Release preparation for version 2.11.1

This commit is contained in:
github-actions[bot]
2022-10-07 02:20:28 +00:00
parent 10eb548156
commit a02dcdc5e1
88 changed files with 257 additions and 127 deletions

View File

@@ -1,3 +1,7 @@
## 0.4.1
No user-facing changes.
## 0.4.0 ## 0.4.0
### Deprecated APIs ### Deprecated APIs

View File

@@ -0,0 +1,3 @@
## 0.4.1
No user-facing changes.

View File

@@ -1,2 +1,2 @@
--- ---
lastReleaseVersion: 0.4.0 lastReleaseVersion: 0.4.1

View File

@@ -1,5 +1,5 @@
name: codeql/cpp-all name: codeql/cpp-all
version: 0.4.1-dev version: 0.4.1
groups: cpp groups: cpp
dbscheme: semmlecode.cpp.dbscheme dbscheme: semmlecode.cpp.dbscheme
extractor: cpp extractor: cpp

View File

@@ -1,3 +1,9 @@
## 0.4.1
### Minor Analysis Improvements
* The alert message of many queries have been changed to better follow the style guide and make the message consistent with other languages.
## 0.4.0 ## 0.4.0
### New Queries ### New Queries

View File

@@ -1,4 +1,5 @@
--- ## 0.4.1
category: minorAnalysis
--- ### Minor Analysis Improvements
* The alert message of many queries have been changed to better follow the style guide and make the message consistent with other languages. * The alert message of many queries have been changed to better follow the style guide and make the message consistent with other languages.

View File

@@ -1,2 +1,2 @@
--- ---
lastReleaseVersion: 0.4.0 lastReleaseVersion: 0.4.1

View File

@@ -1,5 +1,5 @@
name: codeql/cpp-queries name: codeql/cpp-queries
version: 0.4.1-dev version: 0.4.1
groups: groups:
- cpp - cpp
- queries - queries

View File

@@ -1,3 +1,7 @@
## 1.3.1
No user-facing changes.
## 1.3.0 ## 1.3.0
No user-facing changes. No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.3.1
No user-facing changes.

View File

@@ -1,2 +1,2 @@
--- ---
lastReleaseVersion: 1.3.0 lastReleaseVersion: 1.3.1

View File

@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-all name: codeql/csharp-solorigate-all
version: 1.3.1-dev version: 1.3.1
groups: groups:
- csharp - csharp
- solorigate - solorigate

View File

@@ -1,3 +1,7 @@
## 1.3.1
No user-facing changes.
## 1.3.0 ## 1.3.0
No user-facing changes. No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.3.1
No user-facing changes.

View File

@@ -1,2 +1,2 @@
--- ---
lastReleaseVersion: 1.3.0 lastReleaseVersion: 1.3.1

View File

@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-queries name: codeql/csharp-solorigate-queries
version: 1.3.1-dev version: 1.3.1
groups: groups:
- csharp - csharp
- solorigate - solorigate

View File

@@ -1,3 +1,10 @@
## 0.4.1
### Minor Analysis Improvements
* `DateTime` expressions are now considered simple type sanitizers. This affects a wide range of security queries.
* ASP.NET Core controller definition has been made more precise. The amount of introduced taint sources or eliminated false positives should be low though, since the most common pattern is to derive all user defined ASP.NET Core controllers from the standard Controller class, which is not affected.
## 0.4.0 ## 0.4.0
### Deprecated APIs ### Deprecated APIs

View File

@@ -1,4 +0,0 @@
---
category: minorAnalysis
---
* `DateTime` expressions are now considered simple type sanitizers. This affects a wide range of security queries.

View File

@@ -1,4 +1,6 @@
--- ## 0.4.1
category: minorAnalysis
--- ### Minor Analysis Improvements
* `DateTime` expressions are now considered simple type sanitizers. This affects a wide range of security queries.
* ASP.NET Core controller definition has been made more precise. The amount of introduced taint sources or eliminated false positives should be low though, since the most common pattern is to derive all user defined ASP.NET Core controllers from the standard Controller class, which is not affected. * ASP.NET Core controller definition has been made more precise. The amount of introduced taint sources or eliminated false positives should be low though, since the most common pattern is to derive all user defined ASP.NET Core controllers from the standard Controller class, which is not affected.

