hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity
Files
0594f84dfc31b9d8d7b8fcc4d8975d3e421a086b
codeql/javascript/old-change-notes/2021-03-15-client-side-remote-flow-sources.md
Dave Bartolomeo fa40d59332 Move older change notes to old-change-notes 
Now that change notes are per-package, new change notes should be created in the `change-notes` folder under the affected pack (e.g., `cpp/ql/src/change-notes` for C++ query change notes. I've moved all of the change note files that were added before we started publishing them in packs to an `old-change-notes` directory under each language, to reduce the temptation to add new change notes there.

I'm working on a document to describe how and when to create change notes for packs separately.
2021-12-14 12:35:04 -05:00

478 B
Raw Blame History

lgtm,codescanning

  • The security queries now distinguish more clearly between different parts of window.location. When the taint source of an alert is based on window.location, the source will usually occur closer to where user-controlled data is obtained, such as at location.hash.
  • js/request-forgery no longer considers client-side path parameters to be a source due to the restricted character set usable in a path, resulting in fewer false-positive results.