From 508327235ae88492fc1eff47bb142bc0912e335e Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Fri, 4 Nov 2022 20:16:23 +0000 Subject: [PATCH 1/3] Release preparation for version 2.11.3 --- cpp/ql/lib/CHANGELOG.md | 6 ++++++ .../0.4.3.md} | 7 ++++--- cpp/ql/lib/codeql-pack.release.yml | 2 +- cpp/ql/lib/qlpack.yml | 2 +- cpp/ql/src/CHANGELOG.md | 6 ++++++ .../0.4.3.md} | 9 +++++---- cpp/ql/src/codeql-pack.release.yml | 2 +- cpp/ql/src/qlpack.yml | 2 +- csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md | 4 ++++ .../Solorigate/lib/change-notes/released/1.3.3.md | 3 +++ .../Solorigate/lib/codeql-pack.release.yml | 2 +- csharp/ql/campaigns/Solorigate/lib/qlpack.yml | 2 +- csharp/ql/campaigns/Solorigate/src/CHANGELOG.md | 4 ++++ .../Solorigate/src/change-notes/released/1.3.3.md | 3 +++ .../Solorigate/src/codeql-pack.release.yml | 2 +- csharp/ql/campaigns/Solorigate/src/qlpack.yml | 2 +- csharp/ql/lib/CHANGELOG.md | 4 ++++ csharp/ql/lib/change-notes/released/0.4.3.md | 3 +++ csharp/ql/lib/codeql-pack.release.yml | 2 +- csharp/ql/lib/qlpack.yml | 2 +- csharp/ql/src/CHANGELOG.md | 4 ++++ csharp/ql/src/change-notes/released/0.4.3.md | 3 +++ csharp/ql/src/codeql-pack.release.yml | 2 +- csharp/ql/src/qlpack.yml | 2 +- go/ql/lib/CHANGELOG.md | 4 ++++ go/ql/lib/change-notes/released/0.3.3.md | 3 +++ go/ql/lib/codeql-pack.release.yml | 2 +- go/ql/lib/qlpack.yml | 2 +- go/ql/src/CHANGELOG.md | 6 ++++++ .../0.3.3.md} | 7 ++++--- go/ql/src/codeql-pack.release.yml | 2 +- go/ql/src/qlpack.yml | 2 +- java/ql/lib/CHANGELOG.md | 4 ++++ java/ql/lib/change-notes/released/0.4.3.md | 3 +++ java/ql/lib/codeql-pack.release.yml | 2 +- java/ql/lib/qlpack.yml | 2 +- java/ql/src/CHANGELOG.md | 4 ++++ java/ql/src/change-notes/released/0.4.3.md | 3 +++ java/ql/src/codeql-pack.release.yml | 2 +- java/ql/src/qlpack.yml | 2 +- javascript/ql/lib/CHANGELOG.md | 4 ++++ javascript/ql/lib/change-notes/released/0.3.3.md | 3 +++ javascript/ql/lib/codeql-pack.release.yml | 2 +- javascript/ql/lib/qlpack.yml | 2 +- javascript/ql/src/CHANGELOG.md | 14 ++++++++++++++ .../2022-09-05-second-order-command-injection.md | 7 ------- .../src/change-notes/2022-10-07-alert-messages.md | 4 ---- .../src/change-notes/2022-10-26-nextjs-params.md | 5 ----- javascript/ql/src/change-notes/released/0.4.3.md | 13 +++++++++++++ javascript/ql/src/codeql-pack.release.yml | 2 +- javascript/ql/src/qlpack.yml | 2 +- misc/suite-helpers/CHANGELOG.md | 4 ++++ misc/suite-helpers/change-notes/released/0.3.3.md | 3 +++ misc/suite-helpers/codeql-pack.release.yml | 2 +- misc/suite-helpers/qlpack.yml | 2 +- python/ql/lib/CHANGELOG.md | 4 ++++ python/ql/lib/change-notes/released/0.6.3.md | 3 +++ python/ql/lib/codeql-pack.release.yml | 2 +- python/ql/lib/qlpack.yml | 2 +- python/ql/src/CHANGELOG.md | 4 ++++ python/ql/src/change-notes/released/0.5.3.md | 3 +++ python/ql/src/codeql-pack.release.yml | 2 +- python/ql/src/qlpack.yml | 2 +- ruby/ql/lib/CHANGELOG.md | 9 +++++++++ .../change-notes/2022-10-18-activesupport-flow.md | 5 ----- ...022-10-20-expand-faraday-model-for-ssrf-sink.md | 5 ----- .../change-notes/2022-10-21-local-taint-step.md | 4 ---- ruby/ql/lib/change-notes/released/0.4.3.md | 8 ++++++++ ruby/ql/lib/codeql-pack.release.yml | 2 +- ruby/ql/lib/qlpack.yml | 2 +- ruby/ql/src/CHANGELOG.md | 6 ++++++ .../0.4.3.md} | 7 ++++--- ruby/ql/src/codeql-pack.release.yml | 2 +- ruby/ql/src/qlpack.yml | 2 +- shared/ssa/CHANGELOG.md | 4 ++++ shared/ssa/change-notes/released/0.0.4.md | 3 +++ shared/ssa/codeql-pack.release.yml | 2 +- shared/ssa/qlpack.yml | 2 +- shared/typos/CHANGELOG.md | 4 ++++ shared/typos/change-notes/released/0.0.4.md | 3 +++ shared/typos/codeql-pack.release.yml | 2 +- shared/typos/qlpack.yml | 2 +- 82 files changed, 214 insertions(+), 81 deletions(-) rename cpp/ql/lib/change-notes/{2022-10-22-format-literal.md => released/0.4.3.md} (83%) rename cpp/ql/src/change-notes/{2022-11-03-av-rule-76.md => released/0.4.3.md} (62%) create mode 100644 csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.3.3.md create mode 100644 csharp/ql/campaigns/Solorigate/src/change-notes/released/1.3.3.md create mode 100644 csharp/ql/lib/change-notes/released/0.4.3.md create mode 100644 csharp/ql/src/change-notes/released/0.4.3.md create mode 100644 go/ql/lib/change-notes/released/0.3.3.md rename go/ql/src/change-notes/{2022-10-28-protobuf-cleartext-logging.md => released/0.3.3.md} (85%) create mode 100644 java/ql/lib/change-notes/released/0.4.3.md create mode 100644 java/ql/src/change-notes/released/0.4.3.md create mode 100644 javascript/ql/lib/change-notes/released/0.3.3.md delete mode 100644 javascript/ql/src/change-notes/2022-09-05-second-order-command-injection.md delete mode 100644 javascript/ql/src/change-notes/2022-10-07-alert-messages.md delete mode 100644 javascript/ql/src/change-notes/2022-10-26-nextjs-params.md create mode 100644 javascript/ql/src/change-notes/released/0.4.3.md create mode 100644 misc/suite-helpers/change-notes/released/0.3.3.md create mode 100644 python/ql/lib/change-notes/released/0.6.3.md