Switch to new-style change notes.

This commit is contained in:
Max Schaefer 2020-05-01 07:57:13 +01:00
Родитель cd1d699208
Коммит 980241603b
4 изменённых файлов: 4 добавлений и 22 удалений

Просмотреть файл

@ -1,17 +0,0 @@
# Improvements to Go analysis
## General improvements
* A model for the Macaron HTTP library's `Context.Redirect` function was added.
## New queries
| **Query** | **Tags** | **Purpose** |
|------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
## Changes to existing queries
| **Query** | **Expected impact** | **Change** |
|----------------------------------------------|-----------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Bad redirect check (`go/bad-redirect-check`) | More accurate results | The query now checks for a use of the value checked by the result in a redirect call, and no longer uses names as a heuristic for whether the checked value is a URL. |

Просмотреть файл

@ -1,5 +0,0 @@
[[ condition: enterprise-only ]]
# Improvements to Go analysis
## Changes to code extraction

Просмотреть файл

@ -0,0 +1,2 @@
lgtm,codescanning
* The query "Bad redirect check" (`go/bad-redirect-check`) now requires that the checked variable is actually used in a redirect as opposed to relying on a name-based heuristic. This eliminates some false positive results, and adds more true positive results.

Просмотреть файл

@ -0,0 +1,2 @@
lgtm,codescanning
* Basic support for the [Macaron](https://go-macaron.com/) HTTP library has been added, which may lead to more results from the security queries.