View File

@@ -1,2 +1,2 @@
--- ---
lastReleaseVersion: 0.4.0 lastReleaseVersion: 0.4.1

View File

@@ -1,5 +1,5 @@
name: codeql/csharp-all name: codeql/csharp-all
version: 0.4.1-dev version: 0.4.1
groups: csharp groups: csharp
dbscheme: semmlecode.csharp.dbscheme dbscheme: semmlecode.csharp.dbscheme
extractor: csharp extractor: csharp

View File

@@ -1,3 +1,9 @@
## 0.4.1
### Minor Analysis Improvements
* The alert message of many queries have been changed to better follow the style guide and make the message consistent with other languages.
## 0.4.0 ## 0.4.0
### Minor Analysis Improvements ### Minor Analysis Improvements

View File

@@ -1,4 +1,5 @@
--- ## 0.4.1
category: minorAnalysis
--- ### Minor Analysis Improvements
* The alert message of many queries have been changed to better follow the style guide and make the message consistent with other languages.
* The alert message of many queries have been changed to better follow the style guide and make the message consistent with other languages.

View File

@@ -1,2 +1,2 @@
--- ---
lastReleaseVersion: 0.4.0 lastReleaseVersion: 0.4.1

View File

@@ -1,5 +1,5 @@
name: codeql/csharp-queries name: codeql/csharp-queries
version: 0.4.1-dev version: 0.4.1
groups: groups:
- csharp - csharp
- queries - queries

View File

@@ -1,3 +1,9 @@
## 0.3.1
### Minor Analysis Improvements
* Added support for `BeegoInput.RequestBody` as a source of untrusted data.
## 0.3.0 ## 0.3.0
### Deprecated APIs ### Deprecated APIs

View File

@@ -1,4 +1,5 @@
--- ## 0.3.1
category: minorAnalysis
--- ### Minor Analysis Improvements
* Added support for `BeegoInput.RequestBody` as a source of untrusted data. * Added support for `BeegoInput.RequestBody` as a source of untrusted data.

View File

@@ -1,2 +1,2 @@
--- ---
lastReleaseVersion: 0.3.0 lastReleaseVersion: 0.3.1

View File

@@ -1,5 +1,5 @@
name: codeql/go-all name: codeql/go-all
version: 0.3.1-dev version: 0.3.1
groups: go groups: go
dbscheme: go.dbscheme dbscheme: go.dbscheme
extractor: go extractor: go

View File

@@ -1,3 +1,7 @@
## 0.3.1
No user-facing changes.
## 0.3.0 ## 0.3.0
### Query Metadata Changes ### Query Metadata Changes

View File

@@ -0,0 +1,3 @@
## 0.3.1
No user-facing changes.

View File

@@ -1,2 +1,2 @@
--- ---
lastReleaseVersion: 0.3.0 lastReleaseVersion: 0.3.1

View File

@@ -1,5 +1,5 @@
name: codeql/go-queries name: codeql/go-queries
version: 0.3.1-dev version: 0.3.1
groups: groups:
- go - go
- queries - queries

View File

@@ -1,3 +1,9 @@
## 0.4.1
### Minor Analysis Improvements
* Added external flow sources for the intents received in exported Android services.
## 0.4.0 ## 0.4.0
### Breaking Changes ### Breaking Changes

View File

@@ -1,4 +1,5 @@
--- ## 0.4.1
category: minorAnalysis
--- ### Minor Analysis Improvements
* Added external flow sources for the intents received in exported Android services. * Added external flow sources for the intents received in exported Android services.

