Merge branch 'rc/1.24' into merge-124-master

Conflicts:
	change-notes/1.24/analysis-javascript.md
    Resolved in favor of the rc/1.24 branch

change-notes/1.24/analysis-cpp.md

@@ -4,6 +4,8 @@ The following changes in version 1.24 affect C/C++ analysis in all applications.
 
 ## General improvements
 
+You can now suppress alerts using either single-line block comments (`/* ... */`) or line comments (`// ...`).
+
 ## New queries
 
 | **Query**                   | **Tags**  | **Purpose**                                                        |
@@ -12,47 +14,71 @@ The following changes in version 1.24 affect C/C++ analysis in all applications.
 
 ## Changes to existing queries
 
+A new taint-tracking library is used by all the security queries that track tainted values
+(`cpp/path-injection`, `cpp/cgi-xss`, `cpp/sql-injection`, `cpp/uncontrolled-process-operation`,
+`cpp/unbounded-write`, `cpp/tainted-format-string`, `cpp/tainted-format-string-through-global`,
+`cpp/uncontrolled-arithmetic`, `cpp/uncontrolled-allocation-size`, `cpp/user-controlled-bypass`,
+`cpp/cleartext-storage-buffer`, `cpp/tainted-permissions-check`).
+These queries now have more precise results and also offer _path explanations_ so you can explore the results easily.
+There is a performance cost to this, and the LGTM query suite will overall run slower than before.
+
 | **Query**                  | **Expected impact**    | **Change**                                                       |
 |----------------------------|------------------------|------------------------------------------------------------------|
+| Boost\_asio TLS Settings Misconfiguration (`cpp/boost/tls-settings-misconfiguration`) | Query id change | The identifier was updated to use dashes in place of underscores (previous identifier `cpp/boost/tls_settings_misconfiguration`). |
 | Buffer not sufficient for string (`cpp/overflow-calculated`) | More true positive results | This query now identifies a wider variety of buffer allocations using the `semmle.code.cpp.models.interfaces.Allocation` library. |
-| No space for zero terminator (`cpp/no-space-for-terminator`) | More true positive results | This query now identifies a wider variety of buffer allocations using the `semmle.code.cpp.models.interfaces.Allocation` library. |
+| Hard-coded Japanese era start date (`cpp/japanese-era/exact-era-date`) |  | This query is no longer run on LGTM. |
 | Memory is never freed (`cpp/memory-never-freed`) | More true positive results | This query now identifies a wider variety of buffer allocations using the `semmle.code.cpp.models.interfaces.Allocation` library. |
 | Memory may not be freed (`cpp/memory-may-not-be-freed`) | More true positive results | This query now identifies a wider variety of buffer allocations using the `semmle.code.cpp.models.interfaces.Allocation` library. |
-| Mismatching new/free or malloc/delete (`cpp/new-free-mismatch`) | Fewer false positive results | Fixed false positive results in template code. |
+| Mismatching new/free or malloc/delete (`cpp/new-free-mismatch`) | Fewer false positive results | Improved handling of template code gives greater precision. |
-| Missing return statement (`cpp/missing-return`) | Fewer false positive results | Functions containing `asm` statements are no longer highlighted by this query. |
+| Missing return statement (`cpp/missing-return`) | Fewer false positive results and more accurate locations | Functions containing `asm` statements are no longer highlighted by this query. The locations reported by this query are now more accurate in some cases. |
-| Missing return statement (`cpp/missing-return`) | More accurate locations | Locations reported by this query are now more accurate in some cases. |
+| No space for zero terminator (`cpp/no-space-for-terminator`) | More results with greater precision | The query gives more precise results for a wider variety of buffer allocations. String arguments to formatting functions are now (usually) expected to be null terminated strings. Use of the `semmle.code.cpp.models.interfaces.Allocation` library identifies problems with a wider variety of buffer allocations. This query is also more conservative when identifying which pointers point to null-terminated strings. |
-| No space for zero terminator (`cpp/no-space-for-terminator`) | More correct results | String arguments to formatting functions are now (usually) expected to be null terminated strings. |
+| Overflow in uncontrolled allocation size (`cpp/uncontrolled-allocation-size`) | Fewer false positive results | The query now produces fewer, more accurate results. Cases where the tainted allocation size is range checked are more reliably excluded. |
-| Hard-coded Japanese era start date (`cpp/japanese-era/exact-era-date`) |  | This query is no longer run on LGTM. |
-| No space for zero terminator (`cpp/no-space-for-terminator`) | Fewer false positive results | This query has been modified to be more conservative when identifying which pointers point to null-terminated strings.  This approach produces fewer, more accurate results. |
-| Overflow in uncontrolled allocation size (`cpp/uncontrolled-allocation-size`) | Fewer false positive results | Cases where the tainted allocation size is range checked are now more reliably excluded. |
-| Overflow in uncontrolled allocation size (`cpp/uncontrolled-allocation-size`) | Fewer false positive results | The query now produces fewer, more accurate results. |
 | Overloaded assignment does not return 'this' (`cpp/assignment-does-not-return-this`) | Fewer false positive results | This query no longer reports incorrect results in template classes. |
+| Pointer overflow check (`cpp/pointer-overflow-check`),<br> Possibly wrong buffer size in string copy (`cpp/bad-strncpy-size`),<br> Signed overflow check (`cpp/signed-overflow-check`) | More correct results | A new library is used for determining which expressions have identical value, giving more precise results. There is a performance cost to this, and the LGTM suite will overall run slower than before. |
 | Unsafe array for days of the year (`cpp/leap-year/unsafe-array-for-days-of-the-year`) |  | This query is no longer run on LGTM. |
 | Unsigned comparison to zero (`cpp/unsigned-comparison-zero`) | More correct results | This query now also looks for comparisons of the form `0 <= x`. |
 