create mode 100644 python/ql/src/change-notes/released/0.5.3.md delete mode 100644 ruby/ql/lib/change-notes/2022-10-18-activesupport-flow.md delete mode 100644 ruby/ql/lib/change-notes/2022-10-20-expand-faraday-model-for-ssrf-sink.md delete mode 100644 ruby/ql/lib/change-notes/2022-10-21-local-taint-step.md create mode 100644 ruby/ql/lib/change-notes/released/0.4.3.md rename ruby/ql/src/change-notes/{2022-11-04-weak-crypto-hash.md => released/0.4.3.md} (86%) create mode 100644 shared/ssa/change-notes/released/0.0.4.md create mode 100644 shared/typos/change-notes/released/0.0.4.md diff --git a/cpp/ql/lib/CHANGELOG.md b/cpp/ql/lib/CHANGELOG.md index dddc44048195..0a7a31b8db92 100644 --- a/cpp/ql/lib/CHANGELOG.md +++ b/cpp/ql/lib/CHANGELOG.md @@ -1,3 +1,9 @@ +## 0.4.3 + +### Minor Analysis Improvements + +* Fixed bugs in the `FormatLiteral` class that were causing `getMaxConvertedLength` and related predicates to return no results when the format literal was `%e`, `%f` or `%g` and an explicit precision was specified. + ## 0.4.2 No user-facing changes. diff --git a/cpp/ql/lib/change-notes/2022-10-22-format-literal.md b/cpp/ql/lib/change-notes/released/0.4.3.md similarity index 83% rename from cpp/ql/lib/change-notes/2022-10-22-format-literal.md rename to cpp/ql/lib/change-notes/released/0.4.3.md index 4a8c31502a0c..9c293649964a 100644 --- a/cpp/ql/lib/change-notes/2022-10-22-format-literal.md +++ b/cpp/ql/lib/change-notes/released/0.4.3.md @@ -1,4 +1,5 @@ ---- -category: minorAnalysis ---- +## 0.4.3 + +### Minor Analysis Improvements + * Fixed bugs in the `FormatLiteral` class that were causing `getMaxConvertedLength` and related predicates to return no results when the format literal was `%e`, `%f` or `%g` and an explicit precision was specified. diff --git a/cpp/ql/lib/codeql-pack.release.yml b/cpp/ql/lib/codeql-pack.release.yml index 94c5b17423cc..1ec9c4ea5d96 100644 --- a/cpp/ql/lib/codeql-pack.release.yml +++ b/cpp/ql/lib/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.4.2 +lastReleaseVersion: 0.4.3 diff --git a/cpp/ql/lib/qlpack.yml b/cpp/ql/lib/qlpack.yml index 8ede550cde65..bc1a3c693900 100644 --- a/cpp/ql/lib/qlpack.yml +++ b/cpp/ql/lib/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/cpp-all -version: 0.4.3-dev +version: 0.4.3 groups: cpp dbscheme: semmlecode.cpp.dbscheme extractor: cpp diff --git a/cpp/ql/src/CHANGELOG.md b/cpp/ql/src/CHANGELOG.md index f35363a4d8d7..f32f416b540c 100644 --- a/cpp/ql/src/CHANGELOG.md +++ b/cpp/ql/src/CHANGELOG.md @@ -1,3 +1,9 @@ +## 0.4.3 + +### Minor Analysis Improvements + +* Fixed a bug in `cpp/jsf/av-rule-76` that caused the query to miss results when an implicitly-defined copy constructor or copy assignment operator was generated. + ## 0.4.2 ### New Queries diff --git a/cpp/ql/src/change-notes/2022-11-03-av-rule-76.md b/cpp/ql/src/change-notes/released/0.4.3.md similarity index 62% rename from cpp/ql/src/change-notes/2022-11-03-av-rule-76.md rename to cpp/ql/src/change-notes/released/0.4.3.md index bd3f75c5114a..f076ec8a1a13 100644 --- a/cpp/ql/src/change-notes/2022-11-03-av-rule-76.md +++ b/cpp/ql/src/change-notes/released/0.4.3.md @@ -1,4 +1,5 @@ ---- -category: minorAnalysis ---- -* Fixed a bug in `cpp/jsf/av-rule-76` that caused the query to miss results when an implicitly-defined copy constructor or copy assignment operator was generated. \ No newline at end of file +## 0.4.3 + +### Minor Analysis Improvements + +* Fixed a bug in `cpp/jsf/av-rule-76` that caused the query to miss results when an implicitly-defined copy constructor or copy assignment operator was generated. diff --git a/cpp/ql/src/codeql-pack.release.yml b/cpp/ql/src/codeql-pack.release.yml index 94c5b17423cc..1ec9c4ea5d96 100644 --- a/cpp/ql/src/codeql-pack.release.yml +++ b/cpp/ql/src/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.4.2 +lastReleaseVersion: 0.4.3 diff --git a/cpp/ql/src/qlpack.yml b/cpp/ql/src/qlpack.yml index 777c9c80f27e..2b9ba3b6a2bd 100644 --- a/cpp/ql/src/qlpack.yml +++ b/cpp/ql/src/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/cpp-queries -version: 0.4.3-dev +version: 0.4.3 groups: - cpp - queries diff --git a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md index 3a38dc1a76fa..98c13dfaa77e 100644 --- a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md +++ b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md @@ -1,3 +1,7 @@ +## 1.3.3 + +No user-facing changes. + ## 1.3.2 No user-facing changes. diff --git a/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.3.3.md b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.3.3.md new file mode 100644 index 000000000000..27a88ea0061a --- /dev/null +++ b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.3.3.md @@ -0,0 +1,3 @@ +## 1.3.3 + +No user-facing changes. diff --git a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml index 86a9cb32d86b..eb1f7dabc842 100644 --- a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml +++ b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 