codeql/java/ql/src/change-notes/released/0.1.3.md

0.1.3

New Queries

• Two new queries "Inefficient regular expression" (java/redos) and "Polynomial regular expression used on uncontrolled data" (java/polynomial-redos) have been added. These queries help find instances of Regular Expression Denial of Service vulnerabilities.

Minor Analysis Improvements

• Query java/sensitive-log has received several improvements.
  • It no longer considers usernames as sensitive information.
  • The conditions to consider a variable a constant (and therefore exclude it as user-provided sensitive information) have been tightened.
  • A sanitizer has been added to handle certain elements introduced by a Kotlin compiler plugin that have deceptive names.