Merge pull request #16878 from github/aibaars/merge-3.14

Merge rc/3.14 into main
This commit is contained in:
Arthur Baars
2024-07-01 11:04:57 +02:00
committed by GitHub
143 changed files with 447 additions and 71 deletions

View File

@@ -1,3 +1,7 @@
## 1.1.1
No user-facing changes.
## 1.1.0
### New Features

View File

@@ -0,0 +1,3 @@
## 1.1.1
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.1.0
lastReleaseVersion: 1.1.1

View File

@@ -1,5 +1,5 @@
name: codeql/cpp-all
version: 1.1.1-dev
version: 1.1.2-dev
groups: cpp
dbscheme: semmlecode.cpp.dbscheme
extractor: cpp

View File

@@ -1,3 +1,7 @@
## 1.0.2
No user-facing changes.
## 1.0.1
### Minor Analysis Improvements

View File

@@ -0,0 +1,3 @@
## 1.0.2
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.0.1
lastReleaseVersion: 1.0.2

View File

@@ -1,5 +1,5 @@
name: codeql/cpp-queries
version: 1.0.2-dev
version: 1.0.3-dev
groups:
- cpp
- queries

View File

@@ -1,3 +1,7 @@
## 1.7.19
No user-facing changes.
## 1.7.18
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.7.19
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.7.18
lastReleaseVersion: 1.7.19

View File

@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-all
version: 1.7.19-dev
version: 1.7.20-dev
groups:
- csharp
- solorigate

View File

@@ -1,3 +1,7 @@
## 1.7.19
No user-facing changes.
## 1.7.18
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.7.19
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.7.18
lastReleaseVersion: 1.7.19

View File

@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-queries
version: 1.7.19-dev
version: 1.7.20-dev
groups:
- csharp
- solorigate

View File

@@ -1,3 +1,7 @@
## 1.0.2
No user-facing changes.
## 1.0.1
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.0.2
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.0.1
lastReleaseVersion: 1.0.2

View File

@@ -1,5 +1,5 @@
name: codeql/csharp-all
version: 1.0.2-dev
version: 1.0.3-dev
groups: csharp
dbscheme: semmlecode.csharp.dbscheme
extractor: csharp

View File

@@ -1,3 +1,7 @@
## 1.0.2
No user-facing changes.
## 1.0.1
### Minor Analysis Improvements

View File

@@ -0,0 +1,3 @@
## 1.0.2
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.0.1
lastReleaseVersion: 1.0.2

View File

@@ -1,5 +1,5 @@
name: codeql/csharp-queries
version: 1.0.2-dev
version: 1.0.3-dev
groups:
- csharp
- queries

