
javascript/ql/lib/codeql-pack.release.yml | 2 +-
javascript/ql/lib/qlpack.yml | 2 +-
javascript/ql/src/CHANGELOG.md | 4 ++++
javascript/ql/src/change-notes/released/0.8.8.md | 3 +++
javascript/ql/src/codeql-pack.release.yml | 2 +-
javascript/ql/src/qlpack.yml | 2 +-
misc/suite-helpers/CHANGELOG.md | 4 ++++
misc/suite-helpers/change-notes/released/0.7.8.md | 3 +++
misc/suite-helpers/codeql-pack.release.yml | 2 +-
misc/suite-helpers/qlpack.yml | 2 +-
python/ql/lib/CHANGELOG.md | 10 ++++++++++
.../change-notes/2024-01-21-regex-ascii-flag.md | 4 ----
.../ql/lib/change-notes/2024-01-22-html-escape.md | 4 ----
python/ql/lib/change-notes/released/0.11.8.md | 9 +++++++++
python/ql/lib/codeql-pack.release.yml | 2 +-
python/ql/lib/qlpack.yml | 2 +-
python/ql/src/CHANGELOG.md | 4 ++++
python/ql/src/change-notes/released/0.9.8.md | 3 +++
python/ql/src/codeql-pack.release.yml | 2 +-
python/ql/src/qlpack.yml | 2 +-
ruby/ql/lib/CHANGELOG.md | 6 ++++++
.../0.8.8.md} | 7 ++++---
ruby/ql/lib/codeql-pack.release.yml | 2 +-
ruby/ql/lib/qlpack.yml | 2 +-
ruby/ql/src/CHANGELOG.md | 11 +++++++++++
.../2023-12-18-insecure-randomness-query.md | 4 ----
.../2024-01-30-unsafe-deserialization-sinks.md | 5 -----
ruby/ql/src/change-notes/released/0.8.8.md | 10 ++++++++++
ruby/ql/src/codeql-pack.release.yml | 2 +-
ruby/ql/src/qlpack.yml | 2 +-
shared/controlflow/CHANGELOG.md | 4 ++++
shared/controlflow/change-notes/released/0.1.8.md | 3 +++
shared/controlflow/codeql-pack.release.yml | 2 +-
shared/controlflow/qlpack.yml | 2 +-
shared/dataflow/CHANGELOG.md | 4 ++++
shared/dataflow/change-notes/released/0.1.8.md | 3 +++
shared/dataflow/codeql-pack.release.yml | 2 +-
shared/dataflow/qlpack.yml | 2 +-
shared/mad/CHANGELOG.md | 4 ++++
shared/mad/change-notes/released/0.2.8.md | 3 +++
shared/mad/codeql-pack.release.yml | 2 +-
shared/mad/qlpack.yml | 2 +-
shared/rangeanalysis/CHANGELOG.md | 4 ++++
.../rangeanalysis/change-notes/released/0.0.7.md | 3 +++
shared/rangeanalysis/codeql-pack.release.yml | 2 +-
shared/rangeanalysis/qlpack.yml | 2 +-
shared/regex/CHANGELOG.md | 4 ++++
shared/regex/change-notes/released/0.2.8.md | 3 +++
shared/regex/codeql-pack.release.yml | 2 +-
shared/regex/qlpack.yml | 2 +-
shared/ssa/CHANGELOG.md | 4 ++++
shared/ssa/change-notes/released/0.2.8.md | 3 +++
shared/ssa/codeql-pack.release.yml | 2 +-
shared/ssa/qlpack.yml | 2 +-
shared/threat-models/CHANGELOG.md | 4 ++++
.../threat-models/change-notes/released/0.0.7.md | 3 +++
shared/threat-models/codeql-pack.release.yml | 2 +-
shared/threat-models/qlpack.yml | 2 +-
shared/tutorial/CHANGELOG.md | 4 ++++
shared/tutorial/change-notes/released/0.2.8.md | 3 +++
shared/tutorial/codeql-pack.release.yml | 2 +-
shared/tutorial/qlpack.yml | 2 +-
shared/typetracking/CHANGELOG.md | 4 ++++
.../typetracking/change-notes/released/0.2.8.md | 3 +++
shared/typetracking/codeql-pack.release.yml | 2 +-
shared/typetracking/qlpack.yml | 2 +-
shared/typos/CHANGELOG.md | 4 ++++
shared/typos/change-notes/released/0.2.8.md | 3 +++
shared/typos/codeql-pack.release.yml | 2 +-
shared/typos/qlpack.yml | 2 +-
shared/util/CHANGELOG.md | 4 ++++
shared/util/change-notes/released/0.2.8.md | 3 +++
shared/util/codeql-pack.release.yml | 2 +-
shared/util/qlpack.yml | 2 +-
shared/yaml/CHANGELOG.md | 4 ++++
shared/yaml/change-notes/released/0.2.8.md | 3 +++
shared/yaml/codeql-pack.release.yml | 2 +-
shared/yaml/qlpack.yml | 2 +-
swift/ql/lib/CHANGELOG.md | 4 ++++
swift/ql/lib/change-notes/released/0.3.8.md | 3 +++
swift/ql/lib/codeql-pack.release.yml | 2 +-
swift/ql/lib/qlpack.yml | 2 +-
swift/ql/src/CHANGELOG.md | 4 ++++
swift/ql/src/change-notes/released/0.3.8.md | 3 +++
swift/ql/src/codeql-pack.release.yml | 2 +-
swift/ql/src/qlpack.yml | 2 +-
148 files changed, 383 insertions(+), 154 deletions(-)
delete mode 100644 cpp/ql/lib/change-notes/2024-01-30-throwing-model.md
rename cpp/ql/lib/change-notes/{2024-01-30-preproc-block.md => released/0.12.5.md} (55%)
delete mode 100644 cpp/ql/src/change-notes/2024-01-19-extracted-files.md
delete mode 100644 cpp/ql/src/change-notes/2024-01-29-false_positive_incorrect_string_type_conversion.md
delete mode 100644 cpp/ql/src/change-notes/2024-01-29-incorrectly-checked-scanf-2.md
delete mode 100644 cpp/ql/src/change-notes/2024-01-29-incorrectly-checked-scanf.md
delete mode 100644 cpp/ql/src/change-notes/2024-01-29-uninitialized-local-false-positive.md
create mode 100644 cpp/ql/src/change-notes/released/0.9.4.md
create mode 100644 csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.8.md
create mode 100644 csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.8.md
delete mode 100644 csharp/ql/lib/change-notes/2024-01-25-extractor-option-logging.md
delete mode 100644 csharp/ql/lib/change-notes/2024-01-26-collection-expression.md
delete mode 100644 csharp/ql/lib/change-notes/2024-01-31-compilation-expanded-args.md
create mode 100644 csharp/ql/lib/change-notes/released/0.8.8.md
rename csharp/ql/src/change-notes/{2024-01-22-url-redirect-sanitizer.md => released/0.8.8.md} (75%)
create mode 100644 go/ql/consistency-queries/change-notes/released/0.0.7.md
create mode 100644 go/ql/lib/change-notes/released/0.7.8.md
create mode 100644 go/ql/src/change-notes/released/0.7.8.md
create mode 100644 java/ql/automodel/src/change-notes/released/0.0.14.md
delete mode 100644 java/ql/lib/change-notes/2024-01-24-new-models.md
rename java/ql/lib/change-notes/{2024-01-23-add-uuid-and-date-to-simpletypesanitizer.md => released/0.8.8.md} (52%)
delete mode 100644 java/ql/src/change-notes/2024-01-15-android-sensitive-notification-query.md
delete mode 100644 java/ql/src/change-notes/2024-01-29-android-sensitive-text-field-query.md
create mode 100644 java/ql/src/change-notes/released/0.8.8.md
create mode 100644 javascript/ql/lib/change-notes/released/0.8.8.md
create mode 100644 javascript/ql/src/change-notes/released/0.8.8.md
create mode 100644 misc/suite-helpers/change-notes/released/0.7.8.md
delete mode 100644 python/ql/lib/change-notes/2024-01-21-regex-ascii-flag.md
delete mode 100644 python/ql/lib/change-notes/2024-01-22-html-escape.md
create mode 100644 python/ql/lib/change-notes/released/0.11.8.md
create mode 100644 python/ql/src/change-notes/released/0.9.8.md
rename ruby/ql/lib/change-notes/{2024-01-22-erb-render-flow.md => released/0.8.8.md} (79%)
delete mode 100644 ruby/ql/src/change-notes/2023-12-18-insecure-randomness-query.md
delete mode 100644 ruby/ql/src/change-notes/2024-01-30-unsafe-deserialization-sinks.md
create mode 100644 ruby/ql/src/change-notes/released/0.8.8.md
create mode 100644 shared/controlflow/change-notes/released/0.1.8.md
create mode 100644 shared/dataflow/change-notes/released/0.1.8.md
create mode 100644 shared/mad/change-notes/released/0.2.8.md
create mode 100644 shared/rangeanalysis/change-notes/released/0.0.7.md
create mode 100644 shared/regex/change-notes/released/0.2.8.md
create mode 100644 shared/ssa/change-notes/released/0.2.8.md
create mode 100644 shared/threat-models/change-notes/released/0.0.7.md
create mode 100644 shared/tutorial/change-notes/released/0.2.8.md
create mode 100644 shared/typetracking/change-notes/released/0.2.8.md
create mode 100644 shared/typos/change-notes/released/0.2.8.md
create mode 100644 shared/util/change-notes/released/0.2.8.md
create mode 100644 shared/yaml/change-notes/released/0.2.8.md
create mode 100644 swift/ql/lib/change-notes/released/0.3.8.md
create mode 100644 swift/ql/src/change-notes/released/0.3.8.md
diff --git a/cpp/ql/lib/CHANGELOG.md b/cpp/ql/lib/CHANGELOG.md
index dc092f2ed35..b552a329250 100644
--- a/cpp/ql/lib/CHANGELOG.md
+++ b/cpp/ql/lib/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 0.12.5
+
+### New Features
+
+* Added the `PreprocBlock.qll` library to this repository. This library offers a view of `#if`, `#elif`, `#else` and similar directives as a tree with navigable parent-child relationships.
+* Added a new `ThrowingFunction` abstract class that can be used to model an external function that may throw an exception.
+
## 0.12.4
### Minor Analysis Improvements
diff --git a/cpp/ql/lib/change-notes/2024-01-30-throwing-model.md b/cpp/ql/lib/change-notes/2024-01-30-throwing-model.md
deleted file mode 100644
index 591cc8cc771..00000000000
--- a/cpp/ql/lib/change-notes/2024-01-30-throwing-model.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: feature
----
-* Added a new `ThrowingFunction` abstract class that can be used to model an external function that may throw an exception.
\ No newline at end of file
diff --git a/cpp/ql/lib/change-notes/2024-01-30-preproc-block.md b/cpp/ql/lib/change-notes/released/0.12.5.md
similarity index 55%
rename from cpp/ql/lib/change-notes/2024-01-30-preproc-block.md
rename to cpp/ql/lib/change-notes/released/0.12.5.md
index 6995ec954ff..1ae4668a5c9 100644
--- a/cpp/ql/lib/change-notes/2024-01-30-preproc-block.md
+++ b/cpp/ql/lib/change-notes/released/0.12.5.md
@@ -1,4 +1,6 @@
----
-category: feature
----
+## 0.12.5
+
+### New Features
+
* Added the `PreprocBlock.qll` library to this repository. This library offers a view of `#if`, `#elif`, `#else` and similar directives as a tree with navigable parent-child relationships.
+* Added a new `ThrowingFunction` abstract class that can be used to model an external function that may throw an exception.
diff --git a/cpp/ql/lib/codeql-pack.release.yml b/cpp/ql/lib/codeql-pack.release.yml
index b458bb47c53..79f80ae516c 100644
--- a/cpp/ql/lib/codeql-pack.release.yml
+++ b/cpp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.12.4
+lastReleaseVersion: 0.12.5
diff --git a/cpp/ql/lib/qlpack.yml b/cpp/ql/lib/qlpack.yml
index f0479b167c6..b1b4172e977 100644
--- a/cpp/ql/lib/qlpack.yml
+++ b/cpp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-all
-version: 0.12.5-dev
+version: 0.12.5
groups: cpp
dbscheme: semmlecode.cpp.dbscheme
extractor: cpp
diff --git a/cpp/ql/src/CHANGELOG.md b/cpp/ql/src/CHANGELOG.md
index 0e67defb949..68bcdbc5b07 100644
--- a/cpp/ql/src/CHANGELOG.md
+++ b/cpp/ql/src/CHANGELOG.md
@@ -1,3 +1,14 @@
+## 0.9.4
+
+### Minor Analysis Improvements
+
+* Corrected 2 false positive with `cpp/incorrect-string-type-conversion`: conversion of byte arrays to wchar and new array allocations converted to wchar.
+* The "Incorrect return-value check for a 'scanf'-like function" query (`cpp/incorrectly-checked-scanf`) no longer reports an alert when an explicit check for EOF is added.
+* The "Incorrect return-value check for a 'scanf'-like function" query (`cpp/incorrectly-checked-scanf`) now recognizes more EOF checks.
+* The "Potentially uninitialized local variable" query (`cpp/uninitialized-local`) no longer reports an alert when the local variable is used as a qualifier to a static member function call.
+* ```
+* The diagnostic query `cpp/diagnostics/successfully-extracted-files` now considers any C/C++ file seen during extraction, even one with some errors, to be extracted / scanned. This affects the Code Scanning UI measure of scanned C/C++ files.
+
## 0.9.3
### Minor Analysis Improvements
diff --git a/cpp/ql/src/change-notes/2024-01-19-extracted-files.md b/cpp/ql/src/change-notes/2024-01-19-extracted-files.md
deleted file mode 100644
index df6de1576ac..00000000000
--- a/cpp/ql/src/change-notes/2024-01-19-extracted-files.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The diagnostic query `cpp/diagnostics/successfully-extracted-files` now considers any C/C++ file seen during extraction, even one with some errors, to be extracted / scanned. This affects the Code Scanning UI measure of scanned C/C++ files.
diff --git a/cpp/ql/src/change-notes/2024-01-29-false_positive_incorrect_string_type_conversion.md b/cpp/ql/src/change-notes/2024-01-29-false_positive_incorrect_string_type_conversion.md
deleted file mode 100644
index 8f081c746f1..00000000000
--- a/cpp/ql/src/change-notes/2024-01-29-false_positive_incorrect_string_type_conversion.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Corrected 2 false positive with `cpp/incorrect-string-type-conversion`: conversion of byte arrays to wchar and new array allocations converted to wchar.
\ No newline at end of file
diff --git a/cpp/ql/src/change-notes/2024-01-29-incorrectly-checked-scanf-2.md b/cpp/ql/src/change-notes/2024-01-29-incorrectly-checked-scanf-2.md
deleted file mode 100644
index cc361145db9..00000000000
--- a/cpp/ql/src/change-notes/2024-01-29-incorrectly-checked-scanf-2.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The "Incorrect return-value check for a 'scanf'-like function" query (`cpp/incorrectly-checked-scanf`) now recognizes more EOF checks.
diff --git a/cpp/ql/src/change-notes/2024-01-29-incorrectly-checked-scanf.md b/cpp/ql/src/change-notes/2024-01-29-incorrectly-checked-scanf.md
deleted file mode 100644
index 7085b9ce0a8..00000000000
--- a/cpp/ql/src/change-notes/2024-01-29-incorrectly-checked-scanf.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The "Incorrect return-value check for a 'scanf'-like function" query (`cpp/incorrectly-checked-scanf`) no longer reports an alert when an explicit check for EOF is added.
diff --git a/cpp/ql/src/change-notes/2024-01-29-uninitialized-local-false-positive.md b/cpp/ql/src/change-notes/2024-01-29-uninitialized-local-false-positive.md
deleted file mode 100644
index 0d07482b755..00000000000
--- a/cpp/ql/src/change-notes/2024-01-29-uninitialized-local-false-positive.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-category: minorAnalysis
----
-* The "Potentially uninitialized local variable" query (`cpp/uninitialized-local`) no longer reports an alert when the local variable is used as a qualifier to a static member function call.
-* ```
\ No newline at end of file
diff --git a/cpp/ql/src/change-notes/released/0.9.4.md b/cpp/ql/src/change-notes/released/0.9.4.md
new file mode 100644
index 00000000000..6525a90f9bb
--- /dev/null
+++ b/cpp/ql/src/change-notes/released/0.9.4.md
@@ -0,0 +1,10 @@
+## 0.9.4
+
+### Minor Analysis Improvements
+
+* Corrected 2 false positive with `cpp/incorrect-string-type-conversion`: conversion of byte arrays to wchar and new array allocations converted to wchar.
