From f2755315429157e21f5678d455254497f942fe75 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen
Date: Fri, 2 Feb 2024 10:57:15 +0100
Subject: [PATCH 001/309] Add support for TS 5.4-beta
---
.../lib/typescript/package-lock.json | 10 +-
.../extractor/lib/typescript/package.json | 4 +-
.../TypeScript/Types/printAst.expected | 151 ++++++++++++++----
.../TypeScript/Types/tests.expected | 20 +++
.../library-tests/TypeScript/Types/tst.ts | 8 +
5 files changed, 155 insertions(+), 38 deletions(-)
diff --git a/javascript/extractor/lib/typescript/package-lock.json b/javascript/extractor/lib/typescript/package-lock.json
index 2d448ae0448..fd672bf43c0 100644
--- a/javascript/extractor/lib/typescript/package-lock.json
+++ b/javascript/extractor/lib/typescript/package-lock.json
@@ -6,7 +6,7 @@
"": {
"name": "typescript-parser-wrapper",
"dependencies": {
- "typescript": "5.3.2"
+ "typescript": "5.4.0-beta"
},
"devDependencies": {
"@types/node": "18.15.3"
@@ -20,9 +20,9 @@
"license": "MIT"
},
"node_modules/typescript": {
- "version": "5.3.2",
- "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.3.2.tgz",
- "integrity": "sha512-6l+RyNy7oAHDfxC4FzSJcz9vnjTKxrLpDG5M2Vu4SHRVNg6xzqZp6LYSR9zjqQTu8DU/f5xwxUdADOkbrIX2gQ==",
+ "version": "5.4.0-beta",
+ "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.4.0-beta.tgz",
+ "integrity": "sha512-KgekV5JS7TQ7Bb8eO64QGxdM7MSBUUXOXq28OWX23d2MA8SiVtNYoo4s33tCTEGV8+6AGBRD2+KiXNNnexRRYw==",
"bin": {
"tsc": "bin/tsc",
"tsserver": "bin/tsserver"
@@ -32,4 +32,4 @@
}
}
}
-}
+}
\ No newline at end of file
diff --git a/javascript/extractor/lib/typescript/package.json b/javascript/extractor/lib/typescript/package.json
index 602379bc36a..2a636c3cdf3 100644
--- a/javascript/extractor/lib/typescript/package.json
+++ b/javascript/extractor/lib/typescript/package.json
@@ -2,7 +2,7 @@
"name": "typescript-parser-wrapper",
"private": true,
"dependencies": {
- "typescript": "5.3.2"
+ "typescript": "5.4.0-beta"
},
"scripts": {
"build": "tsc --project tsconfig.json",
@@ -14,4 +14,4 @@
"devDependencies": {
"@types/node": "18.15.3"
}
-}
+}
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/TypeScript/Types/printAst.expected b/javascript/ql/test/library-tests/TypeScript/Types/printAst.expected
index 5f29995b854..90fa2b8dcda 100644
--- a/javascript/ql/test/library-tests/TypeScript/Types/printAst.expected
+++ b/javascript/ql/test/library-tests/TypeScript/Types/printAst.expected
@@ -124,6 +124,7 @@ nodes
| file://:0:0:0:0 | (Arguments) | semmle.label | (Arguments) |
| file://:0:0:0:0 | (Arguments) | semmle.label | (Arguments) |
| file://:0:0:0:0 | (Arguments) | semmle.label | (Arguments) |
+| file://:0:0:0:0 | (Arguments) | semmle.label | (Arguments) |
| file://:0:0:0:0 | (Parameters) | semmle.label | (Parameters) |
| file://:0:0:0:0 | (Parameters) | semmle.label | (Parameters) |
| file://:0:0:0:0 | (Parameters) | semmle.label | (Parameters) |
@@ -167,6 +168,8 @@ nodes
| file://:0:0:0:0 | (Parameters) | semmle.label | (Parameters) |
| file://:0:0:0:0 | (Parameters) | semmle.label | (Parameters) |
| file://:0:0:0:0 | (Parameters) | semmle.label | (Parameters) |
+| file://:0:0:0:0 | (Parameters) | semmle.label | (Parameters) |
+| file://:0:0:0:0 | (TypeParameters) | semmle.label | (TypeParameters) |
| file://:0:0:0:0 | (TypeParameters) | semmle.label | (TypeParameters) |
| file://:0:0:0:0 | (TypeParameters) | semmle.label | (TypeParameters) |
| file://:0:0:0:0 | (TypeParameters) | semmle.label | (TypeParameters) |
@@ -1757,8 +1760,36 @@ nodes
| tst.ts:483:46:483:50 | [LocalTypeAccess] Pair3 | semmle.label | [LocalTypeAccess] Pair3 |
| tst.ts:483:46:483:58 | [GenericTypeExpr] Pair3 | semmle.label | [GenericTypeExpr] Pair3 |
| tst.ts:483:52:483:57 | [KeywordTypeExpr] string | semmle.label | [KeywordTypeExpr] string |
+| tst.ts:486:1:492:1 | [NamespaceDeclaration] module ... ow"); } | semmle.label | [NamespaceDeclaration] module ... ow"); } |
+| tst.ts:486:1:492:1 | [NamespaceDeclaration] module ... ow"); } | semmle.order | 90 |
+| tst.ts:486:8:486:11 | [VarDecl] TS54 | semmle.label | [VarDecl] TS54 |
+| tst.ts:487:3:489:3 | [FunctionDeclStmt] functio ... 0]; } | semmle.label | [FunctionDeclStmt] functio ... 0]; } |
+| tst.ts:487:12:487:28 | [VarDecl] createStreetLight | semmle.label | [VarDecl] createStreetLight |
+| tst.ts:487:30:487:30 | [Identifier] C | semmle.label | [Identifier] C |
+| tst.ts:487:30:487:45 | [TypeParameter] C extends string | semmle.label | [TypeParameter] C extends string |
+| tst.ts:487:40:487:45 | [KeywordTypeExpr] string | semmle.label | [KeywordTypeExpr] string |
+| tst.ts:487:48:487:53 | [SimpleParameter] colors | semmle.label | [SimpleParameter] colors |
+| tst.ts:487:56:487:56 | [LocalTypeAccess] C | semmle.label | [LocalTypeAccess] C |
+| tst.ts:487:56:487:58 | [ArrayTypeExpr] C[] | semmle.label | [ArrayTypeExpr] C[] |
+| tst.ts:487:61:487:72 | [SimpleParameter] defaultColor | semmle.label | [SimpleParameter] defaultColor |
+| tst.ts:487:76:487:82 | [LocalTypeAccess] NoInfer | semmle.label | [LocalTypeAccess] NoInfer |
+| tst.ts:487:76:487:85 | [GenericTypeExpr] NoInfer | semmle.label | [GenericTypeExpr] NoInfer |
+| tst.ts:487:84:487:84 | [LocalTypeAccess] C | semmle.label | [LocalTypeAccess] C |
+| tst.ts:487:88:489:3 | [BlockStmt] { r ... 0]; } | semmle.label | [BlockStmt] { r ... 0]; } |
+| tst.ts:488:5:488:21 | [ReturnStmt] return colors[0]; | semmle.label | [ReturnStmt] return colors[0]; |
+| tst.ts:488:12:488:17 | [VarRef] colors | semmle.label | [VarRef] colors |
+| tst.ts:488:12:488:20 | [IndexExpr] colors[0] | semmle.label | [IndexExpr] colors[0] |
+| tst.ts:488:19:488:19 | [Literal] 0 | semmle.label | [Literal] 0 |
+| tst.ts:491:3:491:19 | [VarRef] createStreetLight | semmle.label | [VarRef] createStreetLight |
+| tst.ts:491:3:491:57 | [CallExpr] createS ... ellow") | semmle.label | [CallExpr] createS ... ellow") |
+| tst.ts:491:3:491:58 | [ExprStmt] createS ... llow"); | semmle.label | [ExprStmt] createS ... llow"); |
+| tst.ts:491:21:491:46 | [ArrayExpr] ["red", ... green"] | semmle.label | [ArrayExpr] ["red", ... green"] |
+| tst.ts:491:22:491:26 | [Literal] "red" | semmle.label | [Literal] "red" |
+| tst.ts:491:29:491:36 | [Literal] "yellow" | semmle.label | [Literal] "yellow" |
+| tst.ts:491:39:491:45 | [Literal] "green" | semmle.label | [Literal] "green" |
+| tst.ts:491:49:491:56 | [Literal] "yellow" | semmle.label | [Literal] "yellow" |
| tstModuleCJS.cts:1:1:3:1 | [ExportDeclaration] export ... 'b'; } | semmle.label | [ExportDeclaration] export ... 'b'; } |
-| tstModuleCJS.cts:1:1:3:1 | [ExportDeclaration] export ... 'b'; } | semmle.order | 90 |
+| tstModuleCJS.cts:1:1:3:1 | [ExportDeclaration] export ... 'b'; } | semmle.order | 91 |
| tstModuleCJS.cts:1:8:3:1 | [FunctionDeclStmt] functio ... 'b'; } | semmle.label | [FunctionDeclStmt] functio ... 'b'; } |
| tstModuleCJS.cts:1:17:1:28 | [VarDecl] tstModuleCJS | semmle.label | [VarDecl] tstModuleCJS |
| tstModuleCJS.cts:1:33:1:35 | [LiteralTypeExpr] 'a' | semmle.label | [LiteralTypeExpr] 'a' |
@@ -1776,7 +1807,7 @@ nodes
| tstModuleCJS.cts:2:34:2:36 | [Literal] 'a' | semmle.label | [Literal] 'a' |
| tstModuleCJS.cts:2:40:2:42 | [Literal] 'b' | semmle.label | [Literal] 'b' |
| tstModuleES.mts:1:1:3:1 | [ExportDeclaration] export ... 'b'; } | semmle.label | [ExportDeclaration] export ... 'b'; } |
-| tstModuleES.mts:1:1:3:1 | [ExportDeclaration] export ... 'b'; } | semmle.order | 91 |
+| tstModuleES.mts:1:1:3:1 | [ExportDeclaration] export ... 'b'; } | semmle.order | 92 |
| tstModuleES.mts:1:16:3:1 | [FunctionDeclStmt] functio ... 'b'; } | semmle.label | [FunctionDeclStmt] functio ... 'b'; } |
| tstModuleES.mts:1:25:1:35 | [VarDecl] tstModuleES | semmle.label | [VarDecl] tstModuleES |
| tstModuleES.mts:1:40:1:42 | [LiteralTypeExpr] 'a' | semmle.label | [LiteralTypeExpr] 'a' |
@@ -1794,7 +1825,7 @@ nodes
| tstModuleES.mts:2:34:2:36 | [Literal] 'a' | semmle.label | [Literal] 'a' |
| tstModuleES.mts:2:40:2:42 | [Literal] 'b' | semmle.label | [Literal] 'b' |
| tstSuffixA.ts:1:1:3:1 | [ExportDeclaration] export ... .ts'; } | semmle.label | [ExportDeclaration] export ... .ts'; } |
-| tstSuffixA.ts:1:1:3:1 | [ExportDeclaration] export ... .ts'; } | semmle.order | 92 |
+| tstSuffixA.ts:1:1:3:1 | [ExportDeclaration] export ... .ts'; } | semmle.order | 93 |
| tstSuffixA.ts:1:8:3:1 | [FunctionDeclStmt] functio ... .ts'; } | semmle.label | [FunctionDeclStmt] functio ... .ts'; } |
| tstSuffixA.ts:1:17:1:28 | [VarDecl] resolvedFile | semmle.label | [VarDecl] resolvedFile |
| tstSuffixA.ts:1:33:1:47 | [LiteralTypeExpr] 'tstSuffixA.ts' | semmle.label | [LiteralTypeExpr] 'tstSuffixA.ts' |
@@ -1802,7 +1833,7 @@ nodes
| tstSuffixA.ts:2:5:2:27 | [ReturnStmt] return ... xA.ts'; | semmle.label | [ReturnStmt] return ... xA.ts'; |
| tstSuffixA.ts:2:12:2:26 | [Literal] 'tstSuffixA.ts' | semmle.label | [Literal] 'tstSuffixA.ts' |
| tstSuffixB.ios.ts:1:1:3:1 | [ExportDeclaration] export ... .ts'; } | semmle.label | [ExportDeclaration] export ... .ts'; } |
-| tstSuffixB.ios.ts:1:1:3:1 | [ExportDeclaration] export ... .ts'; } | semmle.order | 93 |
+| tstSuffixB.ios.ts:1:1:3:1 | [ExportDeclaration] export ... .ts'; } | semmle.order | 94 |
| tstSuffixB.ios.ts:1:8:3:1 | [FunctionDeclStmt] functio ... .ts'; } | semmle.label | [FunctionDeclStmt] functio ... .ts'; } |
| tstSuffixB.ios.ts:1:17:1:28 | [VarDecl] resolvedFile | semmle.label | [VarDecl] resolvedFile |
| tstSuffixB.ios.ts:1:33:1:51 | [LiteralTypeExpr] 'tstSuffixB.ios.ts' | semmle.label | [LiteralTypeExpr] 'tstSuffixB.ios.ts' |
@@ -1810,7 +1841,7 @@ nodes
| tstSuffixB.ios.ts:2:5:2:31 | [ReturnStmt] return ... os.ts'; | semmle.label | [ReturnStmt] return ... os.ts'; |
| tstSuffixB.ios.ts:2:12:2:30 | [Literal] 'tstSuffixB.ios.ts' | semmle.label | [Literal] 'tstSuffixB.ios.ts' |
| tstSuffixB.ts:1:1:3:1 | [ExportDeclaration] export ... .ts'; } | semmle.label | [ExportDeclaration] export ... .ts'; } |
-| tstSuffixB.ts:1:1:3:1 | [ExportDeclaration] export ... .ts'; } | semmle.order | 94 |
+| tstSuffixB.ts:1:1:3:1 | [ExportDeclaration] export ... .ts'; } | semmle.order | 95 |
| tstSuffixB.ts:1:8:3:1 | [FunctionDeclStmt] functio ... .ts'; } | semmle.label | [FunctionDeclStmt] functio ... .ts'; } |
| tstSuffixB.ts:1:17:1:28 | [VarDecl] resolvedFile | semmle.label | [VarDecl] resolvedFile |
| tstSuffixB.ts:1:33:1:47 | [LiteralTypeExpr] 'tstSuffixB.ts' | semmle.label | [LiteralTypeExpr] 'tstSuffixB.ts' |
@@ -1818,16 +1849,16 @@ nodes
| tstSuffixB.ts:2:5:2:27 | [ReturnStmt] return ... xB.ts'; | semmle.label | [ReturnStmt] return ... xB.ts'; |
| tstSuffixB.ts:2:12:2:26 | [Literal] 'tstSuffixB.ts' | semmle.label | [Literal] 'tstSuffixB.ts' |
| type_alias.ts:1:1:1:17 | [TypeAliasDeclaration,TypeDefinition] type B = boolean; | semmle.label | [TypeAliasDeclaration,TypeDefinition] type B = boolean; |
-| type_alias.ts:1:1:1:17 | [TypeAliasDeclaration,TypeDefinition] type B = boolean; | semmle.order | 95 |
+| type_alias.ts:1:1:1:17 | [TypeAliasDeclaration,TypeDefinition] type B = boolean; | semmle.order | 96 |
| type_alias.ts:1:6:1:6 | [Identifier] B | semmle.label | [Identifier] B |
| type_alias.ts:1:10:1:16 | [KeywordTypeExpr] boolean | semmle.label | [KeywordTypeExpr] boolean |
| type_alias.ts:3:1:3:9 | [DeclStmt] var b = ... | semmle.label | [DeclStmt] var b = ... |
-| type_alias.ts:3:1:3:9 | [DeclStmt] var b = ... | semmle.order | 96 |
+| type_alias.ts:3:1:3:9 | [DeclStmt] var b = ... | semmle.order | 97 |
| type_alias.ts:3:5:3:5 | [VarDecl] b | semmle.label | [VarDecl] b |
| type_alias.ts:3:5:3:8 | [VariableDeclarator] b: B | semmle.label | [VariableDeclarator] b: B |
| type_alias.ts:3:8:3:8 | [LocalTypeAccess] B | semmle.label | [LocalTypeAccess] B |
| type_alias.ts:5:1:5:50 | [TypeAliasDeclaration,TypeDefinition] type Va ... ay>; | semmle.label | [TypeAliasDeclaration,TypeDefinition] type Va ... ay>; |
-| type_alias.ts:5:1:5:50 | [TypeAliasDeclaration,TypeDefinition] type Va ... ay>; | semmle.order | 97 |
+| type_alias.ts:5:1:5:50 | [TypeAliasDeclaration,TypeDefinition] type Va ... ay>; | semmle.order | 98 |
| type_alias.ts:5:6:5:17 | [Identifier] ValueOrArray | semmle.label | [Identifier] ValueOrArray |
| type_alias.ts:5:19:5:19 | [Identifier] T | semmle.label | [Identifier] T |
| type_alias.ts:5:19:5:19 | [TypeParameter] T | semmle.label | [TypeParameter] T |
@@ -1839,14 +1870,14 @@ nodes
| type_alias.ts:5:34:5:48 | [GenericTypeExpr] ValueOrArray | semmle.label | [GenericTypeExpr] ValueOrArray |
| type_alias.ts:5:47:5:47 | [LocalTypeAccess] T | semmle.label | [LocalTypeAccess] T |
| type_alias.ts:7:1:7:28 | [DeclStmt] var c = ... | semmle.label | [DeclStmt] var c = ... |
-| type_alias.ts:7:1:7:28 | [DeclStmt] var c = ... | semmle.order | 98 |
+| type_alias.ts:7:1:7:28 | [DeclStmt] var c = ... | semmle.order | 99 |
| type_alias.ts:7:5:7:5 | [VarDecl] c | semmle.label | [VarDecl] c |
| type_alias.ts:7:5:7:27 | [VariableDeclarator] c: Valu ... number> | semmle.label | [VariableDeclarator] c: Valu ... number> |
| type_alias.ts:7:8:7:19 | [LocalTypeAccess] ValueOrArray | semmle.label | [LocalTypeAccess] ValueOrArray |
| type_alias.ts:7:8:7:27 | [GenericTypeExpr] ValueOrArray | semmle.label | [GenericTypeExpr] ValueOrArray |
| type_alias.ts:7:21:7:26 | [KeywordTypeExpr] number | semmle.label | [KeywordTypeExpr] number |
| type_alias.ts:9:1:15:13 | [TypeAliasDeclaration,TypeDefinition] type Js ... Json[]; | semmle.label | [TypeAliasDeclaration,TypeDefinition] type Js ... Json[]; |
-| type_alias.ts:9:1:15:13 | [TypeAliasDeclaration,TypeDefinition] type Js ... Json[]; | semmle.order | 99 |
+| type_alias.ts:9:1:15:13 | [TypeAliasDeclaration,TypeDefinition] type Js ... Json[]; | semmle.order | 100 |
| type_alias.ts:9:6:9:9 | [Identifier] Json | semmle.label | [Identifier] Json |
| type_alias.ts:10:5:15:12 | [UnionTypeExpr] \| strin ... Json[] | semmle.label | [UnionTypeExpr] \| strin ... Json[] |
| type_alias.ts:10:7:10:12 | [KeywordTypeExpr] string | semmle.label | [KeywordTypeExpr] string |
@@ -1862,12 +1893,12 @@ nodes
| type_alias.ts:15:7:15:10 | [LocalTypeAccess] Json | semmle.label | [LocalTypeAccess] Json |
| type_alias.ts:15:7:15:12 | [ArrayTypeExpr] Json[] | semmle.label | [ArrayTypeExpr] Json[] |
| type_alias.ts:17:1:17:15 | [DeclStmt] var json = ... | semmle.label | [DeclStmt] var json = ... |
-| type_alias.ts:17:1:17:15 | [DeclStmt] var json = ... | semmle.order | 100 |
+| type_alias.ts:17:1:17:15 | [DeclStmt] var json = ... | semmle.order | 101 |
| type_alias.ts:17:5:17:8 | [VarDecl] json | semmle.label | [VarDecl] json |
| type_alias.ts:17:5:17:14 | [VariableDeclarator] json: Json | semmle.label | [VariableDeclarator] json: Json |
| type_alias.ts:17:11:17:14 | [LocalTypeAccess] Json | semmle.label | [LocalTypeAccess] Json |
| type_alias.ts:19:1:21:57 | [TypeAliasDeclaration,TypeDefinition] type Vi ... ode[]]; | semmle.label | [TypeAliasDeclaration,TypeDefinition] type Vi ... ode[]]; |
-| type_alias.ts:19:1:21:57 | [TypeAliasDeclaration,TypeDefinition] type Vi ... ode[]]; | semmle.order | 101 |
+| type_alias.ts:19:1:21:57 | [TypeAliasDeclaration,TypeDefinition] type Vi ... ode[]]; | semmle.order | 102 |
| type_alias.ts:19:6:19:16 | [Identifier] VirtualNode | semmle.label | [Identifier] VirtualNode |
| type_alias.ts:20:5:21:56 | [UnionTypeExpr] \| strin ... Node[]] | semmle.label | [UnionTypeExpr] \| strin ... Node[]] |
| type_alias.ts:20:7:20:12 | [KeywordTypeExpr] string | semmle.label | [KeywordTypeExpr] string |
@@ -1883,7 +1914,7 @@ nodes
| type_alias.ts:21:43:21:53 | [LocalTypeAccess] VirtualNode | semmle.label | [LocalTypeAccess] VirtualNode |
| type_alias.ts:21:43:21:55 | [ArrayTypeExpr] VirtualNode[] | semmle.label | [ArrayTypeExpr] VirtualNode[] |
| type_alias.ts:23:1:27:6 | [DeclStmt] const myNode = ... | semmle.label | [DeclStmt] const myNode = ... |
-| type_alias.ts:23:1:27:6 | [DeclStmt] const myNode = ... | semmle.order | 102 |
+| type_alias.ts:23:1:27:6 | [DeclStmt] const myNode = ... | semmle.order | 103 |
| type_alias.ts:23:7:23:12 | [VarDecl] myNode | semmle.label | [VarDecl] myNode |
| type_alias.ts:23:7:27:5 | [VariableDeclarator] myNode: ... ] ] | semmle.label | [VariableDeclarator] myNode: ... ] ] |
| type_alias.ts:23:15:23:25 | [LocalTypeAccess] VirtualNode | semmle.label | [LocalTypeAccess] VirtualNode |
@@ -1908,12 +1939,12 @@ nodes
| type_alias.ts:26:23:26:36 | [Literal] "second-child" | semmle.label | [Literal] "second-child" |
| type_alias.ts:26:41:26:62 | [Literal] "I'm the second child" | semmle.label | [Literal] "I'm the second child" |
| type_definition_objects.ts:1:1:1:33 | [ImportDeclaration] import ... dummy"; | semmle.label | [ImportDeclaration] import ... dummy"; |
-| type_definition_objects.ts:1:1:1:33 | [ImportDeclaration] import ... dummy"; | semmle.order | 103 |
+| type_definition_objects.ts:1:1:1:33 | [ImportDeclaration] import ... dummy"; | semmle.order | 104 |
| type_definition_objects.ts:1:8:1:17 | [ImportSpecifier] * as dummy | semmle.label | [ImportSpecifier] * as dummy |
| type_definition_objects.ts:1:13:1:17 | [VarDecl] dummy | semmle.label | [VarDecl] dummy |
| type_definition_objects.ts:1:24:1:32 | [Literal] "./dummy" | semmle.label | [Literal] "./dummy" |
| type_definition_objects.ts:3:1:3:17 | [ExportDeclaration] export class C {} | semmle.label | [ExportDeclaration] export class C {} |
-| type_definition_objects.ts:3:1:3:17 | [ExportDeclaration] export class C {} | semmle.order | 104 |
+| type_definition_objects.ts:3:1:3:17 | [ExportDeclaration] export class C {} | semmle.order | 105 |
| type_definition_objects.ts:3:8:3:17 | [ClassDefinition,TypeDefinition] class C {} | semmle.label | [ClassDefinition,TypeDefinition] class C {} |
| type_definition_objects.ts:3:14:3:14 | [VarDecl] C | semmle.label | [VarDecl] C |
| type_definition_objects.ts:3:16:3:15 | [BlockStmt] {} | semmle.label | [BlockStmt] {} |
@@ -1921,36 +1952,36 @@ nodes
| type_definition_objects.ts:3:16:3:15 | [FunctionExpr] () {} | semmle.label | [FunctionExpr] () {} |
| type_definition_objects.ts:3:16:3:15 | [Label] constructor | semmle.label | [Label] constructor |
| type_definition_objects.ts:4:1:4:17 | [DeclStmt] let classObj = ... | semmle.label | [DeclStmt] let classObj = ... |
-| type_definition_objects.ts:4:1:4:17 | [DeclStmt] let classObj = ... | semmle.order | 105 |
+| type_definition_objects.ts:4:1:4:17 | [DeclStmt] let classObj = ... | semmle.order | 106 |
| type_definition_objects.ts:4:5:4:12 | [VarDecl] classObj | semmle.label | [VarDecl] classObj |
| type_definition_objects.ts:4:5:4:16 | [VariableDeclarator] classObj = C | semmle.label | [VariableDeclarator] classObj = C |
| type_definition_objects.ts:4:16:4:16 | [VarRef] C | semmle.label | [VarRef] C |
| type_definition_objects.ts:6:1:6:16 | [ExportDeclaration] export enum E {} | semmle.label | [ExportDeclaration] export enum E {} |
-| type_definition_objects.ts:6:1:6:16 | [ExportDeclaration] export enum E {} | semmle.order | 106 |
+| type_definition_objects.ts:6:1:6:16 | [ExportDeclaration] export enum E {} | semmle.order | 107 |
| type_definition_objects.ts:6:8:6:16 | [EnumDeclaration,TypeDefinition] enum E {} | semmle.label | [EnumDeclaration,TypeDefinition] enum E {} |
| type_definition_objects.ts:6:13:6:13 | [VarDecl] E | semmle.label | [VarDecl] E |
| type_definition_objects.ts:7:1:7:16 | [DeclStmt] let enumObj = ... | semmle.label | [DeclStmt] let enumObj = ... |
-| type_definition_objects.ts:7:1:7:16 | [DeclStmt] let enumObj = ... | semmle.order | 107 |
+| type_definition_objects.ts:7:1:7:16 | [DeclStmt] let enumObj = ... | semmle.order | 108 |
| type_definition_objects.ts:7:5:7:11 | [VarDecl] enumObj | semmle.label | [VarDecl] enumObj |
| type_definition_objects.ts:7:5:7:15 | [VariableDeclarator] enumObj = E | semmle.label | [VariableDeclarator] enumObj = E |
| type_definition_objects.ts:7:15:7:15 | [VarRef] E | semmle.label | [VarRef] E |
| type_definition_objects.ts:9:1:9:22 | [ExportDeclaration] export ... e N {;} | semmle.label | [ExportDeclaration] export ... e N {;} |
-| type_definition_objects.ts:9:1:9:22 | [ExportDeclaration] export ... e N {;} | semmle.order | 108 |
+| type_definition_objects.ts:9:1:9:22 | [ExportDeclaration] export ... e N {;} | semmle.order | 109 |
| type_definition_objects.ts:9:8:9:22 | [NamespaceDeclaration] namespace N {;} | semmle.label | [NamespaceDeclaration] namespace N {;} |
| type_definition_objects.ts:9:18:9:18 | [VarDecl] N | semmle.label | [VarDecl] N |
| type_definition_objects.ts:9:21:9:21 | [EmptyStmt] ; | semmle.label | [EmptyStmt] ; |
| type_definition_objects.ts:10:1:10:21 | [DeclStmt] let namespaceObj = ... | semmle.label | [DeclStmt] let namespaceObj = ... |
-| type_definition_objects.ts:10:1:10:21 | [DeclStmt] let namespaceObj = ... | semmle.order | 109 |
+| type_definition_objects.ts:10:1:10:21 | [DeclStmt] let namespaceObj = ... | semmle.order | 110 |
| type_definition_objects.ts:10:5:10:16 | [VarDecl] namespaceObj | semmle.label | [VarDecl] namespaceObj |
| type_definition_objects.ts:10:5:10:20 | [VariableDeclarator] namespaceObj = N | semmle.label | [VariableDeclarator] namespaceObj = N |
| type_definition_objects.ts:10:20:10:20 | [VarRef] N | semmle.label | [VarRef] N |
| type_definitions.ts:1:1:1:33 | [ImportDeclaration] import ... dummy"; | semmle.label | [ImportDeclaration] import ... dummy"; |
-| type_definitions.ts:1:1:1:33 | [ImportDeclaration] import ... dummy"; | semmle.order | 110 |
+| type_definitions.ts:1:1:1:33 | [ImportDeclaration] import ... dummy"; | semmle.order | 111 |
| type_definitions.ts:1:8:1:17 | [ImportSpecifier] * as dummy | semmle.label | [ImportSpecifier] * as dummy |
| type_definitions.ts:1:13:1:17 | [VarDecl] dummy | semmle.label | [VarDecl] dummy |
| type_definitions.ts:1:24:1:32 | [Literal] "./dummy" | semmle.label | [Literal] "./dummy" |
| type_definitions.ts:3:1:5:1 | [InterfaceDeclaration,TypeDefinition] interfa ... x: S; } | semmle.label | [InterfaceDeclaration,TypeDefinition] interfa ... x: S; } |
-| type_definitions.ts:3:1:5:1 | [InterfaceDeclaration,TypeDefinition] interfa ... x: S; } | semmle.order | 111 |
+| type_definitions.ts:3:1:5:1 | [InterfaceDeclaration,TypeDefinition] interfa ... x: S; } | semmle.order | 112 |
| type_definitions.ts:3:11:3:11 | [Identifier] I | semmle.label | [Identifier] I |
| type_definitions.ts:3:13:3:13 | [Identifier] S | semmle.label | [Identifier] S |
| type_definitions.ts:3:13:3:13 | [TypeParameter] S | semmle.label | [TypeParameter] S |
@@ -1958,14 +1989,14 @@ nodes
| type_definitions.ts:4:3:4:7 | [FieldDeclaration] x: S; | semmle.label | [FieldDeclaration] x: S; |
| type_definitions.ts:4:6:4:6 | [LocalTypeAccess] S | semmle.label | [LocalTypeAccess] S |
| type_definitions.ts:6:1:6:16 | [DeclStmt] let i = ... | semmle.label | [DeclStmt] let i = ... |
-| type_definitions.ts:6:1:6:16 | [DeclStmt] let i = ... | semmle.order | 112 |
+| type_definitions.ts:6:1:6:16 | [DeclStmt] let i = ... | semmle.order | 113 |
| type_definitions.ts:6:5:6:5 | [VarDecl] i | semmle.label | [VarDecl] i |
| type_definitions.ts:6:5:6:16 | [VariableDeclarator] i: I | semmle.label | [VariableDeclarator] i: I |
| type_definitions.ts:6:8:6:8 | [LocalTypeAccess] I | semmle.label | [LocalTypeAccess] I |
| type_definitions.ts:6:8:6:16 | [GenericTypeExpr] I | semmle.label | [GenericTypeExpr] I |
| type_definitions.ts:6:10:6:15 | [KeywordTypeExpr] number | semmle.label | [KeywordTypeExpr] number |
| type_definitions.ts:8:1:10:1 | [ClassDefinition,TypeDefinition] class C ... x: T } | semmle.label | [ClassDefinition,TypeDefinition] class C ... x: T } |
-| type_definitions.ts:8:1:10:1 | [ClassDefinition,TypeDefinition] class C ... x: T } | semmle.order | 113 |
+| type_definitions.ts:8:1:10:1 | [ClassDefinition,TypeDefinition] class C ... x: T } | semmle.order | 114 |
| type_definitions.ts:8:7:8:7 | [VarDecl] C | semmle.label | [VarDecl] C |
| type_definitions.ts:8:8:8:7 | [BlockStmt] {} | semmle.label | [BlockStmt] {} |
| type_definitions.ts:8:8:8:7 | [ClassInitializedMember,ConstructorDefinition] constructor() {} | semmle.label | [ClassInitializedMember,ConstructorDefinition] constructor() {} |
@@ -1977,14 +2008,14 @@ nodes
| type_definitions.ts:9:3:9:6 | [FieldDeclaration] x: T | semmle.label | [FieldDeclaration] x: T |
| type_definitions.ts:9:6:9:6 | [LocalTypeAccess] T | semmle.label | [LocalTypeAccess] T |
| type_definitions.ts:11:1:11:17 | [DeclStmt] let c = ... | semmle.label | [DeclStmt] let c = ... |
-| type_definitions.ts:11:1:11:17 | [DeclStmt] let c = ... | semmle.order | 114 |
+| type_definitions.ts:11:1:11:17 | [DeclStmt] let c = ... | semmle.order | 115 |
| type_definitions.ts:11:5:11:5 | [VarDecl] c | semmle.label | [VarDecl] c |
| type_definitions.ts:11:5:11:16 | [VariableDeclarator] c: C | semmle.label | [VariableDeclarator] c: C |
| type_definitions.ts:11:8:11:8 | [LocalTypeAccess] C | semmle.label | [LocalTypeAccess] C |
| type_definitions.ts:11:8:11:16 | [GenericTypeExpr] C | semmle.label | [GenericTypeExpr] C |
| type_definitions.ts:11:10:11:15 | [KeywordTypeExpr] number | semmle.label | [KeywordTypeExpr] number |
| type_definitions.ts:13:1:15:1 | [EnumDeclaration,TypeDefinition] enum Co ... blue } | semmle.label | [EnumDeclaration,TypeDefinition] enum Co ... blue } |
-| type_definitions.ts:13:1:15:1 | [EnumDeclaration,TypeDefinition] enum Co ... blue } | semmle.order | 115 |
+| type_definitions.ts:13:1:15:1 | [EnumDeclaration,TypeDefinition] enum Co ... blue } | semmle.order | 116 |
| type_definitions.ts:13:6:13:10 | [VarDecl] Color | semmle.label | [VarDecl] Color |
| type_definitions.ts:14:3:14:5 | [EnumMember,TypeDefinition] red | semmle.label | [EnumMember,TypeDefinition] red |
| type_definitions.ts:14:3:14:5 | [VarDecl] red | semmle.label | [VarDecl] red |
@@ -1993,29 +2024,29 @@ nodes
| type_definitions.ts:14:15:14:18 | [EnumMember,TypeDefinition] blue | semmle.label | [EnumMember,TypeDefinition] blue |
| type_definitions.ts:14:15:14:18 | [VarDecl] blue | semmle.label | [VarDecl] blue |
| type_definitions.ts:16:1:16:17 | [DeclStmt] let color = ... | semmle.label | [DeclStmt] let color = ... |
-| type_definitions.ts:16:1:16:17 | [DeclStmt] let color = ... | semmle.order | 116 |
+| type_definitions.ts:16:1:16:17 | [DeclStmt] let color = ... | semmle.order | 117 |
| type_definitions.ts:16:5:16:9 | [VarDecl] color | semmle.label | [VarDecl] color |
| type_definitions.ts:16:5:16:16 | [VariableDeclarator] color: Color | semmle.label | [VariableDeclarator] color: Color |
| type_definitions.ts:16:12:16:16 | [LocalTypeAccess] Color | semmle.label | [LocalTypeAccess] Color |
| type_definitions.ts:18:1:18:33 | [EnumDeclaration,TypeDefinition] enum En ... ember } | semmle.label | [EnumDeclaration,TypeDefinition] enum En ... ember } |
-| type_definitions.ts:18:1:18:33 | [EnumDeclaration,TypeDefinition] enum En ... ember } | semmle.order | 117 |
+| type_definitions.ts:18:1:18:33 | [EnumDeclaration,TypeDefinition] enum En ... ember } | semmle.order | 118 |
| type_definitions.ts:18:6:18:22 | [VarDecl] EnumWithOneMember | semmle.label | [VarDecl] EnumWithOneMember |
| type_definitions.ts:18:26:18:31 | [EnumMember,TypeDefinition] member | semmle.label | [EnumMember,TypeDefinition] member |
| type_definitions.ts:18:26:18:31 | [VarDecl] member | semmle.label | [VarDecl] member |
| type_definitions.ts:19:1:19:25 | [DeclStmt] let e = ... | semmle.label | [DeclStmt] let e = ... |
-| type_definitions.ts:19:1:19:25 | [DeclStmt] let e = ... | semmle.order | 118 |
+| type_definitions.ts:19:1:19:25 | [DeclStmt] let e = ... | semmle.order | 119 |
| type_definitions.ts:19:5:19:5 | [VarDecl] e | semmle.label | [VarDecl] e |
| type_definitions.ts:19:5:19:24 | [VariableDeclarator] e: EnumWithOneMember | semmle.label | [VariableDeclarator] e: EnumWithOneMember |
| type_definitions.ts:19:8:19:24 | [LocalTypeAccess] EnumWithOneMember | semmle.label | [LocalTypeAccess] EnumWithOneMember |
| type_definitions.ts:21:1:21:20 | [TypeAliasDeclaration,TypeDefinition] type Alias = T[]; | semmle.label | [TypeAliasDeclaration,TypeDefinition] type Alias = T[]; |
-| type_definitions.ts:21:1:21:20 | [TypeAliasDeclaration,TypeDefinition] type Alias = T[]; | semmle.order | 119 |
+| type_definitions.ts:21:1:21:20 | [TypeAliasDeclaration,TypeDefinition] type Alias = T[]; | semmle.order | 120 |
| type_definitions.ts:21:6:21:10 | [Identifier] Alias | semmle.label | [Identifier] Alias |
| type_definitions.ts:21:12:21:12 | [Identifier] T | semmle.label | [Identifier] T |
| type_definitions.ts:21:12:21:12 | [TypeParameter] T | semmle.label | [TypeParameter] T |
| type_definitions.ts:21:17:21:17 | [LocalTypeAccess] T | semmle.label | [LocalTypeAccess] T |
| type_definitions.ts:21:17:21:19 | [ArrayTypeExpr] T[] | semmle.label | [ArrayTypeExpr] T[] |
| type_definitions.ts:22:1:22:39 | [DeclStmt] let aliasForNumberArray = ... | semmle.label | [DeclStmt] let aliasForNumberArray = ... |
-| type_definitions.ts:22:1:22:39 | [DeclStmt] let aliasForNumberArray = ... | semmle.order | 120 |
+| type_definitions.ts:22:1:22:39 | [DeclStmt] let aliasForNumberArray = ... | semmle.order | 121 |
| type_definitions.ts:22:5:22:23 | [VarDecl] aliasForNumberArray | semmle.label | [VarDecl] aliasForNumberArray |
| type_definitions.ts:22:5:22:38 | [VariableDeclarator] aliasFo ... number> | semmle.label | [VariableDeclarator] aliasFo ... number> |
| type_definitions.ts:22:26:22:30 | [LocalTypeAccess] Alias | semmle.label | [LocalTypeAccess] Alias |
@@ -2216,6 +2247,10 @@ edges
| file://:0:0:0:0 | (Arguments) | tst.ts:478:17:478:42 | [IndexExpr] SomeCla ... tadata] | semmle.order | 0 |
| file://:0:0:0:0 | (Arguments) | tst.ts:483:17:483:58 | [SatisfiesExpr] ["hello ... string> | semmle.label | 0 |
| file://:0:0:0:0 | (Arguments) | tst.ts:483:17:483:58 | [SatisfiesExpr] ["hello ... string> | semmle.order | 0 |
+| file://:0:0:0:0 | (Arguments) | tst.ts:491:21:491:46 | [ArrayExpr] ["red", ... green"] | semmle.label | 0 |
+| file://:0:0:0:0 | (Arguments) | tst.ts:491:21:491:46 | [ArrayExpr] ["red", ... green"] | semmle.order | 0 |
+| file://:0:0:0:0 | (Arguments) | tst.ts:491:49:491:56 | [Literal] "yellow" | semmle.label | 1 |
+| file://:0:0:0:0 | (Arguments) | tst.ts:491:49:491:56 | [Literal] "yellow" | semmle.order | 1 |
| file://:0:0:0:0 | (Parameters) | tst.ts:14:17:14:17 | [SimpleParameter] x | semmle.label | 0 |
| file://:0:0:0:0 | (Parameters) | tst.ts:14:17:14:17 | [SimpleParameter] x | semmle.order | 0 |
| file://:0:0:0:0 | (Parameters) | tst.ts:14:28:14:28 | [SimpleParameter] y | semmle.label | 1 |
@@ -2314,6 +2349,10 @@ edges
| file://:0:0:0:0 | (Parameters) | tst.ts:474:12:474:18 | [SimpleParameter] _target | semmle.order | 0 |
| file://:0:0:0:0 | (Parameters) | tst.ts:474:21:474:28 | [SimpleParameter] _context | semmle.label | 1 |
| file://:0:0:0:0 | (Parameters) | tst.ts:474:21:474:28 | [SimpleParameter] _context | semmle.order | 1 |
+| file://:0:0:0:0 | (Parameters) | tst.ts:487:48:487:53 | [SimpleParameter] colors | semmle.label | 0 |
+| file://:0:0:0:0 | (Parameters) | tst.ts:487:48:487:53 | [SimpleParameter] colors | semmle.order | 0 |
+| file://:0:0:0:0 | (Parameters) | tst.ts:487:61:487:72 | [SimpleParameter] defaultColor | semmle.label | 1 |
+| file://:0:0:0:0 | (Parameters) | tst.ts:487:61:487:72 | [SimpleParameter] defaultColor | semmle.order | 1 |
| file://:0:0:0:0 | (Parameters) | type_alias.ts:14:10:14:17 | [SimpleParameter] property | semmle.label | 0 |
| file://:0:0:0:0 | (Parameters) | type_alias.ts:14:10:14:17 | [SimpleParameter] property | semmle.order | 0 |
| file://:0:0:0:0 | (Parameters) | type_alias.ts:21:19:21:21 | [SimpleParameter] key | semmle.label | 0 |
@@ -2346,6 +2385,8 @@ edges
| file://:0:0:0:0 | (TypeParameters) | tst.ts:462:40:462:72 | [TypeParameter] const T ... tring[] | semmle.order | 0 |
| file://:0:0:0:0 | (TypeParameters) | tst.ts:481:16:481:16 | [TypeParameter] T | semmle.label | 0 |
| file://:0:0:0:0 | (TypeParameters) | tst.ts:481:16:481:16 | [TypeParameter] T | semmle.order | 0 |
+| file://:0:0:0:0 | (TypeParameters) | tst.ts:487:30:487:45 | [TypeParameter] C extends string | semmle.label | 0 |
+| file://:0:0:0:0 | (TypeParameters) | tst.ts:487:30:487:45 | [TypeParameter] C extends string | semmle.order | 0 |
| file://:0:0:0:0 | (TypeParameters) | type_alias.ts:5:19:5:19 | [TypeParameter] T | semmle.label | 0 |
| file://:0:0:0:0 | (TypeParameters) | type_alias.ts:5:19:5:19 | [TypeParameter] T | semmle.order | 0 |
| file://:0:0:0:0 | (TypeParameters) | type_definitions.ts:3:13:3:13 | [TypeParameter] S | semmle.label | 0 |
@@ -5182,6 +5223,54 @@ edges
| tst.ts:483:46:483:58 | [GenericTypeExpr] Pair3 | tst.ts:483:46:483:50 | [LocalTypeAccess] Pair3 | semmle.order | 1 |
| tst.ts:483:46:483:58 | [GenericTypeExpr] Pair3 | tst.ts:483:52:483:57 | [KeywordTypeExpr] string | semmle.label | 2 |
| tst.ts:483:46:483:58 | [GenericTypeExpr] Pair3 | tst.ts:483:52:483:57 | [KeywordTypeExpr] string | semmle.order | 2 |
+| tst.ts:486:1:492:1 | [NamespaceDeclaration] module ... ow"); } | tst.ts:486:8:486:11 | [VarDecl] TS54 | semmle.label | 1 |
+| tst.ts:486:1:492:1 | [NamespaceDeclaration] module ... ow"); } | tst.ts:486:8:486:11 | [VarDecl] TS54 | semmle.order | 1 |
+| tst.ts:486:1:492:1 | [NamespaceDeclaration] module ... ow"); } | tst.ts:487:3:489:3 | [FunctionDeclStmt] functio ... 0]; } | semmle.label | 2 |
+| tst.ts:486:1:492:1 | [NamespaceDeclaration] module ... ow"); } | tst.ts:487:3:489:3 | [FunctionDeclStmt] functio ... 0]; } | semmle.order | 2 |
+| tst.ts:486:1:492:1 | [NamespaceDeclaration] module ... ow"); } | tst.ts:491:3:491:58 | [ExprStmt] createS ... llow"); | semmle.label | 3 |
+| tst.ts:486:1:492:1 | [NamespaceDeclaration] module ... ow"); } | tst.ts:491:3:491:58 | [ExprStmt] createS ... llow"); | semmle.order | 3 |
+| tst.ts:487:3:489:3 | [FunctionDeclStmt] functio ... 0]; } | file://:0:0:0:0 | (Parameters) | semmle.label | 1 |
+| tst.ts:487:3:489:3 | [FunctionDeclStmt] functio ... 0]; } | file://:0:0:0:0 | (Parameters) | semmle.order | 1 |
+| tst.ts:487:3:489:3 | [FunctionDeclStmt] functio ... 0]; } | file://:0:0:0:0 | (TypeParameters) | semmle.label | 2 |
+| tst.ts:487:3:489:3 | [FunctionDeclStmt] functio ... 0]; } | file://:0:0:0:0 | (TypeParameters) | semmle.order | 2 |
+| tst.ts:487:3:489:3 | [FunctionDeclStmt] functio ... 0]; } | tst.ts:487:12:487:28 | [VarDecl] createStreetLight | semmle.label | 0 |
+| tst.ts:487:3:489:3 | [FunctionDeclStmt] functio ... 0]; } | tst.ts:487:12:487:28 | [VarDecl] createStreetLight | semmle.order | 0 |
+| tst.ts:487:3:489:3 | [FunctionDeclStmt] functio ... 0]; } | tst.ts:487:88:489:3 | [BlockStmt] { r ... 0]; } | semmle.label | 5 |
+| tst.ts:487:3:489:3 | [FunctionDeclStmt] functio ... 0]; } | tst.ts:487:88:489:3 | [BlockStmt] { r ... 0]; } | semmle.order | 5 |
+| tst.ts:487:30:487:45 | [TypeParameter] C extends string | tst.ts:487:30:487:30 | [Identifier] C | semmle.label | 1 |
+| tst.ts:487:30:487:45 | [TypeParameter] C extends string | tst.ts:487:30:487:30 | [Identifier] C | semmle.order | 1 |
+| tst.ts:487:30:487:45 | [TypeParameter] C extends string | tst.ts:487:40:487:45 | [KeywordTypeExpr] string | semmle.label | 2 |
+| tst.ts:487:30:487:45 | [TypeParameter] C extends string | tst.ts:487:40:487:45 | [KeywordTypeExpr] string | semmle.order | 2 |
+| tst.ts:487:48:487:53 | [SimpleParameter] colors | tst.ts:487:56:487:58 | [ArrayTypeExpr] C[] | semmle.label | -2 |
+| tst.ts:487:48:487:53 | [SimpleParameter] colors | tst.ts:487:56:487:58 | [ArrayTypeExpr] C[] | semmle.order | -2 |
+| tst.ts:487:56:487:58 | [ArrayTypeExpr] C[] | tst.ts:487:56:487:56 | [LocalTypeAccess] C | semmle.label | 1 |
+| tst.ts:487:56:487:58 | [ArrayTypeExpr] C[] | tst.ts:487:56:487:56 | [LocalTypeAccess] C | semmle.order | 1 |
+| tst.ts:487:61:487:72 | [SimpleParameter] defaultColor | tst.ts:487:76:487:85 | [GenericTypeExpr] NoInfer | semmle.label | -2 |
+| tst.ts:487:61:487:72 | [SimpleParameter] defaultColor | tst.ts:487:76:487:85 | [GenericTypeExpr] NoInfer | semmle.order | -2 |
+| tst.ts:487:76:487:85 | [GenericTypeExpr] NoInfer | tst.ts:487:76:487:82 | [LocalTypeAccess] NoInfer | semmle.label | 1 |
+| tst.ts:487:76:487:85 | [GenericTypeExpr] NoInfer | tst.ts:487:76:487:82 | [LocalTypeAccess] NoInfer | semmle.order | 1 |
+| tst.ts:487:76:487:85 | [GenericTypeExpr] NoInfer | tst.ts:487:84:487:84 | [LocalTypeAccess] C | semmle.label | 2 |
+| tst.ts:487:76:487:85 | [GenericTypeExpr] NoInfer | tst.ts:487:84:487:84 | [LocalTypeAccess] C | semmle.order | 2 |
+| tst.ts:487:88:489:3 | [BlockStmt] { r ... 0]; } | tst.ts:488:5:488:21 | [ReturnStmt] return colors[0]; | semmle.label | 1 |
+| tst.ts:487:88:489:3 | [BlockStmt] { r ... 0]; } | tst.ts:488:5:488:21 | [ReturnStmt] return colors[0]; | semmle.order | 1 |
+| tst.ts:488:5:488:21 | [ReturnStmt] return colors[0]; | tst.ts:488:12:488:20 | [IndexExpr] colors[0] | semmle.label | 1 |
+| tst.ts:488:5:488:21 | [ReturnStmt] return colors[0]; | tst.ts:488:12:488:20 | [IndexExpr] colors[0] | semmle.order | 1 |
+| tst.ts:488:12:488:20 | [IndexExpr] colors[0] | tst.ts:488:12:488:17 | [VarRef] colors | semmle.label | 1 |
+| tst.ts:488:12:488:20 | [IndexExpr] colors[0] | tst.ts:488:12:488:17 | [VarRef] colors | semmle.order | 1 |
+| tst.ts:488:12:488:20 | [IndexExpr] colors[0] | tst.ts:488:19:488:19 | [Literal] 0 | semmle.label | 2 |
+| tst.ts:488:12:488:20 | [IndexExpr] colors[0] | tst.ts:488:19:488:19 | [Literal] 0 | semmle.order | 2 |
+| tst.ts:491:3:491:57 | [CallExpr] createS ... ellow") | file://:0:0:0:0 | (Arguments) | semmle.label | 1 |
+| tst.ts:491:3:491:57 | [CallExpr] createS ... ellow") | file://:0:0:0:0 | (Arguments) | semmle.order | 1 |
+| tst.ts:491:3:491:57 | [CallExpr] createS ... ellow") | tst.ts:491:3:491:19 | [VarRef] createStreetLight | semmle.label | 0 |
+| tst.ts:491:3:491:57 | [CallExpr] createS ... ellow") | tst.ts:491:3:491:19 | [VarRef] createStreetLight | semmle.order | 0 |
+| tst.ts:491:3:491:58 | [ExprStmt] createS ... llow"); | tst.ts:491:3:491:57 | [CallExpr] createS ... ellow") | semmle.label | 1 |
+| tst.ts:491:3:491:58 | [ExprStmt] createS ... llow"); | tst.ts:491:3:491:57 | [CallExpr] createS ... ellow") | semmle.order | 1 |
+| tst.ts:491:21:491:46 | [ArrayExpr] ["red", ... green"] | tst.ts:491:22:491:26 | [Literal] "red" | semmle.label | 1 |
+| tst.ts:491:21:491:46 | [ArrayExpr] ["red", ... green"] | tst.ts:491:22:491:26 | [Literal] "red" | semmle.order | 1 |
+| tst.ts:491:21:491:46 | [ArrayExpr] ["red", ... green"] | tst.ts:491:29:491:36 | [Literal] "yellow" | semmle.label | 2 |
+| tst.ts:491:21:491:46 | [ArrayExpr] ["red", ... green"] | tst.ts:491:29:491:36 | [Literal] "yellow" | semmle.order | 2 |
+| tst.ts:491:21:491:46 | [ArrayExpr] ["red", ... green"] | tst.ts:491:39:491:45 | [Literal] "green" | semmle.label | 3 |
+| tst.ts:491:21:491:46 | [ArrayExpr] ["red", ... green"] | tst.ts:491:39:491:45 | [Literal] "green" | semmle.order | 3 |
| tstModuleCJS.cts:1:1:3:1 | [ExportDeclaration] export ... 'b'; } | tstModuleCJS.cts:1:8:3:1 | [FunctionDeclStmt] functio ... 'b'; } | semmle.label | 1 |
| tstModuleCJS.cts:1:1:3:1 | [ExportDeclaration] export ... 'b'; } | tstModuleCJS.cts:1:8:3:1 | [FunctionDeclStmt] functio ... 'b'; } | semmle.order | 1 |
| tstModuleCJS.cts:1:8:3:1 | [FunctionDeclStmt] functio ... 'b'; } | tstModuleCJS.cts:1:17:1:28 | [VarDecl] tstModuleCJS | semmle.label | 0 |
diff --git a/javascript/ql/test/library-tests/TypeScript/Types/tests.expected b/javascript/ql/test/library-tests/TypeScript/Types/tests.expected
index 986ae56a664..49a1f1e000f 100644
--- a/javascript/ql/test/library-tests/TypeScript/Types/tests.expected
+++ b/javascript/ql/test/library-tests/TypeScript/Types/tests.expected
@@ -658,6 +658,17 @@ getExprType
| tst.ts:483:17:483:58 | ["hello ... string> | [first: string, string] |
| tst.ts:483:18:483:24 | "hello" | "hello" |
| tst.ts:483:27:483:33 | "world" | "world" |
+| tst.ts:486:8:486:11 | TS54 | typeof TS54 in library-tests/TypeScript/Types/tst.ts |
+| tst.ts:487:48:487:53 | colors | C[] |
+| tst.ts:488:12:488:17 | colors | C[] |
+| tst.ts:488:12:488:20 | colors[0] | C |
+| tst.ts:488:19:488:19 | 0 | 0 |
+| tst.ts:491:3:491:57 | createS ... ellow") | "red" \| "green" \| "yellow" |
+| tst.ts:491:21:491:46 | ["red", ... green"] | ("red" \| "green" \| "yellow")[] |
+| tst.ts:491:22:491:26 | "red" | "red" |
+| tst.ts:491:29:491:36 | "yellow" | "yellow" |
+| tst.ts:491:39:491:45 | "green" | "green" |
+| tst.ts:491:49:491:56 | "yellow" | "yellow" |
| tstModuleCJS.cts:1:17:1:28 | tstModuleCJS | () => "a" \| "b" |
| tstModuleCJS.cts:2:12:2:15 | Math | Math |
| tstModuleCJS.cts:2:12:2:22 | Math.random | () => number |
@@ -1138,6 +1149,12 @@ getTypeExprType
| tst.ts:483:46:483:50 | Pair3 | Pair3 |
| tst.ts:483:46:483:58 | Pair3 | Pair3 |
| tst.ts:483:52:483:57 | string | string |
+| tst.ts:487:30:487:30 | C | C |
+| tst.ts:487:40:487:45 | string | string |
+| tst.ts:487:56:487:56 | C | C |
+| tst.ts:487:56:487:58 | C[] | C[] |
+| tst.ts:487:76:487:82 | NoInfer | any |
+| tst.ts:487:84:487:84 | C | C |
| tstModuleCJS.cts:1:33:1:35 | 'a' | "a" |
| tstModuleCJS.cts:1:33:1:41 | 'a' \| 'b' | "a" \| "b" |
| tstModuleCJS.cts:1:39:1:41 | 'b' | "b" |
@@ -1359,16 +1376,19 @@ unionIndex
| "circle" | 0 | "circle" \| "square" |
| "function" | 7 | "string" \| "number" \| "bigint" \| "boolean" \| "s... |
| "green" | 1 | "red" \| "green" \| "blue" |
+| "green" | 1 | "red" \| "green" \| "yellow" |
| "hello" | 0 | "hello" \| 42 |
| "number" | 1 | "string" \| "number" \| "bigint" \| "boolean" \| "s... |
| "number" | 1 | keyof TypeMap |
| "object" | 6 | "string" \| "number" \| "bigint" \| "boolean" \| "s... |
| "red" | 0 | "red" \| "green" \| "blue" |
+| "red" | 0 | "red" \| "green" \| "yellow" |
| "square" | 1 | "circle" \| "square" |
| "string" | 0 | "string" \| "number" \| "bigint" \| "boolean" \| "s... |
| "string" | 0 | keyof TypeMap |
| "symbol" | 4 | "string" \| "number" \| "bigint" \| "boolean" \| "s... |
| "undefined" | 5 | "string" \| "number" \| "bigint" \| "boolean" \| "s... |
+| "yellow" | 2 | "red" \| "green" \| "yellow" |
| () => number | 0 | (() => number) \| (ClassMethodDecoratorContext number | 1 | void \| (() => number) |
| ClassMethodDecoratorContext numbe... | 1 | (() => number) \| (ClassMethodDecoratorContext = [first: T, T];
console.log(["hello", "world"] satisfies Pair3);
+}
+
+module TS54 {
+ function createStreetLight(colors: C[], defaultColor?: NoInfer) {
+ return colors[0];
+ }
+
+ createStreetLight(["red", "yellow", "green"], "yellow");
}
\ No newline at end of file
From f433039a2514cc03e6129f6496dc43a4bfad0ce8 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen
Date: Fri, 2 Feb 2024 11:23:35 +0100
Subject: [PATCH 002/309] Add change note
---
javascript/ql/lib/change-notes/2024-02-02-typescript-5-4.md | 4 ++++
1 file changed, 4 insertions(+)
create mode 100644 javascript/ql/lib/change-notes/2024-02-02-typescript-5-4.md
diff --git a/javascript/ql/lib/change-notes/2024-02-02-typescript-5-4.md b/javascript/ql/lib/change-notes/2024-02-02-typescript-5-4.md
new file mode 100644
index 00000000000..836719b5d6b
--- /dev/null
+++ b/javascript/ql/lib/change-notes/2024-02-02-typescript-5-4.md
@@ -0,0 +1,4 @@
+---
+category: majorAnalysis
+---
+* Added support for TypeScript 5.4.
\ No newline at end of file
From 3b1751dc8a6716d9a8bb9eecda2475c1f4b2408e Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen
Date: Fri, 2 Feb 2024 11:45:21 +0100
Subject: [PATCH 003/309] Update supported versions
---
docs/codeql/reusables/supported-versions-compilers.rst | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/docs/codeql/reusables/supported-versions-compilers.rst b/docs/codeql/reusables/supported-versions-compilers.rst
index cb9ee322a04..525fe7730a8 100644
--- a/docs/codeql/reusables/supported-versions-compilers.rst
+++ b/docs/codeql/reusables/supported-versions-compilers.rst
@@ -25,7 +25,7 @@
Python [9]_,"2.7, 3.5, 3.6, 3.7, 3.8, 3.9, 3.10, 3.11, 3.12",Not applicable,``.py``
Ruby [10]_,"up to 3.3",Not applicable,"``.rb``, ``.erb``, ``.gemspec``, ``Gemfile``"
Swift [11]_,"Swift 5.4-5.9.1","Swift compiler","``.swift``"
- TypeScript [12]_,"2.6-5.3",Standard TypeScript compiler,"``.ts``, ``.tsx``, ``.mts``, ``.cts``"
+ TypeScript [12]_,"2.6-5.4",Standard TypeScript compiler,"``.ts``, ``.tsx``, ``.mts``, ``.cts``"
.. container:: footnote-group
From 083f56921c8c4adced9e7e8ce2c945b1848dcd50 Mon Sep 17 00:00:00 2001
From: erik-krogh
Date: Sun, 25 Feb 2024 21:20:41 +0100
Subject: [PATCH 004/309] update to 5.4.1-rc
---
javascript/extractor/lib/typescript/package-lock.json | 8 ++++----
javascript/extractor/lib/typescript/package.json | 2 +-
2 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/javascript/extractor/lib/typescript/package-lock.json b/javascript/extractor/lib/typescript/package-lock.json
index fd672bf43c0..af309c3b451 100644
--- a/javascript/extractor/lib/typescript/package-lock.json
+++ b/javascript/extractor/lib/typescript/package-lock.json
@@ -6,7 +6,7 @@
"": {
"name": "typescript-parser-wrapper",
"dependencies": {
- "typescript": "5.4.0-beta"
+ "typescript": "5.4.1-rc"
},
"devDependencies": {
"@types/node": "18.15.3"
@@ -20,9 +20,9 @@
"license": "MIT"
},
"node_modules/typescript": {
- "version": "5.4.0-beta",
- "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.4.0-beta.tgz",
- "integrity": "sha512-KgekV5JS7TQ7Bb8eO64QGxdM7MSBUUXOXq28OWX23d2MA8SiVtNYoo4s33tCTEGV8+6AGBRD2+KiXNNnexRRYw==",
+ "version": "5.4.1-rc",
+ "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.4.1-rc.tgz",
+ "integrity": "sha512-gInURzaO0bbfzfQAc3mfcHxh8qev+No4QOFUZHajo9vBgOLaljELJ3wuzyoGo/zHIzMSezdhtrsRdqL6E9SvNA==",
"bin": {
"tsc": "bin/tsc",
"tsserver": "bin/tsserver"
diff --git a/javascript/extractor/lib/typescript/package.json b/javascript/extractor/lib/typescript/package.json
index 2a636c3cdf3..6a315fed292 100644
--- a/javascript/extractor/lib/typescript/package.json
+++ b/javascript/extractor/lib/typescript/package.json
@@ -2,7 +2,7 @@
"name": "typescript-parser-wrapper",
"private": true,
"dependencies": {
- "typescript": "5.4.0-beta"
+ "typescript": "5.4.1-rc"
},
"scripts": {
"build": "tsc --project tsconfig.json",
From a03c06802e7f08baadf6796dc19a968cd72fdc67 Mon Sep 17 00:00:00 2001
From: Harry Maclean
Date: Tue, 6 Feb 2024 09:34:20 +0000
Subject: [PATCH 005/309] Ruby: Add some more command injection sinks
---
ruby/ql/lib/codeql/ruby/frameworks/core/Kernel.qll | 10 ++++++++--
ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll | 8 +++++---
2 files changed, 13 insertions(+), 5 deletions(-)
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/core/Kernel.qll b/ruby/ql/lib/codeql/ruby/frameworks/core/Kernel.qll
index 96568e74902..2aa46ab550a 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/core/Kernel.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/core/Kernel.qll
@@ -130,13 +130,19 @@ module Kernel {
* `Kernel.spawn` takes the same argument forms as `Kernel.system`.
* See `KernelSystemCall` for details.
* Ruby documentation: https://docs.ruby-lang.org/en/3.0.0/Kernel.html#method-i-spawn
+ * Methods with the same effect exist in the `Process` and `PTY` classes, so they are also modeled here.
* TODO: document and handle the env and option arguments.
* ```
* spawn([env,] command... [,options]) -> pid
* ```
*/
- class KernelSpawnCall extends SystemCommandExecution::Range instanceof KernelMethodCall {
- KernelSpawnCall() { this.getMethodName() = "spawn" }
+ class KernelSpawnCall extends SystemCommandExecution::Range instanceof DataFlow::CallNode {
+ KernelSpawnCall() {
+ this.getMethodName() = "spawn" and
+ this instanceof KernelMethodCall
+ or
+ this = DataFlow::getConstant(["Process", "PTY"]).getAMethodCall("spawn")
+ }
override DataFlow::Node getAnArgument() { result = super.getArgument(_) }
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll b/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll
index e65f3005503..5f349c451f3 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll
@@ -7,7 +7,7 @@ private import codeql.ruby.ApiGraphs
private import codeql.ruby.Concepts
/**
- * Provides modeling for the `Open3` library.
+ * Provides modeling for the `Open3` and `Open4` libraries.
*/
module Open3 {
/**
@@ -18,8 +18,10 @@ module Open3 {
class Open3Call extends SystemCommandExecution::Range instanceof DataFlow::CallNode {
Open3Call() {
this =
- API::getTopLevelMember("Open3")
- .getAMethodCall(["popen3", "popen2", "popen2e", "capture3", "capture2", "capture2e"])
+ API::getTopLevelMember(["Open3", "Open4"])
+ .getAMethodCall([
+ "popen3", "popen2", "popen2e", "capture3", "capture2", "capture2e", "popen4"
+ ])
}
override DataFlow::Node getAnArgument() { result = super.getArgument(_) }
From beef9965cc48174538cc8346fa056ca5fdec5c22 Mon Sep 17 00:00:00 2001
From: Harry Maclean
Date: Mon, 26 Feb 2024 10:35:08 +0000
Subject: [PATCH 006/309] Ruby: Model Open4 library
Also remove duplicate modeling of Process.spawn.
---
.../codeql/ruby/frameworks/core/Kernel.qll | 3 ---
.../codeql/ruby/frameworks/stdlib/Open3.qll | 19 +++++++++++++++----
.../frameworks/stdlib/Open3.expected | 4 ++++
.../library-tests/frameworks/stdlib/Open3.ql | 2 ++
.../library-tests/frameworks/stdlib/Open3.rb | 6 +++++-
5 files changed, 26 insertions(+), 8 deletions(-)
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/core/Kernel.qll b/ruby/ql/lib/codeql/ruby/frameworks/core/Kernel.qll
index 2aa46ab550a..cc3ce9feb97 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/core/Kernel.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/core/Kernel.qll
@@ -130,7 +130,6 @@ module Kernel {
* `Kernel.spawn` takes the same argument forms as `Kernel.system`.
* See `KernelSystemCall` for details.
* Ruby documentation: https://docs.ruby-lang.org/en/3.0.0/Kernel.html#method-i-spawn
- * Methods with the same effect exist in the `Process` and `PTY` classes, so they are also modeled here.
* TODO: document and handle the env and option arguments.
* ```
* spawn([env,] command... [,options]) -> pid
@@ -140,8 +139,6 @@ module Kernel {
KernelSpawnCall() {
this.getMethodName() = "spawn" and
this instanceof KernelMethodCall
- or
- this = DataFlow::getConstant(["Process", "PTY"]).getAMethodCall("spawn")
}
override DataFlow::Node getAnArgument() { result = super.getArgument(_) }
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll b/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll
index 5f349c451f3..f2eb16d2aa8 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll
@@ -18,10 +18,8 @@ module Open3 {
class Open3Call extends SystemCommandExecution::Range instanceof DataFlow::CallNode {
Open3Call() {
this =
- API::getTopLevelMember(["Open3", "Open4"])
- .getAMethodCall([
- "popen3", "popen2", "popen2e", "capture3", "capture2", "capture2e", "popen4"
- ])
+ API::getTopLevelMember("Open3")
+ .getAMethodCall(["popen3", "popen2", "popen2e", "capture3", "capture2", "capture2e"])
}
override DataFlow::Node getAnArgument() { result = super.getArgument(_) }
@@ -33,6 +31,19 @@ module Open3 {
}
}
+ class Open4Call extends SystemCommandExecution::Range instanceof DataFlow::CallNode {
+ Open4Call() {
+ this = API::getTopLevelMember("Open4").getAMethodCall(["open4", "popen4", "spawn"])
+ }
+
+ override DataFlow::Node getAnArgument() { result = super.getArgument(_) }
+
+ override predicate isShellInterpreted(DataFlow::Node arg) {
+ super.getNumberOfArguments() = 1 and
+ arg = this.getAnArgument()
+ }
+ }
+
/**
* A pipeline of system commands constructed via one of the `Open3` methods.
* These methods accept a variable argument list of commands.
diff --git a/ruby/ql/test/library-tests/frameworks/stdlib/Open3.expected b/ruby/ql/test/library-tests/frameworks/stdlib/Open3.expected
index a601d199ff6..48bc6fc27f6 100644
--- a/ruby/ql/test/library-tests/frameworks/stdlib/Open3.expected
+++ b/ruby/ql/test/library-tests/frameworks/stdlib/Open3.expected
@@ -11,3 +11,7 @@ open3PipelineCallExecutions
| Open3.rb:9:1:9:40 | call to pipeline_w |
| Open3.rb:10:1:10:44 | call to pipeline_start |
| Open3.rb:11:1:11:38 | call to pipeline |
+open4CallExecutions
+| Open3.rb:13:1:13:24 | call to open4 |
+| Open3.rb:14:1:14:25 | call to popen4 |
+| Open3.rb:15:1:15:23 | call to spawn |
diff --git a/ruby/ql/test/library-tests/frameworks/stdlib/Open3.ql b/ruby/ql/test/library-tests/frameworks/stdlib/Open3.ql
index 8d98734832d..014573d7010 100644
--- a/ruby/ql/test/library-tests/frameworks/stdlib/Open3.ql
+++ b/ruby/ql/test/library-tests/frameworks/stdlib/Open3.ql
@@ -4,3 +4,5 @@ import codeql.ruby.DataFlow
query predicate open3CallExecutions(Open3Call c) { any() }
query predicate open3PipelineCallExecutions(Open3PipelineCall c) { any() }
+
+query predicate open4CallExecutions(Open4Call c) { any() }
diff --git a/ruby/ql/test/library-tests/frameworks/stdlib/Open3.rb b/ruby/ql/test/library-tests/frameworks/stdlib/Open3.rb
index b1a3d491be1..4a112335ffb 100644
--- a/ruby/ql/test/library-tests/frameworks/stdlib/Open3.rb
+++ b/ruby/ql/test/library-tests/frameworks/stdlib/Open3.rb
@@ -8,4 +8,8 @@ Open3.pipeline_rw("echo foo", "grep bar")
Open3.pipeline_r("echo foo", "grep bar")
Open3.pipeline_w("echo foo", "grep bar")
Open3.pipeline_start("echo foo", "grep bar")
-Open3.pipeline("echo foo", "grep bar")
\ No newline at end of file
+Open3.pipeline("echo foo", "grep bar")
+
+Open4::open4("echo foo")
+Open4::popen4("echo foo")
+Open4.spawn("echo bar")
From d1847566b6b5988254f826a6fd42727308bbddcb Mon Sep 17 00:00:00 2001
From: Harry Maclean
Date: Mon, 26 Feb 2024 10:41:30 +0000
Subject: [PATCH 007/309] Ruby: Ql4QL fix
---
ruby/ql/lib/codeql/ruby/frameworks/core/Kernel.qll | 7 ++-----
ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll | 5 +++++
2 files changed, 7 insertions(+), 5 deletions(-)
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/core/Kernel.qll b/ruby/ql/lib/codeql/ruby/frameworks/core/Kernel.qll
index cc3ce9feb97..96568e74902 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/core/Kernel.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/core/Kernel.qll
@@ -135,11 +135,8 @@ module Kernel {
* spawn([env,] command... [,options]) -> pid
* ```
*/
- class KernelSpawnCall extends SystemCommandExecution::Range instanceof DataFlow::CallNode {
- KernelSpawnCall() {
- this.getMethodName() = "spawn" and
- this instanceof KernelMethodCall
- }
+ class KernelSpawnCall extends SystemCommandExecution::Range instanceof KernelMethodCall {
+ KernelSpawnCall() { this.getMethodName() = "spawn" }
override DataFlow::Node getAnArgument() { result = super.getArgument(_) }
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll b/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll
index f2eb16d2aa8..16b9ecc3797 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll
@@ -31,6 +31,11 @@ module Open3 {
}
}
+ /**
+ * A system command executed via one of the `Open4` methods.
+ * These methods take the same argument forms as `Kernel.system`.
+ * See `KernelSystemCall` for details.
+ */
class Open4Call extends SystemCommandExecution::Range instanceof DataFlow::CallNode {
Open4Call() {
this = API::getTopLevelMember("Open4").getAMethodCall(["open4", "popen4", "spawn"])
From 9d13a1ff515b86bd84e3897335734736ad7354e3 Mon Sep 17 00:00:00 2001
From: Harry Maclean
Date: Mon, 26 Feb 2024 10:43:48 +0000
Subject: [PATCH 008/309] Ruby: Add model for Process.spawn
---
.../codeql/ruby/frameworks/stdlib/Process.qll | 35 +++++++++++++++++++
1 file changed, 35 insertions(+)
create mode 100644 ruby/ql/lib/codeql/ruby/frameworks/stdlib/Process.qll
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Process.qll b/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Process.qll
new file mode 100644
index 00000000000..1ffc15d691b
--- /dev/null
+++ b/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Process.qll
@@ -0,0 +1,35 @@
+/**
+ * Provides modeling for the `Process` library.
+ */
+
+private import codeql.ruby.Concepts
+private import codeql.ruby.DataFlow
+private import codeql.ruby.controlflow.CfgNodes
+private import codeql.ruby.frameworks.core.Kernel
+
+/**
+ * Provides modeling for the `Process` library.
+ */
+module Process {
+ /**
+ * A call to `Process.spawn`.
+ * ```rb
+ * Process.spawn("tar xf ruby-2.0.0-p195.tar.bz2")
+ * Process.spawn({"ENV" => "VAR"}, "echo", "hi")
+ * ```
+ */
+ class SpawnCall extends SystemCommandExecution::Range instanceof DataFlow::CallNode {
+ SpawnCall() { this = DataFlow::getConstant(["Process", "PTY"]).getAMethodCall("spawn") }
+
+ // The command can be argument 0 or 1
+ // Options can be specified after the command, and we want to exclude those.
+ override DataFlow::Node getAnArgument() {
+ result = super.getArgument([0, 1]) and not result.asExpr() instanceof ExprNodes::PairCfgNode
+ }
+
+ override predicate isShellInterpreted(DataFlow::Node arg) {
+ // Process.spawn invokes a subshell if you provide a single string as argument
+ super.getNumberOfArguments() = 1 and arg = this.getAnArgument()
+ }
+ }
+}
From 8bed3fbed442ecdfee770b494d6a188f71025aa1 Mon Sep 17 00:00:00 2001
From: Harry Maclean
Date: Mon, 26 Feb 2024 10:57:17 +0000
Subject: [PATCH 009/309] Ruby: Add basic model for Terrapin library
---
.../codeql/ruby/frameworks/terrapin/model.yml | 41 +++++++++++++++++++
.../CommandInjection.expected | 10 +++++
.../CommandInjection/CommandInjection.rb | 11 ++++-
3 files changed, 61 insertions(+), 1 deletion(-)
create mode 100644 ruby/ql/lib/codeql/ruby/frameworks/terrapin/model.yml
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/terrapin/model.yml b/ruby/ql/lib/codeql/ruby/frameworks/terrapin/model.yml
new file mode 100644
index 00000000000..c111ca5efbc
--- /dev/null
+++ b/ruby/ql/lib/codeql/ruby/frameworks/terrapin/model.yml
@@ -0,0 +1,41 @@
+extensions:
+ - addsTo:
+ pack: codeql/ruby-all
+ extensible: sourceModel
+ data: []
+
+ - addsTo:
+ pack: codeql/ruby-all
+ extensible: sinkModel
+ data:
+ - ["Terrapin::CommandLine!","Method[new].Argument[0]","command-injection"]
+ - ["Terrapin::CommandLine!","Method[new].Argument[1]","command-injection"]
+
+ - addsTo:
+ pack: codeql/ruby-all
+ extensible: summaryModel
+ data:
+ - ["Terrapin::CommandLine::Output!","Method[new]","Argument[1]","ReturnValue","value"]
+ - ["Terrapin::CommandLine!","Method[path=]","Argument[0]","ReturnValue","taint"]
+ - ["Terrapin::CommandLine!","Method[new]","Argument[2]","ReturnValue","taint"]
+
+ - addsTo:
+ pack: codeql/ruby-all
+ extensible: neutralModel
+ data: []
+
+ - addsTo:
+ pack: codeql/ruby-all
+ extensible: typeModel
+ data:
+ - ["Terrapin::CommandLine::Output","Terrapin::CommandLine::MultiPipe","Method[output].ReturnValue"]
+ - ["Terrapin::CommandLine::Output","Terrapin::CommandLine::FakeRunner","Method[call].ReturnValue"]
+ - ["Terrapin::CommandLine::Output","Terrapin::CommandLine::ProcessRunner","Method[call].ReturnValue"]
+ - ["Terrapin::CommandLine::Output","Terrapin::CommandLine!","Method[runner].ReturnValue.ReturnValue"]
+ - ["Terrapin::CommandLine::FakeRunner","Terrapin::CommandLine!","Method[runner].ReturnValue"]
+ - ["Terrapin::CommandLine::Output","Terrapin::CommandLine!","Method[fake!].ReturnValue.ReturnValue"]
+ - ["Terrapin::CommandLine::FakeRunner","Terrapin::CommandLine!","Method[fake!].ReturnValue"]
+ - ["Terrapin::CommandLine::Output","Terrapin::CommandLine","Method[output].ReturnValue"]
+ - ["Terrapin::CommandLineError","Terrapin::CommandNotFoundError",""]
+ - ["Terrapin::CommandLineError","Terrapin::ExitStatusError",""]
+ - ["Terrapin::CommandLineError","Terrapin::InterpolationError",""]
diff --git a/ruby/ql/test/query-tests/security/cwe-078/CommandInjection/CommandInjection.expected b/ruby/ql/test/query-tests/security/cwe-078/CommandInjection/CommandInjection.expected
index be4473409b7..0ca6e123e7b 100644
--- a/ruby/ql/test/query-tests/security/cwe-078/CommandInjection/CommandInjection.expected
+++ b/ruby/ql/test/query-tests/security/cwe-078/CommandInjection/CommandInjection.expected
@@ -21,6 +21,9 @@ edges
| CommandInjection.rb:103:9:103:12 | file | CommandInjection.rb:104:16:104:28 | "cat #{...}" | provenance | |
| CommandInjection.rb:103:16:103:21 | call to params | CommandInjection.rb:103:16:103:28 | ...[...] | provenance | |
| CommandInjection.rb:103:16:103:28 | ...[...] | CommandInjection.rb:103:9:103:12 | file | provenance | |
+| CommandInjection.rb:111:33:111:38 | call to params | CommandInjection.rb:111:33:111:44 | ...[...] | provenance | |
+| CommandInjection.rb:113:44:113:49 | call to params | CommandInjection.rb:113:44:113:54 | ...[...] | provenance | |
+| CommandInjection.rb:113:44:113:54 | ...[...] | CommandInjection.rb:113:41:113:56 | "#{...}" | provenance | |
nodes
| CommandInjection.rb:6:9:6:11 | cmd | semmle.label | cmd |
| CommandInjection.rb:6:15:6:20 | call to params | semmle.label | call to params |
@@ -51,6 +54,11 @@ nodes
| CommandInjection.rb:103:16:103:21 | call to params | semmle.label | call to params |
| CommandInjection.rb:103:16:103:28 | ...[...] | semmle.label | ...[...] |
| CommandInjection.rb:104:16:104:28 | "cat #{...}" | semmle.label | "cat #{...}" |
+| CommandInjection.rb:111:33:111:38 | call to params | semmle.label | call to params |
+| CommandInjection.rb:111:33:111:44 | ...[...] | semmle.label | ...[...] |
+| CommandInjection.rb:113:41:113:56 | "#{...}" | semmle.label | "#{...}" |
+| CommandInjection.rb:113:44:113:49 | call to params | semmle.label | call to params |
+| CommandInjection.rb:113:44:113:54 | ...[...] | semmle.label | ...[...] |
subpaths
#select
| CommandInjection.rb:7:10:7:15 | #{...} | CommandInjection.rb:6:15:6:20 | call to params | CommandInjection.rb:7:10:7:15 | #{...} | This command depends on a $@. | CommandInjection.rb:6:15:6:20 | call to params | user-provided value |
@@ -67,3 +75,5 @@ subpaths
| CommandInjection.rb:82:14:82:34 | "echo #{...}" | CommandInjection.rb:81:23:81:33 | blah_number | CommandInjection.rb:82:14:82:34 | "echo #{...}" | This command depends on a $@. | CommandInjection.rb:81:23:81:33 | blah_number | user-provided value |
| CommandInjection.rb:91:14:91:39 | "echo #{...}" | CommandInjection.rb:91:22:91:37 | ...[...] | CommandInjection.rb:91:14:91:39 | "echo #{...}" | This command depends on a $@. | CommandInjection.rb:91:22:91:37 | ...[...] | user-provided value |
| CommandInjection.rb:104:16:104:28 | "cat #{...}" | CommandInjection.rb:103:16:103:21 | call to params | CommandInjection.rb:104:16:104:28 | "cat #{...}" | This command depends on a $@. | CommandInjection.rb:103:16:103:21 | call to params | user-provided value |
+| CommandInjection.rb:111:33:111:44 | ...[...] | CommandInjection.rb:111:33:111:38 | call to params | CommandInjection.rb:111:33:111:44 | ...[...] | This command depends on a $@. | CommandInjection.rb:111:33:111:38 | call to params | user-provided value |
+| CommandInjection.rb:113:41:113:56 | "#{...}" | CommandInjection.rb:113:44:113:49 | call to params | CommandInjection.rb:113:41:113:56 | "#{...}" | This command depends on a $@. | CommandInjection.rb:113:44:113:49 | call to params | user-provided value |
diff --git a/ruby/ql/test/query-tests/security/cwe-078/CommandInjection/CommandInjection.rb b/ruby/ql/test/query-tests/security/cwe-078/CommandInjection/CommandInjection.rb
index 4be9c95924a..12c15a30b15 100644
--- a/ruby/ql/test/query-tests/security/cwe-078/CommandInjection/CommandInjection.rb
+++ b/ruby/ql/test/query-tests/security/cwe-078/CommandInjection/CommandInjection.rb
@@ -106,4 +106,13 @@ class Foo < ActionController::Base
system("cat #{file.shellescape}") # OK, because file is shell escaped
end
-end
\ No newline at end of file
+
+ def index
+ Terrapin::CommandLine.new(params[:foo], "bar") # BAD
+
+ Terrapin::CommandLine.new("echo", "#{params[foo]}") # BAD
+
+ cmd = Terrapin::CommandLine.new("echo", ":msg")
+ cmd.run(msg: params[:foo]) # GOOD
+ end
+end
From 3eb9491cb4e44659ddcbeed635bf6961eb49fef0 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen
Date: Mon, 26 Feb 2024 17:18:40 +0100
Subject: [PATCH 010/309] python: rewrite `HardcodedCredentials` away from
`PointsTo` - `ModuleValue.attr` and `ClassValue.lookup` are approximated by
`Function.getName` - `ClassValue.getName` is apprximated by `Class.getName` -
`Module::named` is approximated by `Module.getName` - `Value::named` is
approximated by `Builtins::likelyBuiltin` -
`FunctionValue.getNamedArgumentForCall` is approximated by
`ArgumentNode.argumentOf`
---
.../src/Security/CWE-798/HardcodedCredentials.ql | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
diff --git a/python/ql/src/Security/CWE-798/HardcodedCredentials.ql b/python/ql/src/Security/CWE-798/HardcodedCredentials.ql
index 0a92427ec23..04197b13610 100644
--- a/python/ql/src/Security/CWE-798/HardcodedCredentials.ql
+++ b/python/ql/src/Security/CWE-798/HardcodedCredentials.ql
@@ -16,6 +16,8 @@ import python
import semmle.python.dataflow.new.DataFlow
import semmle.python.dataflow.new.TaintTracking
import semmle.python.filters.Tests
+private import semmle.python.dataflow.new.internal.DataFlowDispatch as DataFlowDispatch
+private import semmle.python.dataflow.new.internal.Builtins::Builtins as Builtins
bindingset[char, fraction]
predicate fewer_characters_than(StrConst str, string char, float fraction) {
@@ -30,15 +32,13 @@ predicate fewer_characters_than(StrConst str, string char, float fraction) {
}
predicate possible_reflective_name(string name) {
- exists(any(ModuleValue m).attr(name))
+ any(Function f).getName() = name
or
- exists(any(ClassValue c).lookup(name))
+ any(Class c).getName() = name
or
- any(ClassValue c).getName() = name
+ any(Module m).getName() = name
or
- exists(Module::named(name))
- or
- exists(Value::named(name))
+ exists(Builtins::likelyBuiltin(name))
}
int char_count(StrConst str) { result = count(string c | c = str.getText().charAt(_)) }
@@ -84,7 +84,9 @@ class CredentialSink extends DataFlow::Node {
name.regexpMatch(getACredentialRegex()) and
not name.matches("%file")
|
- any(FunctionValue func).getNamedArgumentForCall(_, name) = this.asCfgNode()
+ exists(DataFlowDispatch::ArgumentPosition pos | pos.isKeyword(name) |
+ this.(DataFlow::ArgumentNode).argumentOf(_, pos)
+ )
or
exists(Keyword k | k.getArg() = name and k.getValue().getAFlowNode() = this.asCfgNode())
or
From b4b5ae2a2c53503538b1cab99c7499ca97f536a1 Mon Sep 17 00:00:00 2001
From: erik-krogh
Date: Tue, 27 Feb 2024 10:05:26 +0100
Subject: [PATCH 011/309] add some request-forgery sanitizers, inspired from C#
---
.../code/java/security/RequestForgery.qll | 77 +++++++++++++++++++
.../CWE-601/semmle/tests/UrlRedirect.expected | 2 +
.../CWE-601/semmle/tests/UrlRedirect2.java | 52 +++++++++++++
3 files changed, 131 insertions(+)
create mode 100644 java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect2.java
diff --git a/java/ql/lib/semmle/code/java/security/RequestForgery.qll b/java/ql/lib/semmle/code/java/security/RequestForgery.qll
index 7a72faeb5e4..e083977c74f 100644
--- a/java/ql/lib/semmle/code/java/security/RequestForgery.qll
+++ b/java/ql/lib/semmle/code/java/security/RequestForgery.qll
@@ -8,6 +8,7 @@ import semmle.code.java.frameworks.JaxWS
import semmle.code.java.frameworks.javase.Http
import semmle.code.java.dataflow.DataFlow
import semmle.code.java.frameworks.Properties
+private import semmle.code.java.controlflow.Guards
private import semmle.code.java.dataflow.StringPrefixes
private import semmle.code.java.dataflow.ExternalFlow
private import semmle.code.java.security.Sanitizers
@@ -83,3 +84,79 @@ private class HostnameSanitizingPrefix extends InterestingPrefix {
private class HostnameSantizer extends RequestForgerySanitizer {
HostnameSantizer() { this.asExpr() = any(HostnameSanitizingPrefix hsp).getAnAppendedExpression() }
}
+
+/**
+ * An argument to a call to `List.contains()` that is a sanitizer for URL redirects.
+ */
+private predicate isContainsUrlSanitizer(Guard guard, Expr e, boolean branch) {
+ guard =
+ any(MethodCall method |
+ method.getMethod().getName() = "contains" and
+ e = method.getArgument(0) and
+ branch = true
+ )
+}
+
+/**
+ * An URL argument to a call to `.contains()` that is a sanitizer for URL redirects.
+ *
+ * This `contains` method is usually called on a list, but the sanitizer matches any call to a method
+ * called `contains`, so other methods with the same name will also be considered sanitizers.
+ */
+class ContainsUrlSanitizer extends RequestForgerySanitizer {
+ ContainsUrlSanitizer() {
+ this = DataFlow::BarrierGuard::getABarrierNode()
+ }
+}
+
+/**
+ * A check that the URL is relative, and therefore safe for URL redirects.
+ */
+private predicate isRelativeUrlSanitizer(Guard guard, Expr e, boolean branch) {
+ guard =
+ any(MethodCall call |
+ exists(Method method |
+ call.getMethod() = method and
+ method.getName() = "isAbsolute" and
+ method.getDeclaringType().hasQualifiedName("java.net", "URI")
+ ) and
+ e = call.getQualifier() and
+ branch = false
+ )
+}
+
+/**
+ * A check that the URL is relative, and therefore safe for URL redirects.
+ */
+class RelativeUrlSanitizer extends RequestForgerySanitizer {
+ RelativeUrlSanitizer() {
+ this = DataFlow::BarrierGuard::getABarrierNode()
+ }
+}
+
+/**
+ * A comparison on the host of a url, that is a sanitizer for URL redirects.
+ * E.g. `"example.org".equals(url.getHost())"`
+ */
+private predicate isHostComparisonSanitizer(Guard guard, Expr e, boolean branch) {
+ guard =
+ any(MethodCall equalsCall |
+ equalsCall.getMethod().getName() = "equals" and
+ branch = true and
+ exists(MethodCall hostCall |
+ hostCall = [equalsCall.getQualifier(), equalsCall.getArgument(0)] and
+ hostCall.getMethod().getName() = "getHost" and
+ hostCall.getMethod().getDeclaringType().hasQualifiedName("java.net", "URI") and
+ e = hostCall.getQualifier()
+ )
+ )
+}
+
+/**
+ * A comparison on the `Host` property of a url, that is a sanitizer for URL redirects.
+ */
+class HostComparisonSanitizer extends RequestForgerySanitizer {
+ HostComparisonSanitizer() {
+ this = DataFlow::BarrierGuard::getABarrierNode()
+ }
+}
diff --git a/java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect.expected b/java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect.expected
index 3757e51134b..cf5af88efd8 100644
--- a/java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect.expected
+++ b/java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect.expected
@@ -6,6 +6,7 @@ edges
| mad/Test.java:9:16:9:41 | getParameter(...) : String | mad/Test.java:14:31:14:38 | source(...) : String | provenance | |
| mad/Test.java:14:31:14:38 | source(...) : String | mad/Test.java:14:22:14:38 | (...)... | provenance | |
nodes
+| UrlRedirect2.java:27:25:27:54 | getParameter(...) | semmle.label | getParameter(...) |
| UrlRedirect.java:23:25:23:54 | getParameter(...) | semmle.label | getParameter(...) |
| UrlRedirect.java:32:25:32:67 | weakCleanup(...) | semmle.label | weakCleanup(...) |
| UrlRedirect.java:32:37:32:66 | getParameter(...) : String | semmle.label | getParameter(...) : String |
@@ -20,6 +21,7 @@ nodes
subpaths
| UrlRedirect.java:32:37:32:66 | getParameter(...) : String | UrlRedirect.java:45:28:45:39 | input : String | UrlRedirect.java:46:10:46:40 | replaceAll(...) : String | UrlRedirect.java:32:25:32:67 | weakCleanup(...) |
#select
+| UrlRedirect2.java:27:25:27:54 | getParameter(...) | UrlRedirect2.java:27:25:27:54 | getParameter(...) | UrlRedirect2.java:27:25:27:54 | getParameter(...) | Untrusted URL redirection depends on a $@. | UrlRedirect2.java:27:25:27:54 | getParameter(...) | user-provided value |
| UrlRedirect.java:23:25:23:54 | getParameter(...) | UrlRedirect.java:23:25:23:54 | getParameter(...) | UrlRedirect.java:23:25:23:54 | getParameter(...) | Untrusted URL redirection depends on a $@. | UrlRedirect.java:23:25:23:54 | getParameter(...) | user-provided value |
| UrlRedirect.java:32:25:32:67 | weakCleanup(...) | UrlRedirect.java:32:37:32:66 | getParameter(...) : String | UrlRedirect.java:32:25:32:67 | weakCleanup(...) | Untrusted URL redirection depends on a $@. | UrlRedirect.java:32:37:32:66 | getParameter(...) | user-provided value |
| UrlRedirect.java:39:34:39:63 | getParameter(...) | UrlRedirect.java:39:34:39:63 | getParameter(...) | UrlRedirect.java:39:34:39:63 | getParameter(...) | Untrusted URL redirection depends on a $@. | UrlRedirect.java:39:34:39:63 | getParameter(...) | user-provided value |
diff --git a/java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect2.java b/java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect2.java
new file mode 100644
index 00000000000..9014dcae7f2
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect2.java
@@ -0,0 +1,52 @@
+// Test case for
+// CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
+// http://cwe.mitre.org/data/definitions/601.html
+
+package test.cwe601.cwe.examples;
+
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.List;
+import java.net.URI;
+import java.net.URISyntaxException;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+public class UrlRedirect2 extends HttpServlet {
+ private static final List VALID_REDIRECTS = Arrays.asList(
+ "http://cwe.mitre.org/data/definitions/601.html",
+ "http://cwe.mitre.org/data/definitions/79.html"
+ );
+
+ protected void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ // BAD: a request parameter is incorporated without validation into a URL redirect
+ response.sendRedirect(request.getParameter("target"));
+
+ // GOOD: the request parameter is validated against a known list of strings
+ String target = request.getParameter("target");
+ if (VALID_REDIRECTS.contains(target)) {
+ response.sendRedirect(target);
+ }
+
+ try {
+ String urlString = request.getParameter("page");
+ URI url = new URI(urlString);
+
+ if (!url.isAbsolute()) {
+ // GOOD: The redirect is to a relative URL
+ response.sendRedirect(url.toString());
+ }
+
+ if ("example.org".equals(url.getHost())) {
+ // GOOD: The redirect is to a known host
+ response.sendRedirect(url.toString());
+ }
+ } catch (URISyntaxException e) {
+ // handle exception
+ }
+ }
+}
From d0e7fbc871de377f6ab2693ce624e325902ea754 Mon Sep 17 00:00:00 2001
From: Harry Maclean
Date: Tue, 27 Feb 2024 09:47:51 +0000
Subject: [PATCH 012/309] Ruby: Add changenote
---
ruby/ql/lib/change-notes/2024-02-27-process-spawn.md | 4 ++++
1 file changed, 4 insertions(+)
create mode 100644 ruby/ql/lib/change-notes/2024-02-27-process-spawn.md
diff --git a/ruby/ql/lib/change-notes/2024-02-27-process-spawn.md b/ruby/ql/lib/change-notes/2024-02-27-process-spawn.md
new file mode 100644
index 00000000000..30feedcbd20
--- /dev/null
+++ b/ruby/ql/lib/change-notes/2024-02-27-process-spawn.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* New command injection sinks have been added, including `Process.spawn`, `Terrapin::CommandLine` and the `open4` gem.
\ No newline at end of file
From 052a8e7f8187026396db06545647afc47f2dbde4 Mon Sep 17 00:00:00 2001
From: Asger F
Date: Wed, 28 Feb 2024 14:58:04 +0100
Subject: [PATCH 013/309] JS: Avoid spurious recursion in AMD
---
javascript/ql/lib/semmle/javascript/AMD.qll | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/javascript/ql/lib/semmle/javascript/AMD.qll b/javascript/ql/lib/semmle/javascript/AMD.qll
index 20b1c26275a..7214005b593 100644
--- a/javascript/ql/lib/semmle/javascript/AMD.qll
+++ b/javascript/ql/lib/semmle/javascript/AMD.qll
@@ -102,9 +102,10 @@ class AmdModuleDefinition extends CallExpr instanceof AmdModuleDefinition::Range
/**
* Holds if `p` is the parameter corresponding to dependency `dep`.
*/
- predicate dependencyParameter(PathExpr dep, Parameter p) {
+ predicate dependencyParameter(Expr dep, Parameter p) {
exists(int i |
- dep = this.getDependency(i) and
+ // Note: to avoid spurious recursion, do not depend on PathExpr here
+ dep = this.getDependencies().getElement(i) and
p = this.getFactoryParameter(i)
)
}
@@ -122,9 +123,9 @@ class AmdModuleDefinition extends CallExpr instanceof AmdModuleDefinition::Range
* `dep1` and `dep2`.
*/
Parameter getDependencyParameter(string name) {
- exists(PathExpr dep |
+ exists(Expr dep |
this.dependencyParameter(dep, result) and
- dep.getValue() = name
+ name = dep.getStringValue()
)
}
From 853397361fceb4395df26e52d1a5b46b259d2915 Mon Sep 17 00:00:00 2001
From: Asger F
Date: Wed, 28 Feb 2024 13:51:28 +0100
Subject: [PATCH 014/309] JS: Do not treat AMD pseudo-dependencies as file
paths
---
javascript/ql/lib/semmle/javascript/AMD.qll | 14 ++++++++++++--
.../ql/test/library-tests/AMD/tests.expected | 1 -
2 files changed, 12 insertions(+), 3 deletions(-)
diff --git a/javascript/ql/lib/semmle/javascript/AMD.qll b/javascript/ql/lib/semmle/javascript/AMD.qll
index 7214005b593..b28dd5b9b72 100644
--- a/javascript/ql/lib/semmle/javascript/AMD.qll
+++ b/javascript/ql/lib/semmle/javascript/AMD.qll
@@ -61,7 +61,13 @@ class AmdModuleDefinition extends CallExpr instanceof AmdModuleDefinition::Range
}
/** Gets the `i`th dependency of this module definition. */
- PathExpr getDependency(int i) { result = this.getDependencies().getElement(i) }
+ PathExpr getDependency(int i) {
+ exists(Expr expr |
+ expr = this.getDependencies().getElement(i) and
+ not isPseudoDependency(expr.getStringValue()) and
+ result = expr
+ )
+ }
/** Gets a dependency of this module definition. */
PathExpr getADependency() {
@@ -203,11 +209,15 @@ class AmdModuleDefinition extends CallExpr instanceof AmdModuleDefinition::Range
}
}
+private predicate isPseudoDependency(string s) { s = ["exports", "require", "module"] }
+
/** An AMD dependency, considered as a path expression. */
private class AmdDependencyPath extends PathExprCandidate {
AmdDependencyPath() {
exists(AmdModuleDefinition amd |
- this = amd.getDependencies().getAnElement() or
+ this = amd.getDependencies().getAnElement() and
+ not isPseudoDependency(this.getStringValue())
+ or
this = amd.getARequireCall().getAnArgument()
)
}
diff --git a/javascript/ql/test/library-tests/AMD/tests.expected b/javascript/ql/test/library-tests/AMD/tests.expected
index 265a7f291df..ce9d6f60f5d 100644
--- a/javascript/ql/test/library-tests/AMD/tests.expected
+++ b/javascript/ql/test/library-tests/AMD/tests.expected
@@ -61,7 +61,6 @@ amdModuleDefinition
| umd.js:4:9:4:43 | define( ... actory) | umd.js:1:18:1:24 | factory |
| umd.js:4:9:4:43 | define( ... actory) | umd.js:9:9:14:1 | functio ... };\\n} |
amdModuleDependencies
-| tst2.js:1:1:3:2 | define( ... 42;\\n}) | tst2.js:1:9:1:17 | 'exports' |
| tst3.js:1:1:3:2 | define( ... 42;\\n}) | tst3.js:2:21:2:25 | './a' |
| tst4.js:1:1:11:2 | define( ... };\\n}) | tst4.js:2:9:2:14 | 'a.js' |
| tst4.js:1:1:11:2 | define( ... };\\n}) | tst4.js:3:9:3:13 | 'foo' |
From 9f01ea68f7d3ce004d54cf3d4132c2a2b89b0bea Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen
Date: Fri, 1 Mar 2024 10:19:49 +0100
Subject: [PATCH 015/309] Python: Add type-tracking consistency query
For now I'm only ignoring stdlib nodes, so it's easy for reviewer to see
why we need to have more excludes :)
---
.../TypeTrackingConsistency.ql | 12 +++++
.../TypeTrackingConsistency.expected | 50 +++++++++++++++++++
2 files changed, 62 insertions(+)
create mode 100644 python/ql/consistency-queries/TypeTrackingConsistency.ql
create mode 100644 python/ql/test/experimental/dataflow/typetracking/CONSISTENCY/TypeTrackingConsistency.expected
diff --git a/python/ql/consistency-queries/TypeTrackingConsistency.ql b/python/ql/consistency-queries/TypeTrackingConsistency.ql
new file mode 100644
index 00000000000..f338c4dcb1d
--- /dev/null
+++ b/python/ql/consistency-queries/TypeTrackingConsistency.ql
@@ -0,0 +1,12 @@
+private import python
+private import semmle.python.dataflow.new.DataFlow
+private import semmle.python.dataflow.new.internal.DataFlowPrivate as DataFlowPrivate
+private import semmle.python.dataflow.new.internal.TypeTrackingImpl
+
+private module ConsistencyChecksInput implements ConsistencyChecksInputSig {
+ predicate unreachableNodeExclude(DataFlow::Node n) {
+ not exists(n.getLocation().getFile().getRelativePath())
+ }
+}
+
+import ConsistencyChecks
diff --git a/python/ql/test/experimental/dataflow/typetracking/CONSISTENCY/TypeTrackingConsistency.expected b/python/ql/test/experimental/dataflow/typetracking/CONSISTENCY/TypeTrackingConsistency.expected
new file mode 100644
index 00000000000..8f036153e53
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/typetracking/CONSISTENCY/TypeTrackingConsistency.expected
@@ -0,0 +1,50 @@
+unreachableNode
+| attribute_tests.py:6:5:6:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:12:9:12:9 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:13:5:13:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:28:5:28:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:29:17:29:17 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:30:5:30:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:39:13:39:13 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:45:5:45:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:77:10:77:16 | [post] ControlFlowNode for MyClass | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:89:13:89:13 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:95:5:95:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:102:13:102:13 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:109:5:109:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:117:5:117:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:123:5:123:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:130:5:130:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:137:5:137:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:150:18:150:21 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:153:19:153:22 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:156:34:156:37 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:159:12:159:21 | [pre] ControlFlowNode for MyClass2() | Unreachable node in step of kind call. |
+| attribute_tests.py:160:7:160:14 | [post] ControlFlowNode for instance | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:167:20:167:23 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:170:19:170:22 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:173:34:173:37 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:177:1:177:8 | [post] ControlFlowNode for instance | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:178:1:178:8 | [post] ControlFlowNode for instance | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:54:5:54:12 | [post] ControlFlowNode for mymodule | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:55:9:55:16 | [post] ControlFlowNode for mymodule | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:72:15:72:15 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:74:13:74:17 | [post] ControlFlowNode for print | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:92:9:92:13 | [post] ControlFlowNode for print | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:98:2:98:13 | [post] ControlFlowNode for my_decorator | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:130:15:130:18 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:133:15:133:18 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:136:15:136:18 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:142:15:142:18 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:145:15:145:18 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:148:15:148:18 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:151:20:151:23 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:152:9:152:12 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:153:9:153:13 | [post] ControlFlowNode for super | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:162:5:162:7 | [post] ControlFlowNode for foo | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:163:9:163:11 | [post] ControlFlowNode for foo | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:179:14:179:24 | [post] ControlFlowNode for get_tracked | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:181:1:181:5 | [post] ControlFlowNode for print | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:188:9:188:13 | [post] ControlFlowNode for print | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:192:9:192:13 | [post] ControlFlowNode for print | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:208:14:208:30 | [post] ControlFlowNode for yielding_function | Unreachable node in step of kind simpleLocalSmallStep. |
From bbe8c6dcaa3f0702741b83d9706f01ca5d713be2 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen
Date: Fri, 1 Mar 2024 10:23:50 +0100
Subject: [PATCH 016/309] Python: Remove synth postupdate nodes from
tt-consistency
---
.../TypeTrackingConsistency.ql | 2 +
.../TypeTrackingConsistency.expected | 48 -------------------
2 files changed, 2 insertions(+), 48 deletions(-)
diff --git a/python/ql/consistency-queries/TypeTrackingConsistency.ql b/python/ql/consistency-queries/TypeTrackingConsistency.ql
index f338c4dcb1d..772960b08a8 100644
--- a/python/ql/consistency-queries/TypeTrackingConsistency.ql
+++ b/python/ql/consistency-queries/TypeTrackingConsistency.ql
@@ -6,6 +6,8 @@ private import semmle.python.dataflow.new.internal.TypeTrackingImpl
private module ConsistencyChecksInput implements ConsistencyChecksInputSig {
predicate unreachableNodeExclude(DataFlow::Node n) {
not exists(n.getLocation().getFile().getRelativePath())
+ or
+ n instanceof DataFlowPrivate::SyntheticPostUpdateNode
}
}
diff --git a/python/ql/test/experimental/dataflow/typetracking/CONSISTENCY/TypeTrackingConsistency.expected b/python/ql/test/experimental/dataflow/typetracking/CONSISTENCY/TypeTrackingConsistency.expected
index 8f036153e53..8cba9c02c17 100644
--- a/python/ql/test/experimental/dataflow/typetracking/CONSISTENCY/TypeTrackingConsistency.expected
+++ b/python/ql/test/experimental/dataflow/typetracking/CONSISTENCY/TypeTrackingConsistency.expected
@@ -1,50 +1,2 @@
unreachableNode
-| attribute_tests.py:6:5:6:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:12:9:12:9 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:13:5:13:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:28:5:28:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:29:17:29:17 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:30:5:30:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:39:13:39:13 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:45:5:45:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:77:10:77:16 | [post] ControlFlowNode for MyClass | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:89:13:89:13 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:95:5:95:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:102:13:102:13 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:109:5:109:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:117:5:117:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:123:5:123:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:130:5:130:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:137:5:137:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:150:18:150:21 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:153:19:153:22 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:156:34:156:37 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
| attribute_tests.py:159:12:159:21 | [pre] ControlFlowNode for MyClass2() | Unreachable node in step of kind call. |
-| attribute_tests.py:160:7:160:14 | [post] ControlFlowNode for instance | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:167:20:167:23 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:170:19:170:22 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:173:34:173:37 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:177:1:177:8 | [post] ControlFlowNode for instance | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:178:1:178:8 | [post] ControlFlowNode for instance | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:54:5:54:12 | [post] ControlFlowNode for mymodule | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:55:9:55:16 | [post] ControlFlowNode for mymodule | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:72:15:72:15 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:74:13:74:17 | [post] ControlFlowNode for print | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:92:9:92:13 | [post] ControlFlowNode for print | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:98:2:98:13 | [post] ControlFlowNode for my_decorator | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:130:15:130:18 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:133:15:133:18 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:136:15:136:18 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:142:15:142:18 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:145:15:145:18 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:148:15:148:18 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:151:20:151:23 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:152:9:152:12 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:153:9:153:13 | [post] ControlFlowNode for super | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:162:5:162:7 | [post] ControlFlowNode for foo | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:163:9:163:11 | [post] ControlFlowNode for foo | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:179:14:179:24 | [post] ControlFlowNode for get_tracked | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:181:1:181:5 | [post] ControlFlowNode for print | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:188:9:188:13 | [post] ControlFlowNode for print | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:192:9:192:13 | [post] ControlFlowNode for print | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:208:14:208:30 | [post] ControlFlowNode for yielding_function | Unreachable node in step of kind simpleLocalSmallStep. |
From ff5f79475099580c8652062988352f37143206bb Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen
Date: Fri, 1 Mar 2024 10:27:29 +0100
Subject: [PATCH 017/309] Python: Exclude synth preupdate nodes from
tt-consistency
... and that should be it :+1: (so that's why I'm allowing the tests to
run on all data-flow nodes again)
---
python/ql/consistency-queries/TypeTrackingConsistency.ql | 4 ++--
.../typetracking/CONSISTENCY/TypeTrackingConsistency.expected | 2 --
2 files changed, 2 insertions(+), 4 deletions(-)
delete mode 100644 python/ql/test/experimental/dataflow/typetracking/CONSISTENCY/TypeTrackingConsistency.expected
diff --git a/python/ql/consistency-queries/TypeTrackingConsistency.ql b/python/ql/consistency-queries/TypeTrackingConsistency.ql
index 772960b08a8..3083f2b5f1a 100644
--- a/python/ql/consistency-queries/TypeTrackingConsistency.ql
+++ b/python/ql/consistency-queries/TypeTrackingConsistency.ql
@@ -5,9 +5,9 @@ private import semmle.python.dataflow.new.internal.TypeTrackingImpl
private module ConsistencyChecksInput implements ConsistencyChecksInputSig {
predicate unreachableNodeExclude(DataFlow::Node n) {
- not exists(n.getLocation().getFile().getRelativePath())
- or
n instanceof DataFlowPrivate::SyntheticPostUpdateNode
+ or
+ n instanceof DataFlowPrivate::SyntheticPreUpdateNode
}
}
diff --git a/python/ql/test/experimental/dataflow/typetracking/CONSISTENCY/TypeTrackingConsistency.expected b/python/ql/test/experimental/dataflow/typetracking/CONSISTENCY/TypeTrackingConsistency.expected
deleted file mode 100644
index 8cba9c02c17..00000000000
--- a/python/ql/test/experimental/dataflow/typetracking/CONSISTENCY/TypeTrackingConsistency.expected
+++ /dev/null
@@ -1,2 +0,0 @@
-unreachableNode
-| attribute_tests.py:159:12:159:21 | [pre] ControlFlowNode for MyClass2() | Unreachable node in step of kind call. |
From bff95c4c1b5ed5fca74215dccd3190758b9679e9 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen
Date: Fri, 1 Mar 2024 13:58:33 +0100
Subject: [PATCH 018/309] Python: Add example of consistency failure
---
.../Arguments/CONSISTENCY/TypeTrackingConsistency.expected | 7 +++++++
1 file changed, 7 insertions(+)
create mode 100644 python/ql/test/query-tests/Classes/Arguments/CONSISTENCY/TypeTrackingConsistency.expected
diff --git a/python/ql/test/query-tests/Classes/Arguments/CONSISTENCY/TypeTrackingConsistency.expected b/python/ql/test/query-tests/Classes/Arguments/CONSISTENCY/TypeTrackingConsistency.expected
new file mode 100644
index 00000000000..c48725c1ebf
--- /dev/null
+++ b/python/ql/test/query-tests/Classes/Arguments/CONSISTENCY/TypeTrackingConsistency.expected
@@ -0,0 +1,7 @@
+unreachableNode
+| wrong_arguments.py:65:1:65:7 | SynthDictSplatArgumentNode | Unreachable node in step of kind call. |
+| wrong_arguments.py:66:1:66:7 | SynthDictSplatArgumentNode | Unreachable node in step of kind call. |
+| wrong_arguments.py:67:1:67:12 | SynthDictSplatArgumentNode | Unreachable node in step of kind call. |
+| wrong_arguments.py:71:1:71:7 | SynthDictSplatArgumentNode | Unreachable node in step of kind call. |
+| wrong_arguments.py:72:1:72:12 | SynthDictSplatArgumentNode | Unreachable node in step of kind call. |
+| wrong_arguments.py:73:1:73:7 | SynthDictSplatArgumentNode | Unreachable node in step of kind call. |
From 1658a1cb801e140d185e6064a190c2bc0f613126 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen
Date: Fri, 1 Mar 2024 13:59:00 +0100
Subject: [PATCH 019/309] Python: Ignore SynthDictSplatArgumentNode failures
---
python/ql/consistency-queries/TypeTrackingConsistency.ql | 3 +++
.../Arguments/CONSISTENCY/TypeTrackingConsistency.expected | 7 -------
2 files changed, 3 insertions(+), 7 deletions(-)
delete mode 100644 python/ql/test/query-tests/Classes/Arguments/CONSISTENCY/TypeTrackingConsistency.expected
diff --git a/python/ql/consistency-queries/TypeTrackingConsistency.ql b/python/ql/consistency-queries/TypeTrackingConsistency.ql
index 3083f2b5f1a..68f9e9e5fa7 100644
--- a/python/ql/consistency-queries/TypeTrackingConsistency.ql
+++ b/python/ql/consistency-queries/TypeTrackingConsistency.ql
@@ -8,6 +8,9 @@ private module ConsistencyChecksInput implements ConsistencyChecksInputSig {
n instanceof DataFlowPrivate::SyntheticPostUpdateNode
or
n instanceof DataFlowPrivate::SyntheticPreUpdateNode
+ or
+ // TODO: when adding support for proper content, handle **kwargs passing better!