View File

@@ -1,2 +1,2 @@
--- ---
lastReleaseVersion: 0.4.0 lastReleaseVersion: 0.4.1

View File

@@ -1,5 +1,5 @@
name: codeql/java-all name: codeql/java-all
version: 0.4.1-dev version: 0.4.1
groups: java groups: java
dbscheme: config/semmlecode.dbscheme dbscheme: config/semmlecode.dbscheme
extractor: java extractor: java

View File

@@ -1,3 +1,15 @@
## 0.4.1
### New Queries
* Added a new query, `java/android/webview-debugging-enabled`, to detect instances of WebView debugging being enabled in production builds.
### Minor Analysis Improvements
* The alert message of many queries have been changed to better follow the style guide and make the message consistent with other languages.
* `PathSanitizer.qll` has been promoted from experimental to the main query pack. This sanitizer was originally [submitted as part of an experimental query by @luchua-bc](https://github.com/github/codeql/pull/7286).
* The queries `java/path-injection`, `java/path-injection-local` and `java/zipslip` now use the sanitizers provided by `PathSanitizer.qll`.
## 0.4.0 ## 0.4.0
### New Queries ### New Queries

View File

@@ -1,6 +0,0 @@
---
category: minorAnalysis
---
* `PathSanitizer.qll` has been promoted from experimental to the main query pack. This sanitizer was originally [submitted as part of an experimental query by @luchua-bc](https://github.com/github/codeql/pull/7286).
* The queries `java/path-injection`, `java/path-injection-local` and `java/zipslip` now use the sanitizers provided by `PathSanitizer.qll`.

View File

@@ -1,4 +0,0 @@
---
category: newQuery
---
* Added a new query, `java/android/webview-debugging-enabled`, to detect instances of WebView debugging being enabled in production builds.

View File

@@ -1,4 +0,0 @@
---
category: minorAnalysis
---
* The alert message of many queries have been changed to better follow the style guide and make the message consistent with other languages.

View File

@@ -0,0 +1,11 @@
## 0.4.1
### New Queries
* Added a new query, `java/android/webview-debugging-enabled`, to detect instances of WebView debugging being enabled in production builds.
### Minor Analysis Improvements
* The alert message of many queries have been changed to better follow the style guide and make the message consistent with other languages.
* `PathSanitizer.qll` has been promoted from experimental to the main query pack. This sanitizer was originally [submitted as part of an experimental query by @luchua-bc](https://github.com/github/codeql/pull/7286).
* The queries `java/path-injection`, `java/path-injection-local` and `java/zipslip` now use the sanitizers provided by `PathSanitizer.qll`.

View File

@@ -1,2 +1,2 @@
--- ---
lastReleaseVersion: 0.4.0 lastReleaseVersion: 0.4.1

View File

@@ -1,5 +1,5 @@
name: codeql/java-queries name: codeql/java-queries
version: 0.4.1-dev version: 0.4.1
groups: groups:
- java - java
- queries - queries

View File

@@ -1,3 +1,10 @@
## 0.3.1
### Minor Analysis Improvements
- Several of the SQL and NoSQL library models have improved, leading to more results for the `js/sql-injection` query,
and in some cases the `js/missing-rate-limiting` query.
## 0.3.0 ## 0.3.0
### Breaking Changes ### Breaking Changes

View File

@@ -1,6 +1,6 @@
--- ## 0.3.1
category: minorAnalysis
--- ### Minor Analysis Improvements
- Several of the SQL and NoSQL library models have improved, leading to more results for the `js/sql-injection` query, - Several of the SQL and NoSQL library models have improved, leading to more results for the `js/sql-injection` query,
and in some cases the `js/missing-rate-limiting` query. and in some cases the `js/missing-rate-limiting` query.

View File

@@ -1,2 +1,2 @@
--- ---
lastReleaseVersion: 0.3.0 lastReleaseVersion: 0.3.1

View File

@@ -1,5 +1,5 @@
name: codeql/javascript-all name: codeql/javascript-all
version: 0.3.1-dev version: 0.3.1
groups: javascript groups: javascript
dbscheme: semmlecode.javascript.dbscheme dbscheme: semmlecode.javascript.dbscheme
extractor: javascript extractor: javascript

View File

@@ -1,3 +1,7 @@
## 0.4.1
No user-facing changes.
## 0.4.0 ## 0.4.0
### Minor Analysis Improvements ### Minor Analysis Improvements

View File

@@ -0,0 +1,3 @@
## 0.4.1
No user-facing changes.