+* The "Incorrect return-value check for a 'scanf'-like function" query (`cpp/incorrectly-checked-scanf`) no longer reports an alert when an explicit check for EOF is added.
+* The "Incorrect return-value check for a 'scanf'-like function" query (`cpp/incorrectly-checked-scanf`) now recognizes more EOF checks.
+* The "Potentially uninitialized local variable" query (`cpp/uninitialized-local`) no longer reports an alert when the local variable is used as a qualifier to a static member function call.
+* ```
+* The diagnostic query `cpp/diagnostics/successfully-extracted-files` now considers any C/C++ file seen during extraction, even one with some errors, to be extracted / scanned. This affects the Code Scanning UI measure of scanned C/C++ files.
diff --git a/cpp/ql/src/codeql-pack.release.yml b/cpp/ql/src/codeql-pack.release.yml
index 7af7247cbb0..694907ca221 100644
--- a/cpp/ql/src/codeql-pack.release.yml
+++ b/cpp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.9.3
+lastReleaseVersion: 0.9.4
diff --git a/cpp/ql/src/qlpack.yml b/cpp/ql/src/qlpack.yml
index a04a6468617..0da41987b3e 100644
--- a/cpp/ql/src/qlpack.yml
+++ b/cpp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-queries
-version: 0.9.4-dev
+version: 0.9.4
groups:
- cpp
- queries
diff --git a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
index 8afcdeb67f3..1e9fa50c21f 100644
--- a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
+++ b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.7.8
+
+No user-facing changes.
+
## 1.7.7
No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.8.md b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.8.md
new file mode 100644
index 00000000000..89c236d93c5
--- /dev/null
+++ b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.8.md
@@ -0,0 +1,3 @@
+## 1.7.8
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
index df4010bd267..e003efd5127 100644
--- a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.7.7
+lastReleaseVersion: 1.7.8
diff --git a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
index 56cadaf8534..77b1c8b5154 100644
--- a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-all
-version: 1.7.8-dev
+version: 1.7.8
groups:
- csharp
- solorigate
diff --git a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
index 8afcdeb67f3..1e9fa50c21f 100644
--- a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
+++ b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.7.8
+
+No user-facing changes.
+
## 1.7.7
No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.8.md b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.8.md
new file mode 100644
index 00000000000..89c236d93c5
--- /dev/null
+++ b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.8.md
@@ -0,0 +1,3 @@
+## 1.7.8
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
index df4010bd267..e003efd5127 100644
--- a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
+++ b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.7.7
+lastReleaseVersion: 1.7.8
diff --git a/csharp/ql/campaigns/Solorigate/src/qlpack.yml b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
index 0b783c75d5a..9851e27c691 100644
--- a/csharp/ql/campaigns/Solorigate/src/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-queries
-version: 1.7.8-dev
+version: 1.7.8
groups:
- csharp
- solorigate
diff --git a/csharp/ql/lib/CHANGELOG.md b/csharp/ql/lib/CHANGELOG.md
index 0b168b22df6..196cd5ecc92 100644
--- a/csharp/ql/lib/CHANGELOG.md
+++ b/csharp/ql/lib/CHANGELOG.md
@@ -1,3 +1,14 @@
+## 0.8.8
+
+### Minor Analysis Improvements
+
+* Added a new database relation to store compiler arguments specified inside `@[...].rsp` file arguments. The arguments
+are returned by `Compilation::getExpandedArgument/1` and `Compilation::getExpandedArguments/0`.
+* C# 12: Added extractor, QL library and data flow support for collection expressions like `[1, y, 4, .. x]`.
+* The C# extractor now accepts an extractor option `logging.verbosity` that specifies the verbosity of the logs. The
+option is added via `codeql database create --language=csharp -Ologging.verbosity=debug ...` or by setting the
+corresponding environment variable `CODEQL_EXTRACTOR_CSHARP_OPTION_LOGGING_VERBOSITY`.
+
## 0.8.7
### Minor Analysis Improvements
diff --git a/csharp/ql/lib/change-notes/2024-01-25-extractor-option-logging.md b/csharp/ql/lib/change-notes/2024-01-25-extractor-option-logging.md
deleted file mode 100644
index 71cb3202675..00000000000
--- a/csharp/ql/lib/change-notes/2024-01-25-extractor-option-logging.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-category: minorAnalysis
----
-* The C# extractor now accepts an extractor option `logging.verbosity` that specifies the verbosity of the logs. The
-option is added via `codeql database create --language=csharp -Ologging.verbosity=debug ...` or by setting the
-corresponding environment variable `CODEQL_EXTRACTOR_CSHARP_OPTION_LOGGING_VERBOSITY`.
\ No newline at end of file
diff --git a/csharp/ql/lib/change-notes/2024-01-26-collection-expression.md b/csharp/ql/lib/change-notes/2024-01-26-collection-expression.md
deleted file mode 100644
index 10a958dcf47..00000000000
--- a/csharp/ql/lib/change-notes/2024-01-26-collection-expression.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* C# 12: Added extractor, QL library and data flow support for collection expressions like `[1, y, 4, .. x]`.
diff --git a/csharp/ql/lib/change-notes/2024-01-31-compilation-expanded-args.md b/csharp/ql/lib/change-notes/2024-01-31-compilation-expanded-args.md
deleted file mode 100644
index 8767c0d1d65..00000000000
--- a/csharp/ql/lib/change-notes/2024-01-31-compilation-expanded-args.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-category: minorAnalysis
----
-* Added a new database relation to store compiler arguments specified inside `@[...].rsp` file arguments. The arguments
-are returned by `Compilation::getExpandedArgument/1` and `Compilation::getExpandedArguments/0`.
diff --git a/csharp/ql/lib/change-notes/released/0.8.8.md b/csharp/ql/lib/change-notes/released/0.8.8.md
new file mode 100644
index 00000000000..96b317ecd06
--- /dev/null
+++ b/csharp/ql/lib/change-notes/released/0.8.8.md
@@ -0,0 +1,10 @@
+## 0.8.8
+
+### Minor Analysis Improvements
+
+* Added a new database relation to store compiler arguments specified inside `@[...].rsp` file arguments. The arguments
+are returned by `Compilation::getExpandedArgument/1` and `Compilation::getExpandedArguments/0`.
+* C# 12: Added extractor, QL library and data flow support for collection expressions like `[1, y, 4, .. x]`.
+* The C# extractor now accepts an extractor option `logging.verbosity` that specifies the verbosity of the logs. The
+option is added via `codeql database create --language=csharp -Ologging.verbosity=debug ...` or by setting the
+corresponding environment variable `CODEQL_EXTRACTOR_CSHARP_OPTION_LOGGING_VERBOSITY`.
diff --git a/csharp/ql/lib/codeql-pack.release.yml b/csharp/ql/lib/codeql-pack.release.yml
index 2ef6dc421f3..da0a61b4048 100644
--- a/csharp/ql/lib/codeql-pack.release.yml
+++ b/csharp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.7
+lastReleaseVersion: 0.8.8
diff --git a/csharp/ql/lib/qlpack.yml b/csharp/ql/lib/qlpack.yml
index 9d8db7347cb..2b137281da6 100644
--- a/csharp/ql/lib/qlpack.yml
+++ b/csharp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-all
-version: 0.8.8-dev
+version: 0.8.8
groups: csharp
dbscheme: semmlecode.csharp.dbscheme
extractor: csharp
diff --git a/csharp/ql/src/CHANGELOG.md b/csharp/ql/src/CHANGELOG.md
index 6572f664b0e..ac2fbfce855 100644
--- a/csharp/ql/src/CHANGELOG.md
+++ b/csharp/ql/src/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 0.8.8
+
+### Minor Analysis Improvements
+
+* Added string interpolation expressions and `string.Format` as possible sanitizers for the `cs/web/unvalidated-url-redirection` query.
+
## 0.8.7
### Minor Analysis Improvements
diff --git a/csharp/ql/src/change-notes/2024-01-22-url-redirect-sanitizer.md b/csharp/ql/src/change-notes/released/0.8.8.md
similarity index 75%
rename from csharp/ql/src/change-notes/2024-01-22-url-redirect-sanitizer.md
rename to csharp/ql/src/change-notes/released/0.8.8.md
index 92a65075a65..d6f017bcf41 100644
--- a/csharp/ql/src/change-notes/2024-01-22-url-redirect-sanitizer.md
+++ b/csharp/ql/src/change-notes/released/0.8.8.md
@@ -1,4 +1,5 @@
----
-category: minorAnalysis
----
+## 0.8.8
+
+### Minor Analysis Improvements
+
* Added string interpolation expressions and `string.Format` as possible sanitizers for the `cs/web/unvalidated-url-redirection` query.
diff --git a/csharp/ql/src/codeql-pack.release.yml b/csharp/ql/src/codeql-pack.release.yml
index 2ef6dc421f3..da0a61b4048 100644
--- a/csharp/ql/src/codeql-pack.release.yml
+++ b/csharp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.7
+lastReleaseVersion: 0.8.8
diff --git a/csharp/ql/src/qlpack.yml b/csharp/ql/src/qlpack.yml
index c3973948993..a16c72edd72 100644
--- a/csharp/ql/src/qlpack.yml
+++ b/csharp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-queries
-version: 0.8.8-dev
+version: 0.8.8
groups:
- csharp
- queries
diff --git a/go/ql/consistency-queries/CHANGELOG.md b/go/ql/consistency-queries/CHANGELOG.md
index ad2e63eb470..8f58f5145db 100644
--- a/go/ql/consistency-queries/CHANGELOG.md
+++ b/go/ql/consistency-queries/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.0.7
+
+No user-facing changes.
+
## 0.0.6
No user-facing changes.
diff --git a/go/ql/consistency-queries/change-notes/released/0.0.7.md b/go/ql/consistency-queries/change-notes/released/0.0.7.md
new file mode 100644
index 00000000000..84da6f18c42
--- /dev/null
+++ b/go/ql/consistency-queries/change-notes/released/0.0.7.md
@@ -0,0 +1,3 @@
+## 0.0.7
+
+No user-facing changes.
diff --git a/go/ql/consistency-queries/codeql-pack.release.yml b/go/ql/consistency-queries/codeql-pack.release.yml
index cf398ce02aa..a2a5484910b 100644
--- a/go/ql/consistency-queries/codeql-pack.release.yml
+++ b/go/ql/consistency-queries/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.6
+lastReleaseVersion: 0.0.7
diff --git a/go/ql/consistency-queries/qlpack.yml b/go/ql/consistency-queries/qlpack.yml
index 88886034408..c7522dd8e35 100644
--- a/go/ql/consistency-queries/qlpack.yml
+++ b/go/ql/consistency-queries/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql-go-consistency-queries
-version: 0.0.7-dev
+version: 0.0.7
groups:
- go
- queries
diff --git a/go/ql/lib/CHANGELOG.md b/go/ql/lib/CHANGELOG.md
index b9ff6e4e0e2..475352f1df2 100644
--- a/go/ql/lib/CHANGELOG.md
+++ b/go/ql/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.7.8
+
+No user-facing changes.
+
## 0.7.7
### Deprecated APIs
diff --git a/go/ql/lib/change-notes/released/0.7.8.md b/go/ql/lib/change-notes/released/0.7.8.md
new file mode 100644
index 00000000000..5627ed51a17
--- /dev/null
+++ b/go/ql/lib/change-notes/released/0.7.8.md
@@ -0,0 +1,3 @@
+## 0.7.8
+
+No user-facing changes.
diff --git a/go/ql/lib/codeql-pack.release.yml b/go/ql/lib/codeql-pack.release.yml
index 89cc2330c10..b6b12196b26 100644
--- a/go/ql/lib/codeql-pack.release.yml
+++ b/go/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.7.7
+lastReleaseVersion: 0.7.8
diff --git a/go/ql/lib/qlpack.yml b/go/ql/lib/qlpack.yml
index 67c991934e0..5f317377d45 100644
--- a/go/ql/lib/qlpack.yml
+++ b/go/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-all
-version: 0.7.8-dev
+version: 0.7.8
groups: go
dbscheme: go.dbscheme
extractor: go
diff --git a/go/ql/src/CHANGELOG.md b/go/ql/src/CHANGELOG.md
index dafcd7aa695..66533a629f2 100644
--- a/go/ql/src/CHANGELOG.md
+++ b/go/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.7.8
+
+No user-facing changes.
+
## 0.7.7
### Minor Analysis Improvements
diff --git a/go/ql/src/change-notes/released/0.7.8.md b/go/ql/src/change-notes/released/0.7.8.md
new file mode 100644
index 00000000000..5627ed51a17
--- /dev/null
+++ b/go/ql/src/change-notes/released/0.7.8.md
@@ -0,0 +1,3 @@
+## 0.7.8
+
+No user-facing changes.
diff --git a/go/ql/src/codeql-pack.release.yml b/go/ql/src/codeql-pack.release.yml
index 89cc2330c10..b6b12196b26 100644
--- a/go/ql/src/codeql-pack.release.yml
+++ b/go/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.7.7
+lastReleaseVersion: 0.7.8
diff --git a/go/ql/src/qlpack.yml b/go/ql/src/qlpack.yml
index a760c342970..81654540219 100644
--- a/go/ql/src/qlpack.yml
+++ b/go/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-queries
-version: 0.7.8-dev
+version: 0.7.8
groups:
- go
- queries
diff --git a/java/ql/automodel/src/CHANGELOG.md b/java/ql/automodel/src/CHANGELOG.md
index eb9aae31d41..fa718635e0c 100644
--- a/java/ql/automodel/src/CHANGELOG.md
+++ b/java/ql/automodel/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.0.14
+
+No user-facing changes.
+
## 0.0.13
No user-facing changes.
diff --git a/java/ql/automodel/src/change-notes/released/0.0.14.md b/java/ql/automodel/src/change-notes/released/0.0.14.md
new file mode 100644
index 00000000000..63b4d50ca45
--- /dev/null
+++ b/java/ql/automodel/src/change-notes/released/0.0.14.md
@@ -0,0 +1,3 @@
+## 0.0.14
+
+No user-facing changes.
diff --git a/java/ql/automodel/src/codeql-pack.release.yml b/java/ql/automodel/src/codeql-pack.release.yml
index 044e54e4f7e..ca29e45d0a6 100644
--- a/java/ql/automodel/src/codeql-pack.release.yml
+++ b/java/ql/automodel/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.13
+lastReleaseVersion: 0.0.14
diff --git a/java/ql/automodel/src/qlpack.yml b/java/ql/automodel/src/qlpack.yml
index 0845b6f1761..3334223e9e4 100644
--- a/java/ql/automodel/src/qlpack.yml
+++ b/java/ql/automodel/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-automodel-queries
-version: 0.0.14-dev
+version: 0.0.14
groups:
- java
- automodel
diff --git a/java/ql/lib/CHANGELOG.md b/java/ql/lib/CHANGELOG.md
index 3621a766e8a..4b34106dc09 100644
--- a/java/ql/lib/CHANGELOG.md
+++ b/java/ql/lib/CHANGELOG.md
@@ -1,3 +1,13 @@
+## 0.8.8
+
+### Minor Analysis Improvements
+
+* Added models for the following packages:
+
+ * com.fasterxml.jackson.databind
+ * javax.servlet
+* Added the `java.util.Date` and `java.util.UUID` classes to the list of types in the `SimpleTypeSanitizer` class in `semmle.code.java.security.Sanitizers`.
+
## 0.8.7
### New Features
diff --git a/java/ql/lib/change-notes/2024-01-24-new-models.md b/java/ql/lib/change-notes/2024-01-24-new-models.md
deleted file mode 100644
index 8646ac1f0cb..00000000000
--- a/java/ql/lib/change-notes/2024-01-24-new-models.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-category: minorAnalysis
----
-* Added models for the following packages:
-
- * com.fasterxml.jackson.databind
- * javax.servlet
diff --git a/java/ql/lib/change-notes/2024-01-23-add-uuid-and-date-to-simpletypesanitizer.md b/java/ql/lib/change-notes/released/0.8.8.md
similarity index 52%
rename from java/ql/lib/change-notes/2024-01-23-add-uuid-and-date-to-simpletypesanitizer.md
rename to java/ql/lib/change-notes/released/0.8.8.md
index 96d6b9e0334..62186579014 100644
--- a/java/ql/lib/change-notes/2024-01-23-add-uuid-and-date-to-simpletypesanitizer.md
+++ b/java/ql/lib/change-notes/released/0.8.8.md
@@ -1,4 +1,9 @@
----
-category: minorAnalysis
----
+## 0.8.8
+
+### Minor Analysis Improvements
+
+* Added models for the following packages:
+
+ * com.fasterxml.jackson.databind
+ * javax.servlet
* Added the `java.util.Date` and `java.util.UUID` classes to the list of types in the `SimpleTypeSanitizer` class in `semmle.code.java.security.Sanitizers`.
diff --git a/java/ql/lib/codeql-pack.release.yml b/java/ql/lib/codeql-pack.release.yml
index 2ef6dc421f3..da0a61b4048 100644
--- a/java/ql/lib/codeql-pack.release.yml
+++ b/java/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.7
+lastReleaseVersion: 0.8.8
diff --git a/java/ql/lib/qlpack.yml b/java/ql/lib/qlpack.yml
index 62f4a0d7e96..6e4e1269d9c 100644
--- a/java/ql/lib/qlpack.yml
+++ b/java/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-all
-version: 0.8.8-dev
+version: 0.8.8
groups: java
dbscheme: config/semmlecode.dbscheme
extractor: java
diff --git a/java/ql/src/CHANGELOG.md b/java/ql/src/CHANGELOG.md
index 84096230dd1..466b98fea11 100644
--- a/java/ql/src/CHANGELOG.md
+++ b/java/ql/src/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 0.8.8
+
+### New Queries
+
+* Added a new query `java/android/sensitive-text` to detect instances of sensitive data being exposed through text fields without being properly masked.
