Compare commits

...

1 Commits

Author SHA1 Message Date
github-actions[bot]
3ab1a57970 Release preparation for version 2.17.4 2024-05-22 17:48:50 +00:00
149 changed files with 382 additions and 131 deletions

View File

@@ -1,3 +1,7 @@
## 1.0.0
No user-facing changes.
## 0.13.1
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.0.0
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.13.1
lastReleaseVersion: 1.0.0

View File

@@ -1,5 +1,5 @@
name: codeql/cpp-all
version: 1.0.0-dev
version: 1.0.0
groups: cpp
dbscheme: semmlecode.cpp.dbscheme
extractor: cpp

View File

@@ -1,3 +1,10 @@
## 1.0.0
### Minor Analysis Improvements
* The "Use of unique pointer after lifetime ends" query (`cpp/use-of-unique-pointer-after-lifetime-ends`) no longer reports an alert when the pointer is converted to a boolean
* The "Variable not initialized before use" query (`cpp/not-initialised`) no longer reports an alert on static variables.
## 0.9.12
### New Queries

View File

@@ -1,4 +0,0 @@
---
category: minorAnalysis
---
* The "Variable not initialized before use" query (`cpp/not-initialised`) no longer reports an alert on static variables.

View File

@@ -1,4 +0,0 @@
---
category: minorAnalysis
---
* The "Use of unique pointer after lifetime ends" query (`cpp/use-of-unique-pointer-after-lifetime-ends`) no longer reports an alert when the pointer is converted to a boolean

View File

@@ -0,0 +1,6 @@
## 1.0.0
### Minor Analysis Improvements
* The "Use of unique pointer after lifetime ends" query (`cpp/use-of-unique-pointer-after-lifetime-ends`) no longer reports an alert when the pointer is converted to a boolean
* The "Variable not initialized before use" query (`cpp/not-initialised`) no longer reports an alert on static variables.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.9.12
lastReleaseVersion: 1.0.0

View File

@@ -1,5 +1,5 @@
name: codeql/cpp-queries
version: 1.0.0-dev
version: 1.0.0
groups:
- cpp
- queries

View File

@@ -1,3 +1,7 @@
## 1.7.17
No user-facing changes.
## 1.7.16
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.7.17
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.7.16
lastReleaseVersion: 1.7.17

View File

@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-all
version: 1.7.17-dev
version: 1.7.17
groups:
- csharp
- solorigate

View File

@@ -1,3 +1,7 @@
## 1.7.17
No user-facing changes.
## 1.7.16
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.7.17
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.7.16
lastReleaseVersion: 1.7.17

View File

@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-queries
version: 1.7.17-dev
version: 1.7.17
groups:
- csharp
- solorigate

View File

@@ -1,3 +1,7 @@
## 1.0.0
No user-facing changes.
## 0.10.1
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.0.0
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.10.1
lastReleaseVersion: 1.0.0

View File

@@ -1,5 +1,5 @@
name: codeql/csharp-all
version: 1.0.0-dev
version: 1.0.0
groups: csharp
dbscheme: semmlecode.csharp.dbscheme
extractor: csharp

View File

@@ -1,3 +1,7 @@
## 1.0.0
No user-facing changes.
## 0.8.16
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.0.0
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.8.16
lastReleaseVersion: 1.0.0

View File

@@ -1,5 +1,5 @@
name: codeql/csharp-queries
version: 1.0.0-dev
version: 1.0.0
groups:
- csharp
- queries

View File

@@ -1,3 +1,7 @@
## 1.0.0
No user-facing changes.
## 0.0.15
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.0.0
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.0.15
lastReleaseVersion: 1.0.0

View File

@@ -1,5 +1,5 @@
name: codeql-go-consistency-queries
version: 1.0.0-dev
version: 1.0.0
groups:
- go
- queries

View File

@@ -1,3 +1,11 @@
## 1.0.0
### Minor Analysis Improvements
* A bug has been fixed which meant that the query `go/incorrect-integer-conversion` did not consider type assertions and type switches which use a defined type whose underlying type is an integer type. This may lead to fewer false positive alerts.
* A bug has been fixed which meant flow was not followed through some ranged for loops. This may lead to more alerts being found.
* Converted the models for the built-in functions `append`, `copy`, `max` and `min` to value flow and Models-as-Data.
## 0.8.1
### Minor Analysis Improvements

View File

@@ -1,4 +0,0 @@
---
category: minorAnalysis
---
* Converted the models for the built-in functions `append`, `copy`, `max` and `min` to value flow and Models-as-Data.

