зеркало из https://github.com/github/codeql.git
Release preparation for version 2.11.4
This commit is contained in:
github-actions[bot]
Родитель
254a5b0928
Коммит
e105c13e77
|
|
@ -1,3 +1,7 @@
|
|||
## 0.4.4
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
## 0.4.3
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
|
|
|||
|
|
@ -0,0 +1,3 @@
|
|||
## 0.4.4
|
||||
|
||||
No user-facing changes.
|
||||
|
|
@ -1,2 +1,2 @@
|
|||
---
|
||||
lastReleaseVersion: 0.4.3
|
||||
lastReleaseVersion: 0.4.4
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
name: codeql/cpp-all
|
||||
version: 0.4.4-dev
|
||||
version: 0.4.4
|
||||
groups: cpp
|
||||
dbscheme: semmlecode.cpp.dbscheme
|
||||
extractor: cpp
|
||||
|
|
|
|||
|
|
@ -1,3 +1,7 @@
|
|||
## 0.4.4
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
## 0.4.3
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
|
|
|||
|
|
@ -0,0 +1,3 @@
|
|||
## 0.4.4
|
||||
|
||||
No user-facing changes.
|
||||
|
|
@ -1,2 +1,2 @@
|
|||
---
|
||||
lastReleaseVersion: 0.4.3
|
||||
lastReleaseVersion: 0.4.4
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
name: codeql/cpp-queries
|
||||
version: 0.4.4-dev
|
||||
version: 0.4.4
|
||||
groups:
|
||||
- cpp
|
||||
- queries
|
||||
|
|
|
|||
|
|
@ -1,3 +1,7 @@
|
|||
## 1.3.4
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
## 1.3.3
|
||||
|
||||
No user-facing changes.
|
||||
|
|
|
|||
|
|
@ -0,0 +1,3 @@
|
|||
## 1.3.4
|
||||
|
||||
No user-facing changes.
|
||||
|
|
@ -1,2 +1,2 @@
|
|||
---
|
||||
lastReleaseVersion: 1.3.3
|
||||
lastReleaseVersion: 1.3.4
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
name: codeql/csharp-solorigate-all
|
||||
version: 1.3.4-dev
|
||||
version: 1.3.4
|
||||
groups:
|
||||
- csharp
|
||||
- solorigate
|
||||
|
|
|
|||
|
|
@ -1,3 +1,7 @@
|
|||
## 1.3.4
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
## 1.3.3
|
||||
|
||||
No user-facing changes.
|
||||
|
|
|
|||
|
|
@ -0,0 +1,3 @@
|
|||
## 1.3.4
|
||||
|
||||
No user-facing changes.
|
||||
|
|
@ -1,2 +1,2 @@
|
|||
---
|
||||
lastReleaseVersion: 1.3.3
|
||||
lastReleaseVersion: 1.3.4
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
name: codeql/csharp-solorigate-queries
|
||||
version: 1.3.4-dev
|
||||
version: 1.3.4
|
||||
groups:
|
||||
- csharp
|
||||
- solorigate
|
||||
|
|
|
|||
|
|
@ -1,3 +1,9 @@
|
|||
## 0.4.4
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
* The `[Summary|Sink|Source]ModelCsv` classes have been deprecated and Models as Data models are defined as data extensions instead.
|
||||
|
||||
## 0.4.3
|
||||
|
||||
No user-facing changes.
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* The `[Summary|Sink|Source]ModelCsv` classes have been deprecated and Models as Data models are defined as data extensions instead.
|
||||
## 0.4.4
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
* The `[Summary|Sink|Source]ModelCsv` classes have been deprecated and Models as Data models are defined as data extensions instead.
|
||||
|
|
@ -1,2 +1,2 @@
|
|||
---
|
||||
lastReleaseVersion: 0.4.3
|
||||
lastReleaseVersion: 0.4.4
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
name: codeql/csharp-all
|
||||
version: 0.4.4-dev
|
||||
version: 0.4.4
|
||||
groups: csharp
|
||||
dbscheme: semmlecode.csharp.dbscheme
|
||||
extractor: csharp
|
||||
|
|
|
|||
|
|
@ -1,3 +1,7 @@
|
|||
## 0.4.4
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
## 0.4.3
|
||||
|
||||
No user-facing changes.