+* Added a new query `java/android/sensitive-notification` to detect instances of sensitive data being exposed through Android notifications.
+
## 0.8.7
### New Queries
@@ -10,10 +17,6 @@
## 0.8.6
-### Deprecated Queries
-
-* The three queries `java/insufficient-key-size`, `java/server-side-template-injection`, and `java/android/implicit-pendingintents` had accidentally general extension points allowing arbitrary string-based flow state. This has been fixed and the old extension points have been deprecated where possible, and otherwise updated.
-
### New Queries
* Added the `java/insecure-randomness` query to detect uses of weakly random values which an attacker may be able to predict. Also added the `crypto-parameter` sink kind for sinks which represent the parameters and keys of cryptographic operations.
@@ -24,6 +27,10 @@
* The query `java/android/missing-certificate-pinning` should no longer alert about requests pointing to the local filesystem.
* Removed some spurious sinks related to `com.opensymphony.xwork2.TextProvider.getText` from the query `java/ognl-injection`.
+### Bug Fixes
+
+* The three queries `java/insufficient-key-size`, `java/server-side-template-injection`, and `java/android/implicit-pendingintents` had accidentally general extension points allowing arbitrary string-based flow state. This has been fixed and the old extension points have been deprecated where possible, and otherwise updated.
+
## 0.8.5
No user-facing changes.
diff --git a/java/ql/src/change-notes/2024-01-15-android-sensitive-notification-query.md b/java/ql/src/change-notes/2024-01-15-android-sensitive-notification-query.md
deleted file mode 100644
index 427ebbe94ff..00000000000
--- a/java/ql/src/change-notes/2024-01-15-android-sensitive-notification-query.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: newQuery
----
-* Added a new query `java/android/sensitive-notification` to detect instances of sensitive data being exposed through Android notifications.
\ No newline at end of file
diff --git a/java/ql/src/change-notes/2024-01-29-android-sensitive-text-field-query.md b/java/ql/src/change-notes/2024-01-29-android-sensitive-text-field-query.md
deleted file mode 100644
index 5e5156944a7..00000000000
--- a/java/ql/src/change-notes/2024-01-29-android-sensitive-text-field-query.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: newQuery
----
-* Added a new query `java/android/sensitive-text` to detect instances of sensitive data being exposed through text fields without being properly masked.
\ No newline at end of file
diff --git a/java/ql/src/change-notes/released/0.8.8.md b/java/ql/src/change-notes/released/0.8.8.md
new file mode 100644
index 00000000000..94f005fdca8
--- /dev/null
+++ b/java/ql/src/change-notes/released/0.8.8.md
@@ -0,0 +1,6 @@
+## 0.8.8
+
+### New Queries
+
+* Added a new query `java/android/sensitive-text` to detect instances of sensitive data being exposed through text fields without being properly masked.
+* Added a new query `java/android/sensitive-notification` to detect instances of sensitive data being exposed through Android notifications.
diff --git a/java/ql/src/codeql-pack.release.yml b/java/ql/src/codeql-pack.release.yml
index 2ef6dc421f3..da0a61b4048 100644
--- a/java/ql/src/codeql-pack.release.yml
+++ b/java/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.7
+lastReleaseVersion: 0.8.8
diff --git a/java/ql/src/qlpack.yml b/java/ql/src/qlpack.yml
index 4d0d39baca3..73e8a062ffe 100644
--- a/java/ql/src/qlpack.yml
+++ b/java/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-queries
-version: 0.8.8-dev
+version: 0.8.8
groups:
- java
- queries
diff --git a/javascript/ql/lib/CHANGELOG.md b/javascript/ql/lib/CHANGELOG.md
index 29005b5ce87..06e40ac7bd5 100644
--- a/javascript/ql/lib/CHANGELOG.md
+++ b/javascript/ql/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.8.8
+
+No user-facing changes.
+
## 0.8.7
### Minor Analysis Improvements
diff --git a/javascript/ql/lib/change-notes/released/0.8.8.md b/javascript/ql/lib/change-notes/released/0.8.8.md
new file mode 100644
index 00000000000..14d202dac00
--- /dev/null
+++ b/javascript/ql/lib/change-notes/released/0.8.8.md
@@ -0,0 +1,3 @@
+## 0.8.8
+
+No user-facing changes.
diff --git a/javascript/ql/lib/codeql-pack.release.yml b/javascript/ql/lib/codeql-pack.release.yml
index 2ef6dc421f3..da0a61b4048 100644
--- a/javascript/ql/lib/codeql-pack.release.yml
+++ b/javascript/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.7
+lastReleaseVersion: 0.8.8
diff --git a/javascript/ql/lib/qlpack.yml b/javascript/ql/lib/qlpack.yml
index bd0c1a815f3..fa544548ea7 100644
--- a/javascript/ql/lib/qlpack.yml
+++ b/javascript/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-all
-version: 0.8.8-dev
+version: 0.8.8
groups: javascript
dbscheme: semmlecode.javascript.dbscheme
extractor: javascript
diff --git a/javascript/ql/src/CHANGELOG.md b/javascript/ql/src/CHANGELOG.md
index ba868a7d629..300da5225f9 100644
--- a/javascript/ql/src/CHANGELOG.md
+++ b/javascript/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.8.8
+
+No user-facing changes.
+
## 0.8.7
### Minor Analysis Improvements
diff --git a/javascript/ql/src/change-notes/released/0.8.8.md b/javascript/ql/src/change-notes/released/0.8.8.md
new file mode 100644
index 00000000000..14d202dac00
--- /dev/null
+++ b/javascript/ql/src/change-notes/released/0.8.8.md
@@ -0,0 +1,3 @@
+## 0.8.8
+
+No user-facing changes.
diff --git a/javascript/ql/src/codeql-pack.release.yml b/javascript/ql/src/codeql-pack.release.yml
index 2ef6dc421f3..da0a61b4048 100644
--- a/javascript/ql/src/codeql-pack.release.yml
+++ b/javascript/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.7
+lastReleaseVersion: 0.8.8
diff --git a/javascript/ql/src/qlpack.yml b/javascript/ql/src/qlpack.yml
index 51a22b542e0..1ebbfc58787 100644
--- a/javascript/ql/src/qlpack.yml
+++ b/javascript/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-queries
-version: 0.8.8-dev
+version: 0.8.8
groups:
- javascript
- queries
diff --git a/misc/suite-helpers/CHANGELOG.md b/misc/suite-helpers/CHANGELOG.md
index 1c10493c9e7..61d4b001d25 100644
--- a/misc/suite-helpers/CHANGELOG.md
+++ b/misc/suite-helpers/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.7.8
+
+No user-facing changes.
+
## 0.7.7
No user-facing changes.
diff --git a/misc/suite-helpers/change-notes/released/0.7.8.md b/misc/suite-helpers/change-notes/released/0.7.8.md
new file mode 100644
index 00000000000..5627ed51a17
--- /dev/null
+++ b/misc/suite-helpers/change-notes/released/0.7.8.md
@@ -0,0 +1,3 @@
+## 0.7.8
+
+No user-facing changes.
diff --git a/misc/suite-helpers/codeql-pack.release.yml b/misc/suite-helpers/codeql-pack.release.yml
index 89cc2330c10..b6b12196b26 100644
--- a/misc/suite-helpers/codeql-pack.release.yml
+++ b/misc/suite-helpers/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.7.7
+lastReleaseVersion: 0.7.8
diff --git a/misc/suite-helpers/qlpack.yml b/misc/suite-helpers/qlpack.yml
index 82d40178d7e..4db5dfcf454 100644
--- a/misc/suite-helpers/qlpack.yml
+++ b/misc/suite-helpers/qlpack.yml
@@ -1,4 +1,4 @@
name: codeql/suite-helpers
-version: 0.7.8-dev
+version: 0.7.8
groups: shared
warnOnImplicitThis: true
diff --git a/python/ql/lib/CHANGELOG.md b/python/ql/lib/CHANGELOG.md
index ca684c59320..01692622749 100644
--- a/python/ql/lib/CHANGELOG.md
+++ b/python/ql/lib/CHANGELOG.md
@@ -1,3 +1,13 @@
+## 0.11.8
+
+### Minor Analysis Improvements
+
+* Added `html.escape` as a sanitizer for HTML.
+
+### Bug Fixes
+
+* Fixed the `a` (ASCII) inline flag not being recognized by the regular expression library.
+
## 0.11.7
### Minor Analysis Improvements
diff --git a/python/ql/lib/change-notes/2024-01-21-regex-ascii-flag.md b/python/ql/lib/change-notes/2024-01-21-regex-ascii-flag.md
deleted file mode 100644
index 5d8741b1bd3..00000000000
--- a/python/ql/lib/change-notes/2024-01-21-regex-ascii-flag.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: fix
----
-* Fixed the `a` (ASCII) inline flag not being recognized by the regular expression library.
diff --git a/python/ql/lib/change-notes/2024-01-22-html-escape.md b/python/ql/lib/change-notes/2024-01-22-html-escape.md
deleted file mode 100644
index 0ae31aee545..00000000000
--- a/python/ql/lib/change-notes/2024-01-22-html-escape.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Added `html.escape` as a sanitizer for HTML.
diff --git a/python/ql/lib/change-notes/released/0.11.8.md b/python/ql/lib/change-notes/released/0.11.8.md
new file mode 100644
index 00000000000..d61a4451868
--- /dev/null
+++ b/python/ql/lib/change-notes/released/0.11.8.md
@@ -0,0 +1,9 @@
+## 0.11.8
+
+### Minor Analysis Improvements
+
+* Added `html.escape` as a sanitizer for HTML.
+
+### Bug Fixes
+
+* Fixed the `a` (ASCII) inline flag not being recognized by the regular expression library.
diff --git a/python/ql/lib/codeql-pack.release.yml b/python/ql/lib/codeql-pack.release.yml
index 59fa16251b6..345c308d402 100644
--- a/python/ql/lib/codeql-pack.release.yml
+++ b/python/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.11.7
+lastReleaseVersion: 0.11.8
diff --git a/python/ql/lib/qlpack.yml b/python/ql/lib/qlpack.yml
index 23bff260f7a..a2c343cca3f 100644
--- a/python/ql/lib/qlpack.yml
+++ b/python/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-all
-version: 0.11.8-dev
+version: 0.11.8
groups: python
dbscheme: semmlecode.python.dbscheme
extractor: python
diff --git a/python/ql/src/CHANGELOG.md b/python/ql/src/CHANGELOG.md
index b42dcfd8b31..17931ead8b1 100644
--- a/python/ql/src/CHANGELOG.md
+++ b/python/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.9.8
+
+No user-facing changes.
+
## 0.9.7
### Minor Analysis Improvements
diff --git a/python/ql/src/change-notes/released/0.9.8.md b/python/ql/src/change-notes/released/0.9.8.md
new file mode 100644
index 00000000000..d1ca1c4d647
--- /dev/null
+++ b/python/ql/src/change-notes/released/0.9.8.md
@@ -0,0 +1,3 @@
+## 0.9.8
+
+No user-facing changes.
diff --git a/python/ql/src/codeql-pack.release.yml b/python/ql/src/codeql-pack.release.yml
index 0921a438254..9ca6c6f2678 100644
--- a/python/ql/src/codeql-pack.release.yml
+++ b/python/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.9.7
+lastReleaseVersion: 0.9.8
diff --git a/python/ql/src/qlpack.yml b/python/ql/src/qlpack.yml
index 5de71eb6e3a..538e5ad799c 100644
--- a/python/ql/src/qlpack.yml
+++ b/python/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-queries
-version: 0.9.8-dev
+version: 0.9.8
groups:
- python
- queries
diff --git a/ruby/ql/lib/CHANGELOG.md b/ruby/ql/lib/CHANGELOG.md
index e9e4507d8df..8a9e4e6c8b7 100644
--- a/ruby/ql/lib/CHANGELOG.md
+++ b/ruby/ql/lib/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 0.8.8
+
+### Minor Analysis Improvements
+
+* Flow is now tracked through Rails `render` calls, when the argument is a `ViewComponent`. In this case, data flow is tracked into the accompanying `.html.erb` file.
+
## 0.8.7
### Minor Analysis Improvements
diff --git a/ruby/ql/lib/change-notes/2024-01-22-erb-render-flow.md b/ruby/ql/lib/change-notes/released/0.8.8.md
similarity index 79%
rename from ruby/ql/lib/change-notes/2024-01-22-erb-render-flow.md
rename to ruby/ql/lib/change-notes/released/0.8.8.md
index f9e68ef580e..dc4b3dd43e3 100644
--- a/ruby/ql/lib/change-notes/2024-01-22-erb-render-flow.md
+++ b/ruby/ql/lib/change-notes/released/0.8.8.md
@@ -1,4 +1,5 @@
----
-category: minorAnalysis
----
+## 0.8.8
+
+### Minor Analysis Improvements
+
* Flow is now tracked through Rails `render` calls, when the argument is a `ViewComponent`. In this case, data flow is tracked into the accompanying `.html.erb` file.
diff --git a/ruby/ql/lib/codeql-pack.release.yml b/ruby/ql/lib/codeql-pack.release.yml
index 2ef6dc421f3..da0a61b4048 100644
--- a/ruby/ql/lib/codeql-pack.release.yml
+++ b/ruby/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.7
+lastReleaseVersion: 0.8.8
diff --git a/ruby/ql/lib/qlpack.yml b/ruby/ql/lib/qlpack.yml
index 8179ac53996..7eb6222e101 100644
--- a/ruby/ql/lib/qlpack.yml
+++ b/ruby/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-all
-version: 0.8.8-dev
+version: 0.8.8
groups: ruby
extractor: ruby
dbscheme: ruby.dbscheme
diff --git a/ruby/ql/src/CHANGELOG.md b/ruby/ql/src/CHANGELOG.md
index 05a89118b05..9eff67dab9e 100644
--- a/ruby/ql/src/CHANGELOG.md
+++ b/ruby/ql/src/CHANGELOG.md
@@ -1,3 +1,14 @@
+## 0.8.8
+
+### New Queries
+
+* Added a new experimental query, `rb/insecure-randomness`, to detect when application uses random values that are not cryptographically secure.
+
+### Minor Analysis Improvements
+
+* Added new unsafe deserialization sinks for the ox gem.
+* Added an additional unsafe deserialization sink for the oj gem.
+
## 0.8.7
No user-facing changes.
diff --git a/ruby/ql/src/change-notes/2023-12-18-insecure-randomness-query.md b/ruby/ql/src/change-notes/2023-12-18-insecure-randomness-query.md
deleted file mode 100644
index a4b3cd5a1f5..00000000000
--- a/ruby/ql/src/change-notes/2023-12-18-insecure-randomness-query.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: newQuery
----
-* Added a new experimental query, `rb/insecure-randomness`, to detect when application uses random values that are not cryptographically secure.
\ No newline at end of file
diff --git a/ruby/ql/src/change-notes/2024-01-30-unsafe-deserialization-sinks.md b/ruby/ql/src/change-notes/2024-01-30-unsafe-deserialization-sinks.md
deleted file mode 100644
index 3ba080e91ab..00000000000
--- a/ruby/ql/src/change-notes/2024-01-30-unsafe-deserialization-sinks.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-category: minorAnalysis
----
-* Added new unsafe deserialization sinks for the ox gem.
-* Added an additional unsafe deserialization sink for the oj gem.
diff --git a/ruby/ql/src/change-notes/released/0.8.8.md b/ruby/ql/src/change-notes/released/0.8.8.md
new file mode 100644
index 00000000000..b8aaed87425
--- /dev/null
+++ b/ruby/ql/src/change-notes/released/0.8.8.md
@@ -0,0 +1,10 @@
+## 0.8.8
+
+### New Queries
+
+* Added a new experimental query, `rb/insecure-randomness`, to detect when application uses random values that are not cryptographically secure.