1.3.2 +lastReleaseVersion: 1.3.3 diff --git a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml index 0cefa10e2d1b..dbb24b17c4e1 100644 --- a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml +++ b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/csharp-solorigate-all -version: 1.3.3-dev +version: 1.3.3 groups: - csharp - solorigate diff --git a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md index 3a38dc1a76fa..98c13dfaa77e 100644 --- a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md +++ b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md @@ -1,3 +1,7 @@ +## 1.3.3 + +No user-facing changes. + ## 1.3.2 No user-facing changes. diff --git a/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.3.3.md b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.3.3.md new file mode 100644 index 000000000000..27a88ea0061a --- /dev/null +++ b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.3.3.md @@ -0,0 +1,3 @@ +## 1.3.3 + +No user-facing changes. diff --git a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml index 86a9cb32d86b..eb1f7dabc842 100644 --- a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml +++ b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 1.3.2 +lastReleaseVersion: 1.3.3 diff --git a/csharp/ql/campaigns/Solorigate/src/qlpack.yml b/csharp/ql/campaigns/Solorigate/src/qlpack.yml index 6cb9cffed4f8..3a77ada168d4 100644 --- a/csharp/ql/campaigns/Solorigate/src/qlpack.yml +++ b/csharp/ql/campaigns/Solorigate/src/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/csharp-solorigate-queries -version: 1.3.3-dev +version: 1.3.3 groups: - csharp - solorigate diff --git a/csharp/ql/lib/CHANGELOG.md b/csharp/ql/lib/CHANGELOG.md index 1072e776f887..2fff5e724433 100644 --- a/csharp/ql/lib/CHANGELOG.md +++ b/csharp/ql/lib/CHANGELOG.md @@ -1,3 +1,7 @@ +## 0.4.3 + +No user-facing changes. + ## 0.4.2 No user-facing changes. diff --git a/csharp/ql/lib/change-notes/released/0.4.3.md b/csharp/ql/lib/change-notes/released/0.4.3.md new file mode 100644 index 000000000000..126fb6225832 --- /dev/null +++ b/csharp/ql/lib/change-notes/released/0.4.3.md @@ -0,0 +1,3 @@ +## 0.4.3 + +No user-facing changes. diff --git a/csharp/ql/lib/codeql-pack.release.yml b/csharp/ql/lib/codeql-pack.release.yml index 94c5b17423cc..1ec9c4ea5d96 100644 --- a/csharp/ql/lib/codeql-pack.release.yml +++ b/csharp/ql/lib/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.4.2 +lastReleaseVersion: 0.4.3 diff --git a/csharp/ql/lib/qlpack.yml b/csharp/ql/lib/qlpack.yml index 49fa2abf0a09..74be764d08d8 100644 --- a/csharp/ql/lib/qlpack.yml +++ b/csharp/ql/lib/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/csharp-all -version: 0.4.3-dev +version: 0.4.3 groups: csharp dbscheme: semmlecode.csharp.dbscheme extractor: csharp diff --git a/csharp/ql/src/CHANGELOG.md b/csharp/ql/src/CHANGELOG.md index be188d00f9bb..46be24580ef5 100644 --- a/csharp/ql/src/CHANGELOG.md +++ b/csharp/ql/src/CHANGELOG.md @@ -1,3 +1,7 @@ +## 0.4.3 + +No user-facing changes. + ## 0.4.2 No user-facing changes. diff --git a/csharp/ql/src/change-notes/released/0.4.3.md b/csharp/ql/src/change-notes/released/0.4.3.md new file mode 100644 index 000000000000..126fb6225832 --- /dev/null +++ b/csharp/ql/src/change-notes/released/0.4.3.md @@ -0,0 +1,3 @@ +## 0.4.3 + +No user-facing changes. diff --git a/csharp/ql/src/codeql-pack.release.yml b/csharp/ql/src/codeql-pack.release.yml index 94c5b17423cc..1ec9c4ea5d96 100644 --- a/csharp/ql/src/codeql-pack.release.yml +++ b/csharp/ql/src/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.4.2 +lastReleaseVersion: 0.4.3 diff --git a/csharp/ql/src/qlpack.yml b/csharp/ql/src/qlpack.yml index 0a0360889f13..d783b74a3ce8 100644 --- a/csharp/ql/src/qlpack.yml +++ b/csharp/ql/src/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/csharp-queries -version: 0.4.3-dev +version: 0.4.3 groups: - csharp - queries diff --git a/go/ql/lib/CHANGELOG.md b/go/ql/lib/CHANGELOG.md index d813fe317f51..681412ed46fc 100644 --- a/go/ql/lib/CHANGELOG.md +++ b/go/ql/lib/CHANGELOG.md @@ -1,3 +1,7 @@ +## 0.3.3 + +No user-facing changes. + ## 0.3.2 No user-facing changes. diff --git a/go/ql/lib/change-notes/released/0.3.3.md b/go/ql/lib/change-notes/released/0.3.3.md new file mode 100644 index 000000000000..8bf29dd1088d --- /dev/null +++ b/go/ql/lib/change-notes/released/0.3.3.md @@ -0,0 +1,3 @@ +## 0.3.3 + +No user-facing changes. diff --git a/go/ql/lib/codeql-pack.release.yml b/go/ql/lib/codeql-pack.release.yml index 18c64250f424..9da182d33948 100644 --- a/go/ql/lib/codeql-pack.release.yml +++ b/go/ql/lib/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.3.2 +lastReleaseVersion: 0.3.3 diff --git a/go/ql/lib/qlpack.yml b/go/ql/lib/qlpack.yml index 24c59d336170..2a4336e09f9d 100644 --- a/go/ql/lib/qlpack.yml +++ b/go/ql/lib/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/go-all -version: 0.3.3-dev +version: 0.3.3 groups: go dbscheme: go.dbscheme extractor: go diff --git a/go/ql/src/CHANGELOG.md b/go/ql/src/CHANGELOG.md index 