diff --git a/cpp/ql/lib/change-notes/2026-03-20-add-indirect-uninitialized-node.md b/cpp/ql/lib/change-notes/2026-03-20-add-indirect-uninitialized-node.md new file mode 100644 index 00000000000..07235e047d4 --- /dev/null +++ b/cpp/ql/lib/change-notes/2026-03-20-add-indirect-uninitialized-node.md @@ -0,0 +1,4 @@ +--- +category: feature +--- +* Added a class `IndirectUninitializedNode` to represent the indirection of an uninitialized local variable as a dataflow node. diff --git a/cpp/ql/lib/change-notes/2026-03-23-indirect-parameter-nodes-and-indirect-instructions.md b/cpp/ql/lib/change-notes/2026-03-23-indirect-parameter-nodes-and-indirect-instructions.md new file mode 100644 index 00000000000..c3bd4028ee9 --- /dev/null +++ b/cpp/ql/lib/change-notes/2026-03-23-indirect-parameter-nodes-and-indirect-instructions.md @@ -0,0 +1,5 @@ +--- +category: feature +--- +* Added a class `DataFlow::IndirectParameterNode` to represent the indirection of a parameter as a dataflow node. +* Added a predicate `Node::asIndirectInstruction` which returns the `Instruction` that defines the indirect dataflow node, if any. \ No newline at end of file diff --git a/cpp/ql/lib/semmle/code/cpp/commons/Printf.qll b/cpp/ql/lib/semmle/code/cpp/commons/Printf.qll index 023ce09c5c1..d189dd36f87 100644 --- a/cpp/ql/lib/semmle/code/cpp/commons/Printf.qll +++ b/cpp/ql/lib/semmle/code/cpp/commons/Printf.qll @@ -163,12 +163,23 @@ predicate primitiveVariadicFormatter( ) } +/** + * Gets a function call whose target is a variadic formatter with the given + * `type`, `format` parameter index and `output` parameter index. + * + * Join-order helper for `callsVariadicFormatter`. + */ +pragma[nomagic] +private predicate callsVariadicFormatterCall(FunctionCall fc, string type, int format, int output) { + variadicFormatter(fc.getTarget(), type, format, output) +} + private predicate callsVariadicFormatter( Function f, string type, int formatParamIndex, int outputParamIndex ) { // calls a variadic formatter with `formatParamIndex`, `outputParamIndex` linked exists(FunctionCall fc, int format, int output | - variadicFormatter(pragma[only_bind_into](fc.getTarget()), type, format, output) and + callsVariadicFormatterCall(fc, type, format, output) and fc.getEnclosingFunction() = f and fc.getArgument(format) = f.getParameter(formatParamIndex).getAnAccess() and fc.getArgument(output) = f.getParameter(outputParamIndex).getAnAccess() @@ -176,7 +187,7 @@ private predicate callsVariadicFormatter( or // calls a variadic formatter with only `formatParamIndex` linked exists(FunctionCall fc, string calledType, int format, int output | - variadicFormatter(pragma[only_bind_into](fc.getTarget()), calledType, format, output) and + callsVariadicFormatterCall(fc, calledType, format, output) and fc.getEnclosingFunction() = f and fc.getArgument(format) = f.getParameter(formatParamIndex).getAnAccess() and not fc.getArgument(output) = f.getParameter(_).getAnAccess() and diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowNodes.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowNodes.qll index fe954c640d1..1895726ecb4 100644 --- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowNodes.qll +++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowNodes.qll @@ -321,6 +321,12 @@ module Public { */ Operand asIndirectOperand(int index) { hasOperandAndIndex(this, result, index) } + /** + * Gets the instruction that is indirectly tracked by this node behind + * `index` number of indirections. + */ + Instruction asIndirectInstruction(int index) { hasInstructionAndIndex(this, result, index) } + /** * Holds if this node is at index `i` in basic block `block`. * @@ -617,6 +623,25 @@ module Public { */ LocalVariable asUninitialized() { result = this.