+
+### Minor Analysis Improvements
+
+* Added new unsafe deserialization sinks for the ox gem.
+* Added an additional unsafe deserialization sink for the oj gem.
diff --git a/ruby/ql/src/codeql-pack.release.yml b/ruby/ql/src/codeql-pack.release.yml
index 2ef6dc421f3..da0a61b4048 100644
--- a/ruby/ql/src/codeql-pack.release.yml
+++ b/ruby/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.7
+lastReleaseVersion: 0.8.8
diff --git a/ruby/ql/src/qlpack.yml b/ruby/ql/src/qlpack.yml
index 6891e0227d3..7c1995c00e5 100644
--- a/ruby/ql/src/qlpack.yml
+++ b/ruby/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-queries
-version: 0.8.8-dev
+version: 0.8.8
groups:
- ruby
- queries
diff --git a/shared/controlflow/CHANGELOG.md b/shared/controlflow/CHANGELOG.md
index 6635db28abc..d72921d34c1 100644
--- a/shared/controlflow/CHANGELOG.md
+++ b/shared/controlflow/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.1.8
+
+No user-facing changes.
+
## 0.1.7
No user-facing changes.
diff --git a/shared/controlflow/change-notes/released/0.1.8.md b/shared/controlflow/change-notes/released/0.1.8.md
new file mode 100644
index 00000000000..5b20b52baf1
--- /dev/null
+++ b/shared/controlflow/change-notes/released/0.1.8.md
@@ -0,0 +1,3 @@
+## 0.1.8
+
+No user-facing changes.
diff --git a/shared/controlflow/codeql-pack.release.yml b/shared/controlflow/codeql-pack.release.yml
index 949d4c64c66..3136ea4a1cc 100644
--- a/shared/controlflow/codeql-pack.release.yml
+++ b/shared/controlflow/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.1.7
+lastReleaseVersion: 0.1.8
diff --git a/shared/controlflow/qlpack.yml b/shared/controlflow/qlpack.yml
index c6c4fb5f728..79d4a386cf1 100644
--- a/shared/controlflow/qlpack.yml
+++ b/shared/controlflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/controlflow
-version: 0.1.8-dev
+version: 0.1.8
groups: shared
library: true
dependencies:
diff --git a/shared/dataflow/CHANGELOG.md b/shared/dataflow/CHANGELOG.md
index c537cb3bb8e..e9b6c3bc904 100644
--- a/shared/dataflow/CHANGELOG.md
+++ b/shared/dataflow/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.1.8
+
+No user-facing changes.
+
## 0.1.7
No user-facing changes.
diff --git a/shared/dataflow/change-notes/released/0.1.8.md b/shared/dataflow/change-notes/released/0.1.8.md
new file mode 100644
index 00000000000..5b20b52baf1
--- /dev/null
+++ b/shared/dataflow/change-notes/released/0.1.8.md
@@ -0,0 +1,3 @@
+## 0.1.8
+
+No user-facing changes.
diff --git a/shared/dataflow/codeql-pack.release.yml b/shared/dataflow/codeql-pack.release.yml
index 949d4c64c66..3136ea4a1cc 100644
--- a/shared/dataflow/codeql-pack.release.yml
+++ b/shared/dataflow/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.1.7
+lastReleaseVersion: 0.1.8
diff --git a/shared/dataflow/qlpack.yml b/shared/dataflow/qlpack.yml
index 91d1454351c..ffb4d0754be 100644
--- a/shared/dataflow/qlpack.yml
+++ b/shared/dataflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/dataflow
-version: 0.1.8-dev
+version: 0.1.8
groups: shared
library: true
dependencies:
diff --git a/shared/mad/CHANGELOG.md b/shared/mad/CHANGELOG.md
index 438ce8241a6..35042f79b69 100644
--- a/shared/mad/CHANGELOG.md
+++ b/shared/mad/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.8
+
+No user-facing changes.
+
## 0.2.7
No user-facing changes.
diff --git a/shared/mad/change-notes/released/0.2.8.md b/shared/mad/change-notes/released/0.2.8.md
new file mode 100644
index 00000000000..2f8aa0dd21e
--- /dev/null
+++ b/shared/mad/change-notes/released/0.2.8.md
@@ -0,0 +1,3 @@
+## 0.2.8
+
+No user-facing changes.
diff --git a/shared/mad/codeql-pack.release.yml b/shared/mad/codeql-pack.release.yml
index 6d3c0021858..66ad7f587f8 100644
--- a/shared/mad/codeql-pack.release.yml
+++ b/shared/mad/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.7
+lastReleaseVersion: 0.2.8
diff --git a/shared/mad/qlpack.yml b/shared/mad/qlpack.yml
index 31a8e8b7534..c4eade3b256 100644
--- a/shared/mad/qlpack.yml
+++ b/shared/mad/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/mad
-version: 0.2.8-dev
+version: 0.2.8
groups: shared
library: true
dependencies: null
diff --git a/shared/rangeanalysis/CHANGELOG.md b/shared/rangeanalysis/CHANGELOG.md
index 6f334d57356..9ad1339683f 100644
--- a/shared/rangeanalysis/CHANGELOG.md
+++ b/shared/rangeanalysis/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.0.7
+
+No user-facing changes.
+
## 0.0.6
No user-facing changes.
diff --git a/shared/rangeanalysis/change-notes/released/0.0.7.md b/shared/rangeanalysis/change-notes/released/0.0.7.md
new file mode 100644
index 00000000000..84da6f18c42
--- /dev/null
+++ b/shared/rangeanalysis/change-notes/released/0.0.7.md
@@ -0,0 +1,3 @@
+## 0.0.7
+
+No user-facing changes.
diff --git a/shared/rangeanalysis/codeql-pack.release.yml b/shared/rangeanalysis/codeql-pack.release.yml
index cf398ce02aa..a2a5484910b 100644
--- a/shared/rangeanalysis/codeql-pack.release.yml
+++ b/shared/rangeanalysis/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.6
+lastReleaseVersion: 0.0.7
diff --git a/shared/rangeanalysis/qlpack.yml b/shared/rangeanalysis/qlpack.yml
index 6317ae4cac4..faa059f069a 100644
--- a/shared/rangeanalysis/qlpack.yml
+++ b/shared/rangeanalysis/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/rangeanalysis
-version: 0.0.7-dev
+version: 0.0.7
groups: shared
library: true
dependencies:
diff --git a/shared/regex/CHANGELOG.md b/shared/regex/CHANGELOG.md
index 267288c38df..bf0aa553157 100644
--- a/shared/regex/CHANGELOG.md
+++ b/shared/regex/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.8
+
+No user-facing changes.
+
## 0.2.7
No user-facing changes.
diff --git a/shared/regex/change-notes/released/0.2.8.md b/shared/regex/change-notes/released/0.2.8.md
new file mode 100644
index 00000000000..2f8aa0dd21e
--- /dev/null
+++ b/shared/regex/change-notes/released/0.2.8.md
@@ -0,0 +1,3 @@
+## 0.2.8
+
+No user-facing changes.
diff --git a/shared/regex/codeql-pack.release.yml b/shared/regex/codeql-pack.release.yml
index 6d3c0021858..66ad7f587f8 100644
--- a/shared/regex/codeql-pack.release.yml
+++ b/shared/regex/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.7
+lastReleaseVersion: 0.2.8
diff --git a/shared/regex/qlpack.yml b/shared/regex/qlpack.yml
index c75c3ca7b2d..57aa69e9629 100644
--- a/shared/regex/qlpack.yml
+++ b/shared/regex/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/regex
-version: 0.2.8-dev
+version: 0.2.8
groups: shared
library: true
dependencies:
diff --git a/shared/ssa/CHANGELOG.md b/shared/ssa/CHANGELOG.md
index 8a920eb7bed..7c9b57d2b8e 100644
--- a/shared/ssa/CHANGELOG.md
+++ b/shared/ssa/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.8
+
+No user-facing changes.
+
## 0.2.7
### Minor Analysis Improvements
diff --git a/shared/ssa/change-notes/released/0.2.8.md b/shared/ssa/change-notes/released/0.2.8.md
new file mode 100644
index 00000000000..2f8aa0dd21e
--- /dev/null
+++ b/shared/ssa/change-notes/released/0.2.8.md
@@ -0,0 +1,3 @@
+## 0.2.8
+
+No user-facing changes.
diff --git a/shared/ssa/codeql-pack.release.yml b/shared/ssa/codeql-pack.release.yml
index 6d3c0021858..66ad7f587f8 100644
--- a/shared/ssa/codeql-pack.release.yml
+++ b/shared/ssa/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.7
+lastReleaseVersion: 0.2.8
diff --git a/shared/ssa/qlpack.yml b/shared/ssa/qlpack.yml
index 92717e37ccb..f47e195b548 100644
--- a/shared/ssa/qlpack.yml
+++ b/shared/ssa/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ssa
-version: 0.2.8-dev
+version: 0.2.8
groups: shared
library: true
dependencies:
diff --git a/shared/threat-models/CHANGELOG.md b/shared/threat-models/CHANGELOG.md
index ad2e63eb470..8f58f5145db 100644
--- a/shared/threat-models/CHANGELOG.md
+++ b/shared/threat-models/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.0.7
+
+No user-facing changes.
+
## 0.0.6
No user-facing changes.
diff --git a/shared/threat-models/change-notes/released/0.0.7.md b/shared/threat-models/change-notes/released/0.0.7.md
new file mode 100644
index 00000000000..84da6f18c42
--- /dev/null
+++ b/shared/threat-models/change-notes/released/0.0.7.md
@@ -0,0 +1,3 @@
+## 0.0.7
+
+No user-facing changes.
diff --git a/shared/threat-models/codeql-pack.release.yml b/shared/threat-models/codeql-pack.release.yml
index cf398ce02aa..a2a5484910b 100644
--- a/shared/threat-models/codeql-pack.release.yml
+++ b/shared/threat-models/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.6
+lastReleaseVersion: 0.0.7
diff --git a/shared/threat-models/qlpack.yml b/shared/threat-models/qlpack.yml
index 4fd423016e2..b056dd0d720 100644
--- a/shared/threat-models/qlpack.yml
+++ b/shared/threat-models/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/threat-models
-version: 0.0.7-dev
+version: 0.0.7
library: true
groups: shared
dataExtensions:
diff --git a/shared/tutorial/CHANGELOG.md b/shared/tutorial/CHANGELOG.md
index d89b3171dc6..bc33883a950 100644
--- a/shared/tutorial/CHANGELOG.md
+++ b/shared/tutorial/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.8
+
+No user-facing changes.
+
## 0.2.7
No user-facing changes.
diff --git a/shared/tutorial/change-notes/released/0.2.8.md b/shared/tutorial/change-notes/released/0.2.8.md
new file mode 100644
index 00000000000..2f8aa0dd21e
--- /dev/null
+++ b/shared/tutorial/change-notes/released/0.2.8.md
@@ -0,0 +1,3 @@
+## 0.2.8
+
+No user-facing changes.
diff --git a/shared/tutorial/codeql-pack.release.yml b/shared/tutorial/codeql-pack.release.yml
index 6d3c0021858..66ad7f587f8 100644
--- a/shared/tutorial/codeql-pack.release.yml
+++ b/shared/tutorial/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.7
+lastReleaseVersion: 0.2.8
diff --git a/shared/tutorial/qlpack.yml b/shared/tutorial/qlpack.yml
index 573d2d5e5bd..23525cbfc60 100644
--- a/shared/tutorial/qlpack.yml
+++ b/shared/tutorial/qlpack.yml
@@ -1,7 +1,7 @@
name: codeql/tutorial
description: Library for the CodeQL detective tutorials, helping new users learn to
write CodeQL queries.
-version: 0.2.8-dev
+version: 0.2.8
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/typetracking/CHANGELOG.md b/shared/typetracking/CHANGELOG.md
index b47b17710e8..4c21bc408be 100644
--- a/shared/typetracking/CHANGELOG.md
+++ b/shared/typetracking/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.8
+
+No user-facing changes.
+
## 0.2.7
No user-facing changes.
diff --git a/shared/typetracking/change-notes/released/0.2.8.md b/shared/typetracking/change-notes/released/0.2.8.md
new file mode 100644
index 00000000000..2f8aa0dd21e
--- /dev/null
+++ b/shared/typetracking/change-notes/released/0.2.8.md
@@ -0,0 +1,3 @@
+## 0.2.8
+
+No user-facing changes.
diff --git a/shared/typetracking/codeql-pack.release.yml b/shared/typetracking/codeql-pack.release.yml
index 6d3c0021858..66ad7f587f8 100644
--- a/shared/typetracking/codeql-pack.release.yml
+++ b/shared/typetracking/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.7
+lastReleaseVersion: 0.2.8
diff --git a/shared/typetracking/qlpack.yml b/shared/typetracking/qlpack.yml
index a35e17dee12..09757c9de82 100644
--- a/shared/typetracking/qlpack.yml
+++ b/shared/typetracking/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typetracking
-version: 0.2.8-dev
+version: 0.2.8
groups: shared
library: true
dependencies:
diff --git a/shared/typos/CHANGELOG.md b/shared/typos/CHANGELOG.md
index 101d57dbad8..2b0bb7d2f75 100644
--- a/shared/typos/CHANGELOG.md
+++ b/shared/typos/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.8
+
+No user-facing changes.
+
## 0.2.7
No user-facing changes.
diff --git a/shared/typos/change-notes/released/0.2.8.md b/shared/typos/change-notes/released/0.2.8.md
new file mode 100644
index 00000000000..2f8aa0dd21e
--- /dev/null
+++ b/shared/typos/change-notes/released/0.2.8.md
@@ -0,0 +1,3 @@
+## 0.2.8
+
+No user-facing changes.
diff --git a/shared/typos/codeql-pack.release.yml b/shared/typos/codeql-pack.release.yml
index 6d3c0021858..66ad7f587f8 100644
--- a/shared/typos/codeql-pack.release.yml
+++ b/shared/typos/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.7
+lastReleaseVersion: 0.2.8
diff --git a/shared/typos/qlpack.yml b/shared/typos/qlpack.yml
index bc2565304e4..4466e61ee0b 100644
--- a/shared/typos/qlpack.yml
+++ b/shared/typos/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typos
-version: 0.2.8-dev
+version: 0.2.8
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/util/CHANGELOG.md b/shared/util/CHANGELOG.md
index edfa06a5da2..273afd4129b 100644
--- a/shared/util/CHANGELOG.md
+++ b/shared/util/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.8
+
+No user-facing changes.
+
## 0.2.7
No user-facing changes.
diff --git a/shared/util/change-notes/released/0.2.8.md b/shared/util/change-notes/released/0.2.8.md
new file mode 100644
index 00000000000..2f8aa0dd21e
--- /dev/null
+++ b/shared/util/change-notes/released/0.2.8.md
@@ -0,0 +1,3 @@
+## 0.2.8
+
+No user-facing changes.
diff --git a/shared/util/codeql-pack.release.yml b/shared/util/codeql-pack.release.yml
index 6d3c0021858..66ad7f587f8 100644
--- a/shared/util/codeql-pack.release.yml
+++ b/shared/util/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.7
+lastReleaseVersion: 0.2.8
diff --git a/shared/util/qlpack.yml b/shared/util/qlpack.yml
index cddb6cc42f1..ae11a5bf58b 100644
--- a/shared/util/qlpack.yml
+++ b/shared/util/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/util
-version: 0.2.8-dev
+version: 0.2.8
groups: shared
library: true
dependencies: null
diff --git a/shared/yaml/CHANGELOG.md b/shared/yaml/CHANGELOG.md
index c5b3ec6b30e..e2991032640 100644
--- a/shared/yaml/CHANGELOG.md
+++ b/shared/yaml/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.8
+
+No user-facing changes.
+
## 0.2.7
No user-facing changes.
diff --git a/shared/yaml/change-notes/released/0.2.8.md b/shared/yaml/change-notes/released/0.2.8.md
new file mode 100644
index 00000000000..2f8aa0dd21e
--- /dev/null
+++ b/shared/yaml/change-notes/released/0.2.8.md
@@ -0,0 +1,3 @@
+## 0.2.8
+
+No user-facing changes.
diff --git a/shared/yaml/codeql-pack.release.yml b/shared/yaml/codeql-pack.release.yml
index 6d3c0021858..66ad7f587f8 100644
--- a/shared/yaml/codeql-pack.release.yml
+++ b/shared/yaml/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.7
+lastReleaseVersion: 0.2.8
diff --git a/shared/yaml/qlpack.yml b/shared/yaml/qlpack.yml
index 2680ca9cbb9..4d656f79862 100644
--- a/shared/yaml/qlpack.yml
+++ b/shared/yaml/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/yaml
-version: 0.2.8-dev
+version: 0.2.8
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/swift/ql/lib/CHANGELOG.md b/swift/ql/lib/CHANGELOG.md
index f06c4195a35..b69d9b9e9a3 100644
--- a/swift/ql/lib/CHANGELOG.md
+++ b/swift/ql/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.3.8
+
+No user-facing changes.