8ebc7a8bc40d..65aa3c40d99d 100644 --- a/go/ql/src/CHANGELOG.md +++ b/go/ql/src/CHANGELOG.md @@ -1,3 +1,9 @@ +## 0.3.3 + +### Minor Analysis Improvements + +* Query `go/clear-text-logging` now excludes `GetX` methods of protobuf `Message` structs, except where taint is specifically known to belong to the right field. This is to avoid FPs where taint is written to one field and then spuriously read from another. + ## 0.3.2 ### Minor Analysis Improvements diff --git a/go/ql/src/change-notes/2022-10-28-protobuf-cleartext-logging.md b/go/ql/src/change-notes/released/0.3.3.md similarity index 85% rename from go/ql/src/change-notes/2022-10-28-protobuf-cleartext-logging.md rename to go/ql/src/change-notes/released/0.3.3.md index 6f994f945a59..faf553725c1f 100644 --- a/go/ql/src/change-notes/2022-10-28-protobuf-cleartext-logging.md +++ b/go/ql/src/change-notes/released/0.3.3.md @@ -1,4 +1,5 @@ ---- -category: minorAnalysis ---- +## 0.3.3 + +### Minor Analysis Improvements + * Query `go/clear-text-logging` now excludes `GetX` methods of protobuf `Message` structs, except where taint is specifically known to belong to the right field. This is to avoid FPs where taint is written to one field and then spuriously read from another. diff --git a/go/ql/src/codeql-pack.release.yml b/go/ql/src/codeql-pack.release.yml index 18c64250f424..9da182d33948 100644 --- a/go/ql/src/codeql-pack.release.yml +++ b/go/ql/src/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.3.2 +lastReleaseVersion: 0.3.3 diff --git a/go/ql/src/qlpack.yml b/go/ql/src/qlpack.yml index dfadd9af566e..d6aea5402d25 100644 --- a/go/ql/src/qlpack.yml +++ b/go/ql/src/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/go-queries -version: 0.3.3-dev +version: 0.3.3 groups: - go - queries diff --git a/java/ql/lib/CHANGELOG.md b/java/ql/lib/CHANGELOG.md index 68e22befd367..696c3097fac9 100644 --- a/java/ql/lib/CHANGELOG.md +++ b/java/ql/lib/CHANGELOG.md @@ -1,3 +1,7 @@ +## 0.4.3 + +No user-facing changes. + ## 0.4.2 ### Deprecated APIs diff --git a/java/ql/lib/change-notes/released/0.4.3.md b/java/ql/lib/change-notes/released/0.4.3.md new file mode 100644 index 000000000000..126fb6225832 --- /dev/null +++ b/java/ql/lib/change-notes/released/0.4.3.md @@ -0,0 +1,3 @@ +## 0.4.3 + +No user-facing changes. diff --git a/java/ql/lib/codeql-pack.release.yml b/java/ql/lib/codeql-pack.release.yml index 94c5b17423cc..1ec9c4ea5d96 100644 --- a/java/ql/lib/codeql-pack.release.yml +++ b/java/ql/lib/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.4.2 +lastReleaseVersion: 0.4.3 diff --git a/java/ql/lib/qlpack.yml b/java/ql/lib/qlpack.yml index 641cfff6c2ed..41604876de06 100644 --- a/java/ql/lib/qlpack.yml +++ b/java/ql/lib/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/java-all -version: 0.4.3-dev +version: 0.4.3 groups: java dbscheme: config/semmlecode.dbscheme extractor: java diff --git a/java/ql/src/CHANGELOG.md b/java/ql/src/CHANGELOG.md index 98a262943c91..61b4170ca740 100644 --- a/java/ql/src/CHANGELOG.md +++ b/java/ql/src/CHANGELOG.md @@ -1,3 +1,7 @@ +## 0.4.3 + +No user-facing changes. + ## 0.4.2 ### New Queries diff --git a/java/ql/src/change-notes/released/0.4.3.md b/java/ql/src/change-notes/released/0.4.3.md new file mode 100644 index 000000000000..126fb6225832 --- /dev/null +++ b/java/ql/src/change-notes/released/0.4.3.md @@ -0,0 +1,3 @@ +## 0.4.3 + +No user-facing changes. diff --git a/java/ql/src/codeql-pack.release.yml b/java/ql/src/codeql-pack.release.yml index 94c5b17423cc..1ec9c4ea5d96 100644 --- a/java/ql/src/codeql-pack.release.yml +++ b/java/ql/src/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.4.2 +lastReleaseVersion: 0.4.3 diff --git a/java/ql/src/qlpack.yml b/java/ql/src/qlpack.yml index b638cf878dd8..81a41dd63b64 100644 --- a/java/ql/src/qlpack.yml +++ b/java/ql/src/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/java-queries -version: 0.4.3-dev +version: 0.4.3 groups: - java - queries diff --git a/javascript/ql/lib/CHANGELOG.md b/javascript/ql/lib/CHANGELOG.md index c2abad0b00b3..ac17e9e9f27b 100644 --- a/javascript/ql/lib/CHANGELOG.md +++ b/javascript/ql/lib/CHANGELOG.md @@ -1,3 +1,7 @@ +## 0.3.3 + +No user-facing changes. + ## 0.3.2 No user-facing changes. diff --git a/javascript/ql/lib/change-notes/released/0.3.3.md b/javascript/ql/lib/change-notes/released/0.3.3.md new file mode 100644 index 000000000000..8bf29dd1088d --- /dev/null +++ b/javascript/ql/lib/change-notes/released/0.3.3.md @@ -0,0 +1,3 @@ +## 0.3.3 + +No user-facing changes. diff --git a/javascript/ql/lib/codeql-pack.release.yml b/javascript/ql/lib/codeql-pack.release.yml index 18c64250f424..9da182d33948 100644 --- a/javascript/ql/lib/codeql-pack.release.yml +++ b/javascript/ql/lib/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.3.2 +lastReleaseVersion: 0.3.3 diff --git a/javascript/ql/lib/qlpack.yml b/javascript/ql/lib/qlpack.yml index 2295fcf87150..85ac7bd42797 100644 --- a/javascript/ql/lib/qlpack.yml +++ b/javascript/ql/lib/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/javascript-all -version: 0.3.3-dev +version: 0.3.3 groups: javascript dbscheme: semmlecode.javascript.dbscheme extractor: javascript diff --git a/javascript/ql/src/CHANGELOG.md b/javascript/ql/src/CHANGELOG.md index 3a0d14456d63..3928801d4566 100644 --- a/javascript/ql/src/CHANGELOG.md +++ b/javascript/ql/src/CHANGELOG.md @@ -1,3 +1,17 @@ +## 0.4.3 + +### New Queries + +* Added a new query, `js/second-order-command-line-injection`, to detect shell + commands that may execute arbitrary code when the user has control over + the arguments to a command-line program. + This currently flags up unsafe invocations of git and hg. + +### Minor Analysis Improvements + +- Added sources for user defined path and query parameters in `Next.js`. +* The alert message of many queries have been changed to better follow the style guide and make the message consistent with other languages. + ## 0.4.2 ### Minor Analysis Improvements diff --git a/javascript/ql/src/change-notes/2022-09-05-second-order-command-injection.md b/javascript/ql/src/change-notes/2022-09-05-second-order-command-injection.md deleted file mode 100644 index 4550e75b988f..000000000000 --- a/javascript/ql/src/change-notes/2022-09-05-second-order-command-injection.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -category: newQuery ---- -* Added a new query, `js/second-order-command-line-injection`, to detect shell - commands that may execute arbitrary code when the user has control over - the arguments to a command-line program. - This currently flags up unsafe invocations of git and hg. diff --git a/javascript/ql/src/change-notes/2022-10-07-alert-messages.md b/javascript/ql/src/change-notes/2022-10-07-alert-messages.md deleted file mode 100644 index de46b7752ebf..000000000000 --- a/javascript/ql/src/change-notes/2022-10-07-alert-messages.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -category: minorAnalysis ---- -* The alert message of many queries have been changed to better follow the style guide and make the message consistent with other languages. \ No newline at end of file diff --git a/javascript/ql/src/change-notes/2022-10-26-nextjs-params.md b/javascript/ql/src/change-notes/2022-10-26-nextjs-params.md deleted file mode 100644 index 18eb9b9877bf..000000000000 --- a/javascript/ql/src/change-notes/2022-10-26-nextjs-params.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -category: minorAnalysis ---- - -- Added sources for user defined path and query parameters in `Next.js`. diff --git a/javascript/ql/src/change-notes/released/0.4.3.md b/javascript/ql/src/change-notes/released/0.4.3.md new file mode 100644 index 000000000000..3bd15bf43e29 --- /dev/null +++ b/javascript/ql/src/change-notes/released/0.4.3.md @@ -0,0 +1,13 @@ +## 0.4.3 + +### New Queries + +* Added a new query, `js/second-order-command-line-injection`, to detect shell + commands that may execute arbitrary code when the user has control over + the arguments to a command-line program. + This currently flags up unsafe invocations of git and hg. + +### Minor Analysis Improvements + +- Added sources for user defined path and query parameters in `Next.js`. +* The alert message of many queries have been changed to better follow the style guide and make the message consistent with other languages. diff --git a/javascript/ql/src/codeql-pack.release.yml b/javascript/ql/src/codeql-pack.release.yml index 94c5b17423cc..1ec9c4ea5d96 100644 --- a/javascript/ql/src/codeql-pack.release.yml +++ b/javascript/ql/src/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.4.2 +lastReleaseVersion: 0.4.3 diff --git a/javascript/ql/src/qlpack.yml b/javascript/ql/src/qlpack.yml index 6c1ec33b2575..6d0c5dbdf5c9 100644 --- a/javascript/ql/src/qlpack.yml +++ b/javascript/ql/src/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/javascript-queries -version: 0.4.3-dev +version: 0.4.3 groups: - javascript - queries diff --git a/misc/suite-helpers/CHANGELOG.md b/misc/suite-helpers/CHANGELOG.md index 9be99c3eef1e..e3d9cec6f665 100644 --- a/misc/suite-helpers/CHANGELOG.md +++ b/misc/suite-helpers/CHANGELOG.md @@ -1,3 +1,7 @@ +## 0.3.3 + +No user-facing changes. + ## 0.3.2 No user-facing changes. diff --git a/misc/suite-helpers/change-notes/released/0.3.3.md b/misc/suite-helpers/change-notes/released/0.3.3.md new file mode 100644 index 000000000000..8bf29dd1088d --- /dev/null +++ b/misc/suite-helpers/change-notes/released/0.3.3.md @@ -0,0 +1,3 @@ +## 0.3.3 + +No user-facing changes. diff --git a/misc/suite-helpers/codeql-pack.release.yml b/misc/suite-helpers/codeql-pack.release.yml index 18c64250f424..9da182d33948 100644 --- a/misc/suite-helpers/codeql-pack.release.yml +++ b/misc/suite-helpers/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.3.2 +lastReleaseVersion: 0.3.3 diff --git a/misc/suite-helpers/qlpack.yml b/misc/suite-helpers/qlpack.yml index 724d134709b3..d0624712842d 100644 --- a/misc/suite-helpers/qlpack.yml +++ b/misc/suite-helpers/qlpack.yml @@ -1,3 +1,3 @@ name: codeql/suite-helpers -version: 0.3.3-dev +version: 