Merge pull request #10260 from github/edoardo/3.7-mergeback

Merge `rc/3.7` into `main`

java/ql/lib/CHANGELOG.md

@@ -1,3 +1,30 @@
+## 0.3.4
+
+### Deprecated APIs
+
+* Many classes/predicates/modules with upper-case acronyms in their name have been renamed to follow our style-guide. 
+  The old name still exists as a deprecated alias.
+* The utility files previously in the `semmle.code.java.security.performance` package have been moved to the `semmle.code.java.security.regexp` package.  
+  The previous files still exist as deprecated aliases.
+
+### New Features
+
+* Added a new predicate, `requiresPermissions`, in the `AndroidComponentXmlElement` and `AndroidApplicationXmlElement` classes to detect if the element has explicitly set a value for its `android:permission` attribute.
+* Added a new predicate, `hasAnIntentFilterElement`, in the `AndroidComponentXmlElement` class to detect if a component contains an intent filter element.
+* Added a new predicate, `hasExportedAttribute`, in the `AndroidComponentXmlElement` class to detect if a component has an `android:exported` attribute.
+* Added a new class, `AndroidCategoryXmlElement`, to represent a category element in an Android manifest file.
+* Added a new predicate, `getACategoryElement`, in the `AndroidIntentFilterXmlElement` class to get a category element of an intent filter.
+* Added a new predicate, `isInBuildDirectory`, in the `AndroidManifestXmlFile` class. This predicate detects if the manifest file is located in a build directory.
+* Added a new predicate, `isDebuggable`, in the `AndroidApplicationXmlElement` class. This predicate detects if the application element has its `android:debuggable` attribute enabled.
+
+### Minor Analysis Improvements
+
+* Added new flow steps for the classes `java.io.Path` and `java.nio.Paths`.
+* The class `AndroidFragment` now also models the Android Jetpack version of the `Fragment` class (`androidx.fragment.app.Fragment`).
+* Java 19 builds can now be extracted. There are no non-preview new language features in this release, so the only user-visible change is that the CodeQL extractor will now correctly trace compilations using the JDK 19 release of `javac`.
+* Classes and methods that are seen with several different paths during the extraction process (for example, packaged into different JAR files) now report an arbitrarily selected location via their `getLocation` and `hasLocationInfo` predicates, rather than reporting all of them. This may lead to reduced alert duplication.
+* The query `java/hardcoded-credential-api-call` now recognises methods that consume usernames, passwords and keys from the JSch, Ganymed, Apache SSHD, sshj, Trilead SSH-2, Apache FTPClient and MongoDB projects. 
+
 ## 0.3.3
 
 ### Minor Analysis Improvements

java/ql/lib/change-notes/2022-05-25-redos-refac.md

@@ -1,5 +0,0 @@
----
-category: deprecated
----
-* The utility files previously in the `semmle.code.java.security.performance` package have been moved to the `semmle.code.java.security.regexp` package.  
-  The previous files still exist as deprecated aliases.

java/ql/lib/change-notes/2022-08-01-android-manifest-new-predicates.md

@@ -1,5 +0,0 @@
----
-category: feature
----
-* Added a new predicate, `isInBuildDirectory`, in the `AndroidManifestXmlFile` class. This predicate detects if the manifest file is located in a build directory.
-* Added a new predicate, `isDebuggable`, in the `AndroidApplicationXmlElement` class. This predicate detects if the application element has its `android:debuggable` attribute enabled.

java/ql/lib/change-notes/2022-08-09-android-manifest-new-class-and-predicates.md

@@ -1,8 +0,0 @@
----
-category: feature
----
-* Added a new predicate, `requiresPermissions`, in the `AndroidComponentXmlElement` and `AndroidApplicationXmlElement` classes to detect if the element has explicitly set a value for its `android:permission` attribute.
-* Added a new predicate, `hasAnIntentFilterElement`, in the `AndroidComponentXmlElement` class to detect if a component contains an intent filter element.
-* Added a new predicate, `hasExportedAttribute`, in the `AndroidComponentXmlElement` class to detect if a component has an `android:exported` attribute.
-* Added a new class, `AndroidCategoryXmlElement`, to represent a category element in an Android manifest file.
-* Added a new predicate, `getACategoryElement`, in the `AndroidIntentFilterXmlElement` class to get a category element of an intent filter.

java/ql/lib/change-notes/2022-08-13-more-hardcoded-credential-apis.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The query `java/hardcoded-credential-api-call` now recognises methods that consume usernames, passwords and keys from the JSch, Ganymed, Apache SSHD, sshj, Trilead SSH-2, Apache FTPClient and MongoDB projects. 

java/ql/lib/change-notes/2022-08-19-androidx-fragments.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The class `AndroidFragment` now also models the Android Jetpack version of the `Fragment` class (`androidx.fragment.app.Fragment`).