|
||||
|
|
|
|||
|
|
@ -0,0 +1,3 @@
|
|||
## 0.4.4
|
||||
|
||||
No user-facing changes.
|
||||
|
|
@ -1,2 +1,2 @@
|
|||
---
|
||||
lastReleaseVersion: 0.4.3
|
||||
lastReleaseVersion: 0.4.4
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
name: codeql/csharp-queries
|
||||
version: 0.4.4-dev
|
||||
version: 0.4.4
|
||||
groups:
|
||||
- csharp
|
||||
- queries
|
||||
|
|
|
|||
|
|
@ -1,3 +1,7 @@
|
|||
## 0.3.4
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
## 0.3.3
|
||||
|
||||
No user-facing changes.
|
||||
|
|
|
|||
|
|
@ -0,0 +1,3 @@
|
|||
## 0.3.4
|
||||
|
||||
No user-facing changes.
|
||||
|
|
@ -1,2 +1,2 @@
|
|||
---
|
||||
lastReleaseVersion: 0.3.3
|
||||
lastReleaseVersion: 0.3.4
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
name: codeql/go-all
|
||||
version: 0.3.4-dev
|
||||
version: 0.3.4
|
||||
groups: go
|
||||
dbscheme: go.dbscheme
|
||||
extractor: go
|
||||
|
|
|
|||
|
|
@ -1,3 +1,7 @@
|
|||
## 0.3.4
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
## 0.3.3
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
|
|
|||
|
|
@ -0,0 +1,3 @@
|
|||
## 0.3.4
|
||||
|
||||
No user-facing changes.
|
||||
|
|
@ -1,2 +1,2 @@
|
|||
---
|
||||
lastReleaseVersion: 0.3.3
|
||||
lastReleaseVersion: 0.3.4
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
name: codeql/go-queries
|
||||
version: 0.3.4-dev
|
||||
version: 0.3.4
|
||||
groups:
|
||||
- go
|
||||
- queries
|
||||
|
|
|
|||
|
|
@ -1,3 +1,15 @@
|
|||
## 0.4.4
|
||||
|
||||
### New Features
|
||||
|
||||
* The new `string Compilation.getInfo(string)` provides access to some information about compilations.
|
||||
* Kotlin support is now in beta. This means that Java analyses will also include Kotlin code by default. Kotlin support can be disabled by setting `CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN` to `true` in the environment.
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
* The ReDoS libraries in `semmle.code.java.security.regexp` has been moved to a shared pack inside the `shared/` folder, and the previous location has been deprecated.
|
||||
* Added data flow summaries for tainted Android intents sent to activities via `Activity.startActivities`.
|
||||
|
||||
## 0.4.3
|
||||
|
||||
No user-facing changes.
|
||||
|
|
|
|||
|
|
@ -1,4 +0,0 @@
|
|||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Added data flow summaries for tainted Android intents sent to activities via `Activity.startActivities`.
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* The ReDoS libraries in `semmle.code.java.security.regexp` has been moved to a shared pack inside the `shared/` folder, and the previous location has been deprecated.
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
---
|
||||
category: feature
|
||||
---
|
||||
* The new `string Compilation.getInfo(string)` provides access to some information about compilations.
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
---
|
||||
category: feature
|
||||
---
|
||||
* Kotlin support is now in beta. This means that Java analyses will also include Kotlin code by default. Kotlin support can be disabled by setting `CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN` to `true` in the environment.
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
## 0.4.4
|
||||
|
||||
### New Features
|
||||
|
||||
* The new `string Compilation.getInfo(string)` provides access to some information about compilations.
|
||||
* Kotlin support is now in beta. This means that Java analyses will also include Kotlin code by default. Kotlin support can be disabled by setting `CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN` to `true` in the environment.