+ n instanceof DataFlowPrivate::SynthDictSplatArgumentNode
}
}
diff --git a/python/ql/test/query-tests/Classes/Arguments/CONSISTENCY/TypeTrackingConsistency.expected b/python/ql/test/query-tests/Classes/Arguments/CONSISTENCY/TypeTrackingConsistency.expected
deleted file mode 100644
index c48725c1ebf..00000000000
--- a/python/ql/test/query-tests/Classes/Arguments/CONSISTENCY/TypeTrackingConsistency.expected
+++ /dev/null
@@ -1,7 +0,0 @@
-unreachableNode
-| wrong_arguments.py:65:1:65:7 | SynthDictSplatArgumentNode | Unreachable node in step of kind call. |
-| wrong_arguments.py:66:1:66:7 | SynthDictSplatArgumentNode | Unreachable node in step of kind call. |
-| wrong_arguments.py:67:1:67:12 | SynthDictSplatArgumentNode | Unreachable node in step of kind call. |
-| wrong_arguments.py:71:1:71:7 | SynthDictSplatArgumentNode | Unreachable node in step of kind call. |
-| wrong_arguments.py:72:1:72:12 | SynthDictSplatArgumentNode | Unreachable node in step of kind call. |
-| wrong_arguments.py:73:1:73:7 | SynthDictSplatArgumentNode | Unreachable node in step of kind call. |
From 5d212514c63ae288371b3878d64f6ed01d7e543b Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen
Date: Fri, 1 Mar 2024 14:07:08 +0100
Subject: [PATCH 020/309] Python: Add example of consistency failure
---
.../TypeTrackingConsistency.expected | 51 +++++++++++++++++++
1 file changed, 51 insertions(+)
create mode 100644 python/ql/test/experimental/dataflow/match/CONSISTENCY/TypeTrackingConsistency.expected
diff --git a/python/ql/test/experimental/dataflow/match/CONSISTENCY/TypeTrackingConsistency.expected b/python/ql/test/experimental/dataflow/match/CONSISTENCY/TypeTrackingConsistency.expected
new file mode 100644
index 00000000000..52cd572e19f
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/match/CONSISTENCY/TypeTrackingConsistency.expected
@@ -0,0 +1,51 @@
+unreachableNode
+| test.py:72:15:72:15 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:72:15:72:15 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:72:18:72:18 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:72:18:72:18 | ControlFlowNode for y | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:73:20:73:20 | ControlFlowNode for x | Unreachable node in step of kind call. |
+| test.py:74:18:74:18 | ControlFlowNode for y | Unreachable node in step of kind call. |
+| test.py:79:15:79:15 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:79:15:79:15 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:79:18:79:18 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:79:18:79:18 | ControlFlowNode for y | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:80:20:80:20 | ControlFlowNode for x | Unreachable node in step of kind call. |
+| test.py:81:18:81:18 | ControlFlowNode for y | Unreachable node in step of kind call. |
+| test.py:89:15:89:15 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:89:15:89:15 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:89:19:89:19 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:89:19:89:19 | ControlFlowNode for y | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:90:20:90:20 | ControlFlowNode for x | Unreachable node in step of kind call. |
+| test.py:96:15:96:15 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:96:15:96:15 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:96:19:96:19 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:96:19:96:19 | ControlFlowNode for y | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:97:18:97:18 | ControlFlowNode for x | Unreachable node in step of kind call. |
+| test.py:103:15:103:15 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:103:15:103:15 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:103:19:103:19 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:103:19:103:19 | ControlFlowNode for y | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:104:20:104:20 | ControlFlowNode for x | Unreachable node in step of kind call. |
+| test.py:110:15:110:15 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:110:15:110:15 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:110:19:110:19 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:110:19:110:19 | ControlFlowNode for y | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:111:18:111:18 | ControlFlowNode for x | Unreachable node in step of kind call. |
+| test.py:117:20:117:20 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:117:20:117:20 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:117:28:117:28 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:117:28:117:28 | ControlFlowNode for y | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:118:20:118:20 | ControlFlowNode for x | Unreachable node in step of kind call. |
+| test.py:119:18:119:18 | ControlFlowNode for y | Unreachable node in step of kind call. |
+| test.py:125:20:125:20 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:125:20:125:20 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:126:20:126:20 | ControlFlowNode for x | Unreachable node in step of kind call. |
+| test.py:132:20:132:20 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:132:20:132:20 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:133:18:133:18 | ControlFlowNode for x | Unreachable node in step of kind call. |
+| test.py:151:27:151:27 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:151:27:151:27 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:152:18:152:18 | ControlFlowNode for x | Unreachable node in step of kind call. |
+| test.py:155:27:155:27 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:155:27:155:27 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:156:20:156:20 | ControlFlowNode for x | Unreachable node in step of kind call. |
From bcd5c08ebd2693690e5bdba177c023668cf45e5b Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen
Date: Fri, 1 Mar 2024 14:15:32 +0100
Subject: [PATCH 021/309] Python: Ignore match-related inconsistencies
---
.../TypeTrackingConsistency.ql | 9 ++++
.../TypeTrackingConsistency.expected | 51 -------------------
2 files changed, 9 insertions(+), 51 deletions(-)
delete mode 100644 python/ql/test/experimental/dataflow/match/CONSISTENCY/TypeTrackingConsistency.expected
diff --git a/python/ql/consistency-queries/TypeTrackingConsistency.ql b/python/ql/consistency-queries/TypeTrackingConsistency.ql
index 68f9e9e5fa7..b2349fc0f1c 100644
--- a/python/ql/consistency-queries/TypeTrackingConsistency.ql
+++ b/python/ql/consistency-queries/TypeTrackingConsistency.ql
@@ -11,6 +11,15 @@ private module ConsistencyChecksInput implements ConsistencyChecksInputSig {
or
// TODO: when adding support for proper content, handle **kwargs passing better!
n instanceof DataFlowPrivate::SynthDictSplatArgumentNode
+ or
+ // TODO: when adding support for proper content, handle unpacking tuples in match
+ // cases better, such as
+ //
+ // match (NONSOURCE, SOURCE):
+ // case (x, y): ...
+ exists(DataFlow::Node m | m.asCfgNode().getNode() instanceof MatchCapturePattern |
+ TypeTrackingInput::simpleLocalSmallStep*(m, n)
+ )
}
}
diff --git a/python/ql/test/experimental/dataflow/match/CONSISTENCY/TypeTrackingConsistency.expected b/python/ql/test/experimental/dataflow/match/CONSISTENCY/TypeTrackingConsistency.expected
deleted file mode 100644
index 52cd572e19f..00000000000
--- a/python/ql/test/experimental/dataflow/match/CONSISTENCY/TypeTrackingConsistency.expected
+++ /dev/null
@@ -1,51 +0,0 @@
-unreachableNode
-| test.py:72:15:72:15 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:72:15:72:15 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:72:18:72:18 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:72:18:72:18 | ControlFlowNode for y | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:73:20:73:20 | ControlFlowNode for x | Unreachable node in step of kind call. |
-| test.py:74:18:74:18 | ControlFlowNode for y | Unreachable node in step of kind call. |
-| test.py:79:15:79:15 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:79:15:79:15 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:79:18:79:18 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:79:18:79:18 | ControlFlowNode for y | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:80:20:80:20 | ControlFlowNode for x | Unreachable node in step of kind call. |
-| test.py:81:18:81:18 | ControlFlowNode for y | Unreachable node in step of kind call. |
-| test.py:89:15:89:15 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:89:15:89:15 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:89:19:89:19 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:89:19:89:19 | ControlFlowNode for y | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:90:20:90:20 | ControlFlowNode for x | Unreachable node in step of kind call. |
-| test.py:96:15:96:15 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:96:15:96:15 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:96:19:96:19 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:96:19:96:19 | ControlFlowNode for y | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:97:18:97:18 | ControlFlowNode for x | Unreachable node in step of kind call. |
-| test.py:103:15:103:15 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:103:15:103:15 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:103:19:103:19 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:103:19:103:19 | ControlFlowNode for y | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:104:20:104:20 | ControlFlowNode for x | Unreachable node in step of kind call. |
-| test.py:110:15:110:15 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:110:15:110:15 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:110:19:110:19 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:110:19:110:19 | ControlFlowNode for y | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:111:18:111:18 | ControlFlowNode for x | Unreachable node in step of kind call. |
-| test.py:117:20:117:20 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:117:20:117:20 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:117:28:117:28 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:117:28:117:28 | ControlFlowNode for y | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:118:20:118:20 | ControlFlowNode for x | Unreachable node in step of kind call. |
-| test.py:119:18:119:18 | ControlFlowNode for y | Unreachable node in step of kind call. |
-| test.py:125:20:125:20 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:125:20:125:20 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:126:20:126:20 | ControlFlowNode for x | Unreachable node in step of kind call. |
-| test.py:132:20:132:20 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:132:20:132:20 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:133:18:133:18 | ControlFlowNode for x | Unreachable node in step of kind call. |
-| test.py:151:27:151:27 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:151:27:151:27 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:152:18:152:18 | ControlFlowNode for x | Unreachable node in step of kind call. |
-| test.py:155:27:155:27 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:155:27:155:27 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:156:20:156:20 | ControlFlowNode for x | Unreachable node in step of kind call. |
From 7e3e5db3dbde7aa9304c758bd21141deff2225e6 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen
Date: Fri, 1 Mar 2024 14:21:16 +0100
Subject: [PATCH 022/309] Python: Add example of consistency failure
---
.../TypeTrackingConsistency.expected | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
create mode 100644 python/ql/test/experimental/dataflow/coverage/CONSISTENCY/TypeTrackingConsistency.expected
diff --git a/python/ql/test/experimental/dataflow/coverage/CONSISTENCY/TypeTrackingConsistency.expected b/python/ql/test/experimental/dataflow/coverage/CONSISTENCY/TypeTrackingConsistency.expected
new file mode 100644
index 00000000000..30f0348dc6d
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/coverage/CONSISTENCY/TypeTrackingConsistency.expected
@@ -0,0 +1,18 @@
+unreachableNode
+| test.py:215:16:215:19 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:226:17:226:20 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:231:20:231:24 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:580:9:580:12 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:589:5:589:11 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:589:6:589:10 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:589:7:589:9 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:618:7:618:16 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:626:7:626:16 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:634:6:634:17 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:646:6:646:14 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:655:7:655:13 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:664:7:664:13 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:673:6:673:14 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:693:9:693:11 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:701:9:701:12 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:710:9:710:14 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
From 7c60562132247d13ee75a9e466caa73f8e1ebba6 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen
Date: Fri, 1 Mar 2024 14:22:18 +0100
Subject: [PATCH 023/309] Python: Ignore IterableSequenceNode inconsistencies
---
.../TypeTrackingConsistency.ql | 4 ++++
.../TypeTrackingConsistency.expected | 18 ------------------
2 files changed, 4 insertions(+), 18 deletions(-)
delete mode 100644 python/ql/test/experimental/dataflow/coverage/CONSISTENCY/TypeTrackingConsistency.expected
diff --git a/python/ql/consistency-queries/TypeTrackingConsistency.ql b/python/ql/consistency-queries/TypeTrackingConsistency.ql
index b2349fc0f1c..b8f1e3a1b48 100644
--- a/python/ql/consistency-queries/TypeTrackingConsistency.ql
+++ b/python/ql/consistency-queries/TypeTrackingConsistency.ql
@@ -20,6 +20,10 @@ private module ConsistencyChecksInput implements ConsistencyChecksInputSig {
exists(DataFlow::Node m | m.asCfgNode().getNode() instanceof MatchCapturePattern |
TypeTrackingInput::simpleLocalSmallStep*(m, n)
)
+ or
+ // TODO: when adding support for proper content, handle iterable unpacking better
+ // such as `for k,v in items:`, or `a, (b,c) = ...`
+ n instanceof DataFlow::IterableSequenceNode
}
}
diff --git a/python/ql/test/experimental/dataflow/coverage/CONSISTENCY/TypeTrackingConsistency.expected b/python/ql/test/experimental/dataflow/coverage/CONSISTENCY/TypeTrackingConsistency.expected
deleted file mode 100644
index 30f0348dc6d..00000000000
--- a/python/ql/test/experimental/dataflow/coverage/CONSISTENCY/TypeTrackingConsistency.expected
+++ /dev/null
@@ -1,18 +0,0 @@
-unreachableNode
-| test.py:215:16:215:19 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:226:17:226:20 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:231:20:231:24 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:580:9:580:12 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:589:5:589:11 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:589:6:589:10 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:589:7:589:9 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:618:7:618:16 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:626:7:626:16 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:634:6:634:17 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:646:6:646:14 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:655:7:655:13 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:664:7:664:13 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:673:6:673:14 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:693:9:693:11 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:701:9:701:12 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:710:9:710:14 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
From 2b2ea597ce384aa1488de9c98ec7bb229ee0aa2c Mon Sep 17 00:00:00 2001
From: Angela P Wen
Date: Mon, 4 Mar 2024 16:42:38 +0000
Subject: [PATCH 024/309] Fix formatting on changenotes
---
ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md | 2 +-
ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md b/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
index 56d2dcf5c73..6f3a90768ba 100644
--- a/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
+++ b/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
@@ -1,4 +1,4 @@
---
category: minorAnalysis
---
-Calls to `Arel::Nodes::SqlLiteral.new` are now modeled as instances of the `SqlConstruction` concept, as well as propagating taint from their argument.
\ No newline at end of file
+* Calls to `Arel::Nodes::SqlLiteral.new` are now modeled as instances of the `SqlConstruction` concept, as well as propagating taint from their argument.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md b/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
index f08bd54efa2..350e049b5bf 100644
--- a/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
+++ b/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
@@ -1,4 +1,4 @@
---
category: minorAnalysis
---
-Calls to `I18n.translate` as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
\ No newline at end of file
+* Calls to `I18n.translate` as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
\ No newline at end of file
From a67218a0277be5516730cf3bdb0fb1932c14b2c1 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
Date: Mon, 4 Mar 2024 17:42:08 +0000
Subject: [PATCH 025/309] Release preparation for version 2.16.4
---
cpp/ql/lib/CHANGELOG.md | 6 ++++++
.../0.12.7.md} | 9 +++++----
cpp/ql/lib/codeql-pack.release.yml | 2 +-
cpp/ql/lib/qlpack.yml | 2 +-
cpp/ql/src/CHANGELOG.md | 7 +++++++
.../2024-02-29-non-constant-format-path-query.md | 4 ----
.../0.9.6.md} | 8 +++++---
cpp/ql/src/codeql-pack.release.yml | 2 +-
cpp/ql/src/qlpack.yml | 2 +-
csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md | 4 ++++
.../Solorigate/lib/change-notes/released/1.7.10.md | 3 +++
.../Solorigate/lib/codeql-pack.release.yml | 2 +-
csharp/ql/campaigns/Solorigate/lib/qlpack.yml | 2 +-
csharp/ql/campaigns/Solorigate/src/CHANGELOG.md | 4 ++++
.../Solorigate/src/change-notes/released/1.7.10.md | 3 +++
.../Solorigate/src/codeql-pack.release.yml | 2 +-
csharp/ql/campaigns/Solorigate/src/qlpack.yml | 2 +-
csharp/ql/lib/CHANGELOG.md | 14 ++++++++++++++
.../change-notes/2024-02-21-getonly-properties.md | 4 ----
.../ql/lib/change-notes/2024-02-22-no-db-stats.md | 4 ----
.../change-notes/2024-02-23-compiler-generated.md | 4 ----
.../2024-02-26-variable-capture-flow.md | 4 ----
.../2024-02-28-experimental-attribute.md | 4 ----
.../2024-02-28-refreadonly-parameter.md | 4 ----
csharp/ql/lib/change-notes/released/0.8.10.md | 13 +++++++++++++
csharp/ql/lib/codeql-pack.release.yml | 2 +-
csharp/ql/lib/qlpack.yml | 2 +-
csharp/ql/src/CHANGELOG.md | 6 ++++++
.../0.8.10.md} | 9 +++++----
csharp/ql/src/codeql-pack.release.yml | 2 +-
csharp/ql/src/qlpack.yml | 2 +-
go/ql/consistency-queries/CHANGELOG.md | 4 ++++
.../change-notes/released/0.0.9.md | 3 +++
go/ql/consistency-queries/codeql-pack.release.yml | 2 +-
go/ql/consistency-queries/qlpack.yml | 2 +-
go/ql/lib/CHANGELOG.md | 11 +++++++++++
.../lib/change-notes/2024-02-14-range-map-read.md | 4 ----
.../0.7.10.md} | 11 ++++++++---
go/ql/lib/codeql-pack.release.yml | 2 +-
go/ql/lib/qlpack.yml | 2 +-
go/ql/src/CHANGELOG.md | 4 ++++
go/ql/src/change-notes/released/0.7.10.md | 3 +++
go/ql/src/codeql-pack.release.yml | 2 +-
go/ql/src/qlpack.yml | 2 +-
java/ql/automodel/src/CHANGELOG.md | 4 ++++
.../automodel/src/change-notes/released/0.0.17.md | 3 +++
java/ql/automodel/src/codeql-pack.release.yml | 2 +-
java/ql/automodel/src/qlpack.yml | 2 +-
java/ql/lib/CHANGELOG.md | 11 +++++++++++
.../change-notes/2024-02-23-widget-flowsteps.md | 4 ----
java/ql/lib/change-notes/2024-02-27-error-types.md | 4 ----
.../lib/change-notes/2024-02-27-mvnw-versions.md | 4 ----
java/ql/lib/change-notes/released/0.8.10.md | 10 ++++++++++
java/ql/lib/codeql-pack.release.yml | 2 +-
java/ql/lib/qlpack.yml | 2 +-
java/ql/src/CHANGELOG.md | 10 ++++++++++
.../2024-02-12-android-insecure-keys.md | 4 ----
.../0.8.10.md} | 11 ++++++++---
java/ql/src/codeql-pack.release.yml | 2 +-
java/ql/src/qlpack.yml | 2 +-
javascript/ql/lib/CHANGELOG.md | 4 ++++
javascript/ql/lib/change-notes/released/0.8.10.md | 3 +++
javascript/ql/lib/codeql-pack.release.yml | 2 +-
javascript/ql/lib/qlpack.yml | 2 +-
javascript/ql/src/CHANGELOG.md | 4 ++++
javascript/ql/src/change-notes/released/0.8.10.md | 3 +++
javascript/ql/src/codeql-pack.release.yml | 2 +-
javascript/ql/src/qlpack.yml | 2 +-
misc/suite-helpers/CHANGELOG.md | 4 ++++
misc/suite-helpers/change-notes/released/0.7.10.md | 3 +++
misc/suite-helpers/codeql-pack.release.yml | 2 +-
misc/suite-helpers/qlpack.yml | 2 +-
python/ql/lib/CHANGELOG.md | 7 +++++++
.../2024-02-28-iterable-unpacking-module-scope.md | 4 ----
.../0.11.10.md} | 8 +++++---
python/ql/lib/codeql-pack.release.yml | 2 +-
python/ql/lib/qlpack.yml | 2 +-
python/ql/src/CHANGELOG.md | 6 ++++++
.../0.9.10.md} | 7 ++++---
python/ql/src/codeql-pack.release.yml | 2 +-
python/ql/src/qlpack.yml | 2 +-
ruby/ql/lib/CHANGELOG.md | 9 +++++++++
...2024-02-15-activerecord_connection_sql_sinks.md | 4 ----
.../2024-02-20-activerecord-sql-sink-arguments.md | 4 ----
.../lib/change-notes/2024-02-26-arel-sqlliteral.md | 4 ----
.../lib/change-notes/2024-02-29-i18n-translate.md | 4 ----
ruby/ql/lib/change-notes/released/0.8.10.md | 8 ++++++++
ruby/ql/lib/codeql-pack.release.yml | 2 +-
ruby/ql/lib/qlpack.yml | 2 +-
ruby/ql/src/CHANGELOG.md | 7 +++++++
.../2024-02-13-rails-more-request-sources.md | 4 ----
.../0.8.10.md} | 10 ++++++----
ruby/ql/src/codeql-pack.release.yml | 2 +-
ruby/ql/src/qlpack.yml | 2 +-
shared/controlflow/CHANGELOG.md | 4 ++++
shared/controlflow/change-notes/released/0.1.10.md | 3 +++
shared/controlflow/codeql-pack.release.yml | 2 +-
shared/controlflow/qlpack.yml | 2 +-
shared/dataflow/CHANGELOG.md | 4 ++++
shared/dataflow/change-notes/released/0.2.1.md | 3 +++
shared/dataflow/codeql-pack.release.yml | 2 +-
shared/dataflow/qlpack.yml | 2 +-
shared/mad/CHANGELOG.md | 4 ++++
shared/mad/change-notes/released/0.2.10.md | 3 +++
shared/mad/codeql-pack.release.yml | 2 +-
shared/mad/qlpack.yml | 2 +-
shared/rangeanalysis/CHANGELOG.md | 4 ++++
.../rangeanalysis/change-notes/released/0.0.9.md | 3 +++
shared/rangeanalysis/codeql-pack.release.yml | 2 +-
shared/rangeanalysis/qlpack.yml | 2 +-
shared/regex/CHANGELOG.md | 4 ++++
shared/regex/change-notes/released/0.2.10.md | 3 +++
shared/regex/codeql-pack.release.yml | 2 +-
shared/regex/qlpack.yml | 2 +-
shared/ssa/CHANGELOG.md | 4 ++++
shared/ssa/change-notes/released/0.2.10.md | 3 +++
shared/ssa/codeql-pack.release.yml | 2 +-
shared/ssa/qlpack.yml | 2 +-
shared/threat-models/CHANGELOG.md | 4 ++++
.../threat-models/change-notes/released/0.0.9.md | 3 +++
shared/threat-models/codeql-pack.release.yml | 2 +-
shared/threat-models/qlpack.yml | 2 +-
shared/tutorial/CHANGELOG.md | 4 ++++
shared/tutorial/change-notes/released/0.2.10.md | 3 +++
shared/tutorial/codeql-pack.release.yml | 2 +-
shared/tutorial/qlpack.yml | 2 +-
shared/typetracking/CHANGELOG.md | 4 ++++
.../typetracking/change-notes/released/0.2.10.md | 3 +++
shared/typetracking/codeql-pack.release.yml | 2 +-
shared/typetracking/qlpack.yml | 2 +-
shared/typos/CHANGELOG.md | 4 ++++
shared/typos/change-notes/released/0.2.10.md | 3 +++
shared/typos/codeql-pack.release.yml | 2 +-
shared/typos/qlpack.yml | 2 +-
shared/util/CHANGELOG.md | 4 ++++
shared/util/change-notes/released/0.2.10.md | 3 +++
shared/util/codeql-pack.release.yml | 2 +-
shared/util/qlpack.yml | 2 +-
shared/yaml/CHANGELOG.md | 4 ++++
shared/yaml/change-notes/released/0.2.10.md | 3 +++
shared/yaml/codeql-pack.release.yml | 2 +-
shared/yaml/qlpack.yml | 2 +-
swift/ql/lib/CHANGELOG.md | 6 ++++++
.../0.3.10.md} | 7 ++++---
swift/ql/lib/codeql-pack.release.yml | 2 +-
swift/ql/lib/qlpack.yml | 2 +-
swift/ql/src/CHANGELOG.md | 4 ++++
swift/ql/src/change-notes/released/0.3.10.md | 3 +++
swift/ql/src/codeql-pack.release.yml | 2 +-
swift/ql/src/qlpack.yml | 2 +-
150 files changed, 394 insertions(+), 168 deletions(-)
rename cpp/ql/lib/change-notes/{2024-02-26-ir-named-destructors.md => released/0.12.7.md} (54%)
delete mode 100644 cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md
rename cpp/ql/src/change-notes/{2024-02-16-modelled-functions-block-flow.md => released/0.9.6.md} (77%)
create mode 100644 csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md
create mode 100644 csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md
create mode 100644 csharp/ql/lib/change-notes/released/0.8.10.md
rename csharp/ql/src/change-notes/{2024-02-06-threat-models.md => released/0.8.10.md} (88%)
create mode 100644 go/ql/consistency-queries/change-notes/released/0.0.9.md
delete mode 100644 go/ql/lib/change-notes/2024-02-14-range-map-read.md
rename go/ql/lib/change-notes/{2024-03-04-autobuilder-changes.md => released/0.7.10.md} (68%)
create mode 100644 go/ql/src/change-notes/released/0.7.10.md
create mode 100644 java/ql/automodel/src/change-notes/released/0.0.17.md
delete mode 100644 java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md
delete mode 100644 java/ql/lib/change-notes/2024-02-27-error-types.md
delete mode 100644 java/ql/lib/change-notes/2024-02-27-mvnw-versions.md
create mode 100644 java/ql/lib/change-notes/released/0.8.10.md
delete mode 100644 java/ql/src/change-notes/2024-02-12-android-insecure-keys.md
rename java/ql/src/change-notes/{2024-03-04-sensitive-log-remove-null-from-sources.md => released/0.8.10.md} (54%)
create mode 100644 javascript/ql/lib/change-notes/released/0.8.10.md
create mode 100644 javascript/ql/src/change-notes/released/0.8.10.md
create mode 100644 misc/suite-helpers/change-notes/released/0.7.10.md
delete mode 100644 python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md
rename python/ql/lib/change-notes/{2024-03-01-dict-update-content.md => released/0.11.10.md} (52%)
rename python/ql/src/change-notes/{2024-03-04-nosql-injection.md => released/0.9.10.md} (81%)
delete mode 100644 ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md
delete mode 100644 ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md
delete mode 100644 ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
delete mode 100644 ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
create mode 100644 ruby/ql/lib/change-notes/released/0.8.10.md
delete mode 100644 ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md
rename ruby/ql/src/change-notes/{2024-03-01-method-code-injection-sinks.md => released/0.8.10.md} (51%)
create mode 100644 shared/controlflow/change-notes/released/0.1.10.md
create mode 100644 shared/dataflow/change-notes/released/0.2.1.md
create mode 100644 shared/mad/change-notes/released/0.2.10.md
create mode 100644 shared/rangeanalysis/change-notes/released/0.0.9.md
create mode 100644 shared/regex/change-notes/released/0.2.10.md
create mode 100644 shared/ssa/change-notes/released/0.2.10.md
create mode 100644 shared/threat-models/change-notes/released/0.0.9.md
create mode 100644 shared/tutorial/change-notes/released/0.2.10.md
create mode 100644 shared/typetracking/change-notes/released/0.2.10.md
create mode 100644 shared/typos/change-notes/released/0.2.10.md
create mode 100644 shared/util/change-notes/released/0.2.10.md
create mode 100644 shared/yaml/change-notes/released/0.2.10.md
rename swift/ql/lib/change-notes/{2024-02-22-extension-patch.md => released/0.3.10.md} (83%)
create mode 100644 swift/ql/src/change-notes/released/0.3.10.md
diff --git a/cpp/ql/lib/CHANGELOG.md b/cpp/ql/lib/CHANGELOG.md
index b3091ec37d8..e1c0dfbecd9 100644
--- a/cpp/ql/lib/CHANGELOG.md
+++ b/cpp/ql/lib/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 0.12.7
+
+### Minor Analysis Improvements
+
+* Added destructors for named objects to the intermediate representation.
+
## 0.12.6
### New Features
diff --git a/cpp/ql/lib/change-notes/2024-02-26-ir-named-destructors.md b/cpp/ql/lib/change-notes/released/0.12.7.md
similarity index 54%
rename from cpp/ql/lib/change-notes/2024-02-26-ir-named-destructors.md
rename to cpp/ql/lib/change-notes/released/0.12.7.md
index 4e35decaf8e..856a8b665c7 100644
--- a/cpp/ql/lib/change-notes/2024-02-26-ir-named-destructors.md
+++ b/cpp/ql/lib/change-notes/released/0.12.7.md
@@ -1,4 +1,5 @@
----
-category: minorAnalysis
----
-* Added destructors for named objects to the intermediate representation.
\ No newline at end of file
+## 0.12.7
+
+### Minor Analysis Improvements
+
+* Added destructors for named objects to the intermediate representation.
diff --git a/cpp/ql/lib/codeql-pack.release.yml b/cpp/ql/lib/codeql-pack.release.yml
index 170a312c104..20419e9c610 100644
--- a/cpp/ql/lib/codeql-pack.release.yml
+++ b/cpp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.12.6
+lastReleaseVersion: 0.12.7
diff --git a/cpp/ql/lib/qlpack.yml b/cpp/ql/lib/qlpack.yml
index 8e201fff594..3bb9229bf94 100644
--- a/cpp/ql/lib/qlpack.yml
+++ b/cpp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-all
-version: 0.12.7-dev
+version: 0.12.7
groups: cpp
dbscheme: semmlecode.cpp.dbscheme
extractor: cpp
diff --git a/cpp/ql/src/CHANGELOG.md b/cpp/ql/src/CHANGELOG.md
index ffcd73ff5d7..f6acd424bb0 100644
--- a/cpp/ql/src/CHANGELOG.md
+++ b/cpp/ql/src/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 0.9.6
+
+### Minor Analysis Improvements
+
+* The "non-constant format string" query (`cpp/non-constant-format`) has been converted to a `path-problem` query.
+* The new C/C++ dataflow and taint-tracking libraries (`semmle.code.cpp.dataflow.new.DataFlow` and `semmle.code.cpp.dataflow.new.TaintTracking`) now implicitly assume that dataflow and taint modelled via `DataFlowFunction` and `TaintFunction` always fully overwrite their buffers and thus act as flow barriers. As a result, many dataflow and taint-tracking queries now produce fewer false positives. To remove this assumption and go back to the previous behavior for a given model, one can override the new `isPartialWrite` predicate.
+
## 0.9.5
### Minor Analysis Improvements
diff --git a/cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md b/cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md
deleted file mode 100644
index 2e5933a61e8..00000000000
--- a/cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The "non-constant format string" query (`cpp/non-constant-format`) has been converted to a `path-problem` query.
\ No newline at end of file
diff --git a/cpp/ql/src/change-notes/2024-02-16-modelled-functions-block-flow.md b/cpp/ql/src/change-notes/released/0.9.6.md
similarity index 77%
rename from cpp/ql/src/change-notes/2024-02-16-modelled-functions-block-flow.md
rename to cpp/ql/src/change-notes/released/0.9.6.md
index d6ef3c3e056..0c85f3f9f0f 100644
--- a/cpp/ql/src/change-notes/2024-02-16-modelled-functions-block-flow.md
+++ b/cpp/ql/src/change-notes/released/0.9.6.md
@@ -1,4 +1,6 @@
----
-category: minorAnalysis
----
+## 0.9.6
+
+### Minor Analysis Improvements
+
+* The "non-constant format string" query (`cpp/non-constant-format`) has been converted to a `path-problem` query.
* The new C/C++ dataflow and taint-tracking libraries (`semmle.code.cpp.dataflow.new.DataFlow` and `semmle.code.cpp.dataflow.new.TaintTracking`) now implicitly assume that dataflow and taint modelled via `DataFlowFunction` and `TaintFunction` always fully overwrite their buffers and thus act as flow barriers. As a result, many dataflow and taint-tracking queries now produce fewer false positives. To remove this assumption and go back to the previous behavior for a given model, one can override the new `isPartialWrite` predicate.
diff --git a/cpp/ql/src/codeql-pack.release.yml b/cpp/ql/src/codeql-pack.release.yml
index 460240feaff..19139c132b2 100644
--- a/cpp/ql/src/codeql-pack.release.yml
+++ b/cpp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.9.5
+lastReleaseVersion: 0.9.6
diff --git a/cpp/ql/src/qlpack.yml b/cpp/ql/src/qlpack.yml
index 31bd20166b2..4052647bb97 100644
--- a/cpp/ql/src/qlpack.yml
+++ b/cpp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-queries
-version: 0.9.6-dev
+version: 0.9.6
groups:
- cpp
- queries
diff --git a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
index 190b83b0f25..82eacfc84f7 100644
--- a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
+++ b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.7.10
+
+No user-facing changes.
+
## 1.7.9
No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md
new file mode 100644
index 00000000000..8e8007d8475
--- /dev/null
+++ b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md
@@ -0,0 +1,3 @@
+## 1.7.10
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
index 678da6bc37e..31c7fe07020 100644
--- a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.7.9
+lastReleaseVersion: 1.7.10
diff --git a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
index 7e643b0fac3..ee993bed0c9 100644
--- a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-all
-version: 1.7.10-dev
+version: 1.7.10
groups:
- csharp
- solorigate
diff --git a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
index 190b83b0f25..82eacfc84f7 100644
--- a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
+++ b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.7.10
+
+No user-facing changes.
+
## 1.7.9
No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md
new file mode 100644
index 00000000000..8e8007d8475
--- /dev/null
+++ b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md
@@ -0,0 +1,3 @@
+## 1.7.10
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
index 678da6bc37e..31c7fe07020 100644
--- a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
+++ b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.7.9
+lastReleaseVersion: 1.7.10
diff --git a/csharp/ql/campaigns/Solorigate/src/qlpack.yml b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
index 8654bbfd031..1f421754fc8 100644
--- a/csharp/ql/campaigns/Solorigate/src/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-queries
-version: 1.7.10-dev
+version: 1.7.10
groups:
- csharp
- solorigate
diff --git a/csharp/ql/lib/CHANGELOG.md b/csharp/ql/lib/CHANGELOG.md
index 95fd64c5270..16cc14259e1 100644
--- a/csharp/ql/lib/CHANGELOG.md
+++ b/csharp/ql/lib/CHANGELOG.md
@@ -1,3 +1,17 @@
+## 0.8.10
+
+### Major Analysis Improvements
+
+* Improved support for flow through captured variables that properly adheres to inter-procedural control flow.
+* We no longer make use of CodeQL database stats, which may affect join-orders in custom queries. It is therefore recommended to test performance of custom queries after upgrading to this version.
+
+### Minor Analysis Improvements
+
+* C# 12: Add QL library support (`ExperimentalAttribute`) for the experimental attribute.
+* C# 12: Add extractor and QL library support for `ref readonly` parameters.
+* C#: The table `expr_compiler_generated` has been deleted and its content has been added to `compiler_generated`.
+* Data flow via get only properties like `public object Obj { get; }` is now captured by the data flow library.
+
## 0.8.9
### Minor Analysis Improvements
diff --git a/csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md b/csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md
deleted file mode 100644
index 6bb8e99c71e..00000000000
--- a/csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Data flow via get only properties like `public object Obj { get; }` is now captured by the data flow library.
diff --git a/csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md b/csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md
deleted file mode 100644
index d6ffbd523ac..00000000000
--- a/csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: majorAnalysis
----
-* We no longer make use of CodeQL database stats, which may affect join-orders in custom queries. It is therefore recommended to test performance of custom queries after upgrading to this version.
diff --git a/csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md b/csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md
deleted file mode 100644
index 9b1739b9b6d..00000000000
--- a/csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* C#: The table `expr_compiler_generated` has been deleted and its content has been added to `compiler_generated`.
diff --git a/csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md b/csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md
deleted file mode 100644
index 66ab65083dc..00000000000
--- a/csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: majorAnalysis
----
-* Improved support for flow through captured variables that properly adheres to inter-procedural control flow.
\ No newline at end of file
diff --git a/csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md b/csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md
deleted file mode 100644
index 8749c790954..00000000000
--- a/csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* C# 12: Add QL library support (`ExperimentalAttribute`) for the experimental attribute.
diff --git a/csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md b/csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md
deleted file mode 100644
index 586b5341d29..00000000000
--- a/csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* C# 12: Add extractor and QL library support for `ref readonly` parameters.
diff --git a/csharp/ql/lib/change-notes/released/0.8.10.md b/csharp/ql/lib/change-notes/released/0.8.10.md
new file mode 100644
index 00000000000..f591ddc5b21
--- /dev/null
+++ b/csharp/ql/lib/change-notes/released/0.8.10.md
@@ -0,0 +1,13 @@
+## 0.8.10
+
+### Major Analysis Improvements
+
+* Improved support for flow through captured variables that properly adheres to inter-procedural control flow.
+* We no longer make use of CodeQL database stats, which may affect join-orders in custom queries. It is therefore recommended to test performance of custom queries after upgrading to this version.
+
+### Minor Analysis Improvements
+
+* C# 12: Add QL library support (`ExperimentalAttribute`) for the experimental attribute.
+* C# 12: Add extractor and QL library support for `ref readonly` parameters.
+* C#: The table `expr_compiler_generated` has been deleted and its content has been added to `compiler_generated`.
+* Data flow via get only properties like `public object Obj { get; }` is now captured by the data flow library.
diff --git a/csharp/ql/lib/codeql-pack.release.yml b/csharp/ql/lib/codeql-pack.release.yml
index 5290c29b7fe..0521f0f75fa 100644
--- a/csharp/ql/lib/codeql-pack.release.yml
+++ b/csharp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/csharp/ql/lib/qlpack.yml b/csharp/ql/lib/qlpack.yml
index d75ea3c6320..93c5c1120a2 100644
--- a/csharp/ql/lib/qlpack.yml
+++ b/csharp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-all
-version: 0.8.10-dev
+version: 0.8.10
groups: csharp
dbscheme: semmlecode.csharp.dbscheme
extractor: csharp
diff --git a/csharp/ql/src/CHANGELOG.md b/csharp/ql/src/CHANGELOG.md
index 9fe1609363f..46c939e5cee 100644
--- a/csharp/ql/src/CHANGELOG.md
+++ b/csharp/ql/src/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. The changed queries are `cs/code-injection`, `cs/command-line-injection`, `cs/user-controlled-bypass`, `cs/count-untrusted-data-external-api`, `cs/untrusted-data-to-external-api`, `cs/ldap-injection`, `cs/log-forging`, `cs/xml/missing-validation`, `cs/redos`, `cs/regex-injection`, `cs/resource-injection`, `cs/sql-injection`, `cs/path-injection`, `cs/unsafe-deserialization-untrusted-input`, `cs/web/unvalidated-url-redirection`, `cs/xml/insecure-dtd-handling`, `cs/xml/xpath-injection`, `cs/web/xss`, and `cs/uncontrolled-format-string`.
+
## 0.8.9
### Minor Analysis Improvements
diff --git a/csharp/ql/src/change-notes/2024-02-06-threat-models.md b/csharp/ql/src/change-notes/released/0.8.10.md
similarity index 88%
rename from csharp/ql/src/change-notes/2024-02-06-threat-models.md
rename to csharp/ql/src/change-notes/released/0.8.10.md
index 69ac4e4dc17..702161c3d28 100644
--- a/csharp/ql/src/change-notes/2024-02-06-threat-models.md
+++ b/csharp/ql/src/change-notes/released/0.8.10.md
@@ -1,4 +1,5 @@
----
-category: minorAnalysis
----
-* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. The changed queries are `cs/code-injection`, `cs/command-line-injection`, `cs/user-controlled-bypass`, `cs/count-untrusted-data-external-api`, `cs/untrusted-data-to-external-api`, `cs/ldap-injection`, `cs/log-forging`, `cs/xml/missing-validation`, `cs/redos`, `cs/regex-injection`, `cs/resource-injection`, `cs/sql-injection`, `cs/path-injection`, `cs/unsafe-deserialization-untrusted-input`, `cs/web/unvalidated-url-redirection`, `cs/xml/insecure-dtd-handling`, `cs/xml/xpath-injection`, `cs/web/xss`, and `cs/uncontrolled-format-string`.
\ No newline at end of file
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. The changed queries are `cs/code-injection`, `cs/command-line-injection`, `cs/user-controlled-bypass`, `cs/count-untrusted-data-external-api`, `cs/untrusted-data-to-external-api`, `cs/ldap-injection`, `cs/log-forging`, `cs/xml/missing-validation`, `cs/redos`, `cs/regex-injection`, `cs/resource-injection`, `cs/sql-injection`, `cs/path-injection`, `cs/unsafe-deserialization-untrusted-input`, `cs/web/unvalidated-url-redirection`, `cs/xml/insecure-dtd-handling`, `cs/xml/xpath-injection`, `cs/web/xss`, and `cs/uncontrolled-format-string`.
diff --git a/csharp/ql/src/codeql-pack.release.yml b/csharp/ql/src/codeql-pack.release.yml
index 5290c29b7fe..0521f0f75fa 100644
--- a/csharp/ql/src/codeql-pack.release.yml
+++ b/csharp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/csharp/ql/src/qlpack.yml b/csharp/ql/src/qlpack.yml
index 9ee23cc7307..46384094b19 100644
--- a/csharp/ql/src/qlpack.yml
+++ b/csharp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-queries
-version: 0.8.10-dev
+version: 0.8.10
groups:
- csharp
- queries
diff --git a/go/ql/consistency-queries/CHANGELOG.md b/go/ql/consistency-queries/CHANGELOG.md
index fba2a870356..a59e560c415 100644
--- a/go/ql/consistency-queries/CHANGELOG.md
+++ b/go/ql/consistency-queries/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.0.9
+
+No user-facing changes.
+
## 0.0.8
No user-facing changes.
diff --git a/go/ql/consistency-queries/change-notes/released/0.0.9.md b/go/ql/consistency-queries/change-notes/released/0.0.9.md
new file mode 100644
index 00000000000..c9e17c6d6cf
--- /dev/null
+++ b/go/ql/consistency-queries/change-notes/released/0.0.9.md
@@ -0,0 +1,3 @@
+## 0.0.9
+
+No user-facing changes.
diff --git a/go/ql/consistency-queries/codeql-pack.release.yml b/go/ql/consistency-queries/codeql-pack.release.yml
index 58fdc6b45de..ecdd64fbab8 100644
--- a/go/ql/consistency-queries/codeql-pack.release.yml
+++ b/go/ql/consistency-queries/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.8
+lastReleaseVersion: 0.0.9
diff --git a/go/ql/consistency-queries/qlpack.yml b/go/ql/consistency-queries/qlpack.yml
index b574796b995..d5a2fbee5f1 100644
--- a/go/ql/consistency-queries/qlpack.yml
+++ b/go/ql/consistency-queries/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql-go-consistency-queries
-version: 0.0.9-dev
+version: 0.0.9
groups:
- go
- queries
diff --git a/go/ql/lib/CHANGELOG.md b/go/ql/lib/CHANGELOG.md
index 65a2376217b..fee5fd37a26 100644
--- a/go/ql/lib/CHANGELOG.md
+++ b/go/ql/lib/CHANGELOG.md
@@ -1,3 +1,14 @@
+## 0.7.10
+
+### Major Analysis Improvements
+
+* We have significantly improved the Go autobuilder to understand a greater range of project layouts, which allows Go source files to be analysed that could previously not be processed.
+* Go 1.22 has been included in the range of supported Go versions.
+
+### Bug Fixes
+
+* Fixed dataflow out of a `map` using a `range` statement.
+
## 0.7.9
No user-facing changes.
diff --git a/go/ql/lib/change-notes/2024-02-14-range-map-read.md b/go/ql/lib/change-notes/2024-02-14-range-map-read.md
deleted file mode 100644
index ea45737a72e..00000000000
--- a/go/ql/lib/change-notes/2024-02-14-range-map-read.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: fix
----
-* Fixed dataflow out of a `map` using a `range` statement.
diff --git a/go/ql/lib/change-notes/2024-03-04-autobuilder-changes.md b/go/ql/lib/change-notes/released/0.7.10.md
similarity index 68%
rename from go/ql/lib/change-notes/2024-03-04-autobuilder-changes.md
rename to go/ql/lib/change-notes/released/0.7.10.md
index 0442a571029..55954f8a394 100644
--- a/go/ql/lib/change-notes/2024-03-04-autobuilder-changes.md
+++ b/go/ql/lib/change-notes/released/0.7.10.md
@@ -1,5 +1,10 @@
----
-category: majorAnalysis
----
+## 0.7.10
+
+### Major Analysis Improvements
+
* We have significantly improved the Go autobuilder to understand a greater range of project layouts, which allows Go source files to be analysed that could previously not be processed.
* Go 1.22 has been included in the range of supported Go versions.
+
+### Bug Fixes
+
+* Fixed dataflow out of a `map` using a `range` statement.
diff --git a/go/ql/lib/codeql-pack.release.yml b/go/ql/lib/codeql-pack.release.yml
index 576395f3405..67518567297 100644
--- a/go/ql/lib/codeql-pack.release.yml
+++ b/go/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.7.9
+lastReleaseVersion: 0.7.10
diff --git a/go/ql/lib/qlpack.yml b/go/ql/lib/qlpack.yml
index f21e478efa6..8cc190fa880 100644
--- a/go/ql/lib/qlpack.yml
+++ b/go/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-all
-version: 0.7.10-dev
+version: 0.7.10
groups: go
dbscheme: go.dbscheme
extractor: go
diff --git a/go/ql/src/CHANGELOG.md b/go/ql/src/CHANGELOG.md
index d95165a3a34..24e38b9890e 100644
--- a/go/ql/src/CHANGELOG.md
+++ b/go/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.7.10
+
+No user-facing changes.
+
## 0.7.9
### New Queries
diff --git a/go/ql/src/change-notes/released/0.7.10.md b/go/ql/src/change-notes/released/0.7.10.md
new file mode 100644
index 00000000000..989c5b8f682
--- /dev/null
+++ b/go/ql/src/change-notes/released/0.7.10.md
@@ -0,0 +1,3 @@
+## 0.7.10
+
+No user-facing changes.
diff --git a/go/ql/src/codeql-pack.release.yml b/go/ql/src/codeql-pack.release.yml
index 576395f3405..67518567297 100644
--- a/go/ql/src/codeql-pack.release.yml
+++ b/go/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.7.9
+lastReleaseVersion: 0.7.10
diff --git a/go/ql/src/qlpack.yml b/go/ql/src/qlpack.yml
index d91cab59612..4ded3a52f63 100644
--- a/go/ql/src/qlpack.yml
+++ b/go/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-queries
-version: 0.7.10-dev
+version: 0.7.10
groups:
- go
- queries
diff --git a/java/ql/automodel/src/CHANGELOG.md b/java/ql/automodel/src/CHANGELOG.md
index 4a3c54adb38..c3282c773a9 100644
--- a/java/ql/automodel/src/CHANGELOG.md
+++ b/java/ql/automodel/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.0.17
+
+No user-facing changes.
+
## 0.0.16
No user-facing changes.
diff --git a/java/ql/automodel/src/change-notes/released/0.0.17.md b/java/ql/automodel/src/change-notes/released/0.0.17.md
new file mode 100644
index 00000000000..62cc89030a6
--- /dev/null
+++ b/java/ql/automodel/src/change-notes/released/0.0.17.md
@@ -0,0 +1,3 @@
+## 0.0.17
+
+No user-facing changes.
diff --git a/java/ql/automodel/src/codeql-pack.release.yml b/java/ql/automodel/src/codeql-pack.release.yml
index a49f7be4cff..cbc3d3cd493 100644
--- a/java/ql/automodel/src/codeql-pack.release.yml
+++ b/java/ql/automodel/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.16
+lastReleaseVersion: 0.0.17
diff --git a/java/ql/automodel/src/qlpack.yml b/java/ql/automodel/src/qlpack.yml
index 898239be098..59fab0cdcc5 100644
--- a/java/ql/automodel/src/qlpack.yml
+++ b/java/ql/automodel/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-automodel-queries
-version: 0.0.17-dev
+version: 0.0.17
groups:
- java
- automodel
diff --git a/java/ql/lib/CHANGELOG.md b/java/ql/lib/CHANGELOG.md
index d369cbdc931..2a02ccee6ab 100644
--- a/java/ql/lib/CHANGELOG.md
+++ b/java/ql/lib/CHANGELOG.md
@@ -1,3 +1,14 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Java expressions with erroneous types (e.g. the result of a call whose callee couldn't be resolved during extraction) are now given a CodeQL `ErrorType` more often.
+
+### Bug Fixes
+
+* Fixed the Java autobuilder overriding the version of Maven used by a project when the Maven wrapper `mvnw` is in use and the `maven-wrapper.jar` file is not present in the repository.
+* Some flow steps related to `android.text.Editable.toString` that were accidentally disabled have been re-enabled.
+
## 0.8.9
### Deprecated APIs
diff --git a/java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md b/java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md
deleted file mode 100644
index eb560fba07d..00000000000
--- a/java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: fix
----
-* Some flow steps related to `android.text.Editable.toString` that were accidentally disabled have been re-enabled.
diff --git a/java/ql/lib/change-notes/2024-02-27-error-types.md b/java/ql/lib/change-notes/2024-02-27-error-types.md
deleted file mode 100644
index cdc6d7620aa..00000000000
--- a/java/ql/lib/change-notes/2024-02-27-error-types.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Java expressions with erroneous types (e.g. the result of a call whose callee couldn't be resolved during extraction) are now given a CodeQL `ErrorType` more often.
diff --git a/java/ql/lib/change-notes/2024-02-27-mvnw-versions.md b/java/ql/lib/change-notes/2024-02-27-mvnw-versions.md
deleted file mode 100644
index a0227088ae9..00000000000
--- a/java/ql/lib/change-notes/2024-02-27-mvnw-versions.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: fix
----
-* Fixed the Java autobuilder overriding the version of Maven used by a project when the Maven wrapper `mvnw` is in use and the `maven-wrapper.jar` file is not present in the repository.
diff --git a/java/ql/lib/change-notes/released/0.8.10.md b/java/ql/lib/change-notes/released/0.8.10.md
new file mode 100644
index 00000000000..b45f14bf347
--- /dev/null
+++ b/java/ql/lib/change-notes/released/0.8.10.md
@@ -0,0 +1,10 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Java expressions with erroneous types (e.g. the result of a call whose callee couldn't be resolved during extraction) are now given a CodeQL `ErrorType` more often.
+
+### Bug Fixes
+
+* Fixed the Java autobuilder overriding the version of Maven used by a project when the Maven wrapper `mvnw` is in use and the `maven-wrapper.jar` file is not present in the repository.
+* Some flow steps related to `android.text.Editable.toString` that were accidentally disabled have been re-enabled.
diff --git a/java/ql/lib/codeql-pack.release.yml b/java/ql/lib/codeql-pack.release.yml
index 5290c29b7fe..0521f0f75fa 100644
--- a/java/ql/lib/codeql-pack.release.yml
+++ b/java/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/java/ql/lib/qlpack.yml b/java/ql/lib/qlpack.yml
index 15b4982d41e..428eedc75e3 100644
--- a/java/ql/lib/qlpack.yml
+++ b/java/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-all
-version: 0.8.10-dev
+version: 0.8.10
groups: java
dbscheme: config/semmlecode.dbscheme
extractor: java
diff --git a/java/ql/src/CHANGELOG.md b/java/ql/src/CHANGELOG.md
index 5d835351453..c61275f5ed8 100644
--- a/java/ql/src/CHANGELOG.md
+++ b/java/ql/src/CHANGELOG.md
@@ -1,3 +1,13 @@
+## 0.8.10
+
+### New Queries
+
+* Added a new query `java/android/insecure-local-key-gen` for finding instances of keys generated for biometric authentication in an insecure way.
+
+### Minor Analysis Improvements
+
+* To reduce the number of false positives in the query "Insertion of sensitive information into log files" (`java/sensitive-log`), variables with names that contain "null" (case-insensitively) are no longer considered sources of sensitive information.
+
## 0.8.9
### New Queries
diff --git a/java/ql/src/change-notes/2024-02-12-android-insecure-keys.md b/java/ql/src/change-notes/2024-02-12-android-insecure-keys.md
deleted file mode 100644
index 1de07727796..00000000000
--- a/java/ql/src/change-notes/2024-02-12-android-insecure-keys.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: newQuery
----
-* Added a new query `java/android/insecure-local-key-gen` for finding instances of keys generated for biometric authentication in an insecure way.
\ No newline at end of file
diff --git a/java/ql/src/change-notes/2024-03-04-sensitive-log-remove-null-from-sources.md b/java/ql/src/change-notes/released/0.8.10.md
similarity index 54%
rename from java/ql/src/change-notes/2024-03-04-sensitive-log-remove-null-from-sources.md
rename to java/ql/src/change-notes/released/0.8.10.md
index 0bb4f18f2bd..c5d18ae3379 100644
--- a/java/ql/src/change-notes/2024-03-04-sensitive-log-remove-null-from-sources.md
+++ b/java/ql/src/change-notes/released/0.8.10.md
@@ -1,4 +1,9 @@
----
-category: minorAnalysis
----
+## 0.8.10
+
+### New Queries
+
+* Added a new query `java/android/insecure-local-key-gen` for finding instances of keys generated for biometric authentication in an insecure way.
+
+### Minor Analysis Improvements
+
* To reduce the number of false positives in the query "Insertion of sensitive information into log files" (`java/sensitive-log`), variables with names that contain "null" (case-insensitively) are no longer considered sources of sensitive information.
diff --git a/java/ql/src/codeql-pack.release.yml b/java/ql/src/codeql-pack.release.yml
index 5290c29b7fe..0521f0f75fa 100644
--- a/java/ql/src/codeql-pack.release.yml
+++ b/java/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/java/ql/src/qlpack.yml b/java/ql/src/qlpack.yml
index 8f4de528e21..ebbdbeee3b2 100644
--- a/java/ql/src/qlpack.yml
+++ b/java/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-queries
-version: 0.8.10-dev
+version: 0.8.10
groups:
- java
- queries
diff --git a/javascript/ql/lib/CHANGELOG.md b/javascript/ql/lib/CHANGELOG.md
index 5b97ebbb22b..d5edcc00513 100644
--- a/javascript/ql/lib/CHANGELOG.md
+++ b/javascript/ql/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.8.10
+
+No user-facing changes.
+
## 0.8.9
### Minor Analysis Improvements
diff --git a/javascript/ql/lib/change-notes/released/0.8.10.md b/javascript/ql/lib/change-notes/released/0.8.10.md
new file mode 100644
index 00000000000..777bbd2fded
--- /dev/null
+++ b/javascript/ql/lib/change-notes/released/0.8.10.md
@@ -0,0 +1,3 @@
+## 0.8.10
+
+No user-facing changes.
diff --git a/javascript/ql/lib/codeql-pack.release.yml b/javascript/ql/lib/codeql-pack.release.yml
index 5290c29b7fe..0521f0f75fa 100644
--- a/javascript/ql/lib/codeql-pack.release.yml
+++ b/javascript/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/javascript/ql/lib/qlpack.yml b/javascript/ql/lib/qlpack.yml
index ef3ca7521ac..da16493a21c 100644
--- a/javascript/ql/lib/qlpack.yml
+++ b/javascript/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-all
-version: 0.8.10-dev
+version: 0.8.10
groups: javascript
dbscheme: semmlecode.javascript.dbscheme
extractor: javascript
diff --git a/javascript/ql/src/CHANGELOG.md b/javascript/ql/src/CHANGELOG.md
index 85516e3625d..b9627cac5ee 100644
--- a/javascript/ql/src/CHANGELOG.md
+++ b/javascript/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.8.10
+
+No user-facing changes.
+
## 0.8.9
### Bug Fixes
diff --git a/javascript/ql/src/change-notes/released/0.8.10.md b/javascript/ql/src/change-notes/released/0.8.10.md
new file mode 100644
index 00000000000..777bbd2fded
--- /dev/null
+++ b/javascript/ql/src/change-notes/released/0.8.10.md
@@ -0,0 +1,3 @@
+## 0.8.10
+
+No user-facing changes.
diff --git a/javascript/ql/src/codeql-pack.release.yml b/javascript/ql/src/codeql-pack.release.yml
index 5290c29b7fe..0521f0f75fa 100644
--- a/javascript/ql/src/codeql-pack.release.yml
+++ b/javascript/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/javascript/ql/src/qlpack.yml b/javascript/ql/src/qlpack.yml
index b6181aa30e9..d224952c564 100644
--- a/javascript/ql/src/qlpack.yml
+++ b/javascript/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-queries
-version: 0.8.10-dev
+version: 0.8.10
groups:
- javascript
- queries
diff --git a/misc/suite-helpers/CHANGELOG.md b/misc/suite-helpers/CHANGELOG.md
index 3c06dd69b0f..1c4455b66c4 100644
--- a/misc/suite-helpers/CHANGELOG.md
+++ b/misc/suite-helpers/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.7.10
+
+No user-facing changes.
+
## 0.7.9
No user-facing changes.
diff --git a/misc/suite-helpers/change-notes/released/0.7.10.md b/misc/suite-helpers/change-notes/released/0.7.10.md
new file mode 100644
index 00000000000..989c5b8f682
--- /dev/null
+++ b/misc/suite-helpers/change-notes/released/0.7.10.md
@@ -0,0 +1,3 @@
+## 0.7.10
+
+No user-facing changes.
diff --git a/misc/suite-helpers/codeql-pack.release.yml b/misc/suite-helpers/codeql-pack.release.yml
index 576395f3405..67518567297 100644
--- a/misc/suite-helpers/codeql-pack.release.yml
+++ b/misc/suite-helpers/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.7.9
+lastReleaseVersion: 0.7.10
diff --git a/misc/suite-helpers/qlpack.yml b/misc/suite-helpers/qlpack.yml
index 49b7a6bda4c..54d978d5efe 100644
--- a/misc/suite-helpers/qlpack.yml
+++ b/misc/suite-helpers/qlpack.yml
@@ -1,4 +1,4 @@
name: codeql/suite-helpers
-version: 0.7.10-dev
+version: 0.7.10
groups: shared
warnOnImplicitThis: true
diff --git a/python/ql/lib/CHANGELOG.md b/python/ql/lib/CHANGELOG.md
index e6f318c51ea..f095607ca1b 100644
--- a/python/ql/lib/CHANGELOG.md
+++ b/python/ql/lib/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 0.11.10
+
+### Minor Analysis Improvements
+
+* Fixed missing flow for dictionary updates (`d[] = ...`) when `` is a string constant not used in dictionary literals or as name of keyword-argument.
+* Fixed flow for iterable unpacking (`a,b = my_tuple`) when it occurs on top-level (module) scope.
+
## 0.11.9
### Minor Analysis Improvements
diff --git a/python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md b/python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md
deleted file mode 100644
index 3c47c6ba866..00000000000
--- a/python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Fixed flow for iterable unpacking (`a,b = my_tuple`) when it occurs on top-level (module) scope.
diff --git a/python/ql/lib/change-notes/2024-03-01-dict-update-content.md b/python/ql/lib/change-notes/released/0.11.10.md
similarity index 52%
rename from python/ql/lib/change-notes/2024-03-01-dict-update-content.md
rename to python/ql/lib/change-notes/released/0.11.10.md
index dfb8d247fff..ed873724e4f 100644
--- a/python/ql/lib/change-notes/2024-03-01-dict-update-content.md
+++ b/python/ql/lib/change-notes/released/0.11.10.md
@@ -1,4 +1,6 @@
----
-category: minorAnalysis
----
+## 0.11.10
+
+### Minor Analysis Improvements
+
* Fixed missing flow for dictionary updates (`d[] = ...`) when `` is a string constant not used in dictionary literals or as name of keyword-argument.
+* Fixed flow for iterable unpacking (`a,b = my_tuple`) when it occurs on top-level (module) scope.
diff --git a/python/ql/lib/codeql-pack.release.yml b/python/ql/lib/codeql-pack.release.yml
index b064d1778a1..ddddcbe9193 100644
--- a/python/ql/lib/codeql-pack.release.yml
+++ b/python/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.11.9
+lastReleaseVersion: 0.11.10
diff --git a/python/ql/lib/qlpack.yml b/python/ql/lib/qlpack.yml
index e9f66e205f2..59a8b4c96d1 100644
--- a/python/ql/lib/qlpack.yml
+++ b/python/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-all
-version: 0.11.10-dev
+version: 0.11.10
groups: python
dbscheme: semmlecode.python.dbscheme
extractor: python
diff --git a/python/ql/src/CHANGELOG.md b/python/ql/src/CHANGELOG.md
index 50762bcbf34..d4245aba7a6 100644
--- a/python/ql/src/CHANGELOG.md
+++ b/python/ql/src/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 0.9.10
+
+### New Queries
+
+* The query `py/nosql-injection` for finding NoSQL injection vulnerabilities is now part of the default security suite.
+
## 0.9.9
No user-facing changes.
diff --git a/python/ql/src/change-notes/2024-03-04-nosql-injection.md b/python/ql/src/change-notes/released/0.9.10.md
similarity index 81%
rename from python/ql/src/change-notes/2024-03-04-nosql-injection.md
rename to python/ql/src/change-notes/released/0.9.10.md
index 6e98540c757..4cbb221b789 100644
--- a/python/ql/src/change-notes/2024-03-04-nosql-injection.md
+++ b/python/ql/src/change-notes/released/0.9.10.md
@@ -1,4 +1,5 @@
----
-category: newQuery
----
+## 0.9.10
+
+### New Queries
+
* The query `py/nosql-injection` for finding NoSQL injection vulnerabilities is now part of the default security suite.
diff --git a/python/ql/src/codeql-pack.release.yml b/python/ql/src/codeql-pack.release.yml
index aabed7c396b..d086ed69541 100644
--- a/python/ql/src/codeql-pack.release.yml
+++ b/python/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.9.9
+lastReleaseVersion: 0.9.10
diff --git a/python/ql/src/qlpack.yml b/python/ql/src/qlpack.yml
index aa18f2d8707..c920f667836 100644
--- a/python/ql/src/qlpack.yml
+++ b/python/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-queries
-version: 0.9.10-dev
+version: 0.9.10
groups:
- python
- queries
diff --git a/ruby/ql/lib/CHANGELOG.md b/ruby/ql/lib/CHANGELOG.md
index a623a151e89..c61a12e0f4a 100644
--- a/ruby/ql/lib/CHANGELOG.md
+++ b/ruby/ql/lib/CHANGELOG.md
@@ -1,3 +1,12 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Calls to `I18n.translate` as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
+* Calls to `Arel::Nodes::SqlLiteral.new` are now modeled as instances of the `SqlConstruction` concept, as well as propagating taint from their argument.
+* Additional arguments beyond the first of calls to the `ActiveRecord` methods `select`, `reselect`, `order`, `reorder`, `joins`, `group`, and `pluck` are now recognized as sql injection sinks.
+* Calls to several methods of `ActiveRecord::Connection`, such as `ActiveRecord::Connection#exec_query`, are now recognized as SQL executions, including those via subclasses.
+
## 0.8.9
### Minor Analysis Improvements
diff --git a/ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md b/ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md
deleted file mode 100644
index c2276f284a8..00000000000
--- a/ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Calls to several methods of `ActiveRecord::Connection`, such as `ActiveRecord::Connection#exec_query`, are now recognized as SQL executions, including those via subclasses.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md b/ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md
deleted file mode 100644
index 1486c7a472d..00000000000
--- a/ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Additional arguments beyond the first of calls to the `ActiveRecord` methods `select`, `reselect`, `order`, `reorder`, `joins`, `group`, and `pluck` are now recognized as sql injection sinks.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md b/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
deleted file mode 100644
index 6f3a90768ba..00000000000
--- a/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Calls to `Arel::Nodes::SqlLiteral.new` are now modeled as instances of the `SqlConstruction` concept, as well as propagating taint from their argument.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md b/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
deleted file mode 100644
index 350e049b5bf..00000000000
--- a/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Calls to `I18n.translate` as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/released/0.8.10.md b/ruby/ql/lib/change-notes/released/0.8.10.md
new file mode 100644
index 00000000000..666e28f840e
--- /dev/null
+++ b/ruby/ql/lib/change-notes/released/0.8.10.md
@@ -0,0 +1,8 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Calls to `I18n.translate` as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
+* Calls to `Arel::Nodes::SqlLiteral.new` are now modeled as instances of the `SqlConstruction` concept, as well as propagating taint from their argument.
+* Additional arguments beyond the first of calls to the `ActiveRecord` methods `select`, `reselect`, `order`, `reorder`, `joins`, `group`, and `pluck` are now recognized as sql injection sinks.
+* Calls to several methods of `ActiveRecord::Connection`, such as `ActiveRecord::Connection#exec_query`, are now recognized as SQL executions, including those via subclasses.
diff --git a/ruby/ql/lib/codeql-pack.release.yml b/ruby/ql/lib/codeql-pack.release.yml
index 5290c29b7fe..0521f0f75fa 100644
--- a/ruby/ql/lib/codeql-pack.release.yml
+++ b/ruby/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/ruby/ql/lib/qlpack.yml b/ruby/ql/lib/qlpack.yml
index 7d409b83adb..de5b41999fe 100644
--- a/ruby/ql/lib/qlpack.yml
+++ b/ruby/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-all
-version: 0.8.10-dev
+version: 0.8.10
groups: ruby
extractor: ruby
dbscheme: ruby.dbscheme
diff --git a/ruby/ql/src/CHANGELOG.md b/ruby/ql/src/CHANGELOG.md
index 4149c728eff..f875b6d16ad 100644
--- a/ruby/ql/src/CHANGELOG.md
+++ b/ruby/ql/src/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Calls to `Object#method`, `Object#public_method` and `Object#singleton_method` with untrusted data are now recognised as sinks for code injection.
+* Added additional request sources for Ruby on Rails.
+
## 0.8.9
No user-facing changes.
diff --git a/ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md b/ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md
deleted file mode 100644
index 84ea696dfef..00000000000
--- a/ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Added additional request sources for Ruby on Rails.
\ No newline at end of file
diff --git a/ruby/ql/src/change-notes/2024-03-01-method-code-injection-sinks.md b/ruby/ql/src/change-notes/released/0.8.10.md
similarity index 51%
rename from ruby/ql/src/change-notes/2024-03-01-method-code-injection-sinks.md
rename to ruby/ql/src/change-notes/released/0.8.10.md
index 43e40d3fd53..985cdf8d22e 100644
--- a/ruby/ql/src/change-notes/2024-03-01-method-code-injection-sinks.md
+++ b/ruby/ql/src/change-notes/released/0.8.10.md
@@ -1,4 +1,6 @@
----
-category: minorAnalysis
----
-* Calls to `Object#method`, `Object#public_method` and `Object#singleton_method` with untrusted data are now recognised as sinks for code injection.
\ No newline at end of file
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Calls to `Object#method`, `Object#public_method` and `Object#singleton_method` with untrusted data are now recognised as sinks for code injection.
+* Added additional request sources for Ruby on Rails.
diff --git a/ruby/ql/src/codeql-pack.release.yml b/ruby/ql/src/codeql-pack.release.yml
index 5290c29b7fe..0521f0f75fa 100644
--- a/ruby/ql/src/codeql-pack.release.yml
+++ b/ruby/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/ruby/ql/src/qlpack.yml b/ruby/ql/src/qlpack.yml
index 8af7f9fd797..5e379268234 100644
--- a/ruby/ql/src/qlpack.yml
+++ b/ruby/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-queries
-version: 0.8.10-dev
+version: 0.8.10
groups:
- ruby
- queries
diff --git a/shared/controlflow/CHANGELOG.md b/shared/controlflow/CHANGELOG.md
index dbfa6ef4512..75f2ca53f98 100644
--- a/shared/controlflow/CHANGELOG.md
+++ b/shared/controlflow/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.1.10
+
+No user-facing changes.
+
## 0.1.9
No user-facing changes.
diff --git a/shared/controlflow/change-notes/released/0.1.10.md b/shared/controlflow/change-notes/released/0.1.10.md
new file mode 100644
index 00000000000..47358eeee93
--- /dev/null
+++ b/shared/controlflow/change-notes/released/0.1.10.md
@@ -0,0 +1,3 @@
+## 0.1.10
+
+No user-facing changes.
diff --git a/shared/controlflow/codeql-pack.release.yml b/shared/controlflow/codeql-pack.release.yml
index 1425c0edf7f..30f5ca88be0 100644
--- a/shared/controlflow/codeql-pack.release.yml
+++ b/shared/controlflow/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.1.9
+lastReleaseVersion: 0.1.10
diff --git a/shared/controlflow/qlpack.yml b/shared/controlflow/qlpack.yml
index 9d35a678276..1d43802be42 100644
--- a/shared/controlflow/qlpack.yml
+++ b/shared/controlflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/controlflow
-version: 0.1.10-dev
+version: 0.1.10
groups: shared
library: true
dependencies:
diff --git a/shared/dataflow/CHANGELOG.md b/shared/dataflow/CHANGELOG.md
index 67a5bf589f4..ef80788bded 100644
--- a/shared/dataflow/CHANGELOG.md
+++ b/shared/dataflow/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.1
+
+No user-facing changes.
+
## 0.2.0
### Breaking Changes
diff --git a/shared/dataflow/change-notes/released/0.2.1.md b/shared/dataflow/change-notes/released/0.2.1.md
new file mode 100644
index 00000000000..3dbfc85fe11
--- /dev/null
+++ b/shared/dataflow/change-notes/released/0.2.1.md
@@ -0,0 +1,3 @@
+## 0.2.1
+
+No user-facing changes.
diff --git a/shared/dataflow/codeql-pack.release.yml b/shared/dataflow/codeql-pack.release.yml
index 5274e27ed52..df29a726bcc 100644
--- a/shared/dataflow/codeql-pack.release.yml
+++ b/shared/dataflow/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.0
+lastReleaseVersion: 0.2.1
diff --git a/shared/dataflow/qlpack.yml b/shared/dataflow/qlpack.yml
index 1e7becf71c4..ee422e02ea9 100644
--- a/shared/dataflow/qlpack.yml
+++ b/shared/dataflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/dataflow
-version: 0.2.1-dev
+version: 0.2.1
groups: shared
library: true
dependencies:
diff --git a/shared/mad/CHANGELOG.md b/shared/mad/CHANGELOG.md
index 4d09057118c..4730366775e 100644
--- a/shared/mad/CHANGELOG.md
+++ b/shared/mad/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/mad/change-notes/released/0.2.10.md b/shared/mad/change-notes/released/0.2.10.md
new file mode 100644
index 00000000000..81c9722b19f
--- /dev/null
+++ b/shared/mad/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/mad/codeql-pack.release.yml b/shared/mad/codeql-pack.release.yml
index d021cf0a6be..a71167814cb 100644
--- a/shared/mad/codeql-pack.release.yml
+++ b/shared/mad/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/mad/qlpack.yml b/shared/mad/qlpack.yml
index 22c8f271ccc..6d7269ef3da 100644
--- a/shared/mad/qlpack.yml
+++ b/shared/mad/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/mad
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
dependencies: null
diff --git a/shared/rangeanalysis/CHANGELOG.md b/shared/rangeanalysis/CHANGELOG.md
index 5b8dbcfab22..9943dcb7972 100644
--- a/shared/rangeanalysis/CHANGELOG.md
+++ b/shared/rangeanalysis/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.0.9
+
+No user-facing changes.
+
## 0.0.8
No user-facing changes.
diff --git a/shared/rangeanalysis/change-notes/released/0.0.9.md b/shared/rangeanalysis/change-notes/released/0.0.9.md
new file mode 100644
index 00000000000..c9e17c6d6cf
--- /dev/null
+++ b/shared/rangeanalysis/change-notes/released/0.0.9.md
@@ -0,0 +1,3 @@
+## 0.0.9
+
+No user-facing changes.
diff --git a/shared/rangeanalysis/codeql-pack.release.yml b/shared/rangeanalysis/codeql-pack.release.yml
index 58fdc6b45de..ecdd64fbab8 100644
--- a/shared/rangeanalysis/codeql-pack.release.yml
+++ b/shared/rangeanalysis/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.8
+lastReleaseVersion: 0.0.9
diff --git a/shared/rangeanalysis/qlpack.yml b/shared/rangeanalysis/qlpack.yml
index 836fe51ee34..01db5d5734d 100644
--- a/shared/rangeanalysis/qlpack.yml
+++ b/shared/rangeanalysis/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/rangeanalysis
-version: 0.0.9-dev
+version: 0.0.9
groups: shared
library: true
dependencies:
diff --git a/shared/regex/CHANGELOG.md b/shared/regex/CHANGELOG.md
index cd5f91f71ec..c05869c153d 100644
--- a/shared/regex/CHANGELOG.md
+++ b/shared/regex/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/regex/change-notes/released/0.2.10.md b/shared/regex/change-notes/released/0.2.10.md
new file mode 100644
index 00000000000..81c9722b19f
--- /dev/null
+++ b/shared/regex/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/regex/codeql-pack.release.yml b/shared/regex/codeql-pack.release.yml
index d021cf0a6be..a71167814cb 100644
--- a/shared/regex/codeql-pack.release.yml
+++ b/shared/regex/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/regex/qlpack.yml b/shared/regex/qlpack.yml
index ea3f7f9b238..0d4f485312f 100644
--- a/shared/regex/qlpack.yml
+++ b/shared/regex/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/regex
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
dependencies:
diff --git a/shared/ssa/CHANGELOG.md b/shared/ssa/CHANGELOG.md
index 01acfae0148..a9161ff578b 100644
--- a/shared/ssa/CHANGELOG.md
+++ b/shared/ssa/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/ssa/change-notes/released/0.2.10.md b/shared/ssa/change-notes/released/0.2.10.md
new file mode 100644
index 00000000000..81c9722b19f
--- /dev/null
+++ b/shared/ssa/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/ssa/codeql-pack.release.yml b/shared/ssa/codeql-pack.release.yml
index d021cf0a6be..a71167814cb 100644
--- a/shared/ssa/codeql-pack.release.yml
+++ b/shared/ssa/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/ssa/qlpack.yml b/shared/ssa/qlpack.yml
index 19304ad107f..2ad254711a5 100644
--- a/shared/ssa/qlpack.yml
+++ b/shared/ssa/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ssa
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
dependencies:
diff --git a/shared/threat-models/CHANGELOG.md b/shared/threat-models/CHANGELOG.md
index fba2a870356..a59e560c415 100644
--- a/shared/threat-models/CHANGELOG.md
+++ b/shared/threat-models/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.0.9
+
+No user-facing changes.
+
## 0.0.8
No user-facing changes.
diff --git a/shared/threat-models/change-notes/released/0.0.9.md b/shared/threat-models/change-notes/released/0.0.9.md
new file mode 100644
index 00000000000..c9e17c6d6cf
--- /dev/null
+++ b/shared/threat-models/change-notes/released/0.0.9.md
@@ -0,0 +1,3 @@
+## 0.0.9
+
+No user-facing changes.
diff --git a/shared/threat-models/codeql-pack.release.yml b/shared/threat-models/codeql-pack.release.yml
index 58fdc6b45de..ecdd64fbab8 100644
--- a/shared/threat-models/codeql-pack.release.yml
+++ b/shared/threat-models/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.8
+lastReleaseVersion: 0.0.9
diff --git a/shared/threat-models/qlpack.yml b/shared/threat-models/qlpack.yml
index d0ed9a913b2..60cbbc56fcb 100644
--- a/shared/threat-models/qlpack.yml
+++ b/shared/threat-models/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/threat-models
-version: 0.0.9-dev
+version: 0.0.9
library: true
groups: shared
dataExtensions:
diff --git a/shared/tutorial/CHANGELOG.md b/shared/tutorial/CHANGELOG.md
index 1db3a01af0b..560ad058d5b 100644
--- a/shared/tutorial/CHANGELOG.md
+++ b/shared/tutorial/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/tutorial/change-notes/released/0.2.10.md b/shared/tutorial/change-notes/released/0.2.10.md
new file mode 100644
index 00000000000..81c9722b19f
--- /dev/null
+++ b/shared/tutorial/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/tutorial/codeql-pack.release.yml b/shared/tutorial/codeql-pack.release.yml
index d021cf0a6be..a71167814cb 100644
--- a/shared/tutorial/codeql-pack.release.yml
+++ b/shared/tutorial/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/tutorial/qlpack.yml b/shared/tutorial/qlpack.yml
index b595ae9ee70..69116705c1b 100644
--- a/shared/tutorial/qlpack.yml
+++ b/shared/tutorial/qlpack.yml
@@ -1,7 +1,7 @@
name: codeql/tutorial
description: Library for the CodeQL detective tutorials, helping new users learn to
write CodeQL queries.
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/typetracking/CHANGELOG.md b/shared/typetracking/CHANGELOG.md
index afc857bc6bc..350f9ecbeae 100644
--- a/shared/typetracking/CHANGELOG.md
+++ b/shared/typetracking/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/typetracking/change-notes/released/0.2.10.md b/shared/typetracking/change-notes/released/0.2.10.md
new file mode 100644
index 00000000000..81c9722b19f
--- /dev/null
+++ b/shared/typetracking/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/typetracking/codeql-pack.release.yml b/shared/typetracking/codeql-pack.release.yml
index d021cf0a6be..a71167814cb 100644
--- a/shared/typetracking/codeql-pack.release.yml
+++ b/shared/typetracking/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/typetracking/qlpack.yml b/shared/typetracking/qlpack.yml
index b55927f59bb..fbbdcf5162a 100644
--- a/shared/typetracking/qlpack.yml
+++ b/shared/typetracking/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typetracking
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
dependencies:
diff --git a/shared/typos/CHANGELOG.md b/shared/typos/CHANGELOG.md
index 66c5871d982..54b1eaa4d58 100644
--- a/shared/typos/CHANGELOG.md
+++ b/shared/typos/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/typos/change-notes/released/0.2.10.md b/shared/typos/change-notes/released/0.2.10.md
new file mode 100644
index 00000000000..81c9722b19f
--- /dev/null
+++ b/shared/typos/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/typos/codeql-pack.release.yml b/shared/typos/codeql-pack.release.yml
index d021cf0a6be..a71167814cb 100644
--- a/shared/typos/codeql-pack.release.yml
+++ b/shared/typos/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/typos/qlpack.yml b/shared/typos/qlpack.yml
index 644bfe11bff..4d59d9b3c34 100644
--- a/shared/typos/qlpack.yml
+++ b/shared/typos/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typos
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/util/CHANGELOG.md b/shared/util/CHANGELOG.md
index 63832e927fa..1ca1f71bcbc 100644
--- a/shared/util/CHANGELOG.md
+++ b/shared/util/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/util/change-notes/released/0.2.10.md b/shared/util/change-notes/released/0.2.10.md
new file mode 100644
index 00000000000..81c9722b19f
--- /dev/null
+++ b/shared/util/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/util/codeql-pack.release.yml b/shared/util/codeql-pack.release.yml
index d021cf0a6be..a71167814cb 100644
--- a/shared/util/codeql-pack.release.yml
+++ b/shared/util/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/util/qlpack.yml b/shared/util/qlpack.yml
index ca1a866a53d..28ed738a93d 100644
--- a/shared/util/qlpack.yml
+++ b/shared/util/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/util
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
dependencies: null
diff --git a/shared/yaml/CHANGELOG.md b/shared/yaml/CHANGELOG.md
index e5495abcd50..9fd5ebc26ab 100644
--- a/shared/yaml/CHANGELOG.md
+++ b/shared/yaml/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/yaml/change-notes/released/0.2.10.md b/shared/yaml/change-notes/released/0.2.10.md
new file mode 100644
index 00000000000..81c9722b19f
--- /dev/null
+++ b/shared/yaml/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/yaml/codeql-pack.release.yml b/shared/yaml/codeql-pack.release.yml
index d021cf0a6be..a71167814cb 100644
--- a/shared/yaml/codeql-pack.release.yml
+++ b/shared/yaml/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/yaml/qlpack.yml b/shared/yaml/qlpack.yml
index de5b47e120a..9643ffcec66 100644
--- a/shared/yaml/qlpack.yml
+++ b/shared/yaml/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/yaml
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/swift/ql/lib/CHANGELOG.md b/swift/ql/lib/CHANGELOG.md
index e88cd0259cc..8f14bfcedc9 100644
--- a/swift/ql/lib/CHANGELOG.md
+++ b/swift/ql/lib/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 0.3.10
+
+### Bug Fixes
+
+* Fixed an issue where `TypeDecl.getFullName` would get stuck in an loop and fail when minor database inconsistencies are present.
+
## 0.3.9
### Minor Analysis Improvements
diff --git a/swift/ql/lib/change-notes/2024-02-22-extension-patch.md b/swift/ql/lib/change-notes/released/0.3.10.md
similarity index 83%
rename from swift/ql/lib/change-notes/2024-02-22-extension-patch.md
rename to swift/ql/lib/change-notes/released/0.3.10.md
index 7bd78f3b785..9d6286ff58a 100644
--- a/swift/ql/lib/change-notes/2024-02-22-extension-patch.md
+++ b/swift/ql/lib/change-notes/released/0.3.10.md
@@ -1,4 +1,5 @@
----
-category: fix
----
+## 0.3.10
+
+### Bug Fixes
+
* Fixed an issue where `TypeDecl.getFullName` would get stuck in an loop and fail when minor database inconsistencies are present.
diff --git a/swift/ql/lib/codeql-pack.release.yml b/swift/ql/lib/codeql-pack.release.yml
index 3fa5180bcb4..76ca0ac8ba7 100644
--- a/swift/ql/lib/codeql-pack.release.yml
+++ b/swift/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.3.9
+lastReleaseVersion: 0.3.10
diff --git a/swift/ql/lib/qlpack.yml b/swift/ql/lib/qlpack.yml
index a37a4cb3d58..70ec4798ea8 100644
--- a/swift/ql/lib/qlpack.yml
+++ b/swift/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-all
-version: 0.3.10-dev
+version: 0.3.10
groups: swift
extractor: swift
dbscheme: swift.dbscheme
diff --git a/swift/ql/src/CHANGELOG.md b/swift/ql/src/CHANGELOG.md
index 96615d06972..bda9834c9bc 100644
--- a/swift/ql/src/CHANGELOG.md
+++ b/swift/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.3.10
+
+No user-facing changes.
+
## 0.3.9
### New Queries
diff --git a/swift/ql/src/change-notes/released/0.3.10.md b/swift/ql/src/change-notes/released/0.3.10.md
new file mode 100644
index 00000000000..925a48fc52e
--- /dev/null
+++ b/swift/ql/src/change-notes/released/0.3.10.md
@@ -0,0 +1,3 @@
+## 0.3.10
+
+No user-facing changes.
diff --git a/swift/ql/src/codeql-pack.release.yml b/swift/ql/src/codeql-pack.release.yml
index 3fa5180bcb4..76ca0ac8ba7 100644
--- a/swift/ql/src/codeql-pack.release.yml
+++ b/swift/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.3.9
+lastReleaseVersion: 0.3.10
diff --git a/swift/ql/src/qlpack.yml b/swift/ql/src/qlpack.yml
index e3ead42c98b..ba66b065529 100644
--- a/swift/ql/src/qlpack.yml
+++ b/swift/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-queries
-version: 0.3.10-dev
+version: 0.3.10
groups:
- swift
- queries
From 179aaa134201089df6374ff5ba2132df749d3e12 Mon Sep 17 00:00:00 2001
From: Harry Maclean
Date: Tue, 5 Mar 2024 09:35:18 +0000
Subject: [PATCH 026/309] Ruby: model Open4.popen4ext
---
.../lib/codeql/ruby/frameworks/stdlib/Open3.qll | 16 ++++++++++++++--
.../frameworks/stdlib/Open3.expected | 4 ++++
.../library-tests/frameworks/stdlib/Open3.rb | 4 ++++
3 files changed, 22 insertions(+), 2 deletions(-)
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll b/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll
index 16b9ecc3797..0e9b6245880 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll
@@ -38,14 +38,26 @@ module Open3 {
*/
class Open4Call extends SystemCommandExecution::Range instanceof DataFlow::CallNode {
Open4Call() {
- this = API::getTopLevelMember("Open4").getAMethodCall(["open4", "popen4", "spawn"])
+ this =
+ API::getTopLevelMember("Open4").getAMethodCall(["open4", "popen4", "spawn", "popen4ext"])
}
- override DataFlow::Node getAnArgument() { result = super.getArgument(_) }
+ override DataFlow::Node getAnArgument() {
+ // `popen4ext` takes an optional boolean as its first argument, but it is unlikely that we will be
+ // tracking flow into a boolean value so it doesn't seem worth modeling that special case here.
+ result = super.getArgument(_)
+ }
override predicate isShellInterpreted(DataFlow::Node arg) {
super.getNumberOfArguments() = 1 and
arg = this.getAnArgument()
+ or
+ // ```rb
+ // Open4.popen4ext(true, "some cmd")
+ // ```
+ super.getNumberOfArguments() = 2 and
+ super.getArgument(0).getConstantValue().isBoolean(_) and
+ arg = super.getArgument(1)
}
}
diff --git a/ruby/ql/test/library-tests/frameworks/stdlib/Open3.expected b/ruby/ql/test/library-tests/frameworks/stdlib/Open3.expected
index 48bc6fc27f6..9589d721a29 100644
--- a/ruby/ql/test/library-tests/frameworks/stdlib/Open3.expected
+++ b/ruby/ql/test/library-tests/frameworks/stdlib/Open3.expected
@@ -15,3 +15,7 @@ open4CallExecutions
| Open3.rb:13:1:13:24 | call to open4 |
| Open3.rb:14:1:14:25 | call to popen4 |
| Open3.rb:15:1:15:23 | call to spawn |
+| Open3.rb:16:1:16:27 | call to popen4ext |
+| Open3.rb:17:1:17:30 | call to popen4ext |
+| Open3.rb:18:1:18:33 | call to popen4ext |
+| Open3.rb:19:1:19:36 | call to popen4ext |
diff --git a/ruby/ql/test/library-tests/frameworks/stdlib/Open3.rb b/ruby/ql/test/library-tests/frameworks/stdlib/Open3.rb
index 4a112335ffb..9cc7ea7fd5c 100644
--- a/ruby/ql/test/library-tests/frameworks/stdlib/Open3.rb
+++ b/ruby/ql/test/library-tests/frameworks/stdlib/Open3.rb
@@ -13,3 +13,7 @@ Open3.pipeline("echo foo", "grep bar")
Open4::open4("echo foo")
Open4::popen4("echo foo")
Open4.spawn("echo bar")
+Open4.popen4ext("echo foo")
+Open4.popen4ext("echo", "foo")
+Open4.popen4ext(true, "echo foo")
+Open4.popen4ext(true, "echo", "foo")
From 91cb2a37fd4ec3d8d9a2effa4f1e51761792d9db Mon Sep 17 00:00:00 2001
From: Harry Maclean
Date: Tue, 5 Mar 2024 10:19:22 +0000
Subject: [PATCH 027/309] Ruby: Model Process.exec
---
ruby/ql/lib/codeql/ruby/frameworks/Stdlib.qll | 1 +
.../codeql/ruby/frameworks/stdlib/Process.qll | 14 ++++++++
.../stdlib/CommandExecution.expected | 32 +++++++++++++++++++
.../frameworks/stdlib/CommandExecution.ql | 12 +++++++
.../frameworks/stdlib/process.rb | 5 +++
5 files changed, 64 insertions(+)
create mode 100644 ruby/ql/test/library-tests/frameworks/stdlib/CommandExecution.expected
create mode 100644 ruby/ql/test/library-tests/frameworks/stdlib/CommandExecution.ql
create mode 100644 ruby/ql/test/library-tests/frameworks/stdlib/process.rb
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/Stdlib.qll b/ruby/ql/lib/codeql/ruby/frameworks/Stdlib.qll
index f735f9daf8b..139f1d619d6 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/Stdlib.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/Stdlib.qll
@@ -5,3 +5,4 @@
import stdlib.Open3
import stdlib.Logger
import stdlib.Pathname
+import stdlib.Process
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Process.qll b/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Process.qll
index 1ffc15d691b..e4516f22038 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Process.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Process.qll
@@ -32,4 +32,18 @@ module Process {
super.getNumberOfArguments() = 1 and arg = this.getAnArgument()
}
}
+
+ /**
+ * A system command executed via the `Process.exec` method.
+ */
+ class ExecCall extends SystemCommandExecution::Range instanceof DataFlow::CallNode {
+ ExecCall() { this = DataFlow::getConstant("Process").getAMethodCall("exec") }
+
+ override DataFlow::Node getAnArgument() { result = super.getArgument(_) }
+
+ override predicate isShellInterpreted(DataFlow::Node arg) {
+ // Process.exec invokes a subshell if you provide a single string as argument
+ super.getNumberOfArguments() = 1 and arg = this.getAnArgument()
+ }
+ }
}
diff --git a/ruby/ql/test/library-tests/frameworks/stdlib/CommandExecution.expected b/ruby/ql/test/library-tests/frameworks/stdlib/CommandExecution.expected
new file mode 100644
index 00000000000..e29aaf35bac
--- /dev/null
+++ b/ruby/ql/test/library-tests/frameworks/stdlib/CommandExecution.expected
@@ -0,0 +1,32 @@
+| Open3.rb:1:1:1:24 | call to popen3 | Open3.rb:1:14:1:23 | "echo foo" | true |
+| Open3.rb:2:1:2:24 | call to popen2 | Open3.rb:2:14:2:23 | "echo foo" | true |
+| Open3.rb:3:1:3:25 | call to popen2e | Open3.rb:3:15:3:24 | "echo foo" | true |
+| Open3.rb:4:1:4:26 | call to capture3 | Open3.rb:4:16:4:25 | "echo foo" | true |
+| Open3.rb:5:1:5:26 | call to capture2 | Open3.rb:5:16:5:25 | "echo foo" | true |
+| Open3.rb:6:1:6:27 | call to capture2e | Open3.rb:6:17:6:26 | "echo foo" | true |
+| Open3.rb:7:1:7:41 | call to pipeline_rw | Open3.rb:7:19:7:28 | "echo foo" | true |
+| Open3.rb:7:1:7:41 | call to pipeline_rw | Open3.rb:7:31:7:40 | "grep bar" | true |
+| Open3.rb:8:1:8:40 | call to pipeline_r | Open3.rb:8:18:8:27 | "echo foo" | true |
+| Open3.rb:8:1:8:40 | call to pipeline_r | Open3.rb:8:30:8:39 | "grep bar" | true |
+| Open3.rb:9:1:9:40 | call to pipeline_w | Open3.rb:9:18:9:27 | "echo foo" | true |
+| Open3.rb:9:1:9:40 | call to pipeline_w | Open3.rb:9:30:9:39 | "grep bar" | true |
+| Open3.rb:10:1:10:44 | call to pipeline_start | Open3.rb:10:22:10:31 | "echo foo" | true |
+| Open3.rb:10:1:10:44 | call to pipeline_start | Open3.rb:10:34:10:43 | "grep bar" | true |
+| Open3.rb:11:1:11:38 | call to pipeline | Open3.rb:11:16:11:25 | "echo foo" | true |
+| Open3.rb:11:1:11:38 | call to pipeline | Open3.rb:11:28:11:37 | "grep bar" | true |
+| Open3.rb:13:1:13:24 | call to open4 | Open3.rb:13:14:13:23 | "echo foo" | true |
+| Open3.rb:14:1:14:25 | call to popen4 | Open3.rb:14:15:14:24 | "echo foo" | true |
+| Open3.rb:15:1:15:23 | call to spawn | Open3.rb:15:13:15:22 | "echo bar" | true |
+| Open3.rb:16:1:16:27 | call to popen4ext | Open3.rb:16:17:16:26 | "echo foo" | true |
+| Open3.rb:17:1:17:30 | call to popen4ext | Open3.rb:17:17:17:22 | "echo" | false |
+| Open3.rb:17:1:17:30 | call to popen4ext | Open3.rb:17:25:17:29 | "foo" | false |
+| Open3.rb:18:1:18:33 | call to popen4ext | Open3.rb:18:17:18:20 | true | false |
+| Open3.rb:18:1:18:33 | call to popen4ext | Open3.rb:18:23:18:32 | "echo foo" | true |
+| Open3.rb:19:1:19:36 | call to popen4ext | Open3.rb:19:17:19:20 | true | false |
+| Open3.rb:19:1:19:36 | call to popen4ext | Open3.rb:19:23:19:28 | "echo" | false |
+| Open3.rb:19:1:19:36 | call to popen4ext | Open3.rb:19:31:19:35 | "foo" | false |
+| process.rb:1:1:1:25 | call to spawn | process.rb:1:15:1:24 | "echo foo" | true |
+| process.rb:2:1:2:30 | call to spawn | process.rb:2:15:2:29 | call to [] | true |
+| process.rb:3:1:3:24 | call to exec | process.rb:3:14:3:23 | "echo foo" | true |
+| process.rb:4:1:4:29 | call to exec | process.rb:4:14:4:28 | call to [] | true |
+| process.rb:5:1:5:21 | call to spawn | process.rb:5:11:5:20 | "echo foo" | true |
diff --git a/ruby/ql/test/library-tests/frameworks/stdlib/CommandExecution.ql b/ruby/ql/test/library-tests/frameworks/stdlib/CommandExecution.ql
new file mode 100644
index 00000000000..4de7304272b
--- /dev/null
+++ b/ruby/ql/test/library-tests/frameworks/stdlib/CommandExecution.ql
@@ -0,0 +1,12 @@
+import codeql.ruby.Frameworks
+import codeql.ruby.Concepts
+import codeql.ruby.DataFlow
+
+query predicate commandExecutions(
+ SystemCommandExecution execution, DataFlow::Node arg, boolean isShellInterpreted
+) {
+ arg = execution.getAnArgument() and
+ if execution.isShellInterpreted(arg)
+ then isShellInterpreted = true
+ else isShellInterpreted = false
+}
diff --git a/ruby/ql/test/library-tests/frameworks/stdlib/process.rb b/ruby/ql/test/library-tests/frameworks/stdlib/process.rb
new file mode 100644
index 00000000000..2a40e7fa94e
--- /dev/null
+++ b/ruby/ql/test/library-tests/frameworks/stdlib/process.rb
@@ -0,0 +1,5 @@
+Process.spawn("echo foo")
+Process.spawn(["echo", "foo"])
+Process.exec("echo foo")
+Process.exec(["echo", "foo"])
+PTY.spawn("echo foo")
From 148241183a3a52d15f145fdb97218180d37ba50b Mon Sep 17 00:00:00 2001
From: Harry Maclean
Date: Tue, 5 Mar 2024 10:20:22 +0000
Subject: [PATCH 028/309] Ruby: update changenote
---
ruby/ql/lib/change-notes/2024-02-27-process-spawn.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/ruby/ql/lib/change-notes/2024-02-27-process-spawn.md b/ruby/ql/lib/change-notes/2024-02-27-process-spawn.md
index 30feedcbd20..9c20f05d865 100644
--- a/ruby/ql/lib/change-notes/2024-02-27-process-spawn.md
+++ b/ruby/ql/lib/change-notes/2024-02-27-process-spawn.md
@@ -1,4 +1,4 @@
---
category: minorAnalysis
---
-* New command injection sinks have been added, including `Process.spawn`, `Terrapin::CommandLine` and the `open4` gem.
\ No newline at end of file
+* New command injection sinks have been added, including `Process.spawn`, `Process.exec`, `Terrapin::CommandLine` and the `open4` gem.
\ No newline at end of file
From 2aa093c95cde5faed2aef27e119f8266e660863b Mon Sep 17 00:00:00 2001
From: "Michael B. Gale"
Date: Tue, 5 Mar 2024 11:25:02 +0000
Subject: [PATCH 029/309] Go: Move `getImportPath` to shared `util` package
---
.../cli/go-autobuilder/go-autobuilder.go | 60 +------------------
go/extractor/util/util.go | 59 ++++++++++++++++++
.../util_test.go} | 2 +-
3 files changed, 61 insertions(+), 60 deletions(-)
rename go/extractor/{cli/go-autobuilder/go-autobuilder_test.go => util/util_test.go} (98%)
diff --git a/go/extractor/cli/go-autobuilder/go-autobuilder.go b/go/extractor/cli/go-autobuilder/go-autobuilder.go
index 91291c77144..b2e2a78666f 100644
--- a/go/extractor/cli/go-autobuilder/go-autobuilder.go
+++ b/go/extractor/cli/go-autobuilder/go-autobuilder.go
@@ -3,7 +3,6 @@ package main
import (
"fmt"
"log"
- "net/url"
"os"
"os/exec"
"path/filepath"
@@ -56,63 +55,6 @@ Build behavior:
fmt.Fprintf(os.Stderr, "Usage:\n\n %s\n", os.Args[0])
}
-// Returns the import path of the package being built, or "" if it cannot be determined.
-func getImportPath() (importpath string) {
- importpath = os.Getenv("LGTM_INDEX_IMPORT_PATH")
- if importpath == "" {
- repourl := os.Getenv("SEMMLE_REPO_URL")
- if repourl == "" {
- githubrepo := os.Getenv("GITHUB_REPOSITORY")
- if githubrepo == "" {
- log.Printf("Unable to determine import path, as neither LGTM_INDEX_IMPORT_PATH nor GITHUB_REPOSITORY is set\n")
- return ""
- } else {
- importpath = "github.com/" + githubrepo
- }
- } else {
- importpath = getImportPathFromRepoURL(repourl)
- if importpath == "" {
- log.Printf("Failed to determine import path from SEMMLE_REPO_URL '%s'\n", repourl)
- return
- }
- }
- }
- log.Printf("Import path is '%s'\n", importpath)
- return
-}
-
-// Returns the import path of the package being built from `repourl`, or "" if it cannot be
-// determined.
-func getImportPathFromRepoURL(repourl string) string {
- // check for scp-like URL as in "git@github.com:github/codeql-go.git"
- shorturl := regexp.MustCompile(`^([^@]+@)?([^:]+):([^/].*?)(\.git)?$`)
- m := shorturl.FindStringSubmatch(repourl)
- if m != nil {
- return m[2] + "/" + m[3]
- }
-
- // otherwise parse as proper URL
- u, err := url.Parse(repourl)
- if err != nil {
- log.Fatalf("Malformed repository URL '%s'\n", repourl)
- }
-
- if u.Scheme == "file" {
- // we can't determine import paths from file paths
- return ""
- }
-
- if u.Hostname() == "" || u.Path == "" {
- return ""
- }
-
- host := u.Hostname()
- path := u.Path
- // strip off leading slashes and trailing `.git` if present
- path = regexp.MustCompile(`^/+|\.git$`).ReplaceAllString(path, "")
- return host + "/" + path
-}
-
func restoreRepoLayout(fromDir string, dirEntries []string, scratchDirName string, toDir string) {
for _, dirEntry := range dirEntries {
if dirEntry != scratchDirName {
@@ -568,7 +510,7 @@ func installDependenciesAndBuild() {
if len(workspaces) == 1 {
workspace := workspaces[0]
- importpath := getImportPath()
+ importpath := util.GetImportPath()
needGopath := getNeedGopath(workspace, importpath)
inLGTM := os.Getenv("LGTM_SRC") != "" || os.Getenv("LGTM_INDEX_NEED_GOPATH") != ""
diff --git a/go/extractor/util/util.go b/go/extractor/util/util.go
index b5b28089e78..2ae6a2b0cd2 100644
--- a/go/extractor/util/util.go
+++ b/go/extractor/util/util.go
@@ -6,9 +6,11 @@ import (
"io"
"io/fs"
"log"
+ "net/url"
"os"
"os/exec"
"path/filepath"
+ "regexp"
"runtime"
"slices"
"strings"
@@ -350,3 +352,60 @@ func GetParentDirs(paths []string) []string {
}
return dirs
}
+
+// Returns the import path of the package being built, or "" if it cannot be determined.
+func GetImportPath() (importpath string) {
+ importpath = os.Getenv("LGTM_INDEX_IMPORT_PATH")
+ if importpath == "" {
+ repourl := os.Getenv("SEMMLE_REPO_URL")
+ if repourl == "" {
+ githubrepo := os.Getenv("GITHUB_REPOSITORY")
+ if githubrepo == "" {
+ log.Printf("Unable to determine import path, as neither LGTM_INDEX_IMPORT_PATH nor GITHUB_REPOSITORY is set\n")
+ return ""
+ } else {
+ importpath = "github.com/" + githubrepo
+ }
+ } else {
+ importpath = getImportPathFromRepoURL(repourl)
+ if importpath == "" {
+ log.Printf("Failed to determine import path from SEMMLE_REPO_URL '%s'\n", repourl)
+ return
+ }
+ }
+ }
+ log.Printf("Import path is '%s'\n", importpath)
+ return
+}
+
+// Returns the import path of the package being built from `repourl`, or "" if it cannot be
+// determined.
+func getImportPathFromRepoURL(repourl string) string {
+ // check for scp-like URL as in "git@github.com:github/codeql-go.git"
+ shorturl := regexp.MustCompile(`^([^@]+@)?([^:]+):([^/].*?)(\.git)?$`)
+ m := shorturl.FindStringSubmatch(repourl)
+ if m != nil {
+ return m[2] + "/" + m[3]
+ }
+
+ // otherwise parse as proper URL
+ u, err := url.Parse(repourl)
+ if err != nil {
+ log.Fatalf("Malformed repository URL '%s'\n", repourl)
+ }
+
+ if u.Scheme == "file" {
+ // we can't determine import paths from file paths
+ return ""
+ }
+
+ if u.Hostname() == "" || u.Path == "" {
+ return ""
+ }
+
+ host := u.Hostname()
+ path := u.Path
+ // strip off leading slashes and trailing `.git` if present
+ path = regexp.MustCompile(`^/+|\.git$`).ReplaceAllString(path, "")
+ return host + "/" + path
+}
diff --git a/go/extractor/cli/go-autobuilder/go-autobuilder_test.go b/go/extractor/util/util_test.go
similarity index 98%
rename from go/extractor/cli/go-autobuilder/go-autobuilder_test.go
rename to go/extractor/util/util_test.go
index f4e8405fe36..45d32bda3e1 100644
--- a/go/extractor/cli/go-autobuilder/go-autobuilder_test.go
+++ b/go/extractor/util/util_test.go
@@ -1,4 +1,4 @@
-package main
+package util
import "testing"
From 367ecf75d5889bb20da8e8a2123804d6cb76d79b Mon Sep 17 00:00:00 2001
From: "Michael B. Gale"
Date: Tue, 5 Mar 2024 11:37:51 +0000
Subject: [PATCH 030/309] Go: Use import path for auto-generated Go module
names
---
go/extractor/toolchain/toolchain.go | 17 ++++++++++++++++-
1 file changed, 16 insertions(+), 1 deletion(-)
diff --git a/go/extractor/toolchain/toolchain.go b/go/extractor/toolchain/toolchain.go
index 38abfd43874..104894c5975 100644
--- a/go/extractor/toolchain/toolchain.go
+++ b/go/extractor/toolchain/toolchain.go
@@ -5,8 +5,10 @@ import (
"log"
"os"
"os/exec"
+ "path/filepath"
"strings"
+ "github.com/github/codeql-go/extractor/util"
"golang.org/x/mod/semver"
)
@@ -81,7 +83,20 @@ func TidyModule(path string) *exec.Cmd {
// Run `go mod init` in the directory given by `path`.
func InitModule(path string) *exec.Cmd {
- modInit := exec.Command("go", "mod", "init", "codeql/auto-project")
+ moduleName := "codeql/auto-project"
+
+ if importpath := util.GetImportPath(); importpath != "" {
+ // This should be something like `github.com/user/repo`
+ moduleName = importpath
+
+ // If we are not initialising the new module in the root directory of the workspace,
+ // append the relative path to the module name.
+ if relPath, err := filepath.Rel(".", path); err != nil && relPath != "." {
+ moduleName = moduleName + "/" + relPath
+ }
+ }
+
+ modInit := exec.Command("go", "mod", "init", moduleName)
modInit.Dir = path
return modInit
}
From b1e0bc03ab34a271563ac8a5ba66577b0f59b954 Mon Sep 17 00:00:00 2001
From: "Michael B. Gale"
Date: Tue, 5 Mar 2024 11:55:10 +0000
Subject: [PATCH 031/309] Go: Fix check for whether it is safe to initialise a
`go.mod` file in a given directory
---
go/extractor/project/project.go | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
diff --git a/go/extractor/project/project.go b/go/extractor/project/project.go
index 187389ecd55..9315a33f04c 100644
--- a/go/extractor/project/project.go
+++ b/go/extractor/project/project.go
@@ -439,8 +439,9 @@ func getBuildRoots(emitDiagnostics bool) (goWorkspaces []GoWorkspace, totalModul
for _, component := range components {
path = filepath.Join(path, component)
- // Try to initialize a `go.mod` file automatically for the stray source files.
- if !slices.Contains(goModDirs, path) {
+ // Try to initialize a `go.mod` file automatically for the stray source files if
+ // doing so would not place it in a parent directory of an existing `go.mod` file.
+ if !startsWithAnyOf(path, goModDirs) {
goWorkspaces = append(goWorkspaces, GoWorkspace{
BaseDir: path,
DepMode: GoGetNoModules,
@@ -477,6 +478,16 @@ func getBuildRoots(emitDiagnostics bool) (goWorkspaces []GoWorkspace, totalModul
return
}
+// Determines whether `str` starts with any of `prefixes`.
