Compare commits

...

19 Commits

Author SHA1 Message Date
Chris Smowton
0ac0dad49d Merge pull request #19042 from github/release-prep/2.20.7
Release preparation for version 2.20.7
2025-03-17 12:21:27 +00:00
github-actions[bot]
2d64a618e6 Release preparation for version 2.20.7 2025-03-17 12:15:54 +00:00
Aditya Sharad
52dac47d68 Merge pull request #18953 from github/jonjanego-patch-1-more-escaping
Update codeql-cli-2.20.4.rst
2025-03-07 23:01:18 +05:30
Jon Janego
b9ec58ba73 Update codeql-cli-2.20.4.rst 2025-03-07 09:27:47 -06:00
Florin Coada
c93f671f7b Merge pull request #18951 from github/coadaflorin-patch-for-escaping
Update codeql-cli-2.20.4.rst
2025-03-07 15:24:02 +00:00
Florin Coada
7564255542 Update codeql-cli-2.20.4.rst 2025-03-07 15:16:52 +00:00
Jon Janego
468c12e656 Merge pull request #18944 from github/changedocs-2.20.6
Changedocs for 2.20.6
2025-03-06 17:31:59 -06:00
Jon Janego
b742ed21db Merge branch 'rc/3.17' into changedocs-2.20.6 2025-03-06 16:51:25 -06:00
Jon Janego
65d5e527c0 Apply suggestions from code review
Co-authored-by: Aditya Sharad <6874315+adityasharad@users.noreply.github.com>
2025-03-06 16:46:57 -06:00
Jon Janego
da7b9b7c20 rearranging golang 1.24 support 2025-03-06 15:32:48 -06:00
Jon Janego
3652a45a97 Update codeql-cli-2.20.4.rst 2025-03-06 15:10:42 -06:00
Jon Janego
1385de223f Update codeql-cli-2.20.4.rst 2025-03-06 15:10:11 -06:00
Jon Janego
2b818e3a4f Update codeql-cli-2.19.4.rst 2025-03-06 15:04:55 -06:00
Jon Janego
fc6794f6df adding 2.20.6 sitedocs 2025-03-06 14:12:54 -06:00
Michael B. Gale
16e84d0ad0 Merge pull request #18929 from github/mbg/go/filter-more-vendor-dirs
Go: Support more dependency managers in `IsGolangVendorDirectory`
2025-03-06 16:10:18 +00:00
Michael B. Gale
b872c60e1c Go: Support more dependency managers in IsGolangVendorDirectory 2025-03-06 15:40:44 +00:00
Chuan-kai Lin
c7dc8a364c Merge pull request #18925 from github/mergeback-2.20.6
Mergeback codeql-cli-2.20.6 to rc/3.17
2025-03-04 08:36:09 -08:00
Chuan-kai Lin
df42ff6253 Merge pull request #18912 from github/post-release-prep/codeql-cli-2.20.6
Post-release preparation for codeql-cli-2.20.6
2025-03-03 12:45:35 -08:00
github-actions[bot]
58f355ae5a Post-release preparation for codeql-cli-2.20.6 2025-03-03 18:18:15 +00:00
156 changed files with 475 additions and 77 deletions

View File

@@ -1,3 +1,7 @@
## 0.4.5
No user-facing changes.
## 0.4.4
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 0.4.5
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.4.4
lastReleaseVersion: 0.4.5

View File

@@ -1,5 +1,5 @@
name: codeql/actions-all
version: 0.4.4
version: 0.4.5
library: true
warnOnImplicitThis: true
dependencies:

View File

@@ -1,3 +1,7 @@
## 0.5.2
No user-facing changes.
## 0.5.1
### Bug Fixes

View File

@@ -0,0 +1,3 @@
## 0.5.2
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.5.1
lastReleaseVersion: 0.5.2

View File

@@ -1,5 +1,5 @@
name: codeql/actions-queries
version: 0.5.1
version: 0.5.2
library: false
warnOnImplicitThis: true
groups: [actions, queries]