0.3.3 groups: shared diff --git a/python/ql/lib/CHANGELOG.md b/python/ql/lib/CHANGELOG.md index dcbe14b2e7e5..ee84607f6832 100644 --- a/python/ql/lib/CHANGELOG.md +++ b/python/ql/lib/CHANGELOG.md @@ -1,3 +1,7 @@ +## 0.6.3 + +No user-facing changes. + ## 0.6.2 ### Minor Analysis Improvements diff --git a/python/ql/lib/change-notes/released/0.6.3.md b/python/ql/lib/change-notes/released/0.6.3.md new file mode 100644 index 000000000000..83374bcef56f --- /dev/null +++ b/python/ql/lib/change-notes/released/0.6.3.md @@ -0,0 +1,3 @@ +## 0.6.3 + +No user-facing changes. diff --git a/python/ql/lib/codeql-pack.release.yml b/python/ql/lib/codeql-pack.release.yml index 5501a2a1cc59..b7dafe32c5d8 100644 --- a/python/ql/lib/codeql-pack.release.yml +++ b/python/ql/lib/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.6.2 +lastReleaseVersion: 0.6.3 diff --git a/python/ql/lib/qlpack.yml b/python/ql/lib/qlpack.yml index 83a2674beebf..9522c9d8ee58 100644 --- a/python/ql/lib/qlpack.yml +++ b/python/ql/lib/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/python-all -version: 0.6.3-dev +version: 0.6.3 groups: python dbscheme: semmlecode.python.dbscheme extractor: python diff --git a/python/ql/src/CHANGELOG.md b/python/ql/src/CHANGELOG.md index e9eaaf2a1abc..9e30f0aba2fe 100644 --- a/python/ql/src/CHANGELOG.md +++ b/python/ql/src/CHANGELOG.md @@ -1,3 +1,7 @@ +## 0.5.3 + +No user-facing changes. + ## 0.5.2 ### Minor Analysis Improvements diff --git a/python/ql/src/change-notes/released/0.5.3.md b/python/ql/src/change-notes/released/0.5.3.md new file mode 100644 index 000000000000..e97503053f02 --- /dev/null +++ b/python/ql/src/change-notes/released/0.5.3.md @@ -0,0 +1,3 @@ +## 0.5.3 + +No user-facing changes. diff --git a/python/ql/src/codeql-pack.release.yml b/python/ql/src/codeql-pack.release.yml index 2d9d3f587f82..2164e038a5d1 100644 --- a/python/ql/src/codeql-pack.release.yml +++ b/python/ql/src/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.5.2 +lastReleaseVersion: 0.5.3 diff --git a/python/ql/src/qlpack.yml b/python/ql/src/qlpack.yml index d318213b9033..0471a6a2b062 100644 --- a/python/ql/src/qlpack.yml +++ b/python/ql/src/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/python-queries -version: 0.5.3-dev +version: 0.5.3 groups: - python - queries diff --git a/ruby/ql/lib/CHANGELOG.md b/ruby/ql/lib/CHANGELOG.md index 82449bb0569b..dd53c568ecda 100644 --- a/ruby/ql/lib/CHANGELOG.md +++ b/ruby/ql/lib/CHANGELOG.md @@ -1,3 +1,12 @@ +## 0.4.3 + +### Minor Analysis Improvements + + * There was a bug in `TaintTracking::localTaint` and `TaintTracking::localTaintStep` such that they only tracked non-value-preserving flow steps. They have been fixed and now also include value-preserving steps. +- Instantiations using `Faraday::Connection.new` are now recognized as part of `FaradayHttpRequest`s, meaning they will be considered as sinks for queries such as `rb/request-forgery`. +* Taint flow is now tracked through extension methods on `Hash`, `String` and + `Object` provided by `ActiveSupport`. + ## 0.4.2 ### Minor Analysis Improvements diff --git a/ruby/ql/lib/change-notes/2022-10-18-activesupport-flow.md b/ruby/ql/lib/change-notes/2022-10-18-activesupport-flow.md deleted file mode 100644 index bfb3b0c8950a..000000000000 --- a/ruby/ql/lib/change-notes/2022-10-18-activesupport-flow.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -category: minorAnalysis ---- -* Taint flow is now tracked through extension methods on `Hash`, `String` and - `Object` provided by `ActiveSupport`. diff --git a/ruby/ql/lib/change-notes/2022-10-20-expand-faraday-model-for-ssrf-sink.md b/ruby/ql/lib/change-notes/2022-10-20-expand-faraday-model-for-ssrf-sink.md deleted file mode 100644 index 0d22d59522e0..000000000000 --- a/ruby/ql/lib/change-notes/2022-10-20-expand-faraday-model-for-ssrf-sink.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -category: minorAnalysis ---- - -- Instantiations using `Faraday::Connection.new` are now recognized as part of `FaradayHttpRequest`s, meaning they will be considered as sinks for queries such as `rb/request-forgery`. diff --git a/ruby/ql/lib/change-notes/2022-10-21-local-taint-step.md b/ruby/ql/lib/change-notes/2022-10-21-local-taint-step.md deleted file mode 100644 index baf99174d55b..000000000000 --- a/ruby/ql/lib/change-notes/2022-10-21-local-taint-step.md +++ /dev/null @@ -1,4 +0,0 @@ ---- - category: minorAnalysis ---- - * There was a bug in `TaintTracking::localTaint` and `TaintTracking::localTaintStep` such that they only tracked non-value-preserving flow steps. They have been fixed and now also include value-preserving steps. \ No newline at end of file diff --git a/ruby/ql/lib/change-notes/released/0.4.3.md b/ruby/ql/lib/change-notes/released/0.4.3.md new file mode 100644 index 000000000000..e3e98a0ea143 --- /dev/null +++ b/ruby/ql/lib/change-notes/released/0.4.3.md @@ -0,0 +1,8 @@ +## 0.4.3 + +### Minor Analysis Improvements + + * There was a bug in `TaintTracking::localTaint` and `TaintTracking::localTaintStep` such