+func startsWithAnyOf(str string, prefixes []string) bool {
+ for _, prefix := range prefixes {
+ if strings.HasPrefix(str, prefix) {
+ return true
+ }
+ }
+ return false
+}
+
// Finds Go workspaces in the current working directory.
func GetWorkspaceInfo(emitDiagnostics bool) []GoWorkspace {
bazelPaths := slices.Concat(
From ac394dc80ce6e3488285fd5abc01f2c5543ba0fb Mon Sep 17 00:00:00 2001
From: "Michael B. Gale"
Date: Tue, 5 Mar 2024 13:46:33 +0000
Subject: [PATCH 032/309] Go: Better check for path prefixes
---
go/extractor/project/project.go | 2 +-
go/extractor/project/project_test.go | 27 +++++++++++++++++++++++++++
2 files changed, 28 insertions(+), 1 deletion(-)
create mode 100644 go/extractor/project/project_test.go
diff --git a/go/extractor/project/project.go b/go/extractor/project/project.go
index 9315a33f04c..22c0f856c79 100644
--- a/go/extractor/project/project.go
+++ b/go/extractor/project/project.go
@@ -481,7 +481,7 @@ func getBuildRoots(emitDiagnostics bool) (goWorkspaces []GoWorkspace, totalModul
// Determines whether `str` starts with any of `prefixes`.
func startsWithAnyOf(str string, prefixes []string) bool {
for _, prefix := range prefixes {
- if strings.HasPrefix(str, prefix) {
+ if relPath, err := filepath.Rel(str, prefix); err == nil && !strings.HasPrefix(relPath, "..") {
return true
}
}
diff --git a/go/extractor/project/project_test.go b/go/extractor/project/project_test.go
new file mode 100644
index 00000000000..f2de420773f
--- /dev/null
+++ b/go/extractor/project/project_test.go
@@ -0,0 +1,27 @@
+package project
+
+import (
+ "path/filepath"
+ "testing"
+)
+
+func testStartsWithAnyOf(t *testing.T, path string, prefix string, expectation bool) {
+ result := startsWithAnyOf(path, []string{prefix})
+ if result != expectation {
+ t.Errorf("Expected startsWithAnyOf(%s, %s) to be %t, but it is %t.", path, prefix, expectation, result)
+ }
+}
+
+func TestStartsWithAnyOf(t *testing.T) {
+ testStartsWithAnyOf(t, ".", ".", true)
+ testStartsWithAnyOf(t, ".", "dir", true)
+ testStartsWithAnyOf(t, ".", filepath.Join("foo", "bar"), true)
+ testStartsWithAnyOf(t, "dir", "dir", true)
+ testStartsWithAnyOf(t, "foo", filepath.Join("foo", "bar"), true)
+ testStartsWithAnyOf(t, filepath.Join("foo", "bar"), filepath.Join("foo", "bar"), true)
+ testStartsWithAnyOf(t, filepath.Join("foo", "bar"), filepath.Join("foo", "bar", "baz"), true)
+
+ testStartsWithAnyOf(t, filepath.Join("foo", "bar"), "foo", false)
+ testStartsWithAnyOf(t, filepath.Join("foo", "bar"), "bar", false)
+ testStartsWithAnyOf(t, filepath.Join("foo", "bar"), filepath.Join("foo", "baz"), false)
+}
From a8d240dd7278a4d0e73b92daff10bfd1e7d17d98 Mon Sep 17 00:00:00 2001
From: "Michael B. Gale"
Date: Tue, 5 Mar 2024 14:08:16 +0000
Subject: [PATCH 033/309] Go: Add integration test for mixed layout project
---
.../go/mixed-layout/diagnostics.expected | 28 +++++++++++++++++++
.../force_sequential_test_execution | 2 ++
.../go/mixed-layout/src/module/go.mod | 5 ++++
.../go/mixed-layout/src/module/go.sum | 7 +++++
.../go/mixed-layout/src/module/test.go | 13 +++++++++
.../go/mixed-layout/src/stray-files/test.go | 13 +++++++++
.../go/mixed-layout/src/workspace/go.work | 3 ++
.../mixed-layout/src/workspace/subdir/go.mod | 5 ++++
.../mixed-layout/src/workspace/subdir/go.sum | 7 +++++
.../mixed-layout/src/workspace/subdir/test.go | 13 +++++++++
.../go/mixed-layout/test.expected | 8 ++++++
.../all-platforms/go/mixed-layout/test.py | 18 ++++++++++++
.../all-platforms/go/mixed-layout/test.ql | 8 ++++++
13 files changed, 130 insertions(+)
create mode 100644 go/ql/integration-tests/all-platforms/go/mixed-layout/diagnostics.expected
create mode 100644 go/ql/integration-tests/all-platforms/go/mixed-layout/force_sequential_test_execution
create mode 100644 go/ql/integration-tests/all-platforms/go/mixed-layout/src/module/go.mod
create mode 100644 go/ql/integration-tests/all-platforms/go/mixed-layout/src/module/go.sum
create mode 100644 go/ql/integration-tests/all-platforms/go/mixed-layout/src/module/test.go
create mode 100644 go/ql/integration-tests/all-platforms/go/mixed-layout/src/stray-files/test.go
create mode 100644 go/ql/integration-tests/all-platforms/go/mixed-layout/src/workspace/go.work
create mode 100644 go/ql/integration-tests/all-platforms/go/mixed-layout/src/workspace/subdir/go.mod
create mode 100644 go/ql/integration-tests/all-platforms/go/mixed-layout/src/workspace/subdir/go.sum
create mode 100644 go/ql/integration-tests/all-platforms/go/mixed-layout/src/workspace/subdir/test.go
create mode 100644 go/ql/integration-tests/all-platforms/go/mixed-layout/test.expected
create mode 100644 go/ql/integration-tests/all-platforms/go/mixed-layout/test.py
create mode 100644 go/ql/integration-tests/all-platforms/go/mixed-layout/test.ql
diff --git a/go/ql/integration-tests/all-platforms/go/mixed-layout/diagnostics.expected b/go/ql/integration-tests/all-platforms/go/mixed-layout/diagnostics.expected
new file mode 100644
index 00000000000..bbbdd515d68
--- /dev/null
+++ b/go/ql/integration-tests/all-platforms/go/mixed-layout/diagnostics.expected
@@ -0,0 +1,28 @@
+{
+ "markdownMessage": "1 `go.work` file was found:\n\n`workspace/go.work`",
+ "severity": "note",
+ "source": {
+ "extractorName": "go",
+ "id": "go/autobuilder/go-work-found",
+ "name": "`go.work` file found"
+ },
+ "visibility": {
+ "cliSummaryTable": false,
+ "statusPage": false,
+ "telemetry": true
+ }
+}
+{
+ "markdownMessage": "Go files were found outside of the Go modules corresponding to these `go.mod` files.\n\n`workspace/subdir/go.mod`, `module/go.mod`",
+ "severity": "note",
+ "source": {
+ "extractorName": "go",
+ "id": "go/autobuilder/go-files-outside-go-modules",
+ "name": "Go files were found outside Go modules"
+ },
+ "visibility": {
+ "cliSummaryTable": false,
+ "statusPage": false,
+ "telemetry": true
+ }
+}
diff --git a/go/ql/integration-tests/all-platforms/go/mixed-layout/force_sequential_test_execution b/go/ql/integration-tests/all-platforms/go/mixed-layout/force_sequential_test_execution
new file mode 100644
index 00000000000..47ca9929099
--- /dev/null
+++ b/go/ql/integration-tests/all-platforms/go/mixed-layout/force_sequential_test_execution
@@ -0,0 +1,2 @@
+# go get has been observed to sometimes fail when multiple tests try to simultaneously fetch the same package.
+goget
diff --git a/go/ql/integration-tests/all-platforms/go/mixed-layout/src/module/go.mod b/go/ql/integration-tests/all-platforms/go/mixed-layout/src/module/go.mod
new file mode 100644
index 00000000000..0b8f33b9069
--- /dev/null
+++ b/go/ql/integration-tests/all-platforms/go/mixed-layout/src/module/go.mod
@@ -0,0 +1,5 @@
+go 1.14
+
+require golang.org/x/net v0.0.0-20200505041828-1ed23360d12c
+
+module module
diff --git a/go/ql/integration-tests/all-platforms/go/mixed-layout/src/module/go.sum b/go/ql/integration-tests/all-platforms/go/mixed-layout/src/module/go.sum
new file mode 100644
index 00000000000..6c5ffa613d0
--- /dev/null
+++ b/go/ql/integration-tests/all-platforms/go/mixed-layout/src/module/go.sum
@@ -0,0 +1,7 @@
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/net v0.0.0-20200505041828-1ed23360d12c h1:zJ0mtu4jCalhKg6Oaukv6iIkb+cOvDrajDH9DH46Q4M=
+golang.org/x/net v0.0.0-20200505041828-1ed23360d12c/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd h1:xhmwyvizuTgC2qz7ZlMluP20uW+C3Rm0FD/WLDX8884=
+golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
diff --git a/go/ql/integration-tests/all-platforms/go/mixed-layout/src/module/test.go b/go/ql/integration-tests/all-platforms/go/mixed-layout/src/module/test.go
new file mode 100644
index 00000000000..afc86ac3a12
--- /dev/null
+++ b/go/ql/integration-tests/all-platforms/go/mixed-layout/src/module/test.go
@@ -0,0 +1,13 @@
+package subdir
+
+import (
+ "fmt"
+
+ "golang.org/x/net/ipv4"
+)
+
+func test() {
+
+ header := ipv4.Header{}
+ fmt.Print(header.String())
+}
diff --git a/go/ql/integration-tests/all-platforms/go/mixed-layout/src/stray-files/test.go b/go/ql/integration-tests/all-platforms/go/mixed-layout/src/stray-files/test.go
new file mode 100644
index 00000000000..afc86ac3a12
--- /dev/null
+++ b/go/ql/integration-tests/all-platforms/go/mixed-layout/src/stray-files/test.go
@@ -0,0 +1,13 @@
+package subdir
+
+import (
+ "fmt"
+
+ "golang.org/x/net/ipv4"
+)
+
+func test() {
+
+ header := ipv4.Header{}
+ fmt.Print(header.String())
+}
diff --git a/go/ql/integration-tests/all-platforms/go/mixed-layout/src/workspace/go.work b/go/ql/integration-tests/all-platforms/go/mixed-layout/src/workspace/go.work
new file mode 100644
index 00000000000..e7e866fbe27
--- /dev/null
+++ b/go/ql/integration-tests/all-platforms/go/mixed-layout/src/workspace/go.work
@@ -0,0 +1,3 @@
+go 1.22.0
+
+use ./subdir
diff --git a/go/ql/integration-tests/all-platforms/go/mixed-layout/src/workspace/subdir/go.mod b/go/ql/integration-tests/all-platforms/go/mixed-layout/src/workspace/subdir/go.mod
new file mode 100644
index 00000000000..40a3b330c38
--- /dev/null
+++ b/go/ql/integration-tests/all-platforms/go/mixed-layout/src/workspace/subdir/go.mod
@@ -0,0 +1,5 @@
+go 1.22.0
+
+require golang.org/x/net v0.0.0-20200505041828-1ed23360d12c
+
+module subdir
diff --git a/go/ql/integration-tests/all-platforms/go/mixed-layout/src/workspace/subdir/go.sum b/go/ql/integration-tests/all-platforms/go/mixed-layout/src/workspace/subdir/go.sum
new file mode 100644
index 00000000000..6c5ffa613d0
--- /dev/null
+++ b/go/ql/integration-tests/all-platforms/go/mixed-layout/src/workspace/subdir/go.sum
@@ -0,0 +1,7 @@
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/net v0.0.0-20200505041828-1ed23360d12c h1:zJ0mtu4jCalhKg6Oaukv6iIkb+cOvDrajDH9DH46Q4M=
+golang.org/x/net v0.0.0-20200505041828-1ed23360d12c/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd h1:xhmwyvizuTgC2qz7ZlMluP20uW+C3Rm0FD/WLDX8884=
+golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
diff --git a/go/ql/integration-tests/all-platforms/go/mixed-layout/src/workspace/subdir/test.go b/go/ql/integration-tests/all-platforms/go/mixed-layout/src/workspace/subdir/test.go
new file mode 100644
index 00000000000..afc86ac3a12
--- /dev/null
+++ b/go/ql/integration-tests/all-platforms/go/mixed-layout/src/workspace/subdir/test.go
@@ -0,0 +1,13 @@
+package subdir
+
+import (
+ "fmt"
+
+ "golang.org/x/net/ipv4"
+)
+
+func test() {
+
+ header := ipv4.Header{}
+ fmt.Print(header.String())
+}
diff --git a/go/ql/integration-tests/all-platforms/go/mixed-layout/test.expected b/go/ql/integration-tests/all-platforms/go/mixed-layout/test.expected
new file mode 100644
index 00000000000..ddd1888562f
--- /dev/null
+++ b/go/ql/integration-tests/all-platforms/go/mixed-layout/test.expected
@@ -0,0 +1,8 @@
+extractedFiles
+| src/module/go.mod:0:0:0:0 | src/module/go.mod |
+| src/module/test.go:0:0:0:0 | src/module/test.go |
+| src/stray-files/go.mod:0:0:0:0 | src/stray-files/go.mod |
+| src/stray-files/test.go:0:0:0:0 | src/stray-files/test.go |
+| src/workspace/subdir/go.mod:0:0:0:0 | src/workspace/subdir/go.mod |
+| src/workspace/subdir/test.go:0:0:0:0 | src/workspace/subdir/test.go |
+#select
diff --git a/go/ql/integration-tests/all-platforms/go/mixed-layout/test.py b/go/ql/integration-tests/all-platforms/go/mixed-layout/test.py
new file mode 100644
index 00000000000..43c7d1b38e8
--- /dev/null
+++ b/go/ql/integration-tests/all-platforms/go/mixed-layout/test.py
@@ -0,0 +1,18 @@
+import os
+import subprocess
+
+from create_database_utils import *
+from diagnostics_test_utils import *
+
+# Set up a GOPATH relative to this test's root directory;
+# we set os.environ instead of using extra_env because we
+# need it to be set for the call to "go clean -modcache" later
+goPath = os.path.join(os.path.abspath(os.getcwd()), ".go")
+os.environ['GOPATH'] = goPath
+run_codeql_database_create([], lang="go", source="src")
+
+check_diagnostics()
+
+# Clean up the temporary GOPATH to prevent Bazel failures next
+# time the tests are run; see https://github.com/golang/go/issues/27161
+subprocess.call(["go", "clean", "-modcache"])
diff --git a/go/ql/integration-tests/all-platforms/go/mixed-layout/test.ql b/go/ql/integration-tests/all-platforms/go/mixed-layout/test.ql
new file mode 100644
index 00000000000..459a4301560
--- /dev/null
+++ b/go/ql/integration-tests/all-platforms/go/mixed-layout/test.ql
@@ -0,0 +1,8 @@
+import go
+import semmle.go.DiagnosticsReporting
+
+query predicate extractedFiles(File f) { any() }
+
+from string msg, int sev
+where reportableDiagnostics(_, msg, sev)
+select msg, sev
From 40ff75db07a66f4663ba00b7d76ea8d7ff870aa6 Mon Sep 17 00:00:00 2001
From: "Michael B. Gale"
Date: Tue, 5 Mar 2024 14:56:51 +0000
Subject: [PATCH 034/309] Go: Update list of expected files for
`single-go-mod-and-go-files-not-under-it` test
---
.../go/single-go-mod-and-go-files-not-under-it/test.expected | 2 --
1 file changed, 2 deletions(-)
diff --git a/go/ql/integration-tests/all-platforms/go/single-go-mod-and-go-files-not-under-it/test.expected b/go/ql/integration-tests/all-platforms/go/single-go-mod-and-go-files-not-under-it/test.expected
index 957d2f845a4..66ba3ef588f 100644
--- a/go/ql/integration-tests/all-platforms/go/single-go-mod-and-go-files-not-under-it/test.expected
+++ b/go/ql/integration-tests/all-platforms/go/single-go-mod-and-go-files-not-under-it/test.expected
@@ -1,6 +1,4 @@
extractedFiles
-| src/go.mod:0:0:0:0 | src/go.mod |
-| src/main.go:0:0:0:0 | src/main.go |
| src/subdir/go.mod:0:0:0:0 | src/subdir/go.mod |
| src/subdir/subsubdir/add.go:0:0:0:0 | src/subdir/subsubdir/add.go |
| src/subdir/test.go:0:0:0:0 | src/subdir/test.go |
From 967963a6534b1fcdda3d4f5b6960c29346516303 Mon Sep 17 00:00:00 2001
From: Angela P Wen
Date: Tue, 5 Mar 2024 08:53:33 -0800
Subject: [PATCH 035/309] Revert "Release preparation for version 2.16.4"
---
cpp/ql/lib/CHANGELOG.md | 6 ------
....12.7.md => 2024-02-26-ir-named-destructors.md} | 9 ++++-----
cpp/ql/lib/codeql-pack.release.yml | 2 +-
cpp/ql/lib/qlpack.yml | 2 +-
cpp/ql/src/CHANGELOG.md | 7 -------
...=> 2024-02-16-modelled-functions-block-flow.md} | 8 +++-----
.../2024-02-29-non-constant-format-path-query.md | 4 ++++
cpp/ql/src/codeql-pack.release.yml | 2 +-
cpp/ql/src/qlpack.yml | 2 +-
csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md | 4 ----
.../Solorigate/lib/change-notes/released/1.7.10.md | 3 ---
.../Solorigate/lib/codeql-pack.release.yml | 2 +-
csharp/ql/campaigns/Solorigate/lib/qlpack.yml | 2 +-
csharp/ql/campaigns/Solorigate/src/CHANGELOG.md | 4 ----
.../Solorigate/src/change-notes/released/1.7.10.md | 3 ---
.../Solorigate/src/codeql-pack.release.yml | 2 +-
csharp/ql/campaigns/Solorigate/src/qlpack.yml | 2 +-
csharp/ql/lib/CHANGELOG.md | 14 --------------
.../change-notes/2024-02-21-getonly-properties.md | 4 ++++
.../ql/lib/change-notes/2024-02-22-no-db-stats.md | 4 ++++
.../change-notes/2024-02-23-compiler-generated.md | 4 ++++
.../2024-02-26-variable-capture-flow.md | 4 ++++
.../2024-02-28-experimental-attribute.md | 4 ++++
.../2024-02-28-refreadonly-parameter.md | 4 ++++
csharp/ql/lib/change-notes/released/0.8.10.md | 13 -------------
csharp/ql/lib/codeql-pack.release.yml | 2 +-
csharp/ql/lib/qlpack.yml | 2 +-
csharp/ql/src/CHANGELOG.md | 6 ------
.../0.8.10.md => 2024-02-06-threat-models.md} | 9 ++++-----
csharp/ql/src/codeql-pack.release.yml | 2 +-
csharp/ql/src/qlpack.yml | 2 +-
go/ql/consistency-queries/CHANGELOG.md | 4 ----
.../change-notes/released/0.0.9.md | 3 ---
go/ql/consistency-queries/codeql-pack.release.yml | 2 +-
go/ql/consistency-queries/qlpack.yml | 2 +-
go/ql/lib/CHANGELOG.md | 11 -----------
.../lib/change-notes/2024-02-14-range-map-read.md | 4 ++++
...0.7.10.md => 2024-03-04-autobuilder-changes.md} | 11 +++--------
go/ql/lib/codeql-pack.release.yml | 2 +-
go/ql/lib/qlpack.yml | 2 +-
go/ql/src/CHANGELOG.md | 4 ----
go/ql/src/change-notes/released/0.7.10.md | 3 ---
go/ql/src/codeql-pack.release.yml | 2 +-
go/ql/src/qlpack.yml | 2 +-
java/ql/automodel/src/CHANGELOG.md | 4 ----
.../automodel/src/change-notes/released/0.0.17.md | 3 ---
java/ql/automodel/src/codeql-pack.release.yml | 2 +-
java/ql/automodel/src/qlpack.yml | 2 +-
java/ql/lib/CHANGELOG.md | 11 -----------
.../change-notes/2024-02-23-widget-flowsteps.md | 4 ++++
java/ql/lib/change-notes/2024-02-27-error-types.md | 4 ++++
.../lib/change-notes/2024-02-27-mvnw-versions.md | 4 ++++
java/ql/lib/change-notes/released/0.8.10.md | 10 ----------
java/ql/lib/codeql-pack.release.yml | 2 +-
java/ql/lib/qlpack.yml | 2 +-
java/ql/src/CHANGELOG.md | 10 ----------
.../2024-02-12-android-insecure-keys.md | 4 ++++
...3-04-sensitive-log-remove-null-from-sources.md} | 11 +++--------
java/ql/src/codeql-pack.release.yml | 2 +-
java/ql/src/qlpack.yml | 2 +-
javascript/ql/lib/CHANGELOG.md | 4 ----
javascript/ql/lib/change-notes/released/0.8.10.md | 3 ---
javascript/ql/lib/codeql-pack.release.yml | 2 +-
javascript/ql/lib/qlpack.yml | 2 +-
javascript/ql/src/CHANGELOG.md | 4 ----
javascript/ql/src/change-notes/released/0.8.10.md | 3 ---
javascript/ql/src/codeql-pack.release.yml | 2 +-
javascript/ql/src/qlpack.yml | 2 +-
misc/suite-helpers/CHANGELOG.md | 4 ----
misc/suite-helpers/change-notes/released/0.7.10.md | 3 ---
misc/suite-helpers/codeql-pack.release.yml | 2 +-
misc/suite-helpers/qlpack.yml | 2 +-
python/ql/lib/CHANGELOG.md | 7 -------
.../2024-02-28-iterable-unpacking-module-scope.md | 4 ++++
....11.10.md => 2024-03-01-dict-update-content.md} | 8 +++-----
python/ql/lib/codeql-pack.release.yml | 2 +-
python/ql/lib/qlpack.yml | 2 +-
python/ql/src/CHANGELOG.md | 6 ------
.../0.9.10.md => 2024-03-04-nosql-injection.md} | 7 +++----
python/ql/src/codeql-pack.release.yml | 2 +-
python/ql/src/qlpack.yml | 2 +-
ruby/ql/lib/CHANGELOG.md | 9 ---------
...2024-02-15-activerecord_connection_sql_sinks.md | 4 ++++
.../2024-02-20-activerecord-sql-sink-arguments.md | 4 ++++
.../lib/change-notes/2024-02-26-arel-sqlliteral.md | 4 ++++
.../lib/change-notes/2024-02-29-i18n-translate.md | 4 ++++
ruby/ql/lib/change-notes/released/0.8.10.md | 8 --------
ruby/ql/lib/codeql-pack.release.yml | 2 +-
ruby/ql/lib/qlpack.yml | 2 +-
ruby/ql/src/CHANGELOG.md | 7 -------
.../2024-02-13-rails-more-request-sources.md | 4 ++++
...d => 2024-03-01-method-code-injection-sinks.md} | 10 ++++------
ruby/ql/src/codeql-pack.release.yml | 2 +-
ruby/ql/src/qlpack.yml | 2 +-
shared/controlflow/CHANGELOG.md | 4 ----
shared/controlflow/change-notes/released/0.1.10.md | 3 ---
shared/controlflow/codeql-pack.release.yml | 2 +-
shared/controlflow/qlpack.yml | 2 +-
shared/dataflow/CHANGELOG.md | 4 ----
shared/dataflow/change-notes/released/0.2.1.md | 3 ---
shared/dataflow/codeql-pack.release.yml | 2 +-
shared/dataflow/qlpack.yml | 2 +-
shared/mad/CHANGELOG.md | 4 ----
shared/mad/change-notes/released/0.2.10.md | 3 ---
shared/mad/codeql-pack.release.yml | 2 +-
shared/mad/qlpack.yml | 2 +-
shared/rangeanalysis/CHANGELOG.md | 4 ----
.../rangeanalysis/change-notes/released/0.0.9.md | 3 ---
shared/rangeanalysis/codeql-pack.release.yml | 2 +-
shared/rangeanalysis/qlpack.yml | 2 +-
shared/regex/CHANGELOG.md | 4 ----
shared/regex/change-notes/released/0.2.10.md | 3 ---
shared/regex/codeql-pack.release.yml | 2 +-
shared/regex/qlpack.yml | 2 +-
shared/ssa/CHANGELOG.md | 4 ----
shared/ssa/change-notes/released/0.2.10.md | 3 ---
shared/ssa/codeql-pack.release.yml | 2 +-
shared/ssa/qlpack.yml | 2 +-
shared/threat-models/CHANGELOG.md | 4 ----
.../threat-models/change-notes/released/0.0.9.md | 3 ---
shared/threat-models/codeql-pack.release.yml | 2 +-
shared/threat-models/qlpack.yml | 2 +-
shared/tutorial/CHANGELOG.md | 4 ----
shared/tutorial/change-notes/released/0.2.10.md | 3 ---
shared/tutorial/codeql-pack.release.yml | 2 +-
shared/tutorial/qlpack.yml | 2 +-
shared/typetracking/CHANGELOG.md | 4 ----
.../typetracking/change-notes/released/0.2.10.md | 3 ---
shared/typetracking/codeql-pack.release.yml | 2 +-
shared/typetracking/qlpack.yml | 2 +-
shared/typos/CHANGELOG.md | 4 ----
shared/typos/change-notes/released/0.2.10.md | 3 ---
shared/typos/codeql-pack.release.yml | 2 +-
shared/typos/qlpack.yml | 2 +-
shared/util/CHANGELOG.md | 4 ----
shared/util/change-notes/released/0.2.10.md | 3 ---
shared/util/codeql-pack.release.yml | 2 +-
shared/util/qlpack.yml | 2 +-
shared/yaml/CHANGELOG.md | 4 ----
shared/yaml/change-notes/released/0.2.10.md | 3 ---
shared/yaml/codeql-pack.release.yml | 2 +-
shared/yaml/qlpack.yml | 2 +-
swift/ql/lib/CHANGELOG.md | 6 ------
.../0.3.10.md => 2024-02-22-extension-patch.md} | 7 +++----
swift/ql/lib/codeql-pack.release.yml | 2 +-
swift/ql/lib/qlpack.yml | 2 +-
swift/ql/src/CHANGELOG.md | 4 ----
swift/ql/src/change-notes/released/0.3.10.md | 3 ---
swift/ql/src/codeql-pack.release.yml | 2 +-
swift/ql/src/qlpack.yml | 2 +-
150 files changed, 168 insertions(+), 394 deletions(-)
rename cpp/ql/lib/change-notes/{released/0.12.7.md => 2024-02-26-ir-named-destructors.md} (54%)
rename cpp/ql/src/change-notes/{released/0.9.6.md => 2024-02-16-modelled-functions-block-flow.md} (77%)
create mode 100644 cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md
delete mode 100644 csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md
delete mode 100644 csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md
create mode 100644 csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md
create mode 100644 csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md
create mode 100644 csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md
create mode 100644 csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md
create mode 100644 csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md
create mode 100644 csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md
delete mode 100644 csharp/ql/lib/change-notes/released/0.8.10.md
rename csharp/ql/src/change-notes/{released/0.8.10.md => 2024-02-06-threat-models.md} (88%)
delete mode 100644 go/ql/consistency-queries/change-notes/released/0.0.9.md
create mode 100644 go/ql/lib/change-notes/2024-02-14-range-map-read.md
rename go/ql/lib/change-notes/{released/0.7.10.md => 2024-03-04-autobuilder-changes.md} (68%)
delete mode 100644 go/ql/src/change-notes/released/0.7.10.md
delete mode 100644 java/ql/automodel/src/change-notes/released/0.0.17.md
create mode 100644 java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md
create mode 100644 java/ql/lib/change-notes/2024-02-27-error-types.md
create mode 100644 java/ql/lib/change-notes/2024-02-27-mvnw-versions.md
delete mode 100644 java/ql/lib/change-notes/released/0.8.10.md
create mode 100644 java/ql/src/change-notes/2024-02-12-android-insecure-keys.md
rename java/ql/src/change-notes/{released/0.8.10.md => 2024-03-04-sensitive-log-remove-null-from-sources.md} (54%)
delete mode 100644 javascript/ql/lib/change-notes/released/0.8.10.md
delete mode 100644 javascript/ql/src/change-notes/released/0.8.10.md
delete mode 100644 misc/suite-helpers/change-notes/released/0.7.10.md
create mode 100644 python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md
rename python/ql/lib/change-notes/{released/0.11.10.md => 2024-03-01-dict-update-content.md} (52%)
rename python/ql/src/change-notes/{released/0.9.10.md => 2024-03-04-nosql-injection.md} (81%)
create mode 100644 ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md
create mode 100644 ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md
create mode 100644 ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
create mode 100644 ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
delete mode 100644 ruby/ql/lib/change-notes/released/0.8.10.md
create mode 100644 ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md
rename ruby/ql/src/change-notes/{released/0.8.10.md => 2024-03-01-method-code-injection-sinks.md} (51%)
delete mode 100644 shared/controlflow/change-notes/released/0.1.10.md
delete mode 100644 shared/dataflow/change-notes/released/0.2.1.md
delete mode 100644 shared/mad/change-notes/released/0.2.10.md
delete mode 100644 shared/rangeanalysis/change-notes/released/0.0.9.md
delete mode 100644 shared/regex/change-notes/released/0.2.10.md
delete mode 100644 shared/ssa/change-notes/released/0.2.10.md
delete mode 100644 shared/threat-models/change-notes/released/0.0.9.md
delete mode 100644 shared/tutorial/change-notes/released/0.2.10.md
delete mode 100644 shared/typetracking/change-notes/released/0.2.10.md
delete mode 100644 shared/typos/change-notes/released/0.2.10.md
delete mode 100644 shared/util/change-notes/released/0.2.10.md
delete mode 100644 shared/yaml/change-notes/released/0.2.10.md
rename swift/ql/lib/change-notes/{released/0.3.10.md => 2024-02-22-extension-patch.md} (83%)
delete mode 100644 swift/ql/src/change-notes/released/0.3.10.md
diff --git a/cpp/ql/lib/CHANGELOG.md b/cpp/ql/lib/CHANGELOG.md
index e1c0dfbecd9..b3091ec37d8 100644
--- a/cpp/ql/lib/CHANGELOG.md
+++ b/cpp/ql/lib/CHANGELOG.md
@@ -1,9 +1,3 @@
-## 0.12.7
-
-### Minor Analysis Improvements
-
-* Added destructors for named objects to the intermediate representation.
-
## 0.12.6
### New Features
diff --git a/cpp/ql/lib/change-notes/released/0.12.7.md b/cpp/ql/lib/change-notes/2024-02-26-ir-named-destructors.md
similarity index 54%
rename from cpp/ql/lib/change-notes/released/0.12.7.md
rename to cpp/ql/lib/change-notes/2024-02-26-ir-named-destructors.md
index 856a8b665c7..4e35decaf8e 100644
--- a/cpp/ql/lib/change-notes/released/0.12.7.md
+++ b/cpp/ql/lib/change-notes/2024-02-26-ir-named-destructors.md
@@ -1,5 +1,4 @@
-## 0.12.7
-
-### Minor Analysis Improvements
-
-* Added destructors for named objects to the intermediate representation.
+---
+category: minorAnalysis
+---
+* Added destructors for named objects to the intermediate representation.
\ No newline at end of file
diff --git a/cpp/ql/lib/codeql-pack.release.yml b/cpp/ql/lib/codeql-pack.release.yml
index 20419e9c610..170a312c104 100644
--- a/cpp/ql/lib/codeql-pack.release.yml
+++ b/cpp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.12.7
+lastReleaseVersion: 0.12.6
diff --git a/cpp/ql/lib/qlpack.yml b/cpp/ql/lib/qlpack.yml
index 3bb9229bf94..8e201fff594 100644
--- a/cpp/ql/lib/qlpack.yml
+++ b/cpp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-all
-version: 0.12.7
+version: 0.12.7-dev
groups: cpp
dbscheme: semmlecode.cpp.dbscheme
extractor: cpp
diff --git a/cpp/ql/src/CHANGELOG.md b/cpp/ql/src/CHANGELOG.md
index f6acd424bb0..ffcd73ff5d7 100644
--- a/cpp/ql/src/CHANGELOG.md
+++ b/cpp/ql/src/CHANGELOG.md
@@ -1,10 +1,3 @@
-## 0.9.6
-
-### Minor Analysis Improvements
-
-* The "non-constant format string" query (`cpp/non-constant-format`) has been converted to a `path-problem` query.
-* The new C/C++ dataflow and taint-tracking libraries (`semmle.code.cpp.dataflow.new.DataFlow` and `semmle.code.cpp.dataflow.new.TaintTracking`) now implicitly assume that dataflow and taint modelled via `DataFlowFunction` and `TaintFunction` always fully overwrite their buffers and thus act as flow barriers. As a result, many dataflow and taint-tracking queries now produce fewer false positives. To remove this assumption and go back to the previous behavior for a given model, one can override the new `isPartialWrite` predicate.
-
## 0.9.5
### Minor Analysis Improvements
diff --git a/cpp/ql/src/change-notes/released/0.9.6.md b/cpp/ql/src/change-notes/2024-02-16-modelled-functions-block-flow.md
similarity index 77%
rename from cpp/ql/src/change-notes/released/0.9.6.md
rename to cpp/ql/src/change-notes/2024-02-16-modelled-functions-block-flow.md
index 0c85f3f9f0f..d6ef3c3e056 100644
--- a/cpp/ql/src/change-notes/released/0.9.6.md
+++ b/cpp/ql/src/change-notes/2024-02-16-modelled-functions-block-flow.md
@@ -1,6 +1,4 @@
-## 0.9.6
-
-### Minor Analysis Improvements
-
-* The "non-constant format string" query (`cpp/non-constant-format`) has been converted to a `path-problem` query.
+---
+category: minorAnalysis
+---
* The new C/C++ dataflow and taint-tracking libraries (`semmle.code.cpp.dataflow.new.DataFlow` and `semmle.code.cpp.dataflow.new.TaintTracking`) now implicitly assume that dataflow and taint modelled via `DataFlowFunction` and `TaintFunction` always fully overwrite their buffers and thus act as flow barriers. As a result, many dataflow and taint-tracking queries now produce fewer false positives. To remove this assumption and go back to the previous behavior for a given model, one can override the new `isPartialWrite` predicate.
diff --git a/cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md b/cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md
new file mode 100644
index 00000000000..2e5933a61e8
--- /dev/null
+++ b/cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The "non-constant format string" query (`cpp/non-constant-format`) has been converted to a `path-problem` query.
\ No newline at end of file
diff --git a/cpp/ql/src/codeql-pack.release.yml b/cpp/ql/src/codeql-pack.release.yml
index 19139c132b2..460240feaff 100644
--- a/cpp/ql/src/codeql-pack.release.yml
+++ b/cpp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.9.6
+lastReleaseVersion: 0.9.5
diff --git a/cpp/ql/src/qlpack.yml b/cpp/ql/src/qlpack.yml
index 4052647bb97..31bd20166b2 100644
--- a/cpp/ql/src/qlpack.yml
+++ b/cpp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-queries
-version: 0.9.6
+version: 0.9.6-dev
groups:
- cpp
- queries
diff --git a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
index 82eacfc84f7..190b83b0f25 100644
--- a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
+++ b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 1.7.10
-
-No user-facing changes.
-
## 1.7.9
No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md
deleted file mode 100644
index 8e8007d8475..00000000000
--- a/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 1.7.10
-
-No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
index 31c7fe07020..678da6bc37e 100644
--- a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.7.10
+lastReleaseVersion: 1.7.9
diff --git a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
index ee993bed0c9..7e643b0fac3 100644
--- a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-all
-version: 1.7.10
+version: 1.7.10-dev
groups:
- csharp
- solorigate
diff --git a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
index 82eacfc84f7..190b83b0f25 100644
--- a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
+++ b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 1.7.10
-
-No user-facing changes.
-
## 1.7.9
No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md
deleted file mode 100644
index 8e8007d8475..00000000000
--- a/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 1.7.10
-
-No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
index 31c7fe07020..678da6bc37e 100644
--- a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
+++ b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.7.10
+lastReleaseVersion: 1.7.9
diff --git a/csharp/ql/campaigns/Solorigate/src/qlpack.yml b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
index 1f421754fc8..8654bbfd031 100644
--- a/csharp/ql/campaigns/Solorigate/src/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-queries
-version: 1.7.10
+version: 1.7.10-dev
groups:
- csharp
- solorigate
diff --git a/csharp/ql/lib/CHANGELOG.md b/csharp/ql/lib/CHANGELOG.md
index 16cc14259e1..95fd64c5270 100644
--- a/csharp/ql/lib/CHANGELOG.md
+++ b/csharp/ql/lib/CHANGELOG.md
@@ -1,17 +1,3 @@
-## 0.8.10
-
-### Major Analysis Improvements
-
-* Improved support for flow through captured variables that properly adheres to inter-procedural control flow.
-* We no longer make use of CodeQL database stats, which may affect join-orders in custom queries. It is therefore recommended to test performance of custom queries after upgrading to this version.
-
-### Minor Analysis Improvements
-
-* C# 12: Add QL library support (`ExperimentalAttribute`) for the experimental attribute.
-* C# 12: Add extractor and QL library support for `ref readonly` parameters.
-* C#: The table `expr_compiler_generated` has been deleted and its content has been added to `compiler_generated`.
-* Data flow via get only properties like `public object Obj { get; }` is now captured by the data flow library.
-
## 0.8.9
### Minor Analysis Improvements
diff --git a/csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md b/csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md
new file mode 100644
index 00000000000..6bb8e99c71e
--- /dev/null
+++ b/csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Data flow via get only properties like `public object Obj { get; }` is now captured by the data flow library.
diff --git a/csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md b/csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md
new file mode 100644
index 00000000000..d6ffbd523ac
--- /dev/null
+++ b/csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md
@@ -0,0 +1,4 @@
+---
+category: majorAnalysis
+---
+* We no longer make use of CodeQL database stats, which may affect join-orders in custom queries. It is therefore recommended to test performance of custom queries after upgrading to this version.
diff --git a/csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md b/csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md
new file mode 100644
index 00000000000..9b1739b9b6d
--- /dev/null
+++ b/csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* C#: The table `expr_compiler_generated` has been deleted and its content has been added to `compiler_generated`.
diff --git a/csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md b/csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md
new file mode 100644
index 00000000000..66ab65083dc
--- /dev/null
+++ b/csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md
@@ -0,0 +1,4 @@
+---
+category: majorAnalysis
+---
+* Improved support for flow through captured variables that properly adheres to inter-procedural control flow.
\ No newline at end of file
diff --git a/csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md b/csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md
new file mode 100644
index 00000000000..8749c790954
--- /dev/null
+++ b/csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* C# 12: Add QL library support (`ExperimentalAttribute`) for the experimental attribute.
diff --git a/csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md b/csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md
new file mode 100644
index 00000000000..586b5341d29
--- /dev/null
+++ b/csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* C# 12: Add extractor and QL library support for `ref readonly` parameters.
diff --git a/csharp/ql/lib/change-notes/released/0.8.10.md b/csharp/ql/lib/change-notes/released/0.8.10.md
deleted file mode 100644
index f591ddc5b21..00000000000
--- a/csharp/ql/lib/change-notes/released/0.8.10.md
+++ /dev/null
@@ -1,13 +0,0 @@
-## 0.8.10
-
-### Major Analysis Improvements
-
-* Improved support for flow through captured variables that properly adheres to inter-procedural control flow.
-* We no longer make use of CodeQL database stats, which may affect join-orders in custom queries. It is therefore recommended to test performance of custom queries after upgrading to this version.
-
-### Minor Analysis Improvements
-
-* C# 12: Add QL library support (`ExperimentalAttribute`) for the experimental attribute.
-* C# 12: Add extractor and QL library support for `ref readonly` parameters.
-* C#: The table `expr_compiler_generated` has been deleted and its content has been added to `compiler_generated`.
-* Data flow via get only properties like `public object Obj { get; }` is now captured by the data flow library.
diff --git a/csharp/ql/lib/codeql-pack.release.yml b/csharp/ql/lib/codeql-pack.release.yml
index 0521f0f75fa..5290c29b7fe 100644
--- a/csharp/ql/lib/codeql-pack.release.yml
+++ b/csharp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.10
+lastReleaseVersion: 0.8.9
diff --git a/csharp/ql/lib/qlpack.yml b/csharp/ql/lib/qlpack.yml
index 93c5c1120a2..d75ea3c6320 100644
--- a/csharp/ql/lib/qlpack.yml
+++ b/csharp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-all
-version: 0.8.10
+version: 0.8.10-dev
groups: csharp
dbscheme: semmlecode.csharp.dbscheme
extractor: csharp
diff --git a/csharp/ql/src/CHANGELOG.md b/csharp/ql/src/CHANGELOG.md
index 46c939e5cee..9fe1609363f 100644
--- a/csharp/ql/src/CHANGELOG.md
+++ b/csharp/ql/src/CHANGELOG.md
@@ -1,9 +1,3 @@
-## 0.8.10
-
-### Minor Analysis Improvements
-
-* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. The changed queries are `cs/code-injection`, `cs/command-line-injection`, `cs/user-controlled-bypass`, `cs/count-untrusted-data-external-api`, `cs/untrusted-data-to-external-api`, `cs/ldap-injection`, `cs/log-forging`, `cs/xml/missing-validation`, `cs/redos`, `cs/regex-injection`, `cs/resource-injection`, `cs/sql-injection`, `cs/path-injection`, `cs/unsafe-deserialization-untrusted-input`, `cs/web/unvalidated-url-redirection`, `cs/xml/insecure-dtd-handling`, `cs/xml/xpath-injection`, `cs/web/xss`, and `cs/uncontrolled-format-string`.
-
## 0.8.9
### Minor Analysis Improvements
diff --git a/csharp/ql/src/change-notes/released/0.8.10.md b/csharp/ql/src/change-notes/2024-02-06-threat-models.md
similarity index 88%
rename from csharp/ql/src/change-notes/released/0.8.10.md
rename to csharp/ql/src/change-notes/2024-02-06-threat-models.md
index 702161c3d28..69ac4e4dc17 100644
--- a/csharp/ql/src/change-notes/released/0.8.10.md
+++ b/csharp/ql/src/change-notes/2024-02-06-threat-models.md
@@ -1,5 +1,4 @@
-## 0.8.10
-
-### Minor Analysis Improvements
-
-* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. The changed queries are `cs/code-injection`, `cs/command-line-injection`, `cs/user-controlled-bypass`, `cs/count-untrusted-data-external-api`, `cs/untrusted-data-to-external-api`, `cs/ldap-injection`, `cs/log-forging`, `cs/xml/missing-validation`, `cs/redos`, `cs/regex-injection`, `cs/resource-injection`, `cs/sql-injection`, `cs/path-injection`, `cs/unsafe-deserialization-untrusted-input`, `cs/web/unvalidated-url-redirection`, `cs/xml/insecure-dtd-handling`, `cs/xml/xpath-injection`, `cs/web/xss`, and `cs/uncontrolled-format-string`.
+---
+category: minorAnalysis
+---
+* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. The changed queries are `cs/code-injection`, `cs/command-line-injection`, `cs/user-controlled-bypass`, `cs/count-untrusted-data-external-api`, `cs/untrusted-data-to-external-api`, `cs/ldap-injection`, `cs/log-forging`, `cs/xml/missing-validation`, `cs/redos`, `cs/regex-injection`, `cs/resource-injection`, `cs/sql-injection`, `cs/path-injection`, `cs/unsafe-deserialization-untrusted-input`, `cs/web/unvalidated-url-redirection`, `cs/xml/insecure-dtd-handling`, `cs/xml/xpath-injection`, `cs/web/xss`, and `cs/uncontrolled-format-string`.
\ No newline at end of file
diff --git a/csharp/ql/src/codeql-pack.release.yml b/csharp/ql/src/codeql-pack.release.yml
index 0521f0f75fa..5290c29b7fe 100644
--- a/csharp/ql/src/codeql-pack.release.yml
+++ b/csharp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.10
+lastReleaseVersion: 0.8.9
diff --git a/csharp/ql/src/qlpack.yml b/csharp/ql/src/qlpack.yml
index 46384094b19..9ee23cc7307 100644
--- a/csharp/ql/src/qlpack.yml
+++ b/csharp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-queries
-version: 0.8.10
+version: 0.8.10-dev
groups:
- csharp
- queries
diff --git a/go/ql/consistency-queries/CHANGELOG.md b/go/ql/consistency-queries/CHANGELOG.md
index a59e560c415..fba2a870356 100644
--- a/go/ql/consistency-queries/CHANGELOG.md
+++ b/go/ql/consistency-queries/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.0.9
-
-No user-facing changes.
-
## 0.0.8
No user-facing changes.
diff --git a/go/ql/consistency-queries/change-notes/released/0.0.9.md b/go/ql/consistency-queries/change-notes/released/0.0.9.md
deleted file mode 100644
index c9e17c6d6cf..00000000000
--- a/go/ql/consistency-queries/change-notes/released/0.0.9.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.0.9
-
-No user-facing changes.
diff --git a/go/ql/consistency-queries/codeql-pack.release.yml b/go/ql/consistency-queries/codeql-pack.release.yml
index ecdd64fbab8..58fdc6b45de 100644
--- a/go/ql/consistency-queries/codeql-pack.release.yml
+++ b/go/ql/consistency-queries/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.9
+lastReleaseVersion: 0.0.8
diff --git a/go/ql/consistency-queries/qlpack.yml b/go/ql/consistency-queries/qlpack.yml
index d5a2fbee5f1..b574796b995 100644
--- a/go/ql/consistency-queries/qlpack.yml
+++ b/go/ql/consistency-queries/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql-go-consistency-queries
-version: 0.0.9
+version: 0.0.9-dev
groups:
- go
- queries
diff --git a/go/ql/lib/CHANGELOG.md b/go/ql/lib/CHANGELOG.md
index fee5fd37a26..65a2376217b 100644
--- a/go/ql/lib/CHANGELOG.md
+++ b/go/ql/lib/CHANGELOG.md
@@ -1,14 +1,3 @@
-## 0.7.10
-
-### Major Analysis Improvements
-
-* We have significantly improved the Go autobuilder to understand a greater range of project layouts, which allows Go source files to be analysed that could previously not be processed.
-* Go 1.22 has been included in the range of supported Go versions.
-
-### Bug Fixes
-
-* Fixed dataflow out of a `map` using a `range` statement.
-
## 0.7.9
No user-facing changes.
diff --git a/go/ql/lib/change-notes/2024-02-14-range-map-read.md b/go/ql/lib/change-notes/2024-02-14-range-map-read.md
new file mode 100644
index 00000000000..ea45737a72e
--- /dev/null
+++ b/go/ql/lib/change-notes/2024-02-14-range-map-read.md
@@ -0,0 +1,4 @@
+---
+category: fix
+---
+* Fixed dataflow out of a `map` using a `range` statement.
diff --git a/go/ql/lib/change-notes/released/0.7.10.md b/go/ql/lib/change-notes/2024-03-04-autobuilder-changes.md
similarity index 68%
rename from go/ql/lib/change-notes/released/0.7.10.md
rename to go/ql/lib/change-notes/2024-03-04-autobuilder-changes.md
index 55954f8a394..0442a571029 100644
--- a/go/ql/lib/change-notes/released/0.7.10.md
+++ b/go/ql/lib/change-notes/2024-03-04-autobuilder-changes.md
@@ -1,10 +1,5 @@
-## 0.7.10
-
-### Major Analysis Improvements
-
+---
+category: majorAnalysis
+---
* We have significantly improved the Go autobuilder to understand a greater range of project layouts, which allows Go source files to be analysed that could previously not be processed.
* Go 1.22 has been included in the range of supported Go versions.
-
-### Bug Fixes
-
-* Fixed dataflow out of a `map` using a `range` statement.
diff --git a/go/ql/lib/codeql-pack.release.yml b/go/ql/lib/codeql-pack.release.yml
index 67518567297..576395f3405 100644
--- a/go/ql/lib/codeql-pack.release.yml
+++ b/go/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.7.10
+lastReleaseVersion: 0.7.9
diff --git a/go/ql/lib/qlpack.yml b/go/ql/lib/qlpack.yml
index 8cc190fa880..f21e478efa6 100644
--- a/go/ql/lib/qlpack.yml
+++ b/go/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-all
-version: 0.7.10
+version: 0.7.10-dev
groups: go
dbscheme: go.dbscheme
extractor: go
diff --git a/go/ql/src/CHANGELOG.md b/go/ql/src/CHANGELOG.md
index 24e38b9890e..d95165a3a34 100644
--- a/go/ql/src/CHANGELOG.md
+++ b/go/ql/src/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.7.10
-
-No user-facing changes.
-
## 0.7.9
### New Queries
diff --git a/go/ql/src/change-notes/released/0.7.10.md b/go/ql/src/change-notes/released/0.7.10.md
deleted file mode 100644
index 989c5b8f682..00000000000
--- a/go/ql/src/change-notes/released/0.7.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.7.10
-
-No user-facing changes.
diff --git a/go/ql/src/codeql-pack.release.yml b/go/ql/src/codeql-pack.release.yml
index 67518567297..576395f3405 100644
--- a/go/ql/src/codeql-pack.release.yml
+++ b/go/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.7.10
+lastReleaseVersion: 0.7.9
diff --git a/go/ql/src/qlpack.yml b/go/ql/src/qlpack.yml
index 4ded3a52f63..d91cab59612 100644
--- a/go/ql/src/qlpack.yml
+++ b/go/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-queries
-version: 0.7.10
+version: 0.7.10-dev
groups:
- go
- queries
diff --git a/java/ql/automodel/src/CHANGELOG.md b/java/ql/automodel/src/CHANGELOG.md
index c3282c773a9..4a3c54adb38 100644
--- a/java/ql/automodel/src/CHANGELOG.md
+++ b/java/ql/automodel/src/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.0.17
-
-No user-facing changes.
-
## 0.0.16
No user-facing changes.
diff --git a/java/ql/automodel/src/change-notes/released/0.0.17.md b/java/ql/automodel/src/change-notes/released/0.0.17.md
deleted file mode 100644
index 62cc89030a6..00000000000
--- a/java/ql/automodel/src/change-notes/released/0.0.17.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.0.17
-
-No user-facing changes.
diff --git a/java/ql/automodel/src/codeql-pack.release.yml b/java/ql/automodel/src/codeql-pack.release.yml
index cbc3d3cd493..a49f7be4cff 100644
--- a/java/ql/automodel/src/codeql-pack.release.yml
+++ b/java/ql/automodel/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.17
+lastReleaseVersion: 0.0.16
diff --git a/java/ql/automodel/src/qlpack.yml b/java/ql/automodel/src/qlpack.yml
index 59fab0cdcc5..898239be098 100644
--- a/java/ql/automodel/src/qlpack.yml
+++ b/java/ql/automodel/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-automodel-queries
-version: 0.0.17
+version: 0.0.17-dev
groups:
- java
- automodel
diff --git a/java/ql/lib/CHANGELOG.md b/java/ql/lib/CHANGELOG.md
index 2a02ccee6ab..d369cbdc931 100644
--- a/java/ql/lib/CHANGELOG.md
+++ b/java/ql/lib/CHANGELOG.md
@@ -1,14 +1,3 @@
-## 0.8.10
-
-### Minor Analysis Improvements
-
-* Java expressions with erroneous types (e.g. the result of a call whose callee couldn't be resolved during extraction) are now given a CodeQL `ErrorType` more often.
-
-### Bug Fixes
-
-* Fixed the Java autobuilder overriding the version of Maven used by a project when the Maven wrapper `mvnw` is in use and the `maven-wrapper.jar` file is not present in the repository.
-* Some flow steps related to `android.text.Editable.toString` that were accidentally disabled have been re-enabled.
-
## 0.8.9
### Deprecated APIs
diff --git a/java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md b/java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md
new file mode 100644
index 00000000000..eb560fba07d
--- /dev/null
+++ b/java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md
@@ -0,0 +1,4 @@
+---
+category: fix
+---
+* Some flow steps related to `android.text.Editable.toString` that were accidentally disabled have been re-enabled.
diff --git a/java/ql/lib/change-notes/2024-02-27-error-types.md b/java/ql/lib/change-notes/2024-02-27-error-types.md
new file mode 100644
index 00000000000..cdc6d7620aa
--- /dev/null
+++ b/java/ql/lib/change-notes/2024-02-27-error-types.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Java expressions with erroneous types (e.g. the result of a call whose callee couldn't be resolved during extraction) are now given a CodeQL `ErrorType` more often.
diff --git a/java/ql/lib/change-notes/2024-02-27-mvnw-versions.md b/java/ql/lib/change-notes/2024-02-27-mvnw-versions.md
new file mode 100644
index 00000000000..a0227088ae9
--- /dev/null
+++ b/java/ql/lib/change-notes/2024-02-27-mvnw-versions.md
@@ -0,0 +1,4 @@
+---
+category: fix
+---
+* Fixed the Java autobuilder overriding the version of Maven used by a project when the Maven wrapper `mvnw` is in use and the `maven-wrapper.jar` file is not present in the repository.
diff --git a/java/ql/lib/change-notes/released/0.8.10.md b/java/ql/lib/change-notes/released/0.8.10.md
deleted file mode 100644
index b45f14bf347..00000000000
--- a/java/ql/lib/change-notes/released/0.8.10.md
+++ /dev/null
@@ -1,10 +0,0 @@
-## 0.8.10
-
-### Minor Analysis Improvements
-
-* Java expressions with erroneous types (e.g. the result of a call whose callee couldn't be resolved during extraction) are now given a CodeQL `ErrorType` more often.
-
-### Bug Fixes
-
-* Fixed the Java autobuilder overriding the version of Maven used by a project when the Maven wrapper `mvnw` is in use and the `maven-wrapper.jar` file is not present in the repository.
-* Some flow steps related to `android.text.Editable.toString` that were accidentally disabled have been re-enabled.
diff --git a/java/ql/lib/codeql-pack.release.yml b/java/ql/lib/codeql-pack.release.yml
index 0521f0f75fa..5290c29b7fe 100644
--- a/java/ql/lib/codeql-pack.release.yml
+++ b/java/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.10
+lastReleaseVersion: 0.8.9
diff --git a/java/ql/lib/qlpack.yml b/java/ql/lib/qlpack.yml
index 428eedc75e3..15b4982d41e 100644
--- a/java/ql/lib/qlpack.yml
+++ b/java/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-all
-version: 0.8.10
+version: 0.8.10-dev
groups: java
dbscheme: config/semmlecode.dbscheme
extractor: java
diff --git a/java/ql/src/CHANGELOG.md b/java/ql/src/CHANGELOG.md
index c61275f5ed8..5d835351453 100644
--- a/java/ql/src/CHANGELOG.md
+++ b/java/ql/src/CHANGELOG.md
@@ -1,13 +1,3 @@
-## 0.8.10
-
-### New Queries
-
-* Added a new query `java/android/insecure-local-key-gen` for finding instances of keys generated for biometric authentication in an insecure way.
-
-### Minor Analysis Improvements
-
-* To reduce the number of false positives in the query "Insertion of sensitive information into log files" (`java/sensitive-log`), variables with names that contain "null" (case-insensitively) are no longer considered sources of sensitive information.
-
## 0.8.9
### New Queries
diff --git a/java/ql/src/change-notes/2024-02-12-android-insecure-keys.md b/java/ql/src/change-notes/2024-02-12-android-insecure-keys.md
new file mode 100644
index 00000000000..1de07727796
--- /dev/null
+++ b/java/ql/src/change-notes/2024-02-12-android-insecure-keys.md
@@ -0,0 +1,4 @@
+---
+category: newQuery
+---
+* Added a new query `java/android/insecure-local-key-gen` for finding instances of keys generated for biometric authentication in an insecure way.
\ No newline at end of file
diff --git a/java/ql/src/change-notes/released/0.8.10.md b/java/ql/src/change-notes/2024-03-04-sensitive-log-remove-null-from-sources.md
similarity index 54%
rename from java/ql/src/change-notes/released/0.8.10.md
rename to java/ql/src/change-notes/2024-03-04-sensitive-log-remove-null-from-sources.md
index c5d18ae3379..0bb4f18f2bd 100644
--- a/java/ql/src/change-notes/released/0.8.10.md
+++ b/java/ql/src/change-notes/2024-03-04-sensitive-log-remove-null-from-sources.md
@@ -1,9 +1,4 @@
-## 0.8.10
-
-### New Queries
-
-* Added a new query `java/android/insecure-local-key-gen` for finding instances of keys generated for biometric authentication in an insecure way.
-
-### Minor Analysis Improvements
-
+---
+category: minorAnalysis
+---
* To reduce the number of false positives in the query "Insertion of sensitive information into log files" (`java/sensitive-log`), variables with names that contain "null" (case-insensitively) are no longer considered sources of sensitive information.
diff --git a/java/ql/src/codeql-pack.release.yml b/java/ql/src/codeql-pack.release.yml
index 0521f0f75fa..5290c29b7fe 100644
--- a/java/ql/src/codeql-pack.release.yml
+++ b/java/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.10
+lastReleaseVersion: 0.8.9
diff --git a/java/ql/src/qlpack.yml b/java/ql/src/qlpack.yml
index ebbdbeee3b2..8f4de528e21 100644
--- a/java/ql/src/qlpack.yml
+++ b/java/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-queries
-version: 0.8.10
+version: 0.8.10-dev
groups:
- java
- queries
diff --git a/javascript/ql/lib/CHANGELOG.md b/javascript/ql/lib/CHANGELOG.md
index d5edcc00513..5b97ebbb22b 100644
--- a/javascript/ql/lib/CHANGELOG.md
+++ b/javascript/ql/lib/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.8.10
-
-No user-facing changes.
-
## 0.8.9
### Minor Analysis Improvements
diff --git a/javascript/ql/lib/change-notes/released/0.8.10.md b/javascript/ql/lib/change-notes/released/0.8.10.md
deleted file mode 100644
index 777bbd2fded..00000000000
--- a/javascript/ql/lib/change-notes/released/0.8.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.8.10
-
-No user-facing changes.
diff --git a/javascript/ql/lib/codeql-pack.release.yml b/javascript/ql/lib/codeql-pack.release.yml
index 0521f0f75fa..5290c29b7fe 100644
--- a/javascript/ql/lib/codeql-pack.release.yml
+++ b/javascript/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.10
+lastReleaseVersion: 0.8.9
diff --git a/javascript/ql/lib/qlpack.yml b/javascript/ql/lib/qlpack.yml
index da16493a21c..ef3ca7521ac 100644
--- a/javascript/ql/lib/qlpack.yml
+++ b/javascript/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-all
-version: 0.8.10
+version: 0.8.10-dev
groups: javascript
dbscheme: semmlecode.javascript.dbscheme
extractor: javascript
diff --git a/javascript/ql/src/CHANGELOG.md b/javascript/ql/src/CHANGELOG.md
index b9627cac5ee..85516e3625d 100644
--- a/javascript/ql/src/CHANGELOG.md
+++ b/javascript/ql/src/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.8.10
-
-No user-facing changes.
-
## 0.8.9
### Bug Fixes
diff --git a/javascript/ql/src/change-notes/released/0.8.10.md b/javascript/ql/src/change-notes/released/0.8.10.md
deleted file mode 100644
index 777bbd2fded..00000000000
--- a/javascript/ql/src/change-notes/released/0.8.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.8.10
-
-No user-facing changes.
diff --git a/javascript/ql/src/codeql-pack.release.yml b/javascript/ql/src/codeql-pack.release.yml
index 0521f0f75fa..5290c29b7fe 100644
--- a/javascript/ql/src/codeql-pack.release.yml
+++ b/javascript/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.10
+lastReleaseVersion: 0.8.9
diff --git a/javascript/ql/src/qlpack.yml b/javascript/ql/src/qlpack.yml
index d224952c564..b6181aa30e9 100644
--- a/javascript/ql/src/qlpack.yml
+++ b/javascript/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-queries
-version: 0.8.10
+version: 0.8.10-dev
groups:
- javascript
- queries
diff --git a/misc/suite-helpers/CHANGELOG.md b/misc/suite-helpers/CHANGELOG.md
index 1c4455b66c4..3c06dd69b0f 100644
--- a/misc/suite-helpers/CHANGELOG.md
+++ b/misc/suite-helpers/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.7.10
-
-No user-facing changes.
-
## 0.7.9
No user-facing changes.
diff --git a/misc/suite-helpers/change-notes/released/0.7.10.md b/misc/suite-helpers/change-notes/released/0.7.10.md
deleted file mode 100644
index 989c5b8f682..00000000000
--- a/misc/suite-helpers/change-notes/released/0.7.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.7.10
-
-No user-facing changes.
diff --git a/misc/suite-helpers/codeql-pack.release.yml b/misc/suite-helpers/codeql-pack.release.yml
index 67518567297..576395f3405 100644
--- a/misc/suite-helpers/codeql-pack.release.yml
+++ b/misc/suite-helpers/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.7.10
+lastReleaseVersion: 0.7.9
diff --git a/misc/suite-helpers/qlpack.yml b/misc/suite-helpers/qlpack.yml
index 54d978d5efe..49b7a6bda4c 100644
--- a/misc/suite-helpers/qlpack.yml
+++ b/misc/suite-helpers/qlpack.yml
@@ -1,4 +1,4 @@
name: codeql/suite-helpers
-version: 0.7.10
+version: 0.7.10-dev
groups: shared
warnOnImplicitThis: true
diff --git a/python/ql/lib/CHANGELOG.md b/python/ql/lib/CHANGELOG.md
index f095607ca1b..e6f318c51ea 100644
--- a/python/ql/lib/CHANGELOG.md
+++ b/python/ql/lib/CHANGELOG.md
@@ -1,10 +1,3 @@
-## 0.11.10
-
-### Minor Analysis Improvements
-
-* Fixed missing flow for dictionary updates (`d[] = ...`) when `` is a string constant not used in dictionary literals or as name of keyword-argument.
-* Fixed flow for iterable unpacking (`a,b = my_tuple`) when it occurs on top-level (module) scope.
-
## 0.11.9
### Minor Analysis Improvements
diff --git a/python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md b/python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md
new file mode 100644
index 00000000000..3c47c6ba866
--- /dev/null
+++ b/python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Fixed flow for iterable unpacking (`a,b = my_tuple`) when it occurs on top-level (module) scope.
diff --git a/python/ql/lib/change-notes/released/0.11.10.md b/python/ql/lib/change-notes/2024-03-01-dict-update-content.md
similarity index 52%
rename from python/ql/lib/change-notes/released/0.11.10.md
rename to python/ql/lib/change-notes/2024-03-01-dict-update-content.md
index ed873724e4f..dfb8d247fff 100644
--- a/python/ql/lib/change-notes/released/0.11.10.md
+++ b/python/ql/lib/change-notes/2024-03-01-dict-update-content.md
@@ -1,6 +1,4 @@
-## 0.11.10
-
-### Minor Analysis Improvements
-
+---
+category: minorAnalysis
+---
* Fixed missing flow for dictionary updates (`d[] = ...`) when `` is a string constant not used in dictionary literals or as name of keyword-argument.
-* Fixed flow for iterable unpacking (`a,b = my_tuple`) when it occurs on top-level (module) scope.
diff --git a/python/ql/lib/codeql-pack.release.yml b/python/ql/lib/codeql-pack.release.yml
index ddddcbe9193..b064d1778a1 100644
--- a/python/ql/lib/codeql-pack.release.yml
+++ b/python/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.11.10
+lastReleaseVersion: 0.11.9
diff --git a/python/ql/lib/qlpack.yml b/python/ql/lib/qlpack.yml
index 59a8b4c96d1..e9f66e205f2 100644
--- a/python/ql/lib/qlpack.yml
+++ b/python/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-all
-version: 0.11.10
+version: 0.11.10-dev
groups: python
dbscheme: semmlecode.python.dbscheme
extractor: python
diff --git a/python/ql/src/CHANGELOG.md b/python/ql/src/CHANGELOG.md
index d4245aba7a6..50762bcbf34 100644
--- a/python/ql/src/CHANGELOG.md
+++ b/python/ql/src/CHANGELOG.md
@@ -1,9 +1,3 @@
-## 0.9.10
-
-### New Queries
-
-* The query `py/nosql-injection` for finding NoSQL injection vulnerabilities is now part of the default security suite.
-
## 0.9.9
No user-facing changes.
diff --git a/python/ql/src/change-notes/released/0.9.10.md b/python/ql/src/change-notes/2024-03-04-nosql-injection.md
similarity index 81%
rename from python/ql/src/change-notes/released/0.9.10.md
rename to python/ql/src/change-notes/2024-03-04-nosql-injection.md
index 4cbb221b789..6e98540c757 100644
--- a/python/ql/src/change-notes/released/0.9.10.md
+++ b/python/ql/src/change-notes/2024-03-04-nosql-injection.md
@@ -1,5 +1,4 @@
-## 0.9.10
-
-### New Queries
-
+---
+category: newQuery
+---
* The query `py/nosql-injection` for finding NoSQL injection vulnerabilities is now part of the default security suite.
diff --git a/python/ql/src/codeql-pack.release.yml b/python/ql/src/codeql-pack.release.yml
index d086ed69541..aabed7c396b 100644
--- a/python/ql/src/codeql-pack.release.yml
+++ b/python/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.9.10
+lastReleaseVersion: 0.9.9
diff --git a/python/ql/src/qlpack.yml b/python/ql/src/qlpack.yml
index c920f667836..aa18f2d8707 100644
--- a/python/ql/src/qlpack.yml
+++ b/python/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-queries
-version: 0.9.10
+version: 0.9.10-dev
groups:
- python
- queries
diff --git a/ruby/ql/lib/CHANGELOG.md b/ruby/ql/lib/CHANGELOG.md
index c61a12e0f4a..a623a151e89 100644
--- a/ruby/ql/lib/CHANGELOG.md
+++ b/ruby/ql/lib/CHANGELOG.md
@@ -1,12 +1,3 @@
-## 0.8.10
-
-### Minor Analysis Improvements
-
-* Calls to `I18n.translate` as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
-* Calls to `Arel::Nodes::SqlLiteral.new` are now modeled as instances of the `SqlConstruction` concept, as well as propagating taint from their argument.
-* Additional arguments beyond the first of calls to the `ActiveRecord` methods `select`, `reselect`, `order`, `reorder`, `joins`, `group`, and `pluck` are now recognized as sql injection sinks.
-* Calls to several methods of `ActiveRecord::Connection`, such as `ActiveRecord::Connection#exec_query`, are now recognized as SQL executions, including those via subclasses.
-
## 0.8.9
### Minor Analysis Improvements
diff --git a/ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md b/ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md
new file mode 100644
index 00000000000..c2276f284a8
--- /dev/null
+++ b/ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Calls to several methods of `ActiveRecord::Connection`, such as `ActiveRecord::Connection#exec_query`, are now recognized as SQL executions, including those via subclasses.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md b/ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md
new file mode 100644
index 00000000000..1486c7a472d
--- /dev/null
+++ b/ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Additional arguments beyond the first of calls to the `ActiveRecord` methods `select`, `reselect`, `order`, `reorder`, `joins`, `group`, and `pluck` are now recognized as sql injection sinks.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md b/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
new file mode 100644
index 00000000000..6f3a90768ba
--- /dev/null
+++ b/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Calls to `Arel::Nodes::SqlLiteral.new` are now modeled as instances of the `SqlConstruction` concept, as well as propagating taint from their argument.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md b/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
new file mode 100644
index 00000000000..350e049b5bf
--- /dev/null
+++ b/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Calls to `I18n.translate` as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/released/0.8.10.md b/ruby/ql/lib/change-notes/released/0.8.10.md
deleted file mode 100644
index 666e28f840e..00000000000
--- a/ruby/ql/lib/change-notes/released/0.8.10.md
+++ /dev/null
@@ -1,8 +0,0 @@
-## 0.8.10
-
-### Minor Analysis Improvements
-
-* Calls to `I18n.translate` as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
-* Calls to `Arel::Nodes::SqlLiteral.new` are now modeled as instances of the `SqlConstruction` concept, as well as propagating taint from their argument.
-* Additional arguments beyond the first of calls to the `ActiveRecord` methods `select`, `reselect`, `order`, `reorder`, `joins`, `group`, and `pluck` are now recognized as sql injection sinks.
-* Calls to several methods of `ActiveRecord::Connection`, such as `ActiveRecord::Connection#exec_query`, are now recognized as SQL executions, including those via subclasses.
diff --git a/ruby/ql/lib/codeql-pack.release.yml b/ruby/ql/lib/codeql-pack.release.yml
index 0521f0f75fa..5290c29b7fe 100644
--- a/ruby/ql/lib/codeql-pack.release.yml
+++ b/ruby/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.10
+lastReleaseVersion: 0.8.9
diff --git a/ruby/ql/lib/qlpack.yml b/ruby/ql/lib/qlpack.yml
index de5b41999fe..7d409b83adb 100644
--- a/ruby/ql/lib/qlpack.yml
+++ b/ruby/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-all
-version: 0.8.10
+version: 0.8.10-dev
groups: ruby
extractor: ruby
dbscheme: ruby.dbscheme
diff --git a/ruby/ql/src/CHANGELOG.md b/ruby/ql/src/CHANGELOG.md
index f875b6d16ad..4149c728eff 100644
--- a/ruby/ql/src/CHANGELOG.md
+++ b/ruby/ql/src/CHANGELOG.md
@@ -1,10 +1,3 @@
-## 0.8.10
-
-### Minor Analysis Improvements
-
-* Calls to `Object#method`, `Object#public_method` and `Object#singleton_method` with untrusted data are now recognised as sinks for code injection.
-* Added additional request sources for Ruby on Rails.
-
## 0.8.9
No user-facing changes.
diff --git a/ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md b/ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md
new file mode 100644
index 00000000000..84ea696dfef
--- /dev/null
+++ b/ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added additional request sources for Ruby on Rails.
\ No newline at end of file
diff --git a/ruby/ql/src/change-notes/released/0.8.10.md b/ruby/ql/src/change-notes/2024-03-01-method-code-injection-sinks.md
similarity index 51%
rename from ruby/ql/src/change-notes/released/0.8.10.md
rename to ruby/ql/src/change-notes/2024-03-01-method-code-injection-sinks.md
index 985cdf8d22e..43e40d3fd53 100644
--- a/ruby/ql/src/change-notes/released/0.8.10.md
+++ b/ruby/ql/src/change-notes/2024-03-01-method-code-injection-sinks.md
@@ -1,6 +1,4 @@
-## 0.8.10
-
-### Minor Analysis Improvements
-
-* Calls to `Object#method`, `Object#public_method` and `Object#singleton_method` with untrusted data are now recognised as sinks for code injection.
-* Added additional request sources for Ruby on Rails.
+---
+category: minorAnalysis
+---
+* Calls to `Object#method`, `Object#public_method` and `Object#singleton_method` with untrusted data are now recognised as sinks for code injection.
\ No newline at end of file
diff --git a/ruby/ql/src/codeql-pack.release.yml b/ruby/ql/src/codeql-pack.release.yml
index 0521f0f75fa..5290c29b7fe 100644
--- a/ruby/ql/src/codeql-pack.release.yml
+++ b/ruby/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.10
+lastReleaseVersion: 0.8.9
diff --git a/ruby/ql/src/qlpack.yml b/ruby/ql/src/qlpack.yml
index 5e379268234..8af7f9fd797 100644
--- a/ruby/ql/src/qlpack.yml
+++ b/ruby/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-queries
-version: 0.8.10
+version: 0.8.10-dev
groups:
- ruby
- queries
diff --git a/shared/controlflow/CHANGELOG.md b/shared/controlflow/CHANGELOG.md
index 75f2ca53f98..dbfa6ef4512 100644
--- a/shared/controlflow/CHANGELOG.md
+++ b/shared/controlflow/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.1.10
-
-No user-facing changes.
-
## 0.1.9
No user-facing changes.
diff --git a/shared/controlflow/change-notes/released/0.1.10.md b/shared/controlflow/change-notes/released/0.1.10.md
deleted file mode 100644
index 47358eeee93..00000000000
--- a/shared/controlflow/change-notes/released/0.1.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.1.10
-
-No user-facing changes.
diff --git a/shared/controlflow/codeql-pack.release.yml b/shared/controlflow/codeql-pack.release.yml
index 30f5ca88be0..1425c0edf7f 100644
--- a/shared/controlflow/codeql-pack.release.yml
+++ b/shared/controlflow/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.1.10
+lastReleaseVersion: 0.1.9
diff --git a/shared/controlflow/qlpack.yml b/shared/controlflow/qlpack.yml
index 1d43802be42..9d35a678276 100644
--- a/shared/controlflow/qlpack.yml
+++ b/shared/controlflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/controlflow
-version: 0.1.10
+version: 0.1.10-dev
groups: shared
library: true
dependencies:
diff --git a/shared/dataflow/CHANGELOG.md b/shared/dataflow/CHANGELOG.md
index ef80788bded..67a5bf589f4 100644
--- a/shared/dataflow/CHANGELOG.md
+++ b/shared/dataflow/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.1
-
-No user-facing changes.
-
## 0.2.0
### Breaking Changes
diff --git a/shared/dataflow/change-notes/released/0.2.1.md b/shared/dataflow/change-notes/released/0.2.1.md
deleted file mode 100644
index 3dbfc85fe11..00000000000
--- a/shared/dataflow/change-notes/released/0.2.1.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.1
-
-No user-facing changes.
diff --git a/shared/dataflow/codeql-pack.release.yml b/shared/dataflow/codeql-pack.release.yml
index df29a726bcc..5274e27ed52 100644
--- a/shared/dataflow/codeql-pack.release.yml
+++ b/shared/dataflow/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.1
+lastReleaseVersion: 0.2.0
diff --git a/shared/dataflow/qlpack.yml b/shared/dataflow/qlpack.yml
index ee422e02ea9..1e7becf71c4 100644
--- a/shared/dataflow/qlpack.yml
+++ b/shared/dataflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/dataflow
-version: 0.2.1
+version: 0.2.1-dev
groups: shared
library: true
dependencies:
diff --git a/shared/mad/CHANGELOG.md b/shared/mad/CHANGELOG.md
index 4730366775e..4d09057118c 100644
--- a/shared/mad/CHANGELOG.md
+++ b/shared/mad/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.10
-
-No user-facing changes.
-
## 0.2.9
No user-facing changes.
diff --git a/shared/mad/change-notes/released/0.2.10.md b/shared/mad/change-notes/released/0.2.10.md
deleted file mode 100644
index 81c9722b19f..00000000000
--- a/shared/mad/change-notes/released/0.2.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.10
-
-No user-facing changes.
diff --git a/shared/mad/codeql-pack.release.yml b/shared/mad/codeql-pack.release.yml
index a71167814cb..d021cf0a6be 100644
--- a/shared/mad/codeql-pack.release.yml
+++ b/shared/mad/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.10
+lastReleaseVersion: 0.2.9
diff --git a/shared/mad/qlpack.yml b/shared/mad/qlpack.yml
index 6d7269ef3da..22c8f271ccc 100644
--- a/shared/mad/qlpack.yml
+++ b/shared/mad/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/mad
-version: 0.2.10
+version: 0.2.10-dev
groups: shared
library: true
dependencies: null
diff --git a/shared/rangeanalysis/CHANGELOG.md b/shared/rangeanalysis/CHANGELOG.md
index 9943dcb7972..5b8dbcfab22 100644
--- a/shared/rangeanalysis/CHANGELOG.md
+++ b/shared/rangeanalysis/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.0.9
-
-No user-facing changes.
-
## 0.0.8
No user-facing changes.
diff --git a/shared/rangeanalysis/change-notes/released/0.0.9.md b/shared/rangeanalysis/change-notes/released/0.0.9.md
deleted file mode 100644
index c9e17c6d6cf..00000000000
--- a/shared/rangeanalysis/change-notes/released/0.0.9.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.0.9
-
-No user-facing changes.
diff --git a/shared/rangeanalysis/codeql-pack.release.yml b/shared/rangeanalysis/codeql-pack.release.yml
index ecdd64fbab8..58fdc6b45de 100644
--- a/shared/rangeanalysis/codeql-pack.release.yml
+++ b/shared/rangeanalysis/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.9
+lastReleaseVersion: 0.0.8
diff --git a/shared/rangeanalysis/qlpack.yml b/shared/rangeanalysis/qlpack.yml
index 01db5d5734d..836fe51ee34 100644
--- a/shared/rangeanalysis/qlpack.yml
+++ b/shared/rangeanalysis/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/rangeanalysis
-version: 0.0.9
+version: 0.0.9-dev
groups: shared
library: true
dependencies:
diff --git a/shared/regex/CHANGELOG.md b/shared/regex/CHANGELOG.md
index c05869c153d..cd5f91f71ec 100644
--- a/shared/regex/CHANGELOG.md
+++ b/shared/regex/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.10
-
-No user-facing changes.
-
## 0.2.9
No user-facing changes.
diff --git a/shared/regex/change-notes/released/0.2.10.md b/shared/regex/change-notes/released/0.2.10.md
deleted file mode 100644
index 81c9722b19f..00000000000
--- a/shared/regex/change-notes/released/0.2.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.10
-
-No user-facing changes.
diff --git a/shared/regex/codeql-pack.release.yml b/shared/regex/codeql-pack.release.yml
index a71167814cb..d021cf0a6be 100644
--- a/shared/regex/codeql-pack.release.yml
+++ b/shared/regex/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.10
+lastReleaseVersion: 0.2.9
diff --git a/shared/regex/qlpack.yml b/shared/regex/qlpack.yml
index 0d4f485312f..ea3f7f9b238 100644
--- a/shared/regex/qlpack.yml
+++ b/shared/regex/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/regex
-version: 0.2.10
+version: 0.2.10-dev
groups: shared
library: true
dependencies:
diff --git a/shared/ssa/CHANGELOG.md b/shared/ssa/CHANGELOG.md
index a9161ff578b..01acfae0148 100644
--- a/shared/ssa/CHANGELOG.md
+++ b/shared/ssa/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.10
-
-No user-facing changes.
-
## 0.2.9
No user-facing changes.
diff --git a/shared/ssa/change-notes/released/0.2.10.md b/shared/ssa/change-notes/released/0.2.10.md
deleted file mode 100644
index 81c9722b19f..00000000000
--- a/shared/ssa/change-notes/released/0.2.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.10
-
-No user-facing changes.
diff --git a/shared/ssa/codeql-pack.release.yml b/shared/ssa/codeql-pack.release.yml
index a71167814cb..d021cf0a6be 100644
--- a/shared/ssa/codeql-pack.release.yml
+++ b/shared/ssa/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.10
+lastReleaseVersion: 0.2.9
diff --git a/shared/ssa/qlpack.yml b/shared/ssa/qlpack.yml
index 2ad254711a5..19304ad107f 100644
--- a/shared/ssa/qlpack.yml
+++ b/shared/ssa/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ssa
-version: 0.2.10
+version: 0.2.10-dev
groups: shared
library: true
dependencies:
diff --git a/shared/threat-models/CHANGELOG.md b/shared/threat-models/CHANGELOG.md
index a59e560c415..fba2a870356 100644
--- a/shared/threat-models/CHANGELOG.md
+++ b/shared/threat-models/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.0.9
-
-No user-facing changes.
-
## 0.0.8
No user-facing changes.
diff --git a/shared/threat-models/change-notes/released/0.0.9.md b/shared/threat-models/change-notes/released/0.0.9.md
deleted file mode 100644
index c9e17c6d6cf..00000000000
--- a/shared/threat-models/change-notes/released/0.0.9.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.0.9
-
-No user-facing changes.
diff --git a/shared/threat-models/codeql-pack.release.yml b/shared/threat-models/codeql-pack.release.yml
index ecdd64fbab8..58fdc6b45de 100644
--- a/shared/threat-models/codeql-pack.release.yml
+++ b/shared/threat-models/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.9
+lastReleaseVersion: 0.0.8
diff --git a/shared/threat-models/qlpack.yml b/shared/threat-models/qlpack.yml
index 60cbbc56fcb..d0ed9a913b2 100644
--- a/shared/threat-models/qlpack.yml
+++ b/shared/threat-models/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/threat-models
-version: 0.0.9
+version: 0.0.9-dev
library: true
groups: shared
dataExtensions:
diff --git a/shared/tutorial/CHANGELOG.md b/shared/tutorial/CHANGELOG.md
index 560ad058d5b..1db3a01af0b 100644
--- a/shared/tutorial/CHANGELOG.md
+++ b/shared/tutorial/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.10
-
-No user-facing changes.
-
## 0.2.9
No user-facing changes.
diff --git a/shared/tutorial/change-notes/released/0.2.10.md b/shared/tutorial/change-notes/released/0.2.10.md
deleted file mode 100644
index 81c9722b19f..00000000000
--- a/shared/tutorial/change-notes/released/0.2.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.10
-
-No user-facing changes.
diff --git a/shared/tutorial/codeql-pack.release.yml b/shared/tutorial/codeql-pack.release.yml
index a71167814cb..d021cf0a6be 100644
--- a/shared/tutorial/codeql-pack.release.yml
+++ b/shared/tutorial/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.10
+lastReleaseVersion: 0.2.9
diff --git a/shared/tutorial/qlpack.yml b/shared/tutorial/qlpack.yml
index 69116705c1b..b595ae9ee70 100644
--- a/shared/tutorial/qlpack.yml
+++ b/shared/tutorial/qlpack.yml
@@ -1,7 +1,7 @@
name: codeql/tutorial
description: Library for the CodeQL detective tutorials, helping new users learn to
write CodeQL queries.
-version: 0.2.10
+version: 0.2.10-dev
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/typetracking/CHANGELOG.md b/shared/typetracking/CHANGELOG.md
index 350f9ecbeae..afc857bc6bc 100644
--- a/shared/typetracking/CHANGELOG.md
+++ b/shared/typetracking/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.10
-
-No user-facing changes.
-
## 0.2.9
No user-facing changes.
diff --git a/shared/typetracking/change-notes/released/0.2.10.md b/shared/typetracking/change-notes/released/0.2.10.md
deleted file mode 100644
index 81c9722b19f..00000000000
--- a/shared/typetracking/change-notes/released/0.2.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.10
-
-No user-facing changes.
diff --git a/shared/typetracking/codeql-pack.release.yml b/shared/typetracking/codeql-pack.release.yml
index a71167814cb..d021cf0a6be 100644
--- a/shared/typetracking/codeql-pack.release.yml
+++ b/shared/typetracking/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.10
+lastReleaseVersion: 0.2.9
diff --git a/shared/typetracking/qlpack.yml b/shared/typetracking/qlpack.yml
index fbbdcf5162a..b55927f59bb 100644
--- a/shared/typetracking/qlpack.yml
+++ b/shared/typetracking/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typetracking
-version: 0.2.10
+version: 0.2.10-dev
groups: shared
library: true
dependencies:
diff --git a/shared/typos/CHANGELOG.md b/shared/typos/CHANGELOG.md
index 54b1eaa4d58..66c5871d982 100644
--- a/shared/typos/CHANGELOG.md
+++ b/shared/typos/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.10
-
-No user-facing changes.
-
## 0.2.9
No user-facing changes.
diff --git a/shared/typos/change-notes/released/0.2.10.md b/shared/typos/change-notes/released/0.2.10.md
deleted file mode 100644
index 81c9722b19f..00000000000
--- a/shared/typos/change-notes/released/0.2.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.10
-
-No user-facing changes.
diff --git a/shared/typos/codeql-pack.release.yml b/shared/typos/codeql-pack.release.yml
index a71167814cb..d021cf0a6be 100644
--- a/shared/typos/codeql-pack.release.yml
+++ b/shared/typos/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.10
+lastReleaseVersion: 0.2.9
diff --git a/shared/typos/qlpack.yml b/shared/typos/qlpack.yml
index 4d59d9b3c34..644bfe11bff 100644
--- a/shared/typos/qlpack.yml
+++ b/shared/typos/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typos
-version: 0.2.10
+version: 0.2.10-dev
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/util/CHANGELOG.md b/shared/util/CHANGELOG.md
index 1ca1f71bcbc..63832e927fa 100644
--- a/shared/util/CHANGELOG.md
+++ b/shared/util/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.10
-
-No user-facing changes.
-
## 0.2.9
No user-facing changes.
diff --git a/shared/util/change-notes/released/0.2.10.md b/shared/util/change-notes/released/0.2.10.md
deleted file mode 100644
index 81c9722b19f..00000000000
--- a/shared/util/change-notes/released/0.2.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.10
-
-No user-facing changes.
diff --git a/shared/util/codeql-pack.release.yml b/shared/util/codeql-pack.release.yml
index a71167814cb..d021cf0a6be 100644
--- a/shared/util/codeql-pack.release.yml
+++ b/shared/util/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.10
+lastReleaseVersion: 0.2.9
diff --git a/shared/util/qlpack.yml b/shared/util/qlpack.yml
index 28ed738a93d..ca1a866a53d 100644
--- a/shared/util/qlpack.yml
+++ b/shared/util/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/util
-version: 0.2.10
+version: 0.2.10-dev
groups: shared
library: true
dependencies: null
diff --git a/shared/yaml/CHANGELOG.md b/shared/yaml/CHANGELOG.md
index 9fd5ebc26ab..e5495abcd50 100644
--- a/shared/yaml/CHANGELOG.md
+++ b/shared/yaml/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.10
-
-No user-facing changes.
-
## 0.2.9
No user-facing changes.
diff --git a/shared/yaml/change-notes/released/0.2.10.md b/shared/yaml/change-notes/released/0.2.10.md
deleted file mode 100644
index 81c9722b19f..00000000000
--- a/shared/yaml/change-notes/released/0.2.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.10
-
-No user-facing changes.
diff --git a/shared/yaml/codeql-pack.release.yml b/shared/yaml/codeql-pack.release.yml
index a71167814cb..d021cf0a6be 100644
--- a/shared/yaml/codeql-pack.release.yml
+++ b/shared/yaml/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.10
+lastReleaseVersion: 0.2.9
diff --git a/shared/yaml/qlpack.yml b/shared/yaml/qlpack.yml
index 9643ffcec66..de5b47e120a 100644
--- a/shared/yaml/qlpack.yml
+++ b/shared/yaml/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/yaml
-version: 0.2.10
+version: 0.2.10-dev
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/swift/ql/lib/CHANGELOG.md b/swift/ql/lib/CHANGELOG.md
index 8f14bfcedc9..e88cd0259cc 100644
--- a/swift/ql/lib/CHANGELOG.md
+++ b/swift/ql/lib/CHANGELOG.md
@@ -1,9 +1,3 @@
-## 0.3.10
-
-### Bug Fixes
-
-* Fixed an issue where `TypeDecl.getFullName` would get stuck in an loop and fail when minor database inconsistencies are present.
-
## 0.3.9
### Minor Analysis Improvements
diff --git a/swift/ql/lib/change-notes/released/0.3.10.md b/swift/ql/lib/change-notes/2024-02-22-extension-patch.md
similarity index 83%
rename from swift/ql/lib/change-notes/released/0.3.10.md
rename to swift/ql/lib/change-notes/2024-02-22-extension-patch.md
index 9d6286ff58a..7bd78f3b785 100644
--- a/swift/ql/lib/change-notes/released/0.3.10.md
+++ b/swift/ql/lib/change-notes/2024-02-22-extension-patch.md
@@ -1,5 +1,4 @@
-## 0.3.10
-
-### Bug Fixes
-
+---
+category: fix
+---
* Fixed an issue where `TypeDecl.getFullName` would get stuck in an loop and fail when minor database inconsistencies are present.
diff --git a/swift/ql/lib/codeql-pack.release.yml b/swift/ql/lib/codeql-pack.release.yml
index 76ca0ac8ba7..3fa5180bcb4 100644
--- a/swift/ql/lib/codeql-pack.release.yml
+++ b/swift/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.3.10
+lastReleaseVersion: 0.3.9
diff --git a/swift/ql/lib/qlpack.yml b/swift/ql/lib/qlpack.yml
index 70ec4798ea8..a37a4cb3d58 100644
--- a/swift/ql/lib/qlpack.yml
+++ b/swift/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-all
-version: 0.3.10
+version: 0.3.10-dev
groups: swift
extractor: swift
dbscheme: swift.dbscheme
diff --git a/swift/ql/src/CHANGELOG.md b/swift/ql/src/CHANGELOG.md
index bda9834c9bc..96615d06972 100644
--- a/swift/ql/src/CHANGELOG.md
+++ b/swift/ql/src/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.3.10
-
-No user-facing changes.
-
## 0.3.9
### New Queries
diff --git a/swift/ql/src/change-notes/released/0.3.10.md b/swift/ql/src/change-notes/released/0.3.10.md
deleted file mode 100644
index 925a48fc52e..00000000000
--- a/swift/ql/src/change-notes/released/0.3.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.3.10
-
-No user-facing changes.
diff --git a/swift/ql/src/codeql-pack.release.yml b/swift/ql/src/codeql-pack.release.yml
index 76ca0ac8ba7..3fa5180bcb4 100644
--- a/swift/ql/src/codeql-pack.release.yml
+++ b/swift/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.3.10
+lastReleaseVersion: 0.3.9
diff --git a/swift/ql/src/qlpack.yml b/swift/ql/src/qlpack.yml
index ba66b065529..e3ead42c98b 100644
--- a/swift/ql/src/qlpack.yml
+++ b/swift/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-queries
-version: 0.3.10
+version: 0.3.10-dev
groups:
- swift
- queries
From 661e68dab5ee8d71edcec82139314a481dd983d5 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
Date: Tue, 5 Mar 2024 18:13:58 +0000
Subject: [PATCH 036/309] Release preparation for version 2.16.4
---
cpp/ql/lib/CHANGELOG.md | 6 ++++++
.../0.12.7.md} | 9 +++++----
cpp/ql/lib/codeql-pack.release.yml | 2 +-
cpp/ql/lib/qlpack.yml | 2 +-
cpp/ql/src/CHANGELOG.md | 7 +++++++
.../2024-02-29-non-constant-format-path-query.md | 4 ----
.../0.9.6.md} | 8 +++++---
cpp/ql/src/codeql-pack.release.yml | 2 +-
cpp/ql/src/qlpack.yml | 2 +-
csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md | 4 ++++
.../Solorigate/lib/change-notes/released/1.7.10.md | 3 +++
.../Solorigate/lib/codeql-pack.release.yml | 2 +-
csharp/ql/campaigns/Solorigate/lib/qlpack.yml | 2 +-
csharp/ql/campaigns/Solorigate/src/CHANGELOG.md | 4 ++++
.../Solorigate/src/change-notes/released/1.7.10.md | 3 +++
.../Solorigate/src/codeql-pack.release.yml | 2 +-
csharp/ql/campaigns/Solorigate/src/qlpack.yml | 2 +-
csharp/ql/lib/CHANGELOG.md | 14 ++++++++++++++
.../change-notes/2024-02-21-getonly-properties.md | 4 ----
.../ql/lib/change-notes/2024-02-22-no-db-stats.md | 4 ----
.../change-notes/2024-02-23-compiler-generated.md | 4 ----
.../2024-02-26-variable-capture-flow.md | 4 ----
.../2024-02-28-experimental-attribute.md | 4 ----
.../2024-02-28-refreadonly-parameter.md | 4 ----
csharp/ql/lib/change-notes/released/0.8.10.md | 13 +++++++++++++
csharp/ql/lib/codeql-pack.release.yml | 2 +-
csharp/ql/lib/qlpack.yml | 2 +-
csharp/ql/src/CHANGELOG.md | 6 ++++++
.../0.8.10.md} | 9 +++++----
csharp/ql/src/codeql-pack.release.yml | 2 +-
csharp/ql/src/qlpack.yml | 2 +-
go/ql/consistency-queries/CHANGELOG.md | 4 ++++
.../change-notes/released/0.0.9.md | 3 +++
go/ql/consistency-queries/codeql-pack.release.yml | 2 +-
go/ql/consistency-queries/qlpack.yml | 2 +-
go/ql/lib/CHANGELOG.md | 11 +++++++++++
.../lib/change-notes/2024-02-14-range-map-read.md | 4 ----
.../0.7.10.md} | 11 ++++++++---
go/ql/lib/codeql-pack.release.yml | 2 +-
go/ql/lib/qlpack.yml | 2 +-
go/ql/src/CHANGELOG.md | 4 ++++
go/ql/src/change-notes/released/0.7.10.md | 3 +++
go/ql/src/codeql-pack.release.yml | 2 +-
go/ql/src/qlpack.yml | 2 +-
java/ql/automodel/src/CHANGELOG.md | 4 ++++
.../automodel/src/change-notes/released/0.0.17.md | 3 +++
java/ql/automodel/src/codeql-pack.release.yml | 2 +-
java/ql/automodel/src/qlpack.yml | 2 +-
java/ql/lib/CHANGELOG.md | 11 +++++++++++
.../change-notes/2024-02-23-widget-flowsteps.md | 4 ----
java/ql/lib/change-notes/2024-02-27-error-types.md | 4 ----
.../lib/change-notes/2024-02-27-mvnw-versions.md | 4 ----
java/ql/lib/change-notes/released/0.8.10.md | 10 ++++++++++
java/ql/lib/codeql-pack.release.yml | 2 +-
java/ql/lib/qlpack.yml | 2 +-
java/ql/src/CHANGELOG.md | 10 ++++++++++
.../2024-02-12-android-insecure-keys.md | 4 ----
.../0.8.10.md} | 11 ++++++++---
java/ql/src/codeql-pack.release.yml | 2 +-
java/ql/src/qlpack.yml | 2 +-
javascript/ql/lib/CHANGELOG.md | 4 ++++
javascript/ql/lib/change-notes/released/0.8.10.md | 3 +++
javascript/ql/lib/codeql-pack.release.yml | 2 +-
javascript/ql/lib/qlpack.yml | 2 +-
javascript/ql/src/CHANGELOG.md | 4 ++++
javascript/ql/src/change-notes/released/0.8.10.md | 3 +++
javascript/ql/src/codeql-pack.release.yml | 2 +-
javascript/ql/src/qlpack.yml | 2 +-
misc/suite-helpers/CHANGELOG.md | 4 ++++
misc/suite-helpers/change-notes/released/0.7.10.md | 3 +++
misc/suite-helpers/codeql-pack.release.yml | 2 +-
misc/suite-helpers/qlpack.yml | 2 +-
python/ql/lib/CHANGELOG.md | 7 +++++++
.../2024-02-28-iterable-unpacking-module-scope.md | 4 ----
.../0.11.10.md} | 8 +++++---
python/ql/lib/codeql-pack.release.yml | 2 +-
python/ql/lib/qlpack.yml | 2 +-
python/ql/src/CHANGELOG.md | 6 ++++++
.../0.9.10.md} | 7 ++++---
python/ql/src/codeql-pack.release.yml | 2 +-
python/ql/src/qlpack.yml | 2 +-
ruby/ql/lib/CHANGELOG.md | 9 +++++++++
...2024-02-15-activerecord_connection_sql_sinks.md | 4 ----
.../2024-02-20-activerecord-sql-sink-arguments.md | 4 ----
.../lib/change-notes/2024-02-26-arel-sqlliteral.md | 4 ----
.../lib/change-notes/2024-02-29-i18n-translate.md | 4 ----
ruby/ql/lib/change-notes/released/0.8.10.md | 8 ++++++++
ruby/ql/lib/codeql-pack.release.yml | 2 +-
ruby/ql/lib/qlpack.yml | 2 +-
ruby/ql/src/CHANGELOG.md | 7 +++++++
.../2024-02-13-rails-more-request-sources.md | 4 ----
.../0.8.10.md} | 10 ++++++----
ruby/ql/src/codeql-pack.release.yml | 2 +-
ruby/ql/src/qlpack.yml | 2 +-
shared/controlflow/CHANGELOG.md | 4 ++++
shared/controlflow/change-notes/released/0.1.10.md | 3 +++
shared/controlflow/codeql-pack.release.yml | 2 +-
shared/controlflow/qlpack.yml | 2 +-
shared/dataflow/CHANGELOG.md | 4 ++++
shared/dataflow/change-notes/released/0.2.1.md | 3 +++
shared/dataflow/codeql-pack.release.yml | 2 +-
shared/dataflow/qlpack.yml | 2 +-
shared/mad/CHANGELOG.md | 4 ++++
shared/mad/change-notes/released/0.2.10.md | 3 +++
shared/mad/codeql-pack.release.yml | 2 +-
shared/mad/qlpack.yml | 2 +-
shared/rangeanalysis/CHANGELOG.md | 4 ++++
.../rangeanalysis/change-notes/released/0.0.9.md | 3 +++
shared/rangeanalysis/codeql-pack.release.yml | 2 +-
shared/rangeanalysis/qlpack.yml | 2 +-
shared/regex/CHANGELOG.md | 4 ++++
shared/regex/change-notes/released/0.2.10.md | 3 +++
shared/regex/codeql-pack.release.yml | 2 +-
shared/regex/qlpack.yml | 2 +-
shared/ssa/CHANGELOG.md | 4 ++++
shared/ssa/change-notes/released/0.2.10.md | 3 +++
shared/ssa/codeql-pack.release.yml | 2 +-
shared/ssa/qlpack.yml | 2 +-
shared/threat-models/CHANGELOG.md | 4 ++++
.../threat-models/change-notes/released/0.0.9.md | 3 +++
shared/threat-models/codeql-pack.release.yml | 2 +-
shared/threat-models/qlpack.yml | 2 +-
shared/tutorial/CHANGELOG.md | 4 ++++
shared/tutorial/change-notes/released/0.2.10.md | 3 +++
shared/tutorial/codeql-pack.release.yml | 2 +-
shared/tutorial/qlpack.yml | 2 +-
shared/typetracking/CHANGELOG.md | 4 ++++
.../typetracking/change-notes/released/0.2.10.md | 3 +++
shared/typetracking/codeql-pack.release.yml | 2 +-
shared/typetracking/qlpack.yml | 2 +-
shared/typos/CHANGELOG.md | 4 ++++
shared/typos/change-notes/released/0.2.10.md | 3 +++
shared/typos/codeql-pack.release.yml | 2 +-
shared/typos/qlpack.yml | 2 +-
shared/util/CHANGELOG.md | 4 ++++
shared/util/change-notes/released/0.2.10.md | 3 +++
shared/util/codeql-pack.release.yml | 2 +-
shared/util/qlpack.yml | 2 +-
shared/yaml/CHANGELOG.md | 4 ++++
shared/yaml/change-notes/released/0.2.10.md | 3 +++
shared/yaml/codeql-pack.release.yml | 2 +-
shared/yaml/qlpack.yml | 2 +-
swift/ql/lib/CHANGELOG.md | 6 ++++++
.../0.3.10.md} | 7 ++++---
swift/ql/lib/codeql-pack.release.yml | 2 +-
swift/ql/lib/qlpack.yml | 2 +-
swift/ql/src/CHANGELOG.md | 4 ++++
swift/ql/src/change-notes/released/0.3.10.md | 3 +++
swift/ql/src/codeql-pack.release.yml | 2 +-
swift/ql/src/qlpack.yml | 2 +-
150 files changed, 394 insertions(+), 168 deletions(-)
rename cpp/ql/lib/change-notes/{2024-02-26-ir-named-destructors.md => released/0.12.7.md} (54%)
delete mode 100644 cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md
rename cpp/ql/src/change-notes/{2024-02-16-modelled-functions-block-flow.md => released/0.9.6.md} (77%)
create mode 100644 csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md
create mode 100644 csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md
create mode 100644 csharp/ql/lib/change-notes/released/0.8.10.md
rename csharp/ql/src/change-notes/{2024-02-06-threat-models.md => released/0.8.10.md} (88%)
create mode 100644 go/ql/consistency-queries/change-notes/released/0.0.9.md
delete mode 100644 go/ql/lib/change-notes/2024-02-14-range-map-read.md
rename go/ql/lib/change-notes/{2024-03-04-autobuilder-changes.md => released/0.7.10.md} (68%)
create mode 100644 go/ql/src/change-notes/released/0.7.10.md
create mode 100644 java/ql/automodel/src/change-notes/released/0.0.17.md
delete mode 100644 java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md
delete mode 100644 java/ql/lib/change-notes/2024-02-27-error-types.md
delete mode 100644 java/ql/lib/change-notes/2024-02-27-mvnw-versions.md
create mode 100644 java/ql/lib/change-notes/released/0.8.10.md
delete mode 100644 java/ql/src/change-notes/2024-02-12-android-insecure-keys.md
rename java/ql/src/change-notes/{2024-03-04-sensitive-log-remove-null-from-sources.md => released/0.8.10.md} (54%)
create mode 100644 javascript/ql/lib/change-notes/released/0.8.10.md
create mode 100644 javascript/ql/src/change-notes/released/0.8.10.md
create mode 100644 misc/suite-helpers/change-notes/released/0.7.10.md
delete mode 100644 python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md
rename python/ql/lib/change-notes/{2024-03-01-dict-update-content.md => released/0.11.10.md} (52%)
rename python/ql/src/change-notes/{2024-03-04-nosql-injection.md => released/0.9.10.md} (81%)
delete mode 100644 ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md
delete mode 100644 ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md
delete mode 100644 ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
delete mode 100644 ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
create mode 100644 ruby/ql/lib/change-notes/released/0.8.10.md
delete mode 100644 ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md
rename ruby/ql/src/change-notes/{2024-03-01-method-code-injection-sinks.md => released/0.8.10.md} (51%)
create mode 100644 shared/controlflow/change-notes/released/0.1.10.md
create mode 100644 shared/dataflow/change-notes/released/0.2.1.md
create mode 100644 shared/mad/change-notes/released/0.2.10.md
create mode 100644 shared/rangeanalysis/change-notes/released/0.0.9.md
create mode 100644 shared/regex/change-notes/released/0.2.10.md
create mode 100644 shared/ssa/change-notes/released/0.2.10.md
create mode 100644 shared/threat-models/change-notes/released/0.0.9.md
create mode 100644 shared/tutorial/change-notes/released/0.2.10.md
create mode 100644 shared/typetracking/change-notes/released/0.2.10.md
create mode 100644 shared/typos/change-notes/released/0.2.10.md
create mode 100644 shared/util/change-notes/released/0.2.10.md
create mode 100644 shared/yaml/change-notes/released/0.2.10.md
rename swift/ql/lib/change-notes/{2024-02-22-extension-patch.md => released/0.3.10.md} (83%)
create mode 100644 swift/ql/src/change-notes/released/0.3.10.md
diff --git a/cpp/ql/lib/CHANGELOG.md b/cpp/ql/lib/CHANGELOG.md
index b3091ec37d8..e1c0dfbecd9 100644
--- a/cpp/ql/lib/CHANGELOG.md
+++ b/cpp/ql/lib/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 0.12.7
+
+### Minor Analysis Improvements
+
+* Added destructors for named objects to the intermediate representation.
+
## 0.12.6
### New Features
diff --git a/cpp/ql/lib/change-notes/2024-02-26-ir-named-destructors.md b/cpp/ql/lib/change-notes/released/0.12.7.md
similarity index 54%
rename from cpp/ql/lib/change-notes/2024-02-26-ir-named-destructors.md
rename to cpp/ql/lib/change-notes/released/0.12.7.md
index 4e35decaf8e..856a8b665c7 100644
--- a/cpp/ql/lib/change-notes/2024-02-26-ir-named-destructors.md
+++ b/cpp/ql/lib/change-notes/released/0.12.7.md
@@ -1,4 +1,5 @@
----
-category: minorAnalysis
----
-* Added destructors for named objects to the intermediate representation.
\ No newline at end of file
+## 0.12.7
+
+### Minor Analysis Improvements
+
+* Added destructors for named objects to the intermediate representation.
diff --git a/cpp/ql/lib/codeql-pack.release.yml b/cpp/ql/lib/codeql-pack.release.yml
index 170a312c104..20419e9c610 100644
--- a/cpp/ql/lib/codeql-pack.release.yml
+++ b/cpp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.12.6
+lastReleaseVersion: 0.12.7
diff --git a/cpp/ql/lib/qlpack.yml b/cpp/ql/lib/qlpack.yml
index 8e201fff594..3bb9229bf94 100644
--- a/cpp/ql/lib/qlpack.yml
+++ b/cpp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-all
-version: 0.12.7-dev
+version: 0.12.7
groups: cpp
dbscheme: semmlecode.cpp.dbscheme
extractor: cpp
diff --git a/cpp/ql/src/CHANGELOG.md b/cpp/ql/src/CHANGELOG.md
index ffcd73ff5d7..f6acd424bb0 100644
--- a/cpp/ql/src/CHANGELOG.md
+++ b/cpp/ql/src/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 0.9.6
+
+### Minor Analysis Improvements
+
+* The "non-constant format string" query (`cpp/non-constant-format`) has been converted to a `path-problem` query.
+* The new C/C++ dataflow and taint-tracking libraries (`semmle.code.cpp.dataflow.new.DataFlow` and `semmle.code.cpp.dataflow.new.TaintTracking`) now implicitly assume that dataflow and taint modelled via `DataFlowFunction` and `TaintFunction` always fully overwrite their buffers and thus act as flow barriers. As a result, many dataflow and taint-tracking queries now produce fewer false positives. To remove this assumption and go back to the previous behavior for a given model, one can override the new `isPartialWrite` predicate.
+
## 0.9.5
### Minor Analysis Improvements
diff --git a/cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md b/cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md
deleted file mode 100644
index 2e5933a61e8..00000000000
--- a/cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The "non-constant format string" query (`cpp/non-constant-format`) has been converted to a `path-problem` query.
\ No newline at end of file
diff --git a/cpp/ql/src/change-notes/2024-02-16-modelled-functions-block-flow.md b/cpp/ql/src/change-notes/released/0.9.6.md
similarity index 77%
rename from cpp/ql/src/change-notes/2024-02-16-modelled-functions-block-flow.md
rename to cpp/ql/src/change-notes/released/0.9.6.md
index d6ef3c3e056..0c85f3f9f0f 100644
--- a/cpp/ql/src/change-notes/2024-02-16-modelled-functions-block-flow.md
+++ b/cpp/ql/src/change-notes/released/0.9.6.md
@@ -1,4 +1,6 @@
----
-category: minorAnalysis
----
+## 0.9.6
+
+### Minor Analysis Improvements
+
+* The "non-constant format string" query (`cpp/non-constant-format`) has been converted to a `path-problem` query.
* The new C/C++ dataflow and taint-tracking libraries (`semmle.code.cpp.dataflow.new.DataFlow` and `semmle.code.cpp.dataflow.new.TaintTracking`) now implicitly assume that dataflow and taint modelled via `DataFlowFunction` and `TaintFunction` always fully overwrite their buffers and thus act as flow barriers. As a result, many dataflow and taint-tracking queries now produce fewer false positives. To remove this assumption and go back to the previous behavior for a given model, one can override the new `isPartialWrite` predicate.
diff --git a/cpp/ql/src/codeql-pack.release.yml b/cpp/ql/src/codeql-pack.release.yml
index 460240feaff..19139c132b2 100644
--- a/cpp/ql/src/codeql-pack.release.yml
+++ b/cpp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.9.5
+lastReleaseVersion: 0.9.6
diff --git a/cpp/ql/src/qlpack.yml b/cpp/ql/src/qlpack.yml
index 31bd20166b2..4052647bb97 100644
--- a/cpp/ql/src/qlpack.yml
+++ b/cpp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-queries
-version: 0.9.6-dev
+version: 0.9.6
groups:
- cpp
- queries
diff --git a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
index 190b83b0f25..82eacfc84f7 100644
--- a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
+++ b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.7.10
+
+No user-facing changes.
+
## 1.7.9
No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md
new file mode 100644
index 00000000000..8e8007d8475
--- /dev/null
+++ b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md
@@ -0,0 +1,3 @@
+## 1.7.10
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
index 678da6bc37e..31c7fe07020 100644
--- a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.7.9
+lastReleaseVersion: 1.7.10
diff --git a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
index 7e643b0fac3..ee993bed0c9 100644
--- a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-all
-version: 1.7.10-dev
+version: 1.7.10
groups:
- csharp
- solorigate
diff --git a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
index 190b83b0f25..82eacfc84f7 100644
--- a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
+++ b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.7.10
+
+No user-facing changes.
+
## 1.7.9
No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md
new file mode 100644
index 00000000000..8e8007d8475
--- /dev/null
+++ b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md
@@ -0,0 +1,3 @@
+## 1.7.10
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
index 678da6bc37e..31c7fe07020 100644
--- a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
+++ b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.7.9
+lastReleaseVersion: 1.7.10
diff --git a/csharp/ql/campaigns/Solorigate/src/qlpack.yml b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
index 8654bbfd031..1f421754fc8 100644
--- a/csharp/ql/campaigns/Solorigate/src/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-queries
-version: 1.7.10-dev
+version: 1.7.10
groups:
- csharp
- solorigate
diff --git a/csharp/ql/lib/CHANGELOG.md b/csharp/ql/lib/CHANGELOG.md
index 95fd64c5270..16cc14259e1 100644
--- a/csharp/ql/lib/CHANGELOG.md
+++ b/csharp/ql/lib/CHANGELOG.md
@@ -1,3 +1,17 @@
+## 0.8.10
+
+### Major Analysis Improvements
+
+* Improved support for flow through captured variables that properly adheres to inter-procedural control flow.
+* We no longer make use of CodeQL database stats, which may affect join-orders in custom queries. It is therefore recommended to test performance of custom queries after upgrading to this version.
+
+### Minor Analysis Improvements
+
+* C# 12: Add QL library support (`ExperimentalAttribute`) for the experimental attribute.
+* C# 12: Add extractor and QL library support for `ref readonly` parameters.
+* C#: The table `expr_compiler_generated` has been deleted and its content has been added to `compiler_generated`.
+* Data flow via get only properties like `public object Obj { get; }` is now captured by the data flow library.
+
## 0.8.9
### Minor Analysis Improvements
diff --git a/csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md b/csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md
deleted file mode 100644
index 6bb8e99c71e..00000000000
--- a/csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Data flow via get only properties like `public object Obj { get; }` is now captured by the data flow library.
diff --git a/csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md b/csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md
deleted file mode 100644
index d6ffbd523ac..00000000000
--- a/csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: majorAnalysis
----
-* We no longer make use of CodeQL database stats, which may affect join-orders in custom queries. It is therefore recommended to test performance of custom queries after upgrading to this version.
diff --git a/csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md b/csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md
deleted file mode 100644
index 9b1739b9b6d..00000000000
--- a/csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* C#: The table `expr_compiler_generated` has been deleted and its content has been added to `compiler_generated`.
diff --git a/csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md b/csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md
deleted file mode 100644
index 66ab65083dc..00000000000
--- a/csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: majorAnalysis
----
-* Improved support for flow through captured variables that properly adheres to inter-procedural control flow.
\ No newline at end of file
diff --git a/csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md b/csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md
deleted file mode 100644
index 8749c790954..00000000000
--- a/csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* C# 12: Add QL library support (`ExperimentalAttribute`) for the experimental attribute.
diff --git a/csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md b/csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md
deleted file mode 100644
index 586b5341d29..00000000000
--- a/csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* C# 12: Add extractor and QL library support for `ref readonly` parameters.
diff --git a/csharp/ql/lib/change-notes/released/0.8.10.md b/csharp/ql/lib/change-notes/released/0.8.10.md
new file mode 100644
index 00000000000..f591ddc5b21
--- /dev/null
+++ b/csharp/ql/lib/change-notes/released/0.8.10.md
@@ -0,0 +1,13 @@
+## 0.8.10
+
+### Major Analysis Improvements
+
+* Improved support for flow through captured variables that properly adheres to inter-procedural control flow.
+* We no longer make use of CodeQL database stats, which may affect join-orders in custom queries. It is therefore recommended to test performance of custom queries after upgrading to this version.
+
+### Minor Analysis Improvements
+
+* C# 12: Add QL library support (`ExperimentalAttribute`) for the experimental attribute.
+* C# 12: Add extractor and QL library support for `ref readonly` parameters.
+* C#: The table `expr_compiler_generated` has been deleted and its content has been added to `compiler_generated`.