View File

@@ -1,4 +0,0 @@
---
category: minorAnalysis
---
* A bug has been fixed which meant that the query `go/incorrect-integer-conversion` did not consider type assertions and type switches which use a defined type whose underlying type is an integer type. This may lead to fewer false positive alerts.

View File

@@ -1,4 +0,0 @@
---
category: minorAnalysis
---
* A bug has been fixed which meant flow was not followed through some ranged for loops. This may lead to more alerts being found.

View File

@@ -0,0 +1,7 @@
## 1.0.0
### Minor Analysis Improvements
* A bug has been fixed which meant that the query `go/incorrect-integer-conversion` did not consider type assertions and type switches which use a defined type whose underlying type is an integer type. This may lead to fewer false positive alerts.
* A bug has been fixed which meant flow was not followed through some ranged for loops. This may lead to more alerts being found.
* Converted the models for the built-in functions `append`, `copy`, `max` and `min` to value flow and Models-as-Data.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.8.1
lastReleaseVersion: 1.0.0

View File

@@ -1,5 +1,5 @@
name: codeql/go-all
version: 1.0.0-dev
version: 1.0.0
groups: go
dbscheme: go.dbscheme
extractor: go

View File

@@ -1,3 +1,9 @@
## 1.0.0
### Minor Analysis Improvements
* The query `go/incorrect-integer-conversion` has now been restricted to only use flow through value-preserving steps. This reduces false positives, especially around type switches.
## 0.7.16
No user-facing changes.

View File

@@ -1,4 +1,5 @@
---
category: minorAnalysis
---
## 1.0.0
### Minor Analysis Improvements
* The query `go/incorrect-integer-conversion` has now been restricted to only use flow through value-preserving steps. This reduces false positives, especially around type switches.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.7.16
lastReleaseVersion: 1.0.0

View File

@@ -1,5 +1,5 @@
name: codeql/go-queries
version: 1.0.0-dev
version: 1.0.0
groups:
- go
- queries

View File

@@ -1,3 +1,7 @@
## 1.0.0
No user-facing changes.
## 0.0.23
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.0.0
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.0.23
lastReleaseVersion: 1.0.0

View File

@@ -1,5 +1,5 @@
name: codeql/java-automodel-queries
version: 1.0.0-dev
version: 1.0.0
groups:
- java
- automodel

View File

@@ -1,3 +1,9 @@
## 1.0.0
### Minor Analysis Improvements
* JDK version detection based on Gradle projects has been improved. Java extraction using build-modes `autobuild` or `none` is more likely to pick an appropriate JDK version, particularly when the Android Gradle Plugin or Spring Boot Plugin are in use.
## 0.11.0
### Breaking Changes

View File

@@ -1,4 +1,5 @@
---
category: minorAnalysis
---
## 1.0.0
### Minor Analysis Improvements
* JDK version detection based on Gradle projects has been improved. Java extraction using build-modes `autobuild` or `none` is more likely to pick an appropriate JDK version, particularly when the Android Gradle Plugin or Spring Boot Plugin are in use.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.11.0
lastReleaseVersion: 1.0.0

View File

@@ -1,5 +1,5 @@
name: codeql/java-all
version: 1.0.0-dev
version: 1.0.0
groups: java
dbscheme: config/semmlecode.dbscheme
extractor: java