 ## Changes to libraries
 
-* The data-flow library has been improved, which affects and improves some security queries. The improvements are:
+* The built-in C++20 "spaceship operator" (`<=>`) is now supported via the QL
-  - Track flow through functions that combine taint tracking with flow through fields.
+  class `SpaceshipExpr`. Overloaded forms are modeled as calls to functions
-  - Track flow through clone-like functions, that is, functions that read contents of a field from a
+  named `operator<=>`.
-    parameter and stores the value in the field of a returned object.
+* The data-flow library (`semmle.code.cpp.dataflow.DataFlow` and
-* Created the `semmle.code.cpp.models.interfaces.Allocation` library to model allocation such as `new` expressions and calls to `malloc`. This in intended to replace the functionality in `semmle.code.cpp.commons.Alloc` with a more consistent and useful interface.
+  `semmle.code.cpp.dataflow.TaintTracking`) has been improved, which affects
-* Created the `semmle.code.cpp.models.interfaces.Deallocation` library to model deallocation such as `delete` expressions and calls to `free`. This in intended to replace the functionality in `semmle.code.cpp.commons.Alloc` with a more consistent and useful interface.
+  and improves some security queries. The improvements are:
+    - Track flow through functions that combine taint tracking with flow through fields.
+    - Track flow through clone-like functions, that is, functions that read contents of a field from a
+      parameter and stores the value in the field of a returned object.
+* The security pack taint tracking library
+  (`semmle.code.cpp.security.TaintTracking`) uses a new intermediate
+  representation. This provides a more precise analysis of flow through
+  parameters and pointers. For new queries, however, we continue to recommend
+  using `semmle.code.cpp.dataflow.TaintTracking`.
+* The global value numbering library
+  (`semmle.code.cpp.valuenumbering.GlobalValueNumbering`) uses a new
+  intermediate representation to provide a more precise analysis of
+  heap-allocated memory and pointers to stack variables.
+* New libraries have been created to provide a more consistent and useful interface
+  for modeling allocation and deallocation. These replace the old
+  `semmle.code.cpp.commons.Alloc` library.
+    * The new `semmle.code.cpp.models.interfaces.Allocation` library models
+      allocations, such as `new` expressions and calls to `malloc`.
+    * The new `semmle.code.cpp.models.interfaces.Deallocation` library
+      models deallocations, such as `delete` expressions and calls to `free`.
+    * The predicate `freeCall` in `semmle.code.cpp.commons.Alloc` has been
+      deprecated. The `Allocation` and `Deallocation` models in
+      `semmle.code.cpp.models.interfaces` should be used instead.
 * The new class `StackVariable` should be used in place of `LocalScopeVariable`
   in most cases. The difference is that `StackVariable` does not include
   variables declared with `static` or `thread_local`.
-  * As a rule of thumb, custom queries about the _values_ of variables should
+    * As a rule of thumb, custom queries about the _values_ of variables should
-    be changed from `LocalScopeVariable` to `StackVariable`, while queries
+      be changed from `LocalScopeVariable` to `StackVariable`, while queries
-    about the _name or scope_ of variables should remain unchanged.
+      about the _name or scope_ of variables should remain unchanged.
-  * The `LocalScopeVariableReachability` library is deprecated in favor of
+    * The `LocalScopeVariableReachability` library is deprecated in favor of
-    `StackVariableReachability`. The functionality is the same.
+      `StackVariableReachability`. The functionality is the same.
-* The models library models `strlen` in more detail, and includes common variations such as `wcslen`.
+* Taint tracking and data flow now features better modeling of commonly-used
-* The models library models `gets` and similar functions.
+  library functions:
-* The models library now partially models `std::string`.
+    * `gets` and similar functions,
-* The taint tracking library (`semmle.code.cpp.dataflow.TaintTracking`) has had
+    * the most common operations on `std::string`,
-  the following improvements:
+    * `strdup` and similar functions, and
-  * The library now models data flow through `strdup` and similar functions.
+    * formatting functions such as `sprintf`.
-  * The library now models data flow through formatting functions such as `sprintf`.
-* The security pack taint tracking library (`semmle.code.cpp.security.TaintTracking`) uses a new intermediate representation. This provides a more precise analysis of pointers to stack variables and flow through parameters, improving the results of many security queries.
-* The global value numbering library (`semmle.code.cpp.valuenumbering.GlobalValueNumbering`) uses a new intermediate representation to provide a more precise analysis of heap allocated memory and pointers to stack variables.
-* `freeCall` in `semmle.code.cpp.commons.Alloc` has been deprecated. The`Allocation` and `Deallocation` models in `semmle.code.cpp.models.interfaces` should be used instead.