+* Data flow via get only properties like `public object Obj { get; }` is now captured by the data flow library.
diff --git a/csharp/ql/lib/codeql-pack.release.yml b/csharp/ql/lib/codeql-pack.release.yml
index 5290c29b7fe..0521f0f75fa 100644
--- a/csharp/ql/lib/codeql-pack.release.yml
+++ b/csharp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/csharp/ql/lib/qlpack.yml b/csharp/ql/lib/qlpack.yml
index d75ea3c6320..93c5c1120a2 100644
--- a/csharp/ql/lib/qlpack.yml
+++ b/csharp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-all
-version: 0.8.10-dev
+version: 0.8.10
groups: csharp
dbscheme: semmlecode.csharp.dbscheme
extractor: csharp
diff --git a/csharp/ql/src/CHANGELOG.md b/csharp/ql/src/CHANGELOG.md
index 9fe1609363f..46c939e5cee 100644
--- a/csharp/ql/src/CHANGELOG.md
+++ b/csharp/ql/src/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. The changed queries are `cs/code-injection`, `cs/command-line-injection`, `cs/user-controlled-bypass`, `cs/count-untrusted-data-external-api`, `cs/untrusted-data-to-external-api`, `cs/ldap-injection`, `cs/log-forging`, `cs/xml/missing-validation`, `cs/redos`, `cs/regex-injection`, `cs/resource-injection`, `cs/sql-injection`, `cs/path-injection`, `cs/unsafe-deserialization-untrusted-input`, `cs/web/unvalidated-url-redirection`, `cs/xml/insecure-dtd-handling`, `cs/xml/xpath-injection`, `cs/web/xss`, and `cs/uncontrolled-format-string`.
+
## 0.8.9
### Minor Analysis Improvements
diff --git a/csharp/ql/src/change-notes/2024-02-06-threat-models.md b/csharp/ql/src/change-notes/released/0.8.10.md
similarity index 88%
rename from csharp/ql/src/change-notes/2024-02-06-threat-models.md
rename to csharp/ql/src/change-notes/released/0.8.10.md
index 69ac4e4dc17..702161c3d28 100644
--- a/csharp/ql/src/change-notes/2024-02-06-threat-models.md
+++ b/csharp/ql/src/change-notes/released/0.8.10.md
@@ -1,4 +1,5 @@
----
-category: minorAnalysis
----
-* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. The changed queries are `cs/code-injection`, `cs/command-line-injection`, `cs/user-controlled-bypass`, `cs/count-untrusted-data-external-api`, `cs/untrusted-data-to-external-api`, `cs/ldap-injection`, `cs/log-forging`, `cs/xml/missing-validation`, `cs/redos`, `cs/regex-injection`, `cs/resource-injection`, `cs/sql-injection`, `cs/path-injection`, `cs/unsafe-deserialization-untrusted-input`, `cs/web/unvalidated-url-redirection`, `cs/xml/insecure-dtd-handling`, `cs/xml/xpath-injection`, `cs/web/xss`, and `cs/uncontrolled-format-string`.
\ No newline at end of file
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. The changed queries are `cs/code-injection`, `cs/command-line-injection`, `cs/user-controlled-bypass`, `cs/count-untrusted-data-external-api`, `cs/untrusted-data-to-external-api`, `cs/ldap-injection`, `cs/log-forging`, `cs/xml/missing-validation`, `cs/redos`, `cs/regex-injection`, `cs/resource-injection`, `cs/sql-injection`, `cs/path-injection`, `cs/unsafe-deserialization-untrusted-input`, `cs/web/unvalidated-url-redirection`, `cs/xml/insecure-dtd-handling`, `cs/xml/xpath-injection`, `cs/web/xss`, and `cs/uncontrolled-format-string`.
diff --git a/csharp/ql/src/codeql-pack.release.yml b/csharp/ql/src/codeql-pack.release.yml
index 5290c29b7fe..0521f0f75fa 100644
--- a/csharp/ql/src/codeql-pack.release.yml
+++ b/csharp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/csharp/ql/src/qlpack.yml b/csharp/ql/src/qlpack.yml
index 9ee23cc7307..46384094b19 100644
--- a/csharp/ql/src/qlpack.yml
+++ b/csharp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-queries
-version: 0.8.10-dev
+version: 0.8.10
groups:
- csharp
- queries
diff --git a/go/ql/consistency-queries/CHANGELOG.md b/go/ql/consistency-queries/CHANGELOG.md
index fba2a870356..a59e560c415 100644
--- a/go/ql/consistency-queries/CHANGELOG.md
+++ b/go/ql/consistency-queries/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.0.9
+
+No user-facing changes.
+
## 0.0.8
No user-facing changes.
diff --git a/go/ql/consistency-queries/change-notes/released/0.0.9.md b/go/ql/consistency-queries/change-notes/released/0.0.9.md
new file mode 100644
index 00000000000..c9e17c6d6cf
--- /dev/null
+++ b/go/ql/consistency-queries/change-notes/released/0.0.9.md
@@ -0,0 +1,3 @@
+## 0.0.9
+
+No user-facing changes.
diff --git a/go/ql/consistency-queries/codeql-pack.release.yml b/go/ql/consistency-queries/codeql-pack.release.yml
index 58fdc6b45de..ecdd64fbab8 100644
--- a/go/ql/consistency-queries/codeql-pack.release.yml
+++ b/go/ql/consistency-queries/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.8
+lastReleaseVersion: 0.0.9
diff --git a/go/ql/consistency-queries/qlpack.yml b/go/ql/consistency-queries/qlpack.yml
index b574796b995..d5a2fbee5f1 100644
--- a/go/ql/consistency-queries/qlpack.yml
+++ b/go/ql/consistency-queries/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql-go-consistency-queries
-version: 0.0.9-dev
+version: 0.0.9
groups:
- go
- queries
diff --git a/go/ql/lib/CHANGELOG.md b/go/ql/lib/CHANGELOG.md
index 65a2376217b..fee5fd37a26 100644
--- a/go/ql/lib/CHANGELOG.md
+++ b/go/ql/lib/CHANGELOG.md
@@ -1,3 +1,14 @@
+## 0.7.10
+
+### Major Analysis Improvements
+
+* We have significantly improved the Go autobuilder to understand a greater range of project layouts, which allows Go source files to be analysed that could previously not be processed.
+* Go 1.22 has been included in the range of supported Go versions.
+
+### Bug Fixes
+
+* Fixed dataflow out of a `map` using a `range` statement.
+
## 0.7.9
No user-facing changes.
diff --git a/go/ql/lib/change-notes/2024-02-14-range-map-read.md b/go/ql/lib/change-notes/2024-02-14-range-map-read.md
deleted file mode 100644
index ea45737a72e..00000000000
--- a/go/ql/lib/change-notes/2024-02-14-range-map-read.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: fix
----
-* Fixed dataflow out of a `map` using a `range` statement.
diff --git a/go/ql/lib/change-notes/2024-03-04-autobuilder-changes.md b/go/ql/lib/change-notes/released/0.7.10.md
similarity index 68%
rename from go/ql/lib/change-notes/2024-03-04-autobuilder-changes.md
rename to go/ql/lib/change-notes/released/0.7.10.md
index 0442a571029..55954f8a394 100644
--- a/go/ql/lib/change-notes/2024-03-04-autobuilder-changes.md
+++ b/go/ql/lib/change-notes/released/0.7.10.md
@@ -1,5 +1,10 @@
----
-category: majorAnalysis
----
+## 0.7.10
+
+### Major Analysis Improvements
+
* We have significantly improved the Go autobuilder to understand a greater range of project layouts, which allows Go source files to be analysed that could previously not be processed.
* Go 1.22 has been included in the range of supported Go versions.
+
+### Bug Fixes
+
+* Fixed dataflow out of a `map` using a `range` statement.
diff --git a/go/ql/lib/codeql-pack.release.yml b/go/ql/lib/codeql-pack.release.yml
index 576395f3405..67518567297 100644
--- a/go/ql/lib/codeql-pack.release.yml
+++ b/go/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.7.9
+lastReleaseVersion: 0.7.10
diff --git a/go/ql/lib/qlpack.yml b/go/ql/lib/qlpack.yml
index f21e478efa6..8cc190fa880 100644
--- a/go/ql/lib/qlpack.yml
+++ b/go/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-all
-version: 0.7.10-dev
+version: 0.7.10
groups: go
dbscheme: go.dbscheme
extractor: go
diff --git a/go/ql/src/CHANGELOG.md b/go/ql/src/CHANGELOG.md
index d95165a3a34..24e38b9890e 100644
--- a/go/ql/src/CHANGELOG.md
+++ b/go/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.7.10
+
+No user-facing changes.
+
## 0.7.9
### New Queries
diff --git a/go/ql/src/change-notes/released/0.7.10.md b/go/ql/src/change-notes/released/0.7.10.md
new file mode 100644
index 00000000000..989c5b8f682
--- /dev/null
+++ b/go/ql/src/change-notes/released/0.7.10.md
@@ -0,0 +1,3 @@
+## 0.7.10
+
+No user-facing changes.
diff --git a/go/ql/src/codeql-pack.release.yml b/go/ql/src/codeql-pack.release.yml
index 576395f3405..67518567297 100644
--- a/go/ql/src/codeql-pack.release.yml
+++ b/go/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.7.9
+lastReleaseVersion: 0.7.10
diff --git a/go/ql/src/qlpack.yml b/go/ql/src/qlpack.yml
index d91cab59612..4ded3a52f63 100644
--- a/go/ql/src/qlpack.yml
+++ b/go/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-queries
-version: 0.7.10-dev
+version: 0.7.10
groups:
- go
- queries
diff --git a/java/ql/automodel/src/CHANGELOG.md b/java/ql/automodel/src/CHANGELOG.md
index 4a3c54adb38..c3282c773a9 100644
--- a/java/ql/automodel/src/CHANGELOG.md
+++ b/java/ql/automodel/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.0.17
+
+No user-facing changes.
+
## 0.0.16
No user-facing changes.
diff --git a/java/ql/automodel/src/change-notes/released/0.0.17.md b/java/ql/automodel/src/change-notes/released/0.0.17.md
new file mode 100644
index 00000000000..62cc89030a6
--- /dev/null
+++ b/java/ql/automodel/src/change-notes/released/0.0.17.md
@@ -0,0 +1,3 @@
+## 0.0.17
+
+No user-facing changes.
diff --git a/java/ql/automodel/src/codeql-pack.release.yml b/java/ql/automodel/src/codeql-pack.release.yml
index a49f7be4cff..cbc3d3cd493 100644
--- a/java/ql/automodel/src/codeql-pack.release.yml
+++ b/java/ql/automodel/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.16
+lastReleaseVersion: 0.0.17
diff --git a/java/ql/automodel/src/qlpack.yml b/java/ql/automodel/src/qlpack.yml
index 898239be098..59fab0cdcc5 100644
--- a/java/ql/automodel/src/qlpack.yml
+++ b/java/ql/automodel/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-automodel-queries
-version: 0.0.17-dev
+version: 0.0.17
groups:
- java
- automodel
diff --git a/java/ql/lib/CHANGELOG.md b/java/ql/lib/CHANGELOG.md
index d369cbdc931..2a02ccee6ab 100644
--- a/java/ql/lib/CHANGELOG.md
+++ b/java/ql/lib/CHANGELOG.md
@@ -1,3 +1,14 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Java expressions with erroneous types (e.g. the result of a call whose callee couldn't be resolved during extraction) are now given a CodeQL `ErrorType` more often.
+
+### Bug Fixes
+
+* Fixed the Java autobuilder overriding the version of Maven used by a project when the Maven wrapper `mvnw` is in use and the `maven-wrapper.jar` file is not present in the repository.
+* Some flow steps related to `android.text.Editable.toString` that were accidentally disabled have been re-enabled.
+
## 0.8.9
### Deprecated APIs
diff --git a/java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md b/java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md
deleted file mode 100644
index eb560fba07d..00000000000
--- a/java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: fix
----
-* Some flow steps related to `android.text.Editable.toString` that were accidentally disabled have been re-enabled.
diff --git a/java/ql/lib/change-notes/2024-02-27-error-types.md b/java/ql/lib/change-notes/2024-02-27-error-types.md
deleted file mode 100644
index cdc6d7620aa..00000000000
--- a/java/ql/lib/change-notes/2024-02-27-error-types.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Java expressions with erroneous types (e.g. the result of a call whose callee couldn't be resolved during extraction) are now given a CodeQL `ErrorType` more often.
diff --git a/java/ql/lib/change-notes/2024-02-27-mvnw-versions.md b/java/ql/lib/change-notes/2024-02-27-mvnw-versions.md
deleted file mode 100644
index a0227088ae9..00000000000
--- a/java/ql/lib/change-notes/2024-02-27-mvnw-versions.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: fix
----
-* Fixed the Java autobuilder overriding the version of Maven used by a project when the Maven wrapper `mvnw` is in use and the `maven-wrapper.jar` file is not present in the repository.
diff --git a/java/ql/lib/change-notes/released/0.8.10.md b/java/ql/lib/change-notes/released/0.8.10.md
new file mode 100644
index 00000000000..b45f14bf347
--- /dev/null
+++ b/java/ql/lib/change-notes/released/0.8.10.md
@@ -0,0 +1,10 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Java expressions with erroneous types (e.g. the result of a call whose callee couldn't be resolved during extraction) are now given a CodeQL `ErrorType` more often.
+
+### Bug Fixes
+
+* Fixed the Java autobuilder overriding the version of Maven used by a project when the Maven wrapper `mvnw` is in use and the `maven-wrapper.jar` file is not present in the repository.
+* Some flow steps related to `android.text.Editable.toString` that were accidentally disabled have been re-enabled.
diff --git a/java/ql/lib/codeql-pack.release.yml b/java/ql/lib/codeql-pack.release.yml
index 5290c29b7fe..0521f0f75fa 100644
--- a/java/ql/lib/codeql-pack.release.yml
+++ b/java/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/java/ql/lib/qlpack.yml b/java/ql/lib/qlpack.yml
index 15b4982d41e..428eedc75e3 100644
--- a/java/ql/lib/qlpack.yml
+++ b/java/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-all
-version: 0.8.10-dev
+version: 0.8.10
groups: java
dbscheme: config/semmlecode.dbscheme
extractor: java
diff --git a/java/ql/src/CHANGELOG.md b/java/ql/src/CHANGELOG.md
index 5d835351453..c61275f5ed8 100644
--- a/java/ql/src/CHANGELOG.md
+++ b/java/ql/src/CHANGELOG.md
@@ -1,3 +1,13 @@
+## 0.8.10
+
+### New Queries
+
+* Added a new query `java/android/insecure-local-key-gen` for finding instances of keys generated for biometric authentication in an insecure way.
+
+### Minor Analysis Improvements
+
+* To reduce the number of false positives in the query "Insertion of sensitive information into log files" (`java/sensitive-log`), variables with names that contain "null" (case-insensitively) are no longer considered sources of sensitive information.
+
## 0.8.9
### New Queries
diff --git a/java/ql/src/change-notes/2024-02-12-android-insecure-keys.md b/java/ql/src/change-notes/2024-02-12-android-insecure-keys.md
deleted file mode 100644
index 1de07727796..00000000000
--- a/java/ql/src/change-notes/2024-02-12-android-insecure-keys.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: newQuery
----
-* Added a new query `java/android/insecure-local-key-gen` for finding instances of keys generated for biometric authentication in an insecure way.
\ No newline at end of file
diff --git a/java/ql/src/change-notes/2024-03-04-sensitive-log-remove-null-from-sources.md b/java/ql/src/change-notes/released/0.8.10.md
similarity index 54%
rename from java/ql/src/change-notes/2024-03-04-sensitive-log-remove-null-from-sources.md
rename to java/ql/src/change-notes/released/0.8.10.md
index 0bb4f18f2bd..c5d18ae3379 100644
--- a/java/ql/src/change-notes/2024-03-04-sensitive-log-remove-null-from-sources.md
+++ b/java/ql/src/change-notes/released/0.8.10.md
@@ -1,4 +1,9 @@
----
-category: minorAnalysis
----
+## 0.8.10
+
+### New Queries
+
+* Added a new query `java/android/insecure-local-key-gen` for finding instances of keys generated for biometric authentication in an insecure way.
+
+### Minor Analysis Improvements
+
* To reduce the number of false positives in the query "Insertion of sensitive information into log files" (`java/sensitive-log`), variables with names that contain "null" (case-insensitively) are no longer considered sources of sensitive information.
diff --git a/java/ql/src/codeql-pack.release.yml b/java/ql/src/codeql-pack.release.yml
index 5290c29b7fe..0521f0f75fa 100644
--- a/java/ql/src/codeql-pack.release.yml
+++ b/java/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/java/ql/src/qlpack.yml b/java/ql/src/qlpack.yml
index 8f4de528e21..ebbdbeee3b2 100644
--- a/java/ql/src/qlpack.yml
+++ b/java/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-queries
-version: 0.8.10-dev
+version: 0.8.10
groups:
- java
- queries
diff --git a/javascript/ql/lib/CHANGELOG.md b/javascript/ql/lib/CHANGELOG.md
index 5b97ebbb22b..d5edcc00513 100644
--- a/javascript/ql/lib/CHANGELOG.md
+++ b/javascript/ql/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.8.10
+
+No user-facing changes.
+
## 0.8.9
### Minor Analysis Improvements
diff --git a/javascript/ql/lib/change-notes/released/0.8.10.md b/javascript/ql/lib/change-notes/released/0.8.10.md
new file mode 100644
index 00000000000..777bbd2fded
--- /dev/null
+++ b/javascript/ql/lib/change-notes/released/0.8.10.md
@@ -0,0 +1,3 @@
+## 0.8.10
+
+No user-facing changes.
diff --git a/javascript/ql/lib/codeql-pack.release.yml b/javascript/ql/lib/codeql-pack.release.yml
index 5290c29b7fe..0521f0f75fa 100644
--- a/javascript/ql/lib/codeql-pack.release.yml
+++ b/javascript/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/javascript/ql/lib/qlpack.yml b/javascript/ql/lib/qlpack.yml
index ef3ca7521ac..da16493a21c 100644
--- a/javascript/ql/lib/qlpack.yml
+++ b/javascript/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-all
-version: 0.8.10-dev
+version: 0.8.10
groups: javascript
dbscheme: semmlecode.javascript.dbscheme
extractor: javascript
diff --git a/javascript/ql/src/CHANGELOG.md b/javascript/ql/src/CHANGELOG.md
index 85516e3625d..b9627cac5ee 100644
--- a/javascript/ql/src/CHANGELOG.md
+++ b/javascript/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.8.10
+
+No user-facing changes.
+
## 0.8.9
### Bug Fixes
diff --git a/javascript/ql/src/change-notes/released/0.8.10.md b/javascript/ql/src/change-notes/released/0.8.10.md
new file mode 100644
index 00000000000..777bbd2fded
--- /dev/null
+++ b/javascript/ql/src/change-notes/released/0.8.10.md
@@ -0,0 +1,3 @@
+## 0.8.10
+
+No user-facing changes.
diff --git a/javascript/ql/src/codeql-pack.release.yml b/javascript/ql/src/codeql-pack.release.yml
index 5290c29b7fe..0521f0f75fa 100644
--- a/javascript/ql/src/codeql-pack.release.yml
+++ b/javascript/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/javascript/ql/src/qlpack.yml b/javascript/ql/src/qlpack.yml
index b6181aa30e9..d224952c564 100644
--- a/javascript/ql/src/qlpack.yml
+++ b/javascript/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-queries
-version: 0.8.10-dev
+version: 0.8.10
groups:
- javascript
- queries
diff --git a/misc/suite-helpers/CHANGELOG.md b/misc/suite-helpers/CHANGELOG.md
index 3c06dd69b0f..1c4455b66c4 100644
--- a/misc/suite-helpers/CHANGELOG.md
+++ b/misc/suite-helpers/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.7.10
+
+No user-facing changes.
+
## 0.7.9
No user-facing changes.
diff --git a/misc/suite-helpers/change-notes/released/0.7.10.md b/misc/suite-helpers/change-notes/released/0.7.10.md
new file mode 100644
index 00000000000..989c5b8f682
--- /dev/null
+++ b/misc/suite-helpers/change-notes/released/0.7.10.md
@@ -0,0 +1,3 @@
+## 0.7.10
+
+No user-facing changes.
diff --git a/misc/suite-helpers/codeql-pack.release.yml b/misc/suite-helpers/codeql-pack.release.yml
index 576395f3405..67518567297 100644
--- a/misc/suite-helpers/codeql-pack.release.yml
+++ b/misc/suite-helpers/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.7.9
+lastReleaseVersion: 0.7.10
diff --git a/misc/suite-helpers/qlpack.yml b/misc/suite-helpers/qlpack.yml
index 49b7a6bda4c..54d978d5efe 100644
--- a/misc/suite-helpers/qlpack.yml
+++ b/misc/suite-helpers/qlpack.yml
@@ -1,4 +1,4 @@
name: codeql/suite-helpers
-version: 0.7.10-dev
+version: 0.7.10
groups: shared
warnOnImplicitThis: true
diff --git a/python/ql/lib/CHANGELOG.md b/python/ql/lib/CHANGELOG.md
index e6f318c51ea..f095607ca1b 100644
--- a/python/ql/lib/CHANGELOG.md
+++ b/python/ql/lib/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 0.11.10
+
+### Minor Analysis Improvements
+
+* Fixed missing flow for dictionary updates (`d[] = ...`) when `` is a string constant not used in dictionary literals or as name of keyword-argument.
+* Fixed flow for iterable unpacking (`a,b = my_tuple`) when it occurs on top-level (module) scope.
+
## 0.11.9
### Minor Analysis Improvements
diff --git a/python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md b/python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md
deleted file mode 100644
index 3c47c6ba866..00000000000
--- a/python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Fixed flow for iterable unpacking (`a,b = my_tuple`) when it occurs on top-level (module) scope.
diff --git a/python/ql/lib/change-notes/2024-03-01-dict-update-content.md b/python/ql/lib/change-notes/released/0.11.10.md
similarity index 52%
rename from python/ql/lib/change-notes/2024-03-01-dict-update-content.md
rename to python/ql/lib/change-notes/released/0.11.10.md
index dfb8d247fff..ed873724e4f 100644
--- a/python/ql/lib/change-notes/2024-03-01-dict-update-content.md
+++ b/python/ql/lib/change-notes/released/0.11.10.md
@@ -1,4 +1,6 @@
----
-category: minorAnalysis
----
+## 0.11.10
+
+### Minor Analysis Improvements
+
* Fixed missing flow for dictionary updates (`d[] = ...`) when `` is a string constant not used in dictionary literals or as name of keyword-argument.
+* Fixed flow for iterable unpacking (`a,b = my_tuple`) when it occurs on top-level (module) scope.
diff --git a/python/ql/lib/codeql-pack.release.yml b/python/ql/lib/codeql-pack.release.yml
index b064d1778a1..ddddcbe9193 100644
--- a/python/ql/lib/codeql-pack.release.yml
+++ b/python/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.11.9
+lastReleaseVersion: 0.11.10
diff --git a/python/ql/lib/qlpack.yml b/python/ql/lib/qlpack.yml
index e9f66e205f2..59a8b4c96d1 100644
--- a/python/ql/lib/qlpack.yml
+++ b/python/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-all
-version: 0.11.10-dev
+version: 0.11.10
groups: python
dbscheme: semmlecode.python.dbscheme
extractor: python
diff --git a/python/ql/src/CHANGELOG.md b/python/ql/src/CHANGELOG.md
index 50762bcbf34..d4245aba7a6 100644
--- a/python/ql/src/CHANGELOG.md
+++ b/python/ql/src/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 0.9.10
+
+### New Queries
+
+* The query `py/nosql-injection` for finding NoSQL injection vulnerabilities is now part of the default security suite.
+
## 0.9.9
No user-facing changes.
diff --git a/python/ql/src/change-notes/2024-03-04-nosql-injection.md b/python/ql/src/change-notes/released/0.9.10.md
similarity index 81%
rename from python/ql/src/change-notes/2024-03-04-nosql-injection.md
rename to python/ql/src/change-notes/released/0.9.10.md
index 6e98540c757..4cbb221b789 100644
--- a/python/ql/src/change-notes/2024-03-04-nosql-injection.md
+++ b/python/ql/src/change-notes/released/0.9.10.md
@@ -1,4 +1,5 @@
----
-category: newQuery
----
+## 0.9.10
+
+### New Queries
+
* The query `py/nosql-injection` for finding NoSQL injection vulnerabilities is now part of the default security suite.
diff --git a/python/ql/src/codeql-pack.release.yml b/python/ql/src/codeql-pack.release.yml
index aabed7c396b..d086ed69541 100644
--- a/python/ql/src/codeql-pack.release.yml
+++ b/python/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.9.9
+lastReleaseVersion: 0.9.10
diff --git a/python/ql/src/qlpack.yml b/python/ql/src/qlpack.yml
index aa18f2d8707..c920f667836 100644
--- a/python/ql/src/qlpack.yml
+++ b/python/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-queries
-version: 0.9.10-dev
+version: 0.9.10
groups:
- python
- queries
diff --git a/ruby/ql/lib/CHANGELOG.md b/ruby/ql/lib/CHANGELOG.md
index a623a151e89..c61a12e0f4a 100644
--- a/ruby/ql/lib/CHANGELOG.md
+++ b/ruby/ql/lib/CHANGELOG.md
@@ -1,3 +1,12 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Calls to `I18n.translate` as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
+* Calls to `Arel::Nodes::SqlLiteral.new` are now modeled as instances of the `SqlConstruction` concept, as well as propagating taint from their argument.
+* Additional arguments beyond the first of calls to the `ActiveRecord` methods `select`, `reselect`, `order`, `reorder`, `joins`, `group`, and `pluck` are now recognized as sql injection sinks.
+* Calls to several methods of `ActiveRecord::Connection`, such as `ActiveRecord::Connection#exec_query`, are now recognized as SQL executions, including those via subclasses.
+
## 0.8.9
### Minor Analysis Improvements
diff --git a/ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md b/ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md
deleted file mode 100644
index c2276f284a8..00000000000
--- a/ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Calls to several methods of `ActiveRecord::Connection`, such as `ActiveRecord::Connection#exec_query`, are now recognized as SQL executions, including those via subclasses.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md b/ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md
deleted file mode 100644
index 1486c7a472d..00000000000
--- a/ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Additional arguments beyond the first of calls to the `ActiveRecord` methods `select`, `reselect`, `order`, `reorder`, `joins`, `group`, and `pluck` are now recognized as sql injection sinks.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md b/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
deleted file mode 100644
index 6f3a90768ba..00000000000
--- a/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Calls to `Arel::Nodes::SqlLiteral.new` are now modeled as instances of the `SqlConstruction` concept, as well as propagating taint from their argument.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md b/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
deleted file mode 100644
index 350e049b5bf..00000000000
--- a/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Calls to `I18n.translate` as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/released/0.8.10.md b/ruby/ql/lib/change-notes/released/0.8.10.md
new file mode 100644
index 00000000000..666e28f840e
--- /dev/null
+++ b/ruby/ql/lib/change-notes/released/0.8.10.md
@@ -0,0 +1,8 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Calls to `I18n.translate` as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
+* Calls to `Arel::Nodes::SqlLiteral.new` are now modeled as instances of the `SqlConstruction` concept, as well as propagating taint from their argument.
+* Additional arguments beyond the first of calls to the `ActiveRecord` methods `select`, `reselect`, `order`, `reorder`, `joins`, `group`, and `pluck` are now recognized as sql injection sinks.
+* Calls to several methods of `ActiveRecord::Connection`, such as `ActiveRecord::Connection#exec_query`, are now recognized as SQL executions, including those via subclasses.
diff --git a/ruby/ql/lib/codeql-pack.release.yml b/ruby/ql/lib/codeql-pack.release.yml
index 5290c29b7fe..0521f0f75fa 100644
--- a/ruby/ql/lib/codeql-pack.release.yml
+++ b/ruby/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/ruby/ql/lib/qlpack.yml b/ruby/ql/lib/qlpack.yml
index 7d409b83adb..de5b41999fe 100644
--- a/ruby/ql/lib/qlpack.yml
+++ b/ruby/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-all
-version: 0.8.10-dev
+version: 0.8.10
groups: ruby
extractor: ruby
dbscheme: ruby.dbscheme
diff --git a/ruby/ql/src/CHANGELOG.md b/ruby/ql/src/CHANGELOG.md
index 4149c728eff..f875b6d16ad 100644
--- a/ruby/ql/src/CHANGELOG.md
+++ b/ruby/ql/src/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Calls to `Object#method`, `Object#public_method` and `Object#singleton_method` with untrusted data are now recognised as sinks for code injection.
+* Added additional request sources for Ruby on Rails.
+
## 0.8.9
No user-facing changes.
diff --git a/ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md b/ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md
deleted file mode 100644
index 84ea696dfef..00000000000
--- a/ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Added additional request sources for Ruby on Rails.
\ No newline at end of file
diff --git a/ruby/ql/src/change-notes/2024-03-01-method-code-injection-sinks.md b/ruby/ql/src/change-notes/released/0.8.10.md
similarity index 51%
rename from ruby/ql/src/change-notes/2024-03-01-method-code-injection-sinks.md
rename to ruby/ql/src/change-notes/released/0.8.10.md
index 43e40d3fd53..985cdf8d22e 100644
--- a/ruby/ql/src/change-notes/2024-03-01-method-code-injection-sinks.md
+++ b/ruby/ql/src/change-notes/released/0.8.10.md
@@ -1,4 +1,6 @@
----
-category: minorAnalysis
----
-* Calls to `Object#method`, `Object#public_method` and `Object#singleton_method` with untrusted data are now recognised as sinks for code injection.
\ No newline at end of file
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Calls to `Object#method`, `Object#public_method` and `Object#singleton_method` with untrusted data are now recognised as sinks for code injection.
+* Added additional request sources for Ruby on Rails.
diff --git a/ruby/ql/src/codeql-pack.release.yml b/ruby/ql/src/codeql-pack.release.yml
index 5290c29b7fe..0521f0f75fa 100644
--- a/ruby/ql/src/codeql-pack.release.yml
+++ b/ruby/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/ruby/ql/src/qlpack.yml b/ruby/ql/src/qlpack.yml
index 8af7f9fd797..5e379268234 100644
--- a/ruby/ql/src/qlpack.yml
+++ b/ruby/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-queries
-version: 0.8.10-dev
+version: 0.8.10
groups:
- ruby
- queries
diff --git a/shared/controlflow/CHANGELOG.md b/shared/controlflow/CHANGELOG.md
index dbfa6ef4512..75f2ca53f98 100644
--- a/shared/controlflow/CHANGELOG.md
+++ b/shared/controlflow/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.1.10
+
+No user-facing changes.
+
## 0.1.9
No user-facing changes.
diff --git a/shared/controlflow/change-notes/released/0.1.10.md b/shared/controlflow/change-notes/released/0.1.10.md
new file mode 100644
index 00000000000..47358eeee93
--- /dev/null
+++ b/shared/controlflow/change-notes/released/0.1.10.md
@@ -0,0 +1,3 @@
+## 0.1.10
+
+No user-facing changes.
diff --git a/shared/controlflow/codeql-pack.release.yml b/shared/controlflow/codeql-pack.release.yml
index 1425c0edf7f..30f5ca88be0 100644
--- a/shared/controlflow/codeql-pack.release.yml
+++ b/shared/controlflow/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.1.9
+lastReleaseVersion: 0.1.10
diff --git a/shared/controlflow/qlpack.yml b/shared/controlflow/qlpack.yml
index 9d35a678276..1d43802be42 100644
--- a/shared/controlflow/qlpack.yml
+++ b/shared/controlflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/controlflow
-version: 0.1.10-dev
+version: 0.1.10
groups: shared
library: true
dependencies:
diff --git a/shared/dataflow/CHANGELOG.md b/shared/dataflow/CHANGELOG.md
index 67a5bf589f4..ef80788bded 100644
--- a/shared/dataflow/CHANGELOG.md
+++ b/shared/dataflow/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.1
+
+No user-facing changes.
+
## 0.2.0
### Breaking Changes
diff --git a/shared/dataflow/change-notes/released/0.2.1.md b/shared/dataflow/change-notes/released/0.2.1.md
new file mode 100644
index 00000000000..3dbfc85fe11
--- /dev/null
+++ b/shared/dataflow/change-notes/released/0.2.1.md
@@ -0,0 +1,3 @@
+## 0.2.1
+
+No user-facing changes.
diff --git a/shared/dataflow/codeql-pack.release.yml b/shared/dataflow/codeql-pack.release.yml
index 5274e27ed52..df29a726bcc 100644
--- a/shared/dataflow/codeql-pack.release.yml
+++ b/shared/dataflow/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.0
+lastReleaseVersion: 0.2.1
diff --git a/shared/dataflow/qlpack.yml b/shared/dataflow/qlpack.yml
index 1e7becf71c4..ee422e02ea9 100644
--- a/shared/dataflow/qlpack.yml
+++ b/shared/dataflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/dataflow
-version: 0.2.1-dev
+version: 0.2.1
groups: shared
library: true
dependencies:
diff --git a/shared/mad/CHANGELOG.md b/shared/mad/CHANGELOG.md
index 4d09057118c..4730366775e 100644
--- a/shared/mad/CHANGELOG.md
+++ b/shared/mad/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/mad/change-notes/released/0.2.10.md b/shared/mad/change-notes/released/0.2.10.md
new file mode 100644
index 00000000000..81c9722b19f
--- /dev/null
+++ b/shared/mad/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/mad/codeql-pack.release.yml b/shared/mad/codeql-pack.release.yml
index d021cf0a6be..a71167814cb 100644
--- a/shared/mad/codeql-pack.release.yml
+++ b/shared/mad/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/mad/qlpack.yml b/shared/mad/qlpack.yml
index 22c8f271ccc..6d7269ef3da 100644
--- a/shared/mad/qlpack.yml
+++ b/shared/mad/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/mad
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
dependencies: null
diff --git a/shared/rangeanalysis/CHANGELOG.md b/shared/rangeanalysis/CHANGELOG.md
index 5b8dbcfab22..9943dcb7972 100644
--- a/shared/rangeanalysis/CHANGELOG.md
+++ b/shared/rangeanalysis/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.0.9
+
+No user-facing changes.
+
## 0.0.8
No user-facing changes.
diff --git a/shared/rangeanalysis/change-notes/released/0.0.9.md b/shared/rangeanalysis/change-notes/released/0.0.9.md
new file mode 100644
index 00000000000..c9e17c6d6cf
--- /dev/null
+++ b/shared/rangeanalysis/change-notes/released/0.0.9.md
@@ -0,0 +1,3 @@
+## 0.0.9
+
+No user-facing changes.
diff --git a/shared/rangeanalysis/codeql-pack.release.yml b/shared/rangeanalysis/codeql-pack.release.yml
index 58fdc6b45de..ecdd64fbab8 100644
--- a/shared/rangeanalysis/codeql-pack.release.yml
+++ b/shared/rangeanalysis/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.8
+lastReleaseVersion: 0.0.9
diff --git a/shared/rangeanalysis/qlpack.yml b/shared/rangeanalysis/qlpack.yml
index 836fe51ee34..01db5d5734d 100644
--- a/shared/rangeanalysis/qlpack.yml
+++ b/shared/rangeanalysis/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/rangeanalysis
-version: 0.0.9-dev
+version: 0.0.9
groups: shared
library: true
dependencies:
diff --git a/shared/regex/CHANGELOG.md b/shared/regex/CHANGELOG.md
index cd5f91f71ec..c05869c153d 100644
--- a/shared/regex/CHANGELOG.md
+++ b/shared/regex/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/regex/change-notes/released/0.2.10.md b/shared/regex/change-notes/released/0.2.10.md
new file mode 100644
index 00000000000..81c9722b19f
--- /dev/null
+++ b/shared/regex/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/regex/codeql-pack.release.yml b/shared/regex/codeql-pack.release.yml
index d021cf0a6be..a71167814cb 100644
--- a/shared/regex/codeql-pack.release.yml
+++ b/shared/regex/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/regex/qlpack.yml b/shared/regex/qlpack.yml
index ea3f7f9b238..0d4f485312f 100644
--- a/shared/regex/qlpack.yml
+++ b/shared/regex/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/regex
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
dependencies:
diff --git a/shared/ssa/CHANGELOG.md b/shared/ssa/CHANGELOG.md
index 01acfae0148..a9161ff578b 100644
--- a/shared/ssa/CHANGELOG.md
+++ b/shared/ssa/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/ssa/change-notes/released/0.2.10.md b/shared/ssa/change-notes/released/0.2.10.md
new file mode 100644
index 00000000000..81c9722b19f
--- /dev/null
+++ b/shared/ssa/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/ssa/codeql-pack.release.yml b/shared/ssa/codeql-pack.release.yml
index d021cf0a6be..a71167814cb 100644
--- a/shared/ssa/codeql-pack.release.yml
+++ b/shared/ssa/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/ssa/qlpack.yml b/shared/ssa/qlpack.yml
index 19304ad107f..2ad254711a5 100644
--- a/shared/ssa/qlpack.yml
+++ b/shared/ssa/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ssa
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
dependencies:
diff --git a/shared/threat-models/CHANGELOG.md b/shared/threat-models/CHANGELOG.md
index fba2a870356..a59e560c415 100644
--- a/shared/threat-models/CHANGELOG.md
+++ b/shared/threat-models/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.0.9
+
+No user-facing changes.
+
## 0.0.8
No user-facing changes.
diff --git a/shared/threat-models/change-notes/released/0.0.9.md b/shared/threat-models/change-notes/released/0.0.9.md
new file mode 100644
index 00000000000..c9e17c6d6cf
--- /dev/null
+++ b/shared/threat-models/change-notes/released/0.0.9.md
@@ -0,0 +1,3 @@
+## 0.0.9
+
+No user-facing changes.
diff --git a/shared/threat-models/codeql-pack.release.yml b/shared/threat-models/codeql-pack.release.yml
index 58fdc6b45de..ecdd64fbab8 100644
--- a/shared/threat-models/codeql-pack.release.yml
+++ b/shared/threat-models/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.8
+lastReleaseVersion: 0.0.9
diff --git a/shared/threat-models/qlpack.yml b/shared/threat-models/qlpack.yml
index d0ed9a913b2..60cbbc56fcb 100644
--- a/shared/threat-models/qlpack.yml
+++ b/shared/threat-models/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/threat-models
-version: 0.0.9-dev
+version: 0.0.9
library: true
groups: shared
dataExtensions:
diff --git a/shared/tutorial/CHANGELOG.md b/shared/tutorial/CHANGELOG.md
index 1db3a01af0b..560ad058d5b 100644
--- a/shared/tutorial/CHANGELOG.md
+++ b/shared/tutorial/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/tutorial/change-notes/released/0.2.10.md b/shared/tutorial/change-notes/released/0.2.10.md
new file mode 100644
index 00000000000..81c9722b19f
--- /dev/null
+++ b/shared/tutorial/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/tutorial/codeql-pack.release.yml b/shared/tutorial/codeql-pack.release.yml
index d021cf0a6be..a71167814cb 100644
--- a/shared/tutorial/codeql-pack.release.yml
+++ b/shared/tutorial/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/tutorial/qlpack.yml b/shared/tutorial/qlpack.yml
index b595ae9ee70..69116705c1b 100644
--- a/shared/tutorial/qlpack.yml
+++ b/shared/tutorial/qlpack.yml
@@ -1,7 +1,7 @@
name: codeql/tutorial
description: Library for the CodeQL detective tutorials, helping new users learn to
write CodeQL queries.
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/typetracking/CHANGELOG.md b/shared/typetracking/CHANGELOG.md
index afc857bc6bc..350f9ecbeae 100644
--- a/shared/typetracking/CHANGELOG.md
+++ b/shared/typetracking/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/typetracking/change-notes/released/0.2.10.md b/shared/typetracking/change-notes/released/0.2.10.md
new file mode 100644
index 00000000000..81c9722b19f
--- /dev/null
+++ b/shared/typetracking/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/typetracking/codeql-pack.release.yml b/shared/typetracking/codeql-pack.release.yml
index d021cf0a6be..a71167814cb 100644
--- a/shared/typetracking/codeql-pack.release.yml
+++ b/shared/typetracking/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/typetracking/qlpack.yml b/shared/typetracking/qlpack.yml
index b55927f59bb..fbbdcf5162a 100644
--- a/shared/typetracking/qlpack.yml
+++ b/shared/typetracking/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typetracking
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
dependencies:
diff --git a/shared/typos/CHANGELOG.md b/shared/typos/CHANGELOG.md
index 66c5871d982..54b1eaa4d58 100644
--- a/shared/typos/CHANGELOG.md
+++ b/shared/typos/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/typos/change-notes/released/0.2.10.md b/shared/typos/change-notes/released/0.2.10.md
new file mode 100644
index 00000000000..81c9722b19f
--- /dev/null
+++ b/shared/typos/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/typos/codeql-pack.release.yml b/shared/typos/codeql-pack.release.yml
index d021cf0a6be..a71167814cb 100644
--- a/shared/typos/codeql-pack.release.yml
+++ b/shared/typos/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/typos/qlpack.yml b/shared/typos/qlpack.yml
index 644bfe11bff..4d59d9b3c34 100644
--- a/shared/typos/qlpack.yml
+++ b/shared/typos/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typos
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/util/CHANGELOG.md b/shared/util/CHANGELOG.md
index 63832e927fa..1ca1f71bcbc 100644
--- a/shared/util/CHANGELOG.md
+++ b/shared/util/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/util/change-notes/released/0.2.10.md b/shared/util/change-notes/released/0.2.10.md
new file mode 100644
index 00000000000..81c9722b19f
--- /dev/null
+++ b/shared/util/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/util/codeql-pack.release.yml b/shared/util/codeql-pack.release.yml
index d021cf0a6be..a71167814cb 100644
--- a/shared/util/codeql-pack.release.yml
+++ b/shared/util/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/util/qlpack.yml b/shared/util/qlpack.yml
index ca1a866a53d..28ed738a93d 100644
--- a/shared/util/qlpack.yml
+++ b/shared/util/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/util
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
dependencies: null
diff --git a/shared/yaml/CHANGELOG.md b/shared/yaml/CHANGELOG.md
index e5495abcd50..9fd5ebc26ab 100644
--- a/shared/yaml/CHANGELOG.md
+++ b/shared/yaml/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/yaml/change-notes/released/0.2.10.md b/shared/yaml/change-notes/released/0.2.10.md
new file mode 100644
index 00000000000..81c9722b19f
--- /dev/null
+++ b/shared/yaml/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/yaml/codeql-pack.release.yml b/shared/yaml/codeql-pack.release.yml
index d021cf0a6be..a71167814cb 100644
--- a/shared/yaml/codeql-pack.release.yml
+++ b/shared/yaml/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/yaml/qlpack.yml b/shared/yaml/qlpack.yml
index de5b47e120a..9643ffcec66 100644
--- a/shared/yaml/qlpack.yml
+++ b/shared/yaml/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/yaml
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/swift/ql/lib/CHANGELOG.md b/swift/ql/lib/CHANGELOG.md
index e88cd0259cc..8f14bfcedc9 100644
--- a/swift/ql/lib/CHANGELOG.md
+++ b/swift/ql/lib/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 0.3.10
+
+### Bug Fixes
+
+* Fixed an issue where `TypeDecl.getFullName` would get stuck in an loop and fail when minor database inconsistencies are present.
+
## 0.3.9
### Minor Analysis Improvements
diff --git a/swift/ql/lib/change-notes/2024-02-22-extension-patch.md b/swift/ql/lib/change-notes/released/0.3.10.md
similarity index 83%
rename from swift/ql/lib/change-notes/2024-02-22-extension-patch.md
rename to swift/ql/lib/change-notes/released/0.3.10.md
index 7bd78f3b785..9d6286ff58a 100644
--- a/swift/ql/lib/change-notes/2024-02-22-extension-patch.md
+++ b/swift/ql/lib/change-notes/released/0.3.10.md
@@ -1,4 +1,5 @@
----
-category: fix
----
+## 0.3.10
+
+### Bug Fixes
+
* Fixed an issue where `TypeDecl.getFullName` would get stuck in an loop and fail when minor database inconsistencies are present.
diff --git a/swift/ql/lib/codeql-pack.release.yml b/swift/ql/lib/codeql-pack.release.yml
index 3fa5180bcb4..76ca0ac8ba7 100644
--- a/swift/ql/lib/codeql-pack.release.yml
+++ b/swift/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.3.9
+lastReleaseVersion: 0.3.10
diff --git a/swift/ql/lib/qlpack.yml b/swift/ql/lib/qlpack.yml
index a37a4cb3d58..70ec4798ea8 100644
--- a/swift/ql/lib/qlpack.yml
+++ b/swift/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-all
-version: 0.3.10-dev
+version: 0.3.10
groups: swift
extractor: swift
dbscheme: swift.dbscheme
diff --git a/swift/ql/src/CHANGELOG.md b/swift/ql/src/CHANGELOG.md
index 96615d06972..bda9834c9bc 100644
--- a/swift/ql/src/CHANGELOG.md
+++ b/swift/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.3.10
+
+No user-facing changes.
+
## 0.3.9
### New Queries
diff --git a/swift/ql/src/change-notes/released/0.3.10.md b/swift/ql/src/change-notes/released/0.3.10.md
new file mode 100644
index 00000000000..925a48fc52e
--- /dev/null
+++ b/swift/ql/src/change-notes/released/0.3.10.md
@@ -0,0 +1,3 @@
+## 0.3.10
+
+No user-facing changes.
diff --git a/swift/ql/src/codeql-pack.release.yml b/swift/ql/src/codeql-pack.release.yml
index 3fa5180bcb4..76ca0ac8ba7 100644
--- a/swift/ql/src/codeql-pack.release.yml
+++ b/swift/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.3.9
+lastReleaseVersion: 0.3.10
diff --git a/swift/ql/src/qlpack.yml b/swift/ql/src/qlpack.yml
index e3ead42c98b..ba66b065529 100644
--- a/swift/ql/src/qlpack.yml
+++ b/swift/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-queries
-version: 0.3.10-dev
+version: 0.3.10
groups:
- swift
- queries
From ce31f8641a4c4f83c8665bdf48de524862aa15c7 Mon Sep 17 00:00:00 2001
From: Angela P Wen
Date: Wed, 6 Mar 2024 12:07:33 -0800
Subject: [PATCH 037/309] Revert "Release preparation for version 2.16.4"
---
cpp/ql/lib/CHANGELOG.md | 6 ------
....12.7.md => 2024-02-26-ir-named-destructors.md} | 9 ++++-----
cpp/ql/lib/codeql-pack.release.yml | 2 +-
cpp/ql/lib/qlpack.yml | 2 +-
cpp/ql/src/CHANGELOG.md | 7 -------
...=> 2024-02-16-modelled-functions-block-flow.md} | 8 +++-----
.../2024-02-29-non-constant-format-path-query.md | 4 ++++
cpp/ql/src/codeql-pack.release.yml | 2 +-
cpp/ql/src/qlpack.yml | 2 +-
csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md | 4 ----
.../Solorigate/lib/change-notes/released/1.7.10.md | 3 ---
.../Solorigate/lib/codeql-pack.release.yml | 2 +-
csharp/ql/campaigns/Solorigate/lib/qlpack.yml | 2 +-
csharp/ql/campaigns/Solorigate/src/CHANGELOG.md | 4 ----
.../Solorigate/src/change-notes/released/1.7.10.md | 3 ---
.../Solorigate/src/codeql-pack.release.yml | 2 +-
csharp/ql/campaigns/Solorigate/src/qlpack.yml | 2 +-
csharp/ql/lib/CHANGELOG.md | 14 --------------
.../change-notes/2024-02-21-getonly-properties.md | 4 ++++
.../ql/lib/change-notes/2024-02-22-no-db-stats.md | 4 ++++
.../change-notes/2024-02-23-compiler-generated.md | 4 ++++
.../2024-02-26-variable-capture-flow.md | 4 ++++
.../2024-02-28-experimental-attribute.md | 4 ++++
.../2024-02-28-refreadonly-parameter.md | 4 ++++
csharp/ql/lib/change-notes/released/0.8.10.md | 13 -------------
csharp/ql/lib/codeql-pack.release.yml | 2 +-
csharp/ql/lib/qlpack.yml | 2 +-
csharp/ql/src/CHANGELOG.md | 6 ------
.../0.8.10.md => 2024-02-06-threat-models.md} | 9 ++++-----
csharp/ql/src/codeql-pack.release.yml | 2 +-
csharp/ql/src/qlpack.yml | 2 +-
go/ql/consistency-queries/CHANGELOG.md | 4 ----
.../change-notes/released/0.0.9.md | 3 ---
go/ql/consistency-queries/codeql-pack.release.yml | 2 +-
go/ql/consistency-queries/qlpack.yml | 2 +-
go/ql/lib/CHANGELOG.md | 11 -----------
.../lib/change-notes/2024-02-14-range-map-read.md | 4 ++++
...0.7.10.md => 2024-03-04-autobuilder-changes.md} | 11 +++--------
go/ql/lib/codeql-pack.release.yml | 2 +-
go/ql/lib/qlpack.yml | 2 +-
go/ql/src/CHANGELOG.md | 4 ----
go/ql/src/change-notes/released/0.7.10.md | 3 ---
go/ql/src/codeql-pack.release.yml | 2 +-
go/ql/src/qlpack.yml | 2 +-
java/ql/automodel/src/CHANGELOG.md | 4 ----
.../automodel/src/change-notes/released/0.0.17.md | 3 ---
java/ql/automodel/src/codeql-pack.release.yml | 2 +-
java/ql/automodel/src/qlpack.yml | 2 +-
java/ql/lib/CHANGELOG.md | 11 -----------
.../change-notes/2024-02-23-widget-flowsteps.md | 4 ++++
java/ql/lib/change-notes/2024-02-27-error-types.md | 4 ++++
.../lib/change-notes/2024-02-27-mvnw-versions.md | 4 ++++
java/ql/lib/change-notes/released/0.8.10.md | 10 ----------
java/ql/lib/codeql-pack.release.yml | 2 +-
java/ql/lib/qlpack.yml | 2 +-
java/ql/src/CHANGELOG.md | 10 ----------
.../2024-02-12-android-insecure-keys.md | 4 ++++
...3-04-sensitive-log-remove-null-from-sources.md} | 11 +++--------
java/ql/src/codeql-pack.release.yml | 2 +-
java/ql/src/qlpack.yml | 2 +-
javascript/ql/lib/CHANGELOG.md | 4 ----
javascript/ql/lib/change-notes/released/0.8.10.md | 3 ---
javascript/ql/lib/codeql-pack.release.yml | 2 +-
javascript/ql/lib/qlpack.yml | 2 +-
javascript/ql/src/CHANGELOG.md | 4 ----
javascript/ql/src/change-notes/released/0.8.10.md | 3 ---
javascript/ql/src/codeql-pack.release.yml | 2 +-
javascript/ql/src/qlpack.yml | 2 +-
misc/suite-helpers/CHANGELOG.md | 4 ----
misc/suite-helpers/change-notes/released/0.7.10.md | 3 ---
misc/suite-helpers/codeql-pack.release.yml | 2 +-
misc/suite-helpers/qlpack.yml | 2 +-
python/ql/lib/CHANGELOG.md | 7 -------
.../2024-02-28-iterable-unpacking-module-scope.md | 4 ++++
....11.10.md => 2024-03-01-dict-update-content.md} | 8 +++-----
python/ql/lib/codeql-pack.release.yml | 2 +-
python/ql/lib/qlpack.yml | 2 +-
python/ql/src/CHANGELOG.md | 6 ------
.../0.9.10.md => 2024-03-04-nosql-injection.md} | 7 +++----
python/ql/src/codeql-pack.release.yml | 2 +-
python/ql/src/qlpack.yml | 2 +-
ruby/ql/lib/CHANGELOG.md | 9 ---------
...2024-02-15-activerecord_connection_sql_sinks.md | 4 ++++
.../2024-02-20-activerecord-sql-sink-arguments.md | 4 ++++
.../lib/change-notes/2024-02-26-arel-sqlliteral.md | 4 ++++
.../lib/change-notes/2024-02-29-i18n-translate.md | 4 ++++
ruby/ql/lib/change-notes/released/0.8.10.md | 8 --------
ruby/ql/lib/codeql-pack.release.yml | 2 +-
ruby/ql/lib/qlpack.yml | 2 +-
ruby/ql/src/CHANGELOG.md | 7 -------
.../2024-02-13-rails-more-request-sources.md | 4 ++++
...d => 2024-03-01-method-code-injection-sinks.md} | 10 ++++------
ruby/ql/src/codeql-pack.release.yml | 2 +-
ruby/ql/src/qlpack.yml | 2 +-
shared/controlflow/CHANGELOG.md | 4 ----
shared/controlflow/change-notes/released/0.1.10.md | 3 ---
shared/controlflow/codeql-pack.release.yml | 2 +-
shared/controlflow/qlpack.yml | 2 +-
shared/dataflow/CHANGELOG.md | 4 ----
shared/dataflow/change-notes/released/0.2.1.md | 3 ---
shared/dataflow/codeql-pack.release.yml | 2 +-
shared/dataflow/qlpack.yml | 2 +-
shared/mad/CHANGELOG.md | 4 ----
shared/mad/change-notes/released/0.2.10.md | 3 ---
shared/mad/codeql-pack.release.yml | 2 +-
shared/mad/qlpack.yml | 2 +-
shared/rangeanalysis/CHANGELOG.md | 4 ----
.../rangeanalysis/change-notes/released/0.0.9.md | 3 ---
shared/rangeanalysis/codeql-pack.release.yml | 2 +-
shared/rangeanalysis/qlpack.yml | 2 +-
shared/regex/CHANGELOG.md | 4 ----
shared/regex/change-notes/released/0.2.10.md | 3 ---
shared/regex/codeql-pack.release.yml | 2 +-
shared/regex/qlpack.yml | 2 +-
shared/ssa/CHANGELOG.md | 4 ----
shared/ssa/change-notes/released/0.2.10.md | 3 ---
shared/ssa/codeql-pack.release.yml | 2 +-
shared/ssa/qlpack.yml | 2 +-
shared/threat-models/CHANGELOG.md | 4 ----
.../threat-models/change-notes/released/0.0.9.md | 3 ---
shared/threat-models/codeql-pack.release.yml | 2 +-
shared/threat-models/qlpack.yml | 2 +-
shared/tutorial/CHANGELOG.md | 4 ----
shared/tutorial/change-notes/released/0.2.10.md | 3 ---
shared/tutorial/codeql-pack.release.yml | 2 +-
shared/tutorial/qlpack.yml | 2 +-
shared/typetracking/CHANGELOG.md | 4 ----
.../typetracking/change-notes/released/0.2.10.md | 3 ---
shared/typetracking/codeql-pack.release.yml | 2 +-
shared/typetracking/qlpack.yml | 2 +-
shared/typos/CHANGELOG.md | 4 ----
shared/typos/change-notes/released/0.2.10.md | 3 ---
shared/typos/codeql-pack.release.yml | 2 +-
shared/typos/qlpack.yml | 2 +-
shared/util/CHANGELOG.md | 4 ----
shared/util/change-notes/released/0.2.10.md | 3 ---
shared/util/codeql-pack.release.yml | 2 +-
shared/util/qlpack.yml | 2 +-
shared/yaml/CHANGELOG.md | 4 ----
shared/yaml/change-notes/released/0.2.10.md | 3 ---
shared/yaml/codeql-pack.release.yml | 2 +-
shared/yaml/qlpack.yml | 2 +-
swift/ql/lib/CHANGELOG.md | 6 ------
.../0.3.10.md => 2024-02-22-extension-patch.md} | 7 +++----
swift/ql/lib/codeql-pack.release.yml | 2 +-
swift/ql/lib/qlpack.yml | 2 +-
swift/ql/src/CHANGELOG.md | 4 ----
swift/ql/src/change-notes/released/0.3.10.md | 3 ---
swift/ql/src/codeql-pack.release.yml | 2 +-
swift/ql/src/qlpack.yml | 2 +-
150 files changed, 168 insertions(+), 394 deletions(-)
rename cpp/ql/lib/change-notes/{released/0.12.7.md => 2024-02-26-ir-named-destructors.md} (54%)
rename cpp/ql/src/change-notes/{released/0.9.6.md => 2024-02-16-modelled-functions-block-flow.md} (77%)
create mode 100644 cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md
delete mode 100644 csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md
delete mode 100644 csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md
create mode 100644 csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md
create mode 100644 csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md
create mode 100644 csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md
create mode 100644 csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md
create mode 100644 csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md
create mode 100644 csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md
delete mode 100644 csharp/ql/lib/change-notes/released/0.8.10.md
rename csharp/ql/src/change-notes/{released/0.8.10.md => 2024-02-06-threat-models.md} (88%)
delete mode 100644 go/ql/consistency-queries/change-notes/released/0.0.9.md
create mode 100644 go/ql/lib/change-notes/2024-02-14-range-map-read.md
rename go/ql/lib/change-notes/{released/0.7.10.md => 2024-03-04-autobuilder-changes.md} (68%)
delete mode 100644 go/ql/src/change-notes/released/0.7.10.md
delete mode 100644 java/ql/automodel/src/change-notes/released/0.0.17.md
create mode 100644 java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md
create mode 100644 java/ql/lib/change-notes/2024-02-27-error-types.md
create mode 100644 java/ql/lib/change-notes/2024-02-27-mvnw-versions.md
delete mode 100644 java/ql/lib/change-notes/released/0.8.10.md
create mode 100644 java/ql/src/change-notes/2024-02-12-android-insecure-keys.md
rename java/ql/src/change-notes/{released/0.8.10.md => 2024-03-04-sensitive-log-remove-null-from-sources.md} (54%)
delete mode 100644 javascript/ql/lib/change-notes/released/0.8.10.md
delete mode 100644 javascript/ql/src/change-notes/released/0.8.10.md
delete mode 100644 misc/suite-helpers/change-notes/released/0.7.10.md
create mode 100644 python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md
rename python/ql/lib/change-notes/{released/0.11.10.md => 2024-03-01-dict-update-content.md} (52%)
rename python/ql/src/change-notes/{released/0.9.10.md => 2024-03-04-nosql-injection.md} (81%)
create mode 100644 ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md
create mode 100644 ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md
create mode 100644 ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
create mode 100644 ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
delete mode 100644 ruby/ql/lib/change-notes/released/0.8.10.md
create mode 100644 ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md
rename ruby/ql/src/change-notes/{released/0.8.10.md => 2024-03-01-method-code-injection-sinks.md} (51%)
delete mode 100644 shared/controlflow/change-notes/released/0.1.10.md
delete mode 100644 shared/dataflow/change-notes/released/0.2.1.md
delete mode 100644 shared/mad/change-notes/released/0.2.10.md
delete mode 100644 shared/rangeanalysis/change-notes/released/0.0.9.md
delete mode 100644 shared/regex/change-notes/released/0.2.10.md
delete mode 100644 shared/ssa/change-notes/released/0.2.10.md
delete mode 100644 shared/threat-models/change-notes/released/0.0.9.md
delete mode 100644 shared/tutorial/change-notes/released/0.2.10.md
delete mode 100644 shared/typetracking/change-notes/released/0.2.10.md
delete mode 100644 shared/typos/change-notes/released/0.2.10.md
delete mode 100644 shared/util/change-notes/released/0.2.10.md
delete mode 100644 shared/yaml/change-notes/released/0.2.10.md
rename swift/ql/lib/change-notes/{released/0.3.10.md => 2024-02-22-extension-patch.md} (83%)
delete mode 100644 swift/ql/src/change-notes/released/0.3.10.md
diff --git a/cpp/ql/lib/CHANGELOG.md b/cpp/ql/lib/CHANGELOG.md
index e1c0dfbecd9..b3091ec37d8 100644
--- a/cpp/ql/lib/CHANGELOG.md
+++ b/cpp/ql/lib/CHANGELOG.md
@@ -1,9 +1,3 @@
-## 0.12.7
-
-### Minor Analysis Improvements
-
-* Added destructors for named objects to the intermediate representation.
-
## 0.12.6
### New Features
diff --git a/cpp/ql/lib/change-notes/released/0.12.7.md b/cpp/ql/lib/change-notes/2024-02-26-ir-named-destructors.md
similarity index 54%
rename from cpp/ql/lib/change-notes/released/0.12.7.md
rename to cpp/ql/lib/change-notes/2024-02-26-ir-named-destructors.md
index 856a8b665c7..4e35decaf8e 100644
--- a/cpp/ql/lib/change-notes/released/0.12.7.md
+++ b/cpp/ql/lib/change-notes/2024-02-26-ir-named-destructors.md
@@ -1,5 +1,4 @@
-## 0.12.7
-
-### Minor Analysis Improvements
-
-* Added destructors for named objects to the intermediate representation.
+---
+category: minorAnalysis
+---
+* Added destructors for named objects to the intermediate representation.
\ No newline at end of file
diff --git a/cpp/ql/lib/codeql-pack.release.yml b/cpp/ql/lib/codeql-pack.release.yml
index 20419e9c610..170a312c104 100644
--- a/cpp/ql/lib/codeql-pack.release.yml
+++ b/cpp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.12.7
+lastReleaseVersion: 0.12.6
diff --git a/cpp/ql/lib/qlpack.yml b/cpp/ql/lib/qlpack.yml
index 3bb9229bf94..8e201fff594 100644
--- a/cpp/ql/lib/qlpack.yml
+++ b/cpp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-all
-version: 0.12.7
+version: 0.12.7-dev
groups: cpp
dbscheme: semmlecode.cpp.dbscheme
extractor: cpp
diff --git a/cpp/ql/src/CHANGELOG.md b/cpp/ql/src/CHANGELOG.md
index f6acd424bb0..ffcd73ff5d7 100644
--- a/cpp/ql/src/CHANGELOG.md
+++ b/cpp/ql/src/CHANGELOG.md
@@ -1,10 +1,3 @@
-## 0.9.6
-
-### Minor Analysis Improvements
-
-* The "non-constant format string" query (`cpp/non-constant-format`) has been converted to a `path-problem` query.
-* The new C/C++ dataflow and taint-tracking libraries (`semmle.code.cpp.dataflow.new.DataFlow` and `semmle.code.cpp.dataflow.new.TaintTracking`) now implicitly assume that dataflow and taint modelled via `DataFlowFunction` and `TaintFunction` always fully overwrite their buffers and thus act as flow barriers. As a result, many dataflow and taint-tracking queries now produce fewer false positives. To remove this assumption and go back to the previous behavior for a given model, one can override the new `isPartialWrite` predicate.
-
## 0.9.5
### Minor Analysis Improvements
diff --git a/cpp/ql/src/change-notes/released/0.9.6.md b/cpp/ql/src/change-notes/2024-02-16-modelled-functions-block-flow.md
similarity index 77%
rename from cpp/ql/src/change-notes/released/0.9.6.md
rename to cpp/ql/src/change-notes/2024-02-16-modelled-functions-block-flow.md
index 0c85f3f9f0f..d6ef3c3e056 100644
--- a/cpp/ql/src/change-notes/released/0.9.6.md
+++ b/cpp/ql/src/change-notes/2024-02-16-modelled-functions-block-flow.md
@@ -1,6 +1,4 @@
-## 0.9.6
-
-### Minor Analysis Improvements
-
-* The "non-constant format string" query (`cpp/non-constant-format`) has been converted to a `path-problem` query.
+---
+category: minorAnalysis
+---
* The new C/C++ dataflow and taint-tracking libraries (`semmle.code.cpp.dataflow.new.DataFlow` and `semmle.code.cpp.dataflow.new.TaintTracking`) now implicitly assume that dataflow and taint modelled via `DataFlowFunction` and `TaintFunction` always fully overwrite their buffers and thus act as flow barriers. As a result, many dataflow and taint-tracking queries now produce fewer false positives. To remove this assumption and go back to the previous behavior for a given model, one can override the new `isPartialWrite` predicate.
diff --git a/cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md b/cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md
new file mode 100644
index 00000000000..2e5933a61e8
--- /dev/null
+++ b/cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The "non-constant format string" query (`cpp/non-constant-format`) has been converted to a `path-problem` query.
\ No newline at end of file
diff --git a/cpp/ql/src/codeql-pack.release.yml b/cpp/ql/src/codeql-pack.release.yml
index 19139c132b2..460240feaff 100644
--- a/cpp/ql/src/codeql-pack.release.yml
+++ b/cpp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.9.6
+lastReleaseVersion: 0.9.5
diff --git a/cpp/ql/src/qlpack.yml b/cpp/ql/src/qlpack.yml
index 4052647bb97..31bd20166b2 100644
--- a/cpp/ql/src/qlpack.yml
+++ b/cpp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-queries
-version: 0.9.6
+version: 0.9.6-dev
groups:
- cpp
- queries
diff --git a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
index 82eacfc84f7..190b83b0f25 100644
--- a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
+++ b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 1.7.10
-
-No user-facing changes.
-
## 1.7.9
No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md
deleted file mode 100644
index 8e8007d8475..00000000000
--- a/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 1.7.10
-
-No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
index 31c7fe07020..678da6bc37e 100644
--- a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.7.10
+lastReleaseVersion: 1.7.9
diff --git a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
index ee993bed0c9..7e643b0fac3 100644
--- a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-all
-version: 1.7.10
+version: 1.7.10-dev
groups:
- csharp
- solorigate
diff --git a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
index 82eacfc84f7..190b83b0f25 100644
--- a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
+++ b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 1.7.10
-
-No user-facing changes.
-
## 1.7.9
No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md
deleted file mode 100644
index 8e8007d8475..00000000000
--- a/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 1.7.10
-
-No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
index 31c7fe07020..678da6bc37e 100644
--- a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
+++ b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.7.10
+lastReleaseVersion: 1.7.9
diff --git a/csharp/ql/campaigns/Solorigate/src/qlpack.yml b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
index 1f421754fc8..8654bbfd031 100644
--- a/csharp/ql/campaigns/Solorigate/src/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-queries
-version: 1.7.10
+version: 1.7.10-dev
groups:
- csharp
- solorigate
diff --git a/csharp/ql/lib/CHANGELOG.md b/csharp/ql/lib/CHANGELOG.md
index 16cc14259e1..95fd64c5270 100644
--- a/csharp/ql/lib/CHANGELOG.md
+++ b/csharp/ql/lib/CHANGELOG.md
@@ -1,17 +1,3 @@
-## 0.8.10
-
-### Major Analysis Improvements
-
-* Improved support for flow through captured variables that properly adheres to inter-procedural control flow.
-* We no longer make use of CodeQL database stats, which may affect join-orders in custom queries. It is therefore recommended to test performance of custom queries after upgrading to this version.
-
-### Minor Analysis Improvements
-
-* C# 12: Add QL library support (`ExperimentalAttribute`) for the experimental attribute.
-* C# 12: Add extractor and QL library support for `ref readonly` parameters.
-* C#: The table `expr_compiler_generated` has been deleted and its content has been added to `compiler_generated`.
-* Data flow via get only properties like `public object Obj { get; }` is now captured by the data flow library.
-
## 0.8.9
### Minor Analysis Improvements
diff --git a/csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md b/csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md
new file mode 100644
index 00000000000..6bb8e99c71e
--- /dev/null
+++ b/csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Data flow via get only properties like `public object Obj { get; }` is now captured by the data flow library.
diff --git a/csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md b/csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md
new file mode 100644
index 00000000000..d6ffbd523ac
--- /dev/null
+++ b/csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md
@@ -0,0 +1,4 @@
+---
+category: majorAnalysis
+---
+* We no longer make use of CodeQL database stats, which may affect join-orders in custom queries. It is therefore recommended to test performance of custom queries after upgrading to this version.
diff --git a/csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md b/csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md
new file mode 100644
index 00000000000..9b1739b9b6d
--- /dev/null
+++ b/csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* C#: The table `expr_compiler_generated` has been deleted and its content has been added to `compiler_generated`.
diff --git a/csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md b/csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md
new file mode 100644
index 00000000000..66ab65083dc
--- /dev/null
+++ b/csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md
@@ -0,0 +1,4 @@
+---
+category: majorAnalysis
+---
+* Improved support for flow through captured variables that properly adheres to inter-procedural control flow.
\ No newline at end of file
diff --git a/csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md b/csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md
new file mode 100644
index 00000000000..8749c790954
--- /dev/null
+++ b/csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* C# 12: Add QL library support (`ExperimentalAttribute`) for the experimental attribute.
diff --git a/csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md b/csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md
new file mode 100644
index 00000000000..586b5341d29
--- /dev/null
+++ b/csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* C# 12: Add extractor and QL library support for `ref readonly` parameters.
diff --git a/csharp/ql/lib/change-notes/released/0.8.10.md b/csharp/ql/lib/change-notes/released/0.8.10.md
deleted file mode 100644
index f591ddc5b21..00000000000
--- a/csharp/ql/lib/change-notes/released/0.8.10.md
+++ /dev/null
@@ -1,13 +0,0 @@
-## 0.8.10
-
-### Major Analysis Improvements
-
-* Improved support for flow through captured variables that properly adheres to inter-procedural control flow.
-* We no longer make use of CodeQL database stats, which may affect join-orders in custom queries. It is therefore recommended to test performance of custom queries after upgrading to this version.
-
-### Minor Analysis Improvements
-
-* C# 12: Add QL library support (`ExperimentalAttribute`) for the experimental attribute.
-* C# 12: Add extractor and QL library support for `ref readonly` parameters.
-* C#: The table `expr_compiler_generated` has been deleted and its content has been added to `compiler_generated`.
-* Data flow via get only properties like `public object Obj { get; }` is now captured by the data flow library.
diff --git a/csharp/ql/lib/codeql-pack.release.yml b/csharp/ql/lib/codeql-pack.release.yml
index 0521f0f75fa..5290c29b7fe 100644
--- a/csharp/ql/lib/codeql-pack.release.yml
+++ b/csharp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.10
+lastReleaseVersion: 0.8.9
diff --git a/csharp/ql/lib/qlpack.yml b/csharp/ql/lib/qlpack.yml
index 93c5c1120a2..d75ea3c6320 100644
--- a/csharp/ql/lib/qlpack.yml
+++ b/csharp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-all
-version: 0.8.10
+version: 0.8.10-dev
groups: csharp
dbscheme: semmlecode.csharp.dbscheme
extractor: csharp
diff --git a/csharp/ql/src/CHANGELOG.md b/csharp/ql/src/CHANGELOG.md
index 46c939e5cee..9fe1609363f 100644
--- a/csharp/ql/src/CHANGELOG.md
+++ b/csharp/ql/src/CHANGELOG.md
@@ -1,9 +1,3 @@
-## 0.8.10
-
-### Minor Analysis Improvements
-
-* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. The changed queries are `cs/code-injection`, `cs/command-line-injection`, `cs/user-controlled-bypass`, `cs/count-untrusted-data-external-api`, `cs/untrusted-data-to-external-api`, `cs/ldap-injection`, `cs/log-forging`, `cs/xml/missing-validation`, `cs/redos`, `cs/regex-injection`, `cs/resource-injection`, `cs/sql-injection`, `cs/path-injection`, `cs/unsafe-deserialization-untrusted-input`, `cs/web/unvalidated-url-redirection`, `cs/xml/insecure-dtd-handling`, `cs/xml/xpath-injection`, `cs/web/xss`, and `cs/uncontrolled-format-string`.
-
## 0.8.9
### Minor Analysis Improvements
diff --git a/csharp/ql/src/change-notes/released/0.8.10.md b/csharp/ql/src/change-notes/2024-02-06-threat-models.md
similarity index 88%
rename from csharp/ql/src/change-notes/released/0.8.10.md
rename to csharp/ql/src/change-notes/2024-02-06-threat-models.md
index 702161c3d28..69ac4e4dc17 100644
--- a/csharp/ql/src/change-notes/released/0.8.10.md
+++ b/csharp/ql/src/change-notes/2024-02-06-threat-models.md
@@ -1,5 +1,4 @@
-## 0.8.10
-
-### Minor Analysis Improvements
-
-* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. The changed queries are `cs/code-injection`, `cs/command-line-injection`, `cs/user-controlled-bypass`, `cs/count-untrusted-data-external-api`, `cs/untrusted-data-to-external-api`, `cs/ldap-injection`, `cs/log-forging`, `cs/xml/missing-validation`, `cs/redos`, `cs/regex-injection`, `cs/resource-injection`, `cs/sql-injection`, `cs/path-injection`, `cs/unsafe-deserialization-untrusted-input`, `cs/web/unvalidated-url-redirection`, `cs/xml/insecure-dtd-handling`, `cs/xml/xpath-injection`, `cs/web/xss`, and `cs/uncontrolled-format-string`.
+---
+category: minorAnalysis
+---
+* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. The changed queries are `cs/code-injection`, `cs/command-line-injection`, `cs/user-controlled-bypass`, `cs/count-untrusted-data-external-api`, `cs/untrusted-data-to-external-api`, `cs/ldap-injection`, `cs/log-forging`, `cs/xml/missing-validation`, `cs/redos`, `cs/regex-injection`, `cs/resource-injection`, `cs/sql-injection`, `cs/path-injection`, `cs/unsafe-deserialization-untrusted-input`, `cs/web/unvalidated-url-redirection`, `cs/xml/insecure-dtd-handling`, `cs/xml/xpath-injection`, `cs/web/xss`, and `cs/uncontrolled-format-string`.
\ No newline at end of file
diff --git a/csharp/ql/src/codeql-pack.release.yml b/csharp/ql/src/codeql-pack.release.yml
index 0521f0f75fa..5290c29b7fe 100644
--- a/csharp/ql/src/codeql-pack.release.yml
+++ b/csharp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.10
+lastReleaseVersion: 0.8.9
diff --git a/csharp/ql/src/qlpack.yml b/csharp/ql/src/qlpack.yml
index 46384094b19..9ee23cc7307 100644
--- a/csharp/ql/src/qlpack.yml
+++ b/csharp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-queries
-version: 0.8.10
+version: 0.8.10-dev
groups:
- csharp
- queries
diff --git a/go/ql/consistency-queries/CHANGELOG.md b/go/ql/consistency-queries/CHANGELOG.md
index a59e560c415..fba2a870356 100644
--- a/go/ql/consistency-queries/CHANGELOG.md
+++ b/go/ql/consistency-queries/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.0.9
-
-No user-facing changes.
-
## 0.0.8
No user-facing changes.
diff --git a/go/ql/consistency-queries/change-notes/released/0.0.9.md b/go/ql/consistency-queries/change-notes/released/0.0.9.md
deleted file mode 100644
index c9e17c6d6cf..00000000000
--- a/go/ql/consistency-queries/change-notes/released/0.0.9.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.0.9
-
-No user-facing changes.
diff --git a/go/ql/consistency-queries/codeql-pack.release.yml b/go/ql/consistency-queries/codeql-pack.release.yml
index ecdd64fbab8..58fdc6b45de 100644
--- a/go/ql/consistency-queries/codeql-pack.release.yml
+++ b/go/ql/consistency-queries/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.9
+lastReleaseVersion: 0.0.8
diff --git a/go/ql/consistency-queries/qlpack.yml b/go/ql/consistency-queries/qlpack.yml
index d5a2fbee5f1..b574796b995 100644
--- a/go/ql/consistency-queries/qlpack.yml
+++ b/go/ql/consistency-queries/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql-go-consistency-queries
-version: 0.0.9
+version: 0.0.9-dev
groups:
- go
- queries
diff --git a/go/ql/lib/CHANGELOG.md b/go/ql/lib/CHANGELOG.md
index fee5fd37a26..65a2376217b 100644
--- a/go/ql/lib/CHANGELOG.md
+++ b/go/ql/lib/CHANGELOG.md
@@ -1,14 +1,3 @@
-## 0.7.10
-
-### Major Analysis Improvements
-
-* We have significantly improved the Go autobuilder to understand a greater range of project layouts, which allows Go source files to be analysed that could previously not be processed.
-* Go 1.22 has been included in the range of supported Go versions.
-
-### Bug Fixes
-
-* Fixed dataflow out of a `map` using a `range` statement.
-
## 0.7.9
No user-facing changes.
diff --git a/go/ql/lib/change-notes/2024-02-14-range-map-read.md b/go/ql/lib/change-notes/2024-02-14-range-map-read.md
new file mode 100644
index 00000000000..ea45737a72e
--- /dev/null
+++ b/go/ql/lib/change-notes/2024-02-14-range-map-read.md
@@ -0,0 +1,4 @@
+---
+category: fix
+---
+* Fixed dataflow out of a `map` using a `range` statement.
diff --git a/go/ql/lib/change-notes/released/0.7.10.md b/go/ql/lib/change-notes/2024-03-04-autobuilder-changes.md
similarity index 68%
rename from go/ql/lib/change-notes/released/0.7.10.md
rename to go/ql/lib/change-notes/2024-03-04-autobuilder-changes.md
index 55954f8a394..0442a571029 100644
--- a/go/ql/lib/change-notes/released/0.7.10.md
+++ b/go/ql/lib/change-notes/2024-03-04-autobuilder-changes.md
@@ -1,10 +1,5 @@
-## 0.7.10
-
-### Major Analysis Improvements
-
+---
+category: majorAnalysis
+---
* We have significantly improved the Go autobuilder to understand a greater range of project layouts, which allows Go source files to be analysed that could previously not be processed.
* Go 1.22 has been included in the range of supported Go versions.
-
-### Bug Fixes
-
-* Fixed dataflow out of a `map` using a `range` statement.
diff --git a/go/ql/lib/codeql-pack.release.yml b/go/ql/lib/codeql-pack.release.yml
index 67518567297..576395f3405 100644
--- a/go/ql/lib/codeql-pack.release.yml
+++ b/go/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.7.10
+lastReleaseVersion: 0.7.9
diff --git a/go/ql/lib/qlpack.yml b/go/ql/lib/qlpack.yml
index 8cc190fa880..f21e478efa6 100644
--- a/go/ql/lib/qlpack.yml
+++ b/go/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-all
-version: 0.7.10
+version: 0.7.10-dev
groups: go
dbscheme: go.dbscheme
extractor: go
diff --git a/go/ql/src/CHANGELOG.md b/go/ql/src/CHANGELOG.md
index 24e38b9890e..d95165a3a34 100644
--- a/go/ql/src/CHANGELOG.md
+++ b/go/ql/src/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.7.10
-
-No user-facing changes.
-
## 0.7.9
### New Queries
diff --git a/go/ql/src/change-notes/released/0.7.10.md b/go/ql/src/change-notes/released/0.7.10.md
deleted file mode 100644
index 989c5b8f682..00000000000
--- a/go/ql/src/change-notes/released/0.7.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.7.10
-
-No user-facing changes.
diff --git a/go/ql/src/codeql-pack.release.yml b/go/ql/src/codeql-pack.release.yml
index 67518567297..576395f3405 100644
--- a/go/ql/src/codeql-pack.release.yml
+++ b/go/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.7.10
+lastReleaseVersion: 0.7.9
diff --git a/go/ql/src/qlpack.yml b/go/ql/src/qlpack.yml
index 4ded3a52f63..d91cab59612 100644
--- a/go/ql/src/qlpack.yml
+++ b/go/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-queries
-version: 0.7.10
+version: 0.7.10-dev
groups:
- go
- queries
diff --git a/java/ql/automodel/src/CHANGELOG.md b/java/ql/automodel/src/CHANGELOG.md
index c3282c773a9..4a3c54adb38 100644
--- a/java/ql/automodel/src/CHANGELOG.md
+++ b/java/ql/automodel/src/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.0.17
-
-No user-facing changes.
-
## 0.0.16
No user-facing changes.
diff --git a/java/ql/automodel/src/change-notes/released/0.0.17.md b/java/ql/automodel/src/change-notes/released/0.0.17.md
deleted file mode 100644
index 62cc89030a6..00000000000
--- a/java/ql/automodel/src/change-notes/released/0.0.17.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.0.17
-
-No user-facing changes.
diff --git a/java/ql/automodel/src/codeql-pack.release.yml b/java/ql/automodel/src/codeql-pack.release.yml
index cbc3d3cd493..a49f7be4cff 100644
--- a/java/ql/automodel/src/codeql-pack.release.yml
+++ b/java/ql/automodel/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.17
+lastReleaseVersion: 0.0.16
diff --git a/java/ql/automodel/src/qlpack.yml b/java/ql/automodel/src/qlpack.yml
index 59fab0cdcc5..898239be098 100644
--- a/java/ql/automodel/src/qlpack.yml
+++ b/java/ql/automodel/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-automodel-queries
-version: 0.0.17
+version: 0.0.17-dev
groups:
- java
- automodel
diff --git a/java/ql/lib/CHANGELOG.md b/java/ql/lib/CHANGELOG.md
index 2a02ccee6ab..d369cbdc931 100644
--- a/java/ql/lib/CHANGELOG.md
+++ b/java/ql/lib/CHANGELOG.md
@@ -1,14 +1,3 @@
-## 0.8.10
-
-### Minor Analysis Improvements
-
-* Java expressions with erroneous types (e.g. the result of a call whose callee couldn't be resolved during extraction) are now given a CodeQL `ErrorType` more often.
-
-### Bug Fixes
-
-* Fixed the Java autobuilder overriding the version of Maven used by a project when the Maven wrapper `mvnw` is in use and the `maven-wrapper.jar` file is not present in the repository.
-* Some flow steps related to `android.text.Editable.toString` that were accidentally disabled have been re-enabled.
-
## 0.8.9
### Deprecated APIs
diff --git a/java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md b/java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md
new file mode 100644
index 00000000000..eb560fba07d
--- /dev/null
+++ b/java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md
@@ -0,0 +1,4 @@
+---
+category: fix
+---
+* Some flow steps related to `android.text.Editable.toString` that were accidentally disabled have been re-enabled.
diff --git a/java/ql/lib/change-notes/2024-02-27-error-types.md b/java/ql/lib/change-notes/2024-02-27-error-types.md
new file mode 100644
index 00000000000..cdc6d7620aa
--- /dev/null
+++ b/java/ql/lib/change-notes/2024-02-27-error-types.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Java expressions with erroneous types (e.g. the result of a call whose callee couldn't be resolved during extraction) are now given a CodeQL `ErrorType` more often.
diff --git a/java/ql/lib/change-notes/2024-02-27-mvnw-versions.md b/java/ql/lib/change-notes/2024-02-27-mvnw-versions.md
new file mode 100644
index 00000000000..a0227088ae9
--- /dev/null
+++ b/java/ql/lib/change-notes/2024-02-27-mvnw-versions.md
@@ -0,0 +1,4 @@
+---
+category: fix
+---
+* Fixed the Java autobuilder overriding the version of Maven used by a project when the Maven wrapper `mvnw` is in use and the `maven-wrapper.jar` file is not present in the repository.
diff --git a/java/ql/lib/change-notes/released/0.8.10.md b/java/ql/lib/change-notes/released/0.8.10.md
deleted file mode 100644
index b45f14bf347..00000000000
--- a/java/ql/lib/change-notes/released/0.8.10.md
+++ /dev/null
@@ -1,10 +0,0 @@
-## 0.8.10
-
-### Minor Analysis Improvements
-
-* Java expressions with erroneous types (e.g. the result of a call whose callee couldn't be resolved during extraction) are now given a CodeQL `ErrorType` more often.
-
-### Bug Fixes
-
-* Fixed the Java autobuilder overriding the version of Maven used by a project when the Maven wrapper `mvnw` is in use and the `maven-wrapper.jar` file is not present in the repository.
-* Some flow steps related to `android.text.Editable.toString` that were accidentally disabled have been re-enabled.
diff --git a/java/ql/lib/codeql-pack.release.yml b/java/ql/lib/codeql-pack.release.yml
index 0521f0f75fa..5290c29b7fe 100644
--- a/java/ql/lib/codeql-pack.release.yml
+++ b/java/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.10
+lastReleaseVersion: 0.8.9
diff --git a/java/ql/lib/qlpack.yml b/java/ql/lib/qlpack.yml
index 428eedc75e3..15b4982d41e 100644
--- a/java/ql/lib/qlpack.yml
+++ b/java/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-all
-version: 0.8.10
+version: 0.8.10-dev
groups: java
dbscheme: config/semmlecode.dbscheme
extractor: java
diff --git a/java/ql/src/CHANGELOG.md b/java/ql/src/CHANGELOG.md
index c61275f5ed8..5d835351453 100644
--- a/java/ql/src/CHANGELOG.md
+++ b/java/ql/src/CHANGELOG.md
@@ -1,13 +1,3 @@
-## 0.8.10
-
-### New Queries
-
-* Added a new query `java/android/insecure-local-key-gen` for finding instances of keys generated for biometric authentication in an insecure way.
-
-### Minor Analysis Improvements
-
-* To reduce the number of false positives in the query "Insertion of sensitive information into log files" (`java/sensitive-log`), variables with names that contain "null" (case-insensitively) are no longer considered sources of sensitive information.
-
## 0.8.9
### New Queries
diff --git a/java/ql/src/change-notes/2024-02-12-android-insecure-keys.md b/java/ql/src/change-notes/2024-02-12-android-insecure-keys.md
new file mode 100644
index 00000000000..1de07727796
--- /dev/null
+++ b/java/ql/src/change-notes/2024-02-12-android-insecure-keys.md
@@ -0,0 +1,4 @@
+---
+category: newQuery
+---
+* Added a new query `java/android/insecure-local-key-gen` for finding instances of keys generated for biometric authentication in an insecure way.
\ No newline at end of file
diff --git a/java/ql/src/change-notes/released/0.8.10.md b/java/ql/src/change-notes/2024-03-04-sensitive-log-remove-null-from-sources.md
similarity index 54%
rename from java/ql/src/change-notes/released/0.8.10.md
rename to java/ql/src/change-notes/2024-03-04-sensitive-log-remove-null-from-sources.md
index c5d18ae3379..0bb4f18f2bd 100644
--- a/java/ql/src/change-notes/released/0.8.10.md
+++ b/java/ql/src/change-notes/2024-03-04-sensitive-log-remove-null-from-sources.md
@@ -1,9 +1,4 @@
-## 0.8.10
-
-### New Queries
-
-* Added a new query `java/android/insecure-local-key-gen` for finding instances of keys generated for biometric authentication in an insecure way.
-
-### Minor Analysis Improvements
-
+---
+category: minorAnalysis
+---
* To reduce the number of false positives in the query "Insertion of sensitive information into log files" (`java/sensitive-log`), variables with names that contain "null" (case-insensitively) are no longer considered sources of sensitive information.
diff --git a/java/ql/src/codeql-pack.release.yml b/java/ql/src/codeql-pack.release.yml
index 0521f0f75fa..5290c29b7fe 100644
--- a/java/ql/src/codeql-pack.release.yml
+++ b/java/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.10
+lastReleaseVersion: 0.8.9
diff --git a/java/ql/src/qlpack.yml b/java/ql/src/qlpack.yml
index ebbdbeee3b2..8f4de528e21 100644
--- a/java/ql/src/qlpack.yml
+++ b/java/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-queries
-version: 0.8.10
+version: 0.8.10-dev
groups:
- java
- queries
diff --git a/javascript/ql/lib/CHANGELOG.md b/javascript/ql/lib/CHANGELOG.md
index d5edcc00513..5b97ebbb22b 100644
--- a/javascript/ql/lib/CHANGELOG.md
+++ b/javascript/ql/lib/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.8.10
-
-No user-facing changes.
-
## 0.8.9
### Minor Analysis Improvements
diff --git a/javascript/ql/lib/change-notes/released/0.8.10.md b/javascript/ql/lib/change-notes/released/0.8.10.md
deleted file mode 100644
index 777bbd2fded..00000000000
--- a/javascript/ql/lib/change-notes/released/0.8.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.8.10
-
-No user-facing changes.
diff --git a/javascript/ql/lib/codeql-pack.release.yml b/javascript/ql/lib/codeql-pack.release.yml
index 0521f0f75fa..5290c29b7fe 100644
--- a/javascript/ql/lib/codeql-pack.release.yml
+++ b/javascript/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.10
+lastReleaseVersion: 0.8.9
diff --git a/javascript/ql/lib/qlpack.yml b/javascript/ql/lib/qlpack.yml
index da16493a21c..ef3ca7521ac 100644
--- a/javascript/ql/lib/qlpack.yml
+++ b/javascript/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-all
-version: 0.8.10
+version: 0.8.10-dev
groups: javascript
dbscheme: semmlecode.javascript.dbscheme
extractor: javascript
diff --git a/javascript/ql/src/CHANGELOG.md b/javascript/ql/src/CHANGELOG.md
index b9627cac5ee..85516e3625d 100644
--- a/javascript/ql/src/CHANGELOG.md
+++ b/javascript/ql/src/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.8.10
-
-No user-facing changes.
-
## 0.8.9
### Bug Fixes
diff --git a/javascript/ql/src/change-notes/released/0.8.10.md b/javascript/ql/src/change-notes/released/0.8.10.md
deleted file mode 100644
index 777bbd2fded..00000000000
--- a/javascript/ql/src/change-notes/released/0.8.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.8.10
-
-No user-facing changes.
diff --git a/javascript/ql/src/codeql-pack.release.yml b/javascript/ql/src/codeql-pack.release.yml
index 0521f0f75fa..5290c29b7fe 100644
--- a/javascript/ql/src/codeql-pack.release.yml
+++ b/javascript/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.10
+lastReleaseVersion: 0.8.9
diff --git a/javascript/ql/src/qlpack.yml b/javascript/ql/src/qlpack.yml
index d224952c564..b6181aa30e9 100644
--- a/javascript/ql/src/qlpack.yml
+++ b/javascript/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-queries
-version: 0.8.10
+version: 0.8.10-dev
groups:
- javascript
- queries
diff --git a/misc/suite-helpers/CHANGELOG.md b/misc/suite-helpers/CHANGELOG.md
index 1c4455b66c4..3c06dd69b0f 100644
--- a/misc/suite-helpers/CHANGELOG.md
+++ b/misc/suite-helpers/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.7.10
-
-No user-facing changes.
-
## 0.7.9
No user-facing changes.
diff --git a/misc/suite-helpers/change-notes/released/0.7.10.md b/misc/suite-helpers/change-notes/released/0.7.10.md
deleted file mode 100644
index 989c5b8f682..00000000000
--- a/misc/suite-helpers/change-notes/released/0.7.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.7.10
-
-No user-facing changes.
diff --git a/misc/suite-helpers/codeql-pack.release.yml b/misc/suite-helpers/codeql-pack.release.yml
index 67518567297..576395f3405 100644
--- a/misc/suite-helpers/codeql-pack.release.yml
+++ b/misc/suite-helpers/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.7.10
+lastReleaseVersion: 0.7.9
diff --git a/misc/suite-helpers/qlpack.yml b/misc/suite-helpers/qlpack.yml
index 54d978d5efe..49b7a6bda4c 100644
--- a/misc/suite-helpers/qlpack.yml
+++ b/misc/suite-helpers/qlpack.yml
@@ -1,4 +1,4 @@
name: codeql/suite-helpers
-version: 0.7.10
+version: 0.7.10-dev
groups: shared
warnOnImplicitThis: true
diff --git a/python/ql/lib/CHANGELOG.md b/python/ql/lib/CHANGELOG.md
index f095607ca1b..e6f318c51ea 100644
--- a/python/ql/lib/CHANGELOG.md
+++ b/python/ql/lib/CHANGELOG.md
@@ -1,10 +1,3 @@
-## 0.11.10
-
-### Minor Analysis Improvements
-
-* Fixed missing flow for dictionary updates (`d[] = ...`) when `` is a string constant not used in dictionary literals or as name of keyword-argument.
-* Fixed flow for iterable unpacking (`a,b = my_tuple`) when it occurs on top-level (module) scope.
-
## 0.11.9
### Minor Analysis Improvements
diff --git a/python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md b/python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md
new file mode 100644
index 00000000000..3c47c6ba866
--- /dev/null
+++ b/python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Fixed flow for iterable unpacking (`a,b = my_tuple`) when it occurs on top-level (module) scope.
diff --git a/python/ql/lib/change-notes/released/0.11.10.md b/python/ql/lib/change-notes/2024-03-01-dict-update-content.md
similarity index 52%
rename from python/ql/lib/change-notes/released/0.11.10.md
rename to python/ql/lib/change-notes/2024-03-01-dict-update-content.md
index ed873724e4f..dfb8d247fff 100644
--- a/python/ql/lib/change-notes/released/0.11.10.md
+++ b/python/ql/lib/change-notes/2024-03-01-dict-update-content.md
@@ -1,6 +1,4 @@
-## 0.11.10
-
-### Minor Analysis Improvements
-
+---
+category: minorAnalysis
+---
* Fixed missing flow for dictionary updates (`d[] = ...`) when `` is a string constant not used in dictionary literals or as name of keyword-argument.
-* Fixed flow for iterable unpacking (`a,b = my_tuple`) when it occurs on top-level (module) scope.
diff --git a/python/ql/lib/codeql-pack.release.yml b/python/ql/lib/codeql-pack.release.yml
index ddddcbe9193..b064d1778a1 100644
--- a/python/ql/lib/codeql-pack.release.yml
+++ b/python/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.11.10
+lastReleaseVersion: 0.11.9
diff --git a/python/ql/lib/qlpack.yml b/python/ql/lib/qlpack.yml
index 59a8b4c96d1..e9f66e205f2 100644
--- a/python/ql/lib/qlpack.yml
+++ b/python/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-all
-version: 0.11.10
+version: 0.11.10-dev
groups: python
dbscheme: semmlecode.python.dbscheme
extractor: python
diff --git a/python/ql/src/CHANGELOG.md b/python/ql/src/CHANGELOG.md
index d4245aba7a6..50762bcbf34 100644
--- a/python/ql/src/CHANGELOG.md
+++ b/python/ql/src/CHANGELOG.md
@@ -1,9 +1,3 @@
-## 0.9.10
-
-### New Queries
-
-* The query `py/nosql-injection` for finding NoSQL injection vulnerabilities is now part of the default security suite.
-
## 0.9.9
No user-facing changes.
diff --git a/python/ql/src/change-notes/released/0.9.10.md b/python/ql/src/change-notes/2024-03-04-nosql-injection.md
similarity index 81%
rename from python/ql/src/change-notes/released/0.9.10.md
rename to python/ql/src/change-notes/2024-03-04-nosql-injection.md
index 4cbb221b789..6e98540c757 100644
--- a/python/ql/src/change-notes/released/0.9.10.md
+++ b/python/ql/src/change-notes/2024-03-04-nosql-injection.md
@@ -1,5 +1,4 @@
-## 0.9.10
-
-### New Queries
-
+---
+category: newQuery
+---
* The query `py/nosql-injection` for finding NoSQL injection vulnerabilities is now part of the default security suite.
diff --git a/python/ql/src/codeql-pack.release.yml b/python/ql/src/codeql-pack.release.yml
index d086ed69541..aabed7c396b 100644
--- a/python/ql/src/codeql-pack.release.yml
+++ b/python/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.9.10
+lastReleaseVersion: 0.9.9
diff --git a/python/ql/src/qlpack.yml b/python/ql/src/qlpack.yml
index c920f667836..aa18f2d8707 100644
--- a/python/ql/src/qlpack.yml
+++ b/python/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-queries
-version: 0.9.10
+version: 0.9.10-dev
groups:
- python
- queries
diff --git a/ruby/ql/lib/CHANGELOG.md b/ruby/ql/lib/CHANGELOG.md
index c61a12e0f4a..a623a151e89 100644
--- a/ruby/ql/lib/CHANGELOG.md
+++ b/ruby/ql/lib/CHANGELOG.md
@@ -1,12 +1,3 @@
-## 0.8.10
-
-### Minor Analysis Improvements
-
-* Calls to `I18n.translate` as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
-* Calls to `Arel::Nodes::SqlLiteral.new` are now modeled as instances of the `SqlConstruction` concept, as well as propagating taint from their argument.
-* Additional arguments beyond the first of calls to the `ActiveRecord` methods `select`, `reselect`, `order`, `reorder`, `joins`, `group`, and `pluck` are now recognized as sql injection sinks.
-* Calls to several methods of `ActiveRecord::Connection`, such as `ActiveRecord::Connection#exec_query`, are now recognized as SQL executions, including those via subclasses.
-
## 0.8.9
### Minor Analysis Improvements
diff --git a/ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md b/ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md
new file mode 100644
index 00000000000..c2276f284a8
--- /dev/null
+++ b/ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Calls to several methods of `ActiveRecord::Connection`, such as `ActiveRecord::Connection#exec_query`, are now recognized as SQL executions, including those via subclasses.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md b/ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md
new file mode 100644
index 00000000000..1486c7a472d
--- /dev/null
+++ b/ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Additional arguments beyond the first of calls to the `ActiveRecord` methods `select`, `reselect`, `order`, `reorder`, `joins`, `group`, and `pluck` are now recognized as sql injection sinks.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md b/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
new file mode 100644
index 00000000000..6f3a90768ba
--- /dev/null
+++ b/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Calls to `Arel::Nodes::SqlLiteral.new` are now modeled as instances of the `SqlConstruction` concept, as well as propagating taint from their argument.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md b/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
new file mode 100644
index 00000000000..350e049b5bf
--- /dev/null
+++ b/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Calls to `I18n.translate` as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/released/0.8.10.md b/ruby/ql/lib/change-notes/released/0.8.10.md
deleted file mode 100644
index 666e28f840e..00000000000
--- a/ruby/ql/lib/change-notes/released/0.8.10.md
+++ /dev/null
@@ -1,8 +0,0 @@
-## 0.8.10
-
-### Minor Analysis Improvements
-
-* Calls to `I18n.translate` as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
-* Calls to `Arel::Nodes::SqlLiteral.new` are now modeled as instances of the `SqlConstruction` concept, as well as propagating taint from their argument.
-* Additional arguments beyond the first of calls to the `ActiveRecord` methods `select`, `reselect`, `order`, `reorder`, `joins`, `group`, and `pluck` are now recognized as sql injection sinks.
-* Calls to several methods of `ActiveRecord::Connection`, such as `ActiveRecord::Connection#exec_query`, are now recognized as SQL executions, including those via subclasses.
diff --git a/ruby/ql/lib/codeql-pack.release.yml b/ruby/ql/lib/codeql-pack.release.yml
index 0521f0f75fa..5290c29b7fe 100644
--- a/ruby/ql/lib/codeql-pack.release.yml
+++ b/ruby/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.10
+lastReleaseVersion: 0.8.9
diff --git a/ruby/ql/lib/qlpack.yml b/ruby/ql/lib/qlpack.yml
index de5b41999fe..7d409b83adb 100644
--- a/ruby/ql/lib/qlpack.yml
+++ b/ruby/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-all
-version: 0.8.10
+version: 0.8.10-dev
groups: ruby
extractor: ruby
dbscheme: ruby.dbscheme
diff --git a/ruby/ql/src/CHANGELOG.md b/ruby/ql/src/CHANGELOG.md
index f875b6d16ad..4149c728eff 100644
--- a/ruby/ql/src/CHANGELOG.md
+++ b/ruby/ql/src/CHANGELOG.md
@@ -1,10 +1,3 @@
-## 0.8.10
-
-### Minor Analysis Improvements
-
-* Calls to `Object#method`, `Object#public_method` and `Object#singleton_method` with untrusted data are now recognised as sinks for code injection.
-* Added additional request sources for Ruby on Rails.
-
## 0.8.9
No user-facing changes.
diff --git a/ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md b/ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md
new file mode 100644
index 00000000000..84ea696dfef
--- /dev/null
+++ b/ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added additional request sources for Ruby on Rails.
\ No newline at end of file
diff --git a/ruby/ql/src/change-notes/released/0.8.10.md b/ruby/ql/src/change-notes/2024-03-01-method-code-injection-sinks.md
similarity index 51%
rename from ruby/ql/src/change-notes/released/0.8.10.md
rename to ruby/ql/src/change-notes/2024-03-01-method-code-injection-sinks.md
index 985cdf8d22e..43e40d3fd53 100644
--- a/ruby/ql/src/change-notes/released/0.8.10.md
+++ b/ruby/ql/src/change-notes/2024-03-01-method-code-injection-sinks.md
@@ -1,6 +1,4 @@
-## 0.8.10
-
-### Minor Analysis Improvements
-
-* Calls to `Object#method`, `Object#public_method` and `Object#singleton_method` with untrusted data are now recognised as sinks for code injection.
-* Added additional request sources for Ruby on Rails.
+---
+category: minorAnalysis
+---
+* Calls to `Object#method`, `Object#public_method` and `Object#singleton_method` with untrusted data are now recognised as sinks for code injection.
\ No newline at end of file
diff --git a/ruby/ql/src/codeql-pack.release.yml b/ruby/ql/src/codeql-pack.release.yml
index 0521f0f75fa..5290c29b7fe 100644
--- a/ruby/ql/src/codeql-pack.release.yml
+++ b/ruby/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.10
+lastReleaseVersion: 0.8.9
diff --git a/ruby/ql/src/qlpack.yml b/ruby/ql/src/qlpack.yml
index 5e379268234..8af7f9fd797 100644
--- a/ruby/ql/src/qlpack.yml
+++ b/ruby/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-queries
-version: 0.8.10
+version: 0.8.10-dev
groups:
- ruby
- queries
diff --git a/shared/controlflow/CHANGELOG.md b/shared/controlflow/CHANGELOG.md
index 75f2ca53f98..dbfa6ef4512 100644
--- a/shared/controlflow/CHANGELOG.md
+++ b/shared/controlflow/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.1.10
-
-No user-facing changes.
-
## 0.1.9
No user-facing changes.
diff --git a/shared/controlflow/change-notes/released/0.1.10.md b/shared/controlflow/change-notes/released/0.1.10.md
deleted file mode 100644
index 47358eeee93..00000000000
--- a/shared/controlflow/change-notes/released/0.1.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.1.10
-
-No user-facing changes.
diff --git a/shared/controlflow/codeql-pack.release.yml b/shared/controlflow/codeql-pack.release.yml
index 30f5ca88be0..1425c0edf7f 100644
--- a/shared/controlflow/codeql-pack.release.yml
+++ b/shared/controlflow/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.1.10
+lastReleaseVersion: 0.1.9
diff --git a/shared/controlflow/qlpack.yml b/shared/controlflow/qlpack.yml
index 1d43802be42..9d35a678276 100644
--- a/shared/controlflow/qlpack.yml
+++ b/shared/controlflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/controlflow
-version: 0.1.10
+version: 0.1.10-dev
groups: shared
library: true
dependencies:
diff --git a/shared/dataflow/CHANGELOG.md b/shared/dataflow/CHANGELOG.md
index ef80788bded..67a5bf589f4 100644
--- a/shared/dataflow/CHANGELOG.md
+++ b/shared/dataflow/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.1
-
-No user-facing changes.
-
## 0.2.0
### Breaking Changes
diff --git a/shared/dataflow/change-notes/released/0.2.1.md b/shared/dataflow/change-notes/released/0.2.1.md
deleted file mode 100644
index 3dbfc85fe11..00000000000
--- a/shared/dataflow/change-notes/released/0.2.1.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.1
-
-No user-facing changes.
diff --git a/shared/dataflow/codeql-pack.release.yml b/shared/dataflow/codeql-pack.release.yml
index df29a726bcc..5274e27ed52 100644
--- a/shared/dataflow/codeql-pack.release.yml
+++ b/shared/dataflow/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.1
+lastReleaseVersion: 0.2.0
diff --git a/shared/dataflow/qlpack.yml b/shared/dataflow/qlpack.yml
index ee422e02ea9..1e7becf71c4 100644
--- a/shared/dataflow/qlpack.yml
+++ b/shared/dataflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/dataflow
-version: 0.2.1
+version: 0.2.1-dev
groups: shared
library: true
dependencies:
diff --git a/shared/mad/CHANGELOG.md b/shared/mad/CHANGELOG.md
index 4730366775e..4d09057118c 100644
--- a/shared/mad/CHANGELOG.md
+++ b/shared/mad/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.10
-
-No user-facing changes.
-
## 0.2.9
No user-facing changes.
diff --git a/shared/mad/change-notes/released/0.2.10.md b/shared/mad/change-notes/released/0.2.10.md
deleted file mode 100644
index 81c9722b19f..00000000000
--- a/shared/mad/change-notes/released/0.2.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.10
-
-No user-facing changes.
diff --git a/shared/mad/codeql-pack.release.yml b/shared/mad/codeql-pack.release.yml
index a71167814cb..d021cf0a6be 100644
--- a/shared/mad/codeql-pack.release.yml
+++ b/shared/mad/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.10
+lastReleaseVersion: 0.2.9
diff --git a/shared/mad/qlpack.yml b/shared/mad/qlpack.yml
index 6d7269ef3da..22c8f271ccc 100644
--- a/shared/mad/qlpack.yml
+++ b/shared/mad/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/mad
-version: 0.2.10
+version: 0.2.10-dev
groups: shared
library: true
dependencies: null
diff --git a/shared/rangeanalysis/CHANGELOG.md b/shared/rangeanalysis/CHANGELOG.md
index 9943dcb7972..5b8dbcfab22 100644
--- a/shared/rangeanalysis/CHANGELOG.md
+++ b/shared/rangeanalysis/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.0.9
-
-No user-facing changes.
-
## 0.0.8
No user-facing changes.
diff --git a/shared/rangeanalysis/change-notes/released/0.0.9.md b/shared/rangeanalysis/change-notes/released/0.0.9.md
deleted file mode 100644
index c9e17c6d6cf..00000000000
--- a/shared/rangeanalysis/change-notes/released/0.0.9.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.0.9
-
-No user-facing changes.
diff --git a/shared/rangeanalysis/codeql-pack.release.yml b/shared/rangeanalysis/codeql-pack.release.yml
index ecdd64fbab8..58fdc6b45de 100644
--- a/shared/rangeanalysis/codeql-pack.release.yml
+++ b/shared/rangeanalysis/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.9
+lastReleaseVersion: 0.0.8
diff --git a/shared/rangeanalysis/qlpack.yml b/shared/rangeanalysis/qlpack.yml
index 01db5d5734d..836fe51ee34 100644
--- a/shared/rangeanalysis/qlpack.yml
+++ b/shared/rangeanalysis/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/rangeanalysis
-version: 0.0.9
+version: 0.0.9-dev
groups: shared
library: true
dependencies:
diff --git a/shared/regex/CHANGELOG.md b/shared/regex/CHANGELOG.md
index c05869c153d..cd5f91f71ec 100644
--- a/shared/regex/CHANGELOG.md
+++ b/shared/regex/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.10
-
-No user-facing changes.
-
## 0.2.9
No user-facing changes.
diff --git a/shared/regex/change-notes/released/0.2.10.md b/shared/regex/change-notes/released/0.2.10.md
deleted file mode 100644
index 81c9722b19f..00000000000
--- a/shared/regex/change-notes/released/0.2.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.10
-
-No user-facing changes.
diff --git a/shared/regex/codeql-pack.release.yml b/shared/regex/codeql-pack.release.yml
index a71167814cb..d021cf0a6be 100644
--- a/shared/regex/codeql-pack.release.yml
+++ b/shared/regex/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.10
+lastReleaseVersion: 0.2.9
diff --git a/shared/regex/qlpack.yml b/shared/regex/qlpack.yml
index 0d4f485312f..ea3f7f9b238 100644
--- a/shared/regex/qlpack.yml
+++ b/shared/regex/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/regex
-version: 0.2.10
+version: 0.2.10-dev
groups: shared
library: true
dependencies:
diff --git a/shared/ssa/CHANGELOG.md b/shared/ssa/CHANGELOG.md
index a9161ff578b..01acfae0148 100644
--- a/shared/ssa/CHANGELOG.md
+++ b/shared/ssa/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.10
-
-No user-facing changes.
-
## 0.2.9
No user-facing changes.
diff --git a/shared/ssa/change-notes/released/0.2.10.md b/shared/ssa/change-notes/released/0.2.10.md
deleted file mode 100644
index 81c9722b19f..00000000000
--- a/shared/ssa/change-notes/released/0.2.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.10
-
-No user-facing changes.
diff --git a/shared/ssa/codeql-pack.release.yml b/shared/ssa/codeql-pack.release.yml
index a71167814cb..d021cf0a6be 100644
--- a/shared/ssa/codeql-pack.release.yml
+++ b/shared/ssa/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.10
+lastReleaseVersion: 0.2.9
diff --git a/shared/ssa/qlpack.yml b/shared/ssa/qlpack.yml
index 2ad254711a5..19304ad107f 100644
--- a/shared/ssa/qlpack.yml
+++ b/shared/ssa/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ssa
-version: 0.2.10
+version: 0.2.10-dev
groups: shared
library: true
dependencies:
diff --git a/shared/threat-models/CHANGELOG.md b/shared/threat-models/CHANGELOG.md
index a59e560c415..fba2a870356 100644
--- a/shared/threat-models/CHANGELOG.md
+++ b/shared/threat-models/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.0.9
-
-No user-facing changes.