View File

@@ -19,7 +19,10 @@ CodeQL 2.17.4 runs a total of 414 security queries when configured with the Defa
CodeQL CLI
----------
There are no user-facing CLI changes in this release.
New Features
~~~~~~~~~~~~
* CodeQL package management is now generally available, and all GitHub-produced CodeQL packages have had their version numbers increased to 1.0.0.
Query Packs
-----------

View File

@@ -0,0 +1,127 @@
.. _codeql-cli-2.17.5:
==========================
CodeQL 2.17.5 (2024-06-12)
==========================
.. contents:: Contents
:depth: 2
:local:
:backlinks: none
This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the `code scanning section on the GitHub blog <https://github.blog/tag/code-scanning/>`__, `relevant GitHub Changelog updates <https://github.blog/changelog/label/code-scanning/>`__, `changes in the CodeQL extension for Visual Studio Code <https://marketplace.visualstudio.com/items/GitHub.vscode-codeql/changelog>`__, and the `CodeQL Action changelog <https://github.com/github/codeql-action/blob/main/CHANGELOG.md>`__.
Security Coverage
-----------------
CodeQL 2.17.5 runs a total of 414 security queries when configured with the Default suite (covering 161 CWE). The Extended suite enables an additional 131 queries (covering 35 more CWE).
CodeQL CLI
----------
Breaking Changes
~~~~~~~~~~~~~~~~
* All the commands that output SARIF will output a minified version to reduce the size.
The :code:`codeql database analyze`, :code:`codeql database interpret-results`, :code:`codeql generate query-help`, and :code:`codeql bqrs interpret` commands support the option :code:`--no-sarif-minify` to output a pretty printed SARIF file.
* A number of breaking changes have been made to the :code:`semmle-extractor-options` functionality available for C and C++ CodeQL tests.
* The Arm, Intel, and CodeWarrior compilers are no longer supported and the
:code:`--armcc`, :code:`--intel`, :code:`--codewarrior` flags are now ignored, as are all the flags that only applied to those compilers.
* The :code:`--threads` and :code:`-main-file-name` options, which did not have any effect on tests, are now ignored. Any specification of these options as part of
:code:`semmle-extractor-options` should be removed.
* Support for :code:`--linker`, all flags that would only invoke the preprocessor,
and the :code:`/clr` flag have been removed, as those flags would never produce any usable test output.
* Support for the :code:`--include_path_environment` flag has been removed. All include paths should directly be specified as part of :code:`semmle-extractor-options`.
* Microsoft C/C++ compiler response files specified via :code:`@some_file_name` are now ignored. Instead, all options should directly be specified as part of
:code:`semmle-extractor-options`.
* Support for Microsoft :code:`#import` preprocessor directive has been removed, as support depends on the availability of the Microsoft C/C++ compiler, and availability cannot be guaranteed on all platforms while executing tests.
* Support for the Microsoft :code:`/EHa`, :code:`/EHs`, :code:`/GX`, :code:`/GZ`, :code:`/Tc`, :code:`/Tp`, and :code:`/Zl` flags, and all :code:`/RTC` flags have been removed. Any specification of these options as part of :code:`semmle-extractor-options` should be removed.
* Support for the Apple-specific :code:`-F` and :code:`-iframework` flags has been removed.
The :code:`-F` flag can still be used by replacing :code:`-F <directory>` by
:code:`--edg -F --edg <directory>`. Any occurrence of :code:`-iframework <arg>` should be replaced by :code:`--edg --sys_framework --edg <arg>`.
* Support for the :code:`/TC`, :code:`/TP`, and :code:`-x` flags has been removed. Please ensure all C, respectively C++, source files have a :code:`.c`, respectively :code:`.cpp`,
extension.
* The :code:`--build_error_dir`, :code:`-db`, :code:`--edg_base_dir`, :code:`--error_limit`,
:code:`--src_archive`, :code:`--trapfolder`, and :code:`--variadic_macros` flags are now ignored.
The above changes do not affect the creation of databases through the CodeQL CLI,
or when calling the C/C++ extractor directly with the :code:`--mimic` or :code:`--linker` flags.
Similar functionality continues to be supported in those scenarios, except for CodeWarrior and the :code:`--edg_base_dir`, :code:`--include_path_environment`, :code:`/Tc`, and :code:`/Tp` flags, which were never supported.
Improvements
~~~~~~~~~~~~
* :code:`codeql generate log-summary` now reports completed pipeline runs that are part of an incomplete recursive predicate.