change-notes/1.24/analysis-csharp.md

@@ -2,30 +2,31 @@
 
 The following changes in version 1.24 affect C# analysis in all applications.
 
+## General improvements
+
+You can now suppress alerts using either single-line block comments (`/* ... */`) or line comments (`// ...`).
+
 ## New queries
 
 | **Query**                   | **Tags**  | **Purpose**                                                        |
 |-----------------------------|-----------|--------------------------------------------------------------------|
-| Assembly path injection (`cs/assembly-path-injection`) | security, external/cwe/cwe-114 | Finds user-controlled data used to load an assembly. |
+| Assembly path injection (`cs/assembly-path-injection`) | security, external/cwe/cwe-114 | Finds user-controlled data used to load an assembly. Results are shown on LGTM by default. |
-| Insecure configuration for ASP.NET requestValidationMode (`cs/insecure-request-validation-mode`) | security, external/cwe/cwe-016 | Finds where this attribute has been set to a value less than 4.5, which turns off some validation features and makes the application less secure. |
+| Insecure configuration for ASP.NET requestValidationMode (`cs/insecure-request-validation-mode`) | security, external/cwe/cwe-016 | Finds where this attribute has been set to a value less than 4.5, which turns off some validation features and makes the application less secure. By default, the query is not run on LGTM. |
-| Insecure SQL connection (`cs/insecure-sql-connection`) | security, external/cwe/cwe-327 | Finds unencrypted SQL connection strings. |
+| Insecure SQL connection (`cs/insecure-sql-connection`) | security, external/cwe/cwe-327 | Finds unencrypted SQL connection strings. Results are not shown on LGTM by default. |
-| Page request validation is disabled (`cs/web/request-validation-disabled`) | security, frameworks/asp.net, external/cwe/cwe-016 | Finds where ASP.NET page request validation has been disabled, which could make the application less secure. |
+| Page request validation is disabled (`cs/web/request-validation-disabled`) | security, frameworks/asp.net, external/cwe/cwe-016 | Finds where ASP.NET page request validation has been disabled, which could make the application less secure. By default, the query is not run on LGTM. |
-| Serialization check bypass (`cs/serialization-check-bypass`) | security, external/cwe/cwe-20 | Finds where data is not validated in a deserialization method. |
+| Serialization check bypass (`cs/serialization-check-bypass`) | security, external/cwe/cwe-20 | Finds where data is not validated in a deserialization method. Results are not shown on LGTM by default. |
-| XML injection (`cs/xml-injection`) | security, external/cwe/cwe-091 | Finds user-controlled data that is used to write directly to an XML document. |
+| XML injection (`cs/xml-injection`) | security, external/cwe/cwe-091 | Finds user-controlled data that is used to write directly to an XML document. Results are shown on LGTM by default. |
 