View File

@@ -1,3 +1,13 @@
## 1.0.0
### Breaking Changes
* Removed `local` query variants. The results pertaining to local sources can be found using the non-local counterpart query. As an example, the results previously found by `java/unvalidated-url-redirection-local` can be found by `java/unvalidated-url-redirection`, if the `local` threat model is enabled. The removed queries are `java/path-injection-local`, `java/command-line-injection-local`, `java/xss-local`, `java/sql-injection-local`, `java/http-response-splitting-local`, `java/improper-validation-of-array-construction-local`, `java/improper-validation-of-array-index-local`, `java/tainted-format-string-local`, `java/tainted-arithmetic-local`, `java/unvalidated-url-redirection-local`, `java/xxe-local` and `java/tainted-numeric-cast-local`.
### Minor Analysis Improvements
* The sanitizer of the query `java/zipslip` has been improved to include nodes that are safe due to having certain safe types. This reduces false positives.
## 0.8.16
No user-facing changes.

View File

@@ -1,4 +0,0 @@
---
category: minorAnalysis
---
* The sanitizer of the query `java/zipslip` has been improved to include nodes that are safe due to having certain safe types. This reduces false positives.

View File

@@ -1,4 +1,9 @@
---
category: breaking
---
## 1.0.0
### Breaking Changes
* Removed `local` query variants. The results pertaining to local sources can be found using the non-local counterpart query. As an example, the results previously found by `java/unvalidated-url-redirection-local` can be found by `java/unvalidated-url-redirection`, if the `local` threat model is enabled. The removed queries are `java/path-injection-local`, `java/command-line-injection-local`, `java/xss-local`, `java/sql-injection-local`, `java/http-response-splitting-local`, `java/improper-validation-of-array-construction-local`, `java/improper-validation-of-array-index-local`, `java/tainted-format-string-local`, `java/tainted-arithmetic-local`, `java/unvalidated-url-redirection-local`, `java/xxe-local` and `java/tainted-numeric-cast-local`.
### Minor Analysis Improvements
* The sanitizer of the query `java/zipslip` has been improved to include nodes that are safe due to having certain safe types. This reduces false positives.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.8.16
lastReleaseVersion: 1.0.0

View File

@@ -1,5 +1,5 @@
name: codeql/java-queries
version: 1.0.0-dev
version: 1.0.0
groups:
- java
- queries

View File

@@ -1,3 +1,13 @@
## 1.0.0
### Minor Analysis Improvements
* Additional heuristics for a new sensitive data classification for private information (e.g. credit card numbers) have been added to the shared `SensitiveDataHeuristics.qll` library. This may result in additional results for queries that use sensitive data such as `js/clear-text-storage-sensitive-data` and `js/clear-text-logging`.
### Bug Fixes
* Fixed a bug where very large TypeScript files would cause database creation to crash. Large files over 10MB were already excluded from analysis, but the file size check was not applied to TypeScript files.
## 0.9.1
No user-facing changes.

View File

@@ -1,4 +0,0 @@
---
category: fix
---
* Fixed a bug where very large TypeScript files would cause database creation to crash. Large files over 10MB were already excluded from analysis, but the file size check was not applied to TypeScript files.

View File

@@ -1,4 +1,9 @@
---
category: minorAnalysis
---
* Additional heuristics for a new sensitive data classification for private information (e.g. credit card numbers) have been added to the shared `SensitiveDataHeuristics.qll` library. This may result in additional results for queries that use sensitive data such as `js/clear-text-storage-sensitive-data` and `js/clear-text-logging`.
## 1.0.0
### Minor Analysis Improvements
* Additional heuristics for a new sensitive data classification for private information (e.g. credit card numbers) have been added to the shared `SensitiveDataHeuristics.qll` library. This may result in additional results for queries that use sensitive data such as `js/clear-text-storage-sensitive-data` and `js/clear-text-logging`.
### Bug Fixes
* Fixed a bug where very large TypeScript files would cause database creation to crash. Large files over 10MB were already excluded from analysis, but the file size check was not applied to TypeScript files.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.9.1
lastReleaseVersion: 1.0.0

View File

@@ -1,5 +1,5 @@
name: codeql/javascript-all
version: 1.0.0-dev
version: 1.0.0
groups: javascript
dbscheme: semmlecode.javascript.dbscheme
extractor: javascript