java/ql/lib/change-notes/2022-08-19-java-19-support.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Java 19 builds can now be extracted. There are no non-preview new language features in this release, so the only user-visible change is that the CodeQL extractor will now correctly trace compilations using the JDK 19 release of `javac`.

java/ql/lib/change-notes/2022-08-19-signular-locations.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Classes and methods that are seen with several different paths during the extraction process (for example, packaged into different JAR files) now report an arbitrarily selected location via their `getLocation` and `hasLocationInfo` predicates, rather than reporting all of them. This may lead to reduced alert duplication.

java/ql/lib/change-notes/2022-08-22-path-summaries.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Added new flow steps for the classes `java.io.Path` and `java.nio.Paths`.

java/ql/lib/change-notes/2022-08-22-xml-rename.md

@@ -1,5 +0,0 @@
----
-category: deprecated
----
-* Many classes/predicates/modules with upper-case acronyms in their name have been renamed to follow our style-guide. 
-  The old name still exists as a deprecated alias.

java/ql/lib/change-notes/released/0.3.4.md

@@ -0,0 +1,26 @@
+## 0.3.4
+
+### Deprecated APIs
+
+* Many classes/predicates/modules with upper-case acronyms in their name have been renamed to follow our style-guide. 
+  The old name still exists as a deprecated alias.
+* The utility files previously in the `semmle.code.java.security.performance` package have been moved to the `semmle.code.java.security.regexp` package.  
+  The previous files still exist as deprecated aliases.
+
+### New Features
+
+* Added a new predicate, `requiresPermissions`, in the `AndroidComponentXmlElement` and `AndroidApplicationXmlElement` classes to detect if the element has explicitly set a value for its `android:permission` attribute.
+* Added a new predicate, `hasAnIntentFilterElement`, in the `AndroidComponentXmlElement` class to detect if a component contains an intent filter element.
+* Added a new predicate, `hasExportedAttribute`, in the `AndroidComponentXmlElement` class to detect if a component has an `android:exported` attribute.
+* Added a new class, `AndroidCategoryXmlElement`, to represent a category element in an Android manifest file.
+* Added a new predicate, `getACategoryElement`, in the `AndroidIntentFilterXmlElement` class to get a category element of an intent filter.
+* Added a new predicate, `isInBuildDirectory`, in the `AndroidManifestXmlFile` class. This predicate detects if the manifest file is located in a build directory.
+* Added a new predicate, `isDebuggable`, in the `AndroidApplicationXmlElement` class. This predicate detects if the application element has its `android:debuggable` attribute enabled.
+
+### Minor Analysis Improvements
+
+* Added new flow steps for the classes `java.io.Path` and `java.nio.Paths`.
+* The class `AndroidFragment` now also models the Android Jetpack version of the `Fragment` class (`androidx.fragment.app.Fragment`).
+* Java 19 builds can now be extracted. There are no non-preview new language features in this release, so the only user-visible change is that the CodeQL extractor will now correctly trace compilations using the JDK 19 release of `javac`.
+* Classes and methods that are seen with several different paths during the extraction process (for example, packaged into different JAR files) now report an arbitrarily selected location via their `getLocation` and `hasLocationInfo` predicates, rather than reporting all of them. This may lead to reduced alert duplication.
+* The query `java/hardcoded-credential-api-call` now recognises methods that consume usernames, passwords and keys from the JSch, Ganymed, Apache SSHD, sshj, Trilead SSH-2, Apache FTPClient and MongoDB projects. 

java/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.3.3
+lastReleaseVersion: 0.3.4

java/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/java-all
-version: 0.3.4-dev
+version: 0.3.5-dev
 groups: java
 dbscheme: config/semmlecode.dbscheme
 extractor: java

java/ql/src/CHANGELOG.md

@@ -1,3 +1,25 @@
+## 0.3.3
+
+### New Queries
+
+* Added a new query, `java/android/implicitly-exported-component`, to detect if components are implicitly exported in the Android manifest.
+* A new query "Use of RSA algorithm without OAEP" (`java/rsa-without-oaep`) has been added. This query finds uses of RSA encryption that don't use the OAEP scheme.
+* Added a new query, `java/android/debuggable-attribute-enabled`, to detect if the `android:debuggable` attribute is enabled in the Android manifest.
+* The query "Using a static initialization vector for encryption" (`java/static-initialization-vector`) has been promoted from experimental to the main query pack. This query was originally [submitted as an experimental query by @artem-smotrakov](https://github.com/github/codeql/pull/6357).
+* A new query `java/partial-path-traversal` finds partial path traversal vulnerabilities resulting from incorrectly using 
+`String#startsWith` to compare canonical paths. 
+* Added a new query, `java/suspicious-regexp-range`, to detect character ranges in regular expressions that seem to match 
+  too many characters.
+
+### Query Metadata Changes
+
+* The queries `java/redos` and `java/polynomial-redos` now have a tag for CWE-1333. 
+
+### Minor Analysis Improvements
+
+* The query `java/static-initialization-vector` no longer requires a `Cipher` object to be initialized with `ENCRYPT_MODE` to be considered a valid sink. Also, several new sanitizers were added.
+* Improved sanitizers for `java/sensitive-log`, which removes some false positives and improves performance a bit.
+
 ## 0.3.2
 