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
* The ReDoS libraries in `semmle.code.java.security.regexp` has been moved to a shared pack inside the `shared/` folder, and the previous location has been deprecated.
|
||||
* Added data flow summaries for tainted Android intents sent to activities via `Activity.startActivities`.
|
||||
|
|
@ -1,2 +1,2 @@
|
|||
---
|
||||
lastReleaseVersion: 0.4.3
|
||||
lastReleaseVersion: 0.4.4
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
name: codeql/java-all
|
||||
version: 0.4.4-dev
|
||||
version: 0.4.4
|
||||
groups: java
|
||||
dbscheme: config/semmlecode.dbscheme
|
||||
extractor: java
|
||||
|
|
|
|||
|
|
@ -1,3 +1,10 @@
|
|||
## 0.4.4
|
||||
|
||||
### New Queries
|
||||
|
||||
* The query `java/insufficient-key-size` has been promoted from experimental to the main query pack. Its results will now appear by default. This query was originally [submitted as an experimental query by @luchua-bc](https://github.com/github/codeql/pull/4926).
|
||||
* Added a new query, `java/android/sensitive-keyboard-cache`, to detect instances of sensitive information possibly being saved to the keyboard cache.
|
||||
|
||||
## 0.4.3
|
||||
|
||||
No user-facing changes.
|
||||
|
|
|
|||
|
|
@ -1,4 +0,0 @@
|
|||
---
|
||||
category: newQuery
|
||||
---
|
||||
* Added a new query, `java/android/sensitive-keyboard-cache`, to detect instances of sensitive information possibly being saved to the keyboard cache.
|
||||
|
|
@ -1,4 +1,6 @@
|
|||
---
|
||||
category: newQuery
|
||||
---
|
||||
## 0.4.4
|
||||
|
||||
### New Queries
|
||||
|
||||
* The query `java/insufficient-key-size` has been promoted from experimental to the main query pack. Its results will now appear by default. This query was originally [submitted as an experimental query by @luchua-bc](https://github.com/github/codeql/pull/4926).
|
||||
* Added a new query, `java/android/sensitive-keyboard-cache`, to detect instances of sensitive information possibly being saved to the keyboard cache.
|
||||
|
|
@ -1,2 +1,2 @@
|
|||
---
|
||||
lastReleaseVersion: 0.4.3
|
||||
lastReleaseVersion: 0.4.4
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
name: codeql/java-queries
|
||||
version: 0.4.4-dev
|
||||
version: 0.4.4
|
||||
groups:
|
||||
- java
|
||||
- queries
|
||||
|
|
|
|||
|
|
@ -1,3 +1,9 @@
|
|||
## 0.3.4
|
||||
|
||||
### Major Analysis Improvements
|
||||
|
||||
* Added support for TypeScript 4.9.
|
||||
|
||||
## 0.3.3
|
||||
|
||||
No user-facing changes.
|
||||
|
|
|
|||
|
|
@ -1,4 +0,0 @@
|
|||
---
|
||||
category: majorAnalysis
|
||||
---
|
||||
* Added support for TypeScript 4.9.
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
## 0.3.4
|
||||
|
||||
### Major Analysis Improvements
|
||||
|
||||
* Added support for TypeScript 4.9.
|
||||
|
|
@ -1,2 +1,2 @@
|
|||
---
|
||||
lastReleaseVersion: 0.3.3
|
||||
lastReleaseVersion: 0.3.4
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
name: codeql/javascript-all
|
||||
version: 0.3.4-dev
|
||||
version: 0.3.4
|
||||
groups: javascript
|
||||
dbscheme: semmlecode.javascript.dbscheme
|
||||
extractor: javascript
|
||||
|
|
|
|||
|
|
@ -1,3 +1,16 @@
|
|||
## 0.4.4
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
* Added support for @hapi/glue and Hapi plugins to the frameworks/Hapi.qll library.