(UninitializedNode).getLocalVariable() } + /** + * Gets the uninitialized local variable corresponding to this node behind + * `index` number of indirections, if any. + */ + LocalVariable asIndirectUninitialized(int index) { + exists(IndirectUninitializedNode indirectUninitializedNode | + this = indirectUninitializedNode and + indirectUninitializedNode.getIndirectionIndex() = index + | + result = indirectUninitializedNode.getLocalVariable() + ) + } + + /** + * Gets the uninitialized local variable corresponding to this node behind + * a number indirections, if any. + */ + LocalVariable asIndirectUninitialized() { result = this.asIndirectUninitialized(_) } + /** * Gets the positional parameter corresponding to the node that represents * the value of the parameter after `index` number of loads, if any. For @@ -761,16 +786,13 @@ module Public { final override Type getType() { result = this.getPreUpdateNode().getType() } } - /** - * The value of an uninitialized local variable, viewed as a node in a data - * flow graph. - */ - class UninitializedNode extends Node { + abstract private class AbstractUninitializedNode extends Node { LocalVariable v; + int indirectionIndex; - UninitializedNode() { + AbstractUninitializedNode() { exists(SsaImpl::Definition def, SsaImpl::SourceVariable sv | - def.getIndirectionIndex() = 0 and + def.getIndirectionIndex() = indirectionIndex and def.getValue().asInstruction() instanceof UninitializedInstruction and SsaImpl::defToNode(this, def, sv) and v = sv.getBaseVariable().(SsaImpl::BaseIRVariable).getIRVariable().getAst() @@ -781,6 +803,25 @@ module Public { LocalVariable getLocalVariable() { result = v } } + /** + * The value of an uninitialized local variable, viewed as a node in a data + * flow graph. + */ + class UninitializedNode extends AbstractUninitializedNode { + UninitializedNode() { indirectionIndex = 0 } + } + + /** + * The value of an uninitialized local variable behind one or more levels of + * indirection, viewed as a node in a data flow graph. + */ + class IndirectUninitializedNode extends AbstractUninitializedNode { + IndirectUninitializedNode() { indirectionIndex > 0 } + + /** Gets the indirection index of this node. */ + int getIndirectionIndex() { result = indirectionIndex } + } + /** * The value of a parameter at function entry, viewed as a node in a data * flow graph. This includes both explicit parameters such as `x` in `f(x)` @@ -795,6 +836,12 @@ module Public { /** An explicit positional parameter, including `this`, but not `...`. */ final class DirectParameterNode = AbstractDirectParameterNode; + /** + * A node representing an indirection of a positional parameter, + * including `*this`, but not `*...`. + */ + final class IndirectParameterNode = AbstractIndirectParameterNode; + final class ExplicitParameterNode = AbstractExplicitParameterNode; /** An implicit `this` parameter. */ @@ -954,11 +1001,6 @@ module Public { private import Public -/** - * A node representing an indirection of a parameter. - */ -final class IndirectParameterNode = AbstractIndirectParameterNode; - /** * A class that lifts pre-SSA dataflow nodes to regular dataflow nodes. */ diff --git a/csharp/ql/lib/change-notes/2026-03-19-fix-log-forging-extension-methods.md b/csharp/ql/lib/change-notes/2026-03-19-fix-log-forging-extension-methods.md new file mode 100644 index 00000000000..65ce217b105 --- /dev/null +++ b/csharp/ql/lib/change-notes/2026-03-19-fix-log-forging-extension-methods.md @@ -0,0 +1,7 @@ +--- +category: minorAnalysis +--- +* The `cs/log-forging` query no longer treats arguments to extension methods with + source code on `ILogger` types as sinks. Instead, taint is tracked interprocedurally + through extension method bodies, reducing false positives when extension methods + sanitize input internally. diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/LogForgingQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/LogForgingQuery.qll index 22023ebc409..293b8ff9b8b 100644 --- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/LogForgingQuery.qll +++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/LogForgingQuery.qll @@ -52,9 +52,17 @@ private class HtmlSanitizer extends Sanitizer { } /** - * An argument to a call to a method on a logger class. + * An