View File

@@ -1,3 +1,7 @@
## 4.0.3
No user-facing changes.
## 4.0.2
### Minor Analysis Improvements

View File

@@ -0,0 +1,3 @@
## 4.0.3
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 4.0.2
lastReleaseVersion: 4.0.3

View File

@@ -1,5 +1,5 @@
name: codeql/cpp-all
version: 4.0.2
version: 4.0.3
groups: cpp
dbscheme: semmlecode.cpp.dbscheme
extractor: cpp

View File

@@ -1,3 +1,7 @@
## 1.3.6
No user-facing changes.
## 1.3.5
### Minor Analysis Improvements

View File

@@ -0,0 +1,3 @@
## 1.3.6
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.3.5
lastReleaseVersion: 1.3.6

View File

@@ -1,5 +1,5 @@
name: codeql/cpp-queries
version: 1.3.5
version: 1.3.6
groups:
- cpp
- queries

View File

@@ -1,3 +1,7 @@
## 1.7.36
No user-facing changes.
## 1.7.35
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.7.36
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.7.35
lastReleaseVersion: 1.7.36

View File

@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-all
version: 1.7.35
version: 1.7.36
groups:
- csharp
- solorigate

View File

@@ -1,3 +1,7 @@
## 1.7.36
No user-facing changes.
## 1.7.35
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.7.36
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.7.35
lastReleaseVersion: 1.7.36

View File

@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-queries
version: 1.7.35
version: 1.7.36
groups:
- csharp
- solorigate

View File

@@ -1,3 +1,7 @@
## 5.1.2
No user-facing changes.
## 5.1.1
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 5.1.2
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 5.1.1
lastReleaseVersion: 5.1.2

View File

@@ -1,5 +1,5 @@
name: codeql/csharp-all
version: 5.1.1
version: 5.1.2
groups: csharp
dbscheme: semmlecode.csharp.dbscheme
extractor: csharp

View File

@@ -1,3 +1,7 @@
## 1.0.19
No user-facing changes.
## 1.0.18
### Minor Analysis Improvements

View File

@@ -0,0 +1,3 @@
## 1.0.19
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.0.18
lastReleaseVersion: 1.0.19

View File

@@ -1,5 +1,5 @@
name: codeql/csharp-queries
version: 1.0.18
version: 1.0.19
groups:
- csharp
- queries