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* Fixed a bug that would cause the extractor to crash when an `import` type is used in
|
||||
the `extends` clause of an `interface`.
|
||||
* Fixed an issue with multi-line strings in YAML files being associated with an invalid location,
|
||||
causing alerts related to such strings to appear at the top of the YAML file.
|
||||
|
||||
## 0.4.3
|
||||
|
||||
### New Queries
|
||||
|
|
|
|||
|
|
@ -1,4 +0,0 @@
|
|||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Added support for @hapi/glue and Hapi plugins to the frameworks/Hapi.qll library.
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
---
|
||||
category: fix
|
||||
---
|
||||
* Fixed an issue with multi-line strings in YAML files being associated with an invalid location,
|
||||
causing alerts related to such strings to appear at the top of the YAML file.
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
---
|
||||
category: fix
|
||||
---
|
||||
* Fixed a bug that would cause the extractor to crash when an `import` type is used in
|
||||
the `extends` clause of an `interface`.
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
## 0.4.4
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
* Added support for @hapi/glue and Hapi plugins to the frameworks/Hapi.qll library.
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* Fixed a bug that would cause the extractor to crash when an `import` type is used in
|
||||
the `extends` clause of an `interface`.
|
||||
* Fixed an issue with multi-line strings in YAML files being associated with an invalid location,
|
||||
causing alerts related to such strings to appear at the top of the YAML file.
|
||||
|
|
@ -1,2 +1,2 @@
|
|||
---
|
||||
lastReleaseVersion: 0.4.3
|
||||
lastReleaseVersion: 0.4.4
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
name: codeql/javascript-queries
|
||||
version: 0.4.4-dev
|
||||
version: 0.4.4
|
||||
groups:
|
||||
- javascript
|
||||
- queries
|
||||
|
|
|
|||
|
|
@ -1,3 +1,7 @@
|
|||
## 0.3.4
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
## 0.3.3
|
||||
|
||||
No user-facing changes.
|
||||
|
|
|
|||
|
|
@ -0,0 +1,3 @@
|
|||
## 0.3.4
|
||||
|
||||
No user-facing changes.
|
||||
|
|
@ -1,2 +1,2 @@
|
|||
---
|
||||
lastReleaseVersion: 0.3.3
|
||||
lastReleaseVersion: 0.3.4
|
||||
|
|
|
|||
|
|
@ -1,3 +1,3 @@
|
|||
name: codeql/suite-helpers
|
||||
version: 0.3.4-dev
|
||||
version: 0.3.4
|
||||
groups: shared
|
||||
|
|
|
|||
|
|
@ -1,3 +1,9 @@
|
|||
## 0.6.4
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
* The ReDoS libraries in `semmle.code.python.security.regexp` has been moved to a shared pack inside the `shared/` folder, and the previous location has been deprecated.
|
||||
|
||||
## 0.6.3
|
||||
|
||||
No user-facing changes.
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* The ReDoS libraries in `semmle.code.python.security.regexp` has been moved to a shared pack inside the `shared/` folder, and the previous location has been deprecated.
|
||||
## 0.6.4
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
* The ReDoS libraries in `semmle.code.python.security.regexp` has been moved to a shared pack inside the `shared/` folder, and the previous location has been deprecated.
|
||||
|
|
@ -1,2 +1,2 @@
|
|||
---
|
||||
lastReleaseVersion: 0.6.3
|
||||
lastReleaseVersion: 0.6.4
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
name: codeql/python-all
|
||||
version: 0.6.4-dev
|
||||
version: 0.6.4
|
||||
groups: python
|
||||
dbscheme: semmlecode.python.dbscheme
|
||||
extractor: python
|
||||
|
|
|
|||
|
|
@ -1,3 +1,7 @@
|
|||
## 0.5.4
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
## 0.5.3
|
||||
|
||||
No user-facing changes.
|
||||
|
|
|
|||
|
|
@ -0,0 +1,3 @@
|
|||
## 0.5.4
|
||||
|
||||
No user-facing changes.