argument to a call to a method on a logger class, excluding extension methods + * with source code which are analyzed interprocedurally. */ -private class LogForgingLogMessageSink extends Sink, LogMessageSink { } +private class LogForgingLogMessageSink extends Sink, LogMessageSink { + LogForgingLogMessageSink() { + not exists(ExtensionMethodCall mc | + this.getExpr() = mc.getAnArgument() and + mc.getTarget().fromSource() + ) + } +} /** * An argument to a call to a method on a trace class. diff --git a/csharp/ql/test/query-tests/Security Features/CWE-117/LogForging.cs b/csharp/ql/test/query-tests/Security Features/CWE-117/LogForging.cs index 18169e4a4b0..10ff408e226 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-117/LogForging.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-117/LogForging.cs @@ -33,6 +33,11 @@ public class LogForgingHandler : IHttpHandler Microsoft.Extensions.Logging.ILogger logger2 = null; // BAD: Logged as-is logger2.LogError(username); // $ Alert + + // GOOD: uses safe extension method that sanitizes internally + logger.WarnSafe(username + " logged in"); + // BAD: uses unsafe extension method that does not sanitize + logger.WarnUnsafe(username + " logged in"); } public bool IsReusable @@ -43,3 +48,16 @@ public class LogForgingHandler : IHttpHandler } } } + +static class UserLoggerExtensions +{ + public static void WarnSafe(this ILogger logger, string message) + { + logger.Warn(message.ReplaceLineEndings("")); + } + + public static void WarnUnsafe(this ILogger logger, string message) + { + logger.Warn(message); // $ Alert + } +} diff --git a/csharp/ql/test/query-tests/Security Features/CWE-117/LogForging.expected b/csharp/ql/test/query-tests/Security Features/CWE-117/LogForging.expected index 1820eaa07d9..994cabadc75 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-117/LogForging.expected +++ b/csharp/ql/test/query-tests/Security Features/CWE-117/LogForging.expected @@ -2,14 +2,18 @@ | LogForging.cs:21:21:21:43 | ... + ... | LogForging.cs:18:27:18:49 | access to property QueryString : NameValueCollection | LogForging.cs:21:21:21:43 | ... + ... | This log entry depends on a $@. | LogForging.cs:18:27:18:49 | access to property QueryString | user-provided value | | LogForging.cs:31:50:31:72 | ... + ... | LogForging.cs:18:27:18:49 | access to property QueryString : NameValueCollection | LogForging.cs:31:50:31:72 | ... + ... | This log entry depends on a $@. | LogForging.cs:18:27:18:49 | access to property QueryString | user-provided value | | LogForging.cs:35:26:35:33 | access to local variable username | LogForging.cs:18:27:18:49 | access to property QueryString : NameValueCollection | LogForging.cs:35:26:35:33 | access to local variable username | This log entry depends on a $@. | LogForging.cs:18:27:18:49 | access to property QueryString | user-provided value | +| LogForging.cs:61:21:61:27 | access to parameter message | LogForging.cs:18:27:18:49 | access to property QueryString : NameValueCollection | LogForging.cs:61:21:61:27 | access to parameter message | This log entry depends on a $@. | LogForging.cs:18:27:18:49 | access to property QueryString | user-provided value | | LogForgingAsp.cs:17:21:17:43 | ... + ... | LogForgingAsp.cs:13:32:13:39 | username : String | LogForgingAsp.cs:17:21:17:43 | ... + ... | This log entry depends on a $@. | LogForgingAsp.cs:13:32:13:39 | username | user-provided value | edges | LogForging.cs:18:16:18:23 | access to local variable username : String | LogForging.cs:21:21:21:43 | ... + ... | provenance | | | LogForging.cs:18:16:18:23 | access to local variable username : String | LogForging.cs:31:50:31:72 | ... + ... | provenance | | | LogForging.cs:18:16:18:23 | access to local variable username : String | LogForging.cs:35:26:35:33 | access to local variable username | provenance | | +| LogForging.cs:18:16:18:23 | access to local variable username : String | LogForging.cs:40:27:40:49 | ... + ... : String | provenance | | | LogForging.cs:18:27:18:49 | access to property