codeql/java/ql/src/change-notes/released/0.0.10.md

0.0.10

Breaking Changes

• Add more classes to Netty request/response splitting. Change identification to java/netty-http-request-or-response-splitting. Identify request splitting differently from response splitting in query results. Support additional classes:
  • io.netty.handler.codec.http.CombinedHttpHeaders
  • io.netty.handler.codec.http.DefaultHttpRequest
  • io.netty.handler.codec.http.DefaultFullHttpRequest

New Queries

• A new query titled "Local information disclosure in a temporary directory" (java/local-temp-file-or-directory-information-disclosure) has been added. This query finds uses of APIs that leak potentially sensitive information to other local users via the system temporary directory. This query was originally submitted as query by @JLLeitschuh.