-
## 0.0.8
No user-facing changes.
diff --git a/shared/threat-models/change-notes/released/0.0.9.md b/shared/threat-models/change-notes/released/0.0.9.md
deleted file mode 100644
index c9e17c6d6cf..00000000000
--- a/shared/threat-models/change-notes/released/0.0.9.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.0.9
-
-No user-facing changes.
diff --git a/shared/threat-models/codeql-pack.release.yml b/shared/threat-models/codeql-pack.release.yml
index ecdd64fbab8..58fdc6b45de 100644
--- a/shared/threat-models/codeql-pack.release.yml
+++ b/shared/threat-models/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.9
+lastReleaseVersion: 0.0.8
diff --git a/shared/threat-models/qlpack.yml b/shared/threat-models/qlpack.yml
index 60cbbc56fcb..d0ed9a913b2 100644
--- a/shared/threat-models/qlpack.yml
+++ b/shared/threat-models/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/threat-models
-version: 0.0.9
+version: 0.0.9-dev
library: true
groups: shared
dataExtensions:
diff --git a/shared/tutorial/CHANGELOG.md b/shared/tutorial/CHANGELOG.md
index 560ad058d5b..1db3a01af0b 100644
--- a/shared/tutorial/CHANGELOG.md
+++ b/shared/tutorial/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.10
-
-No user-facing changes.
-
## 0.2.9
No user-facing changes.
diff --git a/shared/tutorial/change-notes/released/0.2.10.md b/shared/tutorial/change-notes/released/0.2.10.md
deleted file mode 100644
index 81c9722b19f..00000000000
--- a/shared/tutorial/change-notes/released/0.2.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.10
-
-No user-facing changes.
diff --git a/shared/tutorial/codeql-pack.release.yml b/shared/tutorial/codeql-pack.release.yml
index a71167814cb..d021cf0a6be 100644
--- a/shared/tutorial/codeql-pack.release.yml
+++ b/shared/tutorial/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.10
+lastReleaseVersion: 0.2.9
diff --git a/shared/tutorial/qlpack.yml b/shared/tutorial/qlpack.yml
index 69116705c1b..b595ae9ee70 100644
--- a/shared/tutorial/qlpack.yml
+++ b/shared/tutorial/qlpack.yml
@@ -1,7 +1,7 @@
name: codeql/tutorial
description: Library for the CodeQL detective tutorials, helping new users learn to
write CodeQL queries.
-version: 0.2.10
+version: 0.2.10-dev
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/typetracking/CHANGELOG.md b/shared/typetracking/CHANGELOG.md
index 350f9ecbeae..afc857bc6bc 100644
--- a/shared/typetracking/CHANGELOG.md
+++ b/shared/typetracking/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.10
-
-No user-facing changes.
-
## 0.2.9
No user-facing changes.
diff --git a/shared/typetracking/change-notes/released/0.2.10.md b/shared/typetracking/change-notes/released/0.2.10.md
deleted file mode 100644
index 81c9722b19f..00000000000
--- a/shared/typetracking/change-notes/released/0.2.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.10
-
-No user-facing changes.
diff --git a/shared/typetracking/codeql-pack.release.yml b/shared/typetracking/codeql-pack.release.yml
index a71167814cb..d021cf0a6be 100644
--- a/shared/typetracking/codeql-pack.release.yml
+++ b/shared/typetracking/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.10
+lastReleaseVersion: 0.2.9
diff --git a/shared/typetracking/qlpack.yml b/shared/typetracking/qlpack.yml
index fbbdcf5162a..b55927f59bb 100644
--- a/shared/typetracking/qlpack.yml
+++ b/shared/typetracking/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typetracking
-version: 0.2.10
+version: 0.2.10-dev
groups: shared
library: true
dependencies:
diff --git a/shared/typos/CHANGELOG.md b/shared/typos/CHANGELOG.md
index 54b1eaa4d58..66c5871d982 100644
--- a/shared/typos/CHANGELOG.md
+++ b/shared/typos/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.10
-
-No user-facing changes.
-
## 0.2.9
No user-facing changes.
diff --git a/shared/typos/change-notes/released/0.2.10.md b/shared/typos/change-notes/released/0.2.10.md
deleted file mode 100644
index 81c9722b19f..00000000000
--- a/shared/typos/change-notes/released/0.2.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.10
-
-No user-facing changes.
diff --git a/shared/typos/codeql-pack.release.yml b/shared/typos/codeql-pack.release.yml
index a71167814cb..d021cf0a6be 100644
--- a/shared/typos/codeql-pack.release.yml
+++ b/shared/typos/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.10
+lastReleaseVersion: 0.2.9
diff --git a/shared/typos/qlpack.yml b/shared/typos/qlpack.yml
index 4d59d9b3c34..644bfe11bff 100644
--- a/shared/typos/qlpack.yml
+++ b/shared/typos/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typos
-version: 0.2.10
+version: 0.2.10-dev
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/util/CHANGELOG.md b/shared/util/CHANGELOG.md
index 1ca1f71bcbc..63832e927fa 100644
--- a/shared/util/CHANGELOG.md
+++ b/shared/util/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.10
-
-No user-facing changes.
-
## 0.2.9
No user-facing changes.
diff --git a/shared/util/change-notes/released/0.2.10.md b/shared/util/change-notes/released/0.2.10.md
deleted file mode 100644
index 81c9722b19f..00000000000
--- a/shared/util/change-notes/released/0.2.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.10
-
-No user-facing changes.
diff --git a/shared/util/codeql-pack.release.yml b/shared/util/codeql-pack.release.yml
index a71167814cb..d021cf0a6be 100644
--- a/shared/util/codeql-pack.release.yml
+++ b/shared/util/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.10
+lastReleaseVersion: 0.2.9
diff --git a/shared/util/qlpack.yml b/shared/util/qlpack.yml
index 28ed738a93d..ca1a866a53d 100644
--- a/shared/util/qlpack.yml
+++ b/shared/util/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/util
-version: 0.2.10
+version: 0.2.10-dev
groups: shared
library: true
dependencies: null
diff --git a/shared/yaml/CHANGELOG.md b/shared/yaml/CHANGELOG.md
index 9fd5ebc26ab..e5495abcd50 100644
--- a/shared/yaml/CHANGELOG.md
+++ b/shared/yaml/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.10
-
-No user-facing changes.
-
## 0.2.9
No user-facing changes.
diff --git a/shared/yaml/change-notes/released/0.2.10.md b/shared/yaml/change-notes/released/0.2.10.md
deleted file mode 100644
index 81c9722b19f..00000000000
--- a/shared/yaml/change-notes/released/0.2.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.10
-
-No user-facing changes.
diff --git a/shared/yaml/codeql-pack.release.yml b/shared/yaml/codeql-pack.release.yml
index a71167814cb..d021cf0a6be 100644
--- a/shared/yaml/codeql-pack.release.yml
+++ b/shared/yaml/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.10
+lastReleaseVersion: 0.2.9
diff --git a/shared/yaml/qlpack.yml b/shared/yaml/qlpack.yml
index 9643ffcec66..de5b47e120a 100644
--- a/shared/yaml/qlpack.yml
+++ b/shared/yaml/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/yaml
-version: 0.2.10
+version: 0.2.10-dev
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/swift/ql/lib/CHANGELOG.md b/swift/ql/lib/CHANGELOG.md
index 8f14bfcedc9..e88cd0259cc 100644
--- a/swift/ql/lib/CHANGELOG.md
+++ b/swift/ql/lib/CHANGELOG.md
@@ -1,9 +1,3 @@
-## 0.3.10
-
-### Bug Fixes
-
-* Fixed an issue where `TypeDecl.getFullName` would get stuck in an loop and fail when minor database inconsistencies are present.
-
## 0.3.9
### Minor Analysis Improvements
diff --git a/swift/ql/lib/change-notes/released/0.3.10.md b/swift/ql/lib/change-notes/2024-02-22-extension-patch.md
similarity index 83%
rename from swift/ql/lib/change-notes/released/0.3.10.md
rename to swift/ql/lib/change-notes/2024-02-22-extension-patch.md
index 9d6286ff58a..7bd78f3b785 100644
--- a/swift/ql/lib/change-notes/released/0.3.10.md
+++ b/swift/ql/lib/change-notes/2024-02-22-extension-patch.md
@@ -1,5 +1,4 @@
-## 0.3.10
-
-### Bug Fixes
-
+---
+category: fix
+---
* Fixed an issue where `TypeDecl.getFullName` would get stuck in an loop and fail when minor database inconsistencies are present.
diff --git a/swift/ql/lib/codeql-pack.release.yml b/swift/ql/lib/codeql-pack.release.yml
index 76ca0ac8ba7..3fa5180bcb4 100644
--- a/swift/ql/lib/codeql-pack.release.yml
+++ b/swift/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.3.10
+lastReleaseVersion: 0.3.9
diff --git a/swift/ql/lib/qlpack.yml b/swift/ql/lib/qlpack.yml
index 70ec4798ea8..a37a4cb3d58 100644
--- a/swift/ql/lib/qlpack.yml
+++ b/swift/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-all
-version: 0.3.10
+version: 0.3.10-dev
groups: swift
extractor: swift
dbscheme: swift.dbscheme
diff --git a/swift/ql/src/CHANGELOG.md b/swift/ql/src/CHANGELOG.md
index bda9834c9bc..96615d06972 100644
--- a/swift/ql/src/CHANGELOG.md
+++ b/swift/ql/src/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.3.10
-
-No user-facing changes.
-
## 0.3.9
### New Queries
diff --git a/swift/ql/src/change-notes/released/0.3.10.md b/swift/ql/src/change-notes/released/0.3.10.md
deleted file mode 100644
index 925a48fc52e..00000000000
--- a/swift/ql/src/change-notes/released/0.3.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.3.10
-
-No user-facing changes.
diff --git a/swift/ql/src/codeql-pack.release.yml b/swift/ql/src/codeql-pack.release.yml
index 76ca0ac8ba7..3fa5180bcb4 100644
--- a/swift/ql/src/codeql-pack.release.yml
+++ b/swift/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.3.10
+lastReleaseVersion: 0.3.9
diff --git a/swift/ql/src/qlpack.yml b/swift/ql/src/qlpack.yml
index ba66b065529..e3ead42c98b 100644
--- a/swift/ql/src/qlpack.yml
+++ b/swift/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-queries
-version: 0.3.10
+version: 0.3.10-dev
groups:
- swift
- queries
From 2f058ffb4d0bc7486717a95744c240b9eef87fe6 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
Date: Wed, 6 Mar 2024 20:56:51 +0000
Subject: [PATCH 038/309] Release preparation for version 2.16.4
---
cpp/ql/lib/CHANGELOG.md | 6 ++++++
.../0.12.7.md} | 9 +++++----
cpp/ql/lib/codeql-pack.release.yml | 2 +-
cpp/ql/lib/qlpack.yml | 2 +-
cpp/ql/src/CHANGELOG.md | 7 +++++++
.../2024-02-29-non-constant-format-path-query.md | 4 ----
.../0.9.6.md} | 8 +++++---
cpp/ql/src/codeql-pack.release.yml | 2 +-
cpp/ql/src/qlpack.yml | 2 +-
csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md | 4 ++++
.../Solorigate/lib/change-notes/released/1.7.10.md | 3 +++
.../Solorigate/lib/codeql-pack.release.yml | 2 +-
csharp/ql/campaigns/Solorigate/lib/qlpack.yml | 2 +-
csharp/ql/campaigns/Solorigate/src/CHANGELOG.md | 4 ++++
.../Solorigate/src/change-notes/released/1.7.10.md | 3 +++
.../Solorigate/src/codeql-pack.release.yml | 2 +-
csharp/ql/campaigns/Solorigate/src/qlpack.yml | 2 +-
csharp/ql/lib/CHANGELOG.md | 14 ++++++++++++++
.../change-notes/2024-02-21-getonly-properties.md | 4 ----
.../ql/lib/change-notes/2024-02-22-no-db-stats.md | 4 ----
.../change-notes/2024-02-23-compiler-generated.md | 4 ----
.../2024-02-26-variable-capture-flow.md | 4 ----
.../2024-02-28-experimental-attribute.md | 4 ----
.../2024-02-28-refreadonly-parameter.md | 4 ----
csharp/ql/lib/change-notes/released/0.8.10.md | 13 +++++++++++++
csharp/ql/lib/codeql-pack.release.yml | 2 +-
csharp/ql/lib/qlpack.yml | 2 +-
csharp/ql/src/CHANGELOG.md | 6 ++++++
.../0.8.10.md} | 9 +++++----
csharp/ql/src/codeql-pack.release.yml | 2 +-
csharp/ql/src/qlpack.yml | 2 +-
go/ql/consistency-queries/CHANGELOG.md | 4 ++++
.../change-notes/released/0.0.9.md | 3 +++
go/ql/consistency-queries/codeql-pack.release.yml | 2 +-
go/ql/consistency-queries/qlpack.yml | 2 +-
go/ql/lib/CHANGELOG.md | 11 +++++++++++
.../lib/change-notes/2024-02-14-range-map-read.md | 4 ----
.../0.7.10.md} | 11 ++++++++---
go/ql/lib/codeql-pack.release.yml | 2 +-
go/ql/lib/qlpack.yml | 2 +-
go/ql/src/CHANGELOG.md | 4 ++++
go/ql/src/change-notes/released/0.7.10.md | 3 +++
go/ql/src/codeql-pack.release.yml | 2 +-
go/ql/src/qlpack.yml | 2 +-
java/ql/automodel/src/CHANGELOG.md | 4 ++++
.../automodel/src/change-notes/released/0.0.17.md | 3 +++
java/ql/automodel/src/codeql-pack.release.yml | 2 +-
java/ql/automodel/src/qlpack.yml | 2 +-
java/ql/lib/CHANGELOG.md | 11 +++++++++++
.../change-notes/2024-02-23-widget-flowsteps.md | 4 ----
java/ql/lib/change-notes/2024-02-27-error-types.md | 4 ----
.../lib/change-notes/2024-02-27-mvnw-versions.md | 4 ----
java/ql/lib/change-notes/released/0.8.10.md | 10 ++++++++++
java/ql/lib/codeql-pack.release.yml | 2 +-
java/ql/lib/qlpack.yml | 2 +-
java/ql/src/CHANGELOG.md | 10 ++++++++++
.../2024-02-12-android-insecure-keys.md | 4 ----
.../0.8.10.md} | 11 ++++++++---
java/ql/src/codeql-pack.release.yml | 2 +-
java/ql/src/qlpack.yml | 2 +-
javascript/ql/lib/CHANGELOG.md | 4 ++++
javascript/ql/lib/change-notes/released/0.8.10.md | 3 +++
javascript/ql/lib/codeql-pack.release.yml | 2 +-
javascript/ql/lib/qlpack.yml | 2 +-
javascript/ql/src/CHANGELOG.md | 4 ++++
javascript/ql/src/change-notes/released/0.8.10.md | 3 +++
javascript/ql/src/codeql-pack.release.yml | 2 +-
javascript/ql/src/qlpack.yml | 2 +-
misc/suite-helpers/CHANGELOG.md | 4 ++++
misc/suite-helpers/change-notes/released/0.7.10.md | 3 +++
misc/suite-helpers/codeql-pack.release.yml | 2 +-
misc/suite-helpers/qlpack.yml | 2 +-
python/ql/lib/CHANGELOG.md | 7 +++++++
.../2024-02-28-iterable-unpacking-module-scope.md | 4 ----
.../0.11.10.md} | 8 +++++---
python/ql/lib/codeql-pack.release.yml | 2 +-
python/ql/lib/qlpack.yml | 2 +-
python/ql/src/CHANGELOG.md | 6 ++++++
.../0.9.10.md} | 7 ++++---
python/ql/src/codeql-pack.release.yml | 2 +-
python/ql/src/qlpack.yml | 2 +-
ruby/ql/lib/CHANGELOG.md | 9 +++++++++
...2024-02-15-activerecord_connection_sql_sinks.md | 4 ----
.../2024-02-20-activerecord-sql-sink-arguments.md | 4 ----
.../lib/change-notes/2024-02-26-arel-sqlliteral.md | 4 ----
.../lib/change-notes/2024-02-29-i18n-translate.md | 4 ----
ruby/ql/lib/change-notes/released/0.8.10.md | 8 ++++++++
ruby/ql/lib/codeql-pack.release.yml | 2 +-
ruby/ql/lib/qlpack.yml | 2 +-
ruby/ql/src/CHANGELOG.md | 7 +++++++
.../2024-02-13-rails-more-request-sources.md | 4 ----
.../0.8.10.md} | 10 ++++++----
ruby/ql/src/codeql-pack.release.yml | 2 +-
ruby/ql/src/qlpack.yml | 2 +-
shared/controlflow/CHANGELOG.md | 4 ++++
shared/controlflow/change-notes/released/0.1.10.md | 3 +++
shared/controlflow/codeql-pack.release.yml | 2 +-
shared/controlflow/qlpack.yml | 2 +-
shared/dataflow/CHANGELOG.md | 4 ++++
shared/dataflow/change-notes/released/0.2.1.md | 3 +++
shared/dataflow/codeql-pack.release.yml | 2 +-
shared/dataflow/qlpack.yml | 2 +-
shared/mad/CHANGELOG.md | 4 ++++
shared/mad/change-notes/released/0.2.10.md | 3 +++
shared/mad/codeql-pack.release.yml | 2 +-
shared/mad/qlpack.yml | 2 +-
shared/rangeanalysis/CHANGELOG.md | 4 ++++
.../rangeanalysis/change-notes/released/0.0.9.md | 3 +++
shared/rangeanalysis/codeql-pack.release.yml | 2 +-
shared/rangeanalysis/qlpack.yml | 2 +-
shared/regex/CHANGELOG.md | 4 ++++
shared/regex/change-notes/released/0.2.10.md | 3 +++
shared/regex/codeql-pack.release.yml | 2 +-
shared/regex/qlpack.yml | 2 +-
shared/ssa/CHANGELOG.md | 4 ++++
shared/ssa/change-notes/released/0.2.10.md | 3 +++
shared/ssa/codeql-pack.release.yml | 2 +-
shared/ssa/qlpack.yml | 2 +-
shared/threat-models/CHANGELOG.md | 4 ++++
.../threat-models/change-notes/released/0.0.9.md | 3 +++
shared/threat-models/codeql-pack.release.yml | 2 +-
shared/threat-models/qlpack.yml | 2 +-
shared/tutorial/CHANGELOG.md | 4 ++++
shared/tutorial/change-notes/released/0.2.10.md | 3 +++
shared/tutorial/codeql-pack.release.yml | 2 +-
shared/tutorial/qlpack.yml | 2 +-
shared/typetracking/CHANGELOG.md | 4 ++++
.../typetracking/change-notes/released/0.2.10.md | 3 +++
shared/typetracking/codeql-pack.release.yml | 2 +-
shared/typetracking/qlpack.yml | 2 +-
shared/typos/CHANGELOG.md | 4 ++++
shared/typos/change-notes/released/0.2.10.md | 3 +++
shared/typos/codeql-pack.release.yml | 2 +-
shared/typos/qlpack.yml | 2 +-
shared/util/CHANGELOG.md | 4 ++++
shared/util/change-notes/released/0.2.10.md | 3 +++
shared/util/codeql-pack.release.yml | 2 +-
shared/util/qlpack.yml | 2 +-
shared/yaml/CHANGELOG.md | 4 ++++
shared/yaml/change-notes/released/0.2.10.md | 3 +++
shared/yaml/codeql-pack.release.yml | 2 +-
shared/yaml/qlpack.yml | 2 +-
swift/ql/lib/CHANGELOG.md | 6 ++++++
.../0.3.10.md} | 7 ++++---
swift/ql/lib/codeql-pack.release.yml | 2 +-
swift/ql/lib/qlpack.yml | 2 +-
swift/ql/src/CHANGELOG.md | 4 ++++
swift/ql/src/change-notes/released/0.3.10.md | 3 +++
swift/ql/src/codeql-pack.release.yml | 2 +-
swift/ql/src/qlpack.yml | 2 +-
150 files changed, 394 insertions(+), 168 deletions(-)
rename cpp/ql/lib/change-notes/{2024-02-26-ir-named-destructors.md => released/0.12.7.md} (54%)
delete mode 100644 cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md
rename cpp/ql/src/change-notes/{2024-02-16-modelled-functions-block-flow.md => released/0.9.6.md} (77%)
create mode 100644 csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md
create mode 100644 csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md
create mode 100644 csharp/ql/lib/change-notes/released/0.8.10.md
rename csharp/ql/src/change-notes/{2024-02-06-threat-models.md => released/0.8.10.md} (88%)
create mode 100644 go/ql/consistency-queries/change-notes/released/0.0.9.md
delete mode 100644 go/ql/lib/change-notes/2024-02-14-range-map-read.md
rename go/ql/lib/change-notes/{2024-03-04-autobuilder-changes.md => released/0.7.10.md} (68%)
create mode 100644 go/ql/src/change-notes/released/0.7.10.md
create mode 100644 java/ql/automodel/src/change-notes/released/0.0.17.md
delete mode 100644 java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md
delete mode 100644 java/ql/lib/change-notes/2024-02-27-error-types.md
delete mode 100644 java/ql/lib/change-notes/2024-02-27-mvnw-versions.md
create mode 100644 java/ql/lib/change-notes/released/0.8.10.md
delete mode 100644 java/ql/src/change-notes/2024-02-12-android-insecure-keys.md
rename java/ql/src/change-notes/{2024-03-04-sensitive-log-remove-null-from-sources.md => released/0.8.10.md} (54%)
create mode 100644 javascript/ql/lib/change-notes/released/0.8.10.md
create mode 100644 javascript/ql/src/change-notes/released/0.8.10.md
create mode 100644 misc/suite-helpers/change-notes/released/0.7.10.md
delete mode 100644 python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md
rename python/ql/lib/change-notes/{2024-03-01-dict-update-content.md => released/0.11.10.md} (52%)
rename python/ql/src/change-notes/{2024-03-04-nosql-injection.md => released/0.9.10.md} (81%)
delete mode 100644 ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md
delete mode 100644 ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md
delete mode 100644 ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
delete mode 100644 ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
create mode 100644 ruby/ql/lib/change-notes/released/0.8.10.md
delete mode 100644 ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md
rename ruby/ql/src/change-notes/{2024-03-01-method-code-injection-sinks.md => released/0.8.10.md} (51%)
create mode 100644 shared/controlflow/change-notes/released/0.1.10.md
create mode 100644 shared/dataflow/change-notes/released/0.2.1.md
create mode 100644 shared/mad/change-notes/released/0.2.10.md
create mode 100644 shared/rangeanalysis/change-notes/released/0.0.9.md
create mode 100644 shared/regex/change-notes/released/0.2.10.md
create mode 100644 shared/ssa/change-notes/released/0.2.10.md
create mode 100644 shared/threat-models/change-notes/released/0.0.9.md
create mode 100644 shared/tutorial/change-notes/released/0.2.10.md
create mode 100644 shared/typetracking/change-notes/released/0.2.10.md
create mode 100644 shared/typos/change-notes/released/0.2.10.md
create mode 100644 shared/util/change-notes/released/0.2.10.md
create mode 100644 shared/yaml/change-notes/released/0.2.10.md
rename swift/ql/lib/change-notes/{2024-02-22-extension-patch.md => released/0.3.10.md} (83%)
create mode 100644 swift/ql/src/change-notes/released/0.3.10.md
diff --git a/cpp/ql/lib/CHANGELOG.md b/cpp/ql/lib/CHANGELOG.md
index b3091ec37d8..e1c0dfbecd9 100644
--- a/cpp/ql/lib/CHANGELOG.md
+++ b/cpp/ql/lib/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 0.12.7
+
+### Minor Analysis Improvements
+
+* Added destructors for named objects to the intermediate representation.
+
## 0.12.6
### New Features
diff --git a/cpp/ql/lib/change-notes/2024-02-26-ir-named-destructors.md b/cpp/ql/lib/change-notes/released/0.12.7.md
similarity index 54%
rename from cpp/ql/lib/change-notes/2024-02-26-ir-named-destructors.md
rename to cpp/ql/lib/change-notes/released/0.12.7.md
index 4e35decaf8e..856a8b665c7 100644
--- a/cpp/ql/lib/change-notes/2024-02-26-ir-named-destructors.md
+++ b/cpp/ql/lib/change-notes/released/0.12.7.md
@@ -1,4 +1,5 @@
----
-category: minorAnalysis
----
-* Added destructors for named objects to the intermediate representation.
\ No newline at end of file
+## 0.12.7
+
+### Minor Analysis Improvements
+
+* Added destructors for named objects to the intermediate representation.
diff --git a/cpp/ql/lib/codeql-pack.release.yml b/cpp/ql/lib/codeql-pack.release.yml
index 170a312c104..20419e9c610 100644
--- a/cpp/ql/lib/codeql-pack.release.yml
+++ b/cpp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.12.6
+lastReleaseVersion: 0.12.7
diff --git a/cpp/ql/lib/qlpack.yml b/cpp/ql/lib/qlpack.yml
index 8e201fff594..3bb9229bf94 100644
--- a/cpp/ql/lib/qlpack.yml
+++ b/cpp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-all
-version: 0.12.7-dev
+version: 0.12.7
groups: cpp
dbscheme: semmlecode.cpp.dbscheme
extractor: cpp
diff --git a/cpp/ql/src/CHANGELOG.md b/cpp/ql/src/CHANGELOG.md
index ffcd73ff5d7..f6acd424bb0 100644
--- a/cpp/ql/src/CHANGELOG.md
+++ b/cpp/ql/src/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 0.9.6
+
+### Minor Analysis Improvements
+
+* The "non-constant format string" query (`cpp/non-constant-format`) has been converted to a `path-problem` query.
+* The new C/C++ dataflow and taint-tracking libraries (`semmle.code.cpp.dataflow.new.DataFlow` and `semmle.code.cpp.dataflow.new.TaintTracking`) now implicitly assume that dataflow and taint modelled via `DataFlowFunction` and `TaintFunction` always fully overwrite their buffers and thus act as flow barriers. As a result, many dataflow and taint-tracking queries now produce fewer false positives. To remove this assumption and go back to the previous behavior for a given model, one can override the new `isPartialWrite` predicate.
+
## 0.9.5
### Minor Analysis Improvements
diff --git a/cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md b/cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md
deleted file mode 100644
index 2e5933a61e8..00000000000
--- a/cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The "non-constant format string" query (`cpp/non-constant-format`) has been converted to a `path-problem` query.
\ No newline at end of file
diff --git a/cpp/ql/src/change-notes/2024-02-16-modelled-functions-block-flow.md b/cpp/ql/src/change-notes/released/0.9.6.md
similarity index 77%
rename from cpp/ql/src/change-notes/2024-02-16-modelled-functions-block-flow.md
rename to cpp/ql/src/change-notes/released/0.9.6.md
index d6ef3c3e056..0c85f3f9f0f 100644
--- a/cpp/ql/src/change-notes/2024-02-16-modelled-functions-block-flow.md
+++ b/cpp/ql/src/change-notes/released/0.9.6.md
@@ -1,4 +1,6 @@
----
-category: minorAnalysis
----
+## 0.9.6
+
+### Minor Analysis Improvements
+
+* The "non-constant format string" query (`cpp/non-constant-format`) has been converted to a `path-problem` query.
* The new C/C++ dataflow and taint-tracking libraries (`semmle.code.cpp.dataflow.new.DataFlow` and `semmle.code.cpp.dataflow.new.TaintTracking`) now implicitly assume that dataflow and taint modelled via `DataFlowFunction` and `TaintFunction` always fully overwrite their buffers and thus act as flow barriers. As a result, many dataflow and taint-tracking queries now produce fewer false positives. To remove this assumption and go back to the previous behavior for a given model, one can override the new `isPartialWrite` predicate.
diff --git a/cpp/ql/src/codeql-pack.release.yml b/cpp/ql/src/codeql-pack.release.yml
index 460240feaff..19139c132b2 100644
--- a/cpp/ql/src/codeql-pack.release.yml
+++ b/cpp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.9.5
+lastReleaseVersion: 0.9.6
diff --git a/cpp/ql/src/qlpack.yml b/cpp/ql/src/qlpack.yml
index 31bd20166b2..4052647bb97 100644
--- a/cpp/ql/src/qlpack.yml
+++ b/cpp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-queries
-version: 0.9.6-dev
+version: 0.9.6
groups:
- cpp
- queries
diff --git a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
index 190b83b0f25..82eacfc84f7 100644
--- a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
+++ b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.7.10
+
+No user-facing changes.
+
## 1.7.9
No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md
new file mode 100644
index 00000000000..8e8007d8475
--- /dev/null
+++ b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md
@@ -0,0 +1,3 @@
+## 1.7.10
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
index 678da6bc37e..31c7fe07020 100644
--- a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.7.9
+lastReleaseVersion: 1.7.10
diff --git a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
index 7e643b0fac3..ee993bed0c9 100644
--- a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-all
-version: 1.7.10-dev
+version: 1.7.10
groups:
- csharp
- solorigate
diff --git a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
index 190b83b0f25..82eacfc84f7 100644
--- a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
+++ b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.7.10
+
+No user-facing changes.
+
## 1.7.9
No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md
new file mode 100644
index 00000000000..8e8007d8475
--- /dev/null
+++ b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md
@@ -0,0 +1,3 @@
+## 1.7.10
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
index 678da6bc37e..31c7fe07020 100644
--- a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
+++ b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.7.9
+lastReleaseVersion: 1.7.10
diff --git a/csharp/ql/campaigns/Solorigate/src/qlpack.yml b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
index 8654bbfd031..1f421754fc8 100644
--- a/csharp/ql/campaigns/Solorigate/src/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-queries
-version: 1.7.10-dev
+version: 1.7.10
groups:
- csharp
- solorigate
diff --git a/csharp/ql/lib/CHANGELOG.md b/csharp/ql/lib/CHANGELOG.md
index 95fd64c5270..16cc14259e1 100644
--- a/csharp/ql/lib/CHANGELOG.md
+++ b/csharp/ql/lib/CHANGELOG.md
@@ -1,3 +1,17 @@
+## 0.8.10
+
+### Major Analysis Improvements
+
+* Improved support for flow through captured variables that properly adheres to inter-procedural control flow.
+* We no longer make use of CodeQL database stats, which may affect join-orders in custom queries. It is therefore recommended to test performance of custom queries after upgrading to this version.
+
+### Minor Analysis Improvements
+
+* C# 12: Add QL library support (`ExperimentalAttribute`) for the experimental attribute.
+* C# 12: Add extractor and QL library support for `ref readonly` parameters.
+* C#: The table `expr_compiler_generated` has been deleted and its content has been added to `compiler_generated`.
+* Data flow via get only properties like `public object Obj { get; }` is now captured by the data flow library.
+
## 0.8.9
### Minor Analysis Improvements
diff --git a/csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md b/csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md
deleted file mode 100644
index 6bb8e99c71e..00000000000
--- a/csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Data flow via get only properties like `public object Obj { get; }` is now captured by the data flow library.
diff --git a/csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md b/csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md
deleted file mode 100644
index d6ffbd523ac..00000000000
--- a/csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: majorAnalysis
----
-* We no longer make use of CodeQL database stats, which may affect join-orders in custom queries. It is therefore recommended to test performance of custom queries after upgrading to this version.
diff --git a/csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md b/csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md
deleted file mode 100644
index 9b1739b9b6d..00000000000
--- a/csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* C#: The table `expr_compiler_generated` has been deleted and its content has been added to `compiler_generated`.
diff --git a/csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md b/csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md
deleted file mode 100644
index 66ab65083dc..00000000000
--- a/csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: majorAnalysis
----
-* Improved support for flow through captured variables that properly adheres to inter-procedural control flow.
\ No newline at end of file
diff --git a/csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md b/csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md
deleted file mode 100644
index 8749c790954..00000000000
--- a/csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* C# 12: Add QL library support (`ExperimentalAttribute`) for the experimental attribute.
diff --git a/csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md b/csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md
deleted file mode 100644
index 586b5341d29..00000000000
--- a/csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* C# 12: Add extractor and QL library support for `ref readonly` parameters.
diff --git a/csharp/ql/lib/change-notes/released/0.8.10.md b/csharp/ql/lib/change-notes/released/0.8.10.md
new file mode 100644
index 00000000000..f591ddc5b21
--- /dev/null
+++ b/csharp/ql/lib/change-notes/released/0.8.10.md
@@ -0,0 +1,13 @@
+## 0.8.10
+
+### Major Analysis Improvements
+
+* Improved support for flow through captured variables that properly adheres to inter-procedural control flow.
+* We no longer make use of CodeQL database stats, which may affect join-orders in custom queries. It is therefore recommended to test performance of custom queries after upgrading to this version.
+
+### Minor Analysis Improvements
+
+* C# 12: Add QL library support (`ExperimentalAttribute`) for the experimental attribute.
+* C# 12: Add extractor and QL library support for `ref readonly` parameters.
+* C#: The table `expr_compiler_generated` has been deleted and its content has been added to `compiler_generated`.
+* Data flow via get only properties like `public object Obj { get; }` is now captured by the data flow library.
diff --git a/csharp/ql/lib/codeql-pack.release.yml b/csharp/ql/lib/codeql-pack.release.yml
index 5290c29b7fe..0521f0f75fa 100644
--- a/csharp/ql/lib/codeql-pack.release.yml
+++ b/csharp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/csharp/ql/lib/qlpack.yml b/csharp/ql/lib/qlpack.yml
index d75ea3c6320..93c5c1120a2 100644
--- a/csharp/ql/lib/qlpack.yml
+++ b/csharp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-all
-version: 0.8.10-dev
+version: 0.8.10
groups: csharp
dbscheme: semmlecode.csharp.dbscheme
extractor: csharp
diff --git a/csharp/ql/src/CHANGELOG.md b/csharp/ql/src/CHANGELOG.md
index 9fe1609363f..46c939e5cee 100644
--- a/csharp/ql/src/CHANGELOG.md
+++ b/csharp/ql/src/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. The changed queries are `cs/code-injection`, `cs/command-line-injection`, `cs/user-controlled-bypass`, `cs/count-untrusted-data-external-api`, `cs/untrusted-data-to-external-api`, `cs/ldap-injection`, `cs/log-forging`, `cs/xml/missing-validation`, `cs/redos`, `cs/regex-injection`, `cs/resource-injection`, `cs/sql-injection`, `cs/path-injection`, `cs/unsafe-deserialization-untrusted-input`, `cs/web/unvalidated-url-redirection`, `cs/xml/insecure-dtd-handling`, `cs/xml/xpath-injection`, `cs/web/xss`, and `cs/uncontrolled-format-string`.
+
## 0.8.9
### Minor Analysis Improvements
diff --git a/csharp/ql/src/change-notes/2024-02-06-threat-models.md b/csharp/ql/src/change-notes/released/0.8.10.md
similarity index 88%
rename from csharp/ql/src/change-notes/2024-02-06-threat-models.md
rename to csharp/ql/src/change-notes/released/0.8.10.md
index 69ac4e4dc17..702161c3d28 100644
--- a/csharp/ql/src/change-notes/2024-02-06-threat-models.md
+++ b/csharp/ql/src/change-notes/released/0.8.10.md
@@ -1,4 +1,5 @@
----
-category: minorAnalysis
----
-* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. The changed queries are `cs/code-injection`, `cs/command-line-injection`, `cs/user-controlled-bypass`, `cs/count-untrusted-data-external-api`, `cs/untrusted-data-to-external-api`, `cs/ldap-injection`, `cs/log-forging`, `cs/xml/missing-validation`, `cs/redos`, `cs/regex-injection`, `cs/resource-injection`, `cs/sql-injection`, `cs/path-injection`, `cs/unsafe-deserialization-untrusted-input`, `cs/web/unvalidated-url-redirection`, `cs/xml/insecure-dtd-handling`, `cs/xml/xpath-injection`, `cs/web/xss`, and `cs/uncontrolled-format-string`.
\ No newline at end of file
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. The changed queries are `cs/code-injection`, `cs/command-line-injection`, `cs/user-controlled-bypass`, `cs/count-untrusted-data-external-api`, `cs/untrusted-data-to-external-api`, `cs/ldap-injection`, `cs/log-forging`, `cs/xml/missing-validation`, `cs/redos`, `cs/regex-injection`, `cs/resource-injection`, `cs/sql-injection`, `cs/path-injection`, `cs/unsafe-deserialization-untrusted-input`, `cs/web/unvalidated-url-redirection`, `cs/xml/insecure-dtd-handling`, `cs/xml/xpath-injection`, `cs/web/xss`, and `cs/uncontrolled-format-string`.
diff --git a/csharp/ql/src/codeql-pack.release.yml b/csharp/ql/src/codeql-pack.release.yml
index 5290c29b7fe..0521f0f75fa 100644
--- a/csharp/ql/src/codeql-pack.release.yml
+++ b/csharp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/csharp/ql/src/qlpack.yml b/csharp/ql/src/qlpack.yml
index 9ee23cc7307..46384094b19 100644
--- a/csharp/ql/src/qlpack.yml
+++ b/csharp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-queries
-version: 0.8.10-dev
+version: 0.8.10
groups:
- csharp
- queries
diff --git a/go/ql/consistency-queries/CHANGELOG.md b/go/ql/consistency-queries/CHANGELOG.md
index fba2a870356..a59e560c415 100644
--- a/go/ql/consistency-queries/CHANGELOG.md
+++ b/go/ql/consistency-queries/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.0.9
+
+No user-facing changes.
+
## 0.0.8
No user-facing changes.
diff --git a/go/ql/consistency-queries/change-notes/released/0.0.9.md b/go/ql/consistency-queries/change-notes/released/0.0.9.md
new file mode 100644
index 00000000000..c9e17c6d6cf
--- /dev/null
+++ b/go/ql/consistency-queries/change-notes/released/0.0.9.md
@@ -0,0 +1,3 @@
+## 0.0.9
+
+No user-facing changes.
diff --git a/go/ql/consistency-queries/codeql-pack.release.yml b/go/ql/consistency-queries/codeql-pack.release.yml
index 58fdc6b45de..ecdd64fbab8 100644
--- a/go/ql/consistency-queries/codeql-pack.release.yml
+++ b/go/ql/consistency-queries/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.8
+lastReleaseVersion: 0.0.9
diff --git a/go/ql/consistency-queries/qlpack.yml b/go/ql/consistency-queries/qlpack.yml
index b574796b995..d5a2fbee5f1 100644
--- a/go/ql/consistency-queries/qlpack.yml
+++ b/go/ql/consistency-queries/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql-go-consistency-queries
-version: 0.0.9-dev
+version: 0.0.9
groups:
- go
- queries
diff --git a/go/ql/lib/CHANGELOG.md b/go/ql/lib/CHANGELOG.md
index 65a2376217b..fee5fd37a26 100644
--- a/go/ql/lib/CHANGELOG.md
+++ b/go/ql/lib/CHANGELOG.md
@@ -1,3 +1,14 @@
+## 0.7.10
+
+### Major Analysis Improvements
+
+* We have significantly improved the Go autobuilder to understand a greater range of project layouts, which allows Go source files to be analysed that could previously not be processed.
+* Go 1.22 has been included in the range of supported Go versions.
+
+### Bug Fixes
+
+* Fixed dataflow out of a `map` using a `range` statement.
+
## 0.7.9
No user-facing changes.
diff --git a/go/ql/lib/change-notes/2024-02-14-range-map-read.md b/go/ql/lib/change-notes/2024-02-14-range-map-read.md
deleted file mode 100644
index ea45737a72e..00000000000
--- a/go/ql/lib/change-notes/2024-02-14-range-map-read.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: fix
----
-* Fixed dataflow out of a `map` using a `range` statement.
diff --git a/go/ql/lib/change-notes/2024-03-04-autobuilder-changes.md b/go/ql/lib/change-notes/released/0.7.10.md
similarity index 68%
rename from go/ql/lib/change-notes/2024-03-04-autobuilder-changes.md
rename to go/ql/lib/change-notes/released/0.7.10.md
index 0442a571029..55954f8a394 100644
--- a/go/ql/lib/change-notes/2024-03-04-autobuilder-changes.md
+++ b/go/ql/lib/change-notes/released/0.7.10.md
@@ -1,5 +1,10 @@
----
-category: majorAnalysis
----
+## 0.7.10
+
+### Major Analysis Improvements
+
* We have significantly improved the Go autobuilder to understand a greater range of project layouts, which allows Go source files to be analysed that could previously not be processed.
* Go 1.22 has been included in the range of supported Go versions.
+
+### Bug Fixes
+
+* Fixed dataflow out of a `map` using a `range` statement.
diff --git a/go/ql/lib/codeql-pack.release.yml b/go/ql/lib/codeql-pack.release.yml
index 576395f3405..67518567297 100644
--- a/go/ql/lib/codeql-pack.release.yml
+++ b/go/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.7.9
+lastReleaseVersion: 0.7.10
diff --git a/go/ql/lib/qlpack.yml b/go/ql/lib/qlpack.yml
index f21e478efa6..8cc190fa880 100644
--- a/go/ql/lib/qlpack.yml
+++ b/go/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-all
-version: 0.7.10-dev
+version: 0.7.10
groups: go
dbscheme: go.dbscheme
extractor: go
diff --git a/go/ql/src/CHANGELOG.md b/go/ql/src/CHANGELOG.md
index d95165a3a34..24e38b9890e 100644
--- a/go/ql/src/CHANGELOG.md
+++ b/go/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.7.10
+
+No user-facing changes.
+
## 0.7.9
### New Queries
diff --git a/go/ql/src/change-notes/released/0.7.10.md b/go/ql/src/change-notes/released/0.7.10.md
new file mode 100644
index 00000000000..989c5b8f682
--- /dev/null
+++ b/go/ql/src/change-notes/released/0.7.10.md
@@ -0,0 +1,3 @@
+## 0.7.10
+
+No user-facing changes.
diff --git a/go/ql/src/codeql-pack.release.yml b/go/ql/src/codeql-pack.release.yml
index 576395f3405..67518567297 100644
--- a/go/ql/src/codeql-pack.release.yml
+++ b/go/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.7.9
+lastReleaseVersion: 0.7.10
diff --git a/go/ql/src/qlpack.yml b/go/ql/src/qlpack.yml
index d91cab59612..4ded3a52f63 100644
--- a/go/ql/src/qlpack.yml
+++ b/go/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-queries
-version: 0.7.10-dev
+version: 0.7.10
groups:
- go
- queries
diff --git a/java/ql/automodel/src/CHANGELOG.md b/java/ql/automodel/src/CHANGELOG.md
index 4a3c54adb38..c3282c773a9 100644
--- a/java/ql/automodel/src/CHANGELOG.md
+++ b/java/ql/automodel/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.0.17
+
+No user-facing changes.
+
## 0.0.16
No user-facing changes.
diff --git a/java/ql/automodel/src/change-notes/released/0.0.17.md b/java/ql/automodel/src/change-notes/released/0.0.17.md
new file mode 100644
index 00000000000..62cc89030a6
--- /dev/null
+++ b/java/ql/automodel/src/change-notes/released/0.0.17.md
@@ -0,0 +1,3 @@
+## 0.0.17
+
+No user-facing changes.
diff --git a/java/ql/automodel/src/codeql-pack.release.yml b/java/ql/automodel/src/codeql-pack.release.yml
index a49f7be4cff..cbc3d3cd493 100644
--- a/java/ql/automodel/src/codeql-pack.release.yml
+++ b/java/ql/automodel/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.16
+lastReleaseVersion: 0.0.17
diff --git a/java/ql/automodel/src/qlpack.yml b/java/ql/automodel/src/qlpack.yml
index 898239be098..59fab0cdcc5 100644
--- a/java/ql/automodel/src/qlpack.yml
+++ b/java/ql/automodel/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-automodel-queries
-version: 0.0.17-dev
+version: 0.0.17
groups:
- java
- automodel
diff --git a/java/ql/lib/CHANGELOG.md b/java/ql/lib/CHANGELOG.md
index d369cbdc931..2a02ccee6ab 100644
--- a/java/ql/lib/CHANGELOG.md
+++ b/java/ql/lib/CHANGELOG.md
@@ -1,3 +1,14 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Java expressions with erroneous types (e.g. the result of a call whose callee couldn't be resolved during extraction) are now given a CodeQL `ErrorType` more often.
+
+### Bug Fixes
+
+* Fixed the Java autobuilder overriding the version of Maven used by a project when the Maven wrapper `mvnw` is in use and the `maven-wrapper.jar` file is not present in the repository.
+* Some flow steps related to `android.text.Editable.toString` that were accidentally disabled have been re-enabled.
+
## 0.8.9
### Deprecated APIs
diff --git a/java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md b/java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md
deleted file mode 100644
index eb560fba07d..00000000000
--- a/java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: fix
----
-* Some flow steps related to `android.text.Editable.toString` that were accidentally disabled have been re-enabled.
diff --git a/java/ql/lib/change-notes/2024-02-27-error-types.md b/java/ql/lib/change-notes/2024-02-27-error-types.md
deleted file mode 100644
index cdc6d7620aa..00000000000
--- a/java/ql/lib/change-notes/2024-02-27-error-types.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Java expressions with erroneous types (e.g. the result of a call whose callee couldn't be resolved during extraction) are now given a CodeQL `ErrorType` more often.
diff --git a/java/ql/lib/change-notes/2024-02-27-mvnw-versions.md b/java/ql/lib/change-notes/2024-02-27-mvnw-versions.md
deleted file mode 100644
index a0227088ae9..00000000000
--- a/java/ql/lib/change-notes/2024-02-27-mvnw-versions.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: fix
----
-* Fixed the Java autobuilder overriding the version of Maven used by a project when the Maven wrapper `mvnw` is in use and the `maven-wrapper.jar` file is not present in the repository.
diff --git a/java/ql/lib/change-notes/released/0.8.10.md b/java/ql/lib/change-notes/released/0.8.10.md
new file mode 100644
index 00000000000..b45f14bf347
--- /dev/null
+++ b/java/ql/lib/change-notes/released/0.8.10.md
@@ -0,0 +1,10 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Java expressions with erroneous types (e.g. the result of a call whose callee couldn't be resolved during extraction) are now given a CodeQL `ErrorType` more often.
+
+### Bug Fixes
+
+* Fixed the Java autobuilder overriding the version of Maven used by a project when the Maven wrapper `mvnw` is in use and the `maven-wrapper.jar` file is not present in the repository.
+* Some flow steps related to `android.text.Editable.toString` that were accidentally disabled have been re-enabled.
diff --git a/java/ql/lib/codeql-pack.release.yml b/java/ql/lib/codeql-pack.release.yml
index 5290c29b7fe..0521f0f75fa 100644
--- a/java/ql/lib/codeql-pack.release.yml
+++ b/java/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/java/ql/lib/qlpack.yml b/java/ql/lib/qlpack.yml
index 15b4982d41e..428eedc75e3 100644
--- a/java/ql/lib/qlpack.yml
+++ b/java/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-all
-version: 0.8.10-dev
+version: 0.8.10
groups: java
dbscheme: config/semmlecode.dbscheme
extractor: java
diff --git a/java/ql/src/CHANGELOG.md b/java/ql/src/CHANGELOG.md
index 5d835351453..c61275f5ed8 100644
--- a/java/ql/src/CHANGELOG.md
+++ b/java/ql/src/CHANGELOG.md
@@ -1,3 +1,13 @@
+## 0.8.10
+
+### New Queries
+
+* Added a new query `java/android/insecure-local-key-gen` for finding instances of keys generated for biometric authentication in an insecure way.
+
+### Minor Analysis Improvements
+
+* To reduce the number of false positives in the query "Insertion of sensitive information into log files" (`java/sensitive-log`), variables with names that contain "null" (case-insensitively) are no longer considered sources of sensitive information.
+
## 0.8.9
### New Queries
diff --git a/java/ql/src/change-notes/2024-02-12-android-insecure-keys.md b/java/ql/src/change-notes/2024-02-12-android-insecure-keys.md
deleted file mode 100644
index 1de07727796..00000000000
--- a/java/ql/src/change-notes/2024-02-12-android-insecure-keys.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: newQuery
----
-* Added a new query `java/android/insecure-local-key-gen` for finding instances of keys generated for biometric authentication in an insecure way.
\ No newline at end of file
diff --git a/java/ql/src/change-notes/2024-03-04-sensitive-log-remove-null-from-sources.md b/java/ql/src/change-notes/released/0.8.10.md
similarity index 54%
rename from java/ql/src/change-notes/2024-03-04-sensitive-log-remove-null-from-sources.md
rename to java/ql/src/change-notes/released/0.8.10.md
index 0bb4f18f2bd..c5d18ae3379 100644
--- a/java/ql/src/change-notes/2024-03-04-sensitive-log-remove-null-from-sources.md
+++ b/java/ql/src/change-notes/released/0.8.10.md
@@ -1,4 +1,9 @@
----
-category: minorAnalysis
----
+## 0.8.10
+
+### New Queries
+
+* Added a new query `java/android/insecure-local-key-gen` for finding instances of keys generated for biometric authentication in an insecure way.
+
+### Minor Analysis Improvements
+
* To reduce the number of false positives in the query "Insertion of sensitive information into log files" (`java/sensitive-log`), variables with names that contain "null" (case-insensitively) are no longer considered sources of sensitive information.
diff --git a/java/ql/src/codeql-pack.release.yml b/java/ql/src/codeql-pack.release.yml
index 5290c29b7fe..0521f0f75fa 100644
--- a/java/ql/src/codeql-pack.release.yml
+++ b/java/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/java/ql/src/qlpack.yml b/java/ql/src/qlpack.yml
index 8f4de528e21..ebbdbeee3b2 100644
--- a/java/ql/src/qlpack.yml
+++ b/java/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-queries
-version: 0.8.10-dev
+version: 0.8.10
groups:
- java
- queries
diff --git a/javascript/ql/lib/CHANGELOG.md b/javascript/ql/lib/CHANGELOG.md
index 5b97ebbb22b..d5edcc00513 100644
--- a/javascript/ql/lib/CHANGELOG.md
+++ b/javascript/ql/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.8.10
+
+No user-facing changes.
+
## 0.8.9
### Minor Analysis Improvements
diff --git a/javascript/ql/lib/change-notes/released/0.8.10.md b/javascript/ql/lib/change-notes/released/0.8.10.md
new file mode 100644
index 00000000000..777bbd2fded
--- /dev/null
+++ b/javascript/ql/lib/change-notes/released/0.8.10.md
@@ -0,0 +1,3 @@
+## 0.8.10
+
+No user-facing changes.
diff --git a/javascript/ql/lib/codeql-pack.release.yml b/javascript/ql/lib/codeql-pack.release.yml
index 5290c29b7fe..0521f0f75fa 100644
--- a/javascript/ql/lib/codeql-pack.release.yml
+++ b/javascript/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/javascript/ql/lib/qlpack.yml b/javascript/ql/lib/qlpack.yml
index ef3ca7521ac..da16493a21c 100644
--- a/javascript/ql/lib/qlpack.yml
+++ b/javascript/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-all
-version: 0.8.10-dev
+version: 0.8.10
groups: javascript
dbscheme: semmlecode.javascript.dbscheme
extractor: javascript
diff --git a/javascript/ql/src/CHANGELOG.md b/javascript/ql/src/CHANGELOG.md
index 85516e3625d..b9627cac5ee 100644
--- a/javascript/ql/src/CHANGELOG.md
+++ b/javascript/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.8.10
+
+No user-facing changes.
+
## 0.8.9
### Bug Fixes
diff --git a/javascript/ql/src/change-notes/released/0.8.10.md b/javascript/ql/src/change-notes/released/0.8.10.md
new file mode 100644
index 00000000000..777bbd2fded
--- /dev/null
+++ b/javascript/ql/src/change-notes/released/0.8.10.md
@@ -0,0 +1,3 @@
+## 0.8.10
+
+No user-facing changes.
diff --git a/javascript/ql/src/codeql-pack.release.yml b/javascript/ql/src/codeql-pack.release.yml
index 5290c29b7fe..0521f0f75fa 100644
--- a/javascript/ql/src/codeql-pack.release.yml
+++ b/javascript/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/javascript/ql/src/qlpack.yml b/javascript/ql/src/qlpack.yml
index b6181aa30e9..d224952c564 100644
--- a/javascript/ql/src/qlpack.yml
+++ b/javascript/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-queries
-version: 0.8.10-dev
+version: 0.8.10
groups:
- javascript
- queries
diff --git a/misc/suite-helpers/CHANGELOG.md b/misc/suite-helpers/CHANGELOG.md
index 3c06dd69b0f..1c4455b66c4 100644
--- a/misc/suite-helpers/CHANGELOG.md
+++ b/misc/suite-helpers/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.7.10
+
+No user-facing changes.
+
## 0.7.9
No user-facing changes.
diff --git a/misc/suite-helpers/change-notes/released/0.7.10.md b/misc/suite-helpers/change-notes/released/0.7.10.md
new file mode 100644
index 00000000000..989c5b8f682
--- /dev/null
+++ b/misc/suite-helpers/change-notes/released/0.7.10.md
@@ -0,0 +1,3 @@
+## 0.7.10
+
+No user-facing changes.
diff --git a/misc/suite-helpers/codeql-pack.release.yml b/misc/suite-helpers/codeql-pack.release.yml
index 576395f3405..67518567297 100644
--- a/misc/suite-helpers/codeql-pack.release.yml
+++ b/misc/suite-helpers/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.7.9
+lastReleaseVersion: 0.7.10
diff --git a/misc/suite-helpers/qlpack.yml b/misc/suite-helpers/qlpack.yml
index 49b7a6bda4c..54d978d5efe 100644
--- a/misc/suite-helpers/qlpack.yml
+++ b/misc/suite-helpers/qlpack.yml
@@ -1,4 +1,4 @@
name: codeql/suite-helpers
-version: 0.7.10-dev
+version: 0.7.10
groups: shared
warnOnImplicitThis: true
diff --git a/python/ql/lib/CHANGELOG.md b/python/ql/lib/CHANGELOG.md
index e6f318c51ea..f095607ca1b 100644
--- a/python/ql/lib/CHANGELOG.md
+++ b/python/ql/lib/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 0.11.10
+
+### Minor Analysis Improvements
+
+* Fixed missing flow for dictionary updates (`d[] = ...`) when `` is a string constant not used in dictionary literals or as name of keyword-argument.
+* Fixed flow for iterable unpacking (`a,b = my_tuple`) when it occurs on top-level (module) scope.
+
## 0.11.9
### Minor Analysis Improvements
diff --git a/python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md b/python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md
deleted file mode 100644
index 3c47c6ba866..00000000000
--- a/python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Fixed flow for iterable unpacking (`a,b = my_tuple`) when it occurs on top-level (module) scope.
diff --git a/python/ql/lib/change-notes/2024-03-01-dict-update-content.md b/python/ql/lib/change-notes/released/0.11.10.md
similarity index 52%
rename from python/ql/lib/change-notes/2024-03-01-dict-update-content.md
rename to python/ql/lib/change-notes/released/0.11.10.md
index dfb8d247fff..ed873724e4f 100644
--- a/python/ql/lib/change-notes/2024-03-01-dict-update-content.md
+++ b/python/ql/lib/change-notes/released/0.11.10.md
@@ -1,4 +1,6 @@
----
-category: minorAnalysis
----
+## 0.11.10
+
+### Minor Analysis Improvements
+
* Fixed missing flow for dictionary updates (`d[] = ...`) when `` is a string constant not used in dictionary literals or as name of keyword-argument.
+* Fixed flow for iterable unpacking (`a,b = my_tuple`) when it occurs on top-level (module) scope.
diff --git a/python/ql/lib/codeql-pack.release.yml b/python/ql/lib/codeql-pack.release.yml
index b064d1778a1..ddddcbe9193 100644
--- a/python/ql/lib/codeql-pack.release.yml
+++ b/python/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.11.9
+lastReleaseVersion: 0.11.10
diff --git a/python/ql/lib/qlpack.yml b/python/ql/lib/qlpack.yml
index e9f66e205f2..59a8b4c96d1 100644
--- a/python/ql/lib/qlpack.yml
+++ b/python/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-all
-version: 0.11.10-dev
+version: 0.11.10
groups: python
dbscheme: semmlecode.python.dbscheme
extractor: python
diff --git a/python/ql/src/CHANGELOG.md b/python/ql/src/CHANGELOG.md
index 50762bcbf34..d4245aba7a6 100644
--- a/python/ql/src/CHANGELOG.md
+++ b/python/ql/src/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 0.9.10
+
+### New Queries
+
+* The query `py/nosql-injection` for finding NoSQL injection vulnerabilities is now part of the default security suite.
+
## 0.9.9
No user-facing changes.
diff --git a/python/ql/src/change-notes/2024-03-04-nosql-injection.md b/python/ql/src/change-notes/released/0.9.10.md
similarity index 81%
rename from python/ql/src/change-notes/2024-03-04-nosql-injection.md
rename to python/ql/src/change-notes/released/0.9.10.md
index 6e98540c757..4cbb221b789 100644
--- a/python/ql/src/change-notes/2024-03-04-nosql-injection.md
+++ b/python/ql/src/change-notes/released/0.9.10.md
@@ -1,4 +1,5 @@
----
-category: newQuery
----
+## 0.9.10
+
+### New Queries
+
* The query `py/nosql-injection` for finding NoSQL injection vulnerabilities is now part of the default security suite.
diff --git a/python/ql/src/codeql-pack.release.yml b/python/ql/src/codeql-pack.release.yml
index aabed7c396b..d086ed69541 100644
--- a/python/ql/src/codeql-pack.release.yml
+++ b/python/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.9.9
+lastReleaseVersion: 0.9.10
diff --git a/python/ql/src/qlpack.yml b/python/ql/src/qlpack.yml
index aa18f2d8707..c920f667836 100644
--- a/python/ql/src/qlpack.yml
+++ b/python/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-queries
-version: 0.9.10-dev
+version: 0.9.10
groups:
- python
- queries
diff --git a/ruby/ql/lib/CHANGELOG.md b/ruby/ql/lib/CHANGELOG.md
index a623a151e89..c61a12e0f4a 100644
--- a/ruby/ql/lib/CHANGELOG.md
+++ b/ruby/ql/lib/CHANGELOG.md
@@ -1,3 +1,12 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Calls to `I18n.translate` as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
+* Calls to `Arel::Nodes::SqlLiteral.new` are now modeled as instances of the `SqlConstruction` concept, as well as propagating taint from their argument.
+* Additional arguments beyond the first of calls to the `ActiveRecord` methods `select`, `reselect`, `order`, `reorder`, `joins`, `group`, and `pluck` are now recognized as sql injection sinks.
+* Calls to several methods of `ActiveRecord::Connection`, such as `ActiveRecord::Connection#exec_query`, are now recognized as SQL executions, including those via subclasses.
+
## 0.8.9
### Minor Analysis Improvements
diff --git a/ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md b/ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md
deleted file mode 100644
index c2276f284a8..00000000000
--- a/ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Calls to several methods of `ActiveRecord::Connection`, such as `ActiveRecord::Connection#exec_query`, are now recognized as SQL executions, including those via subclasses.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md b/ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md
deleted file mode 100644
index 1486c7a472d..00000000000
--- a/ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Additional arguments beyond the first of calls to the `ActiveRecord` methods `select`, `reselect`, `order`, `reorder`, `joins`, `group`, and `pluck` are now recognized as sql injection sinks.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md b/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
deleted file mode 100644
index 6f3a90768ba..00000000000
--- a/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Calls to `Arel::Nodes::SqlLiteral.new` are now modeled as instances of the `SqlConstruction` concept, as well as propagating taint from their argument.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md b/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
deleted file mode 100644
index 350e049b5bf..00000000000
--- a/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Calls to `I18n.translate` as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/released/0.8.10.md b/ruby/ql/lib/change-notes/released/0.8.10.md
new file mode 100644
index 00000000000..666e28f840e
--- /dev/null
+++ b/ruby/ql/lib/change-notes/released/0.8.10.md
@@ -0,0 +1,8 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Calls to `I18n.translate` as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
+* Calls to `Arel::Nodes::SqlLiteral.new` are now modeled as instances of the `SqlConstruction` concept, as well as propagating taint from their argument.
+* Additional arguments beyond the first of calls to the `ActiveRecord` methods `select`, `reselect`, `order`, `reorder`, `joins`, `group`, and `pluck` are now recognized as sql injection sinks.
+* Calls to several methods of `ActiveRecord::Connection`, such as `ActiveRecord::Connection#exec_query`, are now recognized as SQL executions, including those via subclasses.
diff --git a/ruby/ql/lib/codeql-pack.release.yml b/ruby/ql/lib/codeql-pack.release.yml
index 5290c29b7fe..0521f0f75fa 100644
--- a/ruby/ql/lib/codeql-pack.release.yml
+++ b/ruby/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/ruby/ql/lib/qlpack.yml b/ruby/ql/lib/qlpack.yml
index 7d409b83adb..de5b41999fe 100644
--- a/ruby/ql/lib/qlpack.yml
+++ b/ruby/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-all
-version: 0.8.10-dev
+version: 0.8.10
groups: ruby
extractor: ruby
dbscheme: ruby.dbscheme
diff --git a/ruby/ql/src/CHANGELOG.md b/ruby/ql/src/CHANGELOG.md
index 4149c728eff..f875b6d16ad 100644
--- a/ruby/ql/src/CHANGELOG.md
+++ b/ruby/ql/src/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Calls to `Object#method`, `Object#public_method` and `Object#singleton_method` with untrusted data are now recognised as sinks for code injection.
+* Added additional request sources for Ruby on Rails.
+
## 0.8.9
No user-facing changes.
diff --git a/ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md b/ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md
deleted file mode 100644
index 84ea696dfef..00000000000
--- a/ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Added additional request sources for Ruby on Rails.
\ No newline at end of file
diff --git a/ruby/ql/src/change-notes/2024-03-01-method-code-injection-sinks.md b/ruby/ql/src/change-notes/released/0.8.10.md
similarity index 51%
rename from ruby/ql/src/change-notes/2024-03-01-method-code-injection-sinks.md
rename to ruby/ql/src/change-notes/released/0.8.10.md
index 43e40d3fd53..985cdf8d22e 100644
--- a/ruby/ql/src/change-notes/2024-03-01-method-code-injection-sinks.md
+++ b/ruby/ql/src/change-notes/released/0.8.10.md
@@ -1,4 +1,6 @@
----
-category: minorAnalysis
----
-* Calls to `Object#method`, `Object#public_method` and `Object#singleton_method` with untrusted data are now recognised as sinks for code injection.
\ No newline at end of file
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Calls to `Object#method`, `Object#public_method` and `Object#singleton_method` with untrusted data are now recognised as sinks for code injection.
+* Added additional request sources for Ruby on Rails.
diff --git a/ruby/ql/src/codeql-pack.release.yml b/ruby/ql/src/codeql-pack.release.yml
index 5290c29b7fe..0521f0f75fa 100644
--- a/ruby/ql/src/codeql-pack.release.yml
+++ b/ruby/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/ruby/ql/src/qlpack.yml b/ruby/ql/src/qlpack.yml
index 8af7f9fd797..5e379268234 100644
--- a/ruby/ql/src/qlpack.yml
+++ b/ruby/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-queries
-version: 0.8.10-dev
+version: 0.8.10
groups:
- ruby
- queries
diff --git a/shared/controlflow/CHANGELOG.md b/shared/controlflow/CHANGELOG.md
index dbfa6ef4512..75f2ca53f98 100644
--- a/shared/controlflow/CHANGELOG.md
+++ b/shared/controlflow/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.1.10
+
+No user-facing changes.
+
## 0.1.9
No user-facing changes.
diff --git a/shared/controlflow/change-notes/released/0.1.10.md b/shared/controlflow/change-notes/released/0.1.10.md
new file mode 100644
index 00000000000..47358eeee93
--- /dev/null
+++ b/shared/controlflow/change-notes/released/0.1.10.md
@@ -0,0 +1,3 @@
+## 0.1.10
+
+No user-facing changes.
diff --git a/shared/controlflow/codeql-pack.release.yml b/shared/controlflow/codeql-pack.release.yml
index 1425c0edf7f..30f5ca88be0 100644
--- a/shared/controlflow/codeql-pack.release.yml
+++ b/shared/controlflow/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.1.9
+lastReleaseVersion: 0.1.10
diff --git a/shared/controlflow/qlpack.yml b/shared/controlflow/qlpack.yml
index 9d35a678276..1d43802be42 100644
--- a/shared/controlflow/qlpack.yml
+++ b/shared/controlflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/controlflow
-version: 0.1.10-dev
+version: 0.1.10
groups: shared
library: true
dependencies:
diff --git a/shared/dataflow/CHANGELOG.md b/shared/dataflow/CHANGELOG.md
index 67a5bf589f4..ef80788bded 100644
--- a/shared/dataflow/CHANGELOG.md
+++ b/shared/dataflow/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.1
+
+No user-facing changes.
+
## 0.2.0
### Breaking Changes
diff --git a/shared/dataflow/change-notes/released/0.2.1.md b/shared/dataflow/change-notes/released/0.2.1.md
new file mode 100644
index 00000000000..3dbfc85fe11
--- /dev/null
+++ b/shared/dataflow/change-notes/released/0.2.1.md
@@ -0,0 +1,3 @@
+## 0.2.1
+
+No user-facing changes.
diff --git a/shared/dataflow/codeql-pack.release.yml b/shared/dataflow/codeql-pack.release.yml
index 5274e27ed52..df29a726bcc 100644
--- a/shared/dataflow/codeql-pack.release.yml
+++ b/shared/dataflow/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.0
+lastReleaseVersion: 0.2.1
diff --git a/shared/dataflow/qlpack.yml b/shared/dataflow/qlpack.yml
index 1e7becf71c4..ee422e02ea9 100644
--- a/shared/dataflow/qlpack.yml
+++ b/shared/dataflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/dataflow
-version: 0.2.1-dev
+version: 0.2.1
groups: shared
library: true
dependencies:
diff --git a/shared/mad/CHANGELOG.md b/shared/mad/CHANGELOG.md
index 4d09057118c..4730366775e 100644
--- a/shared/mad/CHANGELOG.md
+++ b/shared/mad/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/mad/change-notes/released/0.2.10.md b/shared/mad/change-notes/released/0.2.10.md
new file mode 100644
index 00000000000..81c9722b19f
--- /dev/null
+++ b/shared/mad/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/mad/codeql-pack.release.yml b/shared/mad/codeql-pack.release.yml
index d021cf0a6be..a71167814cb 100644
--- a/shared/mad/codeql-pack.release.yml
+++ b/shared/mad/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/mad/qlpack.yml b/shared/mad/qlpack.yml
index 22c8f271ccc..6d7269ef3da 100644
--- a/shared/mad/qlpack.yml
+++ b/shared/mad/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/mad
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
dependencies: null
diff --git a/shared/rangeanalysis/CHANGELOG.md b/shared/rangeanalysis/CHANGELOG.md
index 5b8dbcfab22..9943dcb7972 100644
--- a/shared/rangeanalysis/CHANGELOG.md
+++ b/shared/rangeanalysis/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.0.9
+
+No user-facing changes.
+
## 0.0.8
No user-facing changes.
diff --git a/shared/rangeanalysis/change-notes/released/0.0.9.md b/shared/rangeanalysis/change-notes/released/0.0.9.md
new file mode 100644
index 00000000000..c9e17c6d6cf
--- /dev/null
+++ b/shared/rangeanalysis/change-notes/released/0.0.9.md
@@ -0,0 +1,3 @@
+## 0.0.9
+
+No user-facing changes.
diff --git a/shared/rangeanalysis/codeql-pack.release.yml b/shared/rangeanalysis/codeql-pack.release.yml
index 58fdc6b45de..ecdd64fbab8 100644
--- a/shared/rangeanalysis/codeql-pack.release.yml
+++ b/shared/rangeanalysis/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.8
+lastReleaseVersion: 0.0.9
diff --git a/shared/rangeanalysis/qlpack.yml b/shared/rangeanalysis/qlpack.yml
index 836fe51ee34..01db5d5734d 100644
--- a/shared/rangeanalysis/qlpack.yml
+++ b/shared/rangeanalysis/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/rangeanalysis
-version: 0.0.9-dev
+version: 0.0.9
groups: shared
library: true
dependencies:
diff --git a/shared/regex/CHANGELOG.md b/shared/regex/CHANGELOG.md
index cd5f91f71ec..c05869c153d 100644
--- a/shared/regex/CHANGELOG.md
+++ b/shared/regex/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/regex/change-notes/released/0.2.10.md b/shared/regex/change-notes/released/0.2.10.md
new file mode 100644
index 00000000000..81c9722b19f
--- /dev/null
+++ b/shared/regex/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/regex/codeql-pack.release.yml b/shared/regex/codeql-pack.release.yml
index d021cf0a6be..a71167814cb 100644
--- a/shared/regex/codeql-pack.release.yml
+++ b/shared/regex/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/regex/qlpack.yml b/shared/regex/qlpack.yml
index ea3f7f9b238..0d4f485312f 100644
--- a/shared/regex/qlpack.yml
+++ b/shared/regex/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/regex
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
dependencies:
diff --git a/shared/ssa/CHANGELOG.md b/shared/ssa/CHANGELOG.md
index 01acfae0148..a9161ff578b 100644
--- a/shared/ssa/CHANGELOG.md
+++ b/shared/ssa/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/ssa/change-notes/released/0.2.10.md b/shared/ssa/change-notes/released/0.2.10.md
new file mode 100644
index 00000000000..81c9722b19f
--- /dev/null
+++ b/shared/ssa/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/ssa/codeql-pack.release.yml b/shared/ssa/codeql-pack.release.yml
index d021cf0a6be..a71167814cb 100644
--- a/shared/ssa/codeql-pack.release.yml
+++ b/shared/ssa/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/ssa/qlpack.yml b/shared/ssa/qlpack.yml
index 19304ad107f..2ad254711a5 100644
--- a/shared/ssa/qlpack.yml
+++ b/shared/ssa/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ssa
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
dependencies:
diff --git a/shared/threat-models/CHANGELOG.md b/shared/threat-models/CHANGELOG.md
index fba2a870356..a59e560c415 100644
--- a/shared/threat-models/CHANGELOG.md
+++ b/shared/threat-models/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.0.9
+
+No user-facing changes.
+
## 0.0.8
No user-facing changes.
diff --git a/shared/threat-models/change-notes/released/0.0.9.md b/shared/threat-models/change-notes/released/0.0.9.md
new file mode 100644
index 00000000000..c9e17c6d6cf
--- /dev/null
+++ b/shared/threat-models/change-notes/released/0.0.9.md
@@ -0,0 +1,3 @@
+## 0.0.9
+
+No user-facing changes.
diff --git a/shared/threat-models/codeql-pack.release.yml b/shared/threat-models/codeql-pack.release.yml
index 58fdc6b45de..ecdd64fbab8 100644
--- a/shared/threat-models/codeql-pack.release.yml
+++ b/shared/threat-models/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.8
+lastReleaseVersion: 0.0.9
diff --git a/shared/threat-models/qlpack.yml b/shared/threat-models/qlpack.yml
index d0ed9a913b2..60cbbc56fcb 100644
--- a/shared/threat-models/qlpack.yml
+++ b/shared/threat-models/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/threat-models
-version: 0.0.9-dev
+version: 0.0.9
library: true
groups: shared
dataExtensions:
diff --git a/shared/tutorial/CHANGELOG.md b/shared/tutorial/CHANGELOG.md
index 1db3a01af0b..560ad058d5b 100644
--- a/shared/tutorial/CHANGELOG.md
+++ b/shared/tutorial/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/tutorial/change-notes/released/0.2.10.md b/shared/tutorial/change-notes/released/0.2.10.md
new file mode 100644
index 00000000000..81c9722b19f
--- /dev/null
+++ b/shared/tutorial/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/tutorial/codeql-pack.release.yml b/shared/tutorial/codeql-pack.release.yml
index d021cf0a6be..a71167814cb 100644
--- a/shared/tutorial/codeql-pack.release.yml
+++ b/shared/tutorial/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/tutorial/qlpack.yml b/shared/tutorial/qlpack.yml
index b595ae9ee70..69116705c1b 100644
--- a/shared/tutorial/qlpack.yml
+++ b/shared/tutorial/qlpack.yml
@@ -1,7 +1,7 @@
name: codeql/tutorial
description: Library for the CodeQL detective tutorials, helping new users learn to
write CodeQL queries.
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/typetracking/CHANGELOG.md b/shared/typetracking/CHANGELOG.md
index afc857bc6bc..350f9ecbeae 100644
--- a/shared/typetracking/CHANGELOG.md
+++ b/shared/typetracking/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/typetracking/change-notes/released/0.2.10.md b/shared/typetracking/change-notes/released/0.2.10.md
new file mode 100644
index 00000000000..81c9722b19f
--- /dev/null
+++ b/shared/typetracking/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/typetracking/codeql-pack.release.yml b/shared/typetracking/codeql-pack.release.yml
index d021cf0a6be..a71167814cb 100644
--- a/shared/typetracking/codeql-pack.release.yml
+++ b/shared/typetracking/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/typetracking/qlpack.yml b/shared/typetracking/qlpack.yml
index b55927f59bb..fbbdcf5162a 100644
--- a/shared/typetracking/qlpack.yml
+++ b/shared/typetracking/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typetracking
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
dependencies:
diff --git a/shared/typos/CHANGELOG.md b/shared/typos/CHANGELOG.md
index 66c5871d982..54b1eaa4d58 100644
--- a/shared/typos/CHANGELOG.md
+++ b/shared/typos/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/typos/change-notes/released/0.2.10.md b/shared/typos/change-notes/released/0.2.10.md
new file mode 100644
index 00000000000..81c9722b19f
--- /dev/null
+++ b/shared/typos/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/typos/codeql-pack.release.yml b/shared/typos/codeql-pack.release.yml
index d021cf0a6be..a71167814cb 100644
--- a/shared/typos/codeql-pack.release.yml
+++ b/shared/typos/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/typos/qlpack.yml b/shared/typos/qlpack.yml
index 644bfe11bff..4d59d9b3c34 100644
--- a/shared/typos/qlpack.yml
+++ b/shared/typos/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typos
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/util/CHANGELOG.md b/shared/util/CHANGELOG.md
index 63832e927fa..1ca1f71bcbc 100644
--- a/shared/util/CHANGELOG.md
+++ b/shared/util/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/util/change-notes/released/0.2.10.md b/shared/util/change-notes/released/0.2.10.md
new file mode 100644
index 00000000000..81c9722b19f
--- /dev/null
+++ b/shared/util/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/util/codeql-pack.release.yml b/shared/util/codeql-pack.release.yml
index d021cf0a6be..a71167814cb 100644
--- a/shared/util/codeql-pack.release.yml
+++ b/shared/util/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/util/qlpack.yml b/shared/util/qlpack.yml
index ca1a866a53d..28ed738a93d 100644
--- a/shared/util/qlpack.yml
+++ b/shared/util/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/util
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
dependencies: null
diff --git a/shared/yaml/CHANGELOG.md b/shared/yaml/CHANGELOG.md
index e5495abcd50..9fd5ebc26ab 100644
--- a/shared/yaml/CHANGELOG.md
+++ b/shared/yaml/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/yaml/change-notes/released/0.2.10.md b/shared/yaml/change-notes/released/0.2.10.md
new file mode 100644
index 00000000000..81c9722b19f
--- /dev/null
+++ b/shared/yaml/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/yaml/codeql-pack.release.yml b/shared/yaml/codeql-pack.release.yml
index d021cf0a6be..a71167814cb 100644
--- a/shared/yaml/codeql-pack.release.yml
+++ b/shared/yaml/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/yaml/qlpack.yml b/shared/yaml/qlpack.yml
index de5b47e120a..9643ffcec66 100644
--- a/shared/yaml/qlpack.yml
+++ b/shared/yaml/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/yaml
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/swift/ql/lib/CHANGELOG.md b/swift/ql/lib/CHANGELOG.md
index e88cd0259cc..8f14bfcedc9 100644
--- a/swift/ql/lib/CHANGELOG.md
+++ b/swift/ql/lib/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 0.3.10
+
+### Bug Fixes
+
+* Fixed an issue where `TypeDecl.getFullName` would get stuck in an loop and fail when minor database inconsistencies are present.
+
## 0.3.9
### Minor Analysis Improvements
diff --git a/swift/ql/lib/change-notes/2024-02-22-extension-patch.md b/swift/ql/lib/change-notes/released/0.3.10.md
similarity index 83%
rename from swift/ql/lib/change-notes/2024-02-22-extension-patch.md
rename to swift/ql/lib/change-notes/released/0.3.10.md
index 7bd78f3b785..9d6286ff58a 100644
--- a/swift/ql/lib/change-notes/2024-02-22-extension-patch.md
+++ b/swift/ql/lib/change-notes/released/0.3.10.md
@@ -1,4 +1,5 @@
----
-category: fix
----
+## 0.3.10
+
+### Bug Fixes
+
* Fixed an issue where `TypeDecl.getFullName` would get stuck in an loop and fail when minor database inconsistencies are present.
diff --git a/swift/ql/lib/codeql-pack.release.yml b/swift/ql/lib/codeql-pack.release.yml
index 3fa5180bcb4..76ca0ac8ba7 100644
--- a/swift/ql/lib/codeql-pack.release.yml
+++ b/swift/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.3.9
+lastReleaseVersion: 0.3.10
diff --git a/swift/ql/lib/qlpack.yml b/swift/ql/lib/qlpack.yml
index a37a4cb3d58..70ec4798ea8 100644
--- a/swift/ql/lib/qlpack.yml
+++ b/swift/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-all
-version: 0.3.10-dev
+version: 0.3.10
groups: swift
extractor: swift
dbscheme: swift.dbscheme
diff --git a/swift/ql/src/CHANGELOG.md b/swift/ql/src/CHANGELOG.md
index 96615d06972..bda9834c9bc 100644
--- a/swift/ql/src/CHANGELOG.md
+++ b/swift/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.3.10
+
+No user-facing changes.
+
## 0.3.9
### New Queries
diff --git a/swift/ql/src/change-notes/released/0.3.10.md b/swift/ql/src/change-notes/released/0.3.10.md
new file mode 100644
index 00000000000..925a48fc52e
--- /dev/null
+++ b/swift/ql/src/change-notes/released/0.3.10.md
@@ -0,0 +1,3 @@
+## 0.3.10
+
+No user-facing changes.
diff --git a/swift/ql/src/codeql-pack.release.yml b/swift/ql/src/codeql-pack.release.yml
index 3fa5180bcb4..76ca0ac8ba7 100644
--- a/swift/ql/src/codeql-pack.release.yml
+++ b/swift/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.3.9
+lastReleaseVersion: 0.3.10
diff --git a/swift/ql/src/qlpack.yml b/swift/ql/src/qlpack.yml
index e3ead42c98b..ba66b065529 100644
--- a/swift/ql/src/qlpack.yml
+++ b/swift/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-queries
-version: 0.3.10-dev
+version: 0.3.10
groups:
- swift
- queries
From dc9092c9ec2cdda8188e9e44d8d51d2a0c6b6cc9 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
Date: Wed, 6 Mar 2024 22:19:33 +0000
Subject: [PATCH 039/309] Post-release preparation for codeql-cli-2.16.4
---
cpp/ql/lib/qlpack.yml | 2 +-
cpp/ql/src/qlpack.yml | 2 +-
csharp/ql/campaigns/Solorigate/lib/qlpack.yml | 2 +-
csharp/ql/campaigns/Solorigate/src/qlpack.yml | 2 +-
csharp/ql/lib/qlpack.yml | 2 +-
csharp/ql/src/qlpack.yml | 2 +-
go/ql/consistency-queries/qlpack.yml | 2 +-
go/ql/lib/qlpack.yml | 2 +-
go/ql/src/qlpack.yml | 2 +-
java/ql/automodel/src/qlpack.yml | 2 +-
java/ql/lib/qlpack.yml | 2 +-
java/ql/src/qlpack.yml | 2 +-
javascript/ql/lib/qlpack.yml | 2 +-
javascript/ql/src/qlpack.yml | 2 +-
misc/suite-helpers/qlpack.yml | 2 +-
python/ql/lib/qlpack.yml | 2 +-
python/ql/src/qlpack.yml | 2 +-
ruby/ql/lib/qlpack.yml | 2 +-
ruby/ql/src/qlpack.yml | 2 +-
shared/controlflow/qlpack.yml | 2 +-
shared/dataflow/qlpack.yml | 2 +-
shared/mad/qlpack.yml | 2 +-
shared/rangeanalysis/qlpack.yml | 2 +-
shared/regex/qlpack.yml | 2 +-
shared/ssa/qlpack.yml | 2 +-
shared/threat-models/qlpack.yml | 2 +-
shared/tutorial/qlpack.yml | 2 +-
shared/typetracking/qlpack.yml | 2 +-
shared/typos/qlpack.yml | 2 +-
shared/util/qlpack.yml | 2 +-
shared/yaml/qlpack.yml | 2 +-
swift/ql/lib/qlpack.yml | 2 +-
swift/ql/src/qlpack.yml | 2 +-
33 files changed, 33 insertions(+), 33 deletions(-)
diff --git a/cpp/ql/lib/qlpack.yml b/cpp/ql/lib/qlpack.yml
index 3bb9229bf94..8b17a050d82 100644
--- a/cpp/ql/lib/qlpack.yml
+++ b/cpp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-all
-version: 0.12.7
+version: 0.12.8-dev
groups: cpp
dbscheme: semmlecode.cpp.dbscheme
extractor: cpp
diff --git a/cpp/ql/src/qlpack.yml b/cpp/ql/src/qlpack.yml
index 4052647bb97..49eb255cc8f 100644
--- a/cpp/ql/src/qlpack.yml
+++ b/cpp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-queries
-version: 0.9.6
+version: 0.9.7-dev
groups:
- cpp
- queries
diff --git a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
index ee993bed0c9..3e8792bce0e 100644
--- a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-all
-version: 1.7.10
+version: 1.7.11-dev
groups:
- csharp
- solorigate
diff --git a/csharp/ql/campaigns/Solorigate/src/qlpack.yml b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
index 1f421754fc8..c67ab9130a0 100644
--- a/csharp/ql/campaigns/Solorigate/src/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-queries
-version: 1.7.10
+version: 1.7.11-dev
groups:
- csharp
- solorigate
diff --git a/csharp/ql/lib/qlpack.yml b/csharp/ql/lib/qlpack.yml
index 93c5c1120a2..a67b40f744f 100644
--- a/csharp/ql/lib/qlpack.yml
+++ b/csharp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-all
-version: 0.8.10
+version: 0.8.11-dev
groups: csharp
dbscheme: semmlecode.csharp.dbscheme
extractor: csharp
diff --git a/csharp/ql/src/qlpack.yml b/csharp/ql/src/qlpack.yml
index 46384094b19..a2148a36157 100644
--- a/csharp/ql/src/qlpack.yml
+++ b/csharp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-queries
-version: 0.8.10
+version: 0.8.11-dev
groups:
- csharp
- queries
diff --git a/go/ql/consistency-queries/qlpack.yml b/go/ql/consistency-queries/qlpack.yml
index d5a2fbee5f1..e82c98f52cb 100644
--- a/go/ql/consistency-queries/qlpack.yml
+++ b/go/ql/consistency-queries/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql-go-consistency-queries
-version: 0.0.9
+version: 0.0.10-dev
groups:
- go
- queries
diff --git a/go/ql/lib/qlpack.yml b/go/ql/lib/qlpack.yml
index 8cc190fa880..54b284e7ee5 100644
--- a/go/ql/lib/qlpack.yml
+++ b/go/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-all
-version: 0.7.10
+version: 0.7.11-dev
groups: go
dbscheme: go.dbscheme
extractor: go
diff --git a/go/ql/src/qlpack.yml b/go/ql/src/qlpack.yml
index 4ded3a52f63..c89aacb8aa2 100644
--- a/go/ql/src/qlpack.yml
+++ b/go/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-queries
-version: 0.7.10
+version: 0.7.11-dev
groups:
- go
- queries
diff --git a/java/ql/automodel/src/qlpack.yml b/java/ql/automodel/src/qlpack.yml
index 59fab0cdcc5..8064163f5cc 100644
--- a/java/ql/automodel/src/qlpack.yml
+++ b/java/ql/automodel/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-automodel-queries
-version: 0.0.17
+version: 0.0.18-dev
groups:
- java
- automodel
diff --git a/java/ql/lib/qlpack.yml b/java/ql/lib/qlpack.yml
index 428eedc75e3..ed83a620d20 100644
--- a/java/ql/lib/qlpack.yml
+++ b/java/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-all
-version: 0.8.10
+version: 0.8.11-dev
groups: java
dbscheme: config/semmlecode.dbscheme
extractor: java
diff --git a/java/ql/src/qlpack.yml b/java/ql/src/qlpack.yml
index ebbdbeee3b2..d7612d9da67 100644
--- a/java/ql/src/qlpack.yml
+++ b/java/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-queries
-version: 0.8.10
+version: 0.8.11-dev
groups:
- java
- queries
diff --git a/javascript/ql/lib/qlpack.yml b/javascript/ql/lib/qlpack.yml
index da16493a21c..30fa7de4198 100644
--- a/javascript/ql/lib/qlpack.yml
+++ b/javascript/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-all
-version: 0.8.10
+version: 0.8.11-dev
groups: javascript
dbscheme: semmlecode.javascript.dbscheme
extractor: javascript
diff --git a/javascript/ql/src/qlpack.yml b/javascript/ql/src/qlpack.yml
index d224952c564..01a3e8a0841 100644
--- a/javascript/ql/src/qlpack.yml
+++ b/javascript/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-queries
-version: 0.8.10
+version: 0.8.11-dev
groups:
- javascript
- queries
diff --git a/misc/suite-helpers/qlpack.yml b/misc/suite-helpers/qlpack.yml
index 54d978d5efe..5d8225b2e0b 100644
--- a/misc/suite-helpers/qlpack.yml
+++ b/misc/suite-helpers/qlpack.yml
@@ -1,4 +1,4 @@
name: codeql/suite-helpers
-version: 0.7.10
+version: 0.7.11-dev
groups: shared
warnOnImplicitThis: true
diff --git a/python/ql/lib/qlpack.yml b/python/ql/lib/qlpack.yml
index 59a8b4c96d1..daab6a41206 100644
--- a/python/ql/lib/qlpack.yml
+++ b/python/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-all
-version: 0.11.10
+version: 0.11.11-dev
groups: python
dbscheme: semmlecode.python.dbscheme
extractor: python
diff --git a/python/ql/src/qlpack.yml b/python/ql/src/qlpack.yml
index c920f667836..5b641a329cb 100644
--- a/python/ql/src/qlpack.yml
+++ b/python/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-queries
-version: 0.9.10
+version: 0.9.11-dev
groups:
- python
- queries
diff --git a/ruby/ql/lib/qlpack.yml b/ruby/ql/lib/qlpack.yml
index de5b41999fe..81695d545ec 100644
--- a/ruby/ql/lib/qlpack.yml
+++ b/ruby/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-all
-version: 0.8.10
+version: 0.8.11-dev
groups: ruby
extractor: ruby
dbscheme: ruby.dbscheme
diff --git a/ruby/ql/src/qlpack.yml b/ruby/ql/src/qlpack.yml
index 5e379268234..65e81bf2ba2 100644
--- a/ruby/ql/src/qlpack.yml
+++ b/ruby/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-queries
-version: 0.8.10
+version: 0.8.11-dev
groups:
- ruby
- queries
diff --git a/shared/controlflow/qlpack.yml b/shared/controlflow/qlpack.yml
index 1d43802be42..19c95747294 100644
--- a/shared/controlflow/qlpack.yml
+++ b/shared/controlflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/controlflow
-version: 0.1.10
+version: 0.1.11-dev
groups: shared
library: true
dependencies:
diff --git a/shared/dataflow/qlpack.yml b/shared/dataflow/qlpack.yml
index ee422e02ea9..4e896e9ae02 100644
--- a/shared/dataflow/qlpack.yml
+++ b/shared/dataflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/dataflow
-version: 0.2.1
+version: 0.2.2-dev
groups: shared
library: true
dependencies:
diff --git a/shared/mad/qlpack.yml b/shared/mad/qlpack.yml
index 6d7269ef3da..e3d2ccaf748 100644
--- a/shared/mad/qlpack.yml
+++ b/shared/mad/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/mad
-version: 0.2.10
+version: 0.2.11-dev
groups: shared
library: true
dependencies: null
diff --git a/shared/rangeanalysis/qlpack.yml b/shared/rangeanalysis/qlpack.yml
index 01db5d5734d..6a528c17637 100644
--- a/shared/rangeanalysis/qlpack.yml
+++ b/shared/rangeanalysis/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/rangeanalysis
-version: 0.0.9
+version: 0.0.10-dev
groups: shared
library: true
dependencies:
diff --git a/shared/regex/qlpack.yml b/shared/regex/qlpack.yml
index 0d4f485312f..8717c5b8a73 100644
--- a/shared/regex/qlpack.yml
+++ b/shared/regex/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/regex
-version: 0.2.10
+version: 0.2.11-dev
groups: shared
library: true
dependencies:
diff --git a/shared/ssa/qlpack.yml b/shared/ssa/qlpack.yml
index 2ad254711a5..656662e9061 100644
--- a/shared/ssa/qlpack.yml
+++ b/shared/ssa/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ssa
-version: 0.2.10
+version: 0.2.11-dev
groups: shared
library: true
dependencies:
diff --git a/shared/threat-models/qlpack.yml b/shared/threat-models/qlpack.yml
index 60cbbc56fcb..ece8f74f701 100644
--- a/shared/threat-models/qlpack.yml
+++ b/shared/threat-models/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/threat-models
-version: 0.0.9
+version: 0.0.10-dev
library: true
groups: shared
dataExtensions:
diff --git a/shared/tutorial/qlpack.yml b/shared/tutorial/qlpack.yml
index 69116705c1b..b1f2b729a85 100644
--- a/shared/tutorial/qlpack.yml
+++ b/shared/tutorial/qlpack.yml
@@ -1,7 +1,7 @@
name: codeql/tutorial
description: Library for the CodeQL detective tutorials, helping new users learn to
write CodeQL queries.
-version: 0.2.10
+version: 0.2.11-dev
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/typetracking/qlpack.yml b/shared/typetracking/qlpack.yml
index fbbdcf5162a..efca1702069 100644
--- a/shared/typetracking/qlpack.yml
+++ b/shared/typetracking/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typetracking
-version: 0.2.10
+version: 0.2.11-dev
groups: shared
library: true
dependencies:
diff --git a/shared/typos/qlpack.yml b/shared/typos/qlpack.yml
index 4d59d9b3c34..76434dcb21c 100644
--- a/shared/typos/qlpack.yml
+++ b/shared/typos/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typos
-version: 0.2.10
+version: 0.2.11-dev
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/util/qlpack.yml b/shared/util/qlpack.yml
index 28ed738a93d..f4d51c896ce 100644
--- a/shared/util/qlpack.yml
+++ b/shared/util/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/util
-version: 0.2.10
+version: 0.2.11-dev
groups: shared
library: true
dependencies: null
diff --git a/shared/yaml/qlpack.yml b/shared/yaml/qlpack.yml
index 9643ffcec66..41f2bc851fd 100644
--- a/shared/yaml/qlpack.yml
+++ b/shared/yaml/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/yaml
-version: 0.2.10
+version: 0.2.11-dev
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/swift/ql/lib/qlpack.yml b/swift/ql/lib/qlpack.yml
index 70ec4798ea8..673004b5172 100644
--- a/swift/ql/lib/qlpack.yml
+++ b/swift/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-all
-version: 0.3.10
+version: 0.3.11-dev
groups: swift
extractor: swift
dbscheme: swift.dbscheme
diff --git a/swift/ql/src/qlpack.yml b/swift/ql/src/qlpack.yml
index ba66b065529..11192f11d8b 100644
--- a/swift/ql/src/qlpack.yml
+++ b/swift/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-queries
-version: 0.3.10
+version: 0.3.11-dev
groups:
- swift
- queries
From 8ae6fa5366839cd1cde7a4eadfb25b30ad128fd8 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Tue, 5 Mar 2024 16:23:58 -0800
Subject: [PATCH 040/309] C++: Add a new query 'cpp/type-confusion' for
detecting type confusion vulnerabilities.
---
.../Security/CWE/CWE-843/TypeConfusion.qhelp | 47 ++++
.../src/Security/CWE/CWE-843/TypeConfusion.ql | 251 ++++++++++++++++++
.../Security/CWE/CWE-843/TypeConfusionBad.cpp | 7 +
.../CWE/CWE-843/TypeConfusionCommon.cpp | 25 ++
.../CWE/CWE-843/TypeConfusionGood.cpp | 11 +
.../CWE/CWE-843/TypeConfusion.expected | 27 ++
.../Security/CWE/CWE-843/TypeConfusion.qlref | 1 +
.../query-tests/Security/CWE/CWE-843/test.cpp | 146 ++++++++++
8 files changed, 515 insertions(+)
create mode 100644 cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.qhelp
create mode 100644 cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql
create mode 100644 cpp/ql/src/Security/CWE/CWE-843/TypeConfusionBad.cpp
create mode 100644 cpp/ql/src/Security/CWE/CWE-843/TypeConfusionCommon.cpp
create mode 100644 cpp/ql/src/Security/CWE/CWE-843/TypeConfusionGood.cpp
create mode 100644 cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected
create mode 100644 cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.qlref
create mode 100644 cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
diff --git a/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.qhelp b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.qhelp
new file mode 100644
index 00000000000..b1ad3a7d6ce
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.qhelp
@@ -0,0 +1,47 @@
+
+
+
+
+
+Certain casts in C and C++ places no restrictions on the target type. For
+example, C style casts such as (MyClass*)p allows the programmer
+to cast any pointer p to an expression of type MyClass*.
+If the runtime type of p turns out to be a type that's incompatible
+with MyClass, this results in undefined behavior.
+
+
+
+
+
+If possible, use dynamic_cast to safely cast between polymorphic types.
+If dynamic_cast is not an option, use static_cast to restrict
+the kinds of conversions that the compiler is allowed to perform. If C++ style casts is
+not an option, carefully check that all casts are safe.
+
+
+
+
+
+Consider the following class hierachy where we define a base class Shape and two
+derived classes Circle and Square that are mutually incompatible:
+
+
+
+
+The following code demonstrates a type confusion vulnerability where the programmer
+assumes that the runtime type of p is always a Square.
+However, if p is a Circle, the cast will result in undefined behavior.
+
+
+
+
+The following code fixes the vulnerability by using dynamic_cast to
+safely cast between polymorphic types. If the cast fails, dynamic_cast
+returns a null pointer, which can be checked for and handled appropriately.
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql
new file mode 100644
index 00000000000..99f89106fb6
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql
@@ -0,0 +1,251 @@
+/**
+ * @name Type confusion
+ * @description Casting a value to an incompatible type can lead to undefined behavior.
+ * @kind path-problem
+ * @problem.severity warning
+ * @security-severity 9.3
+ * @precision medium
+ * @id cpp/type-confusion
+ * @tags security
+ * external/cwe/cwe-843
+ */
+
+import cpp
+import semmle.code.cpp.dataflow.new.DataFlow
+import BadFlow::PathGraph
+
+/**
+ * Holds if `f` is a field located at byte offset `offset` in `c`.
+ *
+ * Note that predicate is recursive, so that given the following:
+ * ```cpp
+ * struct S1 {
+ * int a;
+ * void* b;
+ * };
+ *
+ * struct S2 {
+ * S1 s1;
+ * char c;
+ * };
+ * ```
+ * both `hasAFieldWithOffset(S2, s1, 0)` and `hasAFieldWithOffset(S2, a, 0)`
+ * holds.
+ */
+predicate hasAFieldWithOffset(Class c, Field f, int offset) {
+ // Base case: `f` is a field in `c`.
+ f = c.getAField() and
+ offset = f.getByteOffset() and
+ not f.getUnspecifiedType().(Class).hasDefinition()
+ or
+ // Otherwise, we find the struct that is a field of `c` which then has
+ // the field `f` as a member.
+ exists(Field g |
+ g = c.getAField() and
+ // Find the field with the largest offset that's less than or equal to
+ // offset. That's the struct we need to search recursively.
+ g =
+ max(Field cand, int candOffset |
+ cand = c.getAField() and
+ candOffset = cand.getByteOffset() and
+ offset >= candOffset
+ |
+ cand order by candOffset
+ ) and
+ hasAFieldWithOffset(g.getUnspecifiedType(), f, offset - g.getByteOffset())
+ )
+}
+
+/** Holds if `f` is the last field of its declaring class. */
+predicate lastField(Field f) {
+ exists(Class c | c = f.getDeclaringType() |
+ f =
+ max(Field cand, int byteOffset |
+ cand.getDeclaringType() = c and byteOffset = f.getByteOffset()
+ |
+ cand order by byteOffset
+ )
+ )
+}
+
+/**
+ * Holds if there exists a field in `c2` at offset `offset` that's compatible
+ * with `f1`.
+ */
+bindingset[f1, offset, c2]
+pragma[inline_late]
+predicate hasCompatibleFieldAtOffset(Field f1, int offset, Class c2) {
+ exists(Field f2 | hasAFieldWithOffset(c2, f2, offset) |
+ // Let's not deal with bit-fields for now.
+ f2 instanceof BitField
+ or
+ f1.getUnspecifiedType().getSize() = f2.getUnspecifiedType().getSize()
+ or
+ lastField(f1) and
+ f1.getUnspecifiedType().getSize() <= f2.getUnspecifiedType().getSize()
+ )
+}
+
+/**
+ * Holds if `c1` is a prefix of `c2`.
+ */
+bindingset[c1, c2]
+pragma[inline_late]
+predicate prefix(Class c1, Class c2) {
+ not c1.isPolymorphic() and
+ not c2.isPolymorphic() and
+ if c1 instanceof Union
+ then
+ // If it's a union we just verify that one of it's variants is compatible with the other class
+ exists(Field f1, int offset |
+ // Let's not deal with bit-fields for now.
+ not f1 instanceof BitField and
+ hasAFieldWithOffset(c1, f1, offset)
+ |
+ hasCompatibleFieldAtOffset(f1, offset, c2)
+ )
+ else
+ forall(Field f1, int offset |
+ // Let's not deal with bit-fields for now.
+ not f1 instanceof BitField and
+ hasAFieldWithOffset(c1, f1, offset)
+ |
+ hasCompatibleFieldAtOffset(f1, offset, c2)
+ )
+}
+
+/**
+ * An unsafe cast is any explicit cast that is not
+ * a `dynamic_cast`.
+ */
+class UnsafeCast extends Cast {
+ private Class toType;
+
+ UnsafeCast() {
+ (
+ this instanceof CStyleCast
+ or
+ this instanceof StaticCast
+ or
+ this instanceof ReinterpretCast
+ ) and
+ toType = this.getExplicitlyConverted().getUnspecifiedType().stripType() and
+ not this.isImplicit() and
+ exists(TypeDeclarationEntry tde |
+ tde = toType.getDefinition() and
+ not tde.isFromUninstantiatedTemplate(_)
+ )
+ }
+
+ Class getConvertedType() { result = toType }
+
+ bindingset[this, t]
+ pragma[inline_late]
+ predicate compatibleWith(Type t) {
+ t.stripType() = this.getConvertedType()
+ or
+ prefix(this.getConvertedType(), t.stripType())
+ or
+ t.stripType().(Class).getABaseClass+() = this.getConvertedType()
+ or
+ t.stripType() = this.getConvertedType().getABaseClass+()
+ }
+}
+
+/**
+ * Holds if `source` is an allocation that allocates a value of type `state`.
+ */
+predicate isSourceImpl(DataFlow::Node source, Class state) {
+ state = source.asExpr().(AllocationExpr).getAllocatedElementType().stripType() and
+ exists(TypeDeclarationEntry tde |
+ tde = state.getDefinition() and
+ not tde.isFromUninstantiatedTemplate(_)
+ )
+}
+
+module RelevantStateConfig implements DataFlow::ConfigSig {
+ predicate isSource(DataFlow::Node source) { isSourceImpl(source, _) }
+
+ predicate isBarrier(DataFlow::Node node) {
+ // We disable flow through global variables to reduce FPs from infeasible paths
+ node instanceof DataFlow::VariableNode
+ or
+ exists(Class c | c = node.getType().stripType() |
+ not c.hasDefinition()
+ or
+ exists(TypeDeclarationEntry tde |
+ tde = c.getDefinition() and
+ tde.isFromUninstantiatedTemplate(_)
+ )
+ )
+ }
+
+ predicate isSink(DataFlow::Node sink) {
+ exists(UnsafeCast cast | sink.asExpr() = cast.getUnconverted())
+ }
+}
+
+module RelevantStateFlow = DataFlow::Global;
+
+predicate relevantState(DataFlow::Node sink, Class state) {
+ exists(DataFlow::Node source |
+ RelevantStateFlow::flow(source, sink) and
+ isSourceImpl(source, state)
+ )
+}
+
+predicate isSinkImpl(DataFlow::Node sink, Class state, Type convertedType, boolean compatible) {
+ exists(UnsafeCast cast |
+ relevantState(sink, state) and
+ sink.asExpr() = cast.getUnconverted() and
+ convertedType = cast.getConvertedType()
+ |
+ if cast.compatibleWith(state) then compatible = true else compatible = false
+ )
+}
+
+module BadConfig implements DataFlow::StateConfigSig {
+ class FlowState extends Class {
+ FlowState() { isSourceImpl(_, this) }
+ }
+
+ predicate isSource(DataFlow::Node source, FlowState state) { isSourceImpl(source, state) }
+
+ predicate isBarrier(DataFlow::Node node) { RelevantStateConfig::isBarrier(node) }
+
+ predicate isSink(DataFlow::Node sink, FlowState state) { isSinkImpl(sink, state, _, false) }
+
+ predicate isBarrierOut(DataFlow::Node sink, FlowState state) { isSink(sink, state) }
+}
+
+module BadFlow = DataFlow::GlobalWithState;
+
+module GoodConfig implements DataFlow::StateConfigSig {
+ class FlowState = BadConfig::FlowState;
+
+ predicate isSource(DataFlow::Node source, FlowState state) { BadConfig::isSource(source, state) }
+
+ predicate isBarrier(DataFlow::Node node) { BadConfig::isBarrier(node) }
+
+ predicate isSink(DataFlow::Node sink, FlowState state) {
+ isSinkImpl(sink, state, _, true) and
+ BadFlow::flowTo(sink)
+ }
+}
+
+module GoodFlow = DataFlow::GlobalWithState;
+
+from
+ BadFlow::PathNode source, BadFlow::PathNode sink, Type sourceType, Type sinkType,
+ DataFlow::Node sinkNode
+where
+ BadFlow::flowPath(source, sink) and
+ sinkNode = sink.getNode() and
+ // If there is any flow that would result in a valid cast then we don't
+ // report an alert here. This reduces the number of FPs from infeasible paths
+ // significantly.
+ not GoodFlow::flowTo(sinkNode) and
+ isSourceImpl(source.getNode(), sourceType) and
+ isSinkImpl(sinkNode, _, sinkType, false)
+select sinkNode, source, sink, "Conversion from $@ to $@ is invalid.", sourceType,
+ sourceType.toString(), sinkType, sinkType.toString()
diff --git a/cpp/ql/src/Security/CWE/CWE-843/TypeConfusionBad.cpp b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusionBad.cpp
new file mode 100644
index 00000000000..1ef9bfd3e31
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusionBad.cpp
@@ -0,0 +1,7 @@
+void allocate_and_draw_bad() {
+ Shape* shape = new Circle;
+ // ...
+ // BAD: Assumes that shape is always a Square
+ Square* square = static_cast(shape);
+ int length = square->getLength();
+}
\ No newline at end of file
diff --git a/cpp/ql/src/Security/CWE/CWE-843/TypeConfusionCommon.cpp b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusionCommon.cpp
new file mode 100644
index 00000000000..7bdee019588
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusionCommon.cpp
@@ -0,0 +1,25 @@
+struct Shape {
+ virtual ~Shape();
+
+ virtual void draw() = 0;
+};
+
+struct Circle : public Shape {
+ Circle();
+
+ void draw() override {
+ /* ... */
+ }
+
+ int getRadius();
+};
+
+struct Square : public Shape {
+ Square();
+
+ void draw() override {
+ /* ... */
+ }
+
+ int getLength();
+};
diff --git a/cpp/ql/src/Security/CWE/CWE-843/TypeConfusionGood.cpp b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusionGood.cpp
new file mode 100644
index 00000000000..f56a00a5e10
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusionGood.cpp
@@ -0,0 +1,11 @@
+void allocate_and_draw_good() {
+ Shape* shape = new Circle;
+ // ...
+ // GOOD: Dynamically checks if shape is a Square
+ Square* square = dynamic_cast(shape);
+ if(square) {
+ int length = square->getLength();
+ } else {
+ // handle error
+ }
+}
\ No newline at end of file
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected
new file mode 100644
index 00000000000..2bf82dec984
--- /dev/null
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected
@@ -0,0 +1,27 @@
+edges
+| test.cpp:27:13:27:18 | new | test.cpp:28:25:28:55 | p | provenance | |
+| test.cpp:32:13:32:30 | new | test.cpp:33:12:33:30 | p | provenance | |
+| test.cpp:66:15:66:21 | new | test.cpp:67:12:67:31 | a | provenance | |
+| test.cpp:85:9:85:15 | new | test.cpp:88:14:88:33 | a | provenance | |
+| test.cpp:127:12:127:17 | new | test.cpp:128:24:128:59 | s2 | provenance | |
+| test.cpp:143:14:143:19 | new | test.cpp:145:28:145:68 | s1_2 | provenance | |
+nodes
+| test.cpp:27:13:27:18 | new | semmle.label | new |
+| test.cpp:28:25:28:55 | p | semmle.label | p |
+| test.cpp:32:13:32:30 | new | semmle.label | new |
+| test.cpp:33:12:33:30 | p | semmle.label | p |
+| test.cpp:66:15:66:21 | new | semmle.label | new |
+| test.cpp:67:12:67:31 | a | semmle.label | a |
+| test.cpp:85:9:85:15 | new | semmle.label | new |
+| test.cpp:88:14:88:33 | a | semmle.label | a |
+| test.cpp:127:12:127:17 | new | semmle.label | new |
+| test.cpp:128:24:128:59 | s2 | semmle.label | s2 |
+| test.cpp:143:14:143:19 | new | semmle.label | new |
+| test.cpp:145:28:145:68 | s1_2 | semmle.label | s1_2 |
+subpaths
+#select
+| test.cpp:28:25:28:55 | p | test.cpp:27:13:27:18 | new | test.cpp:28:25:28:55 | p | Conversion from $@ to $@ is invalid. | test.cpp:1:8:1:9 | S1 | S1 | test.cpp:11:8:11:21 | Not_S1_wrapper | Not_S1_wrapper |
+| test.cpp:33:12:33:30 | p | test.cpp:32:13:32:30 | new | test.cpp:33:12:33:30 | p | Conversion from $@ to $@ is invalid. | test.cpp:11:8:11:21 | Not_S1_wrapper | Not_S1_wrapper | test.cpp:1:8:1:9 | S1 | S1 |
+| test.cpp:67:12:67:31 | a | test.cpp:66:15:66:21 | new | test.cpp:67:12:67:31 | a | Conversion from $@ to $@ is invalid. | test.cpp:55:8:55:10 | Cat | Cat | test.cpp:60:8:60:10 | Dog | Dog |
+| test.cpp:128:24:128:59 | s2 | test.cpp:127:12:127:17 | new | test.cpp:128:24:128:59 | s2 | Conversion from $@ to $@ is invalid. | test.cpp:102:8:102:9 | S2 | S2 | test.cpp:119:8:119:20 | Not_S2_prefix | Not_S2_prefix |
+| test.cpp:145:28:145:68 | s1_2 | test.cpp:143:14:143:19 | new | test.cpp:145:28:145:68 | s1_2 | Conversion from $@ to $@ is invalid. | test.cpp:1:8:1:9 | S1 | S1 | test.cpp:131:8:131:23 | HasSomeBitFields | HasSomeBitFields |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.qlref
new file mode 100644
index 00000000000..53b17f1e1fd
--- /dev/null
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.qlref
@@ -0,0 +1 @@
+Security/CWE/CWE-843/TypeConfusion.ql
\ No newline at end of file
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
new file mode 100644
index 00000000000..90d8b47c820
--- /dev/null
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
@@ -0,0 +1,146 @@
+struct S1 {
+ int a;
+ void* b;
+ unsigned char c;
+};
+
+struct S1_wrapper {
+ S1 s1;
+};
+
+struct Not_S1_wrapper {
+ unsigned char x;
+ S1 s1;
+};
+
+void test1() {
+ void* p = new S1;
+ S1_wrapper* s1w = static_cast(p); // GOOD
+}
+
+void test2() {
+ void* p = new S1_wrapper;
+ S1* s1 = static_cast(p); // GOOD
+}
+
+void test3() {
+ void* p = new S1;
+ Not_S1_wrapper* s1w = static_cast(p); // BAD
+}
+
+void test4() {
+ void* p = new Not_S1_wrapper;
+ S1* s1 = static_cast(p); // BAD
+}
+
+struct HasBitFields {
+ int x : 16;
+ int y : 16;
+ int z : 32;
+};
+
+struct BufferStruct {
+ unsigned char buffer[sizeof(HasBitFields)];
+};
+
+void test5() {
+ HasBitFields* p = new HasBitFields;
+ BufferStruct* bs = reinterpret_cast(p); // GOOD
+}
+
+struct Animal {
+ virtual ~Animal();
+};
+
+struct Cat : public Animal {
+ Cat();
+ ~Cat();
+};
+
+struct Dog : public Animal {
+ Dog();
+ ~Dog();
+};
+
+void test6() {
+ Animal* a = new Cat;
+ Dog* d = static_cast(a); // BAD
+}
+
+void test7() {
+ Animal* a = new Cat;
+ Dog* d = dynamic_cast(a); // GOOD
+}
+
+void test8() {
+ Animal* a = new Cat;
+ Cat* d = static_cast(a); // GOOD
+}
+
+void test9(bool b) {
+ Animal* a;
+ if(b) {
+ a = new Cat;
+ } else {
+ a = new Dog;
+ }
+ if(b) {
+ Cat* d = static_cast(a); // GOOD
+ }
+}
+
+/**
+ * The layout of S2 is:
+ * 0: int
+ * 8: void*
+ * 16: unsigned char
+ * 16 + pad: unsigned char
+ * 32 + pad: int
+ * 40 + pad: void*
+ * 48 + pad: unsigned char
+*/
+struct S2 {
+ S1 s1;
+ unsigned char buffer[16];
+ S1 s1_2;
+};
+
+struct S2_prefix {
+ int a;
+ void* p;
+ unsigned char c;
+};
+
+void test10() {
+ S2* s2 = new S2;
+ S2_prefix* s2p = reinterpret_cast(s2); // GOOD
+}
+
+struct Not_S2_prefix {
+ int a;
+ void* p;
+ void* p2;
+ unsigned char c;
+};
+
+void test11() {
+ S2* s2 = new S2;
+ Not_S2_prefix* s2p = reinterpret_cast(s2); // BAD
+}
+
+struct HasSomeBitFields {
+ int x : 16;
+ int y;
+ int z : 32;
+};
+
+void test12() {
+ // This has doesn't have any non-bitfield member, so we don't detect
+ // the problem here since the query currently ignores bitfields.