View File

@@ -1,3 +1,7 @@
## 1.0.0
No user-facing changes.
## 0.8.16
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.0.0
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.8.16
lastReleaseVersion: 1.0.0

View File

@@ -1,5 +1,5 @@
name: codeql/javascript-queries
version: 1.0.0-dev
version: 1.0.0
groups:
- javascript
- queries

View File

@@ -1,3 +1,7 @@
## 1.0.0
No user-facing changes.
## 0.7.16
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.0.0
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.7.16
lastReleaseVersion: 1.0.0

View File

@@ -1,4 +1,4 @@
name: codeql/suite-helpers
version: 1.0.0-dev
version: 1.0.0
groups: shared
warnOnImplicitThis: true

View File

@@ -1,3 +1,13 @@
## 1.0.0
### New Features
* A Python MaD (Models as Data) row may now contain a dotted path in the `type` column. Like in Ruby, a path to a class will refer to instances of that class. This means that the summary `["foo", "Member[MyClass].Instance.Member[instance_method]", "Argument[0]", "ReturnValue", "value"]` can now be written `["foo.MS_Class", "Member[instance_method]", "Argument[0]", "ReturnValue", "value"]`. To refer to an actual class, one may add a `!` at the end of the path.
### Minor Analysis Improvements
* Additional heuristics for a new sensitive data classification for private information (e.g. credit card numbers) have been added to the shared `SensitiveDataHeuristics.qll` library. This may result in additional results for queries that use sensitive data such as `py/clear-text-storage-sensitive-data` and `py/clear-text-logging-sensitive-data`.
## 0.12.1
### Major Analysis Improvements

View File

@@ -1,4 +0,0 @@
---
category: minorAnalysis
---
* Additional heuristics for a new sensitive data classification for private information (e.g. credit card numbers) have been added to the shared `SensitiveDataHeuristics.qll` library. This may result in additional results for queries that use sensitive data such as `py/clear-text-storage-sensitive-data` and `py/clear-text-logging-sensitive-data`.

View File

@@ -1,4 +1,9 @@
---
category: feature
---
* A Python MaD (Models as Data) row may now contain a dotted path in the `type` column. Like in Ruby, a path to a class will refer to instances of that class. This means that the summary `["foo", "Member[MyClass].Instance.Member[instance_method]", "Argument[0]", "ReturnValue", "value"]` can now be written `["foo.MS_Class", "Member[instance_method]", "Argument[0]", "ReturnValue", "value"]`. To refer to an actual class, one may add a `!` at the end of the path.
## 1.0.0
### New Features
* A Python MaD (Models as Data) row may now contain a dotted path in the `type` column. Like in Ruby, a path to a class will refer to instances of that class. This means that the summary `["foo", "Member[MyClass].Instance.Member[instance_method]", "Argument[0]", "ReturnValue", "value"]` can now be written `["foo.MS_Class", "Member[instance_method]", "Argument[0]", "ReturnValue", "value"]`. To refer to an actual class, one may add a `!` at the end of the path.
### Minor Analysis Improvements
* Additional heuristics for a new sensitive data classification for private information (e.g. credit card numbers) have been added to the shared `SensitiveDataHeuristics.qll` library. This may result in additional results for queries that use sensitive data such as `py/clear-text-storage-sensitive-data` and `py/clear-text-logging-sensitive-data`.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.12.1
lastReleaseVersion: 1.0.0

View File

@@ -1,5 +1,5 @@
name: codeql/python-all
version: 1.0.0-dev
version: 1.0.0
groups: python
dbscheme: semmlecode.python.dbscheme
extractor: python

View File

@@ -1,3 +1,9 @@
## 1.0.0
### Minor Analysis Improvements
* Added models of `gradio` PyPI package.
## 0.9.16
### New Queries

View File

@@ -1,4 +0,0 @@
---
category: minorAnalysis
---
* Added models of `gradio` PyPI package.

