From 8367fdbec479a59434676d30c2355418ee15307f Mon Sep 17 00:00:00 2001 From: Dave Bartolomeo Date: Mon, 29 Nov 2021 16:47:56 -0500 Subject: [PATCH] Change notes --- .../2021-11-02-incorrect-integer-conversion-updated.md | 7 +++++++ ql/src/change-notes/2021-11-19-log-injection-query.md | 5 +++++ 2 files changed, 12 insertions(+) create mode 100644 ql/src/change-notes/2021-11-02-incorrect-integer-conversion-updated.md create mode 100644 ql/src/change-notes/2021-11-19-log-injection-query.md diff --git a/ql/src/change-notes/2021-11-02-incorrect-integer-conversion-updated.md b/ql/src/change-notes/2021-11-02-incorrect-integer-conversion-updated.md new file mode 100644 index 00000000000..6c8a94ba8c2 --- /dev/null +++ b/ql/src/change-notes/2021-11-02-incorrect-integer-conversion-updated.md @@ -0,0 +1,7 @@ +--- +category: majorAnalysis +tags: [lgtm,codescanning] +--- +* The query "Incorrect conversion between integer types" has been improved to + treat `math.MaxUint` and `math.MaxInt` as the values they would be on a + 32-bit architecture. This should lead to fewer false positive results. diff --git a/ql/src/change-notes/2021-11-19-log-injection-query.md b/ql/src/change-notes/2021-11-19-log-injection-query.md new file mode 100644 index 00000000000..d47dec057cb --- /dev/null +++ b/ql/src/change-notes/2021-11-19-log-injection-query.md @@ -0,0 +1,5 @@ +--- +category: newQuery +tags: [lgtm,codescanning] +--- +* A new query "Log entries created from user input" (`go/log-injection`) has been added. The query reports user-provided data reaching calls to logging methods.