codeql/csharp/ql/lib/change-notes/released/5.2.3.md

5.2.3

Minor Analysis Improvements

• A bug has been fixed in the data flow analysis, which means that flow through calls using the base qualifier may now be tracked more accurately.
• Added summary models for System.Xml.XmlReader, System.Xml.XmlTextReader and System.Xml.XmlDictionaryReader.
• Models-as-data summaries for byte and char arrays and pointers now treat the entire collection as tainted, reflecting their common use as string alternatives.
• The default taint tracking configuration now allows implicit reads from collections at sinks and in additional flow steps. This increases flow coverage for many taint tracking queries and helps reduce false negatives.