|
||||
|
|
@ -1,2 +1,2 @@
|
|||
---
|
||||
lastReleaseVersion: 0.5.3
|
||||
lastReleaseVersion: 0.5.4
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
name: codeql/python-queries
|
||||
version: 0.5.4-dev
|
||||
version: 0.5.4
|
||||
groups:
|
||||
- python
|
||||
- queries
|
||||
|
|
|
|||
|
|
@ -1,3 +1,17 @@
|
|||
## 0.4.4
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
* Data flow through the `ActiveSupport` extension `Enumerable#index_by` is now modeled.
|
||||
* The `codeql.ruby.Concepts` library now has a `SqlConstruction` class, in addition to the existing `SqlExecution` class.
|
||||
* Calls to `Arel.sql` are now modeled as instances of the new `SqlConstruction` concept.
|
||||
* Arguments to RPC endpoints (public methods) on subclasses of `ActionCable::Channel::Base` are now recognized as sources of remote user input.
|
||||
* Taint flow through the `ActiveSupport` extensions `Hash#reverse_merge` and `Hash:reverse_merge!`, and their aliases, is now modeled more generally, where previously it was only modeled in the context of `ActionController` parameters.
|
||||
* Calls to `logger` in `ActiveSupport` actions are now recognised as logger instances.
|
||||
* Calls to `send_data` in `ActiveSupport` actions are recognised as HTTP responses.
|
||||
* Calls to `body_stream` in `ActiveSupport` actions are recognised as HTTP request accesses.
|
||||
* The `ActiveSupport` extensions `Object#try` and `Object#try!` are now recognised as code executions.
|
||||
|
||||
## 0.4.3
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
|
|
|||
|
|
@ -1,4 +0,0 @@
|
|||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* The `ActiveSupport` extensions `Object#try` and `Object#try!` are now recognised as code executions.
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Calls to `logger` in `ActiveSupport` actions are now recognised as logger instances.
|
||||
* Calls to `send_data` in `ActiveSupport` actions are recognised as HTTP responses.
|
||||
* Calls to `body_stream` in `ActiveSupport` actions are recognised as HTTP request accesses.
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Taint flow through the `ActiveSupport` extensions `Hash#reverse_merge` and `Hash:reverse_merge!`, and their aliases, is now modeled more generally, where previously it was only modeled in the context of `ActionController` parameters.
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Arguments to RPC endpoints (public methods) on subclasses of `ActionCable::Channel::Base` are now recognized as sources of remote user input.
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* The `codeql.ruby.Concepts` library now has a `SqlConstruction` class, in addition to the existing `SqlExecution` class.
|
||||
* Calls to `Arel.sql` are now modeled as instances of the new `SqlConstruction` concept.
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Data flow through the `ActiveSupport` extension `Enumerable#index_by` is now modeled.
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
## 0.4.4
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
* Data flow through the `ActiveSupport` extension `Enumerable#index_by` is now modeled.
|
||||
* The `codeql.ruby.Concepts` library now has a `SqlConstruction` class, in addition to the existing `SqlExecution` class.
|
||||
* Calls to `Arel.sql` are now modeled as instances of the new `SqlConstruction` concept.
|
||||
* Arguments to RPC endpoints (public methods) on subclasses of `ActionCable::Channel::Base` are now recognized as sources of remote user input.
|
||||
* Taint flow through the `ActiveSupport` extensions `Hash#reverse_merge` and `Hash:reverse_merge!`, and their aliases, is now modeled more generally, where previously it was only modeled in the context of `ActionController` parameters.
|
||||
* Calls to `logger` in `ActiveSupport` actions are now recognised as logger instances.
|
||||
* Calls to `send_data` in `ActiveSupport` actions are recognised as HTTP responses.
|
||||
* Calls to `body_stream` in `ActiveSupport` actions are recognised as HTTP request accesses.
|
||||
* The `ActiveSupport` extensions `Object#try` and `Object#try!` are now recognised as code executions.
