mirror of
https://github.com/github/codeql.git
synced 2025-12-20 10:46:30 +01:00
10 lines
781 B
Markdown
10 lines
781 B
Markdown
## 0.8.13
|
|
|
|
### Minor Analysis Improvements
|
|
|
|
* Data flow is now tracked through `ActiveRecord` scopes.
|
|
* Modeled instances of `ActionDispatch::Http::UploadedFile` that can be obtained from element reads of `ActionController::Parameters`, with calls to `original_filename`, `content_type`, and `read` now propagating taint from their receiver.
|
|
* The second argument, `subquery_name`, of the `ActiveRecord::QueryMethods::from` method, is now recognized as an sql injection sink.
|
|
* Calls to `Typhoeus::Request.new` are now considered as instances of the `Http::Client::Request` concept, with the response body being treated as a remote flow source.
|
|
* New command injection sinks have been added, including `Process.spawn`, `Process.exec`, `Terrapin::CommandLine` and the `open4` gem.
|