From dc79cf62d2055147de2a246cdcbc17ec42a93eae Mon Sep 17 00:00:00 2001 From: Esben Sparre Andreasen Date: Tue, 6 Oct 2020 10:32:48 +0200 Subject: [PATCH] Add benjamin-button.md --- benjamin-button.md | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 benjamin-button.md diff --git a/benjamin-button.md b/benjamin-button.md new file mode 100644 index 00000000000..e964f0f1aef --- /dev/null +++ b/benjamin-button.md @@ -0,0 +1,30 @@ +# benjamin-buttons.md + +This file describes the changes that have been applied to +the library to make it behave as if it was younger. + +## TaintedPath.ql + +Sinks added between 2020-01-01 and 2020-10-06 have been removed. Found by looking at: + +- the commit titles of https://github.com/github/codeql/commits/main/javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected +- the PR titles of https://github.com/github/codeql/pulls?page=2&q=is%3Apr+label%3AJS+is%3Aclosed+sink + +## Xss.ql + +Sinks added between 2020-01-01 and 2020-10-06 have been removed. Found by looking at: + +- the commit titles of https://github.com/github/codeql/commits/main/javascript/ql/test/query-tests/Security/CWE-079/Xss.expected +- the PR titles of https://github.com/github/codeql/pulls?page=2&q=is%3Apr+label%3AJS+is%3Aclosed+sink + +## SqlInjection.ql + +Sinks added between 2020-01-01 and 2020-10-06 have been removed. Found by looking at: + +- the commit titles of https://github.com/github/codeql/commits/main/javascript/ql/test/query-tests/Security/CWE-089 +- the PR titles of https://github.com/github/codeql/pulls?page=2&q=is%3Apr+label%3AJS+is%3Aclosed+sink + +## PseudoProperties + +Pseudo-properties (`$name$`) used in type-tracking and global dataflow configurations have been disabled. +Found by searching for `"\$.*\$"`.