+
## 0.3.7
### Minor Analysis Improvements
diff --git a/swift/ql/lib/change-notes/released/0.3.8.md b/swift/ql/lib/change-notes/released/0.3.8.md
new file mode 100644
index 00000000000..7e9035d11c1
--- /dev/null
+++ b/swift/ql/lib/change-notes/released/0.3.8.md
@@ -0,0 +1,3 @@
+## 0.3.8
+
+No user-facing changes.
diff --git a/swift/ql/lib/codeql-pack.release.yml b/swift/ql/lib/codeql-pack.release.yml
index 939934ffd00..4aa0b63b207 100644
--- a/swift/ql/lib/codeql-pack.release.yml
+++ b/swift/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.3.7
+lastReleaseVersion: 0.3.8
diff --git a/swift/ql/lib/qlpack.yml b/swift/ql/lib/qlpack.yml
index bb5078ca42b..8916abe3bec 100644
--- a/swift/ql/lib/qlpack.yml
+++ b/swift/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-all
-version: 0.3.8-dev
+version: 0.3.8
groups: swift
extractor: swift
dbscheme: swift.dbscheme
diff --git a/swift/ql/src/CHANGELOG.md b/swift/ql/src/CHANGELOG.md
index ff380eb0b97..7fe6e54b241 100644
--- a/swift/ql/src/CHANGELOG.md
+++ b/swift/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.3.8
+
+No user-facing changes.
+
## 0.3.7
### New Queries
diff --git a/swift/ql/src/change-notes/released/0.3.8.md b/swift/ql/src/change-notes/released/0.3.8.md
new file mode 100644
index 00000000000..7e9035d11c1
--- /dev/null
+++ b/swift/ql/src/change-notes/released/0.3.8.md
@@ -0,0 +1,3 @@
+## 0.3.8
+
+No user-facing changes.
diff --git a/swift/ql/src/codeql-pack.release.yml b/swift/ql/src/codeql-pack.release.yml
index 939934ffd00..4aa0b63b207 100644
--- a/swift/ql/src/codeql-pack.release.yml
+++ b/swift/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.3.7
+lastReleaseVersion: 0.3.8
diff --git a/swift/ql/src/qlpack.yml b/swift/ql/src/qlpack.yml
index e61def6dd27..4a8d3d68e74 100644
--- a/swift/ql/src/qlpack.yml
+++ b/swift/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-queries
-version: 0.3.8-dev
+version: 0.3.8
groups:
- swift
- queries
From 44fe34a37d32c1eb9403cb09c151bb9bcd3aec1b Mon Sep 17 00:00:00 2001
From: erik-krogh
Date: Tue, 6 Feb 2024 09:20:27 +0100
Subject: [PATCH 034/113] use the correct string type in the tainted-path
examples
---
csharp/ql/src/Security Features/CWE-022/examples/TaintedPath.cs | 2 +-
.../Security Features/CWE-022/examples/TaintedPathGoodFolder.cs | 2 +-
.../CWE-022/examples/TaintedPathGoodNormalize.cs | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/csharp/ql/src/Security Features/CWE-022/examples/TaintedPath.cs b/csharp/ql/src/Security Features/CWE-022/examples/TaintedPath.cs
index c185267a038..4539aed8b88 100644
--- a/csharp/ql/src/Security Features/CWE-022/examples/TaintedPath.cs
+++ b/csharp/ql/src/Security Features/CWE-022/examples/TaintedPath.cs
@@ -6,7 +6,7 @@ public class TaintedPathHandler : IHttpHandler
{
public void ProcessRequest(HttpContext ctx)
{
- String filename = ctx.Request.QueryString["path"];
+ string filename = ctx.Request.QueryString["path"];
// BAD: This could read any file on the filesystem.
ctx.Response.Write(File.ReadAllText(filename));
}
diff --git a/csharp/ql/src/Security Features/CWE-022/examples/TaintedPathGoodFolder.cs b/csharp/ql/src/Security Features/CWE-022/examples/TaintedPathGoodFolder.cs
index 33443abb717..6a3991ac7ad 100644
--- a/csharp/ql/src/Security Features/CWE-022/examples/TaintedPathGoodFolder.cs
+++ b/csharp/ql/src/Security Features/CWE-022/examples/TaintedPathGoodFolder.cs
@@ -6,7 +6,7 @@ public class TaintedPathHandler : IHttpHandler
{
public void ProcessRequest(HttpContext ctx)
{
- String filename = ctx.Request.QueryString["path"];
+ string filename = ctx.Request.QueryString["path"];
string publicFolder = Path.GetFullPath("/home/" + user + "/public");
string filePath = Path.GetFullPath(Path.Combine(publicFolder, filename));
diff --git a/csharp/ql/src/Security Features/CWE-022/examples/TaintedPathGoodNormalize.cs b/csharp/ql/src/Security Features/CWE-022/examples/TaintedPathGoodNormalize.cs
index 939ceffff23..0e31e8b68c9 100644
--- a/csharp/ql/src/Security Features/CWE-022/examples/TaintedPathGoodNormalize.cs
+++ b/csharp/ql/src/Security Features/CWE-022/examples/TaintedPathGoodNormalize.cs
@@ -6,7 +6,7 @@ public class TaintedPathHandler : IHttpHandler
{
public void ProcessRequest(HttpContext ctx)
{
- String filename = ctx.Request.QueryString["path"];
+ string filename = ctx.Request.QueryString["path"];
// GOOD: ensure that the filename has no path separators or parent directory references
if (filename.Contains("..") || filename.Contains("/") || filename.Contains("\\"))
{
From 4e176236e77b1fa4fd19d742cde7567e3bb2037e Mon Sep 17 00:00:00 2001
From: erik-krogh
Date: Tue, 6 Feb 2024 09:21:35 +0100
Subject: [PATCH 035/113] add a definition of user
---
.../Security Features/CWE-022/examples/TaintedPathGoodFolder.cs | 1 +
1 file changed, 1 insertion(+)
diff --git a/csharp/ql/src/Security Features/CWE-022/examples/TaintedPathGoodFolder.cs b/csharp/ql/src/Security Features/CWE-022/examples/TaintedPathGoodFolder.cs
index 6a3991ac7ad..19af394b1c7 100644
--- a/csharp/ql/src/Security Features/CWE-022/examples/TaintedPathGoodFolder.cs
+++ b/csharp/ql/src/Security Features/CWE-022/examples/TaintedPathGoodFolder.cs
@@ -8,6 +8,7 @@ public class TaintedPathHandler : IHttpHandler
{
string filename = ctx.Request.QueryString["path"];
+ string user = ctx.User.Identity.Name;
string publicFolder = Path.GetFullPath("/home/" + user + "/public");
string filePath = Path.GetFullPath(Path.Combine(publicFolder, filename));
From 94b7bda3dcbec3beec45d8dc7ef4eb7834fbb50d Mon Sep 17 00:00:00 2001
From: erik-krogh
Date: Tue, 6 Feb 2024 09:36:30 +0100
Subject: [PATCH 036/113] exclude tagged template literals from
`js/superfluous-trailing-arguments`
---
.../ql/src/LanguageFeatures/SpuriousArguments.ql | 3 ++-
.../LanguageFeatures/SpuriousArguments/tst.js | 11 ++++++++++-
2 files changed, 12 insertions(+), 2 deletions(-)
diff --git a/javascript/ql/src/LanguageFeatures/SpuriousArguments.ql b/javascript/ql/src/LanguageFeatures/SpuriousArguments.ql
index de8f248d2d4..fd3914c9023 100644
--- a/javascript/ql/src/LanguageFeatures/SpuriousArguments.ql
+++ b/javascript/ql/src/LanguageFeatures/SpuriousArguments.ql
@@ -46,7 +46,8 @@ class SpuriousArguments extends Expr {
SpuriousArguments() {
this = invk.getArgument(maxArity(invk)).asExpr() and
- not invk.isIncomplete()
+ not invk.isIncomplete() and
+ not invk.getAstNode() instanceof TaggedTemplateExpr
}
/**
diff --git a/javascript/ql/test/query-tests/LanguageFeatures/SpuriousArguments/tst.js b/javascript/ql/test/query-tests/LanguageFeatures/SpuriousArguments/tst.js
index 13877ff1dda..1caa88564a1 100644
--- a/javascript/ql/test/query-tests/LanguageFeatures/SpuriousArguments/tst.js
+++ b/javascript/ql/test/query-tests/LanguageFeatures/SpuriousArguments/tst.js
@@ -129,4 +129,13 @@ function sum2() {
}
// OK
-sum2(1, 2, 3);
\ No newline at end of file
+sum2(1, 2, 3);
+
+const $ = function (x, arr) {
+ console.log(x, arr);
+};
+
+// OK
+async function tagThing(repoUrl, directory) {
+ await $`git clone ${repoUrl} ${directory}`;
+}
From 6c1e3b1ba60aef87f7fdabc2b1e1586989d0a4e8 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Tue, 6 Feb 2024 11:02:15 +0000
Subject: [PATCH 037/113] Update cpp/ql/src/change-notes/released/0.9.4.md
---
cpp/ql/src/change-notes/released/0.9.4.md | 1 -
1 file changed, 1 deletion(-)
diff --git a/cpp/ql/src/change-notes/released/0.9.4.md b/cpp/ql/src/change-notes/released/0.9.4.md
index 6525a90f9bb..bc6e71d7054 100644
--- a/cpp/ql/src/change-notes/released/0.9.4.md
+++ b/cpp/ql/src/change-notes/released/0.9.4.md
@@ -6,5 +6,4 @@
* The "Incorrect return-value check for a 'scanf'-like function" query (`cpp/incorrectly-checked-scanf`) no longer reports an alert when an explicit check for EOF is added.
* The "Incorrect return-value check for a 'scanf'-like function" query (`cpp/incorrectly-checked-scanf`) now recognizes more EOF checks.
* The "Potentially uninitialized local variable" query (`cpp/uninitialized-local`) no longer reports an alert when the local variable is used as a qualifier to a static member function call.
-* ```
* The diagnostic query `cpp/diagnostics/successfully-extracted-files` now considers any C/C++ file seen during extraction, even one with some errors, to be extracted / scanned. This affects the Code Scanning UI measure of scanned C/C++ files.
From 33cefabe2771d9b28b42a757698a1f18665d140b Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Tue, 6 Feb 2024 11:05:22 +0000
Subject: [PATCH 038/113] Update cpp/ql/src/CHANGELOG.md
---
cpp/ql/src/CHANGELOG.md | 1 -
1 file changed, 1 deletion(-)
diff --git a/cpp/ql/src/CHANGELOG.md b/cpp/ql/src/CHANGELOG.md
index 68bcdbc5b07..44d00c1d8e4 100644
--- a/cpp/ql/src/CHANGELOG.md
+++ b/cpp/ql/src/CHANGELOG.md
@@ -6,7 +6,6 @@
* The "Incorrect return-value check for a 'scanf'-like function" query (`cpp/incorrectly-checked-scanf`) no longer reports an alert when an explicit check for EOF is added.
* The "Incorrect return-value check for a 'scanf'-like function" query (`cpp/incorrectly-checked-scanf`) now recognizes more EOF checks.
* The "Potentially uninitialized local variable" query (`cpp/uninitialized-local`) no longer reports an alert when the local variable is used as a qualifier to a static member function call.
-* ```
* The diagnostic query `cpp/diagnostics/successfully-extracted-files` now considers any C/C++ file seen during extraction, even one with some errors, to be extracted / scanned. This affects the Code Scanning UI measure of scanned C/C++ files.
## 0.9.3
From 705a37706019c2ba531aa613d34ce42757eacd55 Mon Sep 17 00:00:00 2001
From: Max Schaefer
Date: Mon, 5 Feb 2024 19:52:30 +0000
Subject: [PATCH 039/113] Address review comments.