View File

@@ -1,2 +1,2 @@
--- ---
lastReleaseVersion: 0.4.0 lastReleaseVersion: 0.4.1

View File

@@ -1,5 +1,5 @@
name: codeql/javascript-queries name: codeql/javascript-queries
version: 0.4.1-dev version: 0.4.1
groups: groups:
- javascript - javascript
- queries - queries

View File

@@ -1,3 +1,7 @@
## 0.3.1
No user-facing changes.
## 0.3.0 ## 0.3.0
No user-facing changes. No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 0.3.1
No user-facing changes.

View File

@@ -1,2 +1,2 @@
--- ---
lastReleaseVersion: 0.3.0 lastReleaseVersion: 0.3.1

View File

@@ -1,3 +1,3 @@
name: codeql/suite-helpers name: codeql/suite-helpers
version: 0.3.1-dev version: 0.3.1
groups: shared groups: shared

View File

@@ -1,3 +1,10 @@
## 0.6.1
### Minor Analysis Improvements
* Added the ability to refer to subscript operations in the API graph. It is now possible to write `response().getMember("cookies").getASubscript()` to find code like `resp.cookies["key"]` (assuming `response` returns an API node for reponse objects).
* Added modeling of creating Flask responses with `flask.jsonify`.
## 0.6.0 ## 0.6.0
### Deprecated APIs ### Deprecated APIs

View File

@@ -1,4 +0,0 @@
---
category: minorAnalysis
---
* Added modeling of creating Flask responses with `flask.jsonify`.

View File

@@ -1,4 +1,6 @@
--- ## 0.6.1
category: minorAnalysis
--- ### Minor Analysis Improvements
* Added the ability to refer to subscript operations in the API graph. It is now possible to write `response().getMember("cookies").getASubscript()` to find code like `resp.cookies["key"]` (assuming `response` returns an API node for reponse objects). * Added the ability to refer to subscript operations in the API graph. It is now possible to write `response().getMember("cookies").getASubscript()` to find code like `resp.cookies["key"]` (assuming `response` returns an API node for reponse objects).
* Added modeling of creating Flask responses with `flask.jsonify`.

View File

@@ -1,2 +1,2 @@
--- ---
lastReleaseVersion: 0.6.0 lastReleaseVersion: 0.6.1

View File

@@ -1,5 +1,5 @@
name: codeql/python-all name: codeql/python-all
version: 0.6.1-dev version: 0.6.1
groups: python groups: python
dbscheme: semmlecode.python.dbscheme dbscheme: semmlecode.python.dbscheme
extractor: python extractor: python

View File

@@ -1,3 +1,7 @@
## 0.5.1
No user-facing changes.
## 0.5.0 ## 0.5.0
### Query Metadata Changes ### Query Metadata Changes

View File

@@ -0,0 +1,3 @@
## 0.5.1
No user-facing changes.

View File

@@ -1,2 +1,2 @@
--- ---
lastReleaseVersion: 0.5.0 lastReleaseVersion: 0.5.1

View File

@@ -1,5 +1,5 @@
name: codeql/python-queries name: codeql/python-queries
version: 0.5.1-dev version: 0.5.1
groups: groups:
- python - python
- queries - queries