 ### New Queries

java/ql/src/change-notes/2022-06-24-suspicious-range.md

@@ -1,5 +0,0 @@
----
-category: newQuery
----
-* Added a new query, `java/suspicious-regexp-range`, to detect character ranges in regular expressions that seem to match 
-  too many characters.

java/ql/src/change-notes/2022-07-01-partial-path-traversal.md

@@ -1,5 +0,0 @@
----
-category: newQuery
----
-* A new query `java/partial-path-traversal` finds partial path traversal vulnerabilities resulting from incorrectly using 
-`String#startsWith` to compare canonical paths. 

java/ql/src/change-notes/2022-07-19-static-initialization-vector.md

@@ -1,4 +0,0 @@
----
-category: newQuery
----
-* The query "Using a static initialization vector for encryption" (`java/static-initialization-vector`) has been promoted from experimental to the main query pack. This query was originally [submitted as an experimental query by @artem-smotrakov](https://github.com/github/codeql/pull/6357).

java/ql/src/change-notes/2022-08-01-android-debug-query.md

@@ -1,4 +0,0 @@
----
-category: newQuery
----
-* Added a new query, `java/android/debuggable-attribute-enabled`, to detect if the `android:debuggable` attribute is enabled in the Android manifest.

java/ql/src/change-notes/2022-08-05-rsa-without-oaep.md

@@ -1,4 +0,0 @@
----
-category: newQuery
----
-* A new query "Use of RSA algorithm without OAEP" (`java/rsa-without-oaep`) has been added. This query finds uses of RSA encryption that don't use the OAEP scheme.

java/ql/src/change-notes/2022-08-09-android-implicit-export.md

@@ -1,4 +0,0 @@
----
-category: newQuery
----
-* Added a new query, `java/android/implicitly-exported-component`, to detect if components are implicitly exported in the Android manifest.

java/ql/src/change-notes/2022-08-18-sensitive-log-sanitizer.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Improved sanitizers for `java/sensitive-log`, which removes some false positives and improves performance a bit.

java/ql/src/change-notes/2022-08-22-static-init-vector-query-improvements.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The query `java/static-initialization-vector` no longer requires a `Cipher` object to be initialized with `ENCRYPT_MODE` to be considered a valid sink. Also, several new sanitizers were added.

java/ql/src/change-notes/2022-08-23-redos-cwe-1333.md

@@ -1,4 +0,0 @@
----
-category: queryMetadata
----
-* The queries `java/redos` and `java/polynomial-redos` now have a tag for CWE-1333. 

java/ql/src/change-notes/released/0.3.3.md

@@ -0,0 +1,21 @@
+## 0.3.3
+
+### New Queries
+
+* Added a new query, `java/android/implicitly-exported-component`, to detect if components are implicitly exported in the Android manifest.
+* A new query "Use of RSA algorithm without OAEP" (`java/rsa-without-oaep`) has been added. This query finds uses of RSA encryption that don't use the OAEP scheme.
+* Added a new query, `java/android/debuggable-attribute-enabled`, to detect if the `android:debuggable` attribute is enabled in the Android manifest.
+* The query "Using a static initialization vector for encryption" (`java/static-initialization-vector`) has been promoted from experimental to the main query pack. This query was originally [submitted as an experimental query by @artem-smotrakov](https://github.com/github/codeql/pull/6357).
+* A new query `java/partial-path-traversal` finds partial path traversal vulnerabilities resulting from incorrectly using 
+`String#startsWith` to compare canonical paths. 
+* Added a new query, `java/suspicious-regexp-range`, to detect character ranges in regular expressions that seem to match 
+  too many characters.
+
+### Query Metadata Changes
+
+* The queries `java/redos` and `java/polynomial-redos` now have a tag for CWE-1333. 
+
+### Minor Analysis Improvements
+
+* The query `java/static-initialization-vector` no longer requires a `Cipher` object to be initialized with `ENCRYPT_MODE` to be considered a valid sink. Also, several new sanitizers were added.
+* Improved sanitizers for `java/sensitive-log`, which removes some false positives and improves performance a bit.

java/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.3.2
+lastReleaseVersion: 0.3.3

java/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/java-queries
-version: 0.3.3-dev
+version: 0.3.4-dev
 groups: 
   - java
   - queries