---
java/ql/lib/change-notes/2024-01-31-new-models.md | 3 ---
java/ql/lib/ext/android.app.model.yml | 1 -
java/ql/lib/ext/java.net.model.yml | 1 -
java/ql/lib/ext/java.nio.file.model.yml | 1 -
java/ql/lib/ext/javax.xml.parsers.model.yml | 6 ------
java/ql/lib/ext/org.apache.http.impl.client.model.yml | 1 -
6 files changed, 13 deletions(-)
delete mode 100644 java/ql/lib/ext/javax.xml.parsers.model.yml
diff --git a/java/ql/lib/change-notes/2024-01-31-new-models.md b/java/ql/lib/change-notes/2024-01-31-new-models.md
index 195c1dd9954..4fbc1b59571 100644
--- a/java/ql/lib/change-notes/2024-01-31-new-models.md
+++ b/java/ql/lib/change-notes/2024-01-31-new-models.md
@@ -3,7 +3,6 @@ category: minorAnalysis
---
* Added models for the following packages:
- * android.app
* java.io
* java.lang
* java.net
@@ -11,11 +10,9 @@ category: minorAnalysis
* java.nio.file
* java.util.zip
* javax.servlet
- * javax.xml.parsers
* kotlin.io
* org.apache.commons.io
* org.apache.hadoop.fs
* org.apache.hadoop.fs.s3a
- * org.apache.http.impl.client
* org.eclipse.jetty.client
* org.gradle.api.file
diff --git a/java/ql/lib/ext/android.app.model.yml b/java/ql/lib/ext/android.app.model.yml
index f70ea2d238c..28b5171c0d7 100644
--- a/java/ql/lib/ext/android.app.model.yml
+++ b/java/ql/lib/ext/android.app.model.yml
@@ -6,7 +6,6 @@ extensions:
- ["android.app", "Activity", True, "bindService", "", "", "Argument[0]", "intent-redirection", "manual"]
- ["android.app", "Activity", True, "bindServiceAsUser", "", "", "Argument[0]", "intent-redirection", "manual"]
- ["android.app", "Activity", True, "setResult", "(int,Intent)", "", "Argument[1]", "pending-intents", "manual"]
- - ["android.app", "Activity", True, "startActivity", "(Intent)", "", "Argument[0]", "intent-redirection", "ai-manual"]
- ["android.app", "Activity", True, "startActivityAsCaller", "", "", "Argument[0]", "intent-redirection", "manual"]
- ["android.app", "Activity", True, "startActivityForResult", "(Intent,int)", "", "Argument[0]", "intent-redirection", "manual"]
- ["android.app", "Activity", True, "startActivityForResult", "(Intent,int,Bundle)", "", "Argument[0]", "intent-redirection", "manual"]
diff --git a/java/ql/lib/ext/java.net.model.yml b/java/ql/lib/ext/java.net.model.yml
index a6dd7fc5ce8..afdf3320b08 100644
--- a/java/ql/lib/ext/java.net.model.yml
+++ b/java/ql/lib/ext/java.net.model.yml
@@ -44,7 +44,6 @@ extensions:
- ["java.net", "InetSocketAddress", True, "InetSocketAddress", "(String,int)", "", "Argument[0]", "Argument[this]", "taint", "ai-manual"]
- ["java.net", "URI", False, "resolve", "(URI)", "", "Argument[this]", "ReturnValue", "taint", "ai-manual"]
- ["java.net", "URI", False, "URI", "(String,String,String,int,String,String,String)", "", "Argument[5]", "Argument[this].SyntheticField[java.net.URI.query]", "taint", "ai-manual"]
- - ["java.net", "URI", False, "URI", "(String,String,String,int,String,String,String)", "", "Argument[4]", "ReturnValue", "taint", "ai-manual"]
- ["java.net", "URI", False, "URI", "(String,String,String)", "", "Argument[1]", "ReturnValue", "taint", "ai-manual"]
- ["java.net", "URI", False, "URI", "(String)", "", "Argument[0]", "Argument[this]", "taint", "manual"]
- ["java.net", "URI", False, "create", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
diff --git a/java/ql/lib/ext/java.nio.file.model.yml b/java/ql/lib/ext/java.nio.file.model.yml
index ea32fa75fe3..f41cbf3a3e9 100644
--- a/java/ql/lib/ext/java.nio.file.model.yml
+++ b/java/ql/lib/ext/java.nio.file.model.yml
@@ -82,7 +82,6 @@ extensions:
- ["java.nio.file", "Path", False, "toFile", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
- ["java.nio.file", "Path", True, "toString", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
- ["java.nio.file", "Path", True, "toUri", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
- - ["java.nio.file", "Paths", False, "get", "(String,String[])", "", "Argument[1]", "ReturnValue", "taint", "ai-manual"]
- ["java.nio.file", "Paths", True, "get", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["java.nio.file", "Paths", True, "get", "", "", "Argument[1].ArrayElement", "ReturnValue", "taint", "manual"]
# Not supported by current lambda flow
diff --git a/java/ql/lib/ext/javax.xml.parsers.model.yml b/java/ql/lib/ext/javax.xml.parsers.model.yml
deleted file mode 100644
index d39a28f5942..00000000000
--- a/java/ql/lib/ext/javax.xml.parsers.model.yml
+++ /dev/null
@@ -1,6 +0,0 @@
-extensions:
- - addsTo:
- pack: codeql/java-all
- extensible: sinkModel
- data:
- - ["javax.xml.parsers", "DocumentBuilder", True, "parse", "(InputSource)", "", "Argument[0]", "xxe", "ai-manual"]
diff --git a/java/ql/lib/ext/org.apache.http.impl.client.model.yml b/java/ql/lib/ext/org.apache.http.impl.client.model.yml
index 6f407ac3682..be517e5344f 100644
--- a/java/ql/lib/ext/org.apache.http.impl.client.model.yml
+++ b/java/ql/lib/ext/org.apache.http.impl.client.model.yml
@@ -3,5 +3,4 @@ extensions:
pack: codeql/java-all
extensible: sinkModel
data:
- - ["org.apache.http.impl.client", "CloseableHttpClient", True, "execute", "(HttpUriRequest)", "", "Argument[0]", "request-forgery", "ai-manual"]
- ["org.apache.http.impl.client", "RequestWrapper", True, "setURI", "(URI)", "", "Argument[0]", "request-forgery", "hq-manual"]
From b5139078d0befed44d9147f01862bb7d8a454ab9 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
Date: Tue, 6 Feb 2024 19:22:35 +0000
Subject: [PATCH 040/113] Post-release preparation for codeql-cli-2.16.2
---
cpp/ql/lib/qlpack.yml | 2 +-
cpp/ql/src/qlpack.yml | 2 +-
csharp/ql/campaigns/Solorigate/lib/qlpack.yml | 2 +-
csharp/ql/campaigns/Solorigate/src/qlpack.yml | 2 +-
csharp/ql/lib/qlpack.yml | 2 +-
csharp/ql/src/qlpack.yml | 2 +-
go/ql/consistency-queries/qlpack.yml | 2 +-
go/ql/lib/qlpack.yml | 2 +-
go/ql/src/qlpack.yml | 2 +-
java/ql/automodel/src/qlpack.yml | 2 +-
java/ql/lib/qlpack.yml | 2 +-
java/ql/src/qlpack.yml | 2 +-
javascript/ql/lib/qlpack.yml | 2 +-
javascript/ql/src/qlpack.yml | 2 +-
misc/suite-helpers/qlpack.yml | 2 +-
python/ql/lib/qlpack.yml | 2 +-
python/ql/src/qlpack.yml | 2 +-
ruby/ql/lib/qlpack.yml | 2 +-
ruby/ql/src/qlpack.yml | 2 +-
shared/controlflow/qlpack.yml | 2 +-
shared/dataflow/qlpack.yml | 2 +-
shared/mad/qlpack.yml | 2 +-
shared/rangeanalysis/qlpack.yml | 2 +-
shared/regex/qlpack.yml | 2 +-
shared/ssa/qlpack.yml | 2 +-
shared/threat-models/qlpack.yml | 2 +-
shared/tutorial/qlpack.yml | 2 +-
shared/typetracking/qlpack.yml | 2 +-
shared/typos/qlpack.yml | 2 +-
shared/util/qlpack.yml | 2 +-
shared/yaml/qlpack.yml | 2 +-
swift/ql/lib/qlpack.yml | 2 +-
swift/ql/src/qlpack.yml | 2 +-
33 files changed, 33 insertions(+), 33 deletions(-)
diff --git a/cpp/ql/lib/qlpack.yml b/cpp/ql/lib/qlpack.yml
index b1b4172e977..7615b6bac2f 100644
--- a/cpp/ql/lib/qlpack.yml
+++ b/cpp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-all
-version: 0.12.5
+version: 0.12.6-dev
groups: cpp
dbscheme: semmlecode.cpp.dbscheme
extractor: cpp
diff --git a/cpp/ql/src/qlpack.yml b/cpp/ql/src/qlpack.yml
index 0da41987b3e..9151201a137 100644
--- a/cpp/ql/src/qlpack.yml
+++ b/cpp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-queries
-version: 0.9.4
+version: 0.9.5-dev
groups:
- cpp
- queries
diff --git a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
index 77b1c8b5154..8466748a25b 100644
--- a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-all
-version: 1.7.8
+version: 1.7.9-dev
groups:
- csharp
- solorigate
diff --git a/csharp/ql/campaigns/Solorigate/src/qlpack.yml b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
index 9851e27c691..ff72db938e0 100644
--- a/csharp/ql/campaigns/Solorigate/src/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-queries
-version: 1.7.8
+version: 1.7.9-dev
groups:
- csharp
- solorigate
diff --git a/csharp/ql/lib/qlpack.yml b/csharp/ql/lib/qlpack.yml
index 2b137281da6..2e576e11b11 100644
--- a/csharp/ql/lib/qlpack.yml
+++ b/csharp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-all
-version: 0.8.8
+version: 0.8.9-dev
groups: csharp
dbscheme: semmlecode.csharp.dbscheme
extractor: csharp
diff --git a/csharp/ql/src/qlpack.yml b/csharp/ql/src/qlpack.yml
index a16c72edd72..018c3e09ae3 100644
--- a/csharp/ql/src/qlpack.yml
+++ b/csharp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-queries
-version: 0.8.8
+version: 0.8.9-dev
groups:
- csharp
- queries
diff --git a/go/ql/consistency-queries/qlpack.yml b/go/ql/consistency-queries/qlpack.yml
index c7522dd8e35..651e694d964 100644
--- a/go/ql/consistency-queries/qlpack.yml
+++ b/go/ql/consistency-queries/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql-go-consistency-queries
-version: 0.0.7
+version: 0.0.8-dev
groups:
- go
- queries
diff --git a/go/ql/lib/qlpack.yml b/go/ql/lib/qlpack.yml
index 5f317377d45..920594fe6ec 100644
--- a/go/ql/lib/qlpack.yml
+++ b/go/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-all
-version: 0.7.8
+version: 0.7.9-dev
groups: go
dbscheme: go.dbscheme
extractor: go
diff --git a/go/ql/src/qlpack.yml b/go/ql/src/qlpack.yml
index 81654540219..fb73fa0eb96 100644
--- a/go/ql/src/qlpack.yml
+++ b/go/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-queries
-version: 0.7.8
+version: 0.7.9-dev
groups:
- go
- queries
diff --git a/java/ql/automodel/src/qlpack.yml b/java/ql/automodel/src/qlpack.yml
index 3334223e9e4..1f68ac3f6ba 100644
--- a/java/ql/automodel/src/qlpack.yml
+++ b/java/ql/automodel/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-automodel-queries
-version: 0.0.14
+version: 0.0.15-dev
groups:
- java
- automodel
diff --git a/java/ql/lib/qlpack.yml b/java/ql/lib/qlpack.yml
index 6e4e1269d9c..cadcc1c9be6 100644
--- a/java/ql/lib/qlpack.yml
+++ b/java/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-all
-version: 0.8.8
+version: 0.8.9-dev
groups: java
dbscheme: config/semmlecode.dbscheme
extractor: java
diff --git a/java/ql/src/qlpack.yml b/java/ql/src/qlpack.yml
index 73e8a062ffe..cad99f4d9c4 100644
--- a/java/ql/src/qlpack.yml
+++ b/java/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-queries
-version: 0.8.8
+version: 0.8.9-dev
groups:
- java
- queries
diff --git a/javascript/ql/lib/qlpack.yml b/javascript/ql/lib/qlpack.yml
index fa544548ea7..2be9a1ed2bd 100644
--- a/javascript/ql/lib/qlpack.yml
+++ b/javascript/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-all
-version: 0.8.8
+version: 0.8.9-dev
groups: javascript
dbscheme: semmlecode.javascript.dbscheme
extractor: javascript
diff --git a/javascript/ql/src/qlpack.yml b/javascript/ql/src/qlpack.yml
index 1ebbfc58787..545be6f2c61 100644
--- a/javascript/ql/src/qlpack.yml
+++ b/javascript/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-queries
-version: 0.8.8
+version: 0.8.9-dev
groups:
- javascript
- queries
diff --git a/misc/suite-helpers/qlpack.yml b/misc/suite-helpers/qlpack.yml
index 4db5dfcf454..6b20374ae33 100644
--- a/misc/suite-helpers/qlpack.yml
+++ b/misc/suite-helpers/qlpack.yml
@@ -1,4 +1,4 @@
name: codeql/suite-helpers
-version: 0.7.8
+version: 0.7.9-dev
groups: shared
warnOnImplicitThis: true
diff --git a/python/ql/lib/qlpack.yml b/python/ql/lib/qlpack.yml
index a2c343cca3f..94f82195d5b 100644
--- a/python/ql/lib/qlpack.yml
+++ b/python/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-all
-version: 0.11.8
+version: 0.11.9-dev
groups: python
dbscheme: semmlecode.python.dbscheme
extractor: python
diff --git a/python/ql/src/qlpack.yml b/python/ql/src/qlpack.yml
index 538e5ad799c..c5335da22f3 100644
--- a/python/ql/src/qlpack.yml
+++ b/python/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-queries
-version: 0.9.8
+version: 0.9.9-dev
groups:
- python
- queries
diff --git a/ruby/ql/lib/qlpack.yml b/ruby/ql/lib/qlpack.yml
index 7eb6222e101..6c55331de90 100644
--- a/ruby/ql/lib/qlpack.yml
+++ b/ruby/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-all
-version: 0.8.8
+version: 0.8.9-dev
groups: ruby
extractor: ruby
dbscheme: ruby.dbscheme
diff --git a/ruby/ql/src/qlpack.yml b/ruby/ql/src/qlpack.yml
index 7c1995c00e5..3637a80df7f 100644
--- a/ruby/ql/src/qlpack.yml
+++ b/ruby/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-queries
-version: 0.8.8
+version: 0.8.9-dev
groups:
- ruby
- queries
diff --git a/shared/controlflow/qlpack.yml b/shared/controlflow/qlpack.yml
index 79d4a386cf1..c7a88e50611 100644
--- a/shared/controlflow/qlpack.yml
+++ b/shared/controlflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/controlflow
-version: 0.1.8
+version: 0.1.9-dev
groups: shared
library: true
dependencies:
diff --git a/shared/dataflow/qlpack.yml b/shared/dataflow/qlpack.yml
index ffb4d0754be..c14ef815d58 100644
--- a/shared/dataflow/qlpack.yml
+++ b/shared/dataflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/dataflow
-version: 0.1.8
+version: 0.1.9-dev
groups: shared
library: true
dependencies:
diff --git a/shared/mad/qlpack.yml b/shared/mad/qlpack.yml
index c4eade3b256..0b3830f888d 100644
--- a/shared/mad/qlpack.yml
+++ b/shared/mad/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/mad
-version: 0.2.8
+version: 0.2.9-dev
groups: shared
library: true
dependencies: null
diff --git a/shared/rangeanalysis/qlpack.yml b/shared/rangeanalysis/qlpack.yml
index faa059f069a..0f5272dd8cf 100644
--- a/shared/rangeanalysis/qlpack.yml
+++ b/shared/rangeanalysis/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/rangeanalysis
-version: 0.0.7
+version: 0.0.8-dev
groups: shared
library: true
dependencies:
diff --git a/shared/regex/qlpack.yml b/shared/regex/qlpack.yml
index 57aa69e9629..eca67311c9c 100644
--- a/shared/regex/qlpack.yml
+++ b/shared/regex/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/regex
-version: 0.2.8
+version: 0.2.9-dev
groups: shared
library: true
dependencies:
diff --git a/shared/ssa/qlpack.yml b/shared/ssa/qlpack.yml
index f47e195b548..b5d30380815 100644
--- a/shared/ssa/qlpack.yml
+++ b/shared/ssa/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ssa
-version: 0.2.8
+version: 0.2.9-dev
groups: shared
library: true
dependencies:
diff --git a/shared/threat-models/qlpack.yml b/shared/threat-models/qlpack.yml
index b056dd0d720..eb345ecca9a 100644
--- a/shared/threat-models/qlpack.yml
+++ b/shared/threat-models/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/threat-models
-version: 0.0.7
+version: 0.0.8-dev
library: true
groups: shared
dataExtensions:
diff --git a/shared/tutorial/qlpack.yml b/shared/tutorial/qlpack.yml
index 23525cbfc60..e3080bb33b5 100644
--- a/shared/tutorial/qlpack.yml
+++ b/shared/tutorial/qlpack.yml
@@ -1,7 +1,7 @@
name: codeql/tutorial
description: Library for the CodeQL detective tutorials, helping new users learn to
write CodeQL queries.
-version: 0.2.8
+version: 0.2.9-dev
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/typetracking/qlpack.yml b/shared/typetracking/qlpack.yml
index 09757c9de82..adf375fd0c3 100644
--- a/shared/typetracking/qlpack.yml
+++ b/shared/typetracking/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typetracking
-version: 0.2.8
+version: 0.2.9-dev
groups: shared
library: true
dependencies:
diff --git a/shared/typos/qlpack.yml b/shared/typos/qlpack.yml
index 4466e61ee0b..927514b2fe4 100644
--- a/shared/typos/qlpack.yml
+++ b/shared/typos/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typos
-version: 0.2.8
+version: 0.2.9-dev
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/util/qlpack.yml b/shared/util/qlpack.yml
index ae11a5bf58b..72537a48107 100644
--- a/shared/util/qlpack.yml
+++ b/shared/util/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/util
-version: 0.2.8
+version: 0.2.9-dev
groups: shared
library: true
dependencies: null
diff --git a/shared/yaml/qlpack.yml b/shared/yaml/qlpack.yml
index 4d656f79862..fae3aad1324 100644
--- a/shared/yaml/qlpack.yml
+++ b/shared/yaml/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/yaml
-version: 0.2.8
+version: 0.2.9-dev
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/swift/ql/lib/qlpack.yml b/swift/ql/lib/qlpack.yml
index 8916abe3bec..2c58adec21e 100644
--- a/swift/ql/lib/qlpack.yml
+++ b/swift/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-all
-version: 0.3.8
+version: 0.3.9-dev
groups: swift
extractor: swift
dbscheme: swift.dbscheme
diff --git a/swift/ql/src/qlpack.yml b/swift/ql/src/qlpack.yml
index 4a8d3d68e74..00ff9a6f163 100644
--- a/swift/ql/src/qlpack.yml
+++ b/swift/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-queries
-version: 0.3.8
+version: 0.3.9-dev
groups:
- swift
- queries
From 1484a169d743bec1bf3d08b390ddc5c1efad16c5 Mon Sep 17 00:00:00 2001
From: Jonathan Leitschuh
Date: Tue, 6 Feb 2024 15:43:19 -0500
Subject: [PATCH 041/113] Reduce severity of `java/relative-path-command`
Significantly reduces the severity of `java/relative-path-command` from 9.8 to 5.4
https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
---
java/ql/src/Security/CWE/CWE-078/ExecRelative.ql | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/java/ql/src/Security/CWE/CWE-078/ExecRelative.ql b/java/ql/src/Security/CWE/CWE-078/ExecRelative.ql
index 501826c6426..533980a3f0a 100644
--- a/java/ql/src/Security/CWE/CWE-078/ExecRelative.ql
+++ b/java/ql/src/Security/CWE/CWE-078/ExecRelative.ql
@@ -4,7 +4,7 @@
* malicious changes in the PATH environment variable.