+ S1* s1 = new S1;
+ HasBitFields* hbf = reinterpret_cast(s1); // BAD [NOT DETECTED]
+
+ S1* s1_2 = new S1;
+ // This one has a non-bitfield members. So we detect the problem
+ HasSomeBitFields* hbf2 = reinterpret_cast(s1_2); // BAD
+}
From 6dc0fa515d03d48de8bf572edf97bb6d14c3f162 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Tue, 5 Mar 2024 16:29:37 -0800
Subject: [PATCH 041/309] C++: Add change note.
---
cpp/ql/src/change-notes/2024-03-05-type-confusion-query.md | 4 ++++
1 file changed, 4 insertions(+)
create mode 100644 cpp/ql/src/change-notes/2024-03-05-type-confusion-query.md
diff --git a/cpp/ql/src/change-notes/2024-03-05-type-confusion-query.md b/cpp/ql/src/change-notes/2024-03-05-type-confusion-query.md
new file mode 100644
index 00000000000..f96a4684b76
--- /dev/null
+++ b/cpp/ql/src/change-notes/2024-03-05-type-confusion-query.md
@@ -0,0 +1,4 @@
+---
+category: newQuery
+---
+* Added a new query, `cpp/type-confusion`, to detect casts to invalid types.
\ No newline at end of file
From cf4c8eb517982d81f4194bbdde7828af980f3a9f Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Wed, 6 Mar 2024 13:56:27 -0800
Subject: [PATCH 042/309] C++: Add more tests.
---
cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp | 1 +
1 file changed, 1 insertion(+)
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
index 90d8b47c820..879df4e23e6 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
@@ -144,3 +144,4 @@ void test12() {
// This one has a non-bitfield members. So we detect the problem
HasSomeBitFields* hbf2 = reinterpret_cast(s1_2); // BAD
}
+
From cd57cd0d8ac83218ec4bc388a98298fe70872661 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Wed, 6 Mar 2024 13:56:37 -0800
Subject: [PATCH 043/309] C++: Add qhelp reference.
---
cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.qhelp | 3 +++
1 file changed, 3 insertions(+)
diff --git a/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.qhelp b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.qhelp
index b1ad3a7d6ce..0f72a992205 100644
--- a/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.qhelp
+++ b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.qhelp
@@ -43,5 +43,8 @@ returns a null pointer, which can be checked for and handled appropriately.
+
+Microsoft Learn: Type conversions and type safety.
+
From c2db5f490e750b0e371f943376f59b8bbbae1355 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Wed, 6 Mar 2024 14:02:45 -0800
Subject: [PATCH 044/309] C++: Add more FNs and FPs to show examples of where
the 'successor typing' strategy fails.
---
.../CWE/CWE-843/TypeConfusion.expected | 7 +++++
.../query-tests/Security/CWE/CWE-843/test.cpp | 26 +++++++++++++++++++
2 files changed, 33 insertions(+)
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected
index 2bf82dec984..07c37663db9 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected
@@ -5,6 +5,8 @@ edges
| test.cpp:85:9:85:15 | new | test.cpp:88:14:88:33 | a | provenance | |
| test.cpp:127:12:127:17 | new | test.cpp:128:24:128:59 | s2 | provenance | |
| test.cpp:143:14:143:19 | new | test.cpp:145:28:145:68 | s1_2 | provenance | |
+| test.cpp:153:9:153:15 | new | test.cpp:159:14:159:33 | a | provenance | |
+| test.cpp:168:9:168:15 | new | test.cpp:171:14:171:33 | a | provenance | |
nodes
| test.cpp:27:13:27:18 | new | semmle.label | new |
| test.cpp:28:25:28:55 | p | semmle.label | p |
@@ -18,6 +20,10 @@ nodes
| test.cpp:128:24:128:59 | s2 | semmle.label | s2 |
| test.cpp:143:14:143:19 | new | semmle.label | new |
| test.cpp:145:28:145:68 | s1_2 | semmle.label | s1_2 |
+| test.cpp:153:9:153:15 | new | semmle.label | new |
+| test.cpp:159:14:159:33 | a | semmle.label | a |
+| test.cpp:168:9:168:15 | new | semmle.label | new |
+| test.cpp:171:14:171:33 | a | semmle.label | a |
subpaths
#select
| test.cpp:28:25:28:55 | p | test.cpp:27:13:27:18 | new | test.cpp:28:25:28:55 | p | Conversion from $@ to $@ is invalid. | test.cpp:1:8:1:9 | S1 | S1 | test.cpp:11:8:11:21 | Not_S1_wrapper | Not_S1_wrapper |
@@ -25,3 +31,4 @@ subpaths
| test.cpp:67:12:67:31 | a | test.cpp:66:15:66:21 | new | test.cpp:67:12:67:31 | a | Conversion from $@ to $@ is invalid. | test.cpp:55:8:55:10 | Cat | Cat | test.cpp:60:8:60:10 | Dog | Dog |
| test.cpp:128:24:128:59 | s2 | test.cpp:127:12:127:17 | new | test.cpp:128:24:128:59 | s2 | Conversion from $@ to $@ is invalid. | test.cpp:102:8:102:9 | S2 | S2 | test.cpp:119:8:119:20 | Not_S2_prefix | Not_S2_prefix |
| test.cpp:145:28:145:68 | s1_2 | test.cpp:143:14:143:19 | new | test.cpp:145:28:145:68 | s1_2 | Conversion from $@ to $@ is invalid. | test.cpp:1:8:1:9 | S1 | S1 | test.cpp:131:8:131:23 | HasSomeBitFields | HasSomeBitFields |
+| test.cpp:159:14:159:33 | a | test.cpp:153:9:153:15 | new | test.cpp:159:14:159:33 | a | Conversion from $@ to $@ is invalid. | test.cpp:60:8:60:10 | Dog | Dog | test.cpp:55:8:55:10 | Cat | Cat |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
index 879df4e23e6..1ba1aa2062c 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
@@ -145,3 +145,29 @@ void test12() {
HasSomeBitFields* hbf2 = reinterpret_cast(s1_2); // BAD
}
+void test13(bool b, Cat* c) {
+ Animal* a;
+ if(b) {
+ a = c;
+ } else {
+ a = new Dog;
+ }
+ // This FP happens despite the `not GoodFlow::flowTo(sinkNode)` condition in the query
+ // because we don't find a flow path from `a = c` to `static_cast(a)` because
+ // the "source" (i.e., `a = c`) doesn't have an allocation.
+ if(b) {
+ Cat* d = static_cast(a); // GOOD [FALSE POSITIVE]
+ }
+}
+
+void test14(bool b) {
+ Animal* a;
+ if(b) {
+ a = new Cat;
+ } else {
+ a = new Dog;
+ }
+ if(!b) {
+ Cat* d = static_cast(a); // BAD [NOT DETECTED]
+ }
+}
From fc9919a5b61f824f62f993ab0d30e3bb45bf7449 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Wed, 6 Mar 2024 14:20:15 -0800
Subject: [PATCH 045/309] C++: Add a test that exercise the 'last field' check.
---
.../CWE/CWE-843/TypeConfusion.expected | 4 ++++
.../query-tests/Security/CWE/CWE-843/test.cpp | 19 +++++++++++++++++++
2 files changed, 23 insertions(+)
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected
index 07c37663db9..04e5462bf01 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected
@@ -7,6 +7,7 @@ edges
| test.cpp:143:14:143:19 | new | test.cpp:145:28:145:68 | s1_2 | provenance | |
| test.cpp:153:9:153:15 | new | test.cpp:159:14:159:33 | a | provenance | |
| test.cpp:168:9:168:15 | new | test.cpp:171:14:171:33 | a | provenance | |
+| test.cpp:187:15:187:24 | new | test.cpp:189:25:189:45 | u64 | provenance | |
nodes
| test.cpp:27:13:27:18 | new | semmle.label | new |
| test.cpp:28:25:28:55 | p | semmle.label | p |
@@ -24,6 +25,8 @@ nodes
| test.cpp:159:14:159:33 | a | semmle.label | a |
| test.cpp:168:9:168:15 | new | semmle.label | new |
| test.cpp:171:14:171:33 | a | semmle.label | a |
+| test.cpp:187:15:187:24 | new | semmle.label | new |
+| test.cpp:189:25:189:45 | u64 | semmle.label | u64 |
subpaths
#select
| test.cpp:28:25:28:55 | p | test.cpp:27:13:27:18 | new | test.cpp:28:25:28:55 | p | Conversion from $@ to $@ is invalid. | test.cpp:1:8:1:9 | S1 | S1 | test.cpp:11:8:11:21 | Not_S1_wrapper | Not_S1_wrapper |
@@ -32,3 +35,4 @@ subpaths
| test.cpp:128:24:128:59 | s2 | test.cpp:127:12:127:17 | new | test.cpp:128:24:128:59 | s2 | Conversion from $@ to $@ is invalid. | test.cpp:102:8:102:9 | S2 | S2 | test.cpp:119:8:119:20 | Not_S2_prefix | Not_S2_prefix |
| test.cpp:145:28:145:68 | s1_2 | test.cpp:143:14:143:19 | new | test.cpp:145:28:145:68 | s1_2 | Conversion from $@ to $@ is invalid. | test.cpp:1:8:1:9 | S1 | S1 | test.cpp:131:8:131:23 | HasSomeBitFields | HasSomeBitFields |
| test.cpp:159:14:159:33 | a | test.cpp:153:9:153:15 | new | test.cpp:159:14:159:33 | a | Conversion from $@ to $@ is invalid. | test.cpp:60:8:60:10 | Dog | Dog | test.cpp:55:8:55:10 | Cat | Cat |
+| test.cpp:189:25:189:45 | u64 | test.cpp:187:15:187:24 | new | test.cpp:189:25:189:45 | u64 | Conversion from $@ to $@ is invalid. | test.cpp:175:8:175:13 | UInt64 | UInt64 | test.cpp:184:8:184:22 | UInt8_with_more | UInt8_with_more |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
index 1ba1aa2062c..6b5b5ccde37 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
@@ -171,3 +171,22 @@ void test14(bool b) {
Cat* d = static_cast(a); // BAD [NOT DETECTED]
}
}
+
+struct UInt64 { unsigned long u64; };
+struct UInt8 { unsigned char u8; };
+
+void test14() {
+ void* u64 = new UInt64;
+ // ...
+ UInt8* u8 = (UInt8*)u64; // GOOD
+}
+
+struct UInt8_with_more { UInt8 u8; void* p; };
+
+void test15() {
+ void* u64 = new UInt64;
+ // ...
+ UInt8_with_more* u8 = (UInt8_with_more*)u64; // BAD
+}
+
+// semmle-extractor-options: --gcc -std=c++11
From 3295d5cb9f03911a99831cf51fb70ce039559b1e Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Wed, 6 Mar 2024 14:36:18 -0800
Subject: [PATCH 046/309] C++: Add more QLDoc.
---
.../src/Security/CWE/CWE-843/TypeConfusion.ql | 54 ++++++++++++++++++-
1 file changed, 53 insertions(+), 1 deletion(-)
diff --git a/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql
index 99f89106fb6..6bfe9164a39 100644
--- a/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql
+++ b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql
@@ -163,6 +163,12 @@ predicate isSourceImpl(DataFlow::Node source, Class state) {
)
}
+/**
+ * The `RelevantStateConfig` configuration is used to find the set of
+ * states for the `BadConfig` and `GoodConfig`. The flow computed by
+ * `RelevantStateConfig` is used to implement the `relevantState` predicate
+ * which is used to avoid a cartesian product in `isSinkImpl`.
+ */
module RelevantStateConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { isSourceImpl(source, _) }
@@ -204,9 +210,16 @@ predicate isSinkImpl(DataFlow::Node sink, Class state, Type convertedType, boole
)
}
+/**
+ * The `BadConfig` configuration tracks flow from an allocation to an
+ * incompatible cast.
+ *
+ * We use `FlowState` to track the type of the source, and compare the
+ * flow state to the target of the cast in the `isSink` definition.
+ */
module BadConfig implements DataFlow::StateConfigSig {
class FlowState extends Class {
- FlowState() { isSourceImpl(_, this) }
+ FlowState() { relevantState(_, this) }
}
predicate isSource(DataFlow::Node source, FlowState state) { isSourceImpl(source, state) }
@@ -220,6 +233,45 @@ module BadConfig implements DataFlow::StateConfigSig {
module BadFlow = DataFlow::GlobalWithState;
+/**
+ * The `GoodConfig` configuration tracks flow from an allocation to a
+ * compatible cast.
+ *
+ * We use `GoodConfig` to reduce the number of FPs from infeasible paths.
+ * For example, consider the following example:
+ * ```cpp
+ * struct Animal { virtual ~Animal(); };
+ *
+ * struct Cat : public Animal {
+ * Cat();
+ * ~Cat();
+ * };
+ *
+ * struct Dog : public Animal {
+ * Dog();
+ * ~Dog();
+ * };
+ *
+ * void test9(bool b) {
+ * Animal* a;
+ * if(b) {
+ * a = new Cat;
+ * } else {
+ * a = new Dog;
+ * }
+ * if(b) {
+ * Cat* d = static_cast(a);
+ * }
+ * }
+ * ```
+ * Here, `BadConfig` finds a flow from `a = new Dog` to `static_cast(a)`.
+ * However, that path is never realized in an actual execution path. So in
+ * order to remove this result we exclude results where there exists an
+ * allocation of a type that's compatible with `static_cast(a)`.
+ *
+ * We use `FlowState` to track the type of the source, and compare the
+ * flow state to the target of the cast in the `isSink` definition.
+ */
module GoodConfig implements DataFlow::StateConfigSig {
class FlowState = BadConfig::FlowState;
From bf84f3a936c07ca822a8394984cb84ebbba7ece7 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Wed, 6 Mar 2024 15:53:16 -0800
Subject: [PATCH 047/309] C++: Add FN.
---
.../query-tests/Security/CWE/CWE-843/test.cpp | 22 ++++++++++++++++++-
1 file changed, 21 insertions(+), 1 deletion(-)
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
index 6b5b5ccde37..3fdafd9d02f 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
@@ -189,4 +189,24 @@ void test15() {
UInt8_with_more* u8 = (UInt8_with_more*)u64; // BAD
}
-// semmle-extractor-options: --gcc -std=c++11
+struct SingleInt {
+ int i;
+} __attribute__((packed));;
+
+struct PairInts {
+ int x, y;
+} __attribute__((packed));;
+
+union MyUnion
+{
+ PairInts p;
+ unsigned long long foo;
+} __attribute__((packed));
+
+void test16() {
+ void* si = new SingleInt;
+ // ...
+ MyUnion* mu = (MyUnion*)si; // BAD [NOT DETECTED]
+}
+
+// semmle-extractor-options: --gcc -std=c++11
\ No newline at end of file
From 01fc7432cb79bc30857988401f8a4776c7b211e3 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Wed, 6 Mar 2024 22:17:33 -0800
Subject: [PATCH 048/309] C++: Add more tests.
---
.../CWE/CWE-843/TypeConfusion.expected | 8 ++++++++
.../query-tests/Security/CWE/CWE-843/test.cpp | 18 ++++++++++++++++++
2 files changed, 26 insertions(+)
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected
index 04e5462bf01..45355a86a48 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected
@@ -8,6 +8,8 @@ edges
| test.cpp:153:9:153:15 | new | test.cpp:159:14:159:33 | a | provenance | |
| test.cpp:168:9:168:15 | new | test.cpp:171:14:171:33 | a | provenance | |
| test.cpp:187:15:187:24 | new | test.cpp:189:25:189:45 | u64 | provenance | |
+| test.cpp:217:13:217:18 | new | test.cpp:218:30:218:65 | p | provenance | |
+| test.cpp:226:13:226:18 | new | test.cpp:227:29:227:63 | p | provenance | |
nodes
| test.cpp:27:13:27:18 | new | semmle.label | new |
| test.cpp:28:25:28:55 | p | semmle.label | p |
@@ -27,6 +29,10 @@ nodes
| test.cpp:171:14:171:33 | a | semmle.label | a |
| test.cpp:187:15:187:24 | new | semmle.label | new |
| test.cpp:189:25:189:45 | u64 | semmle.label | u64 |
+| test.cpp:217:13:217:18 | new | semmle.label | new |
+| test.cpp:218:30:218:65 | p | semmle.label | p |
+| test.cpp:226:13:226:18 | new | semmle.label | new |
+| test.cpp:227:29:227:63 | p | semmle.label | p |
subpaths
#select
| test.cpp:28:25:28:55 | p | test.cpp:27:13:27:18 | new | test.cpp:28:25:28:55 | p | Conversion from $@ to $@ is invalid. | test.cpp:1:8:1:9 | S1 | S1 | test.cpp:11:8:11:21 | Not_S1_wrapper | Not_S1_wrapper |
@@ -36,3 +42,5 @@ subpaths
| test.cpp:145:28:145:68 | s1_2 | test.cpp:143:14:143:19 | new | test.cpp:145:28:145:68 | s1_2 | Conversion from $@ to $@ is invalid. | test.cpp:1:8:1:9 | S1 | S1 | test.cpp:131:8:131:23 | HasSomeBitFields | HasSomeBitFields |
| test.cpp:159:14:159:33 | a | test.cpp:153:9:153:15 | new | test.cpp:159:14:159:33 | a | Conversion from $@ to $@ is invalid. | test.cpp:60:8:60:10 | Dog | Dog | test.cpp:55:8:55:10 | Cat | Cat |
| test.cpp:189:25:189:45 | u64 | test.cpp:187:15:187:24 | new | test.cpp:189:25:189:45 | u64 | Conversion from $@ to $@ is invalid. | test.cpp:175:8:175:13 | UInt64 | UInt64 | test.cpp:184:8:184:22 | UInt8_with_more | UInt8_with_more |
+| test.cpp:218:30:218:65 | p | test.cpp:217:13:217:18 | new | test.cpp:218:30:218:65 | p | Conversion from $@ to $@ is invalid. | test.cpp:1:8:1:9 | S1 | S1 | test.cpp:212:8:212:26 | UnrelatedStructSize | UnrelatedStructSize |
+| test.cpp:227:29:227:63 | p | test.cpp:226:13:226:18 | new | test.cpp:227:29:227:63 | p | Conversion from $@ to $@ is invalid. | test.cpp:1:8:1:9 | S1 | S1 | test.cpp:221:8:221:25 | TooLargeBufferSize | TooLargeBufferSize |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
index 3fdafd9d02f..982496218ff 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
@@ -209,4 +209,22 @@ void test16() {
MyUnion* mu = (MyUnion*)si; // BAD [NOT DETECTED]
}
+struct UnrelatedStructSize {
+ unsigned char buffer[1024];
+};
+
+void test17() {
+ void* p = new S1;
+ UnrelatedStructSize* uss = static_cast(p); // BAD
+}
+
+struct TooLargeBufferSize {
+ unsigned char buffer[sizeof(S1) + 1];
+};
+
+void test18() {
+ void* p = new S1;
+ TooLargeBufferSize* uss = static_cast(p); // BAD
+}
+
// semmle-extractor-options: --gcc -std=c++11
\ No newline at end of file
From b876117eccf7b1e7c9db393ce0d6e2d1277a382a Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Wed, 6 Mar 2024 22:25:04 -0800
Subject: [PATCH 049/309] C++: Add more QLDoc.
---
cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql
index 6bfe9164a39..d43e0145c99 100644
--- a/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql
+++ b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql
@@ -139,6 +139,20 @@ class UnsafeCast extends Cast {
Class getConvertedType() { result = toType }
+ /**
+ * Holds if the result of this cast can safely be interpreted as a value of
+ * type `t`.
+ *
+ * The compatibility rules are as follows:
+ *
+ * 1. the result of `(T)x` is compatible with the type `T` for any `T`
+ * 2. the result of `(T)x` is compatible with the type `U` for any `U` such
+ * that `U` is a subtype of `T`, or `T` is a subtype of `U`.
+ * 3. the result of `(T)x` is compatible with the type `U` if `U` the list
+ * of fields of `U` is a prefix of the list of fields of `T`.
+ * For example, if `T` is `struct { unsigned char x; int y; };`
+ * and `U` is `struct { unsigned char uc; };`.
+ */
bindingset[this, t]
pragma[inline_late]
predicate compatibleWith(Type t) {
From 7d74125508aaf237af675369655dbce2a0ae1b3d Mon Sep 17 00:00:00 2001
From: Tony Torralba
Date: Thu, 7 Mar 2024 15:17:49 +0100
Subject: [PATCH 050/309] Go: Promote go/uncontrolled-allocation-size
---
.../security/UncontrolledAllocationSize.qll | 34 +++++++++++
...controlledAllocationSizeCustomizations.qll | 33 +++++++++++
.../CWE-770/UncontrolledAllocationSize.qhelp | 36 +++++++++++
.../CWE-770/UncontrolledAllocationSize.ql | 22 +++++++
.../CWE-770/UncontrolledAllocationSizeBad.go} | 0
.../UncontrolledAllocationSizeGood.go} | 0
...2024-03-07-uncontrolled-allocation-size.md | 4 ++
.../CWE-770/DenialOfService.qhelp | 32 ----------
.../experimental/CWE-770/DenialOfService.ql | 59 -------------------
.../CWE-770/DenialOfService.expected | 18 ------
.../CWE-770/DenialOfService.qlref | 1 -
.../UncontrolledAllocationSize.expected | 0
.../CWE-770/UncontrolledAllocationSize.ql | 4 ++
.../CWE-770/UncontrolledAllocationSizeBad.go} | 2 +-
.../UncontrolledAllocationSizeGood.go} | 0
15 files changed, 134 insertions(+), 111 deletions(-)
create mode 100644 go/ql/lib/semmle/go/security/UncontrolledAllocationSize.qll
create mode 100644 go/ql/lib/semmle/go/security/UncontrolledAllocationSizeCustomizations.qll
create mode 100644 go/ql/src/Security/CWE-770/UncontrolledAllocationSize.qhelp
create mode 100644 go/ql/src/Security/CWE-770/UncontrolledAllocationSize.ql
rename go/ql/src/{experimental/CWE-770/DenialOfServiceBad.go => Security/CWE-770/UncontrolledAllocationSizeBad.go} (100%)
rename go/ql/src/{experimental/CWE-770/DenialOfServiceGood.go => Security/CWE-770/UncontrolledAllocationSizeGood.go} (100%)
create mode 100644 go/ql/src/change-notes/2024-03-07-uncontrolled-allocation-size.md
delete mode 100644 go/ql/src/experimental/CWE-770/DenialOfService.qhelp
delete mode 100644 go/ql/src/experimental/CWE-770/DenialOfService.ql
delete mode 100644 go/ql/test/experimental/CWE-770/DenialOfService.expected
delete mode 100644 go/ql/test/experimental/CWE-770/DenialOfService.qlref
create mode 100644 go/ql/test/query-tests/Security/CWE-770/UncontrolledAllocationSize.expected
create mode 100644 go/ql/test/query-tests/Security/CWE-770/UncontrolledAllocationSize.ql
rename go/ql/test/{experimental/CWE-770/DenialOfServiceBad.go => query-tests/Security/CWE-770/UncontrolledAllocationSizeBad.go} (89%)
rename go/ql/test/{experimental/CWE-770/DenialOfServiceGood.go => query-tests/Security/CWE-770/UncontrolledAllocationSizeGood.go} (100%)
diff --git a/go/ql/lib/semmle/go/security/UncontrolledAllocationSize.qll b/go/ql/lib/semmle/go/security/UncontrolledAllocationSize.qll
new file mode 100644
index 00000000000..885aa7a7053
--- /dev/null
+++ b/go/ql/lib/semmle/go/security/UncontrolledAllocationSize.qll
@@ -0,0 +1,34 @@
+/**
+ * Provides a taint-tracking configuration for reasoning about uncontrolled allocation size issues.
+ */
+
+import go
+
+/**
+ * Provides a taint-tracking flow for reasoning about uncontrolled allocation size issues.
+ */
+module UncontrolledAllocationSize {
+ private import UncontrolledAllocationSizeCustomizations::UncontrolledAllocationSize
+
+ /**
+ * Module for defining predicates and tracking taint flow related to uncontrolled allocation size issues.
+ */
+ module Config implements DataFlow::ConfigSig {
+ predicate isSource(DataFlow::Node source) { source instanceof Source }
+
+ predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
+
+ predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+
+ predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
+ exists(Function f, DataFlow::CallNode cn | cn = f.getACall() |
+ f.hasQualifiedName("strconv", ["Atoi", "ParseInt", "ParseUint", "ParseFloat"]) and
+ node1 = cn.getArgument(0) and
+ node2 = cn.getResult(0)
+ )
+ }
+ }
+
+ /** Tracks taint flow for reasoning about uncontrolled allocation size issues. */
+ module Flow = TaintTracking::Global;
+}
diff --git a/go/ql/lib/semmle/go/security/UncontrolledAllocationSizeCustomizations.qll b/go/ql/lib/semmle/go/security/UncontrolledAllocationSizeCustomizations.qll
new file mode 100644
index 00000000000..1237971dde1
--- /dev/null
+++ b/go/ql/lib/semmle/go/security/UncontrolledAllocationSizeCustomizations.qll
@@ -0,0 +1,33 @@
+/**
+ * Provides default sources, sinks, and sanitizers for reasoning about uncontrolled allocation size issues,
+ * as well as extension points for adding your own.
+ */
+
+import go
+private import semmle.go.security.AllocationSizeOverflow
+
+/**
+ * Provides extension points for customizing the taint-tracking configuration for reasoning
+ * about uncontrolled allocation size issues.
+ */
+module UncontrolledAllocationSize {
+ /** A data flow source for uncontrolled allocation size vulnerabilities. */
+ abstract class Source extends DataFlow::Node { }
+
+ /** A data flow sink for uncontrolled allocation size vulnerabilities. */
+ abstract class Sink extends DataFlow::Node { }
+
+ /** A sanitizer for uncontrolled allocation size vulnerabilities. */
+ abstract class Sanitizer extends DataFlow::Node { }
+
+ /** A source of untrusted data, considered as a taint source for uncontrolled size allocation vulnerabilities. */
+ private class UntrustedFlowAsSource extends Source instanceof UntrustedFlowSource { }
+
+ /** The size argument of a memory allocation function. */
+ private class AllocationSizeAsSink extends Sink instanceof AllocationSizeOverflow::AllocationSize {
+ }
+
+ /** A check that a value is below some upper limit. */
+ private class SizeCheckSanitizer extends Sanitizer instanceof AllocationSizeOverflow::AllocationSizeCheckBarrier
+ { }
+}
diff --git a/go/ql/src/Security/CWE-770/UncontrolledAllocationSize.qhelp b/go/ql/src/Security/CWE-770/UncontrolledAllocationSize.qhelp
new file mode 100644
index 00000000000..b4029e93e1e
--- /dev/null
+++ b/go/ql/src/Security/CWE-770/UncontrolledAllocationSize.qhelp
@@ -0,0 +1,36 @@
+
+
+
+
+ Using untrusted input to allocate slices with the built-in make function could
+ lead to excessive memory allocation and potentially cause the program to crash due to running
+ out of memory. This vulnerability could be exploited to perform a denial-of-service attack by
+ consuming all available server resources.
+
+
+
+ Implement a maximum allowed value for size allocations with the built-in make
+ function to prevent excessively large allocations.
+
+
+
+ In the following example snippet, the n parameter is user-controlled.
+ If the external user provides an excessively large value, the application allocates a slice
+ of size n without further verification, potentially exhausting all the available
+ memory.
+
+
+
+ One way to prevent this vulnerability is by implementing a maximum allowed value for the
+ user-controlled input, as seen in the following example:
+
+
+
+
+
+ OWASP: Denial
+ of Service Cheat Sheet
+
+
+
\ No newline at end of file
diff --git a/go/ql/src/Security/CWE-770/UncontrolledAllocationSize.ql b/go/ql/src/Security/CWE-770/UncontrolledAllocationSize.ql
new file mode 100644
index 00000000000..2be09c6901b
--- /dev/null
+++ b/go/ql/src/Security/CWE-770/UncontrolledAllocationSize.ql
@@ -0,0 +1,22 @@
+/**
+ * @name Slice memory allocation with excessive size value
+ * @description Allocating memory for slices with the built-in make function from user-controlled sources
+ * can lead to a denial of service.
+ * @kind path-problem
+ * @problem.severity warning
+ * @security-severity 6.0
+ * @precision high
+ * @id go/uncontrolled-allocation-size
+ * @tags security
+ * external/cwe/cwe-770
+ */
+
+import go
+import semmle.go.security.UncontrolledAllocationSize
+import UncontrolledAllocationSize::Flow::PathGraph
+
+from
+ UncontrolledAllocationSize::Flow::PathNode source, UncontrolledAllocationSize::Flow::PathNode sink
+where UncontrolledAllocationSize::Flow::flowPath(source, sink)
+select sink, source, sink, "This memory allocation depends on a $@.", source.getNode(),
+ "user-provided value"
diff --git a/go/ql/src/experimental/CWE-770/DenialOfServiceBad.go b/go/ql/src/Security/CWE-770/UncontrolledAllocationSizeBad.go
similarity index 100%
rename from go/ql/src/experimental/CWE-770/DenialOfServiceBad.go
rename to go/ql/src/Security/CWE-770/UncontrolledAllocationSizeBad.go
diff --git a/go/ql/src/experimental/CWE-770/DenialOfServiceGood.go b/go/ql/src/Security/CWE-770/UncontrolledAllocationSizeGood.go
similarity index 100%
rename from go/ql/src/experimental/CWE-770/DenialOfServiceGood.go
rename to go/ql/src/Security/CWE-770/UncontrolledAllocationSizeGood.go
diff --git a/go/ql/src/change-notes/2024-03-07-uncontrolled-allocation-size.md b/go/ql/src/change-notes/2024-03-07-uncontrolled-allocation-size.md
new file mode 100644
index 00000000000..663932005eb
--- /dev/null
+++ b/go/ql/src/change-notes/2024-03-07-uncontrolled-allocation-size.md
@@ -0,0 +1,4 @@
+---
+category: newQuery
+---
+* The query "Slice memory allocation with excessive size value" (`go/uncontrolled-allocation-size`) has been promoted from experimental to the main query pack. Its results will now appear by default. This query was originally [submitted as an experimental query by @Malayke](https://github.com/github/codeql/pull/15130).
diff --git a/go/ql/src/experimental/CWE-770/DenialOfService.qhelp b/go/ql/src/experimental/CWE-770/DenialOfService.qhelp
deleted file mode 100644
index b91f1f7e3b0..00000000000
--- a/go/ql/src/experimental/CWE-770/DenialOfService.qhelp
+++ /dev/null
@@ -1,32 +0,0 @@
-
-
-
-
- Using untrusted input to created with the built-in make function
- could lead to excessive memory allocation and potentially cause the program to crash due
- to running out of memory. This vulnerability could be exploited to perform a DoS attack by consuming all available server resources.
-
-
-
- Implement a maximum allowed value for creates a slice with the built-in make function to prevent excessively large allocations.
- For instance, you could restrict it to a reasonable upper limit.
-
-
-
- In the following example snippet, the n field is user-controlled.
- The server trusts that n has an acceptable value, however when using a maliciously large value,
- it allocates a slice of n of strings before filling the slice with data.
-
-
-
- One way to prevent this vulnerability is by implementing a maximum allowed value for the user-controlled input:
-
-
-
-
-
-
- OWASP: Denial of Service Cheat Sheet
-
-
-
\ No newline at end of file
diff --git a/go/ql/src/experimental/CWE-770/DenialOfService.ql b/go/ql/src/experimental/CWE-770/DenialOfService.ql
deleted file mode 100644
index 199cd0df552..00000000000
--- a/go/ql/src/experimental/CWE-770/DenialOfService.ql
+++ /dev/null
@@ -1,59 +0,0 @@
-/**
- * @name Denial Of Service
- * @description slices created with the built-in make function from user-controlled sources using a
- * maliciously large value possibly leading to a denial of service.
- * @kind path-problem
- * @problem.severity error
- * @security-severity 9
- * @precision high
- * @id go/denial-of-service
- * @tags security
- * experimental
- * external/cwe/cwe-770
- */
-
-import go
-
-/**
- * Holds if the guard `g` on its branch `branch` checks that `e` is not constant and is less than some other value.
- */
-predicate denialOfServiceSanitizerGuard(DataFlow::Node g, Expr e, boolean branch) {
- exists(DataFlow::Node lesser |
- e = lesser.asExpr() and
- g.(DataFlow::RelationalComparisonNode).leq(branch, lesser, _, _) and
- not e.isConst()
- )
-}
-
-/**
- * Module for defining predicates and tracking taint flow related to denial of service issues.
- */
-module Config implements DataFlow::ConfigSig {
- predicate isSource(DataFlow::Node source) { source instanceof UntrustedFlowSource }
-
- predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
- exists(Function f, DataFlow::CallNode cn | cn = f.getACall() |
- f.hasQualifiedName("strconv", ["Atoi", "ParseInt", "ParseUint", "ParseFloat"]) and
- node1 = cn.getArgument(0) and
- node2 = cn.getResult(0)
- )
- }
-
- predicate isBarrier(DataFlow::Node node) {
- node = DataFlow::BarrierGuard::getABarrierNode()
- }
-
- predicate isSink(DataFlow::Node sink) { sink = Builtin::make().getACall().getArgument(0) }
-}
-
-/**
- * Tracks taint flow for reasoning about denial of service, where source is
- * user-controlled and unchecked.
- */
-module Flow = TaintTracking::Global;
-
-import Flow::PathGraph
-
-from Flow::PathNode source, Flow::PathNode sink
-where Flow::flowPath(source, sink)
-select sink, source, sink, "This variable might be leading to denial of service."
diff --git a/go/ql/test/experimental/CWE-770/DenialOfService.expected b/go/ql/test/experimental/CWE-770/DenialOfService.expected
deleted file mode 100644
index 4a2ae9d6646..00000000000
--- a/go/ql/test/experimental/CWE-770/DenialOfService.expected
+++ /dev/null
@@ -1,18 +0,0 @@
-edges
-| DenialOfServiceBad.go:11:12:11:16 | selection of URL | DenialOfServiceBad.go:11:12:11:24 | call to Query | provenance | |
-| DenialOfServiceBad.go:11:12:11:24 | call to Query | DenialOfServiceBad.go:13:15:13:20 | source | provenance | |
-| DenialOfServiceBad.go:13:15:13:20 | source | DenialOfServiceBad.go:13:15:13:29 | call to Get | provenance | |
-| DenialOfServiceBad.go:13:15:13:29 | call to Get | DenialOfServiceBad.go:14:28:14:36 | sourceStr | provenance | |
-| DenialOfServiceBad.go:14:2:14:37 | ... := ...[0] | DenialOfServiceBad.go:20:27:20:30 | sink | provenance | |
-| DenialOfServiceBad.go:14:28:14:36 | sourceStr | DenialOfServiceBad.go:14:2:14:37 | ... := ...[0] | provenance | |
-nodes
-| DenialOfServiceBad.go:11:12:11:16 | selection of URL | semmle.label | selection of URL |
-| DenialOfServiceBad.go:11:12:11:24 | call to Query | semmle.label | call to Query |
-| DenialOfServiceBad.go:13:15:13:20 | source | semmle.label | source |
-| DenialOfServiceBad.go:13:15:13:29 | call to Get | semmle.label | call to Get |
-| DenialOfServiceBad.go:14:2:14:37 | ... := ...[0] | semmle.label | ... := ...[0] |
-| DenialOfServiceBad.go:14:28:14:36 | sourceStr | semmle.label | sourceStr |
-| DenialOfServiceBad.go:20:27:20:30 | sink | semmle.label | sink |
-subpaths
-#select
-| DenialOfServiceBad.go:20:27:20:30 | sink | DenialOfServiceBad.go:11:12:11:16 | selection of URL | DenialOfServiceBad.go:20:27:20:30 | sink | This variable might be leading to denial of service. |
diff --git a/go/ql/test/experimental/CWE-770/DenialOfService.qlref b/go/ql/test/experimental/CWE-770/DenialOfService.qlref
deleted file mode 100644
index e5896bb61df..00000000000
--- a/go/ql/test/experimental/CWE-770/DenialOfService.qlref
+++ /dev/null
@@ -1 +0,0 @@
-experimental/CWE-770/DenialOfService.ql
\ No newline at end of file
diff --git a/go/ql/test/query-tests/Security/CWE-770/UncontrolledAllocationSize.expected b/go/ql/test/query-tests/Security/CWE-770/UncontrolledAllocationSize.expected
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/go/ql/test/query-tests/Security/CWE-770/UncontrolledAllocationSize.ql b/go/ql/test/query-tests/Security/CWE-770/UncontrolledAllocationSize.ql
new file mode 100644
index 00000000000..18add3a4881
--- /dev/null
+++ b/go/ql/test/query-tests/Security/CWE-770/UncontrolledAllocationSize.ql
@@ -0,0 +1,4 @@
+import go
+import semmle.go.security.UncontrolledAllocationSize
+import TestUtilities.InlineFlowTest
+import FlowTest
diff --git a/go/ql/test/experimental/CWE-770/DenialOfServiceBad.go b/go/ql/test/query-tests/Security/CWE-770/UncontrolledAllocationSizeBad.go
similarity index 89%
rename from go/ql/test/experimental/CWE-770/DenialOfServiceBad.go
rename to go/ql/test/query-tests/Security/CWE-770/UncontrolledAllocationSizeBad.go
index 2d61cdbdafc..0ae70436bde 100644
--- a/go/ql/test/experimental/CWE-770/DenialOfServiceBad.go
+++ b/go/ql/test/query-tests/Security/CWE-770/UncontrolledAllocationSizeBad.go
@@ -17,7 +17,7 @@ func OutOfMemoryBad(w http.ResponseWriter, r *http.Request) {
return
}
- result := make([]string, sink)
+ result := make([]string, sink) // $hasTaintFlow="sink"
for i := 0; i < sink; i++ {
result[i] = fmt.Sprintf("Item %d", i+1)
}
diff --git a/go/ql/test/experimental/CWE-770/DenialOfServiceGood.go b/go/ql/test/query-tests/Security/CWE-770/UncontrolledAllocationSizeGood.go
similarity index 100%
rename from go/ql/test/experimental/CWE-770/DenialOfServiceGood.go
rename to go/ql/test/query-tests/Security/CWE-770/UncontrolledAllocationSizeGood.go
From 138ce42cf6f4f65c04e829448831bef548eeaec4 Mon Sep 17 00:00:00 2001
From: Tony Torralba
Date: Thu, 7 Mar 2024 15:22:46 +0100
Subject: [PATCH 051/309] Fix qhelp
---
go/ql/src/Security/CWE-770/UncontrolledAllocationSize.qhelp | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/go/ql/src/Security/CWE-770/UncontrolledAllocationSize.qhelp b/go/ql/src/Security/CWE-770/UncontrolledAllocationSize.qhelp
index b4029e93e1e..14930944bb6 100644
--- a/go/ql/src/Security/CWE-770/UncontrolledAllocationSize.qhelp
+++ b/go/ql/src/Security/CWE-770/UncontrolledAllocationSize.qhelp
@@ -19,12 +19,12 @@
of size n without further verification, potentially exhausting all the available
memory.
-
+
One way to prevent this vulnerability is by implementing a maximum allowed value for the
user-controlled input, as seen in the following example:
-
+
From 9e77b898856dec5ce1a139ed051eac019a9bd11c Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Thu, 7 Mar 2024 08:33:49 -0800
Subject: [PATCH 052/309] Update TypeConfusion.qhelp
Co-authored-by: hubwriter
---
cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.qhelp | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.qhelp b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.qhelp
index 0f72a992205..205a1ae7ff8 100644
--- a/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.qhelp
+++ b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.qhelp
@@ -3,7 +3,7 @@
-Certain casts in C and C++ places no restrictions on the target type. For
+Certain casts in C and C++ place no restrictions on the target type. For
example, C style casts such as (MyClass*)p allows the programmer
to cast any pointer p to an expression of type MyClass*.
If the runtime type of p turns out to be a type that's incompatible
From cedbfbe7ea4841583f2c7ed1ca9c5ef235109151 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Thu, 7 Mar 2024 10:50:20 -0800
Subject: [PATCH 053/309] C++: Use a more generous definition of compatible
types.
---
.../src/Security/CWE/CWE-843/TypeConfusion.ql | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
diff --git a/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql
index d43e0145c99..c2a6f89d33f 100644
--- a/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql
+++ b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql
@@ -148,20 +148,32 @@ class UnsafeCast extends Cast {
* 1. the result of `(T)x` is compatible with the type `T` for any `T`
* 2. the result of `(T)x` is compatible with the type `U` for any `U` such
* that `U` is a subtype of `T`, or `T` is a subtype of `U`.
- * 3. the result of `(T)x` is compatible with the type `U` if `U` the list
+ * 3. the result of `(T)x` is compatible with the type `U` if the list
+ * of fields of `T` is a prefix of the list of fields of `U`.
+ * For example, if `U` is `struct { unsigned char x; int y; };`
+ * and `T` is `struct { unsigned char uc; };`.
+ * 4. the result of `(T)x` is compatible with the type `U` if the list
* of fields of `U` is a prefix of the list of fields of `T`.
- * For example, if `T` is `struct { unsigned char x; int y; };`
- * and `U` is `struct { unsigned char uc; };`.
+ *
+ * Condition 4 is a bit controversial, since it assumes that the additional
+ * fields in `T` won't be accessed. This may result in some FNs.
*/
bindingset[this, t]
pragma[inline_late]
predicate compatibleWith(Type t) {
+ // Conition 1
t.stripType() = this.getConvertedType()
or
+ // Condition 3
prefix(this.getConvertedType(), t.stripType())
or
+ // Condition 4
+ prefix(t.stripType(), this.getConvertedType())
+ or
+ // Condition 2 (a)
t.stripType().(Class).getABaseClass+() = this.getConvertedType()
or
+ // Condition 2 (b)
t.stripType() = this.getConvertedType().getABaseClass+()
}
}
From 4f9bdca4f083b3921d6dc22c95c9785c7d81896e Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Thu, 7 Mar 2024 13:08:26 -0800
Subject: [PATCH 054/309] C++: Optimize.
---
cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql | 14 ++++++--------
1 file changed, 6 insertions(+), 8 deletions(-)
diff --git a/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql
index c2a6f89d33f..f7ac0465d87 100644
--- a/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql
+++ b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql
@@ -219,16 +219,14 @@ module RelevantStateConfig implements DataFlow::ConfigSig {
module RelevantStateFlow = DataFlow::Global;
-predicate relevantState(DataFlow::Node sink, Class state) {
- exists(DataFlow::Node source |
- RelevantStateFlow::flow(source, sink) and
- isSourceImpl(source, state)
- )
+predicate relevantState(DataFlow::Node source, DataFlow::Node sink, Class state) {
+ RelevantStateFlow::flow(source, sink) and
+ isSourceImpl(source, state)
}
predicate isSinkImpl(DataFlow::Node sink, Class state, Type convertedType, boolean compatible) {
exists(UnsafeCast cast |
- relevantState(sink, state) and
+ relevantState(_, sink, state) and
sink.asExpr() = cast.getUnconverted() and
convertedType = cast.getConvertedType()
|
@@ -245,10 +243,10 @@ predicate isSinkImpl(DataFlow::Node sink, Class state, Type convertedType, boole
*/
module BadConfig implements DataFlow::StateConfigSig {
class FlowState extends Class {
- FlowState() { relevantState(_, this) }
+ FlowState() { relevantState(_, _, this) }
}
- predicate isSource(DataFlow::Node source, FlowState state) { isSourceImpl(source, state) }
+ predicate isSource(DataFlow::Node source, FlowState state) { relevantState(source, _, state) }
predicate isBarrier(DataFlow::Node node) { RelevantStateConfig::isBarrier(node) }
From 761f6d3a7eda185f17bd26a3360a5cfeb69cfcab Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Thu, 7 Mar 2024 13:44:41 -0800
Subject: [PATCH 055/309] C++: Disable field flow from the 'cpp/type-confusion'
query to fix performance on ChakraCore.
---
cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql
index f7ac0465d87..530d8804ebd 100644
--- a/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql
+++ b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql
@@ -215,6 +215,8 @@ module RelevantStateConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) {
exists(UnsafeCast cast | sink.asExpr() = cast.getUnconverted())
}
+
+ int fieldFlowBranchLimit() { result = 0 }
}
module RelevantStateFlow = DataFlow::Global;
@@ -253,6 +255,8 @@ module BadConfig implements DataFlow::StateConfigSig {
predicate isSink(DataFlow::Node sink, FlowState state) { isSinkImpl(sink, state, _, false) }
predicate isBarrierOut(DataFlow::Node sink, FlowState state) { isSink(sink, state) }
+
+ int fieldFlowBranchLimit() { result = 0 }
}
module BadFlow = DataFlow::GlobalWithState;
@@ -307,6 +311,8 @@ module GoodConfig implements DataFlow::StateConfigSig {
isSinkImpl(sink, state, _, true) and
BadFlow::flowTo(sink)
}
+
+ int fieldFlowBranchLimit() { result = 0 }
}
module GoodFlow = DataFlow::GlobalWithState;
From e793a1e9fe78df48abc2069aff8767b822fd46f7 Mon Sep 17 00:00:00 2001
From: Tom Hvitved
Date: Tue, 5 Mar 2024 09:38:09 +0100
Subject: [PATCH 056/309] Ruby: Add variable capture spurious flow test
---
.../library-tests/dataflow/global/Flow.expected | 11 +++++++++++
.../dataflow/global/captured_variables.rb | 14 ++++++++++++++
2 files changed, 25 insertions(+)
diff --git a/ruby/ql/test/library-tests/dataflow/global/Flow.expected b/ruby/ql/test/library-tests/dataflow/global/Flow.expected
index 7ae00a80dce..9e01d45a07c 100644
--- a/ruby/ql/test/library-tests/dataflow/global/Flow.expected
+++ b/ruby/ql/test/library-tests/dataflow/global/Flow.expected
@@ -1,4 +1,5 @@
testFailures
+| captured_variables.rb:236:14:236:14 | x | Unexpected result: hasValueFlow=19 |
edges
| blocks.rb:14:12:14:20 | call to source | blocks.rb:8:10:8:14 | yield ... | provenance | |
| captured_variables.rb:9:24:9:24 | x | captured_variables.rb:10:10:10:23 | -> { ... } [captured x] | provenance | |
@@ -122,6 +123,10 @@ edges
| captured_variables.rb:222:11:224:5 | -> { ... } [captured x] | captured_variables.rb:222:5:222:7 | fn1 [captured x] | provenance | |
| captured_variables.rb:226:5:226:7 | [post] fn1 [captured y] | captured_variables.rb:227:10:227:10 | y | provenance | |
| captured_variables.rb:226:5:226:7 | fn1 [captured x] | captured_variables.rb:226:5:226:7 | [post] fn1 [captured y] | provenance | |
+| captured_variables.rb:233:9:233:17 | call to taint | captured_variables.rb:235:11:237:5 | -> { ... } [captured x] | provenance | |
+| captured_variables.rb:235:5:235:7 | fn1 [captured x] | captured_variables.rb:241:5:241:7 | fn1 [captured x] | provenance | |
+| captured_variables.rb:235:11:237:5 | -> { ... } [captured x] | captured_variables.rb:235:5:235:7 | fn1 [captured x] | provenance | |
+| captured_variables.rb:241:5:241:7 | fn1 [captured x] | captured_variables.rb:236:14:236:14 | x | provenance | |
| instance_variables.rb:10:19:10:19 | x | instance_variables.rb:11:18:11:18 | x | provenance | |
| instance_variables.rb:11:18:11:18 | x | instance_variables.rb:11:9:11:14 | [post] self [@field] | provenance | |
| instance_variables.rb:13:5:15:7 | self in get_field [@field] | instance_variables.rb:14:16:14:21 | self [@field] | provenance | |
@@ -385,6 +390,11 @@ nodes
| captured_variables.rb:226:5:226:7 | [post] fn1 [captured y] | semmle.label | [post] fn1 [captured y] |
| captured_variables.rb:226:5:226:7 | fn1 [captured x] | semmle.label | fn1 [captured x] |
| captured_variables.rb:227:10:227:10 | y | semmle.label | y |
+| captured_variables.rb:233:9:233:17 | call to taint | semmle.label | call to taint |
+| captured_variables.rb:235:5:235:7 | fn1 [captured x] | semmle.label | fn1 [captured x] |
+| captured_variables.rb:235:11:237:5 | -> { ... } [captured x] | semmle.label | -> { ... } [captured x] |
+| captured_variables.rb:236:14:236:14 | x | semmle.label | x |
+| captured_variables.rb:241:5:241:7 | fn1 [captured x] | semmle.label | fn1 [captured x] |
| instance_variables.rb:10:19:10:19 | x | semmle.label | x |
| instance_variables.rb:11:9:11:14 | [post] self [@field] | semmle.label | [post] self [@field] |
| instance_variables.rb:11:18:11:18 | x | semmle.label | x |
@@ -595,6 +605,7 @@ subpaths
| captured_variables.rb:199:10:199:10 | x | captured_variables.rb:197:9:197:17 | call to taint | captured_variables.rb:199:10:199:10 | x | $@ | captured_variables.rb:197:9:197:17 | call to taint | call to taint |
| captured_variables.rb:208:14:208:14 | x | captured_variables.rb:206:13:206:21 | call to taint | captured_variables.rb:208:14:208:14 | x | $@ | captured_variables.rb:206:13:206:21 | call to taint | call to taint |
| captured_variables.rb:227:10:227:10 | y | captured_variables.rb:219:9:219:17 | call to taint | captured_variables.rb:227:10:227:10 | y | $@ | captured_variables.rb:219:9:219:17 | call to taint | call to taint |
+| captured_variables.rb:236:14:236:14 | x | captured_variables.rb:233:9:233:17 | call to taint | captured_variables.rb:236:14:236:14 | x | $@ | captured_variables.rb:233:9:233:17 | call to taint | call to taint |
| instance_variables.rb:20:10:20:13 | @foo | instance_variables.rb:19:12:19:21 | call to taint | instance_variables.rb:20:10:20:13 | @foo | $@ | instance_variables.rb:19:12:19:21 | call to taint | call to taint |
| instance_variables.rb:36:10:36:33 | call to get_field | instance_variables.rb:36:14:36:22 | call to taint | instance_variables.rb:36:10:36:33 | call to get_field | $@ | instance_variables.rb:36:14:36:22 | call to taint | call to taint |
| instance_variables.rb:39:6:39:33 | call to get_field | instance_variables.rb:39:14:39:22 | call to taint | instance_variables.rb:39:6:39:33 | call to get_field | $@ | instance_variables.rb:39:14:39:22 | call to taint | call to taint |
diff --git a/ruby/ql/test/library-tests/dataflow/global/captured_variables.rb b/ruby/ql/test/library-tests/dataflow/global/captured_variables.rb
index 79d1fc83b76..8c7c5049b2d 100644
--- a/ruby/ql/test/library-tests/dataflow/global/captured_variables.rb
+++ b/ruby/ql/test/library-tests/dataflow/global/captured_variables.rb
@@ -228,3 +228,17 @@ def multi_capture
end
multi_capture
+
+def m1
+ x = taint(19)
+
+ fn1 = -> {
+ sink x
+ }
+
+ x = nil
+
+ fn1.call()
+end
+
+m1
\ No newline at end of file
From 63bb772ef9a67b4c2993cb370de4775b44c5f8b3 Mon Sep 17 00:00:00 2001
From: Tom Hvitved
Date: Mon, 4 Mar 2024 13:25:15 +0100
Subject: [PATCH 057/309] Variable capture: Avoid overlapping and
false-positive data flow paths
---
.../codeql/dataflow/VariableCapture.qll | 80 +++++++++++++++++--
1 file changed, 74 insertions(+), 6 deletions(-)
diff --git a/shared/dataflow/codeql/dataflow/VariableCapture.qll b/shared/dataflow/codeql/dataflow/VariableCapture.qll
index e90bf481442..9fd385d4458 100644
--- a/shared/dataflow/codeql/dataflow/VariableCapture.qll
+++ b/shared/dataflow/codeql/dataflow/VariableCapture.qll
@@ -601,16 +601,22 @@ module Flow Input> implements OutputSig
* observed in a similarly synthesized post-update node for this read of `v`.
*/
private predicate synthRead(
- CapturedVariable v, BasicBlock bb, int i, boolean topScope, Expr closure
+ CapturedVariable v, BasicBlock bb, int i, boolean topScope, Expr closure, boolean alias
) {
exists(ClosureExpr ce | closureCaptures(ce, v) |
- ce.hasCfgNode(bb, i) and ce = closure
+ ce.hasCfgNode(bb, i) and ce = closure and alias = false
or
- localOrNestedClosureAccess(ce, closure, bb, i)
+ localOrNestedClosureAccess(ce, closure, bb, i) and alias = true
) and
if v.getCallable() != bb.getEnclosingCallable() then topScope = false else topScope = true
}
+ private predicate synthRead(
+ CapturedVariable v, BasicBlock bb, int i, boolean topScope, Expr closure
+ ) {
+ synthRead(v, bb, i, topScope, closure, _)
+ }
+
/**
* Holds if there is an access of a captured variable inside a closure in the
* `i`th node of `bb`, such that we need to synthesize a `this.` qualifier.
@@ -919,16 +925,22 @@ module Flow Input> implements OutputSig
)
}
- predicate storeStep(ClosureNode node1, CapturedVariable v, ClosureNode node2) {
- // store v in the closure or in the malloc in case of a relevant constructor call
+ private predicate storeStepClosure(
+ ClosureNode node1, CapturedVariable v, ClosureNode node2, boolean alias
+ ) {
exists(BasicBlock bb, int i, Expr closure |
- synthRead(v, bb, i, _, closure) and
+ synthRead(v, bb, i, _, closure, alias) and
node1 = TSynthRead(v, bb, i, false)
|
node2 = TExprNode(closure, false)
or
node2 = TMallocNode(closure) and hasConstructorCapture(closure, v)
)
+ }
+
+ predicate storeStep(ClosureNode node1, CapturedVariable v, ClosureNode node2) {
+ // store v in the closure or in the malloc in case of a relevant constructor call
+ storeStepClosure(node1, v, node2, _)
or
// write to v inside the closure body
exists(BasicBlock bb, int i, VariableWrite vw |
@@ -964,6 +976,62 @@ module Flow Input> implements OutputSig
}
predicate clearsContent(ClosureNode node, CapturedVariable v) {
+ /*
+ * Stores into closure aliases block flow from previous stores, both to
+ * avoid overlapping data flow paths, but also to avoid false positive
+ * flow.
+ *
+ * Example 1 (overlapping paths):
+ *
+ * ```rb
+ * def m
+ * x = taint
+ *
+ * fn = -> { # (1)
+ * sink x
+ * }
+ *
+ * fn.call # (2)
+ * ```
+ *
+ * If we don't clear `x` at `fn` (2), we will have two overlapping paths:
+ *
+ * ```
+ * taint -> fn (2) [captured x]
+ * taint -> fn (1) [captured x] -> fn (2) [captured x]
+ * ```
+ *
+ * where the step `fn (1) [captured x] -> fn [captured x]` arises from normal
+ * use-use flow for `fn`. Clearing `x` at `fn` (2) removes the second path above.
+ *
+ * Example 2 (false positive flow):
+ *
+ * ```rb
+ * def m
+ * x = taint
+ *
+ * fn = -> { # (1)
+ * sink x
+ * }
+ *
+ * x = nil # (2)
+ *
+ * fn.call # (3)
+ * end
+ * ```
+ *
+ * If we don't clear `x` at `fn` (3), we will have the following false positive
+ * flow path:
+ *
+ * ```
+ * taint -> fn (1) [captured x] -> fn (3) [captured x]
+ * ```
+ *
+ * since normal use-use flow for `fn` does not take the overwrite at (2) into account.
+ */
+
+ storeStepClosure(_, v, node, true)
+ or
exists(BasicBlock bb, int i |
captureWrite(v, bb, i, false, _) and
node = TSynthThisQualifier(bb, i, false)
From 24e35f6f3d0126b81b72f896aa9bd1d8fa369af4 Mon Sep 17 00:00:00 2001
From: Tom Hvitved
Date: Mon, 4 Mar 2024 13:31:53 +0100
Subject: [PATCH 058/309] Update expected test output
---
.../dataflow/global/DataFlowPath.expected | 86 -------------------
.../global/TaintTrackingPath.expected | 86 -------------------
.../dataflow/variable-capture/by_value.py | 2 +-
.../dataflow/global/Flow.expected | 46 ----------
4 files changed, 1 insertion(+), 219 deletions(-)
diff --git a/csharp/ql/test/library-tests/dataflow/global/DataFlowPath.expected b/csharp/ql/test/library-tests/dataflow/global/DataFlowPath.expected
index c994ff441b4..7ebc9193829 100644
--- a/csharp/ql/test/library-tests/dataflow/global/DataFlowPath.expected
+++ b/csharp/ql/test/library-tests/dataflow/global/DataFlowPath.expected
@@ -1,27 +1,17 @@
edges
-| Capture.cs:7:20:7:26 | tainted : String | Capture.cs:9:9:13:9 | CaptureIn1(...) : CaptureIn1 [captured tainted] : String | provenance | |
| Capture.cs:7:20:7:26 | tainted : String | Capture.cs:14:9:14:18 | access to local function CaptureIn1 : CaptureIn1 [captured tainted] : String | provenance | |
-| Capture.cs:7:20:7:26 | tainted : String | Capture.cs:16:9:24:9 | CaptureIn2(...) : CaptureIn2 [captured tainted] : String | provenance | |
| Capture.cs:7:20:7:26 | tainted : String | Capture.cs:25:9:25:18 | access to local function CaptureIn2 : CaptureIn2 [captured tainted] : String | provenance | |
-| Capture.cs:7:20:7:26 | tainted : String | Capture.cs:27:43:32:9 | (...) => ... : (...) => ... [captured tainted] : String | provenance | |
| Capture.cs:7:20:7:26 | tainted : String | Capture.cs:33:30:33:39 | access to local variable captureIn3 : Func [captured tainted] : String | provenance | |
| Capture.cs:7:20:7:26 | tainted : String | Capture.cs:61:36:61:42 | access to parameter tainted : String | provenance | |
-| Capture.cs:9:9:13:9 | CaptureIn1(...) : CaptureIn1 [captured tainted] : String | Capture.cs:14:9:14:18 | access to local function CaptureIn1 : CaptureIn1 [captured tainted] : String | provenance | |
| Capture.cs:11:17:11:22 | access to local variable sink27 : String | Capture.cs:12:19:12:24 | access to local variable sink27 | provenance | |
| Capture.cs:11:26:11:32 | access to parameter tainted : String | Capture.cs:11:17:11:22 | access to local variable sink27 : String | provenance | |
| Capture.cs:14:9:14:18 | access to local function CaptureIn1 : CaptureIn1 [captured tainted] : String | Capture.cs:11:26:11:32 | access to parameter tainted : String | provenance | |
-| Capture.cs:16:9:24:9 | CaptureIn2(...) : CaptureIn2 [captured tainted] : String | Capture.cs:25:9:25:18 | access to local function CaptureIn2 : CaptureIn2 [captured tainted] : String | provenance | |
-| Capture.cs:18:13:22:13 | M(...) : M [captured tainted] : String | Capture.cs:23:13:23:13 | access to local function M : M [captured tainted] : String | provenance | |
| Capture.cs:20:21:20:26 | access to local variable sink28 : String | Capture.cs:21:23:21:28 | access to local variable sink28 | provenance | |
| Capture.cs:20:30:20:36 | access to parameter tainted : String | Capture.cs:20:21:20:26 | access to local variable sink28 : String | provenance | |
| Capture.cs:23:13:23:13 | access to local function M : M [captured tainted] : String | Capture.cs:20:30:20:36 | access to parameter tainted : String | provenance | |
-| Capture.cs:25:9:25:18 | access to local function CaptureIn2 : CaptureIn2 [captured tainted] : String | Capture.cs:18:13:22:13 | M(...) : M [captured tainted] : String | provenance | |
| Capture.cs:25:9:25:18 | access to local function CaptureIn2 : CaptureIn2 [captured tainted] : String | Capture.cs:23:13:23:13 | access to local function M : M [captured tainted] : String | provenance | |
-| Capture.cs:27:30:27:39 | access to local variable captureIn3 : (...) => ... [captured tainted] : String | Capture.cs:33:30:33:39 | access to local variable captureIn3 : (...) => ... [captured tainted] : String | provenance | |
-| Capture.cs:27:43:32:9 | (...) => ... : (...) => ... [captured tainted] : String | Capture.cs:27:30:27:39 | access to local variable captureIn3 : (...) => ... [captured tainted] : String | provenance | |
| Capture.cs:29:17:29:22 | access to local variable sink29 : String | Capture.cs:30:19:30:24 | access to local variable sink29 | provenance | |
| Capture.cs:29:26:29:32 | access to parameter tainted : String | Capture.cs:29:17:29:22 | access to local variable sink29 : String | provenance | |
-| Capture.cs:33:30:33:39 | access to local variable captureIn3 : (...) => ... [captured tainted] : String | Capture.cs:29:26:29:32 | access to parameter tainted : String | provenance | |
| Capture.cs:33:30:33:39 | access to local variable captureIn3 : Func [captured tainted] : String | Capture.cs:29:26:29:32 | access to parameter tainted : String | provenance | |
| Capture.cs:50:50:50:55 | sink39 : String | Capture.cs:52:23:59:13 | (...) => ... : (...) => ... [captured sink39] : String | provenance | |
| Capture.cs:52:23:59:13 | (...) => ... : (...) => ... [captured sink39] : String | Capture.cs:350:34:350:34 | a : (...) => ... [captured sink39] : String | provenance | |
@@ -37,28 +27,18 @@ edges
| Capture.cs:114:23:117:13 | [post] (...) => ... : (...) => ... [captured sink40] : String | Capture.cs:123:9:123:33 | [post] access to local function CaptureOutMultipleLambdas : CaptureOutMultipleLambdas [captured sink40] : String | provenance | |
| Capture.cs:116:26:116:39 | "taint source" : String | Capture.cs:352:9:352:9 | [post] access to parameter a : (...) => ... [captured sink40] : String | provenance | |
| Capture.cs:123:9:123:33 | [post] access to local function CaptureOutMultipleLambdas : CaptureOutMultipleLambdas [captured sink40] : String | Capture.cs:124:15:124:20 | access to local variable sink40 | provenance | |
-| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:130:9:133:9 | CaptureThrough1(...) : CaptureThrough1 [captured tainted] : String | provenance | |
| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:134:9:134:23 | access to local function CaptureThrough1 : CaptureThrough1 [captured tainted] : String | provenance | |
-| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:138:9:145:9 | CaptureThrough2(...) : CaptureThrough2 [captured tainted] : String | provenance | |
| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:146:9:146:23 | access to local function CaptureThrough2 : CaptureThrough2 [captured tainted] : String | provenance | |
-| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:150:48:154:9 | (...) => ... : (...) => ... [captured tainted] : String | provenance | |
| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:155:30:155:44 | access to local variable captureThrough3 : Func [captured tainted] : String | provenance | |
-| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:158:9:161:9 | CaptureThrough4(...) : CaptureThrough4 [captured tainted] : String | provenance | |
| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:162:22:162:36 | access to local function CaptureThrough4 : CaptureThrough4 [captured tainted] : String | provenance | |
| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:170:25:170:31 | access to parameter tainted : String | provenance | |
| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:196:25:196:31 | access to parameter tainted : String | provenance | |
-| Capture.cs:130:9:133:9 | CaptureThrough1(...) : CaptureThrough1 [captured tainted] : String | Capture.cs:134:9:134:23 | access to local function CaptureThrough1 : CaptureThrough1 [captured tainted] : String | provenance | |
| Capture.cs:134:9:134:23 | [post] access to local function CaptureThrough1 : CaptureThrough1 [captured sink33] : String | Capture.cs:135:15:135:20 | access to local variable sink33 | provenance | |
| Capture.cs:134:9:134:23 | access to local function CaptureThrough1 : CaptureThrough1 [captured tainted] : String | Capture.cs:134:9:134:23 | [post] access to local function CaptureThrough1 : CaptureThrough1 [captured sink33] : String | provenance | |
-| Capture.cs:138:9:145:9 | CaptureThrough2(...) : CaptureThrough2 [captured tainted] : String | Capture.cs:146:9:146:23 | access to local function CaptureThrough2 : CaptureThrough2 [captured tainted] : String | provenance | |
| Capture.cs:146:9:146:23 | [post] access to local function CaptureThrough2 : CaptureThrough2 [captured sink34] : String | Capture.cs:147:15:147:20 | access to local variable sink34 | provenance | |
| Capture.cs:146:9:146:23 | access to local function CaptureThrough2 : CaptureThrough2 [captured tainted] : String | Capture.cs:146:9:146:23 | [post] access to local function CaptureThrough2 : CaptureThrough2 [captured sink34] : String | provenance | |
-| Capture.cs:150:30:150:44 | access to local variable captureThrough3 : (...) => ... [captured tainted] : String | Capture.cs:155:30:155:44 | access to local variable captureThrough3 : (...) => ... [captured tainted] : String | provenance | |
-| Capture.cs:150:48:154:9 | (...) => ... : (...) => ... [captured tainted] : String | Capture.cs:150:30:150:44 | access to local variable captureThrough3 : (...) => ... [captured tainted] : String | provenance | |
| Capture.cs:155:30:155:44 | [post] access to local variable captureThrough3 : (...) => ... [captured sink35] : String | Capture.cs:156:15:156:20 | access to local variable sink35 | provenance | |
-| Capture.cs:155:30:155:44 | access to local variable captureThrough3 : (...) => ... [captured tainted] : String | Capture.cs:155:30:155:44 | [post] access to local variable captureThrough3 : (...) => ... [captured sink35] : String | provenance | |
| Capture.cs:155:30:155:44 | access to local variable captureThrough3 : Func [captured tainted] : String | Capture.cs:155:30:155:44 | [post] access to local variable captureThrough3 : (...) => ... [captured sink35] : String | provenance | |
-| Capture.cs:158:9:161:9 | CaptureThrough4(...) : CaptureThrough4 [captured tainted] : String | Capture.cs:162:22:162:36 | access to local function CaptureThrough4 : CaptureThrough4 [captured tainted] : String | provenance | |
| Capture.cs:162:13:162:18 | access to local variable sink36 : String | Capture.cs:163:15:163:20 | access to local variable sink36 | provenance | |
| Capture.cs:162:22:162:36 | access to local function CaptureThrough4 : CaptureThrough4 [captured tainted] : String | Capture.cs:162:22:162:38 | call to local function CaptureThrough4 : String | provenance | |
| Capture.cs:162:22:162:38 | call to local function CaptureThrough4 : String | Capture.cs:162:13:162:18 | access to local variable sink36 : String | provenance | |
@@ -66,19 +46,13 @@ edges
| Capture.cs:170:9:170:23 | [post] access to local function CaptureThrough5 : CaptureThrough5 [captured sink37] : String | Capture.cs:171:15:171:20 | access to local variable sink37 | provenance | |
| Capture.cs:170:25:170:31 | access to parameter tainted : String | Capture.cs:166:37:166:37 | p : String | provenance | |
| Capture.cs:170:25:170:31 | access to parameter tainted : String | Capture.cs:170:9:170:23 | [post] access to local function CaptureThrough5 : CaptureThrough5 [captured sink37] : String | provenance | |
-| Capture.cs:190:26:190:26 | s : String | Capture.cs:192:13:192:28 | M(...) : M [captured s] : String | provenance | |
| Capture.cs:190:26:190:26 | s : String | Capture.cs:193:20:193:20 | access to local function M : M [captured s] : String | provenance | |
-| Capture.cs:192:13:192:28 | M(...) : M [captured s] : String | Capture.cs:193:20:193:20 | access to local function M : M [captured s] : String | provenance | |
| Capture.cs:193:20:193:20 | access to local function M : M [captured s] : String | Capture.cs:193:20:193:22 | call to local function M : String | provenance | |
| Capture.cs:196:13:196:18 | access to local variable sink38 : String | Capture.cs:197:15:197:20 | access to local variable sink38 | provenance | |
| Capture.cs:196:22:196:32 | call to local function Id : String | Capture.cs:196:13:196:18 | access to local variable sink38 : String | provenance | |
| Capture.cs:196:25:196:31 | access to parameter tainted : String | Capture.cs:190:26:190:26 | s : String | provenance | |
| Capture.cs:196:25:196:31 | access to parameter tainted : String | Capture.cs:196:22:196:32 | call to local function Id : String | provenance | |
-| Capture.cs:202:20:202:20 | s : String | Capture.cs:204:20:207:9 | (...) => ... : (...) => ... [captured s] : String | provenance | |
| Capture.cs:202:20:202:20 | s : String | Capture.cs:208:9:208:9 | access to local variable a : Action [captured s] : String | provenance | |
-| Capture.cs:204:16:204:16 | access to local variable a : (...) => ... [captured s] : String | Capture.cs:208:9:208:9 | access to local variable a : (...) => ... [captured s] : String | provenance | |
-| Capture.cs:204:20:207:9 | (...) => ... : (...) => ... [captured s] : String | Capture.cs:204:16:204:16 | access to local variable a : (...) => ... [captured s] : String | provenance | |
-| Capture.cs:208:9:208:9 | access to local variable a : (...) => ... [captured s] : String | Capture.cs:206:19:206:19 | access to parameter s | provenance | |
| Capture.cs:208:9:208:9 | access to local variable a : Action [captured s] : String | Capture.cs:206:19:206:19 | access to parameter s | provenance | |
| Capture.cs:211:21:211:34 | "taint source" : String | Capture.cs:202:20:202:20 | s : String | provenance | |
| Capture.cs:213:22:213:22 | s : String | Capture.cs:215:16:218:9 | (...) => ... : (...) => ... [captured s] : String | provenance | |
@@ -93,17 +67,13 @@ edges
| Capture.cs:229:20:233:9 | (...) => ... : (...) => ... [captured x] : String | Capture.cs:231:19:231:19 | access to local variable x | provenance | |
| Capture.cs:229:20:233:9 | [post] (...) => ... : (...) => ... [captured x] : String | Capture.cs:234:15:234:15 | access to local variable x | provenance | |
| Capture.cs:232:17:232:30 | "taint source" : String | Capture.cs:229:20:233:9 | [post] (...) => ... : (...) => ... [captured x] : String | provenance | |
-| Capture.cs:242:9:242:9 | [post] access to local variable c : Capture [field Field] : String | Capture.cs:244:20:248:9 | (...) => ... : (...) => ... [captured c, field Field] : String | provenance | |
| Capture.cs:242:9:242:9 | [post] access to local variable c : Capture [field Field] : String | Capture.cs:249:9:249:9 | access to local variable a : Action [captured c, field Field] : String | provenance | |
| Capture.cs:242:9:242:9 | [post] access to local variable c : Capture [field Field] : String | Capture.cs:251:15:251:15 | access to local variable c : Capture [field Field] : String | provenance | |
| Capture.cs:242:19:242:32 | "taint source" : String | Capture.cs:242:9:242:9 | [post] access to local variable c : Capture [field Field] : String | provenance | |
-| Capture.cs:244:16:244:16 | access to local variable a : (...) => ... [captured c, field Field] : String | Capture.cs:249:9:249:9 | access to local variable a : (...) => ... [captured c, field Field] : String | provenance | |
-| Capture.cs:244:20:248:9 | (...) => ... : (...) => ... [captured c, field Field] : String | Capture.cs:244:16:244:16 | access to local variable a : (...) => ... [captured c, field Field] : String | provenance | |
| Capture.cs:246:19:246:19 | access to local variable c : Capture [field Field] : String | Capture.cs:246:19:246:25 | access to field Field | provenance | |
| Capture.cs:247:13:247:13 | [post] access to local variable c : Capture [field Field] : String | Capture.cs:249:9:249:9 | [post] access to local variable a : (...) => ... [captured c, field Field] : String | provenance | |
| Capture.cs:247:23:247:36 | "taint source" : String | Capture.cs:247:13:247:13 | [post] access to local variable c : Capture [field Field] : String | provenance | |
| Capture.cs:249:9:249:9 | [post] access to local variable a : (...) => ... [captured c, field Field] : String | Capture.cs:251:15:251:15 | access to local variable c : Capture [field Field] : String | provenance | |
-| Capture.cs:249:9:249:9 | access to local variable a : (...) => ... [captured c, field Field] : String | Capture.cs:246:19:246:19 | access to local variable c : Capture [field Field] : String | provenance | |
| Capture.cs:249:9:249:9 | access to local variable a : Action [captured c, field Field] : String | Capture.cs:246:19:246:19 | access to local variable c : Capture [field Field] : String | provenance | |
| Capture.cs:251:15:251:15 | access to local variable c : Capture [field Field] : String | Capture.cs:251:15:251:21 | access to field Field | provenance | |
| Capture.cs:264:13:264:13 | [post] access to local variable c : Capture [field Field] : String | Capture.cs:266:9:266:9 | [post] access to local variable a : (...) => ... [captured c, field Field] : String | provenance | |
@@ -112,52 +82,30 @@ edges
| Capture.cs:268:15:268:15 | access to local variable c : Capture [field Field] : String | Capture.cs:268:15:268:21 | access to field Field | provenance | |
| Capture.cs:273:19:273:19 | x : String | Capture.cs:273:30:273:30 | access to parameter x | provenance | |
| Capture.cs:273:34:273:47 | "taint source" : String | Capture.cs:355:45:355:45 | x : String | provenance | |
-| Capture.cs:278:17:278:30 | "taint source" : String | Capture.cs:280:25:288:9 | (...) => ... : (...) => ... [captured x] : String | provenance | |
| Capture.cs:278:17:278:30 | "taint source" : String | Capture.cs:290:9:290:14 | access to local variable middle : Action [captured x] : String | provenance | |
| Capture.cs:278:17:278:30 | "taint source" : String | Capture.cs:292:15:292:15 | access to local variable x | provenance | |
-| Capture.cs:280:16:280:21 | access to local variable middle : (...) => ... [captured x] : String | Capture.cs:290:9:290:14 | access to local variable middle : (...) => ... [captured x] : String | provenance | |
-| Capture.cs:280:25:288:9 | (...) => ... : (...) => ... [captured x] : String | Capture.cs:280:16:280:21 | access to local variable middle : (...) => ... [captured x] : String | provenance | |
-| Capture.cs:282:20:282:24 | access to local variable inner : (...) => ... [captured x] : String | Capture.cs:287:13:287:17 | access to local variable inner : (...) => ... [captured x] : String | provenance | |
-| Capture.cs:282:28:286:13 | (...) => ... : (...) => ... [captured x] : String | Capture.cs:282:20:282:24 | access to local variable inner : (...) => ... [captured x] : String | provenance | |
| Capture.cs:285:21:285:34 | "taint source" : String | Capture.cs:287:13:287:17 | [post] access to local variable inner : (...) => ... [captured x] : String | provenance | |
| Capture.cs:287:13:287:17 | [post] access to local variable inner : (...) => ... [captured x] : String | Capture.cs:290:9:290:14 | [post] access to local variable middle : (...) => ... [captured x] : String | provenance | |
-| Capture.cs:287:13:287:17 | access to local variable inner : (...) => ... [captured x] : String | Capture.cs:284:23:284:23 | access to local variable x | provenance | |
| Capture.cs:287:13:287:17 | access to local variable inner : Action [captured x] : String | Capture.cs:284:23:284:23 | access to local variable x | provenance | |
| Capture.cs:290:9:290:14 | [post] access to local variable middle : (...) => ... [captured x] : String | Capture.cs:292:15:292:15 | access to local variable x | provenance | |
-| Capture.cs:290:9:290:14 | access to local variable middle : (...) => ... [captured x] : String | Capture.cs:282:28:286:13 | (...) => ... : (...) => ... [captured x] : String | provenance | |
-| Capture.cs:290:9:290:14 | access to local variable middle : (...) => ... [captured x] : String | Capture.cs:287:13:287:17 | access to local variable inner : Action [captured x] : String | provenance | |
-| Capture.cs:290:9:290:14 | access to local variable middle : Action [captured x] : String | Capture.cs:282:28:286:13 | (...) => ... : (...) => ... [captured x] : String | provenance | |
| Capture.cs:290:9:290:14 | access to local variable middle : Action [captured x] : String | Capture.cs:287:13:287:17 | access to local variable inner : Action [captured x] : String | provenance | |
-| Capture.cs:297:9:297:12 | [post] this access : Capture [field Field] : String | Capture.cs:299:20:303:9 | (...) => ... : (...) => ... [captured this in M10, field Field] : String | provenance | |
| Capture.cs:297:9:297:12 | [post] this access : Capture [field Field] : String | Capture.cs:304:9:304:9 | access to local variable a : Action [captured this in M10, field Field] : String | provenance | |
| Capture.cs:297:9:297:12 | [post] this access : Capture [field Field] : String | Capture.cs:306:15:306:18 | this access : Capture [field Field] : String | provenance | |
| Capture.cs:297:22:297:35 | "taint source" : String | Capture.cs:297:9:297:12 | [post] this access : Capture [field Field] : String | provenance | |
-| Capture.cs:299:16:299:16 | access to local variable a : (...) => ... [captured this in M10, field Field] : String | Capture.cs:304:9:304:9 | access to local variable a : (...) => ... [captured this in M10, field Field] : String | provenance | |
-| Capture.cs:299:20:303:9 | (...) => ... : (...) => ... [captured this in M10, field Field] : String | Capture.cs:299:16:299:16 | access to local variable a : (...) => ... [captured this in M10, field Field] : String | provenance | |
| Capture.cs:301:19:301:22 | this access : Capture [field Field] : String | Capture.cs:301:19:301:28 | access to field Field | provenance | |
| Capture.cs:302:13:302:16 | [post] this access : Capture [field Field] : String | Capture.cs:304:9:304:9 | [post] access to local variable a : (...) => ... [captured this in M10, field Field] : String | provenance | |
| Capture.cs:302:26:302:39 | "taint source" : String | Capture.cs:302:13:302:16 | [post] this access : Capture [field Field] : String | provenance | |
| Capture.cs:304:9:304:9 | [post] access to local variable a : (...) => ... [captured this in M10, field Field] : String | Capture.cs:306:15:306:18 | this access : Capture [field Field] : String | provenance | |
-| Capture.cs:304:9:304:9 | access to local variable a : (...) => ... [captured this in M10, field Field] : String | Capture.cs:301:19:301:22 | this access : Capture [field Field] : String | provenance | |
| Capture.cs:304:9:304:9 | access to local variable a : Action [captured this in M10, field Field] : String | Capture.cs:301:19:301:22 | this access : Capture [field Field] : String | provenance | |
| Capture.cs:306:15:306:18 | this access : Capture [field Field] : String | Capture.cs:306:15:306:24 | access to field Field | provenance | |
| Capture.cs:311:17:311:30 | "taint source" : String | Capture.cs:312:15:312:15 | access to local variable x | provenance | |
| Capture.cs:318:17:318:30 | "taint source" : String | Capture.cs:319:19:319:19 | access to local variable x | provenance | |
-| Capture.cs:328:17:328:30 | "taint source" : String | Capture.cs:330:9:330:49 | CapturedLocalFunction(...) : CapturedLocalFunction [captured x] : String | provenance | |
-| Capture.cs:328:17:328:30 | "taint source" : String | Capture.cs:332:9:332:65 | CapturingLocalFunction(...) : CapturingLocalFunction [captured x] : String | provenance | |
| Capture.cs:328:17:328:30 | "taint source" : String | Capture.cs:334:9:334:30 | access to local function CapturingLocalFunction : CapturingLocalFunction [captured x] : String | provenance | |
-| Capture.cs:330:9:330:49 | CapturedLocalFunction(...) : CapturedLocalFunction [captured x] : String | Capture.cs:332:42:332:62 | access to local function CapturedLocalFunction : CapturedLocalFunction [captured x] : String | provenance | |
-| Capture.cs:332:9:332:65 | CapturingLocalFunction(...) : CapturingLocalFunction [captured x] : String | Capture.cs:334:9:334:30 | access to local function CapturingLocalFunction : CapturingLocalFunction [captured x] : String | provenance | |
-| Capture.cs:332:42:332:62 | access to local function CapturedLocalFunction : CapturedLocalFunction [captured x] : String | Capture.cs:330:47:330:47 | access to local variable x | provenance | |
| Capture.cs:332:42:332:62 | access to local function CapturedLocalFunction : CapturedLocalFunction [captured x] : String | Capture.cs:330:47:330:47 | access to local variable x | provenance | |
| Capture.cs:334:9:334:30 | access to local function CapturingLocalFunction : CapturingLocalFunction [captured x] : String | Capture.cs:332:42:332:62 | access to local function CapturedLocalFunction : CapturedLocalFunction [captured x] : String | provenance | |
| Capture.cs:339:17:339:30 | "taint source" : String | Capture.cs:341:33:341:46 | (...) => ... : (...) => ... [captured x] : String | provenance | |
-| Capture.cs:341:33:341:46 | (...) => ... : (...) => ... [captured x] : String | Capture.cs:343:34:343:55 | (...) => ... : (...) => ... [captured capturedLambda, captured x] : String | provenance | |
| Capture.cs:341:33:341:46 | (...) => ... : (...) => ... [captured x] : String | Capture.cs:345:9:345:23 | access to local variable capturingLambda : Action [captured capturedLambda, captured x] : String | provenance | |
-| Capture.cs:343:16:343:30 | access to local variable capturingLambda : (...) => ... [captured capturedLambda, captured x] : String | Capture.cs:345:9:345:23 | access to local variable capturingLambda : (...) => ... [captured capturedLambda, captured x] : String | provenance | |
-| Capture.cs:343:34:343:55 | (...) => ... : (...) => ... [captured capturedLambda, captured x] : String | Capture.cs:343:16:343:30 | access to local variable capturingLambda : (...) => ... [captured capturedLambda, captured x] : String | provenance | |
| Capture.cs:343:40:343:53 | access to local variable capturedLambda : (...) => ... [captured x] : String | Capture.cs:341:45:341:45 | access to local variable x | provenance | |
-| Capture.cs:345:9:345:23 | access to local variable capturingLambda : (...) => ... [captured capturedLambda, captured x] : String | Capture.cs:343:40:343:53 | access to local variable capturedLambda : (...) => ... [captured x] : String | provenance | |
| Capture.cs:345:9:345:23 | access to local variable capturingLambda : Action [captured capturedLambda, captured x] : String | Capture.cs:343:40:343:53 | access to local variable capturedLambda : (...) => ... [captured x] : String | provenance | |
| Capture.cs:350:34:350:34 | a : (...) => ... [captured s] : String | Capture.cs:352:9:352:9 | access to parameter a : (...) => ... [captured s] : String | provenance | |
| Capture.cs:350:34:350:34 | a : (...) => ... [captured sink39] : String | Capture.cs:352:9:352:9 | access to parameter a : (...) => ... [captured sink39] : String | provenance | |
@@ -519,24 +467,18 @@ edges
| Splitting.cs:48:36:48:49 | "taint source" : String | Splitting.cs:48:13:48:13 | access to local variable s : String | provenance | |
nodes
| Capture.cs:7:20:7:26 | tainted : String | semmle.label | tainted : String |
-| Capture.cs:9:9:13:9 | CaptureIn1(...) : CaptureIn1 [captured tainted] : String | semmle.label | CaptureIn1(...) : CaptureIn1 [captured tainted] : String |
| Capture.cs:11:17:11:22 | access to local variable sink27 : String | semmle.label | access to local variable sink27 : String |
| Capture.cs:11:26:11:32 | access to parameter tainted : String | semmle.label | access to parameter tainted : String |
| Capture.cs:12:19:12:24 | access to local variable sink27 | semmle.label | access to local variable sink27 |
| Capture.cs:14:9:14:18 | access to local function CaptureIn1 : CaptureIn1 [captured tainted] : String | semmle.label | access to local function CaptureIn1 : CaptureIn1 [captured tainted] : String |
-| Capture.cs:16:9:24:9 | CaptureIn2(...) : CaptureIn2 [captured tainted] : String | semmle.label | CaptureIn2(...) : CaptureIn2 [captured tainted] : String |
-| Capture.cs:18:13:22:13 | M(...) : M [captured tainted] : String | semmle.label | M(...) : M [captured tainted] : String |
| Capture.cs:20:21:20:26 | access to local variable sink28 : String | semmle.label | access to local variable sink28 : String |
| Capture.cs:20:30:20:36 | access to parameter tainted : String | semmle.label | access to parameter tainted : String |
| Capture.cs:21:23:21:28 | access to local variable sink28 | semmle.label | access to local variable sink28 |
| Capture.cs:23:13:23:13 | access to local function M : M [captured tainted] : String | semmle.label | access to local function M : M [captured tainted] : String |
| Capture.cs:25:9:25:18 | access to local function CaptureIn2 : CaptureIn2 [captured tainted] : String | semmle.label | access to local function CaptureIn2 : CaptureIn2 [captured tainted] : String |
-| Capture.cs:27:30:27:39 | access to local variable captureIn3 : (...) => ... [captured tainted] : String | semmle.label | access to local variable captureIn3 : (...) => ... [captured tainted] : String |
-| Capture.cs:27:43:32:9 | (...) => ... : (...) => ... [captured tainted] : String | semmle.label | (...) => ... : (...) => ... [captured tainted] : String |
| Capture.cs:29:17:29:22 | access to local variable sink29 : String | semmle.label | access to local variable sink29 : String |
| Capture.cs:29:26:29:32 | access to parameter tainted : String | semmle.label | access to parameter tainted : String |
| Capture.cs:30:19:30:24 | access to local variable sink29 | semmle.label | access to local variable sink29 |
-| Capture.cs:33:30:33:39 | access to local variable captureIn3 : (...) => ... [captured tainted] : String | semmle.label | access to local variable captureIn3 : (...) => ... [captured tainted] : String |
| Capture.cs:33:30:33:39 | access to local variable captureIn3 : Func [captured tainted] : String | semmle.label | access to local variable captureIn3 : Func [captured tainted] : String |
| Capture.cs:50:50:50:55 | sink39 : String | semmle.label | sink39 : String |
| Capture.cs:52:23:59:13 | (...) => ... : (...) => ... [captured sink39] : String | semmle.label | (...) => ... : (...) => ... [captured sink39] : String |
@@ -558,21 +500,15 @@ nodes
| Capture.cs:123:9:123:33 | [post] access to local function CaptureOutMultipleLambdas : CaptureOutMultipleLambdas [captured sink40] : String | semmle.label | [post] access to local function CaptureOutMultipleLambdas : CaptureOutMultipleLambdas [captured sink40] : String |
| Capture.cs:124:15:124:20 | access to local variable sink40 | semmle.label | access to local variable sink40 |
| Capture.cs:127:25:127:31 | tainted : String | semmle.label | tainted : String |
-| Capture.cs:130:9:133:9 | CaptureThrough1(...) : CaptureThrough1 [captured tainted] : String | semmle.label | CaptureThrough1(...) : CaptureThrough1 [captured tainted] : String |
| Capture.cs:134:9:134:23 | [post] access to local function CaptureThrough1 : CaptureThrough1 [captured sink33] : String | semmle.label | [post] access to local function CaptureThrough1 : CaptureThrough1 [captured sink33] : String |
| Capture.cs:134:9:134:23 | access to local function CaptureThrough1 : CaptureThrough1 [captured tainted] : String | semmle.label | access to local function CaptureThrough1 : CaptureThrough1 [captured tainted] : String |
| Capture.cs:135:15:135:20 | access to local variable sink33 | semmle.label | access to local variable sink33 |
-| Capture.cs:138:9:145:9 | CaptureThrough2(...) : CaptureThrough2 [captured tainted] : String | semmle.label | CaptureThrough2(...) : CaptureThrough2 [captured tainted] : String |
| Capture.cs:146:9:146:23 | [post] access to local function CaptureThrough2 : CaptureThrough2 [captured sink34] : String | semmle.label | [post] access to local function CaptureThrough2 : CaptureThrough2 [captured sink34] : String |
| Capture.cs:146:9:146:23 | access to local function CaptureThrough2 : CaptureThrough2 [captured tainted] : String | semmle.label | access to local function CaptureThrough2 : CaptureThrough2 [captured tainted] : String |
| Capture.cs:147:15:147:20 | access to local variable sink34 | semmle.label | access to local variable sink34 |
-| Capture.cs:150:30:150:44 | access to local variable captureThrough3 : (...) => ... [captured tainted] : String | semmle.label | access to local variable captureThrough3 : (...) => ... [captured tainted] : String |
-| Capture.cs:150:48:154:9 | (...) => ... : (...) => ... [captured tainted] : String | semmle.label | (...) => ... : (...) => ... [captured tainted] : String |
| Capture.cs:155:30:155:44 | [post] access to local variable captureThrough3 : (...) => ... [captured sink35] : String | semmle.label | [post] access to local variable captureThrough3 : (...) => ... [captured sink35] : String |
-| Capture.cs:155:30:155:44 | access to local variable captureThrough3 : (...) => ... [captured tainted] : String | semmle.label | access to local variable captureThrough3 : (...) => ... [captured tainted] : String |
| Capture.cs:155:30:155:44 | access to local variable captureThrough3 : Func [captured tainted] : String | semmle.label | access to local variable captureThrough3 : Func [captured tainted] : String |
| Capture.cs:156:15:156:20 | access to local variable sink35 | semmle.label | access to local variable sink35 |
-| Capture.cs:158:9:161:9 | CaptureThrough4(...) : CaptureThrough4 [captured tainted] : String | semmle.label | CaptureThrough4(...) : CaptureThrough4 [captured tainted] : String |
| Capture.cs:162:13:162:18 | access to local variable sink36 : String | semmle.label | access to local variable sink36 : String |
| Capture.cs:162:22:162:36 | access to local function CaptureThrough4 : CaptureThrough4 [captured tainted] : String | semmle.label | access to local function CaptureThrough4 : CaptureThrough4 [captured tainted] : String |
| Capture.cs:162:22:162:38 | call to local function CaptureThrough4 : String | semmle.label | call to local function CaptureThrough4 : String |
@@ -583,7 +519,6 @@ nodes
| Capture.cs:170:25:170:31 | access to parameter tainted : String | semmle.label | access to parameter tainted : String |
| Capture.cs:171:15:171:20 | access to local variable sink37 | semmle.label | access to local variable sink37 |
| Capture.cs:190:26:190:26 | s : String | semmle.label | s : String |
-| Capture.cs:192:13:192:28 | M(...) : M [captured s] : String | semmle.label | M(...) : M [captured s] : String |
| Capture.cs:193:20:193:20 | access to local function M : M [captured s] : String | semmle.label | access to local function M : M [captured s] : String |
| Capture.cs:193:20:193:22 | call to local function M : String | semmle.label | call to local function M : String |
| Capture.cs:196:13:196:18 | access to local variable sink38 : String | semmle.label | access to local variable sink38 : String |
@@ -591,10 +526,7 @@ nodes
| Capture.cs:196:25:196:31 | access to parameter tainted : String | semmle.label | access to parameter tainted : String |
| Capture.cs:197:15:197:20 | access to local variable sink38 | semmle.label | access to local variable sink38 |
| Capture.cs:202:20:202:20 | s : String | semmle.label | s : String |
-| Capture.cs:204:16:204:16 | access to local variable a : (...) => ... [captured s] : String | semmle.label | access to local variable a : (...) => ... [captured s] : String |
-| Capture.cs:204:20:207:9 | (...) => ... : (...) => ... [captured s] : String | semmle.label | (...) => ... : (...) => ... [captured s] : String |
| Capture.cs:206:19:206:19 | access to parameter s | semmle.label | access to parameter s |
-| Capture.cs:208:9:208:9 | access to local variable a : (...) => ... [captured s] : String | semmle.label | access to local variable a : (...) => ... [captured s] : String |
| Capture.cs:208:9:208:9 | access to local variable a : Action [captured s] : String | semmle.label | access to local variable a : Action [captured s] : String |
| Capture.cs:211:21:211:34 | "taint source" : String | semmle.label | "taint source" : String |
| Capture.cs:213:22:213:22 | s : String | semmle.label | s : String |
@@ -612,14 +544,11 @@ nodes
| Capture.cs:234:15:234:15 | access to local variable x | semmle.label | access to local variable x |
| Capture.cs:242:9:242:9 | [post] access to local variable c : Capture [field Field] : String | semmle.label | [post] access to local variable c : Capture [field Field] : String |
| Capture.cs:242:19:242:32 | "taint source" : String | semmle.label | "taint source" : String |
-| Capture.cs:244:16:244:16 | access to local variable a : (...) => ... [captured c, field Field] : String | semmle.label | access to local variable a : (...) => ... [captured c, field Field] : String |
-| Capture.cs:244:20:248:9 | (...) => ... : (...) => ... [captured c, field Field] : String | semmle.label | (...) => ... : (...) => ... [captured c, field Field] : String |
| Capture.cs:246:19:246:19 | access to local variable c : Capture [field Field] : String | semmle.label | access to local variable c : Capture [field Field] : String |
| Capture.cs:246:19:246:25 | access to field Field | semmle.label | access to field Field |
| Capture.cs:247:13:247:13 | [post] access to local variable c : Capture [field Field] : String | semmle.label | [post] access to local variable c : Capture [field Field] : String |
| Capture.cs:247:23:247:36 | "taint source" : String | semmle.label | "taint source" : String |
| Capture.cs:249:9:249:9 | [post] access to local variable a : (...) => ... [captured c, field Field] : String | semmle.label | [post] access to local variable a : (...) => ... [captured c, field Field] : String |
-| Capture.cs:249:9:249:9 | access to local variable a : (...) => ... [captured c, field Field] : String | semmle.label | access to local variable a : (...) => ... [captured c, field Field] : String |
| Capture.cs:249:9:249:9 | access to local variable a : Action [captured c, field Field] : String | semmle.label | access to local variable a : Action [captured c, field Field] : String |
| Capture.cs:251:15:251:15 | access to local variable c : Capture [field Field] : String | semmle.label | access to local variable c : Capture [field Field] : String |
| Capture.cs:251:15:251:21 | access to field Field | semmle.label | access to field Field |
@@ -632,29 +561,20 @@ nodes
| Capture.cs:273:30:273:30 | access to parameter x | semmle.label | access to parameter x |
| Capture.cs:273:34:273:47 | "taint source" : String | semmle.label | "taint source" : String |
| Capture.cs:278:17:278:30 | "taint source" : String | semmle.label | "taint source" : String |
-| Capture.cs:280:16:280:21 | access to local variable middle : (...) => ... [captured x] : String | semmle.label | access to local variable middle : (...) => ... [captured x] : String |
-| Capture.cs:280:25:288:9 | (...) => ... : (...) => ... [captured x] : String | semmle.label | (...) => ... : (...) => ... [captured x] : String |
-| Capture.cs:282:20:282:24 | access to local variable inner : (...) => ... [captured x] : String | semmle.label | access to local variable inner : (...) => ... [captured x] : String |
-| Capture.cs:282:28:286:13 | (...) => ... : (...) => ... [captured x] : String | semmle.label | (...) => ... : (...) => ... [captured x] : String |
| Capture.cs:284:23:284:23 | access to local variable x | semmle.label | access to local variable x |
| Capture.cs:285:21:285:34 | "taint source" : String | semmle.label | "taint source" : String |
| Capture.cs:287:13:287:17 | [post] access to local variable inner : (...) => ... [captured x] : String | semmle.label | [post] access to local variable inner : (...) => ... [captured x] : String |
-| Capture.cs:287:13:287:17 | access to local variable inner : (...) => ... [captured x] : String | semmle.label | access to local variable inner : (...) => ... [captured x] : String |
| Capture.cs:287:13:287:17 | access to local variable inner : Action [captured x] : String | semmle.label | access to local variable inner : Action [captured x] : String |
| Capture.cs:290:9:290:14 | [post] access to local variable middle : (...) => ... [captured x] : String | semmle.label | [post] access to local variable middle : (...) => ... [captured x] : String |
-| Capture.cs:290:9:290:14 | access to local variable middle : (...) => ... [captured x] : String | semmle.label | access to local variable middle : (...) => ... [captured x] : String |
| Capture.cs:290:9:290:14 | access to local variable middle : Action [captured x] : String | semmle.label | access to local variable middle : Action [captured x] : String |
| Capture.cs:292:15:292:15 | access to local variable x | semmle.label | access to local variable x |
| Capture.cs:297:9:297:12 | [post] this access : Capture [field Field] : String | semmle.label | [post] this access : Capture [field Field] : String |
| Capture.cs:297:22:297:35 | "taint source" : String | semmle.label | "taint source" : String |
-| Capture.cs:299:16:299:16 | access to local variable a : (...) => ... [captured this in M10, field Field] : String | semmle.label | access to local variable a : (...) => ... [captured this in M10, field Field] : String |
-| Capture.cs:299:20:303:9 | (...) => ... : (...) => ... [captured this in M10, field Field] : String | semmle.label | (...) => ... : (...) => ... [captured this in M10, field Field] : String |
| Capture.cs:301:19:301:22 | this access : Capture [field Field] : String | semmle.label | this access : Capture [field Field] : String |
| Capture.cs:301:19:301:28 | access to field Field | semmle.label | access to field Field |
| Capture.cs:302:13:302:16 | [post] this access : Capture [field Field] : String | semmle.label | [post] this access : Capture [field Field] : String |
| Capture.cs:302:26:302:39 | "taint source" : String | semmle.label | "taint source" : String |
| Capture.cs:304:9:304:9 | [post] access to local variable a : (...) => ... [captured this in M10, field Field] : String | semmle.label | [post] access to local variable a : (...) => ... [captured this in M10, field Field] : String |
-| Capture.cs:304:9:304:9 | access to local variable a : (...) => ... [captured this in M10, field Field] : String | semmle.label | access to local variable a : (...) => ... [captured this in M10, field Field] : String |
| Capture.cs:304:9:304:9 | access to local variable a : Action [captured this in M10, field Field] : String | semmle.label | access to local variable a : Action [captured this in M10, field Field] : String |
| Capture.cs:306:15:306:18 | this access : Capture [field Field] : String | semmle.label | this access : Capture [field Field] : String |
| Capture.cs:306:15:306:24 | access to field Field | semmle.label | access to field Field |
@@ -663,19 +583,13 @@ nodes
| Capture.cs:318:17:318:30 | "taint source" : String | semmle.label | "taint source" : String |
| Capture.cs:319:19:319:19 | access to local variable x | semmle.label | access to local variable x |
| Capture.cs:328:17:328:30 | "taint source" : String | semmle.label | "taint source" : String |
-| Capture.cs:330:9:330:49 | CapturedLocalFunction(...) : CapturedLocalFunction [captured x] : String | semmle.label | CapturedLocalFunction(...) : CapturedLocalFunction [captured x] : String |
| Capture.cs:330:47:330:47 | access to local variable x | semmle.label | access to local variable x |
-| Capture.cs:332:9:332:65 | CapturingLocalFunction(...) : CapturingLocalFunction [captured x] : String | semmle.label | CapturingLocalFunction(...) : CapturingLocalFunction [captured x] : String |
-| Capture.cs:332:42:332:62 | access to local function CapturedLocalFunction : CapturedLocalFunction [captured x] : String | semmle.label | access to local function CapturedLocalFunction : CapturedLocalFunction [captured x] : String |
| Capture.cs:332:42:332:62 | access to local function CapturedLocalFunction : CapturedLocalFunction [captured x] : String | semmle.label | access to local function CapturedLocalFunction : CapturedLocalFunction [captured x] : String |
| Capture.cs:334:9:334:30 | access to local function CapturingLocalFunction : CapturingLocalFunction [captured x] : String | semmle.label | access to local function CapturingLocalFunction : CapturingLocalFunction [captured x] : String |
| Capture.cs:339:17:339:30 | "taint source" : String | semmle.label | "taint source" : String |
| Capture.cs:341:33:341:46 | (...) => ... : (...) => ... [captured x] : String | semmle.label | (...) => ... : (...) => ... [captured x] : String |
| Capture.cs:341:45:341:45 | access to local variable x | semmle.label | access to local variable x |
-| Capture.cs:343:16:343:30 | access to local variable capturingLambda : (...) => ... [captured capturedLambda, captured x] : String | semmle.label | access to local variable capturingLambda : (...) => ... [captured capturedLambda, captured x] : String |
-| Capture.cs:343:34:343:55 | (...) => ... : (...) => ... [captured capturedLambda, captured x] : String | semmle.label | (...) => ... : (...) => ... [captured capturedLambda, captured x] : String |
| Capture.cs:343:40:343:53 | access to local variable capturedLambda : (...) => ... [captured x] : String | semmle.label | access to local variable capturedLambda : (...) => ... [captured x] : String |
-| Capture.cs:345:9:345:23 | access to local variable capturingLambda : (...) => ... [captured capturedLambda, captured x] : String | semmle.label | access to local variable capturingLambda : (...) => ... [captured capturedLambda, captured x] : String |
| Capture.cs:345:9:345:23 | access to local variable capturingLambda : Action [captured capturedLambda, captured x] : String | semmle.label | access to local variable capturingLambda : Action [captured capturedLambda, captured x] : String |
| Capture.cs:350:34:350:34 | a : (...) => ... [captured s] : String | semmle.label | a : (...) => ... [captured s] : String |
| Capture.cs:350:34:350:34 | a : (...) => ... [captured sink39] : String | semmle.label | a : (...) => ... [captured sink39] : String |
diff --git a/csharp/ql/test/library-tests/dataflow/global/TaintTrackingPath.expected b/csharp/ql/test/library-tests/dataflow/global/TaintTrackingPath.expected
index 2bd30574649..a5ceb692695 100644
--- a/csharp/ql/test/library-tests/dataflow/global/TaintTrackingPath.expected
+++ b/csharp/ql/test/library-tests/dataflow/global/TaintTrackingPath.expected
@@ -1,27 +1,17 @@
edges
-| Capture.cs:7:20:7:26 | tainted : String | Capture.cs:9:9:13:9 | CaptureIn1(...) : CaptureIn1 [captured tainted] : String | provenance | |
| Capture.cs:7:20:7:26 | tainted : String | Capture.cs:14:9:14:18 | access to local function CaptureIn1 : CaptureIn1 [captured tainted] : String | provenance | |
-| Capture.cs:7:20:7:26 | tainted : String | Capture.cs:16:9:24:9 | CaptureIn2(...) : CaptureIn2 [captured tainted] : String | provenance | |
| Capture.cs:7:20:7:26 | tainted : String | Capture.cs:25:9:25:18 | access to local function CaptureIn2 : CaptureIn2 [captured tainted] : String | provenance | |
-| Capture.cs:7:20:7:26 | tainted : String | Capture.cs:27:43:32:9 | (...) => ... : (...) => ... [captured tainted] : String | provenance | |
| Capture.cs:7:20:7:26 | tainted : String | Capture.cs:33:30:33:39 | access to local variable captureIn3 : Func [captured tainted] : String | provenance | |
| Capture.cs:7:20:7:26 | tainted : String | Capture.cs:61:36:61:42 | access to parameter tainted : String | provenance | |
-| Capture.cs:9:9:13:9 | CaptureIn1(...) : CaptureIn1 [captured tainted] : String | Capture.cs:14:9:14:18 | access to local function CaptureIn1 : CaptureIn1 [captured tainted] : String | provenance | |
| Capture.cs:11:17:11:22 | access to local variable sink27 : String | Capture.cs:12:19:12:24 | access to local variable sink27 | provenance | |
| Capture.cs:11:26:11:32 | access to parameter tainted : String | Capture.cs:11:17:11:22 | access to local variable sink27 : String | provenance | |
| Capture.cs:14:9:14:18 | access to local function CaptureIn1 : CaptureIn1 [captured tainted] : String | Capture.cs:11:26:11:32 | access to parameter tainted : String | provenance | |
-| Capture.cs:16:9:24:9 | CaptureIn2(...) : CaptureIn2 [captured tainted] : String | Capture.cs:25:9:25:18 | access to local function CaptureIn2 : CaptureIn2 [captured tainted] : String | provenance | |
-| Capture.cs:18:13:22:13 | M(...) : M [captured tainted] : String | Capture.cs:23:13:23:13 | access to local function M : M [captured tainted] : String | provenance | |
| Capture.cs:20:21:20:26 | access to local variable sink28 : String | Capture.cs:21:23:21:28 | access to local variable sink28 | provenance | |
| Capture.cs:20:30:20:36 | access to parameter tainted : String | Capture.cs:20:21:20:26 | access to local variable sink28 : String | provenance | |
| Capture.cs:23:13:23:13 | access to local function M : M [captured tainted] : String | Capture.cs:20:30:20:36 | access to parameter tainted : String | provenance | |
-| Capture.cs:25:9:25:18 | access to local function CaptureIn2 : CaptureIn2 [captured tainted] : String | Capture.cs:18:13:22:13 | M(...) : M [captured tainted] : String | provenance | |
| Capture.cs:25:9:25:18 | access to local function CaptureIn2 : CaptureIn2 [captured tainted] : String | Capture.cs:23:13:23:13 | access to local function M : M [captured tainted] : String | provenance | |
-| Capture.cs:27:30:27:39 | access to local variable captureIn3 : (...) => ... [captured tainted] : String | Capture.cs:33:30:33:39 | access to local variable captureIn3 : (...) => ... [captured tainted] : String | provenance | |
-| Capture.cs:27:43:32:9 | (...) => ... : (...) => ... [captured tainted] : String | Capture.cs:27:30:27:39 | access to local variable captureIn3 : (...) => ... [captured tainted] : String | provenance | |
| Capture.cs:29:17:29:22 | access to local variable sink29 : String | Capture.cs:30:19:30:24 | access to local variable sink29 | provenance | |
| Capture.cs:29:26:29:32 | access to parameter tainted : String | Capture.cs:29:17:29:22 | access to local variable sink29 : String | provenance | |
-| Capture.cs:33:30:33:39 | access to local variable captureIn3 : (...) => ... [captured tainted] : String | Capture.cs:29:26:29:32 | access to parameter tainted : String | provenance | |
| Capture.cs:33:30:33:39 | access to local variable captureIn3 : Func [captured tainted] : String | Capture.cs:29:26:29:32 | access to parameter tainted : String | provenance | |
| Capture.cs:50:50:50:55 | sink39 : String | Capture.cs:52:23:59:13 | (...) => ... : (...) => ... [captured sink39] : String | provenance | |
| Capture.cs:52:23:59:13 | (...) => ... : (...) => ... [captured sink39] : String | Capture.cs:350:34:350:34 | a : (...) => ... [captured sink39] : String | provenance | |
@@ -37,28 +27,18 @@ edges
| Capture.cs:114:23:117:13 | [post] (...) => ... : (...) => ... [captured sink40] : String | Capture.cs:123:9:123:33 | [post] access to local function CaptureOutMultipleLambdas : CaptureOutMultipleLambdas [captured sink40] : String | provenance | |
| Capture.cs:116:26:116:39 | "taint source" : String | Capture.cs:352:9:352:9 | [post] access to parameter a : (...) => ... [captured sink40] : String | provenance | |
| Capture.cs:123:9:123:33 | [post] access to local function CaptureOutMultipleLambdas : CaptureOutMultipleLambdas [captured sink40] : String | Capture.cs:124:15:124:20 | access to local variable sink40 | provenance | |
-| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:130:9:133:9 | CaptureThrough1(...) : CaptureThrough1 [captured tainted] : String | provenance | |
| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:134:9:134:23 | access to local function CaptureThrough1 : CaptureThrough1 [captured tainted] : String | provenance | |
-| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:138:9:145:9 | CaptureThrough2(...) : CaptureThrough2 [captured tainted] : String | provenance | |
| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:146:9:146:23 | access to local function CaptureThrough2 : CaptureThrough2 [captured tainted] : String | provenance | |
-| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:150:48:154:9 | (...) => ... : (...) => ... [captured tainted] : String | provenance | |
| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:155:30:155:44 | access to local variable captureThrough3 : Func [captured tainted] : String | provenance | |
-| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:158:9:161:9 | CaptureThrough4(...) : CaptureThrough4 [captured tainted] : String | provenance | |
| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:162:22:162:36 | access to local function CaptureThrough4 : CaptureThrough4 [captured tainted] : String | provenance | |
| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:170:25:170:31 | access to parameter tainted : String | provenance | |
| Capture.cs:127:25:127:31 | tainted : String | Capture.cs:196:25:196:31 | access to parameter tainted : String | provenance | |
-| Capture.cs:130:9:133:9 | CaptureThrough1(...) : CaptureThrough1 [captured tainted] : String | Capture.cs:134:9:134:23 | access to local function CaptureThrough1 : CaptureThrough1 [captured tainted] : String | provenance | |
| Capture.cs:134:9:134:23 | [post] access to local function CaptureThrough1 : CaptureThrough1 [captured sink33] : String | Capture.cs:135:15:135:20 | access to local variable sink33 | provenance | |
| Capture.cs:134:9:134:23 | access to local function CaptureThrough1 : CaptureThrough1 [captured tainted] : String | Capture.cs:134:9:134:23 | [post] access to local function CaptureThrough1 : CaptureThrough1 [captured sink33] : String | provenance | |
-| Capture.cs:138:9:145:9 | CaptureThrough2(...) : CaptureThrough2 [captured tainted] : String | Capture.cs:146:9:146:23 | access to local function CaptureThrough2 : CaptureThrough2 [captured tainted] : String | provenance | |
| Capture.cs:146:9:146:23 | [post] access to local function CaptureThrough2 : CaptureThrough2 [captured sink34] : String | Capture.cs:147:15:147:20 | access to local variable sink34 | provenance | |
| Capture.cs:146:9:146:23 | access to local function CaptureThrough2 : CaptureThrough2 [captured tainted] : String | Capture.cs:146:9:146:23 | [post] access to local function CaptureThrough2 : CaptureThrough2 [captured sink34] : String | provenance | |
-| Capture.cs:150:30:150:44 | access to local variable captureThrough3 : (...) => ... [captured tainted] : String | Capture.cs:155:30:155:44 | access to local variable captureThrough3 : (...) => ... [captured tainted] : String | provenance | |
-| Capture.cs:150:48:154:9 | (...) => ... : (...) => ... [captured tainted] : String | Capture.cs:150:30:150:44 | access to local variable captureThrough3 : (...) => ... [captured tainted] : String | provenance | |
| Capture.cs:155:30:155:44 | [post] access to local variable captureThrough3 : (...) => ... [captured sink35] : String | Capture.cs:156:15:156:20 | access to local variable sink35 | provenance | |
-| Capture.cs:155:30:155:44 | access to local variable captureThrough3 : (...) => ... [captured tainted] : String | Capture.cs:155:30:155:44 | [post] access to local variable captureThrough3 : (...) => ... [captured sink35] : String | provenance | |
| Capture.cs:155:30:155:44 | access to local variable captureThrough3 : Func [captured tainted] : String | Capture.cs:155:30:155:44 | [post] access to local variable captureThrough3 : (...) => ... [captured sink35] : String | provenance | |
-| Capture.cs:158:9:161:9 | CaptureThrough4(...) : CaptureThrough4 [captured tainted] : String | Capture.cs:162:22:162:36 | access to local function CaptureThrough4 : CaptureThrough4 [captured tainted] : String | provenance | |
| Capture.cs:162:13:162:18 | access to local variable sink36 : String | Capture.cs:163:15:163:20 | access to local variable sink36 | provenance | |
| Capture.cs:162:22:162:36 | access to local function CaptureThrough4 : CaptureThrough4 [captured tainted] : String | Capture.cs:162:22:162:38 | call to local function CaptureThrough4 : String | provenance | |
| Capture.cs:162:22:162:38 | call to local function CaptureThrough4 : String | Capture.cs:162:13:162:18 | access to local variable sink36 : String | provenance | |
@@ -66,19 +46,13 @@ edges
| Capture.cs:170:9:170:23 | [post] access to local function CaptureThrough5 : CaptureThrough5 [captured sink37] : String | Capture.cs:171:15:171:20 | access to local variable sink37 | provenance | |
| Capture.cs:170:25:170:31 | access to parameter tainted : String | Capture.cs:166:37:166:37 | p : String | provenance | |
| Capture.cs:170:25:170:31 | access to parameter tainted : String | Capture.cs:170:9:170:23 | [post] access to local function CaptureThrough5 : CaptureThrough5 [captured sink37] : String | provenance | |
-| Capture.cs:190:26:190:26 | s : String | Capture.cs:192:13:192:28 | M(...) : M [captured s] : String | provenance | |