that they only tracked non-value-preserving flow steps. They have been fixed and now also include value-preserving steps. +- Instantiations using `Faraday::Connection.new` are now recognized as part of `FaradayHttpRequest`s, meaning they will be considered as sinks for queries such as `rb/request-forgery`. +* Taint flow is now tracked through extension methods on `Hash`, `String` and + `Object` provided by `ActiveSupport`. diff --git a/ruby/ql/lib/codeql-pack.release.yml b/ruby/ql/lib/codeql-pack.release.yml index 94c5b17423cc..1ec9c4ea5d96 100644 --- a/ruby/ql/lib/codeql-pack.release.yml +++ b/ruby/ql/lib/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.4.2 +lastReleaseVersion: 0.4.3 diff --git a/ruby/ql/lib/qlpack.yml b/ruby/ql/lib/qlpack.yml index de2773c45fd8..1c56ebac3222 100644 --- a/ruby/ql/lib/qlpack.yml +++ b/ruby/ql/lib/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/ruby-all -version: 0.4.3-dev +version: 0.4.3 groups: ruby extractor: ruby dbscheme: ruby.dbscheme diff --git a/ruby/ql/src/CHANGELOG.md b/ruby/ql/src/CHANGELOG.md index 6ad900256596..1e45bb15389b 100644 --- a/ruby/ql/src/CHANGELOG.md +++ b/ruby/ql/src/CHANGELOG.md @@ -1,3 +1,9 @@ +## 0.4.3 + +### Minor Analysis Improvements + +* The `rb/weak-cryptographic-algorithm` has been updated to no longer report uses of hash functions such as `MD5` and `SHA1` even if they are known to be weak. These hash algorithms are used very often in non-sensitive contexts, making the query too imprecise in practice. + ## 0.4.2 ### New Queries diff --git a/ruby/ql/src/change-notes/2022-11-04-weak-crypto-hash.md b/ruby/ql/src/change-notes/released/0.4.3.md similarity index 86% rename from ruby/ql/src/change-notes/2022-11-04-weak-crypto-hash.md rename to ruby/ql/src/change-notes/released/0.4.3.md index 88d81156770c..5240b3350e5a 100644 --- a/ruby/ql/src/change-notes/2022-11-04-weak-crypto-hash.md +++ b/ruby/ql/src/change-notes/released/0.4.3.md @@ -1,4 +1,5 @@ ---- -category: minorAnalysis ---- +## 0.4.3 + +### Minor Analysis Improvements + * The `rb/weak-cryptographic-algorithm` has been updated to no longer report uses of hash functions such as `MD5` and `SHA1` even if they are known to be weak. These hash algorithms are used very often in non-sensitive contexts, making the query too imprecise in practice. diff --git a/ruby/ql/src/codeql-pack.release.yml b/ruby/ql/src/codeql-pack.release.yml index 94c5b17423cc..1ec9c4ea5d96 100644 --- a/ruby/ql/src/codeql-pack.release.yml +++ b/ruby/ql/src/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.4.2 +lastReleaseVersion: 0.4.3 diff --git a/ruby/ql/src/qlpack.yml b/ruby/ql/src/qlpack.yml index d1efee416dba..eec4604b2f82 100644 --- a/ruby/ql/src/qlpack.yml +++ b/ruby/ql/src/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/ruby-queries -version: 0.4.3-dev +version: 0.4.3 groups: - ruby - queries diff --git a/shared/ssa/CHANGELOG.md b/shared/ssa/CHANGELOG.md index ca7ec07ac569..d26b43c43582 100644 --- a/shared/ssa/CHANGELOG.md +++ b/shared/ssa/CHANGELOG.md @@ -1,3 +1,7 @@ +## 0.0.4 + +No user-facing changes. + ## 0.0.3 No user-facing changes. diff --git a/shared/ssa/change-notes/released/0.0.4.md b/shared/ssa/change-notes/released/0.0.4.md new file mode 100644 index 000000000000..eefe286a4d88 --- /dev/null +++ b/shared/ssa/change-notes/released/0.0.4.md @@ -0,0 +1,3 @@ +## 0.0.4 + +No user-facing changes. diff --git a/shared/ssa/codeql-pack.release.yml b/shared/ssa/codeql-pack.release.yml index a24b693d1e7a..ec411a674bcd 100644 --- a/shared/ssa/codeql-pack.release.yml +++ b/shared/ssa/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.0.3 +lastReleaseVersion: 0.0.4 diff --git a/shared/ssa/qlpack.yml b/shared/ssa/qlpack.yml index 6ed6475e2017..2cedad6efbce 100644 --- a/shared/ssa/qlpack.yml +++ b/shared/ssa/qlpack.yml @@ -1,4 +1,4 @@ name: codeql/ssa -version: 0.0.4-dev +version: 0.0.4 groups: shared library: true diff --git a/shared/typos/CHANGELOG.md b/shared/typos/CHANGELOG.md index aa5beb8b9832..6741585b960f 100644 --- a/shared/typos/CHANGELOG.md +++ b/shared/typos/CHANGELOG.md @@ -1,3 +1,7 @@ +## 0.0.4 + +No user-facing changes. + ## 0.0.3 No user-facing changes. diff --git a/shared/typos/change-notes/released/0.0.4.md b/shared/typos/change-notes/released/0.0.4.md new file mode 100644 index 000000000000..eefe286a4d88 --- /dev/null +++ b/shared/typos/change-notes/released/0.0.4.md @@ -0,0 +1,3 @@ +## 0.0.4 + +No user-facing changes. diff --git a/shared/typos/codeql-pack.release.yml b/shared/typos/codeql-pack.release.yml index a24b693d1e7a..ec411a674bcd 100644 --- a/shared/typos/codeql-pack.release.yml +++ b/shared/typos/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.0.3 +lastReleaseVersion: 0.0.4 diff --git a/shared/typos/qlpack.yml b/shared/typos/qlpack.yml index 4f971819a73d..edeca64558de 100644 --- a/shared/typos/qlpack.yml +++ b/shared/typos/qlpack.yml @@ -1,4 +1,4 @@ name: codeql/typos -version: 0.0.4-dev +version: 0.0.4 groups: shared library: true From 013b7eff1caedc542b06d28f92e045d49f0d56bc