 ## Changes to existing queries
 
 | **Query**                    | **Expected impact**    | **Change**                        |
 |------------------------------|------------------------|-----------------------------------|
-| Useless assignment to local variable (`cs/useless-assignment-to-local`) | Fewer false positive results | Results have been removed when the variable is named `_` in a `foreach` statement. | 
-| Potentially dangerous use of non-short-circuit logic (`cs/non-short-circuit`) | Fewer false positive results | Results have been removed when the expression contains an `out` parameter. |
 | Dereferenced variable may be null (`cs/dereferenced-value-may-be-null`) | More results | Results are reported from parameters with a default value of `null`. |
-| Useless assignment to local variable (`cs/useless-assignment-to-local`) | Fewer false positive results | Results have been removed when the value assigned is an (implicitly or explicitly) cast default-like value. For example, `var s = (string)null` and `string s = default`. |
-| XPath injection (`cs/xml/xpath-injection`) | More results | The query now recognizes calls to methods on `System.Xml.XPath.XPathNavigator` objects. |
-| Information exposure through transmitted data (`cs/sensitive-data-transmission`) | More results | The query now recognizes writes to cookies and writes to ASP.NET (`Inner`)`Text` properties as additional sinks. |
 | Information exposure through an exception (`cs/information-exposure-through-exception`) | More results | The query now recognizes writes to cookies, writes to ASP.NET (`Inner`)`Text` properties, and email contents as additional sinks. |
-
+| Information exposure through transmitted data (`cs/sensitive-data-transmission`) | More results | The query now recognizes writes to cookies and writes to ASP.NET (`Inner`)`Text` properties as additional sinks. |
-## Removal of old queries
+| Potentially dangerous use of non-short-circuit logic (`cs/non-short-circuit`) | Fewer false positive results | Results have been removed when the expression contains an `out` parameter. |
+| Useless assignment to local variable (`cs/useless-assignment-to-local`) | Fewer false positive results | Results have been removed when the value assigned is an (implicitly or explicitly) cast default-like value. For example, `var s = (string)null` and `string s = default`. Results have also been removed when the variable is named `_` in a `foreach` statement. | 
+| XPath injection (`cs/xml/xpath-injection`) | More results | The query now recognizes calls to methods on `System.Xml.XPath.XPathNavigator` objects. |
 
 ## Changes to code extraction
 
@@ -37,13 +38,11 @@ The following changes in version 1.24 affect C# analysis in all applications.
 ## Changes to libraries
 
 * The data-flow library has been improved, which affects and improves most security queries. The improvements are:
-  - Track flow through methods that combine taint tracking with flow through fields.
+    - Track flow through methods that combine taint tracking with flow through fields.
-  - Track flow through clone-like methods, that is, methods that read contents of a field from a
+    - Track flow through clone-like methods, that is, methods that read the contents of a field from a
-    parameter and stores the value in the field of a returned object.
+      parameter and store the value in the field of a returned object.
 * The taint tracking library now tracks flow through (implicit or explicit) conversion operator calls.
 * [Code contracts](https://docs.microsoft.com/en-us/dotnet/framework/debug-trace-profile/code-contracts) are now recognized, and are treated like any other assertion methods.
 * Expression nullability flow state is given by the predicates `Expr.hasNotNullFlowState()` and `Expr.hasMaybeNullFlowState()`.
 * `stackalloc` array creations are now represented by the QL class `Stackalloc`. Previously they were represented by the class `ArrayCreation`.
-* A new class `RemoteFlowSink` has been added to model sinks where data might be exposed to external users. Examples include web page output, e-mails, and cookies.
+* A new class `RemoteFlowSink` has been added to model sinks where data might be exposed to external users. Examples include web page output, emails, and cookies.
-
-## Changes to autobuilder

change-notes/1.24/analysis-java.md

@@ -4,7 +4,7 @@ The following changes in version 1.24 affect Java analysis in all applications.
 
 ## General improvements
 
-* Alert suppression can now be done with single-line block comments (`/* ... */`) as well as line comments (`// ...`).
+* You can now suppress alerts using either single-line block comments (`/* ... */`) or line comments (`// ...`).
 * A `Customizations.qll` file has been added to allow customizations of the standard library that apply to all queries.
 
 ## New queries
@@ -21,16 +21,16 @@ The following changes in version 1.24 affect Java analysis in all applications.
 
 | **Query**                    | **Expected impact**    | **Change**                        |
 |------------------------------|------------------------|-----------------------------------|
-| Dereferenced variable may be null (`java/dereferenced-value-may-be-null`) | Fewer false positives | Final fields with a non-null initializer are no longer reported. |
+| Dereferenced variable may be null (`java/dereferenced-value-may-be-null`) | Fewer false positive results | Final fields with a non-null initializer are no longer reported. |
-| Expression always evaluates to the same value (`java/evaluation-to-constant`) | Fewer false positives | Expressions of the form `0 * x` are usually intended and no longer reported. Also left shift of ints by 32 bits and longs by 64 bits are no longer reported as they are not constant, these results are instead reported by the new query `java/lshift-larger-than-type-width`. |
+| Expression always evaluates to the same value (`java/evaluation-to-constant`) | Fewer false positive results | Expressions of the form `0 * x` are usually intended and no longer reported. Also left shift of ints by 32 bits and longs by 64 bits are no longer reported as they are not constant, these results are instead reported by the new query `java/lshift-larger-than-type-width`. |
-| Useless null check (`java/useless-null-check`) | More true positives | Useless checks on final fields with a non-null initializer are now reported. |
+| Useless null check (`java/useless-null-check`) | More true positive results | Useless checks on final fields with a non-null initializer are now reported. |
 