* @kind problem
* @problem.severity warning
- * @security-severity 9.8
+ * @security-severity 5.4
* @precision medium
* @id java/relative-path-command
* @tags security
From b8dbb8c866a7f468681ccb6f14e6d02b0842f8ce Mon Sep 17 00:00:00 2001
From: Tamas Vajk
Date: Wed, 7 Feb 2024 10:26:09 +0100
Subject: [PATCH 042/113] C# Add missing Windows Forms implicit usings
---
.../DependencyManager.cs | 13 +++++++
.../FileContent.cs | 30 ++++++++++++++++
.../Semmle.Extraction.Tests/FileContent.cs | 36 +++++++++++++++----
3 files changed, 73 insertions(+), 6 deletions(-)
diff --git a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DependencyManager.cs b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DependencyManager.cs
index 13f8cc4e2a5..cd071c307bf 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DependencyManager.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DependencyManager.cs
@@ -116,8 +116,16 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
bool.TryParse(webViewExtractionOption, out var shouldExtractWebViews) &&
shouldExtractWebViews)
{
+ CompilationInfos.Add(("WebView extraction enabled", "1"));
GenerateSourceFilesFromWebViews(allNonBinaryFiles);
}
+ else
+ {
+ CompilationInfos.Add(("WebView extraction enabled", "0"));
+ }
+
+ CompilationInfos.Add(("UseWPF set", fileContent.UseWpf ? "1" : "0"));
+ CompilationInfos.Add(("UseWindowsForms set", fileContent.UseWindowsForms ? "1" : "0"));
GenerateSourceFileFromImplicitUsings();
@@ -434,6 +442,11 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
"Microsoft.Extensions.DependencyInjection", "Microsoft.Extensions.Hosting", "Microsoft.Extensions.Logging" });
}
+ if (fileContent.UseWindowsForms)
+ {
+ usings.UnionWith(new[] { "System.Drawing", "System.Windows.Forms" });
+ }
+
usings.UnionWith(fileContent.CustomImplicitUsings);
logger.LogInfo($"Generating source file for implicit usings. Namespaces: {string.Join(", ", usings.OrderBy(u => u))}");
diff --git a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/FileContent.cs b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/FileContent.cs
index c06eaec270f..03f448e7330 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/FileContent.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/FileContent.cs
@@ -61,6 +61,28 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
}
}
+ private bool useWpf = false;
+
+ public bool UseWpf
+ {
+ get
+ {
+ initialize.Run();
+ return useWpf;
+ }
+ }
+
+ private bool useWindowsForms = false;
+
+ public bool UseWindowsForms
+ {
+ get
+ {
+ initialize.Run();
+ return useWindowsForms;
+ }
+ }
+
private bool isLegacyProjectStructureUsed = false;
public bool IsLegacyProjectStructureUsed
@@ -173,6 +195,14 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
|| line.Contains("enable".AsSpan(), StringComparison.Ordinal)
|| line.Contains("true".AsSpan(), StringComparison.Ordinal);
+ // Determine if WPF is used.
+ useWpf = useWpf
+ || line.Contains("true".AsSpan(), StringComparison.Ordinal);
+
+ // Determine if Windows Forms is used.
+ useWindowsForms = useWindowsForms
+ || line.Contains("true".AsSpan(), StringComparison.Ordinal);
+
// Find all custom implicit usings.
foreach (var valueMatch in CustomImplicitUsingDeclarations().EnumerateMatches(line))
{
diff --git a/csharp/extractor/Semmle.Extraction.Tests/FileContent.cs b/csharp/extractor/Semmle.Extraction.Tests/FileContent.cs
index ba934120c45..6dcee31024a 100644
--- a/csharp/extractor/Semmle.Extraction.Tests/FileContent.cs
+++ b/csharp/extractor/Semmle.Extraction.Tests/FileContent.cs
@@ -84,7 +84,7 @@ namespace Semmle.Extraction.Tests
Assert.Contains("StyleCop.Analyzers".ToLowerInvariant(), allPackages);
}
- private static void ImplicitUsingsTest(string line, bool expected)
+ private static void CsProjSettingsTest(string line, bool expected, Func func)
{
// Setup
var lines = new List()
@@ -94,28 +94,52 @@ namespace Semmle.Extraction.Tests
var fileContent = new TestFileContent(lines);
// Execute
- var useImplicitUsings = fileContent.UseImplicitUsings;
+ var actual = func(fileContent);
// Verify
- Assert.Equal(expected, useImplicitUsings);
+ Assert.Equal(expected, actual);
}
[Fact]
public void TestFileContent_ImplicitUsings0()
{
- ImplicitUsingsTest("false", false);
+ CsProjSettingsTest("false", false, fc => fc.UseImplicitUsings);
}
[Fact]
public void TestFileContent_ImplicitUsings1()
{
- ImplicitUsingsTest("true", true);
+ CsProjSettingsTest("true", true, fc => fc.UseImplicitUsings);
}
[Fact]
public void TestFileContent_ImplicitUsings2()
{
- ImplicitUsingsTest("enable", true);
+ CsProjSettingsTest("enable", true, fc => fc.UseImplicitUsings);
+ }
+
+ [Fact]
+ public void TestFileContent_UseWpf0()
+ {
+ CsProjSettingsTest("false", false, fc => fc.UseWpf);
+ }
+
+ [Fact]
+ public void TestFileContent_UseWpf1()
+ {
+ CsProjSettingsTest("true", true, fc => fc.UseWpf);
+ }
+
+ [Fact]
+ public void TestFileContent_UseWindowsForms0()
+ {
+ CsProjSettingsTest("false", false, fc => fc.UseWindowsForms);
+ }
+
+ [Fact]
+ public void TestFileContent_UseWindowsForms1()
+ {
+ CsProjSettingsTest("true", true, fc => fc.UseWindowsForms);
}
[Fact]
From 082754a3d8dd3a3a8d550bc5e1b150ea83f51717 Mon Sep 17 00:00:00 2001
From: Max Schaefer
Date: Wed, 7 Feb 2024 13:21:59 +0000
Subject: [PATCH 043/113] Remove problematic Kotlin model.
---
java/ql/lib/change-notes/2024-01-31-new-models.md | 1 -
java/ql/lib/ext/kotlin.io.model.yml | 1 -
2 files changed, 2 deletions(-)
diff --git a/java/ql/lib/change-notes/2024-01-31-new-models.md b/java/ql/lib/change-notes/2024-01-31-new-models.md
index 4fbc1b59571..bdb588f3bc3 100644
--- a/java/ql/lib/change-notes/2024-01-31-new-models.md
+++ b/java/ql/lib/change-notes/2024-01-31-new-models.md
@@ -10,7 +10,6 @@ category: minorAnalysis
* java.nio.file
* java.util.zip
* javax.servlet
- * kotlin.io
* org.apache.commons.io
* org.apache.hadoop.fs
* org.apache.hadoop.fs.s3a
diff --git a/java/ql/lib/ext/kotlin.io.model.yml b/java/ql/lib/ext/kotlin.io.model.yml
index c65862f6eac..b748e04a292 100644
--- a/java/ql/lib/ext/kotlin.io.model.yml
+++ b/java/ql/lib/ext/kotlin.io.model.yml
@@ -3,7 +3,6 @@ extensions:
pack: codeql/java-all
extensible: sinkModel
data:
- - ["kotlin.io", "FilesKt", False, "appendText$default", "(File,String,Charset,int,Object)", "", "Argument[0]", "path-injection", "ai-manual"]
- ["kotlin.io", "FilesKt", False, "deleteRecursively", "(File)", "", "Argument[0]", "path-injection", "ai-manual"]
- ["kotlin.io", "FilesKt", False, "inputStream", "(File)", "", "Argument[0]", "path-injection", "ai-manual"]
- ["kotlin.io", "FilesKt", False, "readBytes", "(File)", "", "Argument[0]", "path-injection", "ai-manual"]
From 8646bffaea94302d4b42050919d18aaab385fa78 Mon Sep 17 00:00:00 2001
From: Koen Vlaswinkel
Date: Wed, 7 Feb 2024 14:35:19 +0100
Subject: [PATCH 044/113] Ruby: Remove `ReturnValue` as access path for
constructors
---
.../utils/modeleditor/FrameworkModeAccessPaths.ql | 4 +++-
ruby/ql/src/utils/modeleditor/ModelEditor.qll | 13 +++++++++----
2 files changed, 12 insertions(+), 5 deletions(-)
diff --git a/ruby/ql/src/utils/modeleditor/FrameworkModeAccessPaths.ql b/ruby/ql/src/utils/modeleditor/FrameworkModeAccessPaths.ql
index d992f1c46f8..87559350048 100644
--- a/ruby/ql/src/utils/modeleditor/FrameworkModeAccessPaths.ql
+++ b/ruby/ql/src/utils/modeleditor/FrameworkModeAccessPaths.ql
@@ -10,6 +10,7 @@ private import ruby
private import codeql.ruby.AST
private import codeql.ruby.ApiGraphs
private import queries.modeling.internal.Util as Util
+private import ModelEditor
predicate simpleParameters(string type, string path, string value, DataFlow::Node node) {
exists(DataFlow::MethodNode methodNode, DataFlow::ParameterNode paramNode |
@@ -58,7 +59,8 @@ predicate blockArguments(string type, string path, string value, DataFlow::Node
predicate returnValue(string type, string path, string value, DataFlow::Node node) {
exists(DataFlow::MethodNode methodNode, DataFlow::Node returnNode |
methodNode.getLocation().getFile() instanceof Util::RelevantFile and
- returnNode = methodNode.getAReturnNode()
+ returnNode = methodNode.getAReturnNode() and
+ not isConstructor(methodNode) // A constructor doesn't have a return value
|
Util::pathToMethod(methodNode, type, path) and
value = "ReturnValue" and
diff --git a/ruby/ql/src/utils/modeleditor/ModelEditor.qll b/ruby/ql/src/utils/modeleditor/ModelEditor.qll
index 625d40fd501..020a5f6177c 100644
--- a/ruby/ql/src/utils/modeleditor/ModelEditor.qll
+++ b/ruby/ql/src/utils/modeleditor/ModelEditor.qll
@@ -32,6 +32,14 @@ string getNamespace(File file) {
)
}
+/**
+ * Holds if this method is a constructor for a module.
+ */
+predicate isConstructor(DataFlow::MethodNode method) {
+ method.getMethodName() = "initialize" and
+ exists(DataFlow::ModuleNode m | m.getOwnInstanceMethod(method.getMethodName()) = method)
+}
+
abstract class Endpoint instanceof DataFlow::Node {
string getNamespace() { result = getNamespace(super.getLocation().getFile()) }
@@ -153,10 +161,7 @@ class MethodEndpoint extends Endpoint instanceof DataFlow::MethodNode {
/**
* Holds if this method is a constructor for a module.
*/
- private predicate isConstructor() {
- super.getMethodName() = "initialize" and
- exists(DataFlow::ModuleNode m | m.getOwnInstanceMethod(super.getMethodName()) = this)
- }
+ private predicate isConstructor() { isConstructor(this) }
}
string methodClassification(Call method) {
From 4eeca02da64ce2ccb3bfe39e21d51088b633600d Mon Sep 17 00:00:00 2001
From: Tamas Vajk
Date: Wed, 7 Feb 2024 14:58:19 +0100
Subject: [PATCH 045/113] Change file content string comparisons to be case
invariant
---
.../FileContent.cs | 29 +++++++------------
1 file changed, 10 insertions(+), 19 deletions(-)
diff --git a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/FileContent.cs b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/FileContent.cs
index 03f448e7330..08639561d87 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/FileContent.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/FileContent.cs
@@ -127,10 +127,10 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
public FileContent(ILogger logger, IEnumerable files) : this(logger, files, new UnsafeFileReader())
{ }
- private static string GetGroup(ReadOnlySpan input, ValueMatch valueMatch, string groupPrefix, bool toLower)
+ private static string GetGroup(ReadOnlySpan input, ValueMatch valueMatch, string groupPrefix)
{
var match = input.Slice(valueMatch.Index, valueMatch.Length);
- var includeIndex = match.IndexOf(groupPrefix, StringComparison.InvariantCultureIgnoreCase);
+ var includeIndex = match.IndexOf(groupPrefix, StringComparison.OrdinalIgnoreCase);
if (includeIndex == -1)
{
return string.Empty;
@@ -141,14 +141,7 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
var quoteIndex1 = match.IndexOf("\"");
var quoteIndex2 = match.Slice(quoteIndex1 + 1).IndexOf("\"");
- var result = match.Slice(quoteIndex1 + 1, quoteIndex2).ToString();
-
- if (toLower)
- {
- result = result.ToLowerInvariant();
- }
-
- return result;
+ return match.Slice(quoteIndex1 + 1, quoteIndex2).ToString();
}
private static bool IsGroupMatch(ReadOnlySpan line, Regex regex, string groupPrefix, string value)
@@ -156,7 +149,7 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
foreach (var valueMatch in regex.EnumerateMatches(line))
{
// We can't get the group from the ValueMatch, so doing it manually:
- if (GetGroup(line, valueMatch, groupPrefix, toLower: true) == value.ToLowerInvariant())
+ if (string.Equals(GetGroup(line, valueMatch, groupPrefix), value, StringComparison.OrdinalIgnoreCase))
{
return true;
}
@@ -172,12 +165,11 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
{
foreach (ReadOnlySpan line in unsafeFileReader.ReadLines(file))
{
-
// Find all the packages.
foreach (var valueMatch in PackageReference().EnumerateMatches(line))
{
// We can't get the group from the ValueMatch, so doing it manually:
- var packageName = GetGroup(line, valueMatch, "Include", toLower: true);
+ var packageName = GetGroup(line, valueMatch, "Include").ToLowerInvariant();
if (!string.IsNullOrEmpty(packageName))
{
allPackages.Add(packageName);
@@ -189,24 +181,23 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
|| IsGroupMatch(line, ProjectSdk(), "Sdk", "Microsoft.NET.Sdk.Web")
|| IsGroupMatch(line, FrameworkReference(), "Include", "Microsoft.AspNetCore.App");
-
// Determine if implicit usings are used.
useImplicitUsings = useImplicitUsings
- || line.Contains("enable".AsSpan(), StringComparison.Ordinal)
- || line.Contains("true".AsSpan(), StringComparison.Ordinal);
+ || line.Contains("enable".AsSpan(), StringComparison.OrdinalIgnoreCase)
+ || line.Contains("true".AsSpan(), StringComparison.OrdinalIgnoreCase);
// Determine if WPF is used.
useWpf = useWpf
- || line.Contains("true".AsSpan(), StringComparison.Ordinal);
+ || line.Contains("true".AsSpan(), StringComparison.OrdinalIgnoreCase);
// Determine if Windows Forms is used.
useWindowsForms = useWindowsForms
- || line.Contains("true".AsSpan(), StringComparison.Ordinal);
+ || line.Contains("true".AsSpan(), StringComparison.OrdinalIgnoreCase);
// Find all custom implicit usings.