QueryString : NameValueCollection | LogForging.cs:18:16:18:23 | access to local variable username : String | provenance | | | LogForging.cs:18:27:18:49 | access to property QueryString : NameValueCollection | LogForging.cs:18:27:18:61 | access to indexer : String | provenance | MaD:1 | | LogForging.cs:18:27:18:61 | access to indexer : String | LogForging.cs:18:16:18:23 | access to local variable username : String | provenance | | +| LogForging.cs:40:27:40:49 | ... + ... : String | LogForging.cs:59:63:59:69 | message : String | provenance | | +| LogForging.cs:59:63:59:69 | message : String | LogForging.cs:61:21:61:27 | access to parameter message | provenance | | | LogForgingAsp.cs:13:32:13:39 | username : String | LogForgingAsp.cs:17:21:17:43 | ... + ... | provenance | | models | 1 | Summary: System.Collections.Specialized; NameValueCollection; false; get_Item; (System.String); ; Argument[this]; ReturnValue; taint; df-generated | @@ -20,6 +24,9 @@ nodes | LogForging.cs:21:21:21:43 | ... + ... | semmle.label | ... + ... | | LogForging.cs:31:50:31:72 | ... + ... | semmle.label | ... + ... | | LogForging.cs:35:26:35:33 | access to local variable username | semmle.label | access to local variable username | +| LogForging.cs:40:27:40:49 | ... + ... : String | semmle.label | ... + ... : String | +| LogForging.cs:59:63:59:69 | message : String | semmle.label | message : String | +| LogForging.cs:61:21:61:27 | access to parameter message | semmle.label | access to parameter message | | LogForgingAsp.cs:13:32:13:39 | username : String | semmle.label | username : String | | LogForgingAsp.cs:17:21:17:43 | ... + ... | semmle.label | ... + ... | subpaths diff --git a/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.19.1.rst b/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.19.1.rst index f2948d0db67..39d4d36537c 100644 --- a/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.19.1.rst +++ b/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.19.1.rst @@ -129,7 +129,7 @@ Java/Kotlin """"""""""" * The Java extractor and QL libraries now support Java 23. -* Kotlin versions up to 2.1.0\ *x* are now supported. +* Kotlin versions up to 2.1.0*x* are now supported. Python """""" diff --git a/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.21.3.rst b/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.21.3.rst index 71a8e3a6824..fffe94c04b8 100644 --- a/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.21.3.rst +++ b/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.21.3.rst @@ -144,7 +144,7 @@ New Features Java/Kotlin """"""""""" -* Kotlin versions up to 2.2.0\ *x* are now supported. Support for the Kotlin 1.5.x series is dropped (so the minimum Kotlin version is now 1.6.0). +* Kotlin versions up to 2.2.0*x* are now supported. Support for the Kotlin 1.5.x series is dropped (so the minimum Kotlin version is now 1.6.0). Swift """"" diff --git a/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.22.3.rst b/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.22.3.rst index 4f1d34ff2dd..8e5a18a0c74 100644 --- a/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.22.3.rst +++ b/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.22.3.rst @@ -98,4 +98,4 @@ C/C++ Java/Kotlin """"""""""" -* Kotlin versions up to 2.2.2\ *x* are now supported. +* Kotlin versions up to 2.2.2*x* are now supported. diff --git a/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.24.3.rst b/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.24.3.rst new file mode 100644 index 00000000000..7c4f99e10d2 --- /dev/null +++ b/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.24.3.rst @@ -0,0 +1,121 @@ +.. _codeql-cli-2.24.3: + +========================== +CodeQL 2.24.3 (2026-03-05) +========================== + +.. contents:: Contents + :depth: 2 + :local: + :backlinks: none + +This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the `code scanning section on the GitHub blog `__, `relevant GitHub Changelog updates `__, `changes in the CodeQL