 ## Changes to libraries
 
 * The data-flow library has been improved, which affects and improves most security queries. The improvements are:
-  - Track flow through methods that combine taint tracking with flow through fields.
+    - Track flow through methods that combine taint tracking with flow through fields.
-  - Track flow through clone-like methods, that is, methods that read contents of a field from a
+    - Track flow through clone-like methods, that is, methods that read contents of a field from a
-    parameter and stores the value in the field of a returned object.
+      parameter and stores the value in the field of a returned object.
 * Identification of test classes has been improved. Previously, one of the
   match conditions would classify any class with a name containing the string
   "Test" as a test class, but now this matching has been replaced with one that
@@ -38,6 +38,6 @@ The following changes in version 1.24 affect Java analysis in all applications.
   general file classification mechanism and thus suppression of alerts, and
   also any security queries using taint tracking, as test classes act as
   default barriers stopping taint flow.
-* Parentheses are now no longer modelled directly in the AST, that is, the
+* Parentheses are now no longer modeled directly in the AST, that is, the
   `ParExpr` class is empty. Instead, a parenthesized expression can be
   identified with the `Expr.isParenthesized()` member predicate.

change-notes/1.24/analysis-javascript.md

@@ -4,67 +4,68 @@
 
 * TypeScript 3.8 is now supported.
 
-* Alert suppression can now be done with single-line block comments (`/* ... */`) as well as line comments (`// ...`).
+* You can now suppress alerts using either single-line block comments (`/* ... */`) or line comments (`// ...`).
 
 * Resolution of imports has improved, leading to more results from the security queries:
-  - Imports with the `.js` extension can now be resolved to a TypeScript file,
+    - Imports with the `.js` extension can now be resolved to a TypeScript file,
-  when the import refers to a file generated by TypeScript.
+      when the import refers to a file generated by TypeScript.
-  - Imports that rely on path-mappings from a `tsconfig.json` file can now be resolved.
+    - Imports that rely on path-mappings from a `tsconfig.json` file can now be resolved.
-  - Export declarations of the form `export * as ns from "x"` are now analyzed more precisely.
+    - Export declarations of the form `export * as ns from "x"` are now analyzed more precisely.
 
 * The analysis of sanitizers has improved, leading to more accurate results from the security queries.
   In particular:
-  - Sanitizer guards now act across function boundaries in more cases.
+    - Sanitizer guards now act across function boundaries in more cases.
-  - Sanitizers can now better distinguish between a tainted value and an object _containing_ a tainted value.
+    - Sanitizers can now better distinguish between a tainted value and an object _containing_ a tainted value.
 
 * Call graph construction has been improved, leading to more results from the security queries:
-  - Calls can now be resolved to indirectly-defined class members in more cases.
+    - Calls can now be resolved to indirectly-defined class members in more cases.
-  - Calls through partial invocations such as `.bind` can now be resolved in more cases.
+    - Calls through partial invocations such as `.bind` can now be resolved in more cases.
 
 * Support for flow summaries has been more clearly marked as being experimental and moved to the new `experimental` folder.
 