foreach (var valueMatch in CustomImplicitUsingDeclarations().EnumerateMatches(line))
{
- var ns = GetGroup(line, valueMatch, "Include", toLower: false);
+ var ns = GetGroup(line, valueMatch, "Include");
if (!string.IsNullOrEmpty(ns))
{
implicitUsingNamespaces.Add(ns);
From 1c6108028b024da4ce2d5200e7e3ef4fffda1a55 Mon Sep 17 00:00:00 2001
From: Ian Lynagh
Date: Wed, 7 Feb 2024 15:12:17 +0000
Subject: [PATCH 046/113] Kotlin 2: Accept some location changes for arrays
---
.../library-tests/arrays/arrayAccesses.expected | 8 ++++----
.../library-tests/arrays/assignExprs.expected | 8 ++++----
2 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/java/ql/test-kotlin2/library-tests/arrays/arrayAccesses.expected b/java/ql/test-kotlin2/library-tests/arrays/arrayAccesses.expected
index 986bdeed21f..3dd2feaf353 100644
--- a/java/ql/test-kotlin2/library-tests/arrays/arrayAccesses.expected
+++ b/java/ql/test-kotlin2/library-tests/arrays/arrayAccesses.expected
@@ -16,7 +16,7 @@
| arrayGetsSets.kt:19:11:19:15 | ...[...] | arrayGetsSets.kt:19:3:19:7 | ...=... | char | arrayGetsSets.kt:19:11:19:12 | a8 | arrayGetsSets.kt:19:14:19:14 | 0 |
| arrayGetsSets.kt:20:3:20:7 | ...[...] | arrayGetsSets.kt:20:3:20:7 | ...=... | Object[] | arrayGetsSets.kt:20:3:20:4 | a9 | arrayGetsSets.kt:20:6:20:6 | 0 |
| arrayGetsSets.kt:20:11:20:15 | ...[...] | arrayGetsSets.kt:20:3:20:7 | ...=... | Object | arrayGetsSets.kt:20:11:20:12 | a9 | arrayGetsSets.kt:20:14:20:14 | 0 |
-| arrayGetsSets.kt:32:3:32:7 | ...[...] | arrayGetsSets.kt:32:3:32:7 | ...+=... | int | arrayGetsSets.kt:32:3:32:4 | a1 | arrayGetsSets.kt:32:6:32:6 | 0 |
-| arrayGetsSets.kt:38:3:38:7 | ...[...] | arrayGetsSets.kt:38:3:38:7 | .../=... | long | arrayGetsSets.kt:38:3:38:4 | a4 | arrayGetsSets.kt:38:6:38:6 | 0 |
-| arrayGetsSets.kt:39:3:39:7 | ...[...] | arrayGetsSets.kt:39:3:39:7 | ...-=... | float | arrayGetsSets.kt:39:3:39:4 | a5 | arrayGetsSets.kt:39:6:39:6 | 0 |
-| arrayGetsSets.kt:40:3:40:7 | ...[...] | arrayGetsSets.kt:40:3:40:7 | ...*=... | double | arrayGetsSets.kt:40:3:40:4 | a6 | arrayGetsSets.kt:40:6:40:6 | 0 |
+| arrayGetsSets.kt:32:3:32:12 | ...[...] | arrayGetsSets.kt:32:3:32:12 | ...+=... | int | arrayGetsSets.kt:32:3:32:4 | a1 | arrayGetsSets.kt:32:6:32:6 | 0 |
+| arrayGetsSets.kt:38:3:38:13 | ...[...] | arrayGetsSets.kt:38:3:38:13 | .../=... | long | arrayGetsSets.kt:38:3:38:4 | a4 | arrayGetsSets.kt:38:6:38:6 | 0 |
+| arrayGetsSets.kt:39:3:39:13 | ...[...] | arrayGetsSets.kt:39:3:39:13 | ...-=... | float | arrayGetsSets.kt:39:3:39:4 | a5 | arrayGetsSets.kt:39:6:39:6 | 0 |
+| arrayGetsSets.kt:40:3:40:14 | ...[...] | arrayGetsSets.kt:40:3:40:14 | ...*=... | double | arrayGetsSets.kt:40:3:40:4 | a6 | arrayGetsSets.kt:40:6:40:6 | 0 |
diff --git a/java/ql/test-kotlin2/library-tests/arrays/assignExprs.expected b/java/ql/test-kotlin2/library-tests/arrays/assignExprs.expected
index da09855b1e0..5f8fda311e2 100644
--- a/java/ql/test-kotlin2/library-tests/arrays/assignExprs.expected
+++ b/java/ql/test-kotlin2/library-tests/arrays/assignExprs.expected
@@ -1,4 +1,4 @@
-| arrayGetsSets.kt:32:3:32:7 | ...+=... | += | int[] | arrayGetsSets.kt:32:3:32:7 | ...[...] | int | arrayGetsSets.kt:32:12:32:12 | 1 | int |
-| arrayGetsSets.kt:38:3:38:7 | .../=... | /= | long[] | arrayGetsSets.kt:38:3:38:7 | ...[...] | long | arrayGetsSets.kt:38:12:38:13 | 1 | long |
-| arrayGetsSets.kt:39:3:39:7 | ...-=... | -= | float[] | arrayGetsSets.kt:39:3:39:7 | ...[...] | float | arrayGetsSets.kt:39:12:39:13 | 1.0 | float |
-| arrayGetsSets.kt:40:3:40:7 | ...*=... | *= | double[] | arrayGetsSets.kt:40:3:40:7 | ...[...] | double | arrayGetsSets.kt:40:12:40:14 | 1.0 | double |
+| arrayGetsSets.kt:32:3:32:12 | ...+=... | += | int[] | arrayGetsSets.kt:32:3:32:12 | ...[...] | int | arrayGetsSets.kt:32:12:32:12 | 1 | int |
+| arrayGetsSets.kt:38:3:38:13 | .../=... | /= | long[] | arrayGetsSets.kt:38:3:38:13 | ...[...] | long | arrayGetsSets.kt:38:12:38:13 | 1 | long |
+| arrayGetsSets.kt:39:3:39:13 | ...-=... | -= | float[] | arrayGetsSets.kt:39:3:39:13 | ...[...] | float | arrayGetsSets.kt:39:12:39:13 | 1.0 | float |
+| arrayGetsSets.kt:40:3:40:14 | ...*=... | *= | double[] | arrayGetsSets.kt:40:3:40:14 | ...[...] | double | arrayGetsSets.kt:40:12:40:14 | 1.0 | double |
From 3d1f9a79fb6d0859b519b58dde7ca9914409abf0 Mon Sep 17 00:00:00 2001
From: Ian Lynagh
Date: Wed, 7 Feb 2024 15:17:40 +0000
Subject: [PATCH 047/113] Kotlin 2: Accept location changes in
test-kotlin2/library-tests/data-classes
---
.../library-tests/data-classes/PrintAst.expected | 10 +++++-----
.../library-tests/data-classes/callees.expected | 2 +-
2 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/java/ql/test-kotlin2/library-tests/data-classes/PrintAst.expected b/java/ql/test-kotlin2/library-tests/data-classes/PrintAst.expected
index f884671c094..e601e1378a6 100644
--- a/java/ql/test-kotlin2/library-tests/data-classes/PrintAst.expected
+++ b/java/ql/test-kotlin2/library-tests/data-classes/PrintAst.expected
@@ -17,11 +17,11 @@ dc.kt:
# 0| 3: [Method] copy
# 0| 3: [TypeAccess] ProtoMapValue
#-----| 4: (Parameters)
-# 1| 0: [Parameter] bytes
-# 1| 0: [TypeAccess] byte[]
-# 1| 1: [Parameter] strs
-# 1| 0: [TypeAccess] String[]
-# 1| 0: [TypeAccess] String
+# 0| 0: [Parameter] bytes
+# 0| 0: [TypeAccess] byte[]
+# 0| 1: [Parameter] strs
+# 0| 0: [TypeAccess] String[]
+# 0| 0: [TypeAccess] String
# 0| 5: [BlockStmt] { ... }
# 0| 0: [ReturnStmt] return ...
# 0| 0: [ClassInstanceExpr] new ProtoMapValue(...)
diff --git a/java/ql/test-kotlin2/library-tests/data-classes/callees.expected b/java/ql/test-kotlin2/library-tests/data-classes/callees.expected
index f16c4ffb435..a0352c3ac72 100644
--- a/java/ql/test-kotlin2/library-tests/data-classes/callees.expected
+++ b/java/ql/test-kotlin2/library-tests/data-classes/callees.expected
@@ -4,4 +4,4 @@
| dc.kt:0:0:0:0 | new ProtoMapValue(...) | ProtoMapValue.ProtoMapValue |
| dc.kt:0:0:0:0 | toString(...) | java.util.Arrays.toString |
| dc.kt:0:0:0:0 | toString(...) | java.util.Arrays.toString |
-| dc.kt:1:1:1:71 | super(...) | java.lang.Object.Object |
+| dc.kt:1:25:1:71 | super(...) | java.lang.Object.Object |
From c731251e61a607024f580519612841ff7fb5f797 Mon Sep 17 00:00:00 2001
From: Ian Lynagh
Date: Wed, 7 Feb 2024 15:32:04 +0000
Subject: [PATCH 048/113] Kotlin 2: Remove an unused diagnostic matcher in
library-tests/dataflow/func
---
.../library-tests/dataflow/func/kotlinx_coroutines_stubs.kt | 2 --
1 file changed, 2 deletions(-)
diff --git a/java/ql/test-kotlin2/library-tests/dataflow/func/kotlinx_coroutines_stubs.kt b/java/ql/test-kotlin2/library-tests/dataflow/func/kotlinx_coroutines_stubs.kt
index 3ef2c70d363..8cb4c31fb25 100644
--- a/java/ql/test-kotlin2/library-tests/dataflow/func/kotlinx_coroutines_stubs.kt
+++ b/java/ql/test-kotlin2/library-tests/dataflow/func/kotlinx_coroutines_stubs.kt
@@ -31,5 +31,3 @@ public fun CoroutineScope.async(
): Deferred {
return null!!
}
-
-// Diagnostic Matches: % Couldn't get owner of KDoc. The comment is extracted without an owner. ...while extracting a file (kotlinx_coroutines_stubs.kt) at %kotlinx_coroutines_stubs.kt:1:1:36:0%
From c314cc8b68a2438701a60593fc8030d487791bab Mon Sep 17 00:00:00 2001
From: Ian Lynagh
Date: Wed, 7 Feb 2024 15:56:10 +0000
Subject: [PATCH 049/113] Kotlin 2: Accept some location changes in
library-tests/exprs/binop.expected
---
java/ql/test-kotlin2/library-tests/exprs/binop.expected | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/java/ql/test-kotlin2/library-tests/exprs/binop.expected b/java/ql/test-kotlin2/library-tests/exprs/binop.expected
index f69701028d5..83dad7f94b5 100644
--- a/java/ql/test-kotlin2/library-tests/exprs/binop.expected
+++ b/java/ql/test-kotlin2/library-tests/exprs/binop.expected
@@ -96,8 +96,8 @@
| exprs.kt:141:12:141:20 | ... + ... | exprs.kt:141:12:141:14 | 123 | exprs.kt:141:18:141:20 | 456 |
| exprs.kt:167:8:167:16 | ... (value not-equals) ... | exprs.kt:167:8:167:8 | r | exprs.kt:167:13:167:16 | null |
| exprs.kt:196:31:196:37 | ... + ... | exprs.kt:196:31:196:32 | getA1(...) | exprs.kt:196:36:196:37 | a2 |
-| exprs.kt:211:20:211:29 | ... + ... | exprs.kt:211:20:211:21 | ...!! | exprs.kt:211:28:211:28 | 5 |
-| exprs.kt:212:19:212:25 | ... + ... | exprs.kt:212:20:212:21 | ...!! | exprs.kt:212:25:212:25 | 5 |
+| exprs.kt:211:19:211:29 | ... + ... | exprs.kt:211:19:211:21 | ...!! | exprs.kt:211:28:211:28 | 5 |
+| exprs.kt:212:19:212:25 | ... + ... | exprs.kt:212:19:212:21 | ...!! | exprs.kt:212:25:212:25 | 5 |
| exprs.kt:230:12:230:47 | ... (value equals) ... | exprs.kt:230:12:230:27 | notNullPrimitive | exprs.kt:230:32:230:47 | notNullPrimitive |
| exprs.kt:231:12:231:48 | ... (value equals) ... | exprs.kt:231:12:231:27 | notNullPrimitive | exprs.kt:231:32:231:48 | nullablePrimitive |
| exprs.kt:232:12:232:49 | ... (value equals) ... | exprs.kt:232:12:232:28 | nullablePrimitive | exprs.kt:232:33:232:49 | nullablePrimitive |
From 8a93133b81dfb5bc2d9ea583573376aa3de84606 Mon Sep 17 00:00:00 2001
From: Ian Lynagh
Date: Wed, 7 Feb 2024 16:21:49 +0000
Subject: [PATCH 050/113] Kotlin 2: Accept loc changes in
library-tests/exprs/unaryOp.expected
---
java/ql/test-kotlin2/library-tests/exprs/unaryOp.expected | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/java/ql/test-kotlin2/library-tests/exprs/unaryOp.expected b/java/ql/test-kotlin2/library-tests/exprs/unaryOp.expected
index 03b5d64a7f4..487226320cc 100644
--- a/java/ql/test-kotlin2/library-tests/exprs/unaryOp.expected
+++ b/java/ql/test-kotlin2/library-tests/exprs/unaryOp.expected
@@ -2,9 +2,9 @@
| exprs.kt:32:15:32:26 | !... | exprs.kt:32:15:32:26 | contains(...) |
| exprs.kt:79:15:79:22 | ~... | exprs.kt:79:15:79:16 | lx |
| exprs.kt:121:14:121:16 | !... | exprs.kt:121:15:121:16 | b1 |
-| exprs.kt:202:19:202:20 | ...!! | exprs.kt:202:18:202:18 | x |
-| exprs.kt:211:20:211:21 | ...!! | exprs.kt:211:19:211:19 | s |
-| exprs.kt:212:20:212:21 | ...!! | exprs.kt:212:19:212:19 | s |
+| exprs.kt:202:18:202:20 | ...!! | exprs.kt:202:18:202:18 | x |
+| exprs.kt:211:19:211:21 | ...!! | exprs.kt:211:19:211:19 | s |
+| exprs.kt:212:19:212:21 | ...!! | exprs.kt:212:19:212:19 | s |
| exprs.kt:286:5:286:6 | -... | exprs.kt:286:6:286:6 | i |
| exprs.kt:287:5:287:6 | +... | exprs.kt:287:6:287:6 | i |
| exprs.kt:288:5:288:6 | -... | exprs.kt:288:6:288:6 | d |
From ef8e6c8805d0fbf3f52e4b24ae1f9c052724840a Mon Sep 17 00:00:00 2001
From: Ian Lynagh
Date: Wed, 7 Feb 2024 16:40:40 +0000
Subject: [PATCH 051/113] Kotlin 2: Accept loc changes in
library-tests/exprs/funcExprs.expected
---
.../library-tests/exprs/funcExprs.expected | 160 +++++++++---------
1 file changed, 80 insertions(+), 80 deletions(-)
diff --git a/java/ql/test-kotlin2/library-tests/exprs/funcExprs.expected b/java/ql/test-kotlin2/library-tests/exprs/funcExprs.expected
index b79725a80e3..1328047196c 100644
--- a/java/ql/test-kotlin2/library-tests/exprs/funcExprs.expected
+++ b/java/ql/test-kotlin2/library-tests/exprs/funcExprs.expected
@@ -75,118 +75,118 @@ lambda_modifiers
| samConversion.kt:46:32:46:44 | ...->... | samConversion.kt:46:32:46:44 | invoke | final, override, public |
| samConversion.kt:58:30:58:45 | ...->... | samConversion.kt:58:30:58:45 | invoke | final, override, public, suspend |
anon_class_member_modifiers
-| delegatedProperties.kt:6:24:9:9 | new KProperty0(...) { ... } | delegatedProperties.kt:6:24:9:9 | get | override, public |
-| delegatedProperties.kt:6:24:9:9 | new KProperty0(...) { ... } | delegatedProperties.kt:6:24:9:9 | invoke | override, public |
+| delegatedProperties.kt:6:27:9:9 | new KProperty0(...) { ... } | delegatedProperties.kt:6:27:9:9 | get | override, public |
+| delegatedProperties.kt:6:27:9:9 | new KProperty0(...) { ... } | delegatedProperties.kt:6:27:9:9 | invoke | override, public |
| delegatedProperties.kt:6:32:9:9 | new Function0(...) { ... } | delegatedProperties.kt:6:32:9:9 | invoke | final, override, public |
-| delegatedProperties.kt:19:31:19:51 | new KMutableProperty0(...) { ... } | delegatedProperties.kt:19:31:19:51 | get | override, public |
-| delegatedProperties.kt:19:31:19:51 | new KMutableProperty0(...) { ... } | delegatedProperties.kt:19:31:19:51 | get | override, public |
-| delegatedProperties.kt:19:31:19:51 | new KMutableProperty0(...) { ... } | delegatedProperties.kt:19:31:19:51 | invoke | override, public |
-| delegatedProperties.kt:19:31:19:51 | new KMutableProperty0(...) { ... } | delegatedProperties.kt:19:31:19:51 | invoke | override, public |
-| delegatedProperties.kt:19:31:19:51 | new KMutableProperty0(...) { ... } | delegatedProperties.kt:19:31:19:51 | set | override, public |
-| delegatedProperties.kt:19:31:19:51 | new KMutableProperty0(...) { ... } | delegatedProperties.kt:19:31:19:51 | set | override, public |
-| delegatedProperties.kt:23:26:23:31 | new KProperty0(...) { ... } | delegatedProperties.kt:23:26:23:31 | get | override, public |
-| delegatedProperties.kt:23:26:23:31 | new KProperty0(...) { ... } | delegatedProperties.kt:23:26:23:31 | invoke | override, public |
+| delegatedProperties.kt:19:34:19:51 | new KMutableProperty0(...) { ... } | delegatedProperties.kt:19:34:19:51 | get | override, public |
+| delegatedProperties.kt:19:34:19:51 | new KMutableProperty0(...) { ... } | delegatedProperties.kt:19:34:19:51 | get | override, public |
+| delegatedProperties.kt:19:34:19:51 | new KMutableProperty0(...) { ... } | delegatedProperties.kt:19:34:19:51 | invoke | override, public |
+| delegatedProperties.kt:19:34:19:51 | new KMutableProperty0(...) { ... } | delegatedProperties.kt:19:34:19:51 | invoke | override, public |
+| delegatedProperties.kt:19:34:19:51 | new KMutableProperty0(...) { ... } | delegatedProperties.kt:19:34:19:51 | set | override, public |
+| delegatedProperties.kt:19:34:19:51 | new KMutableProperty0(...) { ... } | delegatedProperties.kt:19:34:19:51 | set | override, public |
+| delegatedProperties.kt:23:29:23:31 | new KProperty0(...) { ... } | delegatedProperties.kt:23:29:23:31 | get | override, public |
+| delegatedProperties.kt:23:29:23:31 | new KProperty0(...) { ... } | delegatedProperties.kt:23:29:23:31 | invoke | override, public |
| delegatedProperties.kt:25:64:31:9 | new ReadWriteProperty