extension for Visual Studio Code `__, and the `CodeQL Action changelog `__. + +Security Coverage +----------------- + +CodeQL 2.24.3 runs a total of 491 security queries when configured with the Default suite (covering 166 CWE). The Extended suite enables an additional 135 queries (covering 35 more CWE). + +CodeQL CLI +---------- + +Bug Fixes +~~~~~~~~~ + +* Fixed a race condition that could cause flaky failures in overlay CodeQL tests. Test extraction now skips :code:`*.testproj` directories by name, preventing interference from concurrently cleaned-up test databases. +* Fixed spurious "OOPS" warnings that could appear in help output for commands using mutually exclusive option groups, such as :code:`codeql query run`. + +Query Packs +----------- + +Minor Analysis Improvements +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Java/Kotlin +""""""""""" + +* The Java extractor and QL libraries now support Java 26. +* Java analysis now selects the Java version to use informed by Maven POM files across all project modules. It also tries to use Java 17 or higher for all Maven projects if possible, for improved build compatibility. + +Rust +"""" + +* The macro resolution metric has been removed from :code:`rust/diagnostic/database-quality`. This metric was found to be an unreliable indicator of database quality in many cases, leading to false alarms on the tool status page. + +Language Libraries +------------------ + +Bug Fixes +~~~~~~~~~ + +C/C++ +""""" + +* The :code:`allowInterproceduralFlow` predicate of must-flow data flow configurations now correctly handles direct recursion. + +C# +"" + +* Fixed an issue where the body of a partial member could be extracted twice. When both a *defining* and an *implementing* declaration exist, only the *implementing* declaration is now extracted. + +Breaking Changes +~~~~~~~~~~~~~~~~ + +C/C++ +""""" + +* CodeQL version 2.24.2 accidentally introduced a syntactical breaking change to :code:`BarrierGuard<...>::getAnIndirectBarrierNode` and :code:`InstructionBarrierGuard<...>::getAnIndirectBarrierNode`. These breaking changes have now been reverted so that the original code compiles again. +* :code:`MustFlow`, the inter-procedural must-flow data flow analysis library, has been re-worked to use parameterized modules. Like in the case of data flow and taint tracking, instead of extending the :code:`MustFlowConfiguration` class, the user should now implement a module with the :code:`MustFlow::ConfigSig` signature, and instantiate the :code:`MustFlow::Global` parameterized module with the implemented module. + +Python +"""""" + +* The :code:`Metrics` library no longer contains code that depends on the points-to analysis. The removed functionality has instead been moved to the :code:`LegacyPointsTo` module, to classes like :code:`ModuleMetricsWithPointsTo` etc. If you depend on any of these classes, you must now remember to import :code:`LegacyPointsTo`, and use the appropriate types in order to use the points-to-based functionality. + +Major Analysis Improvements +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Python +"""""" + +* The CodeQL Python libraries have been updated to be compatible with overlay evaluation. This should result in a significant speedup on analyses for which a base database already exists. Note that it may be necessary to add :code:`overlay[local?] module;` to user-managed libraries that extend classes that are now marked as :code:`overlay[local]`. + +Minor Analysis Improvements +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +C/C++ +""""" + +* Refactored the "Year field changed using an arithmetic operation without checking for leap year" query (:code:`cpp/leap-year/unchecked-after-arithmetic-year-modification`) to address large numbers of false positive results. + +C# +"" + +* C# 14: Added support for partial events. +* C# 14: Added support for the :code:`field` keyword in properties. + +Java/Kotlin +""""""""""" + +* Some modelling which previously only worked for Java EE