| Capture.cs:190:26:190:26 | s : String | Capture.cs:193:20:193:20 | access to local function M : M [captured s] : String | provenance | |
-| Capture.cs:192:13:192:28 | M(...) : M [captured s] : String | Capture.cs:193:20:193:20 | access to local function M : M [captured s] : String | provenance | |
| Capture.cs:193:20:193:20 | access to local function M : M [captured s] : String | Capture.cs:193:20:193:22 | call to local function M : String | provenance | |
| Capture.cs:196:13:196:18 | access to local variable sink38 : String | Capture.cs:197:15:197:20 | access to local variable sink38 | provenance | |
| Capture.cs:196:22:196:32 | call to local function Id : String | Capture.cs:196:13:196:18 | access to local variable sink38 : String | provenance | |
| Capture.cs:196:25:196:31 | access to parameter tainted : String | Capture.cs:190:26:190:26 | s : String | provenance | |
| Capture.cs:196:25:196:31 | access to parameter tainted : String | Capture.cs:196:22:196:32 | call to local function Id : String | provenance | |
-| Capture.cs:202:20:202:20 | s : String | Capture.cs:204:20:207:9 | (...) => ... : (...) => ... [captured s] : String | provenance | |
| Capture.cs:202:20:202:20 | s : String | Capture.cs:208:9:208:9 | access to local variable a : Action [captured s] : String | provenance | |
-| Capture.cs:204:16:204:16 | access to local variable a : (...) => ... [captured s] : String | Capture.cs:208:9:208:9 | access to local variable a : (...) => ... [captured s] : String | provenance | |
-| Capture.cs:204:20:207:9 | (...) => ... : (...) => ... [captured s] : String | Capture.cs:204:16:204:16 | access to local variable a : (...) => ... [captured s] : String | provenance | |
-| Capture.cs:208:9:208:9 | access to local variable a : (...) => ... [captured s] : String | Capture.cs:206:19:206:19 | access to parameter s | provenance | |
| Capture.cs:208:9:208:9 | access to local variable a : Action [captured s] : String | Capture.cs:206:19:206:19 | access to parameter s | provenance | |
| Capture.cs:211:21:211:34 | "taint source" : String | Capture.cs:202:20:202:20 | s : String | provenance | |
| Capture.cs:213:22:213:22 | s : String | Capture.cs:215:16:218:9 | (...) => ... : (...) => ... [captured s] : String | provenance | |
@@ -93,17 +67,13 @@ edges
| Capture.cs:229:20:233:9 | (...) => ... : (...) => ... [captured x] : String | Capture.cs:231:19:231:19 | access to local variable x | provenance | |
| Capture.cs:229:20:233:9 | [post] (...) => ... : (...) => ... [captured x] : String | Capture.cs:234:15:234:15 | access to local variable x | provenance | |
| Capture.cs:232:17:232:30 | "taint source" : String | Capture.cs:229:20:233:9 | [post] (...) => ... : (...) => ... [captured x] : String | provenance | |
-| Capture.cs:242:9:242:9 | [post] access to local variable c : Capture [field Field] : String | Capture.cs:244:20:248:9 | (...) => ... : (...) => ... [captured c, field Field] : String | provenance | |
| Capture.cs:242:9:242:9 | [post] access to local variable c : Capture [field Field] : String | Capture.cs:249:9:249:9 | access to local variable a : Action [captured c, field Field] : String | provenance | |
| Capture.cs:242:9:242:9 | [post] access to local variable c : Capture [field Field] : String | Capture.cs:251:15:251:15 | access to local variable c : Capture [field Field] : String | provenance | |
| Capture.cs:242:19:242:32 | "taint source" : String | Capture.cs:242:9:242:9 | [post] access to local variable c : Capture [field Field] : String | provenance | |
-| Capture.cs:244:16:244:16 | access to local variable a : (...) => ... [captured c, field Field] : String | Capture.cs:249:9:249:9 | access to local variable a : (...) => ... [captured c, field Field] : String | provenance | |
-| Capture.cs:244:20:248:9 | (...) => ... : (...) => ... [captured c, field Field] : String | Capture.cs:244:16:244:16 | access to local variable a : (...) => ... [captured c, field Field] : String | provenance | |
| Capture.cs:246:19:246:19 | access to local variable c : Capture [field Field] : String | Capture.cs:246:19:246:25 | access to field Field | provenance | |
| Capture.cs:247:13:247:13 | [post] access to local variable c : Capture [field Field] : String | Capture.cs:249:9:249:9 | [post] access to local variable a : (...) => ... [captured c, field Field] : String | provenance | |
| Capture.cs:247:23:247:36 | "taint source" : String | Capture.cs:247:13:247:13 | [post] access to local variable c : Capture [field Field] : String | provenance | |
| Capture.cs:249:9:249:9 | [post] access to local variable a : (...) => ... [captured c, field Field] : String | Capture.cs:251:15:251:15 | access to local variable c : Capture [field Field] : String | provenance | |
-| Capture.cs:249:9:249:9 | access to local variable a : (...) => ... [captured c, field Field] : String | Capture.cs:246:19:246:19 | access to local variable c : Capture [field Field] : String | provenance | |
| Capture.cs:249:9:249:9 | access to local variable a : Action [captured c, field Field] : String | Capture.cs:246:19:246:19 | access to local variable c : Capture [field Field] : String | provenance | |
| Capture.cs:251:15:251:15 | access to local variable c : Capture [field Field] : String | Capture.cs:251:15:251:21 | access to field Field | provenance | |
| Capture.cs:264:13:264:13 | [post] access to local variable c : Capture [field Field] : String | Capture.cs:266:9:266:9 | [post] access to local variable a : (...) => ... [captured c, field Field] : String | provenance | |
@@ -112,52 +82,30 @@ edges
| Capture.cs:268:15:268:15 | access to local variable c : Capture [field Field] : String | Capture.cs:268:15:268:21 | access to field Field | provenance | |
| Capture.cs:273:19:273:19 | x : String | Capture.cs:273:30:273:30 | access to parameter x | provenance | |
| Capture.cs:273:34:273:47 | "taint source" : String | Capture.cs:355:45:355:45 | x : String | provenance | |
-| Capture.cs:278:17:278:30 | "taint source" : String | Capture.cs:280:25:288:9 | (...) => ... : (...) => ... [captured x] : String | provenance | |
| Capture.cs:278:17:278:30 | "taint source" : String | Capture.cs:290:9:290:14 | access to local variable middle : Action [captured x] : String | provenance | |
| Capture.cs:278:17:278:30 | "taint source" : String | Capture.cs:292:15:292:15 | access to local variable x | provenance | |
-| Capture.cs:280:16:280:21 | access to local variable middle : (...) => ... [captured x] : String | Capture.cs:290:9:290:14 | access to local variable middle : (...) => ... [captured x] : String | provenance | |
-| Capture.cs:280:25:288:9 | (...) => ... : (...) => ... [captured x] : String | Capture.cs:280:16:280:21 | access to local variable middle : (...) => ... [captured x] : String | provenance | |
-| Capture.cs:282:20:282:24 | access to local variable inner : (...) => ... [captured x] : String | Capture.cs:287:13:287:17 | access to local variable inner : (...) => ... [captured x] : String | provenance | |
-| Capture.cs:282:28:286:13 | (...) => ... : (...) => ... [captured x] : String | Capture.cs:282:20:282:24 | access to local variable inner : (...) => ... [captured x] : String | provenance | |
| Capture.cs:285:21:285:34 | "taint source" : String | Capture.cs:287:13:287:17 | [post] access to local variable inner : (...) => ... [captured x] : String | provenance | |
| Capture.cs:287:13:287:17 | [post] access to local variable inner : (...) => ... [captured x] : String | Capture.cs:290:9:290:14 | [post] access to local variable middle : (...) => ... [captured x] : String | provenance | |
-| Capture.cs:287:13:287:17 | access to local variable inner : (...) => ... [captured x] : String | Capture.cs:284:23:284:23 | access to local variable x | provenance | |
| Capture.cs:287:13:287:17 | access to local variable inner : Action [captured x] : String | Capture.cs:284:23:284:23 | access to local variable x | provenance | |
| Capture.cs:290:9:290:14 | [post] access to local variable middle : (...) => ... [captured x] : String | Capture.cs:292:15:292:15 | access to local variable x | provenance | |
-| Capture.cs:290:9:290:14 | access to local variable middle : (...) => ... [captured x] : String | Capture.cs:282:28:286:13 | (...) => ... : (...) => ... [captured x] : String | provenance | |
-| Capture.cs:290:9:290:14 | access to local variable middle : (...) => ... [captured x] : String | Capture.cs:287:13:287:17 | access to local variable inner : Action [captured x] : String | provenance | |
-| Capture.cs:290:9:290:14 | access to local variable middle : Action [captured x] : String | Capture.cs:282:28:286:13 | (...) => ... : (...) => ... [captured x] : String | provenance | |
| Capture.cs:290:9:290:14 | access to local variable middle : Action [captured x] : String | Capture.cs:287:13:287:17 | access to local variable inner : Action [captured x] : String | provenance | |
-| Capture.cs:297:9:297:12 | [post] this access : Capture [field Field] : String | Capture.cs:299:20:303:9 | (...) => ... : (...) => ... [captured this in M10, field Field] : String | provenance | |
| Capture.cs:297:9:297:12 | [post] this access : Capture [field Field] : String | Capture.cs:304:9:304:9 | access to local variable a : Action [captured this in M10, field Field] : String | provenance | |
| Capture.cs:297:9:297:12 | [post] this access : Capture [field Field] : String | Capture.cs:306:15:306:18 | this access : Capture [field Field] : String | provenance | |
| Capture.cs:297:22:297:35 | "taint source" : String | Capture.cs:297:9:297:12 | [post] this access : Capture [field Field] : String | provenance | |
-| Capture.cs:299:16:299:16 | access to local variable a : (...) => ... [captured this in M10, field Field] : String | Capture.cs:304:9:304:9 | access to local variable a : (...) => ... [captured this in M10, field Field] : String | provenance | |
-| Capture.cs:299:20:303:9 | (...) => ... : (...) => ... [captured this in M10, field Field] : String | Capture.cs:299:16:299:16 | access to local variable a : (...) => ... [captured this in M10, field Field] : String | provenance | |
| Capture.cs:301:19:301:22 | this access : Capture [field Field] : String | Capture.cs:301:19:301:28 | access to field Field | provenance | |
| Capture.cs:302:13:302:16 | [post] this access : Capture [field Field] : String | Capture.cs:304:9:304:9 | [post] access to local variable a : (...) => ... [captured this in M10, field Field] : String | provenance | |
| Capture.cs:302:26:302:39 | "taint source" : String | Capture.cs:302:13:302:16 | [post] this access : Capture [field Field] : String | provenance | |
| Capture.cs:304:9:304:9 | [post] access to local variable a : (...) => ... [captured this in M10, field Field] : String | Capture.cs:306:15:306:18 | this access : Capture [field Field] : String | provenance | |
-| Capture.cs:304:9:304:9 | access to local variable a : (...) => ... [captured this in M10, field Field] : String | Capture.cs:301:19:301:22 | this access : Capture [field Field] : String | provenance | |
| Capture.cs:304:9:304:9 | access to local variable a : Action [captured this in M10, field Field] : String | Capture.cs:301:19:301:22 | this access : Capture [field Field] : String | provenance | |
| Capture.cs:306:15:306:18 | this access : Capture [field Field] : String | Capture.cs:306:15:306:24 | access to field Field | provenance | |
| Capture.cs:311:17:311:30 | "taint source" : String | Capture.cs:312:15:312:15 | access to local variable x | provenance | |
| Capture.cs:318:17:318:30 | "taint source" : String | Capture.cs:319:19:319:19 | access to local variable x | provenance | |
-| Capture.cs:328:17:328:30 | "taint source" : String | Capture.cs:330:9:330:49 | CapturedLocalFunction(...) : CapturedLocalFunction [captured x] : String | provenance | |
-| Capture.cs:328:17:328:30 | "taint source" : String | Capture.cs:332:9:332:65 | CapturingLocalFunction(...) : CapturingLocalFunction [captured x] : String | provenance | |
| Capture.cs:328:17:328:30 | "taint source" : String | Capture.cs:334:9:334:30 | access to local function CapturingLocalFunction : CapturingLocalFunction [captured x] : String | provenance | |
-| Capture.cs:330:9:330:49 | CapturedLocalFunction(...) : CapturedLocalFunction [captured x] : String | Capture.cs:332:42:332:62 | access to local function CapturedLocalFunction : CapturedLocalFunction [captured x] : String | provenance | |
-| Capture.cs:332:9:332:65 | CapturingLocalFunction(...) : CapturingLocalFunction [captured x] : String | Capture.cs:334:9:334:30 | access to local function CapturingLocalFunction : CapturingLocalFunction [captured x] : String | provenance | |
-| Capture.cs:332:42:332:62 | access to local function CapturedLocalFunction : CapturedLocalFunction [captured x] : String | Capture.cs:330:47:330:47 | access to local variable x | provenance | |
| Capture.cs:332:42:332:62 | access to local function CapturedLocalFunction : CapturedLocalFunction [captured x] : String | Capture.cs:330:47:330:47 | access to local variable x | provenance | |
| Capture.cs:334:9:334:30 | access to local function CapturingLocalFunction : CapturingLocalFunction [captured x] : String | Capture.cs:332:42:332:62 | access to local function CapturedLocalFunction : CapturedLocalFunction [captured x] : String | provenance | |
| Capture.cs:339:17:339:30 | "taint source" : String | Capture.cs:341:33:341:46 | (...) => ... : (...) => ... [captured x] : String | provenance | |
-| Capture.cs:341:33:341:46 | (...) => ... : (...) => ... [captured x] : String | Capture.cs:343:34:343:55 | (...) => ... : (...) => ... [captured capturedLambda, captured x] : String | provenance | |
| Capture.cs:341:33:341:46 | (...) => ... : (...) => ... [captured x] : String | Capture.cs:345:9:345:23 | access to local variable capturingLambda : Action [captured capturedLambda, captured x] : String | provenance | |
-| Capture.cs:343:16:343:30 | access to local variable capturingLambda : (...) => ... [captured capturedLambda, captured x] : String | Capture.cs:345:9:345:23 | access to local variable capturingLambda : (...) => ... [captured capturedLambda, captured x] : String | provenance | |
-| Capture.cs:343:34:343:55 | (...) => ... : (...) => ... [captured capturedLambda, captured x] : String | Capture.cs:343:16:343:30 | access to local variable capturingLambda : (...) => ... [captured capturedLambda, captured x] : String | provenance | |
| Capture.cs:343:40:343:53 | access to local variable capturedLambda : (...) => ... [captured x] : String | Capture.cs:341:45:341:45 | access to local variable x | provenance | |
-| Capture.cs:345:9:345:23 | access to local variable capturingLambda : (...) => ... [captured capturedLambda, captured x] : String | Capture.cs:343:40:343:53 | access to local variable capturedLambda : (...) => ... [captured x] : String | provenance | |
| Capture.cs:345:9:345:23 | access to local variable capturingLambda : Action [captured capturedLambda, captured x] : String | Capture.cs:343:40:343:53 | access to local variable capturedLambda : (...) => ... [captured x] : String | provenance | |
| Capture.cs:350:34:350:34 | a : (...) => ... [captured s] : String | Capture.cs:352:9:352:9 | access to parameter a : (...) => ... [captured s] : String | provenance | |
| Capture.cs:350:34:350:34 | a : (...) => ... [captured sink39] : String | Capture.cs:352:9:352:9 | access to parameter a : (...) => ... [captured sink39] : String | provenance | |
@@ -569,24 +517,18 @@ edges
| Splitting.cs:48:36:48:49 | "taint source" : String | Splitting.cs:48:13:48:13 | access to local variable s : String | provenance | |
nodes
| Capture.cs:7:20:7:26 | tainted : String | semmle.label | tainted : String |
-| Capture.cs:9:9:13:9 | CaptureIn1(...) : CaptureIn1 [captured tainted] : String | semmle.label | CaptureIn1(...) : CaptureIn1 [captured tainted] : String |
| Capture.cs:11:17:11:22 | access to local variable sink27 : String | semmle.label | access to local variable sink27 : String |
| Capture.cs:11:26:11:32 | access to parameter tainted : String | semmle.label | access to parameter tainted : String |
| Capture.cs:12:19:12:24 | access to local variable sink27 | semmle.label | access to local variable sink27 |
| Capture.cs:14:9:14:18 | access to local function CaptureIn1 : CaptureIn1 [captured tainted] : String | semmle.label | access to local function CaptureIn1 : CaptureIn1 [captured tainted] : String |
-| Capture.cs:16:9:24:9 | CaptureIn2(...) : CaptureIn2 [captured tainted] : String | semmle.label | CaptureIn2(...) : CaptureIn2 [captured tainted] : String |
-| Capture.cs:18:13:22:13 | M(...) : M [captured tainted] : String | semmle.label | M(...) : M [captured tainted] : String |
| Capture.cs:20:21:20:26 | access to local variable sink28 : String | semmle.label | access to local variable sink28 : String |
| Capture.cs:20:30:20:36 | access to parameter tainted : String | semmle.label | access to parameter tainted : String |
| Capture.cs:21:23:21:28 | access to local variable sink28 | semmle.label | access to local variable sink28 |
| Capture.cs:23:13:23:13 | access to local function M : M [captured tainted] : String | semmle.label | access to local function M : M [captured tainted] : String |
| Capture.cs:25:9:25:18 | access to local function CaptureIn2 : CaptureIn2 [captured tainted] : String | semmle.label | access to local function CaptureIn2 : CaptureIn2 [captured tainted] : String |
-| Capture.cs:27:30:27:39 | access to local variable captureIn3 : (...) => ... [captured tainted] : String | semmle.label | access to local variable captureIn3 : (...) => ... [captured tainted] : String |
-| Capture.cs:27:43:32:9 | (...) => ... : (...) => ... [captured tainted] : String | semmle.label | (...) => ... : (...) => ... [captured tainted] : String |
| Capture.cs:29:17:29:22 | access to local variable sink29 : String | semmle.label | access to local variable sink29 : String |
| Capture.cs:29:26:29:32 | access to parameter tainted : String | semmle.label | access to parameter tainted : String |
| Capture.cs:30:19:30:24 | access to local variable sink29 | semmle.label | access to local variable sink29 |
-| Capture.cs:33:30:33:39 | access to local variable captureIn3 : (...) => ... [captured tainted] : String | semmle.label | access to local variable captureIn3 : (...) => ... [captured tainted] : String |
| Capture.cs:33:30:33:39 | access to local variable captureIn3 : Func [captured tainted] : String | semmle.label | access to local variable captureIn3 : Func [captured tainted] : String |
| Capture.cs:50:50:50:55 | sink39 : String | semmle.label | sink39 : String |
| Capture.cs:52:23:59:13 | (...) => ... : (...) => ... [captured sink39] : String | semmle.label | (...) => ... : (...) => ... [captured sink39] : String |
@@ -608,21 +550,15 @@ nodes
| Capture.cs:123:9:123:33 | [post] access to local function CaptureOutMultipleLambdas : CaptureOutMultipleLambdas [captured sink40] : String | semmle.label | [post] access to local function CaptureOutMultipleLambdas : CaptureOutMultipleLambdas [captured sink40] : String |
| Capture.cs:124:15:124:20 | access to local variable sink40 | semmle.label | access to local variable sink40 |
| Capture.cs:127:25:127:31 | tainted : String | semmle.label | tainted : String |
-| Capture.cs:130:9:133:9 | CaptureThrough1(...) : CaptureThrough1 [captured tainted] : String | semmle.label | CaptureThrough1(...) : CaptureThrough1 [captured tainted] : String |
| Capture.cs:134:9:134:23 | [post] access to local function CaptureThrough1 : CaptureThrough1 [captured sink33] : String | semmle.label | [post] access to local function CaptureThrough1 : CaptureThrough1 [captured sink33] : String |
| Capture.cs:134:9:134:23 | access to local function CaptureThrough1 : CaptureThrough1 [captured tainted] : String | semmle.label | access to local function CaptureThrough1 : CaptureThrough1 [captured tainted] : String |
| Capture.cs:135:15:135:20 | access to local variable sink33 | semmle.label | access to local variable sink33 |
-| Capture.cs:138:9:145:9 | CaptureThrough2(...) : CaptureThrough2 [captured tainted] : String | semmle.label | CaptureThrough2(...) : CaptureThrough2 [captured tainted] : String |
| Capture.cs:146:9:146:23 | [post] access to local function CaptureThrough2 : CaptureThrough2 [captured sink34] : String | semmle.label | [post] access to local function CaptureThrough2 : CaptureThrough2 [captured sink34] : String |
| Capture.cs:146:9:146:23 | access to local function CaptureThrough2 : CaptureThrough2 [captured tainted] : String | semmle.label | access to local function CaptureThrough2 : CaptureThrough2 [captured tainted] : String |
| Capture.cs:147:15:147:20 | access to local variable sink34 | semmle.label | access to local variable sink34 |
-| Capture.cs:150:30:150:44 | access to local variable captureThrough3 : (...) => ... [captured tainted] : String | semmle.label | access to local variable captureThrough3 : (...) => ... [captured tainted] : String |
-| Capture.cs:150:48:154:9 | (...) => ... : (...) => ... [captured tainted] : String | semmle.label | (...) => ... : (...) => ... [captured tainted] : String |
| Capture.cs:155:30:155:44 | [post] access to local variable captureThrough3 : (...) => ... [captured sink35] : String | semmle.label | [post] access to local variable captureThrough3 : (...) => ... [captured sink35] : String |
-| Capture.cs:155:30:155:44 | access to local variable captureThrough3 : (...) => ... [captured tainted] : String | semmle.label | access to local variable captureThrough3 : (...) => ... [captured tainted] : String |
| Capture.cs:155:30:155:44 | access to local variable captureThrough3 : Func [captured tainted] : String | semmle.label | access to local variable captureThrough3 : Func [captured tainted] : String |
| Capture.cs:156:15:156:20 | access to local variable sink35 | semmle.label | access to local variable sink35 |
-| Capture.cs:158:9:161:9 | CaptureThrough4(...) : CaptureThrough4 [captured tainted] : String | semmle.label | CaptureThrough4(...) : CaptureThrough4 [captured tainted] : String |
| Capture.cs:162:13:162:18 | access to local variable sink36 : String | semmle.label | access to local variable sink36 : String |
| Capture.cs:162:22:162:36 | access to local function CaptureThrough4 : CaptureThrough4 [captured tainted] : String | semmle.label | access to local function CaptureThrough4 : CaptureThrough4 [captured tainted] : String |
| Capture.cs:162:22:162:38 | call to local function CaptureThrough4 : String | semmle.label | call to local function CaptureThrough4 : String |
@@ -633,7 +569,6 @@ nodes
| Capture.cs:170:25:170:31 | access to parameter tainted : String | semmle.label | access to parameter tainted : String |
| Capture.cs:171:15:171:20 | access to local variable sink37 | semmle.label | access to local variable sink37 |
| Capture.cs:190:26:190:26 | s : String | semmle.label | s : String |
-| Capture.cs:192:13:192:28 | M(...) : M [captured s] : String | semmle.label | M(...) : M [captured s] : String |
| Capture.cs:193:20:193:20 | access to local function M : M [captured s] : String | semmle.label | access to local function M : M [captured s] : String |
| Capture.cs:193:20:193:22 | call to local function M : String | semmle.label | call to local function M : String |
| Capture.cs:196:13:196:18 | access to local variable sink38 : String | semmle.label | access to local variable sink38 : String |
@@ -641,10 +576,7 @@ nodes
| Capture.cs:196:25:196:31 | access to parameter tainted : String | semmle.label | access to parameter tainted : String |
| Capture.cs:197:15:197:20 | access to local variable sink38 | semmle.label | access to local variable sink38 |
| Capture.cs:202:20:202:20 | s : String | semmle.label | s : String |
-| Capture.cs:204:16:204:16 | access to local variable a : (...) => ... [captured s] : String | semmle.label | access to local variable a : (...) => ... [captured s] : String |
-| Capture.cs:204:20:207:9 | (...) => ... : (...) => ... [captured s] : String | semmle.label | (...) => ... : (...) => ... [captured s] : String |
| Capture.cs:206:19:206:19 | access to parameter s | semmle.label | access to parameter s |
-| Capture.cs:208:9:208:9 | access to local variable a : (...) => ... [captured s] : String | semmle.label | access to local variable a : (...) => ... [captured s] : String |
| Capture.cs:208:9:208:9 | access to local variable a : Action [captured s] : String | semmle.label | access to local variable a : Action [captured s] : String |
| Capture.cs:211:21:211:34 | "taint source" : String | semmle.label | "taint source" : String |
| Capture.cs:213:22:213:22 | s : String | semmle.label | s : String |
@@ -662,14 +594,11 @@ nodes
| Capture.cs:234:15:234:15 | access to local variable x | semmle.label | access to local variable x |
| Capture.cs:242:9:242:9 | [post] access to local variable c : Capture [field Field] : String | semmle.label | [post] access to local variable c : Capture [field Field] : String |
| Capture.cs:242:19:242:32 | "taint source" : String | semmle.label | "taint source" : String |
-| Capture.cs:244:16:244:16 | access to local variable a : (...) => ... [captured c, field Field] : String | semmle.label | access to local variable a : (...) => ... [captured c, field Field] : String |
-| Capture.cs:244:20:248:9 | (...) => ... : (...) => ... [captured c, field Field] : String | semmle.label | (...) => ... : (...) => ... [captured c, field Field] : String |
| Capture.cs:246:19:246:19 | access to local variable c : Capture [field Field] : String | semmle.label | access to local variable c : Capture [field Field] : String |
| Capture.cs:246:19:246:25 | access to field Field | semmle.label | access to field Field |
| Capture.cs:247:13:247:13 | [post] access to local variable c : Capture [field Field] : String | semmle.label | [post] access to local variable c : Capture [field Field] : String |
| Capture.cs:247:23:247:36 | "taint source" : String | semmle.label | "taint source" : String |
| Capture.cs:249:9:249:9 | [post] access to local variable a : (...) => ... [captured c, field Field] : String | semmle.label | [post] access to local variable a : (...) => ... [captured c, field Field] : String |
-| Capture.cs:249:9:249:9 | access to local variable a : (...) => ... [captured c, field Field] : String | semmle.label | access to local variable a : (...) => ... [captured c, field Field] : String |
| Capture.cs:249:9:249:9 | access to local variable a : Action [captured c, field Field] : String | semmle.label | access to local variable a : Action [captured c, field Field] : String |
| Capture.cs:251:15:251:15 | access to local variable c : Capture [field Field] : String | semmle.label | access to local variable c : Capture [field Field] : String |
| Capture.cs:251:15:251:21 | access to field Field | semmle.label | access to field Field |
@@ -682,29 +611,20 @@ nodes
| Capture.cs:273:30:273:30 | access to parameter x | semmle.label | access to parameter x |
| Capture.cs:273:34:273:47 | "taint source" : String | semmle.label | "taint source" : String |
| Capture.cs:278:17:278:30 | "taint source" : String | semmle.label | "taint source" : String |
-| Capture.cs:280:16:280:21 | access to local variable middle : (...) => ... [captured x] : String | semmle.label | access to local variable middle : (...) => ... [captured x] : String |
-| Capture.cs:280:25:288:9 | (...) => ... : (...) => ... [captured x] : String | semmle.label | (...) => ... : (...) => ... [captured x] : String |
-| Capture.cs:282:20:282:24 | access to local variable inner : (...) => ... [captured x] : String | semmle.label | access to local variable inner : (...) => ... [captured x] : String |
-| Capture.cs:282:28:286:13 | (...) => ... : (...) => ... [captured x] : String | semmle.label | (...) => ... : (...) => ... [captured x] : String |
| Capture.cs:284:23:284:23 | access to local variable x | semmle.label | access to local variable x |
| Capture.cs:285:21:285:34 | "taint source" : String | semmle.label | "taint source" : String |
| Capture.cs:287:13:287:17 | [post] access to local variable inner : (...) => ... [captured x] : String | semmle.label | [post] access to local variable inner : (...) => ... [captured x] : String |
-| Capture.cs:287:13:287:17 | access to local variable inner : (...) => ... [captured x] : String | semmle.label | access to local variable inner : (...) => ... [captured x] : String |
| Capture.cs:287:13:287:17 | access to local variable inner : Action [captured x] : String | semmle.label | access to local variable inner : Action [captured x] : String |
| Capture.cs:290:9:290:14 | [post] access to local variable middle : (...) => ... [captured x] : String | semmle.label | [post] access to local variable middle : (...) => ... [captured x] : String |
-| Capture.cs:290:9:290:14 | access to local variable middle : (...) => ... [captured x] : String | semmle.label | access to local variable middle : (...) => ... [captured x] : String |
| Capture.cs:290:9:290:14 | access to local variable middle : Action [captured x] : String | semmle.label | access to local variable middle : Action [captured x] : String |
| Capture.cs:292:15:292:15 | access to local variable x | semmle.label | access to local variable x |
| Capture.cs:297:9:297:12 | [post] this access : Capture [field Field] : String | semmle.label | [post] this access : Capture [field Field] : String |
| Capture.cs:297:22:297:35 | "taint source" : String | semmle.label | "taint source" : String |
-| Capture.cs:299:16:299:16 | access to local variable a : (...) => ... [captured this in M10, field Field] : String | semmle.label | access to local variable a : (...) => ... [captured this in M10, field Field] : String |
-| Capture.cs:299:20:303:9 | (...) => ... : (...) => ... [captured this in M10, field Field] : String | semmle.label | (...) => ... : (...) => ... [captured this in M10, field Field] : String |
| Capture.cs:301:19:301:22 | this access : Capture [field Field] : String | semmle.label | this access : Capture [field Field] : String |
| Capture.cs:301:19:301:28 | access to field Field | semmle.label | access to field Field |
| Capture.cs:302:13:302:16 | [post] this access : Capture [field Field] : String | semmle.label | [post] this access : Capture [field Field] : String |
| Capture.cs:302:26:302:39 | "taint source" : String | semmle.label | "taint source" : String |
| Capture.cs:304:9:304:9 | [post] access to local variable a : (...) => ... [captured this in M10, field Field] : String | semmle.label | [post] access to local variable a : (...) => ... [captured this in M10, field Field] : String |
-| Capture.cs:304:9:304:9 | access to local variable a : (...) => ... [captured this in M10, field Field] : String | semmle.label | access to local variable a : (...) => ... [captured this in M10, field Field] : String |
| Capture.cs:304:9:304:9 | access to local variable a : Action [captured this in M10, field Field] : String | semmle.label | access to local variable a : Action [captured this in M10, field Field] : String |
| Capture.cs:306:15:306:18 | this access : Capture [field Field] : String | semmle.label | this access : Capture [field Field] : String |
| Capture.cs:306:15:306:24 | access to field Field | semmle.label | access to field Field |
@@ -713,19 +633,13 @@ nodes
| Capture.cs:318:17:318:30 | "taint source" : String | semmle.label | "taint source" : String |
| Capture.cs:319:19:319:19 | access to local variable x | semmle.label | access to local variable x |
| Capture.cs:328:17:328:30 | "taint source" : String | semmle.label | "taint source" : String |
-| Capture.cs:330:9:330:49 | CapturedLocalFunction(...) : CapturedLocalFunction [captured x] : String | semmle.label | CapturedLocalFunction(...) : CapturedLocalFunction [captured x] : String |
| Capture.cs:330:47:330:47 | access to local variable x | semmle.label | access to local variable x |
-| Capture.cs:332:9:332:65 | CapturingLocalFunction(...) : CapturingLocalFunction [captured x] : String | semmle.label | CapturingLocalFunction(...) : CapturingLocalFunction [captured x] : String |
-| Capture.cs:332:42:332:62 | access to local function CapturedLocalFunction : CapturedLocalFunction [captured x] : String | semmle.label | access to local function CapturedLocalFunction : CapturedLocalFunction [captured x] : String |
| Capture.cs:332:42:332:62 | access to local function CapturedLocalFunction : CapturedLocalFunction [captured x] : String | semmle.label | access to local function CapturedLocalFunction : CapturedLocalFunction [captured x] : String |
| Capture.cs:334:9:334:30 | access to local function CapturingLocalFunction : CapturingLocalFunction [captured x] : String | semmle.label | access to local function CapturingLocalFunction : CapturingLocalFunction [captured x] : String |
| Capture.cs:339:17:339:30 | "taint source" : String | semmle.label | "taint source" : String |
| Capture.cs:341:33:341:46 | (...) => ... : (...) => ... [captured x] : String | semmle.label | (...) => ... : (...) => ... [captured x] : String |
| Capture.cs:341:45:341:45 | access to local variable x | semmle.label | access to local variable x |
-| Capture.cs:343:16:343:30 | access to local variable capturingLambda : (...) => ... [captured capturedLambda, captured x] : String | semmle.label | access to local variable capturingLambda : (...) => ... [captured capturedLambda, captured x] : String |
-| Capture.cs:343:34:343:55 | (...) => ... : (...) => ... [captured capturedLambda, captured x] : String | semmle.label | (...) => ... : (...) => ... [captured capturedLambda, captured x] : String |
| Capture.cs:343:40:343:53 | access to local variable capturedLambda : (...) => ... [captured x] : String | semmle.label | access to local variable capturedLambda : (...) => ... [captured x] : String |
-| Capture.cs:345:9:345:23 | access to local variable capturingLambda : (...) => ... [captured capturedLambda, captured x] : String | semmle.label | access to local variable capturingLambda : (...) => ... [captured capturedLambda, captured x] : String |
| Capture.cs:345:9:345:23 | access to local variable capturingLambda : Action [captured capturedLambda, captured x] : String | semmle.label | access to local variable capturingLambda : Action [captured capturedLambda, captured x] : String |
| Capture.cs:350:34:350:34 | a : (...) => ... [captured s] : String | semmle.label | a : (...) => ... [captured s] : String |
| Capture.cs:350:34:350:34 | a : (...) => ... [captured sink39] : String | semmle.label | a : (...) => ... [captured sink39] : String |
diff --git a/python/ql/test/experimental/dataflow/variable-capture/by_value.py b/python/ql/test/experimental/dataflow/variable-capture/by_value.py
index fa7546b8f2b..01b2ed83a46 100644
--- a/python/ql/test/experimental/dataflow/variable-capture/by_value.py
+++ b/python/ql/test/experimental/dataflow/variable-capture/by_value.py
@@ -34,7 +34,7 @@ def by_value1():
a = SOURCE
def inner(a_val=a):
SINK(a_val) #$ captured
- SINK_F(a) #$ SPURIOUS: captured
+ SINK_F(a)
a = NONSOURCE
inner()
diff --git a/ruby/ql/test/library-tests/dataflow/global/Flow.expected b/ruby/ql/test/library-tests/dataflow/global/Flow.expected
index 9e01d45a07c..94589e1aafb 100644
--- a/ruby/ql/test/library-tests/dataflow/global/Flow.expected
+++ b/ruby/ql/test/library-tests/dataflow/global/Flow.expected
@@ -1,11 +1,7 @@
testFailures
-| captured_variables.rb:236:14:236:14 | x | Unexpected result: hasValueFlow=19 |
edges
| blocks.rb:14:12:14:20 | call to source | blocks.rb:8:10:8:14 | yield ... | provenance | |
-| captured_variables.rb:9:24:9:24 | x | captured_variables.rb:10:10:10:23 | -> { ... } [captured x] | provenance | |
| captured_variables.rb:9:24:9:24 | x | captured_variables.rb:11:5:11:6 | fn [captured x] | provenance | |
-| captured_variables.rb:10:5:10:6 | fn [captured x] | captured_variables.rb:11:5:11:6 | fn [captured x] | provenance | |
-| captured_variables.rb:10:10:10:23 | -> { ... } [captured x] | captured_variables.rb:10:5:10:6 | fn [captured x] | provenance | |
| captured_variables.rb:11:5:11:6 | fn [captured x] | captured_variables.rb:10:20:10:20 | x | provenance | |
| captured_variables.rb:13:20:13:29 | call to taint | captured_variables.rb:9:24:9:24 | x | provenance | |
| captured_variables.rb:15:28:15:28 | x | captured_variables.rb:16:5:18:5 | -> { ... } [captured x] | provenance | |
@@ -17,18 +13,12 @@ edges
| captured_variables.rb:27:25:27:57 | call to capture_escape_return2 [captured x] | captured_variables.rb:24:14:24:14 | x | provenance | |
| captured_variables.rb:27:48:27:57 | call to taint | captured_variables.rb:22:28:22:28 | x | provenance | |
| captured_variables.rb:27:48:27:57 | call to taint | captured_variables.rb:27:25:27:57 | call to capture_escape_return2 [captured x] | provenance | |
-| captured_variables.rb:29:33:29:33 | x | captured_variables.rb:30:10:32:5 | -> { ... } [captured x] | provenance | |
| captured_variables.rb:29:33:29:33 | x | captured_variables.rb:33:29:33:30 | fn [captured x] | provenance | |
-| captured_variables.rb:30:5:30:6 | fn [captured x] | captured_variables.rb:33:29:33:30 | fn [captured x] | provenance | |
-| captured_variables.rb:30:10:32:5 | -> { ... } [captured x] | captured_variables.rb:30:5:30:6 | fn [captured x] | provenance | |
| captured_variables.rb:33:29:33:30 | fn [captured x] | captured_variables.rb:31:14:31:14 | x | provenance | |
| captured_variables.rb:35:29:35:38 | call to taint | captured_variables.rb:29:33:29:33 | x | provenance | |
| captured_variables.rb:37:13:37:14 | fn [captured x] | captured_variables.rb:38:5:38:6 | fn [captured x] | provenance | |
| captured_variables.rb:38:5:38:6 | fn [captured x] | captured_variables.rb:42:14:42:14 | x | provenance | |
-| captured_variables.rb:40:31:40:31 | x | captured_variables.rb:41:10:43:5 | -> { ... } [captured x] | provenance | |
| captured_variables.rb:40:31:40:31 | x | captured_variables.rb:44:13:44:14 | fn [captured x] | provenance | |
-| captured_variables.rb:41:5:41:6 | fn [captured x] | captured_variables.rb:44:13:44:14 | fn [captured x] | provenance | |
-| captured_variables.rb:41:10:43:5 | -> { ... } [captured x] | captured_variables.rb:41:5:41:6 | fn [captured x] | provenance | |
| captured_variables.rb:44:13:44:14 | fn [captured x] | captured_variables.rb:37:13:37:14 | fn [captured x] | provenance | |
| captured_variables.rb:46:27:46:36 | call to taint | captured_variables.rb:40:31:40:31 | x | provenance | |
| captured_variables.rb:48:5:48:12 | call to taint | captured_variables.rb:49:16:52:3 | do ... end [captured x] | provenance | |
@@ -66,11 +56,8 @@ edges
| captured_variables.rb:83:6:83:8 | foo [@field] | captured_variables.rb:60:5:62:7 | self in get_field [@field] | provenance | |
| captured_variables.rb:83:6:83:8 | foo [@field] | captured_variables.rb:83:6:83:18 | call to get_field | provenance | |
| captured_variables.rb:83:6:83:8 | foo [@field] | instance_variables.rb:13:5:15:7 | self in get_field [@field] | provenance | |
-| captured_variables.rb:85:5:85:12 | call to taint | captured_variables.rb:86:6:89:1 | -> { ... } [captured y] | provenance | |
| captured_variables.rb:85:5:85:12 | call to taint | captured_variables.rb:90:1:90:2 | fn [captured y] | provenance | |
| captured_variables.rb:85:5:85:12 | call to taint | captured_variables.rb:91:6:91:6 | y | provenance | |
-| captured_variables.rb:86:1:86:2 | fn [captured y] | captured_variables.rb:90:1:90:2 | fn [captured y] | provenance | |
-| captured_variables.rb:86:6:89:1 | -> { ... } [captured y] | captured_variables.rb:86:1:86:2 | fn [captured y] | provenance | |
| captured_variables.rb:88:9:88:16 | call to taint | captured_variables.rb:90:1:90:2 | [post] fn [captured y] | provenance | |
| captured_variables.rb:90:1:90:2 | [post] fn [captured y] | captured_variables.rb:91:6:91:6 | y | provenance | |
| captured_variables.rb:90:1:90:2 | fn [captured y] | captured_variables.rb:87:10:87:10 | y | provenance | |
@@ -82,18 +69,12 @@ edges
| captured_variables.rb:101:11:101:11 | x | captured_variables.rb:104:31:104:31 | x | provenance | |
| captured_variables.rb:104:17:104:24 | call to taint | captured_variables.rb:100:21:100:21 | x | provenance | |
| captured_variables.rb:104:31:104:31 | x | captured_variables.rb:105:10:105:10 | x | provenance | |
-| captured_variables.rb:109:9:109:17 | call to taint | captured_variables.rb:110:14:116:5 | -> { ... } [captured x] | provenance | |
| captured_variables.rb:109:9:109:17 | call to taint | captured_variables.rb:117:5:117:10 | middle [captured x] | provenance | |
| captured_variables.rb:109:9:109:17 | call to taint | captured_variables.rb:118:10:118:10 | x | provenance | |
-| captured_variables.rb:110:5:110:10 | middle [captured x] | captured_variables.rb:117:5:117:10 | middle [captured x] | provenance | |
-| captured_variables.rb:110:14:116:5 | -> { ... } [captured x] | captured_variables.rb:110:5:110:10 | middle [captured x] | provenance | |
-| captured_variables.rb:111:9:111:13 | inner [captured x] | captured_variables.rb:115:9:115:13 | inner [captured x] | provenance | |
-| captured_variables.rb:111:17:114:9 | -> { ... } [captured x] | captured_variables.rb:111:9:111:13 | inner [captured x] | provenance | |
| captured_variables.rb:113:17:113:25 | call to taint | captured_variables.rb:115:9:115:13 | [post] inner [captured x] | provenance | |
| captured_variables.rb:115:9:115:13 | [post] inner [captured x] | captured_variables.rb:117:5:117:10 | [post] middle [captured x] | provenance | |
| captured_variables.rb:115:9:115:13 | inner [captured x] | captured_variables.rb:112:18:112:18 | x | provenance | |
| captured_variables.rb:117:5:117:10 | [post] middle [captured x] | captured_variables.rb:118:10:118:10 | x | provenance | |
-| captured_variables.rb:117:5:117:10 | middle [captured x] | captured_variables.rb:111:17:114:9 | -> { ... } [captured x] | provenance | |
| captured_variables.rb:117:5:117:10 | middle [captured x] | captured_variables.rb:115:9:115:13 | inner [captured x] | provenance | |
| captured_variables.rb:147:5:147:6 | [post] self [@x] | captured_variables.rb:153:14:155:7 | do ... end [captured self, @x] | provenance | |
| captured_variables.rb:147:10:147:18 | call to taint | captured_variables.rb:147:5:147:6 | [post] self [@x] | provenance | |
@@ -117,16 +98,9 @@ edges
| captured_variables.rb:194:1:194:1 | c [@x] | captured_variables.rb:185:5:189:7 | self in baz [@x] | provenance | |
| captured_variables.rb:197:9:197:17 | call to taint | captured_variables.rb:199:10:199:10 | x | provenance | |
| captured_variables.rb:206:13:206:21 | call to taint | captured_variables.rb:208:14:208:14 | x | provenance | |
-| captured_variables.rb:219:9:219:17 | call to taint | captured_variables.rb:222:11:224:5 | -> { ... } [captured x] | provenance | |
| captured_variables.rb:219:9:219:17 | call to taint | captured_variables.rb:226:5:226:7 | fn1 [captured x] | provenance | |
-| captured_variables.rb:222:5:222:7 | fn1 [captured x] | captured_variables.rb:226:5:226:7 | fn1 [captured x] | provenance | |
-| captured_variables.rb:222:11:224:5 | -> { ... } [captured x] | captured_variables.rb:222:5:222:7 | fn1 [captured x] | provenance | |
| captured_variables.rb:226:5:226:7 | [post] fn1 [captured y] | captured_variables.rb:227:10:227:10 | y | provenance | |
| captured_variables.rb:226:5:226:7 | fn1 [captured x] | captured_variables.rb:226:5:226:7 | [post] fn1 [captured y] | provenance | |
-| captured_variables.rb:233:9:233:17 | call to taint | captured_variables.rb:235:11:237:5 | -> { ... } [captured x] | provenance | |
-| captured_variables.rb:235:5:235:7 | fn1 [captured x] | captured_variables.rb:241:5:241:7 | fn1 [captured x] | provenance | |
-| captured_variables.rb:235:11:237:5 | -> { ... } [captured x] | captured_variables.rb:235:5:235:7 | fn1 [captured x] | provenance | |
-| captured_variables.rb:241:5:241:7 | fn1 [captured x] | captured_variables.rb:236:14:236:14 | x | provenance | |
| instance_variables.rb:10:19:10:19 | x | instance_variables.rb:11:18:11:18 | x | provenance | |
| instance_variables.rb:11:18:11:18 | x | instance_variables.rb:11:9:11:14 | [post] self [@field] | provenance | |
| instance_variables.rb:13:5:15:7 | self in get_field [@field] | instance_variables.rb:14:16:14:21 | self [@field] | provenance | |
@@ -269,8 +243,6 @@ nodes
| blocks.rb:8:10:8:14 | yield ... | semmle.label | yield ... |
| blocks.rb:14:12:14:20 | call to source | semmle.label | call to source |
| captured_variables.rb:9:24:9:24 | x | semmle.label | x |
-| captured_variables.rb:10:5:10:6 | fn [captured x] | semmle.label | fn [captured x] |
-| captured_variables.rb:10:10:10:23 | -> { ... } [captured x] | semmle.label | -> { ... } [captured x] |
| captured_variables.rb:10:20:10:20 | x | semmle.label | x |
| captured_variables.rb:11:5:11:6 | fn [captured x] | semmle.label | fn [captured x] |
| captured_variables.rb:13:20:13:29 | call to taint | semmle.label | call to taint |
@@ -286,16 +258,12 @@ nodes
| captured_variables.rb:27:25:27:57 | call to capture_escape_return2 [captured x] | semmle.label | call to capture_escape_return2 [captured x] |
| captured_variables.rb:27:48:27:57 | call to taint | semmle.label | call to taint |
| captured_variables.rb:29:33:29:33 | x | semmle.label | x |
-| captured_variables.rb:30:5:30:6 | fn [captured x] | semmle.label | fn [captured x] |
-| captured_variables.rb:30:10:32:5 | -> { ... } [captured x] | semmle.label | -> { ... } [captured x] |
| captured_variables.rb:31:14:31:14 | x | semmle.label | x |
| captured_variables.rb:33:29:33:30 | fn [captured x] | semmle.label | fn [captured x] |
| captured_variables.rb:35:29:35:38 | call to taint | semmle.label | call to taint |
| captured_variables.rb:37:13:37:14 | fn [captured x] | semmle.label | fn [captured x] |
| captured_variables.rb:38:5:38:6 | fn [captured x] | semmle.label | fn [captured x] |
| captured_variables.rb:40:31:40:31 | x | semmle.label | x |
-| captured_variables.rb:41:5:41:6 | fn [captured x] | semmle.label | fn [captured x] |
-| captured_variables.rb:41:10:43:5 | -> { ... } [captured x] | semmle.label | -> { ... } [captured x] |
| captured_variables.rb:42:14:42:14 | x | semmle.label | x |
| captured_variables.rb:44:13:44:14 | fn [captured x] | semmle.label | fn [captured x] |
| captured_variables.rb:46:27:46:36 | call to taint | semmle.label | call to taint |
@@ -328,8 +296,6 @@ nodes
| captured_variables.rb:83:6:83:8 | foo [@field] | semmle.label | foo [@field] |
| captured_variables.rb:83:6:83:18 | call to get_field | semmle.label | call to get_field |
| captured_variables.rb:85:5:85:12 | call to taint | semmle.label | call to taint |
-| captured_variables.rb:86:1:86:2 | fn [captured y] | semmle.label | fn [captured y] |
-| captured_variables.rb:86:6:89:1 | -> { ... } [captured y] | semmle.label | -> { ... } [captured y] |
| captured_variables.rb:87:10:87:10 | y | semmle.label | y |
| captured_variables.rb:88:9:88:16 | call to taint | semmle.label | call to taint |
| captured_variables.rb:90:1:90:2 | [post] fn [captured y] | semmle.label | [post] fn [captured y] |
@@ -346,10 +312,6 @@ nodes
| captured_variables.rb:104:31:104:31 | x | semmle.label | x |
| captured_variables.rb:105:10:105:10 | x | semmle.label | x |
| captured_variables.rb:109:9:109:17 | call to taint | semmle.label | call to taint |
-| captured_variables.rb:110:5:110:10 | middle [captured x] | semmle.label | middle [captured x] |
-| captured_variables.rb:110:14:116:5 | -> { ... } [captured x] | semmle.label | -> { ... } [captured x] |
-| captured_variables.rb:111:9:111:13 | inner [captured x] | semmle.label | inner [captured x] |
-| captured_variables.rb:111:17:114:9 | -> { ... } [captured x] | semmle.label | -> { ... } [captured x] |
| captured_variables.rb:112:18:112:18 | x | semmle.label | x |
| captured_variables.rb:113:17:113:25 | call to taint | semmle.label | call to taint |
| captured_variables.rb:115:9:115:13 | [post] inner [captured x] | semmle.label | [post] inner [captured x] |
@@ -385,16 +347,9 @@ nodes
| captured_variables.rb:206:13:206:21 | call to taint | semmle.label | call to taint |
| captured_variables.rb:208:14:208:14 | x | semmle.label | x |
| captured_variables.rb:219:9:219:17 | call to taint | semmle.label | call to taint |
-| captured_variables.rb:222:5:222:7 | fn1 [captured x] | semmle.label | fn1 [captured x] |
-| captured_variables.rb:222:11:224:5 | -> { ... } [captured x] | semmle.label | -> { ... } [captured x] |
| captured_variables.rb:226:5:226:7 | [post] fn1 [captured y] | semmle.label | [post] fn1 [captured y] |
| captured_variables.rb:226:5:226:7 | fn1 [captured x] | semmle.label | fn1 [captured x] |
| captured_variables.rb:227:10:227:10 | y | semmle.label | y |
-| captured_variables.rb:233:9:233:17 | call to taint | semmle.label | call to taint |
-| captured_variables.rb:235:5:235:7 | fn1 [captured x] | semmle.label | fn1 [captured x] |
-| captured_variables.rb:235:11:237:5 | -> { ... } [captured x] | semmle.label | -> { ... } [captured x] |
-| captured_variables.rb:236:14:236:14 | x | semmle.label | x |
-| captured_variables.rb:241:5:241:7 | fn1 [captured x] | semmle.label | fn1 [captured x] |
| instance_variables.rb:10:19:10:19 | x | semmle.label | x |
| instance_variables.rb:11:9:11:14 | [post] self [@field] | semmle.label | [post] self [@field] |
| instance_variables.rb:11:18:11:18 | x | semmle.label | x |
@@ -605,7 +560,6 @@ subpaths
| captured_variables.rb:199:10:199:10 | x | captured_variables.rb:197:9:197:17 | call to taint | captured_variables.rb:199:10:199:10 | x | $@ | captured_variables.rb:197:9:197:17 | call to taint | call to taint |
| captured_variables.rb:208:14:208:14 | x | captured_variables.rb:206:13:206:21 | call to taint | captured_variables.rb:208:14:208:14 | x | $@ | captured_variables.rb:206:13:206:21 | call to taint | call to taint |
| captured_variables.rb:227:10:227:10 | y | captured_variables.rb:219:9:219:17 | call to taint | captured_variables.rb:227:10:227:10 | y | $@ | captured_variables.rb:219:9:219:17 | call to taint | call to taint |
-| captured_variables.rb:236:14:236:14 | x | captured_variables.rb:233:9:233:17 | call to taint | captured_variables.rb:236:14:236:14 | x | $@ | captured_variables.rb:233:9:233:17 | call to taint | call to taint |
| instance_variables.rb:20:10:20:13 | @foo | instance_variables.rb:19:12:19:21 | call to taint | instance_variables.rb:20:10:20:13 | @foo | $@ | instance_variables.rb:19:12:19:21 | call to taint | call to taint |
| instance_variables.rb:36:10:36:33 | call to get_field | instance_variables.rb:36:14:36:22 | call to taint | instance_variables.rb:36:10:36:33 | call to get_field | $@ | instance_variables.rb:36:14:36:22 | call to taint | call to taint |
| instance_variables.rb:39:6:39:33 | call to get_field | instance_variables.rb:39:14:39:22 | call to taint | instance_variables.rb:39:6:39:33 | call to get_field | $@ | instance_variables.rb:39:14:39:22 | call to taint | call to taint |
From 8fe483d9d802dad7ded644d34abe26f062e9081b Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen
Date: Thu, 7 Mar 2024 14:25:55 +0100
Subject: [PATCH 059/309] Python: Add example of missing use-use flow
(see PR for more detailed description)
---
.../library-tests/essa/ssa-compute/test2.py | 29 +++++++++++++++++++
1 file changed, 29 insertions(+)
create mode 100644 python/ql/test/library-tests/essa/ssa-compute/test2.py
diff --git a/python/ql/test/library-tests/essa/ssa-compute/test2.py b/python/ql/test/library-tests/essa/ssa-compute/test2.py
new file mode 100644
index 00000000000..d117a6b53e6
--- /dev/null
+++ b/python/ql/test/library-tests/essa/ssa-compute/test2.py
@@ -0,0 +1,29 @@
+def func(x): # $ def=x
+ try:
+ with Thing() as y: # $ def=y
+ y.foo(x, 0) # $ def-use=x:1 def-use=y:3
+ while not x.attribute: # $ use-use=x:4 use-use=x:7
+ y.bar() # $ use-use=y:4 use-use=y:6
+ print(x) # $ use-use=x:5
+ finally:
+ pass
+
+def func(x): # $ def=x
+ try:
+ with Thing() as y: # $ def=y
+ y.foo(x, some_var) # $ def-use=x:11 def-use=y:13
+ while not x.attribute: # $ use-use=x:14 use-use=x:17
+ y.bar() # $ use-use=y:16 MISSING: use-use=y:14
+ print(x) # $ use-use=x:15
+ finally:
+ pass
+
+def func(x): # $ def=x
+ try:
+ with Thing() as y: # $ def=y
+ y.foo(x, some_var.some_attr) # $ def-use=x:21 def-use=y:23
+ while not x.attribute: # $ use-use=x:27 MISSING: use-use=x:24
+ y.bar() # $ use-use=y:26 MISSING: use-use=y:24
+ print(x) # $ use-use=x:25
+ finally:
+ pass
From 87b6592dbc99b5ec861b7c6d835868980d58cc6f Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen
Date: Fri, 8 Mar 2024 13:34:26 +0100
Subject: [PATCH 060/309] Python: Accept inconsistency for missing use-use flow
At least until we have a proper fix
---
python/ql/consistency-queries/TypeTrackingConsistency.ql | 6 ++++++
.../CONSISTENCY/TypeTrackingConsistency.expected | 6 ++++++
2 files changed, 12 insertions(+)
create mode 100644 python/ql/test/library-tests/essa/ssa-compute/CONSISTENCY/TypeTrackingConsistency.expected
diff --git a/python/ql/consistency-queries/TypeTrackingConsistency.ql b/python/ql/consistency-queries/TypeTrackingConsistency.ql
index b8f1e3a1b48..b937b0c6163 100644
--- a/python/ql/consistency-queries/TypeTrackingConsistency.ql
+++ b/python/ql/consistency-queries/TypeTrackingConsistency.ql
@@ -24,6 +24,12 @@ private module ConsistencyChecksInput implements ConsistencyChecksInputSig {
// TODO: when adding support for proper content, handle iterable unpacking better
// such as `for k,v in items:`, or `a, (b,c) = ...`
n instanceof DataFlow::IterableSequenceNode
+ or
+ // We have missing use-use flow in
+ // https://github.com/python/cpython/blob/0fb18b02c8ad56299d6a2910be0bab8ad601ef24/Lib/socketserver.py#L276-L303
+ // which I couldn't just fix. We ignore the problems here, and instead rely on the
+ // test-case added in https://github.com/github/codeql/pull/15841
+ n.getLocation().getFile().getAbsolutePath().matches("%/socketserver.py")
}
}
diff --git a/python/ql/test/library-tests/essa/ssa-compute/CONSISTENCY/TypeTrackingConsistency.expected b/python/ql/test/library-tests/essa/ssa-compute/CONSISTENCY/TypeTrackingConsistency.expected
new file mode 100644
index 00000000000..81d19f3f20d
--- /dev/null
+++ b/python/ql/test/library-tests/essa/ssa-compute/CONSISTENCY/TypeTrackingConsistency.expected
@@ -0,0 +1,6 @@
+unreachableNode
+| test2.py:16:17:16:17 | ControlFlowNode for y | Unreachable node in step of kind load bar. |
+| test2.py:25:23:25:23 | ControlFlowNode for x | Unreachable node in step of kind load attribute. |
+| test2.py:25:23:25:23 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| test2.py:26:17:26:17 | ControlFlowNode for y | Unreachable node in step of kind load bar. |
+| test2.py:27:23:27:23 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
From adf5a4b1e445b4f041625f49d1095c2f0be08bb1 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen
Date: Fri, 8 Mar 2024 14:13:47 +0100
Subject: [PATCH 061/309] Python: Fix internal consistency failures
---
python/ql/consistency-queries/TypeTrackingConsistency.ql | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/python/ql/consistency-queries/TypeTrackingConsistency.ql b/python/ql/consistency-queries/TypeTrackingConsistency.ql
index b937b0c6163..15083229002 100644
--- a/python/ql/consistency-queries/TypeTrackingConsistency.ql
+++ b/python/ql/consistency-queries/TypeTrackingConsistency.ql
@@ -17,7 +17,13 @@ private module ConsistencyChecksInput implements ConsistencyChecksInputSig {
//
// match (NONSOURCE, SOURCE):
// case (x, y): ...
- exists(DataFlow::Node m | m.asCfgNode().getNode() instanceof MatchCapturePattern |
+ exists(DataFlow::Node m |
+ m.asCfgNode().getNode() instanceof MatchCapturePattern
+ or
+ m.asCfgNode().getNode() instanceof MatchAsPattern
+ or
+ m.asCfgNode().getNode() instanceof MatchOrPattern
+ |
TypeTrackingInput::simpleLocalSmallStep*(m, n)
)
or
From dbd33d1cf0d8211779a90bfb7fdc4f7eb4aa9ba7 Mon Sep 17 00:00:00 2001
From: Joe Farebrother
Date: Fri, 8 Mar 2024 14:04:01 +0000
Subject: [PATCH 062/309] Model Argument[1] of ActiveRecord from
---
.../2024-03-08-activerecord-from.md | 4 +
.../codeql/ruby/frameworks/ActiveRecord.qll | 6 +-
.../security/cwe-089/ActiveRecordInjection.rb | 6 +
.../security/cwe-089/SqlInjection.expected | 138 +++++++++---------
4 files changed, 86 insertions(+), 68 deletions(-)
create mode 100644 ruby/ql/lib/change-notes/2024-03-08-activerecord-from.md
diff --git a/ruby/ql/lib/change-notes/2024-03-08-activerecord-from.md b/ruby/ql/lib/change-notes/2024-03-08-activerecord-from.md
new file mode 100644
index 00000000000..704a4f27a61
--- /dev/null
+++ b/ruby/ql/lib/change-notes/2024-03-08-activerecord-from.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The second argument, `subquery_name`, of the `ActiveRecord::QueryMethods::from` method, is now recognized as an sql injection sink.
\ No newline at end of file
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/ActiveRecord.qll b/ruby/ql/lib/codeql/ruby/frameworks/ActiveRecord.qll
index f0917100058..7573e099c19 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/ActiveRecord.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/ActiveRecord.qll
@@ -175,14 +175,14 @@ private predicate sqlFragmentArgumentInner(DataFlow::CallNode call, DataFlow::No
call =
activeRecordQueryBuilderCall([
"delete_all", "delete_by", "destroy_all", "destroy_by", "exists?", "find_by", "find_by!",
- "find_or_create_by", "find_or_create_by!", "find_or_initialize_by", "find_by_sql", "from",
- "having", "lock", "not", "where", "rewhere"
+ "find_or_create_by", "find_or_create_by!", "find_or_initialize_by", "find_by_sql", "having",
+ "lock", "not", "where", "rewhere"
]) and
sink = call.getArgument(0)
or
call =
activeRecordQueryBuilderCall([
- "group", "joins", "order", "reorder", "pluck", "select", "reselect"
+ "from", "group", "joins", "order", "reorder", "pluck", "select", "reselect"
]) and
sink = call.getArgument(_)
or
diff --git a/ruby/ql/test/query-tests/security/cwe-089/ActiveRecordInjection.rb b/ruby/ql/test/query-tests/security/cwe-089/ActiveRecordInjection.rb
index 9a94e48708d..ad074de5e98 100644
--- a/ruby/ql/test/query-tests/security/cwe-089/ActiveRecordInjection.rb
+++ b/ruby/ql/test/query-tests/security/cwe-089/ActiveRecordInjection.rb
@@ -114,6 +114,12 @@ class FooController < ActionController::Base
User.joins(:a, params[:column])
User.count_by_sql(params[:custom_sql_query])
+
+ # BAD: executes `SELECT users.* FROM #{params[:tab]}`
+ # where `params[:tab]` is unsanitized
+ User.all.from(params[:tab])
+ # BAD: executes `SELECT "users".* FROM (SELECT "users".* FROM "users") #{params[:sq]}
+ User.all.from(User.all, params[:sq])
end
end
diff --git a/ruby/ql/test/query-tests/security/cwe-089/SqlInjection.expected b/ruby/ql/test/query-tests/security/cwe-089/SqlInjection.expected
index 9bf4513af07..8b6c5bf4d16 100644
--- a/ruby/ql/test/query-tests/security/cwe-089/SqlInjection.expected
+++ b/ruby/ql/test/query-tests/security/cwe-089/SqlInjection.expected
@@ -46,34 +46,36 @@ edges
| ActiveRecordInjection.rb:113:21:113:26 | call to params | ActiveRecordInjection.rb:113:21:113:35 | ...[...] | provenance | |
| ActiveRecordInjection.rb:114:20:114:25 | call to params | ActiveRecordInjection.rb:114:20:114:34 | ...[...] | provenance | |
| ActiveRecordInjection.rb:116:23:116:28 | call to params | ActiveRecordInjection.rb:116:23:116:47 | ...[...] | provenance | |
-| ActiveRecordInjection.rb:122:5:122:6 | ps | ActiveRecordInjection.rb:123:11:123:12 | ps | provenance | |
-| ActiveRecordInjection.rb:122:10:122:15 | call to params | ActiveRecordInjection.rb:122:5:122:6 | ps | provenance | |
-| ActiveRecordInjection.rb:123:5:123:7 | uid | ActiveRecordInjection.rb:124:5:124:9 | uidEq | provenance | |
-| ActiveRecordInjection.rb:123:11:123:12 | ps | ActiveRecordInjection.rb:123:11:123:17 | ...[...] | provenance | |
-| ActiveRecordInjection.rb:123:11:123:17 | ...[...] | ActiveRecordInjection.rb:123:5:123:7 | uid | provenance | |
-| ActiveRecordInjection.rb:124:5:124:9 | uidEq | ActiveRecordInjection.rb:128:20:128:32 | ... + ... | provenance | |
-| ActiveRecordInjection.rb:124:5:124:9 | uidEq | ActiveRecordInjection.rb:128:28:128:32 | uidEq | provenance | |
-| ActiveRecordInjection.rb:128:20:128:32 | ... + ... [element] | ActiveRecordInjection.rb:128:20:128:32 | ... + ... | provenance | |
-| ActiveRecordInjection.rb:128:28:128:32 | uidEq | ActiveRecordInjection.rb:128:20:128:32 | ... + ... [element] | provenance | |
-| ActiveRecordInjection.rb:161:21:161:26 | call to params | ActiveRecordInjection.rb:161:21:161:44 | ...[...] | provenance | |
-| ActiveRecordInjection.rb:161:21:161:26 | call to params | ActiveRecordInjection.rb:161:21:161:44 | ...[...] | provenance | |
-| ActiveRecordInjection.rb:161:21:161:44 | ...[...] | ActiveRecordInjection.rb:20:22:20:30 | condition | provenance | |
-| ActiveRecordInjection.rb:175:59:175:64 | call to params | ActiveRecordInjection.rb:175:59:175:74 | ...[...] | provenance | |
-| ActiveRecordInjection.rb:175:59:175:74 | ...[...] | ActiveRecordInjection.rb:175:27:175:76 | "this is an unsafe annotation:..." | provenance | |
-| ActiveRecordInjection.rb:186:5:186:13 | my_params | ActiveRecordInjection.rb:187:47:187:55 | my_params | provenance | |
-| ActiveRecordInjection.rb:186:17:186:32 | call to permitted_params | ActiveRecordInjection.rb:186:5:186:13 | my_params | provenance | |
-| ActiveRecordInjection.rb:187:5:187:9 | query | ActiveRecordInjection.rb:188:37:188:41 | query | provenance | |
-| ActiveRecordInjection.rb:187:47:187:55 | my_params | ActiveRecordInjection.rb:187:47:187:65 | ...[...] | provenance | |
-| ActiveRecordInjection.rb:187:47:187:65 | ...[...] | ActiveRecordInjection.rb:187:5:187:9 | query | provenance | |
-| ActiveRecordInjection.rb:193:5:193:10 | call to params | ActiveRecordInjection.rb:193:5:193:27 | call to require | provenance | |
-| ActiveRecordInjection.rb:193:5:193:27 | call to require | ActiveRecordInjection.rb:193:5:193:59 | call to permit | provenance | |
-| ActiveRecordInjection.rb:193:5:193:59 | call to permit | ActiveRecordInjection.rb:186:17:186:32 | call to permitted_params | provenance | |
-| ActiveRecordInjection.rb:193:5:193:59 | call to permit | ActiveRecordInjection.rb:197:77:197:92 | call to permitted_params | provenance | |
-| ActiveRecordInjection.rb:193:5:193:59 | call to permit | ActiveRecordInjection.rb:198:69:198:84 | call to permitted_params | provenance | |
-| ActiveRecordInjection.rb:197:77:197:92 | call to permitted_params | ActiveRecordInjection.rb:197:77:197:102 | ...[...] | provenance | |
-| ActiveRecordInjection.rb:197:77:197:102 | ...[...] | ActiveRecordInjection.rb:197:43:197:104 | "SELECT * FROM users WHERE id ..." | provenance | |
-| ActiveRecordInjection.rb:198:69:198:84 | call to permitted_params | ActiveRecordInjection.rb:198:69:198:94 | ...[...] | provenance | |
-| ActiveRecordInjection.rb:198:69:198:94 | ...[...] | ActiveRecordInjection.rb:198:35:198:96 | "SELECT * FROM users WHERE id ..." | provenance | |
+| ActiveRecordInjection.rb:120:19:120:24 | call to params | ActiveRecordInjection.rb:120:19:120:30 | ...[...] | provenance | |
+| ActiveRecordInjection.rb:122:29:122:34 | call to params | ActiveRecordInjection.rb:122:29:122:39 | ...[...] | provenance | |
+| ActiveRecordInjection.rb:128:5:128:6 | ps | ActiveRecordInjection.rb:129:11:129:12 | ps | provenance | |
+| ActiveRecordInjection.rb:128:10:128:15 | call to params | ActiveRecordInjection.rb:128:5:128:6 | ps | provenance | |
+| ActiveRecordInjection.rb:129:5:129:7 | uid | ActiveRecordInjection.rb:130:5:130:9 | uidEq | provenance | |
+| ActiveRecordInjection.rb:129:11:129:12 | ps | ActiveRecordInjection.rb:129:11:129:17 | ...[...] | provenance | |
+| ActiveRecordInjection.rb:129:11:129:17 | ...[...] | ActiveRecordInjection.rb:129:5:129:7 | uid | provenance | |
+| ActiveRecordInjection.rb:130:5:130:9 | uidEq | ActiveRecordInjection.rb:134:20:134:32 | ... + ... | provenance | |
+| ActiveRecordInjection.rb:130:5:130:9 | uidEq | ActiveRecordInjection.rb:134:28:134:32 | uidEq | provenance | |
+| ActiveRecordInjection.rb:134:20:134:32 | ... + ... [element] | ActiveRecordInjection.rb:134:20:134:32 | ... + ... | provenance | |
+| ActiveRecordInjection.rb:134:28:134:32 | uidEq | ActiveRecordInjection.rb:134:20:134:32 | ... + ... [element] | provenance | |
+| ActiveRecordInjection.rb:167:21:167:26 | call to params | ActiveRecordInjection.rb:167:21:167:44 | ...[...] | provenance | |
+| ActiveRecordInjection.rb:167:21:167:26 | call to params | ActiveRecordInjection.rb:167:21:167:44 | ...[...] | provenance | |
+| ActiveRecordInjection.rb:167:21:167:44 | ...[...] | ActiveRecordInjection.rb:20:22:20:30 | condition | provenance | |
+| ActiveRecordInjection.rb:181:59:181:64 | call to params | ActiveRecordInjection.rb:181:59:181:74 | ...[...] | provenance | |
+| ActiveRecordInjection.rb:181:59:181:74 | ...[...] | ActiveRecordInjection.rb:181:27:181:76 | "this is an unsafe annotation:..." | provenance | |
+| ActiveRecordInjection.rb:192:5:192:13 | my_params | ActiveRecordInjection.rb:193:47:193:55 | my_params | provenance | |
+| ActiveRecordInjection.rb:192:17:192:32 | call to permitted_params | ActiveRecordInjection.rb:192:5:192:13 | my_params | provenance | |
+| ActiveRecordInjection.rb:193:5:193:9 | query | ActiveRecordInjection.rb:194:37:194:41 | query | provenance | |
+| ActiveRecordInjection.rb:193:47:193:55 | my_params | ActiveRecordInjection.rb:193:47:193:65 | ...[...] | provenance | |
+| ActiveRecordInjection.rb:193:47:193:65 | ...[...] | ActiveRecordInjection.rb:193:5:193:9 | query | provenance | |
+| ActiveRecordInjection.rb:199:5:199:10 | call to params | ActiveRecordInjection.rb:199:5:199:27 | call to require | provenance | |
+| ActiveRecordInjection.rb:199:5:199:27 | call to require | ActiveRecordInjection.rb:199:5:199:59 | call to permit | provenance | |
+| ActiveRecordInjection.rb:199:5:199:59 | call to permit | ActiveRecordInjection.rb:192:17:192:32 | call to permitted_params | provenance | |
+| ActiveRecordInjection.rb:199:5:199:59 | call to permit | ActiveRecordInjection.rb:203:77:203:92 | call to permitted_params | provenance | |
+| ActiveRecordInjection.rb:199:5:199:59 | call to permit | ActiveRecordInjection.rb:204:69:204:84 | call to permitted_params | provenance | |
+| ActiveRecordInjection.rb:203:77:203:92 | call to permitted_params | ActiveRecordInjection.rb:203:77:203:102 | ...[...] | provenance | |
+| ActiveRecordInjection.rb:203:77:203:102 | ...[...] | ActiveRecordInjection.rb:203:43:203:104 | "SELECT * FROM users WHERE id ..." | provenance | |
+| ActiveRecordInjection.rb:204:69:204:84 | call to permitted_params | ActiveRecordInjection.rb:204:69:204:94 | ...[...] | provenance | |
+| ActiveRecordInjection.rb:204:69:204:94 | ...[...] | ActiveRecordInjection.rb:204:35:204:96 | "SELECT * FROM users WHERE id ..." | provenance | |
| ArelInjection.rb:4:5:4:8 | name | ArelInjection.rb:6:20:6:61 | "SELECT * FROM users WHERE nam..." | provenance | |
| ArelInjection.rb:4:5:4:8 | name | ArelInjection.rb:7:39:7:80 | "SELECT * FROM users WHERE nam..." | provenance | |
| ArelInjection.rb:4:12:4:17 | call to params | ArelInjection.rb:4:12:4:29 | ...[...] | provenance | |
@@ -165,36 +167,40 @@ nodes
| ActiveRecordInjection.rb:114:20:114:34 | ...[...] | semmle.label | ...[...] |
| ActiveRecordInjection.rb:116:23:116:28 | call to params | semmle.label | call to params |
| ActiveRecordInjection.rb:116:23:116:47 | ...[...] | semmle.label | ...[...] |
-| ActiveRecordInjection.rb:122:5:122:6 | ps | semmle.label | ps |
-| ActiveRecordInjection.rb:122:10:122:15 | call to params | semmle.label | call to params |
-| ActiveRecordInjection.rb:123:5:123:7 | uid | semmle.label | uid |
-| ActiveRecordInjection.rb:123:11:123:12 | ps | semmle.label | ps |
-| ActiveRecordInjection.rb:123:11:123:17 | ...[...] | semmle.label | ...[...] |
-| ActiveRecordInjection.rb:124:5:124:9 | uidEq | semmle.label | uidEq |
-| ActiveRecordInjection.rb:128:20:128:32 | ... + ... | semmle.label | ... + ... |
-| ActiveRecordInjection.rb:128:20:128:32 | ... + ... [element] | semmle.label | ... + ... [element] |
-| ActiveRecordInjection.rb:128:28:128:32 | uidEq | semmle.label | uidEq |
-| ActiveRecordInjection.rb:161:21:161:26 | call to params | semmle.label | call to params |
-| ActiveRecordInjection.rb:161:21:161:44 | ...[...] | semmle.label | ...[...] |
-| ActiveRecordInjection.rb:161:21:161:44 | ...[...] | semmle.label | ...[...] |
-| ActiveRecordInjection.rb:175:27:175:76 | "this is an unsafe annotation:..." | semmle.label | "this is an unsafe annotation:..." |
-| ActiveRecordInjection.rb:175:59:175:64 | call to params | semmle.label | call to params |
-| ActiveRecordInjection.rb:175:59:175:74 | ...[...] | semmle.label | ...[...] |
-| ActiveRecordInjection.rb:186:5:186:13 | my_params | semmle.label | my_params |
-| ActiveRecordInjection.rb:186:17:186:32 | call to permitted_params | semmle.label | call to permitted_params |
-| ActiveRecordInjection.rb:187:5:187:9 | query | semmle.label | query |
-| ActiveRecordInjection.rb:187:47:187:55 | my_params | semmle.label | my_params |
-| ActiveRecordInjection.rb:187:47:187:65 | ...[...] | semmle.label | ...[...] |
-| ActiveRecordInjection.rb:188:37:188:41 | query | semmle.label | query |
-| ActiveRecordInjection.rb:193:5:193:10 | call to params | semmle.label | call to params |
-| ActiveRecordInjection.rb:193:5:193:27 | call to require | semmle.label | call to require |
-| ActiveRecordInjection.rb:193:5:193:59 | call to permit | semmle.label | call to permit |
-| ActiveRecordInjection.rb:197:43:197:104 | "SELECT * FROM users WHERE id ..." | semmle.label | "SELECT * FROM users WHERE id ..." |
-| ActiveRecordInjection.rb:197:77:197:92 | call to permitted_params | semmle.label | call to permitted_params |
-| ActiveRecordInjection.rb:197:77:197:102 | ...[...] | semmle.label | ...[...] |
-| ActiveRecordInjection.rb:198:35:198:96 | "SELECT * FROM users WHERE id ..." | semmle.label | "SELECT * FROM users WHERE id ..." |
-| ActiveRecordInjection.rb:198:69:198:84 | call to permitted_params | semmle.label | call to permitted_params |
-| ActiveRecordInjection.rb:198:69:198:94 | ...[...] | semmle.label | ...[...] |
+| ActiveRecordInjection.rb:120:19:120:24 | call to params | semmle.label | call to params |
+| ActiveRecordInjection.rb:120:19:120:30 | ...[...] | semmle.label | ...[...] |
+| ActiveRecordInjection.rb:122:29:122:34 | call to params | semmle.label | call to params |
+| ActiveRecordInjection.rb:122:29:122:39 | ...[...] | semmle.label | ...[...] |
+| ActiveRecordInjection.rb:128:5:128:6 | ps | semmle.label | ps |
+| ActiveRecordInjection.rb:128:10:128:15 | call to params | semmle.label | call to params |
+| ActiveRecordInjection.rb:129:5:129:7 | uid | semmle.label | uid |
+| ActiveRecordInjection.rb:129:11:129:12 | ps | semmle.label | ps |
+| ActiveRecordInjection.rb:129:11:129:17 | ...[...] | semmle.label | ...[...] |
+| ActiveRecordInjection.rb:130:5:130:9 | uidEq | semmle.label | uidEq |
+| ActiveRecordInjection.rb:134:20:134:32 | ... + ... | semmle.label | ... + ... |
+| ActiveRecordInjection.rb:134:20:134:32 | ... + ... [element] | semmle.label | ... + ... [element] |
+| ActiveRecordInjection.rb:134:28:134:32 | uidEq | semmle.label | uidEq |
+| ActiveRecordInjection.rb:167:21:167:26 | call to params | semmle.label | call to params |
+| ActiveRecordInjection.rb:167:21:167:44 | ...[...] | semmle.label | ...[...] |
+| ActiveRecordInjection.rb:167:21:167:44 | ...[...] | semmle.label | ...[...] |
+| ActiveRecordInjection.rb:181:27:181:76 | "this is an unsafe annotation:..." | semmle.label | "this is an unsafe annotation:..." |
+| ActiveRecordInjection.rb:181:59:181:64 | call to params | semmle.label | call to params |
+| ActiveRecordInjection.rb:181:59:181:74 | ...[...] | semmle.label | ...[...] |
+| ActiveRecordInjection.rb:192:5:192:13 | my_params | semmle.label | my_params |
+| ActiveRecordInjection.rb:192:17:192:32 | call to permitted_params | semmle.label | call to permitted_params |
+| ActiveRecordInjection.rb:193:5:193:9 | query | semmle.label | query |
+| ActiveRecordInjection.rb:193:47:193:55 | my_params | semmle.label | my_params |
+| ActiveRecordInjection.rb:193:47:193:65 | ...[...] | semmle.label | ...[...] |
+| ActiveRecordInjection.rb:194:37:194:41 | query | semmle.label | query |
+| ActiveRecordInjection.rb:199:5:199:10 | call to params | semmle.label | call to params |
+| ActiveRecordInjection.rb:199:5:199:27 | call to require | semmle.label | call to require |
+| ActiveRecordInjection.rb:199:5:199:59 | call to permit | semmle.label | call to permit |
+| ActiveRecordInjection.rb:203:43:203:104 | "SELECT * FROM users WHERE id ..." | semmle.label | "SELECT * FROM users WHERE id ..." |
+| ActiveRecordInjection.rb:203:77:203:92 | call to permitted_params | semmle.label | call to permitted_params |
+| ActiveRecordInjection.rb:203:77:203:102 | ...[...] | semmle.label | ...[...] |
+| ActiveRecordInjection.rb:204:35:204:96 | "SELECT * FROM users WHERE id ..." | semmle.label | "SELECT * FROM users WHERE id ..." |
+| ActiveRecordInjection.rb:204:69:204:84 | call to permitted_params | semmle.label | call to permitted_params |
+| ActiveRecordInjection.rb:204:69:204:94 | ...[...] | semmle.label | ...[...] |
| ArelInjection.rb:4:5:4:8 | name | semmle.label | name |
| ArelInjection.rb:4:12:4:17 | call to params | semmle.label | call to params |
| ArelInjection.rb:4:12:4:29 | ...[...] | semmle.label | ...[...] |
@@ -217,7 +223,7 @@ subpaths
#select
| ActiveRecordInjection.rb:10:33:10:67 | "name='#{...}' and pass='#{...}'" | ActiveRecordInjection.rb:70:23:70:28 | call to params | ActiveRecordInjection.rb:10:33:10:67 | "name='#{...}' and pass='#{...}'" | This SQL query depends on a $@. | ActiveRecordInjection.rb:70:23:70:28 | call to params | user-provided value |
| ActiveRecordInjection.rb:10:33:10:67 | "name='#{...}' and pass='#{...}'" | ActiveRecordInjection.rb:70:38:70:43 | call to params | ActiveRecordInjection.rb:10:33:10:67 | "name='#{...}' and pass='#{...}'" | This SQL query depends on a $@. | ActiveRecordInjection.rb:70:38:70:43 | call to params | user-provided value |
-| ActiveRecordInjection.rb:23:16:23:24 | condition | ActiveRecordInjection.rb:161:21:161:26 | call to params | ActiveRecordInjection.rb:23:16:23:24 | condition | This SQL query depends on a $@. | ActiveRecordInjection.rb:161:21:161:26 | call to params | user-provided value |
+| ActiveRecordInjection.rb:23:16:23:24 | condition | ActiveRecordInjection.rb:167:21:167:26 | call to params | ActiveRecordInjection.rb:23:16:23:24 | condition | This SQL query depends on a $@. | ActiveRecordInjection.rb:167:21:167:26 | call to params | user-provided value |
| ActiveRecordInjection.rb:35:30:35:44 | ...[...] | ActiveRecordInjection.rb:35:30:35:35 | call to params | ActiveRecordInjection.rb:35:30:35:44 | ...[...] | This SQL query depends on a $@. | ActiveRecordInjection.rb:35:30:35:35 | call to params | user-provided value |
| ActiveRecordInjection.rb:39:18:39:32 | ...[...] | ActiveRecordInjection.rb:39:18:39:23 | call to params | ActiveRecordInjection.rb:39:18:39:32 | ...[...] | This SQL query depends on a $@. | ActiveRecordInjection.rb:39:18:39:23 | call to params | user-provided value |
| ActiveRecordInjection.rb:43:20:43:42 | "id = '#{...}'" | ActiveRecordInjection.rb:43:29:43:34 | call to params | ActiveRecordInjection.rb:43:20:43:42 | "id = '#{...}'" | This SQL query depends on a $@. | ActiveRecordInjection.rb:43:29:43:34 | call to params | user-provided value |
@@ -243,12 +249,14 @@ subpaths
| ActiveRecordInjection.rb:113:21:113:35 | ...[...] | ActiveRecordInjection.rb:113:21:113:26 | call to params | ActiveRecordInjection.rb:113:21:113:35 | ...[...] | This SQL query depends on a $@. | ActiveRecordInjection.rb:113:21:113:26 | call to params | user-provided value |
| ActiveRecordInjection.rb:114:20:114:34 | ...[...] | ActiveRecordInjection.rb:114:20:114:25 | call to params | ActiveRecordInjection.rb:114:20:114:34 | ...[...] | This SQL query depends on a $@. | ActiveRecordInjection.rb:114:20:114:25 | call to params | user-provided value |
| ActiveRecordInjection.rb:116:23:116:47 | ...[...] | ActiveRecordInjection.rb:116:23:116:28 | call to params | ActiveRecordInjection.rb:116:23:116:47 | ...[...] | This SQL query depends on a $@. | ActiveRecordInjection.rb:116:23:116:28 | call to params | user-provided value |
-| ActiveRecordInjection.rb:128:20:128:32 | ... + ... | ActiveRecordInjection.rb:122:10:122:15 | call to params | ActiveRecordInjection.rb:128:20:128:32 | ... + ... | This SQL query depends on a $@. | ActiveRecordInjection.rb:122:10:122:15 | call to params | user-provided value |
-| ActiveRecordInjection.rb:161:21:161:44 | ...[...] | ActiveRecordInjection.rb:161:21:161:26 | call to params | ActiveRecordInjection.rb:161:21:161:44 | ...[...] | This SQL query depends on a $@. | ActiveRecordInjection.rb:161:21:161:26 | call to params | user-provided value |
-| ActiveRecordInjection.rb:175:27:175:76 | "this is an unsafe annotation:..." | ActiveRecordInjection.rb:175:59:175:64 | call to params | ActiveRecordInjection.rb:175:27:175:76 | "this is an unsafe annotation:..." | This SQL query depends on a $@. | ActiveRecordInjection.rb:175:59:175:64 | call to params | user-provided value |
-| ActiveRecordInjection.rb:188:37:188:41 | query | ActiveRecordInjection.rb:193:5:193:10 | call to params | ActiveRecordInjection.rb:188:37:188:41 | query | This SQL query depends on a $@. | ActiveRecordInjection.rb:193:5:193:10 | call to params | user-provided value |
-| ActiveRecordInjection.rb:197:43:197:104 | "SELECT * FROM users WHERE id ..." | ActiveRecordInjection.rb:193:5:193:10 | call to params | ActiveRecordInjection.rb:197:43:197:104 | "SELECT * FROM users WHERE id ..." | This SQL query depends on a $@. | ActiveRecordInjection.rb:193:5:193:10 | call to params | user-provided value |
-| ActiveRecordInjection.rb:198:35:198:96 | "SELECT * FROM users WHERE id ..." | ActiveRecordInjection.rb:193:5:193:10 | call to params | ActiveRecordInjection.rb:198:35:198:96 | "SELECT * FROM users WHERE id ..." | This SQL query depends on a $@. | ActiveRecordInjection.rb:193:5:193:10 | call to params | user-provided value |
+| ActiveRecordInjection.rb:120:19:120:30 | ...[...] | ActiveRecordInjection.rb:120:19:120:24 | call to params | ActiveRecordInjection.rb:120:19:120:30 | ...[...] | This SQL query depends on a $@. | ActiveRecordInjection.rb:120:19:120:24 | call to params | user-provided value |
+| ActiveRecordInjection.rb:122:29:122:39 | ...[...] | ActiveRecordInjection.rb:122:29:122:34 | call to params | ActiveRecordInjection.rb:122:29:122:39 | ...[...] | This SQL query depends on a $@. | ActiveRecordInjection.rb:122:29:122:34 | call to params | user-provided value |
+| ActiveRecordInjection.rb:134:20:134:32 | ... + ... | ActiveRecordInjection.rb:128:10:128:15 | call to params | ActiveRecordInjection.rb:134:20:134:32 | ... + ... | This SQL query depends on a $@. | ActiveRecordInjection.rb:128:10:128:15 | call to params | user-provided value |
+| ActiveRecordInjection.rb:167:21:167:44 | ...[...] | ActiveRecordInjection.rb:167:21:167:26 | call to params | ActiveRecordInjection.rb:167:21:167:44 | ...[...] | This SQL query depends on a $@. | ActiveRecordInjection.rb:167:21:167:26 | call to params | user-provided value |
+| ActiveRecordInjection.rb:181:27:181:76 | "this is an unsafe annotation:..." | ActiveRecordInjection.rb:181:59:181:64 | call to params | ActiveRecordInjection.rb:181:27:181:76 | "this is an unsafe annotation:..." | This SQL query depends on a $@. | ActiveRecordInjection.rb:181:59:181:64 | call to params | user-provided value |
+| ActiveRecordInjection.rb:194:37:194:41 | query | ActiveRecordInjection.rb:199:5:199:10 | call to params | ActiveRecordInjection.rb:194:37:194:41 | query | This SQL query depends on a $@. | ActiveRecordInjection.rb:199:5:199:10 | call to params | user-provided value |
+| ActiveRecordInjection.rb:203:43:203:104 | "SELECT * FROM users WHERE id ..." | ActiveRecordInjection.rb:199:5:199:10 | call to params | ActiveRecordInjection.rb:203:43:203:104 | "SELECT * FROM users WHERE id ..." | This SQL query depends on a $@. | ActiveRecordInjection.rb:199:5:199:10 | call to params | user-provided value |
+| ActiveRecordInjection.rb:204:35:204:96 | "SELECT * FROM users WHERE id ..." | ActiveRecordInjection.rb:199:5:199:10 | call to params | ActiveRecordInjection.rb:204:35:204:96 | "SELECT * FROM users WHERE id ..." | This SQL query depends on a $@. | ActiveRecordInjection.rb:199:5:199:10 | call to params | user-provided value |
| ArelInjection.rb:6:20:6:61 | "SELECT * FROM users WHERE nam..." | ArelInjection.rb:4:12:4:17 | call to params | ArelInjection.rb:6:20:6:61 | "SELECT * FROM users WHERE nam..." | This SQL query depends on a $@. | ArelInjection.rb:4:12:4:17 | call to params | user-provided value |
| ArelInjection.rb:7:39:7:80 | "SELECT * FROM users WHERE nam..." | ArelInjection.rb:4:12:4:17 | call to params | ArelInjection.rb:7:39:7:80 | "SELECT * FROM users WHERE nam..." | This SQL query depends on a $@. | ArelInjection.rb:4:12:4:17 | call to params | user-provided value |
| PgInjection.rb:14:15:14:18 | qry1 | PgInjection.rb:6:12:6:17 | call to params | PgInjection.rb:14:15:14:18 | qry1 | This SQL query depends on a $@. | PgInjection.rb:6:12:6:17 | call to params | user-provided value |
From a09eb9f4c570184a8d899529bb558c5ef89cb888 Mon Sep 17 00:00:00 2001
From: Tony Torralba
Date: Mon, 11 Mar 2024 08:58:59 +0100
Subject: [PATCH 063/309] Update
go/ql/src/Security/CWE-770/UncontrolledAllocationSize.ql
Co-authored-by: Ben Ahmady <32935794+subatoi@users.noreply.github.com>
---
go/ql/src/Security/CWE-770/UncontrolledAllocationSize.ql | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/go/ql/src/Security/CWE-770/UncontrolledAllocationSize.ql b/go/ql/src/Security/CWE-770/UncontrolledAllocationSize.ql
index 2be09c6901b..c6d2091cc53 100644
--- a/go/ql/src/Security/CWE-770/UncontrolledAllocationSize.ql
+++ b/go/ql/src/Security/CWE-770/UncontrolledAllocationSize.ql
@@ -1,7 +1,6 @@
/**
* @name Slice memory allocation with excessive size value
- * @description Allocating memory for slices with the built-in make function from user-controlled sources
- * can lead to a denial of service.
+ * @description Allocating memory for slices with the built-in make function from user-controlled sources can lead to a denial of service.
* @kind path-problem
* @problem.severity warning
* @security-severity 6.0
From 7a39f077d9531d48e121659e2cade47488896d50 Mon Sep 17 00:00:00 2001
From: Tom Hvitved
Date: Mon, 11 Mar 2024 11:58:20 +0100
Subject: [PATCH 064/309] Data flow: Add `ConfigSig::accessPathLimit`
---
.../dataflow/internal/ContentDataFlow.qll | 2 ++
.../modelgenerator/internal/CaptureModels.qll | 6 +++---
.../modelgenerator/internal/CaptureModels.qll | 6 +++---
.../ruby/dataflow/internal/DataFlowImpl1.qll | 2 ++
shared/dataflow/codeql/dataflow/DataFlow.qll | 10 ++++++++++
.../codeql/dataflow/internal/DataFlowImpl.qll | 19 ++++++++++++++++---
6 files changed, 36 insertions(+), 9 deletions(-)
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ContentDataFlow.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ContentDataFlow.qll
index e9cd7373975..76936549051 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ContentDataFlow.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ContentDataFlow.qll
@@ -109,6 +109,8 @@ module Global {
DataFlow::FlowFeature getAFeature() { result = ContentConfig::getAFeature() }
+ predicate accessPathLimit = ContentConfig::accessPathLimit/0;
+
// needed to record reads/stores inside summarized callables
predicate includeHiddenNodes() { any() }
}
diff --git a/csharp/ql/src/utils/modelgenerator/internal/CaptureModels.qll b/csharp/ql/src/utils/modelgenerator/internal/CaptureModels.qll
index 9c19e5b9cbb..0a22178d108 100644
--- a/csharp/ql/src/utils/modelgenerator/internal/CaptureModels.qll
+++ b/csharp/ql/src/utils/modelgenerator/internal/CaptureModels.qll
@@ -72,11 +72,11 @@ string captureQualifierFlow(TargetApiSpecific api) {
result = ModelPrinting::asValueModel(api, qualifierString(), "ReturnValue")
}
-private int accessPathLimit() { result = 2 }
+private int accessPathLimit0() { result = 2 }
private newtype TTaintState =
- TTaintRead(int n) { n in [0 .. accessPathLimit()] } or
- TTaintStore(int n) { n in [1 .. accessPathLimit()] }
+ TTaintRead(int n) { n in [0 .. accessPathLimit0()] } or
+ TTaintStore(int n) { n in [1 .. accessPathLimit0()] }
abstract private class TaintState extends TTaintState {
abstract string toString();
diff --git a/java/ql/src/utils/modelgenerator/internal/CaptureModels.qll b/java/ql/src/utils/modelgenerator/internal/CaptureModels.qll
index 9c19e5b9cbb..0a22178d108 100644
--- a/java/ql/src/utils/modelgenerator/internal/CaptureModels.qll
+++ b/java/ql/src/utils/modelgenerator/internal/CaptureModels.qll
@@ -72,11 +72,11 @@ string captureQualifierFlow(TargetApiSpecific api) {
result = ModelPrinting::asValueModel(api, qualifierString(), "ReturnValue")
}
-private int accessPathLimit() { result = 2 }
+private int accessPathLimit0() { result = 2 }
private newtype TTaintState =
- TTaintRead(int n) { n in [0 .. accessPathLimit()] } or
- TTaintStore(int n) { n in [1 .. accessPathLimit()] }
+ TTaintRead(int n) { n in [0 .. accessPathLimit0()] } or
+ TTaintStore(int n) { n in [1 .. accessPathLimit0()] }
abstract private class TaintState extends TTaintState {
abstract string toString();
diff --git a/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl1.qll b/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl1.qll
index 2bbc565daa6..9b92f961e6f 100644
--- a/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl1.qll
+++ b/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl1.qll
@@ -285,6 +285,8 @@ deprecated private module Config implements FullStateConfigSig {
int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
+ int accessPathLimit() { result = 5 }
+
FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
predicate sourceGrouping(Node source, string sourceGroup) {
diff --git a/shared/dataflow/codeql/dataflow/DataFlow.qll b/shared/dataflow/codeql/dataflow/DataFlow.qll
index 6a18c166613..6b14d3d2e06 100644
--- a/shared/dataflow/codeql/dataflow/DataFlow.qll
+++ b/shared/dataflow/codeql/dataflow/DataFlow.qll
@@ -376,6 +376,9 @@ module Configs {
*/
default int fieldFlowBranchLimit() { result = 2 }
+ /** Gets the access path limit. */
+ default int accessPathLimit() { result = Lang::accessPathLimit() }
+
/**
* Gets a data flow configuration feature to add restrictions to the set of
* valid flow paths.
@@ -495,6 +498,9 @@ module Configs {
*/
default int fieldFlowBranchLimit() { result = 2 }
+ /** Gets the access path limit. */
+ default int accessPathLimit() { result = Lang::accessPathLimit() }
+
/**
* Gets a data flow configuration feature to add restrictions to the set of
* valid flow paths.
@@ -583,6 +589,8 @@ module DataFlowMake {
private module C implements FullStateConfigSig {
import DefaultState
import Config
+
+ predicate accessPathLimit = Config::accessPathLimit/0;
}
import Impl
@@ -599,6 +607,8 @@ module DataFlowMake {
module GlobalWithState implements GlobalFlowSig {
private module C implements FullStateConfigSig {
import Config
+
+ predicate accessPathLimit = Config::accessPathLimit/0;
}
import Impl
diff --git a/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll b/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll
index d555b281710..2b43cbdd474 100644
--- a/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll
+++ b/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll
@@ -93,6 +93,9 @@ module MakeImpl {
*/
int fieldFlowBranchLimit();
+ /** Gets the access path limit. */
+ int accessPathLimit();
+
/**
* Gets a data flow configuration feature to add restrictions to the set of
* valid flow paths.
@@ -1328,6 +1331,13 @@ module MakeImpl {
fwdFlow1(_, _, _, _, _, _, t0, t, ap, _) and t0 != t
}
+ bindingset[c, t, tail]
+ additional Ap apCons(Content c, Typ t, Ap tail) {
+ result = Param::apCons(c, t, tail) and
+ Config::accessPathLimit() > 0 and
+ if tail instanceof ApNil then any() else Config::accessPathLimit() > 1
+ }
+
pragma[nomagic]
private predicate fwdFlow0(
NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, TypOption argT,
@@ -3026,11 +3036,11 @@ module MakeImpl {
} or
TConsCons(Content c1, DataFlowType t, Content c2, int len) {
Stage4::consCand(c1, t, TFrontHead(c2)) and
- len in [2 .. accessPathLimit()] and
+ len in [2 .. Config::accessPathLimit()] and
not expensiveLen2unfolding(c1)
} or
TCons1(Content c, int len) {
- len in [1 .. accessPathLimit()] and
+ len in [1 .. Config::accessPathLimit()] and
expensiveLen2unfolding(c)
}
@@ -3189,7 +3199,10 @@ module MakeImpl {
Typ getTyp(DataFlowType t) { result = t }
bindingset[c, t, tail]
- Ap apCons(Content c, Typ t, Ap tail) { result.isCons(c, t, tail) }
+ Ap apCons(Content c, Typ t, Ap tail) {
+ result.isCons(c, t, tail) and
+ Config::accessPathLimit() > tail.len()
+ }
class ApHeadContent = Content;
From da66281fef261b93c2ca667d5c4a66effc53cbaf Mon Sep 17 00:00:00 2001
From: Tom Hvitved
Date: Mon, 11 Mar 2024 11:59:15 +0100
Subject: [PATCH 065/309] Sync files
---
cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl1.qll | 2 ++
cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll | 2 ++
cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll | 2 ++
cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll | 2 ++
.../lib/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll | 2 ++
.../lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl1.qll | 2 ++
.../lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll | 2 ++
.../lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll | 2 ++
.../lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll | 2 ++
.../lib/semmle/code/csharp/dataflow/internal/DataFlowImpl1.qll | 2 ++
.../lib/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll | 2 ++
.../lib/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll | 2 ++
.../lib/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll | 2 ++
.../lib/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll | 2 ++
go/ql/lib/semmle/go/dataflow/internal/DataFlowImpl1.qll | 2 ++
go/ql/lib/semmle/go/dataflow/internal/DataFlowImpl2.qll | 2 ++
.../ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl1.qll | 2 ++
.../ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl2.qll | 2 ++
.../ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl3.qll | 2 ++
.../ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl4.qll | 2 ++
.../ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl5.qll | 2 ++
.../ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl6.qll | 2 ++
.../lib/semmle/python/dataflow/new/internal/DataFlowImpl1.qll | 2 ++
.../lib/semmle/python/dataflow/new/internal/DataFlowImpl2.qll | 2 ++
.../lib/semmle/python/dataflow/new/internal/DataFlowImpl3.qll | 2 ++
.../lib/semmle/python/dataflow/new/internal/DataFlowImpl4.qll | 2 ++
ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl2.qll | 2 ++
swift/ql/lib/codeql/swift/dataflow/internal/DataFlowImpl1.qll | 2 ++
28 files changed, 56 insertions(+)
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl1.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl1.qll
index 2bbc565daa6..9b92f961e6f 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl1.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl1.qll
@@ -285,6 +285,8 @@ deprecated private module Config implements FullStateConfigSig {
int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
+ int accessPathLimit() { result = 5 }
+
FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
predicate sourceGrouping(Node source, string sourceGroup) {
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll
index 2bbc565daa6..9b92f961e6f 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll
@@ -285,6 +285,8 @@ deprecated private module Config implements FullStateConfigSig {
int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
+ int accessPathLimit() { result = 5 }
+
FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
predicate sourceGrouping(Node source, string sourceGroup) {
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll
index 2bbc565daa6..9b92f961e6f 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll
@@ -285,6 +285,8 @@ deprecated private module Config implements FullStateConfigSig {
int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
+ int accessPathLimit() { result = 5 }
+
FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
predicate sourceGrouping(Node source, string sourceGroup) {
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll
index 2bbc565daa6..9b92f961e6f 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll
@@ -285,6 +285,8 @@ deprecated private module Config implements FullStateConfigSig {
int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
+ int accessPathLimit() { result = 5 }
+
FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
predicate sourceGrouping(Node source, string sourceGroup) {
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll
index 2bbc565daa6..9b92f961e6f 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll
@@ -285,6 +285,8 @@ deprecated private module Config implements FullStateConfigSig {
int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
+ int accessPathLimit() { result = 5 }
+
FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
predicate sourceGrouping(Node source, string sourceGroup) {
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl1.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl1.qll
index 2bbc565daa6..9b92f961e6f 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl1.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl1.qll
@@ -285,6 +285,8 @@ deprecated private module Config implements FullStateConfigSig {
int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
+ int accessPathLimit() { result = 5 }
+
FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
predicate sourceGrouping(Node source, string sourceGroup) {
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll
index 2bbc565daa6..9b92f961e6f 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll
@@ -285,6 +285,8 @@ deprecated private module Config implements FullStateConfigSig {
int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
+ int accessPathLimit() { result = 5 }
+
FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
predicate sourceGrouping(Node source, string sourceGroup) {
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll
index 2bbc565daa6..9b92f961e6f 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll
@@ -285,6 +285,8 @@ deprecated private module Config implements FullStateConfigSig {
int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
+ int accessPathLimit() { result = 5 }
+
FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
predicate sourceGrouping(Node source, string sourceGroup) {
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll
index 2bbc565daa6..9b92f961e6f 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll
@@ -285,6 +285,8 @@ deprecated private module Config implements FullStateConfigSig {
int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
+ int accessPathLimit() { result = 5 }
+
FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
predicate sourceGrouping(Node source, string sourceGroup) {
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl1.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl1.qll
index 2bbc565daa6..9b92f961e6f 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl1.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl1.qll
@@ -285,6 +285,8 @@ deprecated private module Config implements FullStateConfigSig {
int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
+ int accessPathLimit() { result = 5 }
+
FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
predicate sourceGrouping(Node source, string sourceGroup) {
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll
index 2bbc565daa6..9b92f961e6f 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll
@@ -285,6 +285,8 @@ deprecated private module Config implements FullStateConfigSig {
int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
+ int accessPathLimit() { result = 5 }
+
FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
predicate sourceGrouping(Node source, string sourceGroup) {
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll
index 2bbc565daa6..9b92f961e6f 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll
@@ -285,6 +285,8 @@ deprecated private module Config implements FullStateConfigSig {
int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
+ int accessPathLimit() { result = 5 }
+
FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
predicate sourceGrouping(Node source, string sourceGroup) {
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll
index 2bbc565daa6..9b92f961e6f 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll
@@ -285,6 +285,8 @@ deprecated private module Config implements FullStateConfigSig {
int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
+ int accessPathLimit() { result = 5 }
+
FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
predicate sourceGrouping(Node source, string sourceGroup) {
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll
index 2bbc565daa6..9b92f961e6f 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll
@@ -285,6 +285,8 @@ deprecated private module Config implements FullStateConfigSig {
int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
+ int accessPathLimit() { result = 5 }
+
FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
predicate sourceGrouping(Node source, string sourceGroup) {
diff --git a/go/ql/lib/semmle/go/dataflow/internal/DataFlowImpl1.qll b/go/ql/lib/semmle/go/dataflow/internal/DataFlowImpl1.qll
index 2bbc565daa6..9b92f961e6f 100644
--- a/go/ql/lib/semmle/go/dataflow/internal/DataFlowImpl1.qll
+++ b/go/ql/lib/semmle/go/dataflow/internal/DataFlowImpl1.qll
@@ -285,6 +285,8 @@ deprecated private module Config implements FullStateConfigSig {
int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
+ int accessPathLimit() { result = 5 }
+
FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
predicate sourceGrouping(Node source, string sourceGroup) {
diff --git a/go/ql/lib/semmle/go/dataflow/internal/DataFlowImpl2.qll b/go/ql/lib/semmle/go/dataflow/internal/DataFlowImpl2.qll
index 2bbc565daa6..9b92f961e6f 100644
--- a/go/ql/lib/semmle/go/dataflow/internal/DataFlowImpl2.qll
+++ b/go/ql/lib/semmle/go/dataflow/internal/DataFlowImpl2.qll
@@ -285,6 +285,8 @@ deprecated private module Config implements FullStateConfigSig {
int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
+ int accessPathLimit() { result = 5 }
+
FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
predicate sourceGrouping(Node source, string sourceGroup) {
diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl1.qll b/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl1.qll
index 2bbc565daa6..9b92f961e6f 100644
--- a/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl1.qll
+++ b/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl1.qll
@@ -285,6 +285,8 @@ deprecated private module Config implements FullStateConfigSig {
int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
+ int accessPathLimit() { result = 5 }
+
FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
predicate sourceGrouping(Node source, string sourceGroup) {
diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl2.qll b/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl2.qll
index 2bbc565daa6..9b92f961e6f 100644
--- a/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl2.qll
+++ b/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl2.qll
@@ -285,6 +285,8 @@ deprecated private module Config implements FullStateConfigSig {
int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
+ int accessPathLimit() { result = 5 }
+
FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
predicate sourceGrouping(Node source, string sourceGroup) {
diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl3.qll b/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl3.qll
index 2bbc565daa6..9b92f961e6f 100644
--- a/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl3.qll
+++ b/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl3.qll
@@ -285,6 +285,8 @@ deprecated private module Config implements FullStateConfigSig {
int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
+ int accessPathLimit() { result = 5 }
+
FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
predicate sourceGrouping(Node source, string sourceGroup) {
diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl4.qll b/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl4.qll
index 2bbc565daa6..9b92f961e6f 100644
--- a/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl4.qll
+++ b/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl4.qll
@@ -285,6 +285,8 @@ deprecated private module Config implements FullStateConfigSig {
int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
+ int accessPathLimit() { result = 5 }
+
FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
predicate sourceGrouping(Node source, string sourceGroup) {
diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl5.qll b/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl5.qll
index 2bbc565daa6..9b92f961e6f 100644
--- a/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl5.qll
+++ b/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl5.qll
@@ -285,6 +285,8 @@ deprecated private module Config implements FullStateConfigSig {
int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
+ int accessPathLimit() { result = 5 }
+
FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
predicate sourceGrouping(Node source, string sourceGroup) {
diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl6.qll b/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl6.qll
index 2bbc565daa6..9b92f961e6f 100644
--- a/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl6.qll
+++ b/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl6.qll
@@ -285,6 +285,8 @@ deprecated private module Config implements FullStateConfigSig {
int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
+ int accessPathLimit() { result = 5 }
+
FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
predicate sourceGrouping(Node source, string sourceGroup) {
diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl1.qll b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl1.qll
index 2bbc565daa6..9b92f961e6f 100644
--- a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl1.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl1.qll
@@ -285,6 +285,8 @@ deprecated private module Config implements FullStateConfigSig {
int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
+ int accessPathLimit() { result = 5 }
+
FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
predicate sourceGrouping(Node source, string sourceGroup) {
diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl2.qll b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl2.qll
index 2bbc565daa6..9b92f961e6f 100644
--- a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl2.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl2.qll
@@ -285,6 +285,8 @@ deprecated private module Config implements FullStateConfigSig {
int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
+ int accessPathLimit() { result = 5 }
+
FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
predicate sourceGrouping(Node source, string sourceGroup) {
diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl3.qll b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl3.qll
index 2bbc565daa6..9b92f961e6f 100644
--- a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl3.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl3.qll
@@ -285,6 +285,8 @@ deprecated private module Config implements FullStateConfigSig {
int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
+ int accessPathLimit() { result = 5 }
+
FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
predicate sourceGrouping(Node source, string sourceGroup) {
diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl4.qll b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl4.qll
index 2bbc565daa6..9b92f961e6f 100644
--- a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl4.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl4.qll
@@ -285,6 +285,8 @@ deprecated private module Config implements FullStateConfigSig {
int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
+ int accessPathLimit() { result = 5 }
+
FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
predicate sourceGrouping(Node source, string sourceGroup) {
diff --git a/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl2.qll b/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl2.qll
index 2bbc565daa6..9b92f961e6f 100644
--- a/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl2.qll
+++ b/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl2.qll
@@ -285,6 +285,8 @@ deprecated private module Config implements FullStateConfigSig {
int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
+ int accessPathLimit() { result = 5 }
+
FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
predicate sourceGrouping(Node source, string sourceGroup) {
diff --git a/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowImpl1.qll b/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowImpl1.qll
index 2bbc565daa6..9b92f961e6f 100644
--- a/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowImpl1.qll
+++ b/swift/ql/lib/codeql/swift/dataflow/internal/DataFlowImpl1.qll
@@ -285,6 +285,8 @@ deprecated private module Config implements FullStateConfigSig {
int fieldFlowBranchLimit() { result = min(any(Configuration config).fieldFlowBranchLimit()) }
+ int accessPathLimit() { result = 5 }
+
FlowFeature getAFeature() { result = any(Configuration config).getAFeature() }
predicate sourceGrouping(Node source, string sourceGroup) {
From f571ebdaf4dcef776d521a30dd13f34b422f0135 Mon Sep 17 00:00:00 2001
From: Michael Nebel
Date: Mon, 11 Mar 2024 14:43:14 +0100
Subject: [PATCH 066/309] C#: Overall change note for C# 12 / .NET 8 support.
