Merge branch 'main' into js/shared-dataflow-merge-main

javascript/ql/src/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 1.2.3
+
+No user-facing changes.
+
 ## 1.2.2
 
 No user-facing changes.

javascript/ql/src/Security/CWE-020/MissingRegExpAnchor.ql

@@ -35,7 +35,7 @@ private module Impl implements
       |
         name = "replace"
         or
-        name = "match" and exists(mcn.getAPropertyRead())
+        name = ["match", "matchAll"] and exists(mcn.getAPropertyRead())
       )
     )
   }

javascript/ql/src/Security/CWE-312/ActionsArtifactLeak.ql

@@ -7,7 +7,8 @@
  * @security-severity 7.5
  * @precision high
  * @id js/actions/actions-artifact-leak
- * @tags security
+ * @tags actions
+ *       security
  *       external/cwe/cwe-312
  *       external/cwe/cwe-315
  *       external/cwe/cwe-359

javascript/ql/src/change-notes/released/1.2.3.md

@@ -0,0 +1,3 @@
+## 1.2.3
+
+No user-facing changes.

javascript/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.2.2
+lastReleaseVersion: 1.2.3

javascript/ql/src/experimental/Security/CWE-942/CorsPermissiveConfigurationCustomizations.qll

@@ -25,9 +25,16 @@ module CorsPermissiveConfiguration {
    */
   abstract class Sanitizer extends DataFlow::Node { }
 
-  /** A source of remote user input, considered as a flow source for CORS misconfiguration. */
-  class RemoteFlowSourceAsSource extends Source instanceof RemoteFlowSource {
-    RemoteFlowSourceAsSource() { not this instanceof ClientSideRemoteFlowSource }
+  /**
+   * DEPRECATED: Use `ActiveThreatModelSource` from Concepts instead!
+   */
+  deprecated class RemoteFlowSourceAsSource = ActiveThreatModelSourceAsSource;
+
+  /**
+   * An active threat-model source, considered as a flow source.
+   */
+  private class ActiveThreatModelSourceAsSource extends Source instanceof ActiveThreatModelSource {
+    ActiveThreatModelSourceAsSource() { not this instanceof ClientSideRemoteFlowSource }
   }
 
   /** A flow label representing `true` and `null` values. */

javascript/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/javascript-queries
-version: 1.2.3-dev
+version: 1.2.4-dev
 groups:
   - javascript
   - queries