 * Support for the following frameworks and libraries has been improved:
-  - [Electron](https://electronjs.org/)
+    - [chrome-remote-interface](https://www.npmjs.com/package/chrome-remote-interface)
-  - [fstream](https://www.npmjs.com/package/fstream)
+    - [Electron](https://electronjs.org/)
-  - [Handlebars](https://www.npmjs.com/package/handlebars)
+    - [for-in](https://www.npmjs.com/package/for-in)
-  - [jsonfile](https://www.npmjs.com/package/jsonfile)
+    - [for-own](https://www.npmjs.com/package/for-own)
-  - [Koa](https://www.npmjs.com/package/koa)
+    - [fstream](https://www.npmjs.com/package/fstream)
-  - [Node.js](https://nodejs.org/)
+    - [Handlebars](https://www.npmjs.com/package/handlebars)
-  - [Socket.IO](https://socket.io/)
+    - [http2](https://nodejs.org/api/http2.html)
-  - [WebSocket](https://developer.mozilla.org/en-US/docs/Web/API/WebSockets_API)
+    - [jQuery](https://jquery.com/)
-  - [chrome-remote-interface](https://www.npmjs.com/package/chrome-remote-interface)
+    - [jsonfile](https://www.npmjs.com/package/jsonfile)
-  - [for-in](https://www.npmjs.com/package/for-in)
+    - [Koa](https://www.npmjs.com/package/koa)
-  - [for-own](https://www.npmjs.com/package/for-own)
+    - [lazy-cache](https://www.npmjs.com/package/lazy-cache)
-  - [http2](https://nodejs.org/api/http2.html)
+    - [mongodb](https://www.npmjs.com/package/mongodb)
-  - [jQuery](https://jquery.com/)
+    - [ncp](https://www.npmjs.com/package/ncp)
-  - [lazy-cache](https://www.npmjs.com/package/lazy-cache)
+    - [Node.js](https://nodejs.org/)
-  - [mongodb](https://www.npmjs.com/package/mongodb)
+    - [node-dir](https://www.npmjs.com/package/node-dir)
-  - [ncp](https://www.npmjs.com/package/ncp)
+    - [path-exists](https://www.npmjs.com/package/path-exists)
-  - [node-dir](https://www.npmjs.com/package/node-dir)
+    - [pg](https://www.npmjs.com/package/pg)
-  - [path-exists](https://www.npmjs.com/package/path-exists)
+    - [react](https://www.npmjs.com/package/react)
-  - [pg](https://www.npmjs.com/package/pg)
+    - [recursive-readdir](https://www.npmjs.com/package/recursive-readdir)
-  - [react](https://www.npmjs.com/package/react)
+    - [request](https://www.npmjs.com/package/request)
-  - [recursive-readdir](https://www.npmjs.com/package/recursive-readdir)
+    - [rimraf](https://www.npmjs.com/package/rimraf)
-  - [request](https://www.npmjs.com/package/request)
+    - [send](https://www.npmjs.com/package/send)
-  - [rimraf](https://www.npmjs.com/package/rimraf)
+    - [Socket.IO](https://socket.io/)
-  - [send](https://www.npmjs.com/package/send)
+    - [SockJS](https://www.npmjs.com/package/sockjs)
-  - [SockJS](https://www.npmjs.com/package/sockjs)
+    - [SockJS-client](https://www.npmjs.com/package/sockjs-client)
-  - [SockJS-client](https://www.npmjs.com/package/sockjs-client)
+    - [typeahead.js](https://www.npmjs.com/package/typeahead.js)
-  - [typeahead.js](https://www.npmjs.com/package/typeahead.js)
+    - [vinyl-fs](https://www.npmjs.com/package/vinyl-fs)
-  - [vinyl-fs](https://www.npmjs.com/package/vinyl-fs)
+    - [WebSocket](https://developer.mozilla.org/en-US/docs/Web/API/WebSockets_API)
-  - [write-file-atomic](https://www.npmjs.com/package/write-file-atomic)
+    - [write-file-atomic](https://www.npmjs.com/package/write-file-atomic)
-  - [ws](https://github.com/websockets/ws)
+    - [ws](https://github.com/websockets/ws)
+
 
 ## New queries
 
 | **Query**                                                                       | **Tags**                                                          | **Purpose**                                                                                                                                                                            |
 |---------------------------------------------------------------------------------|-------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | Cross-site scripting through exception (`js/xss-through-exception`) | security, external/cwe/cwe-079, external/cwe/cwe-116              | Highlights potential XSS vulnerabilities where an exception is written to the DOM. Results are not shown on LGTM by default. |
-| Regular expression always matches (`js/regex/always-matches`) | correctness, regular-expressions | Highlights regular expression checks that trivially succeed by matching an empty substring. Results are shown on LGTM by default. |
 | Missing await (`js/missing-await`) | correctness | Highlights expressions that operate directly on a promise object in a nonsensical way, instead of awaiting its result. Results are shown on LGTM by default. |
 | Polynomial regular expression used on uncontrolled data (`js/polynomial-redos`) | security, external/cwe/cwe-730, external/cwe/cwe-400 | Highlights expensive regular expressions that may be used on malicious input. Results are shown on LGTM by default. | 
 | Prototype pollution in utility function (`js/prototype-pollution-utility`) | security, external/cwe/cwe-400, external/cwe/cwe-471 | Highlights recursive assignment operations that are susceptible to prototype pollution. Results are shown on LGTM by default. |
-| Unsafe jQuery plugin (`js/unsafe-jquery-plugin`) | Highlights potential XSS vulnerabilities in unsafely designed jQuery plugins. Results are shown on LGTM by default. |
+| Regular expression always matches (`js/regex/always-matches`) | correctness, regular-expressions | Highlights regular expression checks that trivially succeed by matching an empty substring. Results are shown on LGTM by default. |
+| Unsafe jQuery plugin (`js/unsafe-jquery-plugin`) | | Highlights potential XSS vulnerabilities in unsafely designed jQuery plugins. Results are shown on LGTM by default. |
 | Unnecessary use of `cat` process (`js/unnecessary-use-of-cat`) | correctness, security, maintainability | Highlights command executions of `cat` where the fs API should be used instead. Results are shown on LGTM by default. |
 