Miscellaneous
~~~~~~~~~~~~~
* The OWASP Java HTML Sanitizer library used by the CodeQL CLI for internal documentation generation commands has been updated to version
\ `20240325.1 <https://github.com/OWASP/java-html-sanitizer/releases/tag/release-20240325.1>`__.
Query Packs
-----------
Minor Analysis Improvements
~~~~~~~~~~~~~~~~~~~~~~~~~~~
C/C++
"""""
* The :code:`cpp/dangerous-function-overflow` no longer produces a false positive alert when the :code:`gets` function does not have exactly one parameter.
C#
""
* .NET 8 Runtime models have been updated based on the newest version of the model generator. Furthermore, the database sources have been changed slightly to reduce result multiplicity.
Java
""""
* The query :code:`java/spring-disabled-csrf-protection` detects disabling CSRF via :code:`ServerHttpSecurity$CsrfSpec::disable`.
* Added more :code:`java.io.File`\ -related sinks to the path injection query.
Python
""""""
* Added models for :code:`opml` library.
Language Libraries
------------------
Major Analysis Improvements
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Java
""""
* The precision of virtual dispatch has been improved. This increases precision in general for all data flow queries.
Minor Analysis Improvements
~~~~~~~~~~~~~~~~~~~~~~~~~~~
C/C++
"""""
* A partial model for the :code:`Boost.Asio` network library has been added. This includes sources, sinks and summaries for certain functions in :code:`Boost.Asio`, such as :code:`read_until` and :code:`write`.
Java
""""
* Support for Eclipse Compiler for Java (ecj) has been fixed to work with (a) runs that don't pass :code:`-noExit` and (b) runs that use post-Java-9 command-line arguments.
New Features
~~~~~~~~~~~~
C/C++
"""""
* Data models can now be added with data extensions. In this way source, sink and summary models can be added in extension :code:`.model.yml` files, rather than by writing classes in QL code. New models should be added in the :code:`lib/ext` folder.
Golang
""""""
* When writing models-as-data models, the receiver is now referred to as :code:`Argument[receiver]` rather than :code:`Argument[-1]`.
* Neutral models are now supported. They have no effect except that a manual neutral summary model will stop a generated summary model from having any effect.

View File

@@ -11,6 +11,7 @@ A list of queries for each suite and language `is available here <https://docs.g
.. toctree::
:maxdepth: 1
codeql-cli-2.17.5
codeql-cli-2.17.4
codeql-cli-2.17.3
codeql-cli-2.17.2

View File

@@ -1,3 +1,7 @@
## 1.0.2
No user-facing changes.
## 1.0.1
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.0.2
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.0.1
lastReleaseVersion: 1.0.2

View File

@@ -1,5 +1,5 @@
name: codeql-go-consistency-queries
version: 1.0.2-dev
version: 1.0.3-dev
groups:
- go
- queries

View File

@@ -1,3 +1,7 @@
## 1.1.1
No user-facing changes.
## 1.1.0
### New Features

View File

@@ -0,0 +1,3 @@
## 1.1.1
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.1.0
lastReleaseVersion: 1.1.1

View File

@@ -1,5 +1,5 @@
name: codeql/go-all
version: 1.1.1-dev
version: 1.1.2-dev
groups: go
dbscheme: go.dbscheme
extractor: go

View File

@@ -1,3 +1,7 @@
## 1.0.2
No user-facing changes.
## 1.0.1
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.0.2
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.0.1
lastReleaseVersion: 1.0.2

View File

@@ -1,5 +1,5 @@
name: codeql/go-queries
version: 1.0.2-dev
version: 1.0.3-dev
groups:
- go
- queries

View File

@@ -1,3 +1,7 @@
## 1.0.2
No user-facing changes.
## 1.0.1
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.0.2
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.0.1
lastReleaseVersion: 1.0.2

View File

@@ -1,5 +1,5 @@
name: codeql/java-automodel-queries
version: 1.0.2-dev
version: 1.0.3-dev
groups:
- java
- automodel

View File

@@ -1,3 +1,7 @@
## 1.1.1
No user-facing changes.
## 1.1.0
### Major Analysis Improvements

View File

@@ -0,0 +1,3 @@
## 1.1.1
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.1.0
lastReleaseVersion: 1.1.1

View File

@@ -1,5 +1,5 @@
name: codeql/java-all
version: 1.1.1-dev
version: 1.1.2-dev
groups: java
dbscheme: config/semmlecode.dbscheme
extractor: java

View File

@@ -1,3 +1,7 @@
## 1.0.2
No user-facing changes.
## 1.0.1
### Minor Analysis Improvements

View File

@@ -0,0 +1,3 @@
## 1.0.2
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.0.1
lastReleaseVersion: 1.0.2