---
csharp/ql/lib/change-notes/2024-03-11-csharp12-dotnet8.md | 4 ++++
1 file changed, 4 insertions(+)
create mode 100644 csharp/ql/lib/change-notes/2024-03-11-csharp12-dotnet8.md
diff --git a/csharp/ql/lib/change-notes/2024-03-11-csharp12-dotnet8.md b/csharp/ql/lib/change-notes/2024-03-11-csharp12-dotnet8.md
new file mode 100644
index 00000000000..7111e8966d6
--- /dev/null
+++ b/csharp/ql/lib/change-notes/2024-03-11-csharp12-dotnet8.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Support for C# 12 / .NET8.
From 7b0df57d7a485d71cdb5f060dccc2388590674bf Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Mon, 11 Mar 2024 13:56:22 +0000
Subject: [PATCH 067/309] C++: Remove the two configurations that depend on
flow state to speed up performance on ChakraCore.
---
.../src/Security/CWE/CWE-843/TypeConfusion.ql | 158 +++++-------------
.../CWE/CWE-843/TypeConfusion.expected | 28 ++++
2 files changed, 72 insertions(+), 114 deletions(-)
diff --git a/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql
index 530d8804ebd..18a331f9c32 100644
--- a/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql
+++ b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql
@@ -12,7 +12,7 @@
import cpp
import semmle.code.cpp.dataflow.new.DataFlow
-import BadFlow::PathGraph
+import Flow::PathGraph
/**
* Holds if `f` is a field located at byte offset `offset` in `c`.
@@ -179,23 +179,28 @@ class UnsafeCast extends Cast {
}
/**
- * Holds if `source` is an allocation that allocates a value of type `state`.
+ * Holds if `source` is an allocation that allocates a value of type `type`.
*/
-predicate isSourceImpl(DataFlow::Node source, Class state) {
- state = source.asExpr().(AllocationExpr).getAllocatedElementType().stripType() and
+predicate isSourceImpl(DataFlow::Node source, Class type) {
+ exists(AllocationExpr alloc |
+ alloc = source.asExpr() and
+ type = alloc.getAllocatedElementType().stripType() and
+ not exists(
+ alloc
+ .(NewOrNewArrayExpr)
+ .getAllocator()
+ .(OperatorNewAllocationFunction)
+ .getPlacementArgument()
+ )
+ ) and
exists(TypeDeclarationEntry tde |
- tde = state.getDefinition() and
+ tde = type.getDefinition() and
not tde.isFromUninstantiatedTemplate(_)
)
}
-/**
- * The `RelevantStateConfig` configuration is used to find the set of
- * states for the `BadConfig` and `GoodConfig`. The flow computed by
- * `RelevantStateConfig` is used to implement the `relevantState` predicate
- * which is used to avoid a cartesian product in `isSinkImpl`.
- */
-module RelevantStateConfig implements DataFlow::ConfigSig {
+/** A configuration describing flow from an allocation to a potentially unsafe cast. */
+module Config implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { isSourceImpl(source, _) }
predicate isBarrier(DataFlow::Node node) {
@@ -212,122 +217,47 @@ module RelevantStateConfig implements DataFlow::ConfigSig {
)
}
- predicate isSink(DataFlow::Node sink) {
- exists(UnsafeCast cast | sink.asExpr() = cast.getUnconverted())
- }
+ predicate isSink(DataFlow::Node sink) { sink.asExpr() = any(UnsafeCast cast).getUnconverted() }
int fieldFlowBranchLimit() { result = 0 }
}
-module RelevantStateFlow = DataFlow::Global;
+module Flow = DataFlow::Global;
-predicate relevantState(DataFlow::Node source, DataFlow::Node sink, Class state) {
- RelevantStateFlow::flow(source, sink) and
- isSourceImpl(source, state)
-}
-
-predicate isSinkImpl(DataFlow::Node sink, Class state, Type convertedType, boolean compatible) {
- exists(UnsafeCast cast |
- relevantState(_, sink, state) and
- sink.asExpr() = cast.getUnconverted() and
- convertedType = cast.getConvertedType()
- |
- if cast.compatibleWith(state) then compatible = true else compatible = false
+predicate relevantType(DataFlow::Node sink, Class allocatedType) {
+ exists(DataFlow::Node source |
+ Flow::flow(source, sink) and
+ isSourceImpl(source, allocatedType)
)
}
-/**
- * The `BadConfig` configuration tracks flow from an allocation to an
- * incompatible cast.
- *
- * We use `FlowState` to track the type of the source, and compare the
- * flow state to the target of the cast in the `isSink` definition.
- */
-module BadConfig implements DataFlow::StateConfigSig {
- class FlowState extends Class {
- FlowState() { relevantState(_, _, this) }
- }
-
- predicate isSource(DataFlow::Node source, FlowState state) { relevantState(source, _, state) }
-
- predicate isBarrier(DataFlow::Node node) { RelevantStateConfig::isBarrier(node) }
-
- predicate isSink(DataFlow::Node sink, FlowState state) { isSinkImpl(sink, state, _, false) }
-
- predicate isBarrierOut(DataFlow::Node sink, FlowState state) { isSink(sink, state) }
-
- int fieldFlowBranchLimit() { result = 0 }
+predicate isSinkImpl(
+ DataFlow::Node sink, Class allocatedType, Type convertedType, boolean compatible
+) {
+ exists(UnsafeCast cast |
+ relevantType(sink, allocatedType) and
+ sink.asExpr() = cast.getUnconverted() and
+ convertedType = cast.getConvertedType()
+ |
+ if cast.compatibleWith(allocatedType) then compatible = true else compatible = false
+ )
}
-module BadFlow = DataFlow::GlobalWithState;
-
-/**
- * The `GoodConfig` configuration tracks flow from an allocation to a
- * compatible cast.
- *
- * We use `GoodConfig` to reduce the number of FPs from infeasible paths.
- * For example, consider the following example:
- * ```cpp
- * struct Animal { virtual ~Animal(); };
- *
- * struct Cat : public Animal {
- * Cat();
- * ~Cat();
- * };
- *
- * struct Dog : public Animal {
- * Dog();
- * ~Dog();
- * };
- *
- * void test9(bool b) {
- * Animal* a;
- * if(b) {
- * a = new Cat;
- * } else {
- * a = new Dog;
- * }
- * if(b) {
- * Cat* d = static_cast(a);
- * }
- * }
- * ```
- * Here, `BadConfig` finds a flow from `a = new Dog` to `static_cast(a)`.
- * However, that path is never realized in an actual execution path. So in
- * order to remove this result we exclude results where there exists an
- * allocation of a type that's compatible with `static_cast(a)`.
- *
- * We use `FlowState` to track the type of the source, and compare the
- * flow state to the target of the cast in the `isSink` definition.
- */
-module GoodConfig implements DataFlow::StateConfigSig {
- class FlowState = BadConfig::FlowState;
-
- predicate isSource(DataFlow::Node source, FlowState state) { BadConfig::isSource(source, state) }
-
- predicate isBarrier(DataFlow::Node node) { BadConfig::isBarrier(node) }
-
- predicate isSink(DataFlow::Node sink, FlowState state) {
- isSinkImpl(sink, state, _, true) and
- BadFlow::flowTo(sink)
- }
-
- int fieldFlowBranchLimit() { result = 0 }
-}
-
-module GoodFlow = DataFlow::GlobalWithState;
-
from
- BadFlow::PathNode source, BadFlow::PathNode sink, Type sourceType, Type sinkType,
+ Flow::PathNode source, Flow::PathNode sink, Type badSourceType, Type sinkType,
DataFlow::Node sinkNode
where
- BadFlow::flowPath(source, sink) and
+ Flow::flowPath(source, sink) and
sinkNode = sink.getNode() and
+ isSourceImpl(source.getNode(), badSourceType) and
+ isSinkImpl(sinkNode, badSourceType, sinkType, false) and
// If there is any flow that would result in a valid cast then we don't
// report an alert here. This reduces the number of FPs from infeasible paths
// significantly.
- not GoodFlow::flowTo(sinkNode) and
- isSourceImpl(source.getNode(), sourceType) and
- isSinkImpl(sinkNode, _, sinkType, false)
-select sinkNode, source, sink, "Conversion from $@ to $@ is invalid.", sourceType,
- sourceType.toString(), sinkType, sinkType.toString()
+ not exists(DataFlow::Node goodSource, Type goodSourceType |
+ isSourceImpl(goodSource, goodSourceType) and
+ isSinkImpl(sinkNode, goodSourceType, sinkType, true) and
+ Flow::flow(goodSource, sinkNode)
+ )
+select sinkNode, source, sink, "Conversion from $@ to $@ is invalid.", badSourceType,
+ badSourceType.toString(), sinkType, sinkType.toString()
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected
index 45355a86a48..4cd377e9f5e 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected
@@ -1,34 +1,62 @@
edges
+| test.cpp:17:13:17:18 | new | test.cpp:18:21:18:47 | p | provenance | |
+| test.cpp:22:13:22:26 | new | test.cpp:23:12:23:30 | p | provenance | |
| test.cpp:27:13:27:18 | new | test.cpp:28:25:28:55 | p | provenance | |
| test.cpp:32:13:32:30 | new | test.cpp:33:12:33:30 | p | provenance | |
+| test.cpp:47:21:47:36 | new | test.cpp:48:22:48:55 | p | provenance | |
| test.cpp:66:15:66:21 | new | test.cpp:67:12:67:31 | a | provenance | |
+| test.cpp:76:15:76:21 | new | test.cpp:77:12:77:31 | a | provenance | |
+| test.cpp:83:9:83:15 | new | test.cpp:88:14:88:33 | a | provenance | |
| test.cpp:85:9:85:15 | new | test.cpp:88:14:88:33 | a | provenance | |
+| test.cpp:115:12:115:17 | new | test.cpp:116:20:116:51 | s2 | provenance | |
| test.cpp:127:12:127:17 | new | test.cpp:128:24:128:59 | s2 | provenance | |
+| test.cpp:140:12:140:17 | new | test.cpp:141:23:141:57 | s1 | provenance | |
| test.cpp:143:14:143:19 | new | test.cpp:145:28:145:68 | s1_2 | provenance | |
| test.cpp:153:9:153:15 | new | test.cpp:159:14:159:33 | a | provenance | |
+| test.cpp:166:9:166:15 | new | test.cpp:171:14:171:33 | a | provenance | |
| test.cpp:168:9:168:15 | new | test.cpp:171:14:171:33 | a | provenance | |
+| test.cpp:179:15:179:24 | new | test.cpp:181:15:181:25 | u64 | provenance | |
| test.cpp:187:15:187:24 | new | test.cpp:189:25:189:45 | u64 | provenance | |
+| test.cpp:207:14:207:26 | new | test.cpp:209:17:209:28 | si | provenance | |
| test.cpp:217:13:217:18 | new | test.cpp:218:30:218:65 | p | provenance | |
| test.cpp:226:13:226:18 | new | test.cpp:227:29:227:63 | p | provenance | |
nodes
+| test.cpp:17:13:17:18 | new | semmle.label | new |
+| test.cpp:18:21:18:47 | p | semmle.label | p |
+| test.cpp:22:13:22:26 | new | semmle.label | new |
+| test.cpp:23:12:23:30 | p | semmle.label | p |
| test.cpp:27:13:27:18 | new | semmle.label | new |
| test.cpp:28:25:28:55 | p | semmle.label | p |
| test.cpp:32:13:32:30 | new | semmle.label | new |
| test.cpp:33:12:33:30 | p | semmle.label | p |
+| test.cpp:47:21:47:36 | new | semmle.label | new |
+| test.cpp:48:22:48:55 | p | semmle.label | p |
| test.cpp:66:15:66:21 | new | semmle.label | new |
| test.cpp:67:12:67:31 | a | semmle.label | a |
+| test.cpp:76:15:76:21 | new | semmle.label | new |
+| test.cpp:77:12:77:31 | a | semmle.label | a |
+| test.cpp:83:9:83:15 | new | semmle.label | new |
| test.cpp:85:9:85:15 | new | semmle.label | new |
| test.cpp:88:14:88:33 | a | semmle.label | a |
+| test.cpp:115:12:115:17 | new | semmle.label | new |
+| test.cpp:116:20:116:51 | s2 | semmle.label | s2 |
| test.cpp:127:12:127:17 | new | semmle.label | new |
| test.cpp:128:24:128:59 | s2 | semmle.label | s2 |
+| test.cpp:140:12:140:17 | new | semmle.label | new |
+| test.cpp:141:23:141:57 | s1 | semmle.label | s1 |
| test.cpp:143:14:143:19 | new | semmle.label | new |
| test.cpp:145:28:145:68 | s1_2 | semmle.label | s1_2 |
| test.cpp:153:9:153:15 | new | semmle.label | new |
| test.cpp:159:14:159:33 | a | semmle.label | a |
+| test.cpp:166:9:166:15 | new | semmle.label | new |
| test.cpp:168:9:168:15 | new | semmle.label | new |
| test.cpp:171:14:171:33 | a | semmle.label | a |
+| test.cpp:179:15:179:24 | new | semmle.label | new |
+| test.cpp:181:15:181:25 | u64 | semmle.label | u64 |
| test.cpp:187:15:187:24 | new | semmle.label | new |
| test.cpp:189:25:189:45 | u64 | semmle.label | u64 |
+| test.cpp:207:14:207:26 | new | semmle.label | new |
+| test.cpp:209:17:209:28 | si | semmle.label | si |
| test.cpp:217:13:217:18 | new | semmle.label | new |
| test.cpp:218:30:218:65 | p | semmle.label | p |
| test.cpp:226:13:226:18 | new | semmle.label | new |
From 61dbe2685867984fb009bf89c211ecbea5b7c4bc Mon Sep 17 00:00:00 2001
From: Ed Minnix
Date: Mon, 11 Mar 2024 10:31:51 -0400
Subject: [PATCH 068/309] Add sinks for `android.os.ParcelFileDescriptor`
---
java/ql/lib/ext/android.os.model.yml | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/java/ql/lib/ext/android.os.model.yml b/java/ql/lib/ext/android.os.model.yml
index fc4822dd59f..80271eac954 100644
--- a/java/ql/lib/ext/android.os.model.yml
+++ b/java/ql/lib/ext/android.os.model.yml
@@ -132,3 +132,8 @@ extensions:
- ["android.os", "Parcel", False, "readTypedList", "", "", "Argument[this]", "Argument[0]", "taint", "manual"]
- ["android.os", "Parcel", False, "readTypedObject", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
- ["android.os", "Parcel", False, "readValue", "", "", "Argument[this]", "ReturnValue", "taint", "manual"]
+ - addsTo:
+ pack: codeql/java-all
+ extensible: sinkModel
+ data:
+ - ["android.os", "ParcelFileDescriptor", False, "open", "", "", "Argument[0]", "path-injection", "manual"]
\ No newline at end of file
From 76aeee2820fc625d1ba45ddf70f03ac548986338 Mon Sep 17 00:00:00 2001
From: Ed Minnix
Date: Mon, 11 Mar 2024 10:34:15 -0400
Subject: [PATCH 069/309] Change note
---
.../2024-03-11-add-parcelfiledescriptor-open-model.md | 4 ++++
1 file changed, 4 insertions(+)
create mode 100644 java/ql/lib/change-notes/2024-03-11-add-parcelfiledescriptor-open-model.md
diff --git a/java/ql/lib/change-notes/2024-03-11-add-parcelfiledescriptor-open-model.md b/java/ql/lib/change-notes/2024-03-11-add-parcelfiledescriptor-open-model.md
new file mode 100644
index 00000000000..31f76712828
--- /dev/null
+++ b/java/ql/lib/change-notes/2024-03-11-add-parcelfiledescriptor-open-model.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added a `path-injection` sink for the `open` methods of the `android.os.ParcelFileDescriptor` class.
From ff2d78d2c8bc15bd36bf24ae204b444ba9feb30d Mon Sep 17 00:00:00 2001
From: Tony Torralba
Date: Mon, 11 Mar 2024 15:53:40 +0100
Subject: [PATCH 070/309] Update
go/ql/src/Security/CWE-770/UncontrolledAllocationSize.ql
---
go/ql/src/Security/CWE-770/UncontrolledAllocationSize.ql | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/go/ql/src/Security/CWE-770/UncontrolledAllocationSize.ql b/go/ql/src/Security/CWE-770/UncontrolledAllocationSize.ql
index c6d2091cc53..eabfa3333ec 100644
--- a/go/ql/src/Security/CWE-770/UncontrolledAllocationSize.ql
+++ b/go/ql/src/Security/CWE-770/UncontrolledAllocationSize.ql
@@ -2,8 +2,8 @@
* @name Slice memory allocation with excessive size value
* @description Allocating memory for slices with the built-in make function from user-controlled sources can lead to a denial of service.
* @kind path-problem
- * @problem.severity warning
- * @security-severity 6.0
+ * @problem.severity error
+ * @security-severity 7.5
* @precision high
* @id go/uncontrolled-allocation-size
* @tags security
From d73f43477fec68116e8401ae54c1b1648a4562e3 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen
Date: Mon, 11 Mar 2024 16:32:19 +0100
Subject: [PATCH 071/309] update ts to released version 54
---
javascript/extractor/lib/typescript/package-lock.json | 10 +++++-----
javascript/extractor/lib/typescript/package.json | 4 ++--
2 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/javascript/extractor/lib/typescript/package-lock.json b/javascript/extractor/lib/typescript/package-lock.json
index af309c3b451..604db5f3e37 100644
--- a/javascript/extractor/lib/typescript/package-lock.json
+++ b/javascript/extractor/lib/typescript/package-lock.json
@@ -6,7 +6,7 @@
"": {
"name": "typescript-parser-wrapper",
"dependencies": {
- "typescript": "5.4.1-rc"
+ "typescript": "5.4"
},
"devDependencies": {
"@types/node": "18.15.3"
@@ -20,9 +20,9 @@
"license": "MIT"
},
"node_modules/typescript": {
- "version": "5.4.1-rc",
- "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.4.1-rc.tgz",
- "integrity": "sha512-gInURzaO0bbfzfQAc3mfcHxh8qev+No4QOFUZHajo9vBgOLaljELJ3wuzyoGo/zHIzMSezdhtrsRdqL6E9SvNA==",
+ "version": "5.4.2",
+ "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.4.2.tgz",
+ "integrity": "sha512-+2/g0Fds1ERlP6JsakQQDXjZdZMM+rqpamFZJEKh4kwTIn3iDkgKtby0CeNd5ATNZ4Ry1ax15TMx0W2V+miizQ==",
"bin": {
"tsc": "bin/tsc",
"tsserver": "bin/tsserver"
@@ -32,4 +32,4 @@
}
}
}
-}
\ No newline at end of file
+}
diff --git a/javascript/extractor/lib/typescript/package.json b/javascript/extractor/lib/typescript/package.json
index 6a315fed292..8f6a1549a60 100644
--- a/javascript/extractor/lib/typescript/package.json
+++ b/javascript/extractor/lib/typescript/package.json
@@ -2,7 +2,7 @@
"name": "typescript-parser-wrapper",
"private": true,
"dependencies": {
- "typescript": "5.4.1-rc"
+ "typescript": "5.4"
},
"scripts": {
"build": "tsc --project tsconfig.json",
@@ -14,4 +14,4 @@
"devDependencies": {
"@types/node": "18.15.3"
}
-}
\ No newline at end of file
+}
From c325ff8a237d6c5fa860a1eed288ee508b5c46bf Mon Sep 17 00:00:00 2001
From: Henry Mercer
Date: Mon, 11 Mar 2024 16:38:33 +0000
Subject: [PATCH 072/309] Mark lines of code queries as telemetry queries
The new file coverage metrics are available in all supported GHES
versions. This PR tags lines of code queries as telemetry queries. Lines
of code information will still be available in the SARIF file, but it
will no longer be displayed in the logging output of the CLI.
The one exception is the metric queries for Java/Kotlin that provides
separate lines of code information for Java and Kotlin. I've kept these
since separate file coverage information for languages like Java and
Kotlin is only available for GHES 3.12 and later.
---
cpp/ql/src/Summary/LinesOfUserCode.ql | 1 +
csharp/ql/src/Metrics/Summaries/LinesOfCode.ql | 1 +
go/ql/src/Summary/LinesOfCode.ql | 1 +
java/ql/src/Metrics/Summaries/LinesOfCode.ql | 1 +
javascript/ql/src/Summary/LinesOfUserCode.ql | 1 +
python/ql/src/Summary/LinesOfUserCode.ql | 1 +
ql/ql/src/queries/summary/LinesOfCode.ql | 1 +
ql/ql/src/queries/summary/LinesOfUserCode.ql | 1 +
ruby/ql/src/queries/summary/LinesOfCode.ql | 1 +
ruby/ql/src/queries/summary/LinesOfUserCode.ql | 1 +
swift/ql/src/diagnostics/SuccessfullyExtractedLines.ql | 1 +
11 files changed, 11 insertions(+)
diff --git a/cpp/ql/src/Summary/LinesOfUserCode.ql b/cpp/ql/src/Summary/LinesOfUserCode.ql
index 67d3aa6a8e0..2c198a1488d 100644
--- a/cpp/ql/src/Summary/LinesOfUserCode.ql
+++ b/cpp/ql/src/Summary/LinesOfUserCode.ql
@@ -4,6 +4,7 @@
* @kind metric
* @tags summary
* lines-of-code
+ * telemetry
* @id cpp/summary/lines-of-user-code
*/
diff --git a/csharp/ql/src/Metrics/Summaries/LinesOfCode.ql b/csharp/ql/src/Metrics/Summaries/LinesOfCode.ql
index 2115cd60d2b..4c6eb55e5ab 100644
--- a/csharp/ql/src/Metrics/Summaries/LinesOfCode.ql
+++ b/csharp/ql/src/Metrics/Summaries/LinesOfCode.ql
@@ -5,6 +5,7 @@
* @kind metric
* @tags summary
* lines-of-code
+ * telemetry
*/
import csharp
diff --git a/go/ql/src/Summary/LinesOfCode.ql b/go/ql/src/Summary/LinesOfCode.ql
index 383d7c5021e..04864e5c4a0 100644
--- a/go/ql/src/Summary/LinesOfCode.ql
+++ b/go/ql/src/Summary/LinesOfCode.ql
@@ -5,6 +5,7 @@
* @kind metric
* @tags summary
* lines-of-code
+ * telemetry
*/
import go
diff --git a/java/ql/src/Metrics/Summaries/LinesOfCode.ql b/java/ql/src/Metrics/Summaries/LinesOfCode.ql
index 769a3476ed2..1ead46f1b20 100644
--- a/java/ql/src/Metrics/Summaries/LinesOfCode.ql
+++ b/java/ql/src/Metrics/Summaries/LinesOfCode.ql
@@ -7,6 +7,7 @@
* @kind metric
* @tags summary
* lines-of-code
+ * telemetry
*/
import java
diff --git a/javascript/ql/src/Summary/LinesOfUserCode.ql b/javascript/ql/src/Summary/LinesOfUserCode.ql
index 61ad13519cb..83fbb9b32da 100644
--- a/javascript/ql/src/Summary/LinesOfUserCode.ql
+++ b/javascript/ql/src/Summary/LinesOfUserCode.ql
@@ -6,6 +6,7 @@
* @kind metric
* @tags summary
* lines-of-code
+ * telemetry
* @id js/summary/lines-of-user-code
*/
diff --git a/python/ql/src/Summary/LinesOfUserCode.ql b/python/ql/src/Summary/LinesOfUserCode.ql
index 528ae948cd7..a30ba7afd19 100644
--- a/python/ql/src/Summary/LinesOfUserCode.ql
+++ b/python/ql/src/Summary/LinesOfUserCode.ql
@@ -8,6 +8,7 @@
* @kind metric
* @tags summary
* lines-of-code
+ * telemetry
* @id py/summary/lines-of-user-code
*/
diff --git a/ql/ql/src/queries/summary/LinesOfCode.ql b/ql/ql/src/queries/summary/LinesOfCode.ql
index cb5ef617476..c0dbe831967 100644
--- a/ql/ql/src/queries/summary/LinesOfCode.ql
+++ b/ql/ql/src/queries/summary/LinesOfCode.ql
@@ -8,6 +8,7 @@
* @kind metric
* @tags summary
* lines-of-code
+ * telemetry
*/
import ql
diff --git a/ql/ql/src/queries/summary/LinesOfUserCode.ql b/ql/ql/src/queries/summary/LinesOfUserCode.ql
index 1701af1a5c9..8f49ce27d2f 100644
--- a/ql/ql/src/queries/summary/LinesOfUserCode.ql
+++ b/ql/ql/src/queries/summary/LinesOfUserCode.ql
@@ -6,6 +6,7 @@
* query counts the lines of code, excluding whitespace or comments.
* @kind metric
* @tags summary
+ * telemetry
*/
import ql
diff --git a/ruby/ql/src/queries/summary/LinesOfCode.ql b/ruby/ql/src/queries/summary/LinesOfCode.ql
index 74994d77347..34e7438bab1 100644
--- a/ruby/ql/src/queries/summary/LinesOfCode.ql
+++ b/ruby/ql/src/queries/summary/LinesOfCode.ql
@@ -8,6 +8,7 @@
* @kind metric
* @tags summary
* lines-of-code
+ * telemetry
*/
import codeql.ruby.AST
diff --git a/ruby/ql/src/queries/summary/LinesOfUserCode.ql b/ruby/ql/src/queries/summary/LinesOfUserCode.ql
index d8025088ceb..121124862a1 100644
--- a/ruby/ql/src/queries/summary/LinesOfUserCode.ql
+++ b/ruby/ql/src/queries/summary/LinesOfUserCode.ql
@@ -6,6 +6,7 @@
* query counts the lines of code, excluding whitespace or comments.
* @kind metric
* @tags summary
+ * telemetry
*/
import codeql.ruby.AST
diff --git a/swift/ql/src/diagnostics/SuccessfullyExtractedLines.ql b/swift/ql/src/diagnostics/SuccessfullyExtractedLines.ql
index 373b6c4bd0f..9fc40680852 100644
--- a/swift/ql/src/diagnostics/SuccessfullyExtractedLines.ql
+++ b/swift/ql/src/diagnostics/SuccessfullyExtractedLines.ql
@@ -4,6 +4,7 @@
* @kind metric
* @id swift/diagnostics/successfully-extracted-lines
* @tags summary
+ * telemetry
*/
import swift
From bc745dfd5eea4e87a3d29bc745bea7cb815ba6b2 Mon Sep 17 00:00:00 2001
From: Ed Minnix
Date: Mon, 11 Mar 2024 13:55:34 -0400
Subject: [PATCH 073/309] Windows registry sources
---
csharp/ql/lib/ext/Microsoft.Win32.model.yml | 9 +++
.../security/dataflow/flowsources/Local.qll | 13 +++++
.../local/registry/Registry.expected | 8 +++
.../local/registry/Registry.ext.yml | 7 +++
.../flowsources/local/registry/Registry.ql | 6 ++
.../flowsources/local/registry/UseRegistry.cs | 55 +++++++++++++++++++
.../flowsources/local/registry/options | 3 +
shared/mad/codeql/mad/ModelValidation.qll | 2 +-
.../ext/threat-model-grouping.model.yml | 1 +
9 files changed, 103 insertions(+), 1 deletion(-)
create mode 100644 csharp/ql/lib/ext/Microsoft.Win32.model.yml
create mode 100644 csharp/ql/test/library-tests/dataflow/flowsources/local/registry/Registry.expected
create mode 100644 csharp/ql/test/library-tests/dataflow/flowsources/local/registry/Registry.ext.yml
create mode 100644 csharp/ql/test/library-tests/dataflow/flowsources/local/registry/Registry.ql
create mode 100644 csharp/ql/test/library-tests/dataflow/flowsources/local/registry/UseRegistry.cs
create mode 100644 csharp/ql/test/library-tests/dataflow/flowsources/local/registry/options
diff --git a/csharp/ql/lib/ext/Microsoft.Win32.model.yml b/csharp/ql/lib/ext/Microsoft.Win32.model.yml
new file mode 100644
index 00000000000..c7e439f2910
--- /dev/null
+++ b/csharp/ql/lib/ext/Microsoft.Win32.model.yml
@@ -0,0 +1,9 @@
+extensions:
+ - addsTo:
+ pack: codeql/csharp-all
+ extensible: sourceModel
+ data:
+ - ["Microsoft.Win32", "Registry", False, "GetValue", "(System.String,System.String,System.Object)", "", "ReturnValue", "windows-registry", "manual"]
+ - ["Microsoft.Win32", "RegistryKey", False, "GetSubKeyNames", "()", "", "ReturnValue", "windows-registry", "manual"]
+ - ["Microsoft.Win32", "RegistryKey", False, "GetValue", "", "", "ReturnValue", "windows-registry", "manual"]
+ - ["Microsoft.Win32", "RegistryKey", False, "GetValueNames", "()", "", "ReturnValue", "windows-registry", "manual"]
\ No newline at end of file
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Local.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Local.qll
index 9f3f398e5b1..7ad656e11d3 100644
--- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Local.qll
+++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Local.qll
@@ -55,3 +55,16 @@ abstract class CommandLineArgumentSource extends LocalFlowSource {
private class MainMethodArgumentSource extends CommandLineArgumentSource {
MainMethodArgumentSource() { this.asParameter() = any(MainMethod mainMethod).getAParameter() }
}
+
+/**
+ * A data flow source that represents the access of a value from the Windows registry.
+ */
+abstract class WindowsRegistrySource extends LocalFlowSource {
+ override string getThreatModel() { result = "windows-registry" }
+
+ override string getSourceType() { result = "a value from the Windows registry" }
+}
+
+private class ExternalWindowsRegistrySource extends WindowsRegistrySource {
+ ExternalWindowsRegistrySource() { sourceNode(this, "windows-registry") }
+}
diff --git a/csharp/ql/test/library-tests/dataflow/flowsources/local/registry/Registry.expected b/csharp/ql/test/library-tests/dataflow/flowsources/local/registry/Registry.expected
new file mode 100644
index 00000000000..9a5b8ef2c0e
--- /dev/null
+++ b/csharp/ql/test/library-tests/dataflow/flowsources/local/registry/Registry.expected
@@ -0,0 +1,8 @@
+| UseRegistry.cs:10:36:10:58 | call to method GetValue | windows-registry |
+| UseRegistry.cs:16:36:16:58 | call to method GetValue | windows-registry |
+| UseRegistry.cs:22:36:22:58 | call to method GetValue | windows-registry |
+| UseRegistry.cs:28:36:28:58 | call to method GetValue | windows-registry |
+| UseRegistry.cs:34:36:34:58 | call to method GetValue | windows-registry |
+| UseRegistry.cs:40:36:40:58 | call to method GetValue | windows-registry |
+| UseRegistry.cs:46:35:46:53 | call to method GetValueNames | windows-registry |
+| UseRegistry.cs:52:36:52:55 | call to method GetSubKeyNames | windows-registry |
diff --git a/csharp/ql/test/library-tests/dataflow/flowsources/local/registry/Registry.ext.yml b/csharp/ql/test/library-tests/dataflow/flowsources/local/registry/Registry.ext.yml
new file mode 100644
index 00000000000..71007f3394c
--- /dev/null
+++ b/csharp/ql/test/library-tests/dataflow/flowsources/local/registry/Registry.ext.yml
@@ -0,0 +1,7 @@
+extensions:
+
+ - addsTo:
+ pack: codeql/threat-models
+ extensible: threatModelConfiguration
+ data:
+ - ["windows-registry", true, 0]
\ No newline at end of file
diff --git a/csharp/ql/test/library-tests/dataflow/flowsources/local/registry/Registry.ql b/csharp/ql/test/library-tests/dataflow/flowsources/local/registry/Registry.ql
new file mode 100644
index 00000000000..9e2934e9e19
--- /dev/null
+++ b/csharp/ql/test/library-tests/dataflow/flowsources/local/registry/Registry.ql
@@ -0,0 +1,6 @@
+import csharp
+import semmle.code.csharp.security.dataflow.flowsources.FlowSources
+
+from DataFlow::Node source
+where source instanceof ThreatModelFlowSource
+select source, source.(SourceNode).getThreatModel()
diff --git a/csharp/ql/test/library-tests/dataflow/flowsources/local/registry/UseRegistry.cs b/csharp/ql/test/library-tests/dataflow/flowsources/local/registry/UseRegistry.cs
new file mode 100644
index 00000000000..e5698127be4
--- /dev/null
+++ b/csharp/ql/test/library-tests/dataflow/flowsources/local/registry/UseRegistry.cs
@@ -0,0 +1,55 @@
+using Microsoft.Win32;
+
+namespace Test
+{
+ class UseRegistry
+ {
+ public static void GetRegistryValue(string keyName, string valueName)
+ {
+ RegistryKey key = Registry.LocalMachine.OpenSubKey(keyName);
+ string value = (string)key.GetValue(valueName);
+ }
+
+ public static void GetRegistryValue2(string keyName, string valueName)
+ {
+ RegistryKey key = Registry.CurrentUser.OpenSubKey(keyName);
+ string value = (string)key.GetValue(valueName);
+ }
+
+ public static void GetRegistryValue3(string keyName, string valueName)
+ {
+ RegistryKey key = Registry.ClassesRoot.OpenSubKey(keyName);
+ string value = (string)key.GetValue(valueName);
+ }
+
+ public static void GetRegistryValue4(string keyName, string valueName)
+ {
+ RegistryKey key = Registry.Users.OpenSubKey(keyName);
+ string value = (string)key.GetValue(valueName);
+ }
+
+ public static void GetRegistryValue5(string keyName, string valueName)
+ {
+ RegistryKey key = Registry.CurrentConfig.OpenSubKey(keyName);
+ string value = (string)key.GetValue(valueName);
+ }
+
+ public static void GetRegistryValue6(string keyName, string valueName)
+ {
+ RegistryKey key = Registry.PerformanceData.OpenSubKey(keyName);
+ string value = (string)key.GetValue(valueName);
+ }
+
+ public static void GetRegistryValueNames(string keyName, string valueName)
+ {
+ RegistryKey key = Registry.LocalMachine.OpenSubKey(keyName);
+ string[] valueNames = key.GetValueNames();
+ }
+
+ public static void GetRegistrySubKeyNames(string keyName, string valueName)
+ {
+ RegistryKey key = Registry.LocalMachine.OpenSubKey(keyName);
+ string[] subKeyNames = key.GetSubKeyNames();
+ }
+ }
+}
\ No newline at end of file
diff --git a/csharp/ql/test/library-tests/dataflow/flowsources/local/registry/options b/csharp/ql/test/library-tests/dataflow/flowsources/local/registry/options
new file mode 100644
index 00000000000..f28b8af0ae4
--- /dev/null
+++ b/csharp/ql/test/library-tests/dataflow/flowsources/local/registry/options
@@ -0,0 +1,3 @@
+semmle-extractor-options: /nostdlib /noconfig
+semmle-extractor-options: --load-sources-from-project:${testdir}/../../../../../resources/stubs/_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj
+semmle-extractor-options: ${testdir}/../../../../../resources/stubs/Microsoft.VisualStudio.TestTools.UnitTesting.cs
diff --git a/shared/mad/codeql/mad/ModelValidation.qll b/shared/mad/codeql/mad/ModelValidation.qll
index 2f990af4e0f..bb3b8c174b9 100644
--- a/shared/mad/codeql/mad/ModelValidation.qll
+++ b/shared/mad/codeql/mad/ModelValidation.qll
@@ -120,7 +120,7 @@ module KindValidation {
// Java
"android-external-storage-dir", "contentprovider",
// C#
- "file-write",
+ "file-write", "windows-registry",
// JavaScript
"database-access-result"
]
diff --git a/shared/threat-models/ext/threat-model-grouping.model.yml b/shared/threat-models/ext/threat-model-grouping.model.yml
index 53107c1e32b..7cc650d3341 100644
--- a/shared/threat-models/ext/threat-model-grouping.model.yml
+++ b/shared/threat-models/ext/threat-model-grouping.model.yml
@@ -16,6 +16,7 @@ extensions:
- ["commandargs", "local"]
- ["environment", "local"]
- ["file", "local"]
+ - ["windows-registry", "local"]
# Android threat models
- ["android-external-storage-dir", "android"]
From 32e532ff3c6ed015996f760084b87023d19d4402 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Mon, 11 Mar 2024 18:42:42 +0000
Subject: [PATCH 074/309] C++: Some cleanup to avoid conflating the case of a
function returning something as a return value, and a function updating one
of its arguments.
---
.../Likely Bugs/Format/NonConstantFormat.ql | 43 ++++++++++++-------
1 file changed, 27 insertions(+), 16 deletions(-)
diff --git a/cpp/ql/src/Likely Bugs/Format/NonConstantFormat.ql b/cpp/ql/src/Likely Bugs/Format/NonConstantFormat.ql
index 0d1cc7bcf39..72ce3590677 100644
--- a/cpp/ql/src/Likely Bugs/Format/NonConstantFormat.ql
+++ b/cpp/ql/src/Likely Bugs/Format/NonConstantFormat.ql
@@ -37,6 +37,11 @@ class UncalledFunction extends Function {
}
}
+predicate dataFlowOrTaintFlowFunction(Function func, FunctionOutput output) {
+ func.(DataFlowFunction).hasDataFlow(_, output) or
+ func.(TaintFunction).hasTaintFlow(_, output)
+}
+
/**
* Holds if `node` is a non-constant source of data flow for non-const format string detection.
* This is defined as either:
@@ -81,24 +86,30 @@ predicate isNonConst(DataFlow::Node node) {
// i.e., functions that with unknown bodies and are not known to define the output through its input
// are considered as possible non-const sources
// The function's output must also not be const to be considered a non-const source
- exists(Function func, CallInstruction call |
- // NOTE: could use `Call` getAnArgument() instead of `CallInstruction` but requires two
- // variables representing the same call in ordoer to use `callOutput` below.
- exists(Expr arg |
- call.getPositionalArgumentOperand(_).getDef().getUnconvertedResultExpression() = arg and
- arg = node.asDefiningArgument()
+ (
+ // Case 1: It's a known dataflow or taintflow function with flow to the return value
+ exists(Function func, CallInstruction call |
+ // NOTE: could use `Call` getAnArgument() instead of `CallInstruction` but requires two
+ // variables representing the same call in ordoer to use `callOutput` below.
+ call.getUnconvertedResultExpression() = node.asIndirectExpr() and
+ func = call.getStaticCallTarget() and
+ not exists(FunctionOutput output |
+ dataFlowOrTaintFlowFunction(func, output) and
+ output.isReturnValueDeref() and
+ node = callOutput(call, output)
+ )
)
or
- call.getUnconvertedResultExpression() = node.asIndirectExpr()
- |
- func = call.getStaticCallTarget() and
- not exists(FunctionOutput output |
- // NOTE: we must include dataflow and taintflow. e.g., including only dataflow we will find sprintf
- // variant function's output are now possible non-const sources
- pragma[only_bind_out](func).(DataFlowFunction).hasDataFlow(_, output) or
- pragma[only_bind_out](func).(TaintFunction).hasTaintFlow(_, output)
- |
- node = callOutput(call, output)
+ // Case 1: It's a known dataflow or taintflow function with flow to an output parameter
+ exists(Function func, int i, CallInstruction call |
+ call.getPositionalArgumentOperand(i).getDef().getUnconvertedResultExpression() =
+ node.asDefiningArgument() and
+ func = call.getStaticCallTarget() and
+ not exists(FunctionOutput output |
+ dataFlowOrTaintFlowFunction(func, output) and
+ output.isParameterDeref(i) and
+ node = callOutput(call, output)
+ )
)
) and
not exists(Call c |
From f97b6e2848a1af385534d341e56c770c8453cfde Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Mon, 11 Mar 2024 18:44:34 +0000
Subject: [PATCH 075/309] C++: Stop conflating pointers and indirections in the
query.
---
.../Likely Bugs/Format/NonConstantFormat.ql | 10 +++---
.../NonConstantFormat.expected | 33 +++++--------------
.../Format/NonConstantFormat/test.cpp | 4 +--
.../semmle/consts/NonConstantFormat.expected | 8 -----
4 files changed, 17 insertions(+), 38 deletions(-)
diff --git a/cpp/ql/src/Likely Bugs/Format/NonConstantFormat.ql b/cpp/ql/src/Likely Bugs/Format/NonConstantFormat.ql
index 72ce3590677..b02986e0b68 100644
--- a/cpp/ql/src/Likely Bugs/Format/NonConstantFormat.ql
+++ b/cpp/ql/src/Likely Bugs/Format/NonConstantFormat.ql
@@ -74,7 +74,9 @@ predicate isNonConst(DataFlow::Node node) {
// Parameters of uncalled functions that aren't const
exists(UncalledFunction f, Parameter p |
f.getAParameter() = p and
- p = node.asParameter() and
+ // We pick the indirection of the parameter since this query is focused
+ // on strings.
+ p = node.asParameter(1) and
// Ignore main's argv parameter as it is already considered a `FlowSource`
// not ignoring it will result in path redundancies
(f.getName() = "main" implies p != f.getParameter(1))
@@ -116,7 +118,7 @@ predicate isNonConst(DataFlow::Node node) {
c.getTarget().hasDefinition() and
if node instanceof DataFlow::DefinitionByReferenceNode
then c.getAnArgument() = node.asDefiningArgument()
- else c = [node.asExpr(), node.asIndirectExpr()]
+ else c = node.asIndirectExpr()
)
}
@@ -125,7 +127,7 @@ predicate isNonConst(DataFlow::Node node) {
* `FormattingFunctionCall`.
*/
predicate isSinkImpl(DataFlow::Node sink, Expr formatString) {
- [sink.asExpr(), sink.asIndirectExpr()] = formatString and
+ sink.asIndirectExpr() = formatString and
exists(FormattingFunctionCall fc | formatString = fc.getArgument(fc.getFormatParameterIndex()))
}
@@ -136,7 +138,7 @@ module NonConstFlowConfig implements DataFlow::ConfigSig {
predicate isBarrier(DataFlow::Node node) {
// Ignore tracing non-const through array indices
- exists(ArrayExpr a | a.getArrayOffset() = node.asExpr())
+ exists(ArrayExpr a | a.getArrayOffset() = node.asIndirectExpr())
}
}
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/NonConstantFormat.expected b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/NonConstantFormat.expected
index 2539c728d87..c3c94158da8 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/NonConstantFormat.expected
+++ b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/NonConstantFormat.expected
@@ -8,15 +8,10 @@ edges
| nested.cpp:35:19:35:21 | *fmt | nested.cpp:27:32:27:34 | *fmt | provenance | |
| nested.cpp:42:24:42:34 | *call to ext_fmt_str | nested.cpp:34:37:34:39 | *fmt | provenance | |
| nested.cpp:86:19:86:46 | *call to __builtin_alloca | nested.cpp:87:18:87:20 | *fmt | provenance | |
-| test.cpp:27:39:27:39 | n | test.cpp:27:13:27:24 | **make_message | provenance | |
-| test.cpp:46:14:46:17 | argc | test.cpp:51:23:51:30 | ... - ... | provenance | |
| test.cpp:46:27:46:30 | **argv | test.cpp:130:20:130:26 | *access to array | provenance | |
-| test.cpp:51:23:51:30 | ... - ... | test.cpp:27:39:27:39 | n | provenance | |
-| test.cpp:51:23:51:30 | ... - ... | test.cpp:51:10:51:21 | *call to make_message | provenance | |
-| test.cpp:155:27:155:30 | data | test.cpp:157:12:157:15 | data | provenance | |
-| test.cpp:167:31:167:34 | data | test.cpp:170:12:170:14 | *res | provenance | |
-| test.cpp:193:32:193:34 | str | test.cpp:195:31:195:33 | str | provenance | |
-| test.cpp:193:32:193:34 | str | test.cpp:197:11:197:14 | *wstr | provenance | |
+| test.cpp:167:31:167:34 | *data | test.cpp:170:12:170:14 | *res | provenance | |
+| test.cpp:193:32:193:34 | *str | test.cpp:195:31:195:33 | *str | provenance | |
+| test.cpp:193:32:193:34 | *str | test.cpp:197:11:197:14 | *wstr | provenance | |
| test.cpp:204:25:204:36 | *call to get_string | test.cpp:205:12:205:20 | *... + ... | provenance | |
| test.cpp:204:25:204:36 | *call to get_string | test.cpp:206:12:206:16 | *hello | provenance | |
| test.cpp:209:25:209:36 | *call to get_string | test.cpp:211:12:211:16 | *hello | provenance | |
@@ -42,19 +37,12 @@ nodes
| nested.cpp:79:32:79:38 | *call to get_fmt | semmle.label | *call to get_fmt |
| nested.cpp:86:19:86:46 | *call to __builtin_alloca | semmle.label | *call to __builtin_alloca |
| nested.cpp:87:18:87:20 | *fmt | semmle.label | *fmt |
-| test.cpp:27:13:27:24 | **make_message | semmle.label | **make_message |
-| test.cpp:27:39:27:39 | n | semmle.label | n |
-| test.cpp:46:14:46:17 | argc | semmle.label | argc |
| test.cpp:46:27:46:30 | **argv | semmle.label | **argv |
-| test.cpp:51:10:51:21 | *call to make_message | semmle.label | *call to make_message |
-| test.cpp:51:23:51:30 | ... - ... | semmle.label | ... - ... |
| test.cpp:130:20:130:26 | *access to array | semmle.label | *access to array |
-| test.cpp:155:27:155:30 | data | semmle.label | data |
-| test.cpp:157:12:157:15 | data | semmle.label | data |
-| test.cpp:167:31:167:34 | data | semmle.label | data |
+| test.cpp:167:31:167:34 | *data | semmle.label | *data |
| test.cpp:170:12:170:14 | *res | semmle.label | *res |
-| test.cpp:193:32:193:34 | str | semmle.label | str |
-| test.cpp:195:31:195:33 | str | semmle.label | str |
+| test.cpp:193:32:193:34 | *str | semmle.label | *str |
+| test.cpp:195:31:195:33 | *str | semmle.label | *str |
| test.cpp:197:11:197:14 | *wstr | semmle.label | *wstr |
| test.cpp:204:25:204:36 | *call to get_string | semmle.label | *call to get_string |
| test.cpp:205:12:205:20 | *... + ... | semmle.label | *... + ... |
@@ -74,7 +62,6 @@ nodes
| test.cpp:245:25:245:36 | *call to get_string | semmle.label | *call to get_string |
| test.cpp:247:12:247:16 | *hello | semmle.label | *hello |
subpaths
-| test.cpp:51:23:51:30 | ... - ... | test.cpp:27:39:27:39 | n | test.cpp:27:13:27:24 | **make_message | test.cpp:51:10:51:21 | *call to make_message |
#select
| NonConstantFormat.c:30:10:30:16 | *access to array | NonConstantFormat.c:28:27:28:30 | **argv | NonConstantFormat.c:30:10:30:16 | *access to array | The format string argument to $@ has a source which cannot be verified to originate from a string literal. | NonConstantFormat.c:30:3:30:8 | call to printf | printf |
| NonConstantFormat.c:41:9:41:45 | *call to any_random_function | NonConstantFormat.c:41:9:41:45 | *call to any_random_function | NonConstantFormat.c:41:9:41:45 | *call to any_random_function | The format string argument to $@ has a source which cannot be verified to originate from a string literal. | NonConstantFormat.c:41:2:41:7 | call to printf | printf |
@@ -82,12 +69,10 @@ subpaths
| nested.cpp:21:23:21:26 | *fmt0 | nested.cpp:42:24:42:34 | *call to ext_fmt_str | nested.cpp:21:23:21:26 | *fmt0 | The format string argument to $@ has a source which cannot be verified to originate from a string literal. | nested.cpp:21:5:21:12 | call to snprintf | snprintf |
| nested.cpp:79:32:79:38 | *call to get_fmt | nested.cpp:79:32:79:38 | *call to get_fmt | nested.cpp:79:32:79:38 | *call to get_fmt | The format string argument to $@ has a source which cannot be verified to originate from a string literal. | nested.cpp:79:5:79:14 | call to diagnostic | diagnostic |
| nested.cpp:87:18:87:20 | *fmt | nested.cpp:86:19:86:46 | *call to __builtin_alloca | nested.cpp:87:18:87:20 | *fmt | The format string argument to $@ has a source which cannot be verified to originate from a string literal. | nested.cpp:87:7:87:16 | call to diagnostic | diagnostic |
-| test.cpp:51:10:51:21 | *call to make_message | test.cpp:46:14:46:17 | argc | test.cpp:51:10:51:21 | *call to make_message | The format string argument to $@ has a source which cannot be verified to originate from a string literal. | test.cpp:51:3:51:8 | call to printf | printf |
| test.cpp:130:20:130:26 | *access to array | test.cpp:46:27:46:30 | **argv | test.cpp:130:20:130:26 | *access to array | The format string argument to $@ has a source which cannot be verified to originate from a string literal. | test.cpp:130:2:130:10 | call to sprintf | sprintf |
-| test.cpp:157:12:157:15 | data | test.cpp:155:27:155:30 | data | test.cpp:157:12:157:15 | data | The format string argument to $@ has a source which cannot be verified to originate from a string literal. | test.cpp:157:5:157:10 | call to printf | printf |
-| test.cpp:170:12:170:14 | *res | test.cpp:167:31:167:34 | data | test.cpp:170:12:170:14 | *res | The format string argument to $@ has a source which cannot be verified to originate from a string literal. | test.cpp:170:5:170:10 | call to printf | printf |
-| test.cpp:195:31:195:33 | str | test.cpp:193:32:193:34 | str | test.cpp:195:31:195:33 | str | The format string argument to $@ has a source which cannot be verified to originate from a string literal. | test.cpp:195:3:195:18 | call to StringCchPrintfW | StringCchPrintfW |
-| test.cpp:197:11:197:14 | *wstr | test.cpp:193:32:193:34 | str | test.cpp:197:11:197:14 | *wstr | The format string argument to $@ has a source which cannot be verified to originate from a string literal. | test.cpp:197:3:197:9 | call to wprintf | wprintf |
+| test.cpp:170:12:170:14 | *res | test.cpp:167:31:167:34 | *data | test.cpp:170:12:170:14 | *res | The format string argument to $@ has a source which cannot be verified to originate from a string literal. | test.cpp:170:5:170:10 | call to printf | printf |
+| test.cpp:195:31:195:33 | *str | test.cpp:193:32:193:34 | *str | test.cpp:195:31:195:33 | *str | The format string argument to $@ has a source which cannot be verified to originate from a string literal. | test.cpp:195:3:195:18 | call to StringCchPrintfW | StringCchPrintfW |
+| test.cpp:197:11:197:14 | *wstr | test.cpp:193:32:193:34 | *str | test.cpp:197:11:197:14 | *wstr | The format string argument to $@ has a source which cannot be verified to originate from a string literal. | test.cpp:197:3:197:9 | call to wprintf | wprintf |
| test.cpp:205:12:205:20 | *... + ... | test.cpp:204:25:204:36 | *call to get_string | test.cpp:205:12:205:20 | *... + ... | The format string argument to $@ has a source which cannot be verified to originate from a string literal. | test.cpp:205:5:205:10 | call to printf | printf |
| test.cpp:206:12:206:16 | *hello | test.cpp:204:25:204:36 | *call to get_string | test.cpp:206:12:206:16 | *hello | The format string argument to $@ has a source which cannot be verified to originate from a string literal. | test.cpp:206:5:206:10 | call to printf | printf |
| test.cpp:211:12:211:16 | *hello | test.cpp:209:25:209:36 | *call to get_string | test.cpp:211:12:211:16 | *hello | The format string argument to $@ has a source which cannot be verified to originate from a string literal. | test.cpp:211:5:211:10 | call to printf | printf |
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/test.cpp
index bc8d0c26bbb..e60db94f9b1 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/test.cpp
+++ b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/test.cpp
@@ -48,7 +48,7 @@ int main(int argc, char **argv) {
printf(choose_message(argc - 1), argc - 1); // GOOD
printf(messages[1]); // GOOD
printf(message); // GOOD
- printf(make_message(argc - 1)); // BAD
+ printf(make_message(argc - 1)); // BAD [NOT DETECTED]
printf("Hello, World\n"); // GOOD
printf(_("Hello, World\n")); // GOOD
{
@@ -154,7 +154,7 @@ void print_ith_message() {
void fmt_via_strcpy(char *data) {
strcpy(data, "some string");
- printf(data); // GOOD [FALSE POSITIVE: Due to inaccurate dataflow killers]
+ printf(data); // GOOD
}
void fmt_with_assignment() {
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/consts/NonConstantFormat.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/consts/NonConstantFormat.expected
index 91f3d367db6..7889b880374 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/consts/NonConstantFormat.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/consts/NonConstantFormat.expected
@@ -23,9 +23,7 @@ edges
| consts.cpp:106:13:106:19 | *call to varFunc | consts.cpp:107:9:107:10 | *v5 | provenance | |
| consts.cpp:111:7:111:13 | *call to varFunc | consts.cpp:112:9:112:10 | *v6 | provenance | |
| consts.cpp:139:13:139:16 | readString output argument | consts.cpp:140:9:140:11 | *v11 | provenance | |
-| consts.cpp:139:13:139:16 | readString output argument | consts.cpp:140:9:140:11 | v11 | provenance | |
| consts.cpp:144:16:144:18 | readStringRef output argument | consts.cpp:145:9:145:11 | *v12 | provenance | |
-| consts.cpp:144:16:144:18 | readStringRef output argument | consts.cpp:145:9:145:11 | v12 | provenance | |
nodes
| consts.cpp:24:7:24:9 | **gv1 | semmle.label | **gv1 |
| consts.cpp:29:7:29:25 | **nonConstFuncToArray | semmle.label | **nonConstFuncToArray |
@@ -47,13 +45,9 @@ nodes
| consts.cpp:130:9:130:10 | *v9 | semmle.label | *v9 |
| consts.cpp:135:9:135:11 | *v10 | semmle.label | *v10 |
| consts.cpp:139:13:139:16 | readString output argument | semmle.label | readString output argument |
-| consts.cpp:139:13:139:16 | readString output argument | semmle.label | readString output argument |
| consts.cpp:140:9:140:11 | *v11 | semmle.label | *v11 |
-| consts.cpp:140:9:140:11 | v11 | semmle.label | v11 |
-| consts.cpp:144:16:144:18 | readStringRef output argument | semmle.label | readStringRef output argument |
| consts.cpp:144:16:144:18 | readStringRef output argument | semmle.label | readStringRef output argument |
| consts.cpp:145:9:145:11 | *v12 | semmle.label | *v12 |
-| consts.cpp:145:9:145:11 | v12 | semmle.label | v12 |
subpaths
#select
| consts.cpp:86:9:86:10 | *v1 | consts.cpp:85:7:85:8 | gets output argument | consts.cpp:86:9:86:10 | *v1 | The format string argument to $@ has a source which cannot be verified to originate from a string literal. | consts.cpp:86:2:86:7 | call to printf | printf |
@@ -78,6 +72,4 @@ subpaths
| consts.cpp:135:9:135:11 | *v10 | consts.cpp:85:7:85:8 | gets output argument | consts.cpp:135:9:135:11 | *v10 | The format string argument to $@ has a source which cannot be verified to originate from a string literal. | consts.cpp:135:2:135:7 | call to printf | printf |
| consts.cpp:135:9:135:11 | *v10 | consts.cpp:90:12:90:13 | gets output argument | consts.cpp:135:9:135:11 | *v10 | The format string argument to $@ has a source which cannot be verified to originate from a string literal. | consts.cpp:135:2:135:7 | call to printf | printf |
| consts.cpp:140:9:140:11 | *v11 | consts.cpp:139:13:139:16 | readString output argument | consts.cpp:140:9:140:11 | *v11 | The format string argument to $@ has a source which cannot be verified to originate from a string literal. | consts.cpp:140:2:140:7 | call to printf | printf |
-| consts.cpp:140:9:140:11 | v11 | consts.cpp:139:13:139:16 | readString output argument | consts.cpp:140:9:140:11 | v11 | The format string argument to $@ has a source which cannot be verified to originate from a string literal. | consts.cpp:140:2:140:7 | call to printf | printf |
| consts.cpp:145:9:145:11 | *v12 | consts.cpp:144:16:144:18 | readStringRef output argument | consts.cpp:145:9:145:11 | *v12 | The format string argument to $@ has a source which cannot be verified to originate from a string literal. | consts.cpp:145:2:145:7 | call to printf | printf |
-| consts.cpp:145:9:145:11 | v12 | consts.cpp:144:16:144:18 | readStringRef output argument | consts.cpp:145:9:145:11 | v12 | The format string argument to $@ has a source which cannot be verified to originate from a string literal. | consts.cpp:145:2:145:7 | call to printf | printf |
From 2345907a52b1f690f2647394bf6d12ef0123dbfe Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Mon, 11 Mar 2024 18:49:03 +0000
Subject: [PATCH 076/309] C++: Reintroduce the 'cannotContainString'
optimization that was removed in #15516.
---
.../Likely Bugs/Format/NonConstantFormat.ql | 32 ++++++++++++++++++-
1 file changed, 31 insertions(+), 1 deletion(-)
diff --git a/cpp/ql/src/Likely Bugs/Format/NonConstantFormat.ql b/cpp/ql/src/Likely Bugs/Format/NonConstantFormat.ql
index b02986e0b68..ee3139f3682 100644
--- a/cpp/ql/src/Likely Bugs/Format/NonConstantFormat.ql
+++ b/cpp/ql/src/Likely Bugs/Format/NonConstantFormat.ql
@@ -37,6 +37,25 @@ class UncalledFunction extends Function {
}
}
+/**
+ * Holds if `t` cannot refer to a string. That is, it's a built-in
+ * or arithmetic type that is not a "`char` like" type.
+ */
+predicate cannotContainString(Type t) {
+ exists(Type unspecified |
+ unspecified = t.getUnspecifiedType() and
+ not unspecified instanceof UnknownType and
+ not unspecified instanceof CharType and
+ not unspecified instanceof WideCharType and
+ not unspecified instanceof Char8Type and
+ not unspecified instanceof Char16Type and
+ not unspecified instanceof Char32Type
+ |
+ unspecified instanceof ArithmeticType or
+ unspecified instanceof BuiltInType
+ )
+}
+
predicate dataFlowOrTaintFlowFunction(Function func, FunctionOutput output) {
func.(DataFlowFunction).hasDataFlow(_, output) or
func.(TaintFunction).hasTaintFlow(_, output)
@@ -132,13 +151,24 @@ predicate isSinkImpl(DataFlow::Node sink, Expr formatString) {
}
module NonConstFlowConfig implements DataFlow::ConfigSig {
- predicate isSource(DataFlow::Node source) { isNonConst(source) }
+ predicate isSource(DataFlow::Node source) {
+ exists(Type t |
+ isNonConst(source) and
+ t = source.getType() and
+ not cannotContainString(t)
+ )
+ }
predicate isSink(DataFlow::Node sink) { isSinkImpl(sink, _) }
predicate isBarrier(DataFlow::Node node) {
// Ignore tracing non-const through array indices
exists(ArrayExpr a | a.getArrayOffset() = node.asIndirectExpr())
+ or
+ exists(Type t |
+ t = node.getType() and
+ cannotContainString(t)
+ )
}
}
From 9854ed4b89f4f0194085504f776a87eb5d3ce57e Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Mon, 11 Mar 2024 18:54:53 +0000
Subject: [PATCH 077/309] C++: Delete comment.
---
cpp/ql/src/Likely Bugs/Format/NonConstantFormat.ql | 2 --
1 file changed, 2 deletions(-)
diff --git a/cpp/ql/src/Likely Bugs/Format/NonConstantFormat.ql b/cpp/ql/src/Likely Bugs/Format/NonConstantFormat.ql
index ee3139f3682..461df854c75 100644
--- a/cpp/ql/src/Likely Bugs/Format/NonConstantFormat.ql
+++ b/cpp/ql/src/Likely Bugs/Format/NonConstantFormat.ql
@@ -110,8 +110,6 @@ predicate isNonConst(DataFlow::Node node) {
(
// Case 1: It's a known dataflow or taintflow function with flow to the return value
exists(Function func, CallInstruction call |
- // NOTE: could use `Call` getAnArgument() instead of `CallInstruction` but requires two
- // variables representing the same call in ordoer to use `callOutput` below.
call.getUnconvertedResultExpression() = node.asIndirectExpr() and
func = call.getStaticCallTarget() and
not exists(FunctionOutput output |
From e82e3180f0ea444915438b3195e2402c60284bf9 Mon Sep 17 00:00:00 2001
From: Tom Hvitved
Date: Fri, 8 Mar 2024 08:47:46 +0100
Subject: [PATCH 078/309] Data flow: Replace `hasLocationInfo` with
`getLocation`
---
shared/dataflow/codeql/dataflow/DataFlow.qll | 65 ++++++++-----------
.../codeql/dataflow/TaintTracking.qll | 12 ++--
.../codeql/dataflow/internal/DataFlowImpl.qll | 61 ++++++-----------
.../dataflow/internal/DataFlowImplCommon.qll | 45 +++----------
.../internal/DataFlowImplConsistency.qll | 14 ++--
.../dataflow/internal/FlowSummaryImpl.qll | 13 ++--
.../codeql/dataflow/test/InlineFlowTest.qll | 14 ++--
7 files changed, 86 insertions(+), 138 deletions(-)
diff --git a/shared/dataflow/codeql/dataflow/DataFlow.qll b/shared/dataflow/codeql/dataflow/DataFlow.qll
index 6a18c166613..ebb9f7c8c25 100644
--- a/shared/dataflow/codeql/dataflow/DataFlow.qll
+++ b/shared/dataflow/codeql/dataflow/DataFlow.qll
@@ -4,8 +4,10 @@
* modules.
*/
+private import codeql.util.Location
+
/** Provides language-specific data flow parameters. */
-signature module InputSig {
+signature module InputSig {
/**
* A node in the data flow graph.
*/
@@ -13,16 +15,8 @@ signature module InputSig {
/** Gets a textual representation of this element. */
string toString();
- /**
- * Holds if this element is at the specified location.
- * The location spans column `startcolumn` of line `startline` to
- * column `endcolumn` of line `endline` in file `filepath`.
- * For more information, see
- * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
- */
- predicate hasLocationInfo(
- string filepath, int startline, int startcolumn, int endline, int endcolumn
- );
+ /** Gets the location of this node. */
+ Location getLocation();
}
class ParameterNode extends Node;
@@ -321,9 +315,9 @@ signature module InputSig {
default predicate ignoreFieldFlowBranchLimit(DataFlowCallable c) { none() }
}
-module Configs {
+module Configs Lang> {
private import Lang
- private import internal.DataFlowImplCommon::MakeImplCommon
+ private import internal.DataFlowImplCommon::MakeImplCommon
import DataFlowImplCommonPublic
/** An input configuration for data flow. */
@@ -531,10 +525,10 @@ module Configs {
}
}
-module DataFlowMake {
+module DataFlowMake Lang> {
private import Lang
- private import internal.DataFlowImpl::MakeImpl
- import Configs
+ private import internal.DataFlowImpl::MakeImpl
+ import Configs
/**
* Gets the exploration limit for `partialFlow` and `partialFlowRev`
@@ -613,19 +607,11 @@ module DataFlowMake {
/** Gets a textual representation of this element. */
string toString();
- /**
- * Holds if this element is at the specified location.
- * The location spans column `startcolumn` of line `startline` to
- * column `endcolumn` of line `endline` in file `filepath`.
- * For more information, see
- * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
- */
- predicate hasLocationInfo(
- string filepath, int startline, int startcolumn, int endline, int endcolumn
- );
-
/** Gets the underlying `Node`. */
Node getNode();
+
+ /** Gets the location of this node. */
+ Location getLocation();
}
signature module PathGraphSig {
@@ -668,6 +654,15 @@ module DataFlowMake {
result = this.asPathNode2().toString()
}
+ /** Gets the underlying `Node`. */
+ Node getNode() {
+ result = this.asPathNode1().getNode() or
+ result = this.asPathNode2().getNode()
+ }
+
+ /** Gets the location of this node. */
+ Location getLocation() { result = this.getNode().getLocation() }
+
/**
* Holds if this element is at the specified location.
* The location spans column `startcolumn` of line `startline` to
@@ -675,17 +670,10 @@ module DataFlowMake {
* For more information, see
* [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
*/
- predicate hasLocationInfo(
+ deprecated predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
- this.asPathNode1().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn) or
- this.asPathNode2().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
- }
-
- /** Gets the underlying `Node`. */
- Node getNode() {
- result = this.asPathNode1().getNode() or
- result = this.asPathNode2().getNode()
+ this.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
}
}
@@ -750,7 +738,7 @@ module DataFlowMake {
* For more information, see
* [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
*/
- predicate hasLocationInfo(
+ deprecated predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
super.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
@@ -758,6 +746,9 @@ module DataFlowMake {
/** Gets the underlying `Node`. */
Node getNode() { result = super.getNode() }
+
+ /** Gets the location of this node. */
+ Location getLocation() { result = super.getLocation() }
}
/**
diff --git a/shared/dataflow/codeql/dataflow/TaintTracking.qll b/shared/dataflow/codeql/dataflow/TaintTracking.qll
index 73960fbca1d..c7d4f6bf505 100644
--- a/shared/dataflow/codeql/dataflow/TaintTracking.qll
+++ b/shared/dataflow/codeql/dataflow/TaintTracking.qll
@@ -5,11 +5,12 @@
private import DataFlow as DF
private import internal.DataFlowImpl
+private import codeql.util.Location
/**
* Provides language-specific taint-tracking parameters.
*/
-signature module InputSig {
+signature module InputSig Lang> {
/**
* Holds if `node` should be a sanitizer in all global taint flow configurations
* but not in local taint.
@@ -33,10 +34,13 @@ signature module InputSig {
/**
* Construct the modules for taint-tracking analyses.
*/
-module TaintFlowMake TaintTrackingLang> {
+module TaintFlowMake<
+ LocationSig Location, DF::InputSig DataFlowLang,
+ InputSig TaintTrackingLang>
+{
private import TaintTrackingLang
- private import DF::DataFlowMake as DataFlow
- private import MakeImpl as DataFlowInternal
+ private import DF::DataFlowMake as DataFlow
+ private import MakeImpl as DataFlowInternal
private module AddTaintDefaults implements
DataFlowInternal::FullStateConfigSig
diff --git a/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll b/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll
index d555b281710..1db7a258181 100644
--- a/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll
+++ b/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll
@@ -7,12 +7,13 @@
private import codeql.util.Unit
private import codeql.util.Option
private import codeql.util.Boolean
+private import codeql.util.Location
private import codeql.dataflow.DataFlow
-module MakeImpl {
+module MakeImpl Lang> {
private import Lang
- private import DataFlowMake
- private import DataFlowImplCommon::MakeImplCommon
+ private import DataFlowMake
+ private import DataFlowImplCommon::MakeImplCommon
private import DataFlowImplCommonPublic
/**
@@ -192,11 +193,7 @@ module MakeImpl {
pragma[only_bind_out](this).getDataFlowType0() = pragma[only_bind_into](result)
}
- predicate hasLocationInfo(
- string filepath, int startline, int startcolumn, int endline, int endcolumn
- ) {
- this.projectToNode().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
- }
+ Location getLocation() { result = this.projectToNode().getLocation() }
}
private class ArgNodeEx extends NodeEx {
@@ -3305,11 +3302,7 @@ module MakeImpl {
override string toString() { result = p + concat(" : " + ppReprType(t)) + " " + ap }
- predicate hasLocationInfo(
- string filepath, int startline, int startcolumn, int endline, int endcolumn
- ) {
- p.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
- }
+ Location getLocation() { result = p.getLocation() }
}
/**
@@ -3727,18 +3720,8 @@ module MakeImpl {
this.ppSummaryCtx()
}
- /**
- * Holds if this element is at the specified location.
- * The location spans column `startcolumn` of line `startline` to
- * column `endcolumn` of line `endline` in file `filepath`.
- * For more information, see
- * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
- */
- predicate hasLocationInfo(
- string filepath, int startline, int startcolumn, int endline, int endcolumn
- ) {
- this.getNodeEx().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
- }
+ /** Gets the location of this node. */
+ Location getLocation() { result = this.getNodeEx().getLocation() }
}
/** Holds if `n` can reach a sink. */
@@ -3774,6 +3757,9 @@ module MakeImpl {
*/
final string toStringWithContext() { result = super.toStringWithContext() }
+ /** Gets the location of this node. */
+ Location getLocation() { result = super.getLocation() }
+
/**
* Holds if this element is at the specified location.
* The location spans column `startcolumn` of line `startline` to
@@ -3781,10 +3767,11 @@ module MakeImpl {
* For more information, see
* [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
*/
- final predicate hasLocationInfo(
+ pragma[inline]
+ deprecated final predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
- super.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+ this.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
}
/** Gets the underlying `Node`. */
@@ -3945,12 +3932,6 @@ module MakeImpl {
override predicate isSource() { none() }
override string toString() { result = sourceGroup }
-
- override predicate hasLocationInfo(
- string filepath, int startline, int startcolumn, int endline, int endcolumn
- ) {
- filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
- }
}
private class PathNodeSinkGroup extends PathNodeImpl, TPathNodeSinkGroup {
@@ -3967,12 +3948,6 @@ module MakeImpl {
override predicate isSource() { none() }
override string toString() { result = sinkGroup }
-
- override predicate hasLocationInfo(
- string filepath, int startline, int startcolumn, int endline, int endcolumn
- ) {
- filepath = "" and startline = 0 and startcolumn = 0 and endline = 0 and endcolumn = 0
- }
}
private predicate pathNode(
@@ -4801,6 +4776,9 @@ module MakeImpl {
result = this.getNodeEx().toString() + this.ppType() + this.ppAp() + this.ppCtx()
}
+ /** Gets the location of this node. */
+ Location getLocation() { result = this.getNodeEx().getLocation() }
+
/**
* Holds if this element is at the specified location.
* The location spans column `startcolumn` of line `startline` to
@@ -4808,10 +4786,11 @@ module MakeImpl {
* For more information, see
* [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
*/
- predicate hasLocationInfo(
+ pragma[inline]
+ deprecated predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
- this.getNodeEx().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+ this.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
}
/** Gets the underlying `Node`. */
diff --git a/shared/dataflow/codeql/dataflow/internal/DataFlowImplCommon.qll b/shared/dataflow/codeql/dataflow/internal/DataFlowImplCommon.qll
index 679be2cb5c6..1caf76de7bc 100644
--- a/shared/dataflow/codeql/dataflow/internal/DataFlowImplCommon.qll
+++ b/shared/dataflow/codeql/dataflow/internal/DataFlowImplCommon.qll
@@ -1,8 +1,9 @@
private import codeql.dataflow.DataFlow
private import codeql.typetracking.TypeTracking as Tt
+private import codeql.util.Location
private import codeql.util.Unit
-module MakeImplCommon {
+module MakeImplCommon Lang> {
private import Lang
import Cached
@@ -1642,19 +1643,15 @@ module MakeImplCommon {
}
}
+ final private class NodeFinal = Node;
+
/**
* A `Node` at which a cast can occur such that the type should be checked.
*/
- class CastingNode instanceof Node {
+ class CastingNode extends NodeFinal {
CastingNode() { castingNode(this) }
string toString() { result = super.toString() }
-
- predicate hasLocationInfo(
- string filepath, int startline, int startcolumn, int endline, int endcolumn
- ) {
- super.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
- }
}
private predicate readStepWithTypes(
@@ -1800,17 +1797,11 @@ module MakeImplCommon {
* The value of a parameter at function entry, viewed as a node in a data
* flow graph.
*/
- class ParamNode instanceof Node {
+ class ParamNode extends NodeFinal {
ParamNode() { parameterNode(this, _, _) }
string toString() { result = super.toString() }
- predicate hasLocationInfo(
- string filepath, int startline, int startcolumn, int endline, int endcolumn
- ) {
- super.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
- }
-
/**
* Holds if this node is the parameter of callable `c` at the specified
* position.
@@ -1821,17 +1812,11 @@ module MakeImplCommon {
}
/** A data-flow node that represents a call argument. */
- class ArgNode instanceof Node {
+ class ArgNode extends NodeFinal {
ArgNode() { argumentNode(this, _, _) }
string toString() { result = super.toString() }
- predicate hasLocationInfo(
- string filepath, int startline, int startcolumn, int endline, int endcolumn
- ) {
- super.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
- }
-
/** Holds if this argument occurs at the given position in the given call. */
final predicate argumentOf(DataFlowCall call, ArgumentPosition pos) {
argumentNode(this, call, pos)
@@ -1842,17 +1827,11 @@ module MakeImplCommon {
* A node from which flow can return to the caller. This is either a regular
* `ReturnNode` or a `PostUpdateNode` corresponding to the value of a parameter.
*/
- class ReturnNodeExt instanceof Node {
+ class ReturnNodeExt extends NodeFinal {
ReturnNodeExt() { returnNodeExt(this, _) }
string toString() { result = super.toString() }
- predicate hasLocationInfo(
- string filepath, int startline, int startcolumn, int endline, int endcolumn
- ) {
- super.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
- }
-
/** Gets the kind of this returned value. */
ReturnKindExt getKind() { returnNodeExt(this, result) }
}
@@ -1861,16 +1840,10 @@ module MakeImplCommon {
* A node to which data can flow from a call. Either an ordinary out node
* or a post-update node associated with a call argument.
*/
- class OutNodeExt instanceof Node {
+ class OutNodeExt extends NodeFinal {
OutNodeExt() { outNodeExt(this) }
string toString() { result = super.toString() }
-
- predicate hasLocationInfo(
- string filepath, int startline, int startcolumn, int endline, int endcolumn
- ) {
- super.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
- }
}
/**
diff --git a/shared/dataflow/codeql/dataflow/internal/DataFlowImplConsistency.qll b/shared/dataflow/codeql/dataflow/internal/DataFlowImplConsistency.qll
index 374d42e9ad5..1d0f8d1969d 100644
--- a/shared/dataflow/codeql/dataflow/internal/DataFlowImplConsistency.qll
+++ b/shared/dataflow/codeql/dataflow/internal/DataFlowImplConsistency.qll
@@ -5,8 +5,9 @@
private import codeql.dataflow.DataFlow as DF
private import codeql.dataflow.TaintTracking as TT
+private import codeql.util.Location
-signature module InputSig {
+signature module InputSig DataFlowLang> {
/** Holds if `n` should be excluded from the consistency test `uniqueEnclosingCallable`. */
default predicate uniqueEnclosingCallableExclude(DataFlowLang::Node n) { none() }
@@ -71,8 +72,8 @@ signature module InputSig {
}
module MakeConsistency<
- DF::InputSig DataFlowLang, TT::InputSig TaintTrackingLang,
- InputSig Input>
+ LocationSig Location, DF::InputSig DataFlowLang,
+ TT::InputSig TaintTrackingLang, InputSig Input>
{
private import DataFlowLang
private import TaintTrackingLang
@@ -128,10 +129,7 @@ module MakeConsistency<
query predicate uniqueNodeLocation(Node n, string msg) {
exists(int c |
- c =
- count(string filepath, int startline, int startcolumn, int endline, int endcolumn |
- n.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
- ) and
+ c = count(n.getLocation()) and
c != 1 and
not Input::uniqueNodeLocationExclude(n) and
msg = "Node should have one location but has " + c + "."
@@ -142,7 +140,7 @@ module MakeConsistency<
exists(int c |
c =
strictcount(Node n |
- not n.hasLocationInfo(_, _, _, _, _) and
+ not exists(n.getLocation()) and
not Input::missingLocationExclude(n)
) and
msg = "Nodes without location: " + c
diff --git a/shared/dataflow/codeql/dataflow/internal/FlowSummaryImpl.qll b/shared/dataflow/codeql/dataflow/internal/FlowSummaryImpl.qll
index f3e840720ab..4d6df294521 100644
--- a/shared/dataflow/codeql/dataflow/internal/FlowSummaryImpl.qll
+++ b/shared/dataflow/codeql/dataflow/internal/FlowSummaryImpl.qll
@@ -10,7 +10,7 @@ private import AccessPathSyntax as AccessPathSyntax
/**
* Provides language-specific parameters.
*/
-signature module InputSig {
+signature module InputSig Lang> {
/**
* A base class of callables that are candidates for flow summary modeling.
*/
@@ -139,10 +139,12 @@ signature module InputSig {
}
}
-module Make Input> {
+module Make<
+ LocationSig Location, DF::InputSig DataFlowLang, InputSig Input>
+{
private import DataFlowLang
private import Input
- private import codeql.dataflow.internal.DataFlowImplCommon::MakeImplCommon
+ private import codeql.dataflow.internal.DataFlowImplCommon::MakeImplCommon
private import codeql.util.Unit
final private class SummarizedCallableBaseFinal = SummarizedCallableBase;
@@ -1457,7 +1459,7 @@ module Make Input> {
AccessPathSyntax::parseInt(part.getArgumentList()) < 0
}
- signature module SourceSinkInterpretationInputSig {
+ signature module SourceSinkInterpretationInputSig {
class Element {
string toString();
@@ -1523,8 +1525,7 @@ module Make Input> {
* Should eventually be replaced with API graphs like in dynamic languages.
*/
module SourceSinkInterpretation<
- LocationSig Location,
- SourceSinkInterpretationInputSig SourceSinkInterpretationInput>
+ SourceSinkInterpretationInputSig SourceSinkInterpretationInput>
{
private import SourceSinkInterpretationInput
diff --git a/shared/dataflow/codeql/dataflow/test/InlineFlowTest.qll b/shared/dataflow/codeql/dataflow/test/InlineFlowTest.qll
index 22a55f5aa07..e35d1332bca 100644
--- a/shared/dataflow/codeql/dataflow/test/InlineFlowTest.qll
+++ b/shared/dataflow/codeql/dataflow/test/InlineFlowTest.qll
@@ -29,8 +29,9 @@
private import codeql.dataflow.DataFlow as DF
private import codeql.dataflow.TaintTracking as TT
private import codeql.util.test.InlineExpectationsTest as IET
+private import codeql.util.Location
-signature module InputSig {
+signature module InputSig DataFlowLang> {
predicate defaultSource(DataFlowLang::Node source);
predicate defaultSink(DataFlowLang::Node source);
@@ -40,12 +41,13 @@ signature module InputSig {
}
module InlineFlowTestMake<
- DF::InputSig DataFlowLang, TT::InputSig TaintTrackingLang,
- IET::InlineExpectationsTestSig Test, InputSig Impl>
+ LocationSig Location, DF::InputSig DataFlowLang,
+ TT::InputSig TaintTrackingLang, IET::InlineExpectationsTestSig Test,
+ InputSig Impl>
{
- private module DataFlow = DF::DataFlowMake;
+ private module DataFlow = DF::DataFlowMake;
- private module TaintTracking = TT::TaintFlowMake;
+ private module TaintTracking = TT::TaintFlowMake;
private module InlineExpectationsTest = IET::Make;
@@ -76,7 +78,7 @@ module InlineFlowTestMake<
private predicate hasLocationInfo(DataFlowLang::Node node, Test::Location location) {
exists(string filepath, int startline, int startcolumn, int endline, int endcolumn |
- node.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn) and
+ node.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn) and
location.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
)
}
From 4291290277e7e1618e4902fd17ababe22c146cd6 Mon Sep 17 00:00:00 2001
From: Tom Hvitved
Date: Fri, 8 Mar 2024 09:04:29 +0100
Subject: [PATCH 079/309] Ruby: Implement new data flow interface
---
ruby/ql/consistency-queries/DataFlowConsistency.ql | 4 ++--
ruby/ql/lib/codeql/ruby/DataFlow.qll | 2 +-
ruby/ql/lib/codeql/ruby/TaintTracking.qll | 3 ++-
ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl.qll | 3 ++-
.../lib/codeql/ruby/dataflow/internal/DataFlowImplCommon.qll | 3 ++-
.../codeql/ruby/dataflow/internal/DataFlowImplSpecific.qll | 3 ++-
ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowPublic.qll | 2 +-
.../ql/lib/codeql/ruby/dataflow/internal/FlowSummaryImpl.qll | 4 ++--
.../ruby/dataflow/internal/TaintTrackingImplSpecific.qll | 3 ++-
ruby/ql/test/TestUtilities/InlineFlowTest.qll | 5 +++--
10 files changed, 19 insertions(+), 13 deletions(-)
diff --git a/ruby/ql/consistency-queries/DataFlowConsistency.ql b/ruby/ql/consistency-queries/DataFlowConsistency.ql
index d064eeb3701..76155d5d1c1 100644
--- a/ruby/ql/consistency-queries/DataFlowConsistency.ql
+++ b/ruby/ql/consistency-queries/DataFlowConsistency.ql
@@ -5,7 +5,7 @@ private import codeql.ruby.dataflow.internal.DataFlowImplSpecific
private import codeql.ruby.dataflow.internal.TaintTrackingImplSpecific
private import codeql.dataflow.internal.DataFlowImplConsistency
-private module Input implements InputSig {
+private module Input implements InputSig {
private import RubyDataFlow
predicate postWithInFlowExclude(Node n) { n instanceof FlowSummaryNode }
@@ -46,4 +46,4 @@ private module Input implements InputSig {
}
}
-import MakeConsistency
+import MakeConsistency
diff --git a/ruby/ql/lib/codeql/ruby/DataFlow.qll b/ruby/ql/lib/codeql/ruby/DataFlow.qll
index aa6e7e0cd59..f17c85143f5 100644
--- a/ruby/ql/lib/codeql/ruby/DataFlow.qll
+++ b/ruby/ql/lib/codeql/ruby/DataFlow.qll
@@ -12,6 +12,6 @@ import codeql.Locations
module DataFlow {
private import codeql.ruby.dataflow.internal.DataFlowImplSpecific
private import codeql.dataflow.DataFlow
- import DataFlowMake
+ import DataFlowMake
import codeql.ruby.dataflow.internal.DataFlowImpl1
}
diff --git a/ruby/ql/lib/codeql/ruby/TaintTracking.qll b/ruby/ql/lib/codeql/ruby/TaintTracking.qll
index 461a423e1f1..7534b28079a 100644
--- a/ruby/ql/lib/codeql/ruby/TaintTracking.qll
+++ b/ruby/ql/lib/codeql/ruby/TaintTracking.qll
@@ -7,6 +7,7 @@ module TaintTracking {
private import codeql.ruby.dataflow.internal.DataFlowImplSpecific
private import codeql.ruby.dataflow.internal.TaintTrackingImplSpecific
private import codeql.dataflow.TaintTracking
- import TaintFlowMake
+ private import codeql.Locations
+ import TaintFlowMake
import codeql.ruby.dataflow.internal.tainttracking1.TaintTrackingImpl
}
diff --git a/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl.qll b/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl.qll
index 277b639d0ab..21ceca9e3b5 100644
--- a/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl.qll
+++ b/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl.qll
@@ -1,3 +1,4 @@
+private import codeql.Locations
private import DataFlowImplSpecific
private import codeql.dataflow.internal.DataFlowImpl
-import MakeImpl
+import MakeImpl
diff --git a/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImplCommon.qll b/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImplCommon.qll
index 05e0bc67b30..0b0e883803e 100644
--- a/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImplCommon.qll
+++ b/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImplCommon.qll
@@ -1,3 +1,4 @@
+private import codeql.Locations
private import DataFlowImplSpecific
private import codeql.dataflow.internal.DataFlowImplCommon
-import MakeImplCommon
+import MakeImplCommon
diff --git a/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImplSpecific.qll b/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImplSpecific.qll
index 7a8e6dad9f8..b342537b053 100644
--- a/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImplSpecific.qll
+++ b/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImplSpecific.qll
@@ -2,6 +2,7 @@
* Provides Ruby-specific definitions for use in the data flow library.
*/
+private import codeql.Locations
private import codeql.dataflow.DataFlow
module Private {
@@ -13,7 +14,7 @@ module Public {
import DataFlowPublic
}
-module RubyDataFlow implements InputSig {
+module RubyDataFlow implements InputSig {
import Private
import Public
diff --git a/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowPublic.qll b/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowPublic.qll
index 8d0c565a737..c1c625a2316 100644
--- a/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowPublic.qll
+++ b/ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowPublic.qll
@@ -35,7 +35,7 @@ class Node extends TNode {
* For more information, see
* [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
*/
- predicate hasLocationInfo(
+ deprecated predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
this.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
diff --git a/ruby/ql/lib/codeql/ruby/dataflow/internal/FlowSummaryImpl.qll b/ruby/ql/lib/codeql/ruby/dataflow/internal/FlowSummaryImpl.qll
index 59f8e541b3d..d0beb44ac7b 100644
--- a/ruby/ql/lib/codeql/ruby/dataflow/internal/FlowSummaryImpl.qll
+++ b/ruby/ql/lib/codeql/ruby/dataflow/internal/FlowSummaryImpl.qll
@@ -9,7 +9,7 @@ private import codeql.ruby.dataflow.internal.DataFlowImplSpecific as DataFlowImp
private import DataFlowImplSpecific::Private
private import DataFlowImplSpecific::Public
-module Input implements InputSig {
+module Input implements InputSig {
class SummarizedCallableBase = string;
ArgumentPosition callbackSelfParameterPosition() { result.isLambdaSelf() }
@@ -146,7 +146,7 @@ module Input implements InputSig {
}
}
-private import Make as Impl
+private import Make as Impl
private module StepsInput implements Impl::Private::StepsInputSig {
DataFlowCall getACall(Public::SummarizedCallable sc) {
diff --git a/ruby/ql/lib/codeql/ruby/dataflow/internal/TaintTrackingImplSpecific.qll b/ruby/ql/lib/codeql/ruby/dataflow/internal/TaintTrackingImplSpecific.qll
index fe733ee5d95..987aefdda72 100644
--- a/ruby/ql/lib/codeql/ruby/dataflow/internal/TaintTrackingImplSpecific.qll
+++ b/ruby/ql/lib/codeql/ruby/dataflow/internal/TaintTrackingImplSpecific.qll
@@ -2,9 +2,10 @@
* Provides Ruby-specific definitions for use in the taint tracking library.
*/
+private import codeql.Locations
private import codeql.dataflow.TaintTracking
private import DataFlowImplSpecific
-module RubyTaintTracking implements InputSig {
+module RubyTaintTracking implements InputSig {
import TaintTrackingPrivate
}
diff --git a/ruby/ql/test/TestUtilities/InlineFlowTest.qll b/ruby/ql/test/TestUtilities/InlineFlowTest.qll
index c9ceda9dff5..7d8a4cb03b8 100644
--- a/ruby/ql/test/TestUtilities/InlineFlowTest.qll
+++ b/ruby/ql/test/TestUtilities/InlineFlowTest.qll
@@ -4,12 +4,13 @@
*/
import ruby
+private import codeql.Locations
private import codeql.dataflow.test.InlineFlowTest
private import codeql.ruby.dataflow.internal.DataFlowImplSpecific
private import codeql.ruby.dataflow.internal.TaintTrackingImplSpecific
private import internal.InlineExpectationsTestImpl
-private module FlowTestImpl implements InputSig {
+private module FlowTestImpl implements InputSig {
import TestUtilities.InlineFlowTestUtil
bindingset[src, sink]
@@ -19,4 +20,4 @@ private module FlowTestImpl implements InputSig {
}
}
-import InlineFlowTestMake
+import InlineFlowTestMake
From 257686eb9a3554d8d602c98be2baaaa67fe8effc Mon Sep 17 00:00:00 2001
From: Tom Hvitved
Date: Fri, 8 Mar 2024 09:14:09 +0100
Subject: [PATCH 080/309] C#: Implement new data flow interface
---
csharp/ql/consistency-queries/DataFlowConsistency.ql | 4 ++--
csharp/ql/lib/semmle/code/csharp/dataflow/DataFlow.qll | 2 +-
.../ql/lib/semmle/code/csharp/dataflow/TaintTracking.qll | 2 +-
.../semmle/code/csharp/dataflow/internal/DataFlowImpl.qll | 3 ++-
.../code/csharp/dataflow/internal/DataFlowImplCommon.qll | 3 ++-
.../csharp/dataflow/internal/DataFlowImplSpecific.qll | 3 ++-
.../code/csharp/dataflow/internal/DataFlowPublic.qll | 2 +-
.../code/csharp/dataflow/internal/FlowSummaryImpl.qll | 8 ++++----
.../dataflow/internal/TaintTrackingImplSpecific.qll | 3 ++-
csharp/ql/test/TestUtilities/InlineFlowTest.qll | 4 ++--
10 files changed, 19 insertions(+), 15 deletions(-)
diff --git a/csharp/ql/consistency-queries/DataFlowConsistency.ql b/csharp/ql/consistency-queries/DataFlowConsistency.ql
index 1ee888329c7..2f34368b669 100644
--- a/csharp/ql/consistency-queries/DataFlowConsistency.ql
+++ b/csharp/ql/consistency-queries/DataFlowConsistency.ql
@@ -4,7 +4,7 @@ private import semmle.code.csharp.dataflow.internal.DataFlowImplSpecific
private import semmle.code.csharp.dataflow.internal.TaintTrackingImplSpecific
private import codeql.dataflow.internal.DataFlowImplConsistency
-private module Input implements InputSig {
+private module Input implements InputSig {
private import CsharpDataFlow
private predicate isStaticAssignable(Assignable a) { a.(Modifiable).isStatic() }
@@ -99,4 +99,4 @@ private module Input implements InputSig {
}
}
-import MakeConsistency
+import MakeConsistency
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/DataFlow.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/DataFlow.qll
index 17e698dce2d..0fc12debaa8 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/DataFlow.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/DataFlow.qll
@@ -8,6 +8,6 @@ import csharp
module DataFlow {
private import semmle.code.csharp.dataflow.internal.DataFlowImplSpecific
private import codeql.dataflow.DataFlow
- import DataFlowMake
+ import DataFlowMake
import semmle.code.csharp.dataflow.internal.DataFlowImpl1
}
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/TaintTracking.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/TaintTracking.qll
index 7243d36b05d..fb39294ed23 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/TaintTracking.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/TaintTracking.qll
@@ -10,6 +10,6 @@ module TaintTracking {
private import semmle.code.csharp.dataflow.internal.DataFlowImplSpecific
private import semmle.code.csharp.dataflow.internal.TaintTrackingImplSpecific
private import codeql.dataflow.TaintTracking
- import TaintFlowMake
+ import TaintFlowMake
import semmle.code.csharp.dataflow.internal.tainttracking1.TaintTrackingImpl
}
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll
index 4cf39afc812..09e47bdd831 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll
@@ -1,3 +1,4 @@
+private import semmle.code.csharp.Location
private import DataFlowImplSpecific
private import codeql.dataflow.internal.DataFlowImpl
-import MakeImpl
+import MakeImpl
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplCommon.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplCommon.qll
index 55829d7d059..72ccd3152da 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplCommon.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplCommon.qll
@@ -1,3 +1,4 @@
+private import semmle.code.csharp.Location
private import DataFlowImplSpecific
private import codeql.dataflow.internal.DataFlowImplCommon
-import MakeImplCommon
+import MakeImplCommon
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplSpecific.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplSpecific.qll
index 774dc6bd86a..af104d777b8 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplSpecific.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplSpecific.qll
@@ -2,6 +2,7 @@
* Provides C#-specific definitions for use in the data flow library.
*/
+private import semmle.code.csharp.Location
private import codeql.dataflow.DataFlow
module Private {
@@ -13,7 +14,7 @@ module Public {
import DataFlowPublic
}
-module CsharpDataFlow implements InputSig {
+module CsharpDataFlow implements InputSig {
import Private
import Public
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPublic.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPublic.qll
index bf30fe5112d..20e3dd8eb7d 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPublic.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPublic.qll
@@ -58,7 +58,7 @@ class Node extends TNode {
* For more information, see
* [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
*/
- predicate hasLocationInfo(
+ deprecated predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
this.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll
index 19972a86ab6..8c76fc3d1a7 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll
@@ -12,7 +12,7 @@ private import DataFlowImplSpecific::Public
private import semmle.code.csharp.Unification
private import semmle.code.csharp.dataflow.internal.ExternalFlow
-module Input implements InputSig {
+module Input implements InputSig {
class SummarizedCallableBase = UnboundCallable;
ArgumentPosition callbackSelfParameterPosition() { result.isDelegateSelf() }
@@ -80,7 +80,7 @@ module Input implements InputSig {
}
}
-private import Make as Impl
+private import Make as Impl
private module TypesInput implements Impl::Private::TypesInputSig {
DataFlowType getSyntheticGlobalType(Impl::Private::SyntheticGlobal sg) {
@@ -154,7 +154,7 @@ private module StepsInput implements Impl::Private::StepsInputSig {
}
module SourceSinkInterpretationInput implements
- Impl::Private::External::SourceSinkInterpretationInputSig
+ Impl::Private::External::SourceSinkInterpretationInputSig
{
private import csharp as Cs
@@ -252,7 +252,7 @@ module Private {
module External {
import Impl::Private::External
- import Impl::Private::External::SourceSinkInterpretation
+ import Impl::Private::External::SourceSinkInterpretation
}
private module SummaryComponentInternal = Impl::Private::SummaryComponent;
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/TaintTrackingImplSpecific.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/TaintTrackingImplSpecific.qll
index 17a0d2c3c1a..b33d582021f 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/TaintTrackingImplSpecific.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/TaintTrackingImplSpecific.qll
@@ -2,9 +2,10 @@
* Provides C#-specific definitions for use in the taint tracking library.
*/
+private import semmle.code.csharp.Location
private import codeql.dataflow.TaintTracking
private import DataFlowImplSpecific
-module CsharpTaintTracking implements InputSig {
+module CsharpTaintTracking implements InputSig {
import TaintTrackingPrivate
}
diff --git a/csharp/ql/test/TestUtilities/InlineFlowTest.qll b/csharp/ql/test/TestUtilities/InlineFlowTest.qll
index b7d7226e812..bf7463535e1 100644
--- a/csharp/ql/test/TestUtilities/InlineFlowTest.qll
+++ b/csharp/ql/test/TestUtilities/InlineFlowTest.qll
@@ -9,7 +9,7 @@ private import semmle.code.csharp.dataflow.internal.DataFlowImplSpecific
private import semmle.code.csharp.dataflow.internal.TaintTrackingImplSpecific
private import internal.InlineExpectationsTestImpl
-private module FlowTestImpl implements InputSig {
+private module FlowTestImpl implements InputSig {
predicate defaultSource(DataFlow::Node source) {
source.asExpr().(MethodCall).getTarget().getUndecoratedName() = ["Source", "Taint"]
}
@@ -35,4 +35,4 @@ private module FlowTestImpl implements InputSig {
}
}
-import InlineFlowTestMake
+import InlineFlowTestMake
From 1c57e996860357f0bc73987256ff6de496139b02 Mon Sep 17 00:00:00 2001
From: Tom Hvitved
Date: Fri, 8 Mar 2024 09:48:37 +0100
Subject: [PATCH 081/309] C++: Implement new data flow interface
---
cpp/ql/lib/semmle/code/cpp/dataflow/DataFlow.qll | 2 +-
cpp/ql/lib/semmle/code/cpp/dataflow/TaintTracking.qll | 2 +-
cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll | 3 ++-
.../semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll | 3 ++-
.../code/cpp/dataflow/internal/DataFlowImplConsistency.qll | 4 ++--
.../code/cpp/dataflow/internal/DataFlowImplSpecific.qll | 3 ++-
cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll | 2 +-
.../code/cpp/dataflow/internal/TaintTrackingImplSpecific.qll | 3 ++-
cpp/ql/lib/semmle/code/cpp/dataflow/new/DataFlow.qll | 2 +-
cpp/ql/lib/semmle/code/cpp/dataflow/new/TaintTracking.qll | 3 ++-
cpp/ql/lib/semmle/code/cpp/ir/dataflow/DataFlow.qll | 2 +-
cpp/ql/lib/semmle/code/cpp/ir/dataflow/TaintTracking.qll | 2 +-
.../lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll | 3 ++-
.../code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll | 3 ++-
.../code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll | 4 ++--
.../code/cpp/ir/dataflow/internal/DataFlowImplSpecific.qll | 3 ++-
.../lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll | 2 +-
.../cpp/ir/dataflow/internal/TaintTrackingImplSpecific.qll | 3 ++-
18 files changed, 29 insertions(+), 20 deletions(-)
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/DataFlow.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/DataFlow.qll
index 43bf134ea79..505b2e190e5 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/DataFlow.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/DataFlow.qll
@@ -28,6 +28,6 @@ import cpp
deprecated module DataFlow {
private import semmle.code.cpp.dataflow.internal.DataFlowImplSpecific
private import codeql.dataflow.DataFlow
- import DataFlowMake
+ import DataFlowMake
import semmle.code.cpp.dataflow.internal.DataFlowImpl1
}
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/TaintTracking.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/TaintTracking.qll
index 8a8db1bdcce..1f93e2a74df 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/TaintTracking.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/TaintTracking.qll
@@ -29,6 +29,6 @@ deprecated module TaintTracking {
private import semmle.code.cpp.dataflow.internal.DataFlowImplSpecific
private import semmle.code.cpp.dataflow.internal.TaintTrackingImplSpecific
private import codeql.dataflow.TaintTracking
- import TaintFlowMake
+ import TaintFlowMake
import semmle.code.cpp.dataflow.internal.tainttracking1.TaintTrackingImpl
}
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll
index 115e145bec0..2038b14880a 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll
@@ -2,6 +2,7 @@
* DEPRECATED: Use `semmle.code.cpp.dataflow.new.DataFlow` instead.
*/
+private import semmle.code.cpp.Location
private import DataFlowImplSpecific
private import codeql.dataflow.internal.DataFlowImpl
-import MakeImpl
+import MakeImpl
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll
index 5d61aac1561..b6e72884fa8 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll
@@ -2,6 +2,7 @@
* DEPRECATED: Use `semmle.code.cpp.dataflow.new.DataFlow` instead.
*/
+private import semmle.code.cpp.Location
private import DataFlowImplSpecific
private import codeql.dataflow.internal.DataFlowImplCommon
-import MakeImplCommon
+import MakeImplCommon
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplConsistency.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplConsistency.qll
index 8abc7a8760a..558bb80f368 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplConsistency.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplConsistency.qll
@@ -10,7 +10,7 @@ private import DataFlowImplSpecific
private import TaintTrackingImplSpecific
private import codeql.dataflow.internal.DataFlowImplConsistency
-private module Input implements InputSig {
+private module Input implements InputSig {
predicate argHasPostUpdateExclude(Private::ArgumentNode n) {
// Is the null pointer (or something that's not really a pointer)
exists(n.asExpr().getValue())
@@ -26,4 +26,4 @@ private module Input implements InputSig {
}
}
-module Consistency = MakeConsistency;
+module Consistency = MakeConsistency;
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplSpecific.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplSpecific.qll
index e8686419aac..f2e9ffc6988 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplSpecific.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplSpecific.qll
@@ -4,6 +4,7 @@
* Provides C++-specific definitions for use in the data flow library.
*/
+private import semmle.code.cpp.Location
private import codeql.dataflow.DataFlow
module Private {
@@ -15,7 +16,7 @@ module Public {
import DataFlowUtil
}
-module CppOldDataFlow implements InputSig {
+module CppOldDataFlow implements InputSig {
import Private
import Public
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll
index 83efaf1511f..0b932e7f05f 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll
@@ -105,7 +105,7 @@ class Node extends TNode {
* For more information, see
* [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
*/
- predicate hasLocationInfo(
+ deprecated predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
this.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/TaintTrackingImplSpecific.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/TaintTrackingImplSpecific.qll
index e1549ea57a3..694d344c2f9 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/TaintTrackingImplSpecific.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/TaintTrackingImplSpecific.qll
@@ -4,9 +4,10 @@
* Provides C++-specific definitions for use in the taint tracking library.
*/
+private import semmle.code.cpp.Location
private import codeql.dataflow.TaintTracking
private import DataFlowImplSpecific
-module CppOldTaintTracking implements InputSig {
+module CppOldTaintTracking implements InputSig {
import TaintTrackingUtil
}
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/new/DataFlow.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/new/DataFlow.qll
index ea4218da734..bcbebd0de1e 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/new/DataFlow.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/new/DataFlow.qll
@@ -28,6 +28,6 @@ import cpp
module DataFlow {
private import semmle.code.cpp.ir.dataflow.internal.DataFlowImplSpecific
private import codeql.dataflow.DataFlow
- import DataFlowMake
+ import DataFlowMake
import semmle.code.cpp.ir.dataflow.internal.DataFlowImpl1
}
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/new/TaintTracking.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/new/TaintTracking.qll
index 87e037aad9b..d28a389203f 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/new/TaintTracking.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/new/TaintTracking.qll
@@ -27,6 +27,7 @@ module TaintTracking {
private import semmle.code.cpp.ir.dataflow.internal.DataFlowImplSpecific
private import semmle.code.cpp.ir.dataflow.internal.TaintTrackingImplSpecific
private import codeql.dataflow.TaintTracking
- import TaintFlowMake
+ private import semmle.code.cpp.Location
+ import TaintFlowMake
import semmle.code.cpp.ir.dataflow.internal.tainttracking1.TaintTrackingImpl
}
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/DataFlow.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/DataFlow.qll
index a2dd75d635c..671d82c74ef 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/DataFlow.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/DataFlow.qll
@@ -24,6 +24,6 @@ import cpp
module DataFlow {
private import semmle.code.cpp.ir.dataflow.internal.DataFlowImplSpecific
private import codeql.dataflow.DataFlow
- import DataFlowMake
+ import DataFlowMake
import semmle.code.cpp.ir.dataflow.internal.DataFlowImpl1
}
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/TaintTracking.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/TaintTracking.qll
index 6f2bfcdd6aa..9ca1315ec3e 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/TaintTracking.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/TaintTracking.qll
@@ -23,6 +23,6 @@ module TaintTracking {
private import semmle.code.cpp.ir.dataflow.internal.DataFlowImplSpecific
private import semmle.code.cpp.ir.dataflow.internal.TaintTrackingImplSpecific
private import codeql.dataflow.TaintTracking
- import TaintFlowMake
+ import TaintFlowMake
import semmle.code.cpp.ir.dataflow.internal.tainttracking1.TaintTrackingImpl
}
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll
index f3e52187647..edac7f5f62a 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll
@@ -1,3 +1,4 @@
+private import semmle.code.cpp.Location
private import DataFlowImplSpecific
private import codeql.dataflow.internal.DataFlowImpl
-import MakeImpl
+import MakeImpl
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll
index 266693f45f6..e620cc5de78 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll
@@ -1,3 +1,4 @@
+private import semmle.code.cpp.Location
private import DataFlowImplSpecific
private import codeql.dataflow.internal.DataFlowImplCommon
-import MakeImplCommon
+import MakeImplCommon
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll
index c32f63a619d..6b0de326d11 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll
@@ -8,7 +8,7 @@ private import DataFlowImplSpecific
private import TaintTrackingImplSpecific
private import codeql.dataflow.internal.DataFlowImplConsistency
-private module Input implements InputSig {
+private module Input implements InputSig {
predicate argHasPostUpdateExclude(Private::ArgumentNode n) {
// The rules for whether an IR argument gets a post-update node are too
// complex to model here.
@@ -16,4 +16,4 @@ private module Input implements InputSig {
}
}
-module Consistency = MakeConsistency;
+module Consistency = MakeConsistency;
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplSpecific.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplSpecific.qll
index a8b9f99f354..aeb136c761e 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplSpecific.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplSpecific.qll
@@ -3,6 +3,7 @@
*/
private import codeql.dataflow.DataFlow
+private import semmle.code.cpp.Location
module Private {
import DataFlowPrivate
@@ -13,7 +14,7 @@ module Public {
import DataFlowUtil
}
-module CppDataFlow implements InputSig {
+module CppDataFlow implements InputSig {
import Private
import Public
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
index b411790596e..ab52e91429f 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
@@ -448,7 +448,7 @@ class Node extends TIRDataFlowNode {
* For more information, see
* [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
*/
- predicate hasLocationInfo(
+ deprecated predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
this.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/TaintTrackingImplSpecific.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/TaintTrackingImplSpecific.qll
index f62468087b9..3364eff6e35 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/TaintTrackingImplSpecific.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/TaintTrackingImplSpecific.qll
@@ -4,7 +4,8 @@
private import codeql.dataflow.TaintTracking
private import DataFlowImplSpecific
+private import semmle.code.cpp.Location
-module CppTaintTracking implements InputSig {
+module CppTaintTracking implements InputSig {
import TaintTrackingUtil
}
From 8d767862dc7138ad0d5b38569f197752de1b5777 Mon Sep 17 00:00:00 2001
From: Tom Hvitved