packages beginning with "javax" will now also work for Java EE packages beginning with "jakarta" as well. This may lead to some alert changes. + +JavaScript/TypeScript +""""""""""""""""""""" + +* Added support for React components wrapped by :code:`observer` from :code:`mobx-react` and :code:`mobx-react-lite`. + +Python +"""""" + +* Added new full SSRF sanitization barrier from the new AntiSSRF library. +* When a guard such as :code:`isSafe(x)` is defined, we now also automatically handle :code:`isSafe(x) == true` and :code:`isSafe(x) != false`. + +Ruby +"""" + +* We now track taint flow through :code:`Shellwords.escape` and :code:`Shellwords.shellescape` for all queries except command injection, for which they are sanitizers. + +Rust +"""" + +* Added support for neutral models (:code:`extensible: neutralModel`) to control where generated source, sink and flow summary models apply. diff --git a/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.25.0.rst b/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.25.0.rst new file mode 100644 index 00000000000..7c371a3a365 --- /dev/null +++ b/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.25.0.rst @@ -0,0 +1,131 @@ +.. _codeql-cli-2.25.0: + +========================== +CodeQL 2.25.0 (2026-03-19) +========================== + +.. contents:: Contents + :depth: 2 + :local: + :backlinks: none + +This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the `code scanning section on the GitHub blog `__, `relevant GitHub Changelog updates `__, `changes in the CodeQL extension for Visual Studio Code `__, and the `CodeQL Action changelog `__. + +Security Coverage +----------------- + +CodeQL 2.25.0 runs a total of 491 security queries when configured with the Default suite (covering 166 CWE). The Extended suite enables an additional 135 queries (covering 35 more CWE). + +CodeQL CLI +---------- + +Breaking Changes +~~~~~~~~~~~~~~~~ + +* :code:`codeql database interpret-results` and :code:`codeql database analyze` no longer attempt to reconstruct file baseline information from databases created with CLI versions before 2.11.2. + +Bug Fixes +~~~~~~~~~ + +* Upgraded Jackson library from 2.16.1 to 2.18.6 to address a high-severity denial of service vulnerability (GHSA-72hv-8253-57qq) in jackson-core's async JSON parser. +* Upgraded snakeyaml (which is a dependency of jackson-dataformat-yaml) from 2.2 to 2.3. + +Language Libraries +------------------ + +Breaking Changes +~~~~~~~~~~~~~~~~ + +Java/Kotlin +""""""""""" + +* The Java control flow graph (CFG) implementation has been completely rewritten. The CFG now includes additional nodes to more accurately represent certain constructs. This also means that any existing code that implicitly relies on very specific details about the CFG may need to be updated. + The CFG now only includes the nodes that are reachable from the entry point. + Additionally, the following breaking changes have been made: + + * :code:`ControlFlowNode.asCall` has been removed - use :code:`Call.getControlFlowNode` instead. + * :code:`ControlFlowNode.getEnclosingStmt` has been removed. + * :code:`ControlFlow::ExprNode` has been removed. + * :code:`ControlFlow::StmtNode` has been removed. + * :code:`ControlFlow::Node` has been removed - this was merely an alias of + :code:`ControlFlowNode`, which is still available. + * Previously deprecated predicates on :code:`BasicBlock` have been removed. + +Major Analysis Improvements +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Swift +""""" + +* Upgraded to allow analysis of Swift 6.2.4. + +Minor Analysis Improvements +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +C/C++ +""""" + +* Inline expectations test comments, which are of the form :code:`// $ tag` or :code:`// $ tag=value`, are now parsed more strictly and will not be recognized if there isn't a space after the :code:`$` symbol. + +C# +"" + +* Inline expectations test comments, which are of the form :code:`// $ tag` or :code:`// $ tag=value`, are now parsed more