View File

@@ -1,5 +1,5 @@
name: codeql/java-queries
version: 1.0.2-dev
version: 1.0.3-dev
groups:
- java
- queries

View File

@@ -1,3 +1,7 @@
## 1.0.2
No user-facing changes.
## 1.0.1
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.0.2
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.0.1
lastReleaseVersion: 1.0.2

View File

@@ -1,5 +1,5 @@
name: codeql/javascript-all
version: 1.0.2-dev
version: 1.0.3-dev
groups: javascript
dbscheme: semmlecode.javascript.dbscheme
extractor: javascript

View File

@@ -1,3 +1,7 @@
## 1.0.2
No user-facing changes.
## 1.0.1
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.0.2
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.0.1
lastReleaseVersion: 1.0.2

View File

@@ -1,5 +1,5 @@
name: codeql/javascript-queries
version: 1.0.2-dev
version: 1.0.3-dev
groups:
- javascript
- queries

View File

@@ -1,3 +1,7 @@
## 1.0.2
No user-facing changes.
## 1.0.1
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.0.2
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.0.1
lastReleaseVersion: 1.0.2

View File

@@ -1,4 +1,4 @@
name: codeql/suite-helpers
version: 1.0.2-dev
version: 1.0.3-dev
groups: shared
warnOnImplicitThis: true

View File

@@ -1,3 +1,7 @@
## 1.0.2
No user-facing changes.
## 1.0.1
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.0.2
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.0.1
lastReleaseVersion: 1.0.2

View File

@@ -1,5 +1,5 @@
name: codeql/python-all
version: 1.0.2-dev
version: 1.0.3-dev
groups: python
dbscheme: semmlecode.python.dbscheme
extractor: python

View File

@@ -1,3 +1,7 @@
## 1.0.2
No user-facing changes.
## 1.0.1
### Minor Analysis Improvements

View File

@@ -0,0 +1,3 @@
## 1.0.2
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.0.1
lastReleaseVersion: 1.0.2

View File

@@ -1,5 +1,5 @@
name: codeql/python-queries
version: 1.0.2-dev
version: 1.0.3-dev
groups:
- python
- queries

View File

@@ -1,3 +1,7 @@
## 1.0.2
No user-facing changes.
## 1.0.1
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.0.2
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.0.1
lastReleaseVersion: 1.0.2

View File

@@ -1,5 +1,5 @@
name: codeql/ruby-all
version: 1.0.2-dev
version: 1.0.3-dev
groups: ruby
extractor: ruby
dbscheme: ruby.dbscheme

View File

@@ -1,3 +1,7 @@
## 1.0.2
No user-facing changes.
## 1.0.1
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.0.2
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.0.1
lastReleaseVersion: 1.0.2

View File

@@ -1,5 +1,5 @@
name: codeql/ruby-queries
version: 1.0.2-dev
version: 1.0.3-dev
groups:
- ruby
- queries

View File

@@ -1,3 +1,7 @@
## 1.0.2
No user-facing changes.
## 1.0.1
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.0.2
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.0.1
lastReleaseVersion: 1.0.2

View File

@@ -1,5 +1,5 @@
name: codeql/controlflow
version: 1.0.2-dev
version: 1.0.3-dev
groups: shared
library: true
dependencies:

View File

@@ -1,3 +1,7 @@
## 1.0.2
No user-facing changes.
## 1.0.1
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.0.2
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.0.1
lastReleaseVersion: 1.0.2

View File

@@ -1,5 +1,5 @@
name: codeql/dataflow
version: 1.0.2-dev
version: 1.0.3-dev
groups: shared
library: true
dependencies:

View File

@@ -1,3 +1,7 @@
## 1.0.2
No user-facing changes.
## 1.0.1
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.0.2
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.0.1
lastReleaseVersion: 1.0.2

View File

@@ -1,5 +1,5 @@
name: codeql/mad
version: 1.0.2-dev
version: 1.0.3-dev
groups: shared
library: true
dependencies:

View File

@@ -1,3 +1,7 @@
## 1.0.2
No user-facing changes.
## 1.0.1
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.0.2
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.0.1
lastReleaseVersion: 1.0.2

View File

@@ -1,5 +1,5 @@
name: codeql/rangeanalysis
version: 1.0.2-dev
version: 1.0.3-dev
groups: shared
library: true
dependencies:

View File

@@ -1,3 +1,7 @@
## 1.0.2
No user-facing changes.
## 1.0.1
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.0.2
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.0.1
lastReleaseVersion: 1.0.2

View File

@@ -1,5 +1,5 @@
name: codeql/regex
version: 1.0.2-dev
version: 1.0.3-dev
groups: shared
library: true
dependencies:

View File

@@ -1,3 +1,7 @@
## 1.0.2
No user-facing changes.
## 1.0.1
No user-facing changes.

Some files were not shown because too many files have changed in this diff Show More