View File

@@ -109,6 +109,14 @@ Python
* Fixed a bug in the extractor where a comment inside a subscript could sometimes cause the AST to be missing nodes.
* Using the :code:`break` and :code:`continue` keywords outside of a loop, which is a syntax error but is accepted by our parser, would cause the control-flow construction to fail. This is now no longer the case.
Major Analysis Improvements
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Golang
""""""
* Go 1.24 is now supported. This includes the new language feature of generic type aliases.
Minor Analysis Improvements
~~~~~~~~~~~~~~~~~~~~~~~~~~~

View File

@@ -0,0 +1,120 @@
.. _codeql-cli-2.20.6:
==========================
CodeQL 2.20.6 (2025-03-06)
==========================
.. contents:: Contents
:depth: 2
:local:
:backlinks: none
This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the `code scanning section on the GitHub blog <https://github.blog/tag/code-scanning/>`__, `relevant GitHub Changelog updates <https://github.blog/changelog/label/code-scanning/>`__, `changes in the CodeQL extension for Visual Studio Code <https://marketplace.visualstudio.com/items/GitHub.vscode-codeql/changelog>`__, and the `CodeQL Action changelog <https://github.com/github/codeql-action/blob/main/CHANGELOG.md>`__.
Security Coverage
-----------------
CodeQL 2.20.6 runs a total of 450 security queries when configured with the Default suite (covering 168 CWE). The Extended suite enables an additional 137 queries (covering 35 more CWE). 1 security query has been added with this release.
CodeQL CLI
----------
Miscellaneous
~~~~~~~~~~~~~
* The CodeQL XML extractor is now able to parse documents in a wider array of character sets.
* The build of Eclipse Temurin OpenJDK that is used to run the CodeQL CLI has been updated to version 21.0.6.
Query Packs
-----------
Bug Fixes
~~~~~~~~~
GitHub Actions
""""""""""""""
* The :code:`actions/unversioned-immutable-action` query will no longer report any alerts, since the Immutable Actions feature is not yet available for customer use. The query remains in the default Code Scanning suites for use internal to GitHub. Once the Immutable Actions feature is available, the query will be updated to report alerts again.
Major Analysis Improvements
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Java/Kotlin
"""""""""""
* Fixed false positive alerts in the java query "Cross-site scripting" (:code:`java/xss`) when :code:`javax.servlet.http.HttpServletResponse` is used with a content type which is not exploitable.
JavaScript/TypeScript
"""""""""""""""""""""
* Improved precision of data flow through arrays, fixing some spurious flows that would sometimes cause the :code:`length` property of an array to be seen as tainted.
* Improved call resolution logic to better handle calls resolving "downwards", targeting a method declared in a subclass of the enclosing class. Data flow analysis has also improved to avoid spurious flow between unrelated classes in the class hierarchy.
Minor Analysis Improvements
~~~~~~~~~~~~~~~~~~~~~~~~~~~
C/C++
"""""
* Due to changes in libraries the query "Static array access may cause overflow" (:code:`cpp/static-buffer-overflow`) will no longer report cases where multiple fields of a struct or class are written with a single :code:`memset` or similar operation.
* The query "Call to memory access function may overflow buffer" (:code:`cpp/overflow-buffer`) has been added to the security-extended query suite. The query detects a range of buffer overflow and underflow issues.
C#
""
* C#: Improve precision of the query :code:`cs/call-to-object-tostring` for value tuples.
Language Libraries
------------------
Major Analysis Improvements
~~~~~~~~~~~~~~~~~~~~~~~~~~~
JavaScript/TypeScript
"""""""""""""""""""""
* Added support for the :code:`response` threat model kind, which can enabled with `advanced setup <https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#extending-codeql-coverage-with-threat-models>`__. When enabled, the response data coming back from an outgoing HTTP request is considered a source of taint.
* Added support for the :code:`useQuery` hook from :code:`@tanstack/react-query`.
Minor Analysis Improvements
~~~~~~~~~~~~~~~~~~~~~~~~~~~
C/C++
"""""
* Modified the :code:`getBufferSize` predicate in :code:`commons/Buffer.qll` to be more tolerant in some cases involving member variables in a larger struct or class.
* Fixed an issue where the :code:`getBufferSize` predicate in :code:`commons/Buffer.qll` was returning results for references inside :code:`offsetof` expressions, which are not accesses to a buffer.
Golang
""""""
* The location info for the following classes has been changed slightly to match a location that is in the database: :code:`BasicBlock`, :code:`ControlFlow::EntryNode`, :code:`ControlFlow::ExitNode`, :code:`ControlFlow::ConditionGuardNode`, :code:`IR::ImplicitLiteralElementIndexInstruction`, :code:`IR::EvalImplicitTrueInstruction`, :code:`SsaImplicitDefinition`, :code:`SsaPhiNode`.
* Added :code:`database` source models for the :code:`github.com/rqlite/gorqlite` package.
* Added :code:`database` source models for database methods from the :code:`go.mongodb.org/mongo-driver/mongo` package.
Java/Kotlin
"""""""""""
* Added a path injection sanitizer for the :code:`child` argument of a :code:`java.io.File` constructor if that argument does not contain path traversal sequences.
JavaScript/TypeScript
"""""""""""""""""""""
* The :code:`response.download()` function in :code:`express` is now recognized as a sink for path traversal attacks.
Deprecated APIs
~~~~~~~~~~~~~~~
Golang
""""""
* The member predicate :code:`hasLocationInfo` has been deprecated on the following classes: :code:`BasicBlock`, :code:`Callable`, :code:`Content`, :code:`ContentSet`, :code:`ControlFlow::Node`, :code:`DataFlowCallable`, :code:`DataFlow::Node`, :code:`Entity`, :code:`GVN`, :code:`HtmlTemplate::TemplateStmt`, :code:`IR:WriteTarget`, :code:`SourceSinkInterpretationInput::SourceOrSinkElement`, :code:`SourceSinkInterpretationInput::InterpretNode`, :code:`SsaVariable`, :code:`SsaDefinition`, :code:`SsaWithFields`, :code:`StringOps::ConcatenationElement`, :code:`Type`, and :code:`VariableWithFields`. Use :code:`getLocation()` instead.
New Features
~~~~~~~~~~~~
Java/Kotlin
"""""""""""
* The Java extractor and QL libraries now support Java 24.