strictly and will not be recognized if there isn't a space after the :code:`$` symbol. +* Added :code:`System.Net.WebSockets::ReceiveAsync` as a remote flow source. +* Added reverse taint flow from implicit conversion operator calls to their arguments. +* Added post-update nodes for struct-type arguments, allowing data flow out of method calls via those arguments. +* C# 14: Added support for partial constructors. + +Golang +"""""" + +* Inline expectations test comments, which are of the form :code:`// $ tag` or :code:`// $ tag=value`, are now parsed more strictly and will not be recognized if there isn't a space after the :code:`$` symbol. + +Java/Kotlin +""""""""""" + +* Inline expectations test comments, which are of the form :code:`// $ tag` or :code:`// $ tag=value`, are now parsed more strictly and will not be recognized if there isn't a space after the :code:`$` symbol. +* The class :code:`Assignment` now extends :code:`BinaryExpr`. Uses of :code:`BinaryExpr` may in some cases need slight adjustment. + +JavaScript/TypeScript +""""""""""""""""""""" + +* Added support for browser-specific source kinds (:code:`browser`, :code:`browser-url-query`, :code:`browser-url-fragment`, :code:`browser-url-path`, :code:`browser-url`, :code:`browser-window-name`, :code:`browser-message-event`) that can be used in data extensions to model sources in browser environments. +* Inline expectations test comments, which are of the form :code:`// $ tag` or :code:`// $ tag=value`, are now parsed more strictly and will not be recognized if there isn't a space after the :code:`$` symbol. + +Python +"""""" + +* The call graph resolution no longer considers methods marked using |link-code-typing-overload-1|_ as valid targets. This ensures that only the method that contains the actual implementation gets resolved as a target. +* Inline expectations test comments, which are of the form :code:`# $ tag` or :code:`# $ tag=value`, are now parsed more strictly and will not be recognized if there isn't a space after the :code:`$` symbol. + +Ruby +"""" + +* Inline expectations test comments, which are of the form :code:`# $ tag` or :code:`# $ tag=value`, are now parsed more strictly and will not be recognized if there isn't a space after the :code:`$` symbol. + +Swift +""""" + +* Inline expectations test comments, which are of the form :code:`// $ tag` or :code:`// $ tag=value`, are now parsed more strictly and will not be recognized if there isn't a space after the :code:`$` symbol. + +Rust +"""" + +* Inline expectations test comments, which are of the form :code:`// $ tag` or :code:`// $ tag=value`, are now parsed more strictly and will not be recognized if there isn't a space after the :code:`$` symbol. +* Added neutral models to inhibit spurious generated sink models for :code:`map` and :code:`from`. This fixes some false positive query results. + +Shared Libraries +---------------- + +New Features +~~~~~~~~~~~~ + +Dataflow Analysis +""""""""""""""""" + +* Two new flow features :code:`FeatureEscapesSourceCallContext` and :code:`FeatureEscapesSourceCallContextOrEqualSourceSinkCallContext` have been added. The former implies that the sink must be reached from the source by escaping the source call context, that is, flow must either return from the callable containing the source or use a jump-step before reaching the sink. The latter is the disjunction of the former and the existing :code:`FeatureEqualSourceSinkCallContext` flow feature. + +.. |link-code-typing-overload-1| replace:: :code:`@typing.overload`\ +.. _link-code-typing-overload-1: https://typing.python.org/en/latest/spec/overload.html#overloads + diff --git a/docs/codeql/codeql-overview/codeql-changelog/index.rst b/docs/codeql/codeql-overview/codeql-changelog/index.rst index 21671f1c969..d880a7e56d8 100644 --- a/docs/codeql/codeql-overview/codeql-changelog/index.rst +++ b/docs/codeql/codeql-overview/codeql-changelog/index.rst @@ -11,6 +11,8 @@ A list of queries for each suite and language `is available here