View File

@@ -0,0 +1,5 @@
## 1.0.0
### Minor Analysis Improvements
* Added models of `gradio` PyPI package.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.9.16
lastReleaseVersion: 1.0.0

View File

@@ -1,5 +1,5 @@
name: codeql/python-queries
version: 1.0.0-dev
version: 1.0.0
groups:
- python
- queries

View File

@@ -1,3 +1,9 @@
## 1.0.0
### Minor Analysis Improvements
* Additional heuristics for a new sensitive data classification for private information (e.g. credit card numbers) have been added to the shared `SensitiveDataHeuristics.qll` library. This may result in additional results for queries that use sensitive data such as `rb/sensitive-get-query`.
## 0.9.1
No user-facing changes.

View File

@@ -1,4 +1,5 @@
---
category: minorAnalysis
---
* Additional heuristics for a new sensitive data classification for private information (e.g. credit card numbers) have been added to the shared `SensitiveDataHeuristics.qll` library. This may result in additional results for queries that use sensitive data such as `rb/sensitive-get-query`.
## 1.0.0
### Minor Analysis Improvements
* Additional heuristics for a new sensitive data classification for private information (e.g. credit card numbers) have been added to the shared `SensitiveDataHeuristics.qll` library. This may result in additional results for queries that use sensitive data such as `rb/sensitive-get-query`.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.9.1
lastReleaseVersion: 1.0.0

View File

@@ -1,5 +1,5 @@
name: codeql/ruby-all
version: 1.0.0-dev
version: 1.0.0
groups: ruby
extractor: ruby
dbscheme: ruby.dbscheme

View File

@@ -1,3 +1,7 @@
## 1.0.0
No user-facing changes.
## 0.8.16
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.0.0
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.8.16
lastReleaseVersion: 1.0.0

View File

@@ -1,5 +1,5 @@
name: codeql/ruby-queries
version: 1.0.0-dev
version: 1.0.0
groups:
- ruby
- queries

View File

@@ -1,3 +1,7 @@
## 1.0.0
No user-facing changes.
## 0.1.16
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.0.0
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.1.16
lastReleaseVersion: 1.0.0

View File

@@ -1,5 +1,5 @@
name: codeql/controlflow
version: 1.0.0-dev
version: 1.0.0
groups: shared
library: true
dependencies:

View File

@@ -1,3 +1,9 @@
## 1.0.0
### Minor Analysis Improvements
* The data flow library now adds intermediate nodes when data flows out of a function via a parameter, in order to make path explanations easier to follow. The intermediate nodes have the same location as the underlying parameter, but must be accessed via `PathNode.asParameterReturnNode` instead of `PathNode.asNode`.
## 0.2.7
No user-facing changes.

View File

@@ -1,4 +1,5 @@
---
category: minorAnalysis
---
* The data flow library now adds intermediate nodes when data flows out of a function via a parameter, in order to make path explanations easier to follow. The intermediate nodes have the same location as the underlying parameter, but must be accessed via `PathNode.asParameterReturnNode` instead of `PathNode.asNode`.
## 1.0.0
### Minor Analysis Improvements
* The data flow library now adds intermediate nodes when data flows out of a function via a parameter, in order to make path explanations easier to follow. The intermediate nodes have the same location as the underlying parameter, but must be accessed via `PathNode.asParameterReturnNode` instead of `PathNode.asNode`.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.2.7
lastReleaseVersion: 1.0.0

View File

@@ -1,5 +1,5 @@
name: codeql/dataflow
version: 1.0.0-dev
version: 1.0.0
groups: shared
library: true
dependencies:

View File

@@ -1,3 +1,7 @@
## 1.0.0
No user-facing changes.
## 0.2.16
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.0.0
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.2.16
lastReleaseVersion: 1.0.0

View File

@@ -1,5 +1,5 @@
name: codeql/mad
version: 1.0.0-dev
version: 1.0.0
groups: shared
library: true
dependencies:

View File

@@ -1,3 +1,7 @@
## 1.0.0
No user-facing changes.
## 0.0.15
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.0.0
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.0.15
lastReleaseVersion: 1.0.0

Some files were not shown because too many files have changed in this diff Show More