View File

@@ -1,3 +1,26 @@
## 0.4.1
### Minor Analysis Improvements
* The following classes have been moved from `codeql.ruby.frameworks.ActionController` to `codeql.ruby.frameworks.Rails`:
* `ParamsCall`, now accessed as `Rails::ParamsCall`.
* `CookieCall`, now accessed as `Rails::CookieCall`.
* The following classes have been moved from `codeql.ruby.frameworks.ActionView` to `codeql.ruby.frameworks.Rails`:
* `HtmlSafeCall`, now accessed as `Rails::HtmlSafeCall`.
* `HtmlEscapeCall`, now accessed as `Rails::HtmlEscapeCall`.
* `RenderCall`, now accessed as `Rails::RenderCall`.
* `RenderToCall`, now accessed as `Rails::RenderToCall`.
* Subclasses of `ActionController::Metal` are now recognised as controllers.
* `ActionController::DataStreaming::send_file` is now recognized as a
`FileSystemAccess`.
* Various XSS sinks in the ActionView library are now recognized.
* Calls to `ActiveRecord::Base.create` are now recognized as model
instantiations.
* Various code executions, command executions and HTTP requests in the
ActiveStorage library are now recognized.
* `MethodBase` now has two new predicates related to visibility: `isPublic` and
`isProtected`. These hold, respectively, if the method is public or protected.
## 0.4.0 ## 0.4.0
### Breaking Changes ### Breaking Changes

View File

@@ -1,5 +0,0 @@
---
category: minorAnalysis
---
* `MethodBase` now has two new predicates related to visibility: `isPublic` and
`isProtected`. These hold, respectively, if the method is public or protected.

View File

@@ -1,6 +0,0 @@
---
category: minorAnalysis
---
* Various code executions, command executions and HTTP requests in the
ActiveStorage library are now recognized.

View File

@@ -1,4 +0,0 @@
---
category: minorAnalysis
---
* Various XSS sinks in the ActionView library are now recognized.

View File

@@ -1,5 +0,0 @@
---
category: minorAnalysis
---
* Calls to `ActiveRecord::Base.create` are now recognized as model
instantiations.

View File

@@ -1,4 +0,0 @@
---
category: minorAnalysis
---
* Subclasses of `ActionController::Metal` are now recognised as controllers.

View File

@@ -1,6 +0,0 @@
---
category: minorAnalysis
---
* `ActionController::DataStreaming::send_file` is now recognized as a
`FileSystemAccess`.

View File

@@ -1,11 +0,0 @@
---
category: minorAnalysis
---
* The following classes have been moved from `codeql.ruby.frameworks.ActionController` to `codeql.ruby.frameworks.Rails`:
* `ParamsCall`, now accessed as `Rails::ParamsCall`.
* `CookieCall`, now accessed as `Rails::CookieCall`.
* The following classes have been moved from `codeql.ruby.frameworks.ActionView` to `codeql.ruby.frameworks.Rails`:
* `HtmlSafeCall`, now accessed as `Rails::HtmlSafeCall`.
* `HtmlEscapeCall`, now accessed as `Rails::HtmlEscapeCall`.
* `RenderCall`, now accessed as `Rails::RenderCall`.
* `RenderToCall`, now accessed as `Rails::RenderToCall`.

View File

@@ -0,0 +1,22 @@
## 0.4.1
### Minor Analysis Improvements
* The following classes have been moved from `codeql.ruby.frameworks.ActionController` to `codeql.ruby.frameworks.Rails`:
* `ParamsCall`, now accessed as `Rails::ParamsCall`.
* `CookieCall`, now accessed as `Rails::CookieCall`.
* The following classes have been moved from `codeql.ruby.frameworks.ActionView` to `codeql.ruby.frameworks.Rails`:
* `HtmlSafeCall`, now accessed as `Rails::HtmlSafeCall`.
* `HtmlEscapeCall`, now accessed as `Rails::HtmlEscapeCall`.
* `RenderCall`, now accessed as `Rails::RenderCall`.
* `RenderToCall`, now accessed as `Rails::RenderToCall`.
* Subclasses of `ActionController::Metal` are now recognised as controllers.
* `ActionController::DataStreaming::send_file` is now recognized as a
`FileSystemAccess`.
* Various XSS sinks in the ActionView library are now recognized.
* Calls to `ActiveRecord::Base.create` are now recognized as model
instantiations.
* Various code executions, command executions and HTTP requests in the
ActiveStorage library are now recognized.
* `MethodBase` now has two new predicates related to visibility: `isPublic` and
`isProtected`. These hold, respectively, if the method is public or protected.

