In this commit:
- Replace _QL pack_ with _CodeQL pack_
- Replace `about-ql-pack` references with `about-codeql-packs`
- Replace examples using `libraryPathDependencies with
`dependencies`
- Update some examples to specify the optional `version` field
- Update description of query specifiers to note that a path
within a pack is valid.
As of go 1.19 it will try to format markdown nicely, but in both these cases the formatting isn't supposed to be interpreted this way, so indent it to make it a preformatted block.
I guess this is not 100% accurate any longer since the base class is
only a `DataFlow::Node` now... I guess we could make it a
`DataFlow::CallNode` in the Concept definition.
Sadly most alert text changed, but the two important changes are:
1. The request on RestClient.rb:19 now has an expanded alert text,
highlighting where the origin of the value that disables certificate
validation comes from. (in this case, it's trivial since it's the
line right above)
2. We handle passing `false`/`OpenSSL::SSL::VERIFY_NONE` the same in the
argument passing examples in Faraday.rb
Added:
- one where the value is not directly used when disabling certificate
validation.
- one with argument passing, Faraday, where it is only the passing of
`OpenSSL::SSL::VERIFY_NONE` that is recognized.
This introduces a `MethodRefExpr` node synthesized out of
`DotSyntaxCallExpr` under the `LookupExpr` hierarchy. This means that
much like
```free_function(1, 2)```
is a `CallExpr` with `getFunction` giving a `DeclRefExpr`,
```foo.method(1, 2)```
is now a `CallExpr` with `getFunction` giving a `MethodRefExpr`.
`ApplyExpr::getStaticTarget` has been made work with it (as well as
`ConstructorRefCallExpr` which for the moment has been left where it
is), a new `MethodApplyExpr` has been introduced deriving from it,
and control and data flow libraries have adapted.
A small but was fixed in `qlgen` where the default constructor for DB
types was not correctly subtracting derived IPA types depending on the
order of definitions in `schema.yml`.
There are still some occurrences of `DotSyntaxCallExpr`, and as already
mentioned the other `SelfApply` class (`ConstructorRefCallExpr`) was
left alone. Their treatment is left for a future PR.
The Kotlin extractor can now be told to write TRAP with no compression,
gzip compression or Brotli compression - although Brotli is not yet
supported and it will fall back to gzip.
The invocation TRAP file is a bit more complicated, as it's already been
started before the extractor starts. For now that continues to always be
uncompressed.