View File

@@ -11,6 +11,7 @@ A list of queries for each suite and language `is available here <https://docs.g
.. toctree::
:maxdepth: 1
codeql-cli-2.20.6
codeql-cli-2.20.5
codeql-cli-2.20.4
codeql-cli-2.20.3

View File

@@ -307,5 +307,8 @@ func fileExists(path string) bool {
// and contains a `modules.txt` file.
func IsGolangVendorDirectory(dirPath string) bool {
return filepath.Base(dirPath) == "vendor" &&
(fileExists(filepath.Join(dirPath, "modules.txt")) || fileExists(filepath.Join(dirPath, "../glide.yaml")))
(fileExists(filepath.Join(dirPath, "modules.txt")) ||
fileExists(filepath.Join(dirPath, "../glide.yaml")) ||
fileExists(filepath.Join(dirPath, "../Gopkg.lock")) ||
fileExists(filepath.Join(dirPath, "../vendor.conf")))
}

View File

@@ -1,3 +1,7 @@
## 1.0.19
No user-facing changes.
## 1.0.18
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.0.19
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.0.18
lastReleaseVersion: 1.0.19

View File

@@ -1,5 +1,5 @@
name: codeql-go-consistency-queries
version: 1.0.18
version: 1.0.19
groups:
- go
- queries

View File

@@ -1,3 +1,7 @@
## 4.2.1
No user-facing changes.
## 4.2.0
### Deprecated APIs

View File

@@ -0,0 +1,3 @@
## 4.2.1
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 4.2.0
lastReleaseVersion: 4.2.1

View File

@@ -1,5 +1,5 @@
name: codeql/go-all
version: 4.2.0
version: 4.2.1
groups: go
dbscheme: go.dbscheme
extractor: go

View File

@@ -1,3 +1,7 @@
## 1.1.10
No user-facing changes.
## 1.1.9
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.1.10
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.1.9
lastReleaseVersion: 1.1.10

View File

@@ -1,5 +1,5 @@
name: codeql/go-queries
version: 1.1.9
version: 1.1.10
groups:
- go
- queries

View File

@@ -1,3 +1,7 @@
## 7.1.1
No user-facing changes.
## 7.1.0
### New Features

View File

@@ -0,0 +1,3 @@
## 7.1.1
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 7.1.0
lastReleaseVersion: 7.1.1

View File

@@ -1,5 +1,5 @@
name: codeql/java-all
version: 7.1.0
version: 7.1.1
groups: java
dbscheme: config/semmlecode.dbscheme
extractor: java

View File

@@ -1,3 +1,7 @@
## 1.3.1
No user-facing changes.
## 1.3.0
### Major Analysis Improvements

View File

@@ -0,0 +1,3 @@
## 1.3.1
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.3.0
lastReleaseVersion: 1.3.1

View File

@@ -1,5 +1,5 @@
name: codeql/java-queries
version: 1.3.0
version: 1.3.1
groups:
- java
- queries

View File

@@ -1,3 +1,7 @@
## 2.5.1
No user-facing changes.
## 2.5.0
### Major Analysis Improvements

View File

@@ -0,0 +1,3 @@
## 2.5.1
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 2.5.0
lastReleaseVersion: 2.5.1