View File

@@ -1,2 +1,2 @@
--- ---
lastReleaseVersion: 0.4.0 lastReleaseVersion: 0.4.1

View File

@@ -1,5 +1,5 @@
name: codeql/ruby-all name: codeql/ruby-all
version: 0.4.1-dev version: 0.4.1
groups: ruby groups: ruby
extractor: ruby extractor: ruby
dbscheme: ruby.dbscheme dbscheme: ruby.dbscheme

View File

@@ -1,3 +1,11 @@
## 0.4.1
### Minor Analysis Improvements
* The `rb/xxe` query has been updated to add the following sinks for XML external entity expansion:
1. Calls to parse XML using `LibXML` when its `default_substitute_entities` option is enabled.
2. Uses of the Rails methods `ActiveSupport::XmlMini.parse`, `Hash.from_xml`, and `Hash.from_trusted_xml` when `ActiveSupport::XmlMini` is configured to use `LibXML` as its backend, and its `default_substitute_entities` option is enabled.
## 0.4.0 ## 0.4.0
### New Queries ### New Queries

View File

@@ -1,6 +1,7 @@
--- ## 0.4.1
category: minorAnalysis
--- ### Minor Analysis Improvements
* The `rb/xxe` query has been updated to add the following sinks for XML external entity expansion: * The `rb/xxe` query has been updated to add the following sinks for XML external entity expansion:
1. Calls to parse XML using `LibXML` when its `default_substitute_entities` option is enabled. 1. Calls to parse XML using `LibXML` when its `default_substitute_entities` option is enabled.
2. Uses of the Rails methods `ActiveSupport::XmlMini.parse`, `Hash.from_xml`, and `Hash.from_trusted_xml` when `ActiveSupport::XmlMini` is configured to use `LibXML` as its backend, and its `default_substitute_entities` option is enabled. 2. Uses of the Rails methods `ActiveSupport::XmlMini.parse`, `Hash.from_xml`, and `Hash.from_trusted_xml` when `ActiveSupport::XmlMini` is configured to use `LibXML` as its backend, and its `default_substitute_entities` option is enabled.

View File

@@ -1,2 +1,2 @@
--- ---
lastReleaseVersion: 0.4.0 lastReleaseVersion: 0.4.1

View File

@@ -1,5 +1,5 @@
name: codeql/ruby-queries name: codeql/ruby-queries
version: 0.4.1-dev version: 0.4.1
groups: groups:
- ruby - ruby
- queries - queries

View File

@@ -1,3 +1,7 @@
## 0.0.2
No user-facing changes.
## 0.0.1 ## 0.0.1
* Initial release. Extracted common SSA code into a library pack to share code between languages. * Initial release. Extracted common SSA code into a library pack to share code between languages.

View File

@@ -0,0 +1,3 @@
## 0.0.2
No user-facing changes.

View File

@@ -1,2 +1,2 @@
--- ---
lastReleaseVersion: 0.0.1 lastReleaseVersion: 0.0.2

View File

@@ -1,4 +1,4 @@
name: codeql/ssa name: codeql/ssa
version: 0.0.2-dev version: 0.0.2
groups: shared groups: shared
library: true library: true

View File

@@ -1,3 +1,7 @@
## 0.0.2
No user-facing changes.
## 0.0.1 ## 0.0.1
* Initial release. Share the database of common typographical errors between languages. * Initial release. Share the database of common typographical errors between languages.

View File

@@ -0,0 +1,3 @@
## 0.0.2
No user-facing changes.

View File

@@ -1,2 +1,2 @@
--- ---
lastReleaseVersion: 0.0.1 lastReleaseVersion: 0.0.2

View File

@@ -1,4 +1,4 @@
name: codeql/typos name: codeql/typos
version: 0.0.2-dev version: 0.0.2
groups: shared groups: shared
library: true library: true