 
@@ -73,20 +74,20 @@
 | **Query**                      | **Expected impact**          | **Change**                                                                |
 |--------------------------------|------------------------------|---------------------------------------------------------------------------|
 | Clear-text logging of sensitive information (`js/clear-text-logging`) | More results | More results involving `process.env` and indirect calls to logging methods are recognized. |
-| Duplicate parameter names (`js/duplicate-parameter-name`) | Fewer results | This query now recognizes additional parameters that reasonably can have duplicated names. |
+| Duplicate parameter names (`js/duplicate-parameter-name`) | Fewer results | This query now ignores additional parameters that reasonably can have duplicated names. |
-| Incomplete string escaping or encoding (`js/incomplete-sanitization`) | Fewer false positive results | This query now recognizes additional cases where a single replacement is likely to be intentional. |
-| Unbound event handler receiver (`js/unbound-event-handler-receiver`) | Fewer false positive results | This query now recognizes additional ways event handler receivers can be bound. | 
 | Expression has no effect (`js/useless-expression`) | Fewer false positive results | The query now recognizes block-level flow type annotations and ignores the first statement of a try block. |
-| Use of call stack introspection in strict mode (`js/strict-mode-call-stack-introspection`) | Fewer false positive results | The query no longer flags expression statements. |
+| Identical operands (`js/redundant-operation`) | Fewer results | This query now excludes cases where the operands change a value using ++/-- expressions. |
-| Missing CSRF middleware (`js/missing-token-validation`) | Fewer false positive results | The query reports fewer duplicates and only flags handlers that explicitly access cookie data. |
+| Incomplete string escaping or encoding (`js/incomplete-sanitization`) | Fewer false positive results | This query now recognizes and excludes additional cases where a single replacement is likely to be intentional. |
-| Uncontrolled data used in path expression (`js/path-injection`) | More results | This query now recognizes additional ways dangerous paths can be constructed and used. |
-| Uncontrolled command line (`js/command-line-injection`) | More results | This query now recognizes additional ways of constructing arguments to `cmd.exe` and `/bin/sh`. |
-| Syntax error (`js/syntax-error`) | Lower severity | This results of this query are now displayed with lower severity. |
-| Use of password hash with insufficient computational effort (`js/insufficient-password-hash`) | Fewer false positive results | This query now recognizes additional cases that do not require secure hashing. |
-| Useless regular-expression character escape (`js/useless-regexp-character-escape`) | Fewer false positive results | This query now distinguishes escapes in strings and regular expression literals. |
-| Identical operands (`js/redundant-operation`) | Fewer results | This query now recognizes cases where the operands change a value using ++/-- expressions. |
-| Superfluous trailing arguments (`js/superfluous-trailing-arguments`) | Fewer results | This query now recognizes cases where a function uses the `Function.arguments` value to process a variable number of parameters. |
 | Incomplete URL scheme check (`js/incomplete-url-scheme-check`) | More results | This query now recognizes additional variations of URL scheme checks. |
+| Missing CSRF middleware (`js/missing-token-validation`) | Fewer false positive results | The query reports fewer duplicates and only flags handlers that explicitly access cookie data. |
+| Superfluous trailing arguments (`js/superfluous-trailing-arguments`) | Fewer results | This query now excludes cases where a function uses the `Function.arguments` value to process a variable number of parameters. |
+| Syntax error (`js/syntax-error`) | Lower severity | This results of this query are now displayed with lower severity. |
+| Unbound event handler receiver (`js/unbound-event-handler-receiver`) | Fewer false positive results | This query now recognizes additional ways event handler receivers can be bound. |
+| Uncontrolled command line (`js/command-line-injection`) | More results | This query now recognizes additional ways of constructing arguments to `cmd.exe` and `/bin/sh`. |
+| Uncontrolled data used in path expression (`js/path-injection`) | More results | This query now recognizes additional ways dangerous paths can be constructed and used. |
+| Use of call stack introspection in strict mode (`js/strict-mode-call-stack-introspection`) | Fewer false positive results | The query no longer flags expression statements. |
+| Use of password hash with insufficient computational effort (`js/insufficient-password-hash`) | Fewer false positive results | This query now recognizes and excludes additional cases that do not require secure hashing. |
+| Useless regular-expression character escape (`js/useless-regexp-character-escape`) | Fewer false positive results | This query now distinguishes between escapes in strings and regular expression literals. |
 
 ## Changes to libraries
 
@@ -94,6 +95,6 @@
 * An extensible model of the `EventEmitter` pattern has been implemented.
 * Taint-tracking configurations now interact differently with the `data` flow label, which may affect queries
   that combine taint-tracking and flow labels.
-  - Sources added by the 1-argument `isSource` predicate are associated with the `taint` label now, instead of the `data` label.
+    - Sources added by the 1-argument `isSource` predicate are associated with the `taint` label now, instead of the `data` label.
-  - Sanitizers now only block the `taint` label. As a result, sanitizers no longer block the flow of tainted values wrapped inside a property of an object.
+    - Sanitizers now only block the `taint` label. As a result, sanitizers no longer block the flow of tainted values wrapped inside a property of an object.
-    To retain the old behavior, instead use a barrier, or block the `data` flow label using a labeled sanitizer.
+      To retain the old behavior, instead use a barrier, or block the `data` flow label using a labeled sanitizer.

cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll

@@ -4,6 +4,7 @@ import semmle.code.cpp.models.interfaces.Taint
  * The `std::basic_string` constructor(s).
  */
 class StdStringConstructor extends TaintFunction {
+  pragma[noinline]
   StdStringConstructor() { this.hasQualifiedName("std", "basic_string", "basic_string") }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {

javascript/ql/src/semmle/javascript/frameworks/SocketIO.qll

@@ -82,6 +82,11 @@ module SocketIO {
     }
 
     override DataFlow::SourceNode ref() { result = server(DataFlow::TypeTracker::end()) }
+
+    /**
+     * DEPRECATED. Always returns `this` as a `ServerObject` now represents the origin of a server.
+     */
+    deprecated DataFlow::SourceNode getOrigin() { result = this }
   }
 
   /** A data flow node that may produce (that is, create or return) a socket.io server. */
@@ -270,6 +275,18 @@ module SocketIO {
     }
 
     override string getChannel() { this.getArgument(0).mayHaveStringValue(result) }
+
+    /** Gets a parameter through which data is received from a client. */
+    DataFlow::SourceNode getAReceivedItem() { result = getReceivedItem(_) }
+
+    /** Gets a client-side node that may be sending the data received here. */
+    SendNode getASender() { result.getAReceiver() = this }
+
+    /** Gets the acknowledgment callback, if any. */
+    ReceiveCallback getAck() { result.getReceiveNode() = this }
+
+    /** DEPRECATED. Use `getChannel()` instead. */
+    deprecated string getEventName() { result = getChannel() }
   }
 
   /** An acknowledgment callback when receiving a message. */
@@ -289,6 +306,9 @@ module SocketIO {
     override SocketIOClient::SendCallback getAReceiver() {
       result.getSendNode().getAReceiver() = rcv
     }
+
+    /** Gets the API call to which this is a callback. */
+    ReceiveNode getReceiveNode() { result = rcv }
   }
 
   /**
@@ -350,6 +370,12 @@ module SocketIO {
     override SocketIOClient::ReceiveNode getAReceiver() {
       result.getSocket().getATargetNamespace() = getNamespace()
     }
+
+    /** Gets the acknowledgment callback, if any. */
+    SendCallback getAck() { result.getSendNode() = this }
+
+    /** DEPRECATED. Use `getChannel()` instead. */
+    deprecated string getEventName() { result = getChannel() }
   }
 
   /** A socket.io namespace, identified by its server and its path. */
@@ -538,14 +564,26 @@ module SocketIOClient {
         result != cb.getLastParameter() or not exists(result.getAnInvocation())
       )
     }
+
+    /** Gets a data flow node representing data received from the server. */
+    DataFlow::SourceNode getAReceivedItem() { result = getReceivedItem(_) }
+
+    /** Gets the acknowledgment callback, if any. */
+    DataFlow::SourceNode getAck() { result.(ReceiveCallback).getReceiveNode() = this }
+
+    /** Gets a server-side node that may be sending the data received here. */
+    SocketIO::SendNode getASender() {
+      result.getNamespace() = getSocket().getATargetNamespace() and
+      not result.getChannel() != getChannel()
+    }
   }
 
   /** An acknowledgment callback from a receive node. */
-  class RecieveCallback extends EventDispatch::Range, DataFlow::SourceNode {
+  class ReceiveCallback extends EventDispatch::Range, DataFlow::SourceNode {
     override SocketObject emitter;
     ReceiveNode rcv;
 
-    RecieveCallback() {
+    ReceiveCallback() {
       this = rcv.getListener().getLastParameter() and
       exists(this.getAnInvocation()) and
       emitter = rcv.getEmitter()
@@ -607,10 +645,19 @@ module SocketIOClient {
       )
     }
 
+    /** Gets a data flow node representing data sent to the client. */
+    DataFlow::Node getASentItem() { result = getSentItem(_) }
+
     /** Gets a server-side node that may be receiving the data sent here. */
     override SocketIO::ReceiveNode getAReceiver() {
       result.getSocket().getNamespace() = getSocket().getATargetNamespace()
     }
+
+    /** Gets the acknowledgment callback, if any. */
+    DataFlow::FunctionNode getAck() { result.(SendCallback).getSendNode() = this }
+
+    /** DEPRECATED. Use `getChannel()` instead. */
+    deprecated string getEventName() { result = getChannel() }
   }
 
   /**

javascript/ql/test/library-tests/frameworks/SocketIO/ClientReceiveNode_getAck.qll

@@ -1,7 +1,7 @@
 import javascript
 
 query predicate test_ClientReceiveNode_getAck(
-  SocketIOClient::ReceiveNode rn, SocketIOClient::RecieveCallback res
+  SocketIOClient::ReceiveNode rn, SocketIOClient::ReceiveCallback res
 ) {
   res.getReceiveNode() = rn
 }