View File

@@ -1,5 +1,5 @@
name: codeql/javascript-all
version: 2.5.0
version: 2.5.1
groups: javascript
dbscheme: semmlecode.javascript.dbscheme
extractor: javascript

View File

@@ -1,3 +1,7 @@
## 1.5.1
No user-facing changes.
## 1.5.0
### Major Analysis Improvements

View File

@@ -0,0 +1,3 @@
## 1.5.1
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.5.0
lastReleaseVersion: 1.5.1

View File

@@ -1,5 +1,5 @@
name: codeql/javascript-queries
version: 1.5.0
version: 1.5.1
groups:
- javascript
- queries

View File

@@ -1,3 +1,7 @@
## 1.0.19
No user-facing changes.
## 1.0.18
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.0.19
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.0.18
lastReleaseVersion: 1.0.19

View File

@@ -1,4 +1,4 @@
name: codeql/suite-helpers
version: 1.0.18
version: 1.0.19
groups: shared
warnOnImplicitThis: true

View File

@@ -1,3 +1,7 @@
## 4.0.3
No user-facing changes.
## 4.0.2
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 4.0.3
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 4.0.2
lastReleaseVersion: 4.0.3

View File

@@ -1,5 +1,5 @@
name: codeql/python-all
version: 4.0.2
version: 4.0.3
groups: python
dbscheme: semmlecode.python.dbscheme
extractor: python

View File

@@ -1,3 +1,7 @@
## 1.4.5
No user-facing changes.
## 1.4.4
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.4.5
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.4.4
lastReleaseVersion: 1.4.5

View File

@@ -1,5 +1,5 @@
name: codeql/python-queries
version: 1.4.4
version: 1.4.5
groups:
- python
- queries

View File

@@ -1,3 +1,7 @@
## 4.1.2
No user-facing changes.
## 4.1.1
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 4.1.2
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 4.1.1
lastReleaseVersion: 4.1.2

View File

@@ -1,5 +1,5 @@
name: codeql/ruby-all
version: 4.1.1
version: 4.1.2
groups: ruby
extractor: ruby
dbscheme: ruby.dbscheme

View File

@@ -1,3 +1,7 @@
## 1.1.14
No user-facing changes.
## 1.1.13
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.1.14
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.1.13
lastReleaseVersion: 1.1.14

View File

@@ -1,5 +1,5 @@
name: codeql/ruby-queries
version: 1.1.13
version: 1.1.14
groups:
- ruby
- queries

View File

@@ -1,3 +1,7 @@
## 0.1.4
No user-facing changes.
## 0.1.3
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 0.1.4
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.1.3
lastReleaseVersion: 0.1.4

View File

@@ -1,5 +1,5 @@
name: codeql/rust-all
version: 0.1.3
version: 0.1.4
groups: rust
extractor: rust
dbscheme: rust.dbscheme

View File

@@ -1,3 +1,7 @@
## 0.1.4
No user-facing changes.
## 0.1.3
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 0.1.4
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.1.3
lastReleaseVersion: 0.1.4

View File

@@ -1,5 +1,5 @@
name: codeql/rust-queries
version: 0.1.3
version: 0.1.4
groups:
- rust
- queries

View File

@@ -1,3 +1,7 @@
## 2.0.3
No user-facing changes.
## 2.0.2
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 2.0.3
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 2.0.2
lastReleaseVersion: 2.0.3

View File

@@ -1,5 +1,5 @@
name: codeql/controlflow
version: 2.0.2
version: 2.0.3
groups: shared
library: true
dependencies:

View File

@@ -1,3 +1,7 @@
## 2.0.3
No user-facing changes.
## 2.0.2
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 2.0.3
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 2.0.2
lastReleaseVersion: 2.0.3

View File

@@ -1,5 +1,5 @@
name: codeql/dataflow
version: 2.0.2
version: 2.0.3
groups: shared
library: true
dependencies:

Some files were not shown because too many files have changed in this diff Show More