Files
codeql/java/ql/lib/change-notes/released/9.2.1.md
2026-07-09 16:48:01 +00:00

8 lines
635 B
Markdown

## 9.2.1
### Minor Analysis Improvements
* Regular expression checks via annotation with `@javax.validation.constraints.Pattern` are now recognized as sanitizers for `java/path-injection`.
* Added summary and LLM-generated source and sink models for `org.apache.poi`.
* The first argument of the `uri` method of `WebClient$UriSpec` in `org.springframework.web.reactive.function.client` is now considered a request forgery sink. Previously only the first arguments of the `WebClient.create` and `WebClient$Builder.baseUrl` methods were considered. This may lead to more alerts for the query `java/ssrf` (Server-side request forgery).