|
||||
|
|
@ -1,2 +1,2 @@
|
|||
---
|
||||
lastReleaseVersion: 0.4.3
|
||||
lastReleaseVersion: 0.4.4
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
name: codeql/ruby-all
|
||||
version: 0.4.4-dev
|
||||
version: 0.4.4
|
||||
groups: ruby
|
||||
extractor: ruby
|
||||
dbscheme: ruby.dbscheme
|
||||
|
|
|
|||
|
|
@ -1,3 +1,13 @@
|
|||
## 0.4.4
|
||||
|
||||
### New Queries
|
||||
|
||||
* Added a new query, `rb/shell-command-constructed-from-input`, to detect libraries that unsafely construct shell commands from their inputs.
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
* The `rb/sql-injection` query now considers consider SQL constructions, such as calls to `Arel.sql`, as sinks.
|
||||
|
||||
## 0.4.3
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
|
|
|||
|
|
@ -1,4 +0,0 @@
|
|||
---
|
||||
category: newQuery
|
||||
---
|
||||
* Added a new query, `rb/shell-command-constructed-from-input`, to detect libraries that unsafely construct shell commands from their inputs.
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* The `rb/sql-injection` query now considers consider SQL constructions, such as calls to `Arel.sql`, as sinks.
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
## 0.4.4
|
||||
|
||||
### New Queries
|
||||
|
||||
* Added a new query, `rb/shell-command-constructed-from-input`, to detect libraries that unsafely construct shell commands from their inputs.
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
* The `rb/sql-injection` query now considers consider SQL constructions, such as calls to `Arel.sql`, as sinks.
|
||||
|
|
@ -1,2 +1,2 @@
|
|||
---
|
||||
lastReleaseVersion: 0.4.3
|
||||
lastReleaseVersion: 0.4.4
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
name: codeql/ruby-queries
|
||||
version: 0.4.4-dev
|
||||
version: 0.4.4
|
||||
groups:
|
||||
- ruby
|
||||
- queries
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
## 0.0.1
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
* Initial release. Extracted common regex related code, including the ReDoS analysis, into a library pack to share code between languages.
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
## 0.0.1
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
* Initial release. Extracted common regex related code, including the ReDoS analysis, into a library pack to share code between languages.
|
||||
|
|
@ -0,0 +1,2 @@
|
|||
---
|
||||
lastReleaseVersion: 0.0.1
|
||||
|
|
@ -1,5 +1,5 @@
|
|||
name: codeql/regex
|
||||
version: 0.0.1-dev
|
||||
version: 0.0.1
|
||||
groups: shared
|
||||
library: true
|
||||
dependencies:
|
||||
|
|
|
|||
|
|
@ -1,3 +1,7 @@
|
|||
## 0.0.5
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
## 0.0.4
|
||||
|
||||
No user-facing changes.
|
||||
|
|
|
|||
|
|
@ -0,0 +1,3 @@
|
|||
## 0.0.5
|
||||
|
||||
No user-facing changes.
|
||||
|
|
@ -1,2 +1,2 @@
|
|||
---
|
||||
lastReleaseVersion: 0.0.4
|
||||
lastReleaseVersion: 0.0.5
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
name: codeql/ssa
|
||||
version: 0.0.5-dev
|
||||
version: 0.0.5
|
||||
groups: shared
|
||||
library: true
|
||||
|
|
|
|||
|
|
@ -1,3 +1,7 @@
|
|||
## 0.0.5
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
## 0.0.4
|
||||
|
||||
No user-facing changes.
|
||||
|
|
|
|||
|
|
@ -0,0 +1,3 @@
|
|||
## 0.0.5
|
||||
|
||||
No user-facing changes.
|
||||
|
|
@ -1,2 +1,2 @@
|
|||
---
|
||||
lastReleaseVersion: 0.0.4
|
||||
lastReleaseVersion: 0.0.5
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
name: codeql/typos
|
||||
version: 0.0.5-dev
|
||||
version: 0.0.5
|
||||
groups: shared
|
||||
library: true
|
||||
|
|
|
|||
Загрузка…
Ссылка в новой задаче