Mon Sep 17 00:00:00 2001 From: Dave Bartolomeo Date: Fri, 4 Nov 2022 18:46:32 -0400 Subject: [PATCH 2/3] Apply suggestions from code review Co-authored-by: Jeroen Ketema <93738568+jketema@users.noreply.github.com> --- javascript/ql/src/CHANGELOG.md | 2 +- javascript/ql/src/change-notes/released/0.4.3.md | 2 +- ruby/ql/lib/CHANGELOG.md | 4 ++-- ruby/ql/lib/change-notes/released/0.4.3.md | 4 ++-- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/javascript/ql/src/CHANGELOG.md b/javascript/ql/src/CHANGELOG.md index 3928801d4566..bdd74c9a7010 100644 --- a/javascript/ql/src/CHANGELOG.md +++ b/javascript/ql/src/CHANGELOG.md @@ -9,7 +9,7 @@ ### Minor Analysis Improvements -- Added sources for user defined path and query parameters in `Next.js`. +* Added sources for user defined path and query parameters in `Next.js`. * The alert message of many queries have been changed to better follow the style guide and make the message consistent with other languages. ## 0.4.2 diff --git a/javascript/ql/src/change-notes/released/0.4.3.md b/javascript/ql/src/change-notes/released/0.4.3.md index 3bd15bf43e29..cefac1cbd40b 100644 --- a/javascript/ql/src/change-notes/released/0.4.3.md +++ b/javascript/ql/src/change-notes/released/0.4.3.md @@ -9,5 +9,5 @@ ### Minor Analysis Improvements -- Added sources for user defined path and query parameters in `Next.js`. +* Added sources for user defined path and query parameters in `Next.js`. * The alert message of many queries have been changed to better follow the style guide and make the message consistent with other languages. diff --git a/ruby/ql/lib/CHANGELOG.md b/ruby/ql/lib/CHANGELOG.md index dd53c568ecda..c92874cdbb78 100644 --- a/ruby/ql/lib/CHANGELOG.md +++ b/ruby/ql/lib/CHANGELOG.md @@ -2,8 +2,8 @@ ### Minor Analysis Improvements - * There was a bug in `TaintTracking::localTaint` and `TaintTracking::localTaintStep` such that they only tracked non-value-preserving flow steps. They have been fixed and now also include value-preserving steps. -- Instantiations using `Faraday::Connection.new` are now recognized as part of `FaradayHttpRequest`s, meaning they will be considered as sinks for queries such as `rb/request-forgery`. +* There was a bug in `TaintTracking::localTaint` and `TaintTracking::localTaintStep` such that they only tracked non-value-preserving flow steps. They have been fixed and now also include value-preserving steps. +* Instantiations using `Faraday::Connection.new` are now recognized as part of `FaradayHttpRequest`s, meaning they will be considered as sinks for queries such as `rb/request-forgery`. * Taint flow is now tracked through extension methods on `Hash`, `String` and `Object` provided by `ActiveSupport`. diff --git a/ruby/ql/lib/change-notes/released/0.4.3.md b/ruby/ql/lib/change-notes/released/0.4.3.md index e3e98a0ea143..baf29b0b5b1d 100644 --- a/ruby/ql/lib/change-notes/released/0.4.3.md +++ b/ruby/ql/lib/change-notes/released/0.4.3.md @@ -2,7 +2,7 @@ ### Minor Analysis Improvements - * There was a bug in `TaintTracking::localTaint` and `TaintTracking::localTaintStep` such that they only tracked non-value-preserving flow steps. They have been fixed and now also include value-preserving steps. -- Instantiations using `Faraday::Connection.new` are now recognized as part of `FaradayHttpRequest`s, meaning they will be considered as sinks for queries such as `rb/request-forgery`. +* There was a bug in `TaintTracking::localTaint` and `TaintTracking::localTaintStep` such that they only tracked non-value-preserving flow steps. They have been fixed and now also include value-preserving steps. +* Instantiations using `Faraday::Connection.new` are now recognized as part of `FaradayHttpRequest`s, meaning they will be considered as sinks for queries such as `rb/request-forgery`. * Taint flow is now tracked through extension methods on `Hash`, `String` and `Object` provided by `ActiveSupport`. From fca754bdddb406c03dc1c9b1a61322976a8a59a6 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Sat, 5 Nov 2022 14:30:48 +0000 Subject: [PATCH 3/3] Post-release preparation for codeql-cli-2.11.3 --- cpp/ql/lib/qlpack.yml | 2 +- cpp/ql/src/qlpack.yml | 2 +- csharp/ql/campaigns/Solorigate/lib/qlpack.yml | 2 +- csharp/ql/campaigns/Solorigate/src/qlpack.yml | 2 +- csharp/ql/lib/qlpack.yml | 2 +- csharp/ql/src/qlpack.yml | 2 +- go/ql/lib/qlpack.yml | 2 +- go/ql/src/qlpack.yml | 2 +- java/ql/lib/qlpack.yml | 2 +- java/ql/src/qlpack.yml | 2 +- javascript/ql/lib/qlpack.yml | 2 +- javascript/ql/src/qlpack.yml | 2 +- misc/suite-helpers/qlpack.yml | 2 +- python/ql/lib/qlpack.yml | 2 +- python/ql/src/qlpack.yml | 2 +- ruby/ql/lib/qlpack.yml | 2 +- ruby/ql/src/qlpack.yml | 2 +- shared/ssa/qlpack.yml | 2 +- shared/typos/qlpack.yml | 2 +- 19 files changed, 19 insertions(+), 19 deletions(-) diff --git a/cpp/ql/lib/qlpack.yml b/cpp/ql/lib/qlpack.yml index bc1a3c693900..ef1fd2099a3d 100644 --- a/cpp/ql/lib/qlpack.yml +++ b/cpp/ql/lib/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/cpp-all -version: 0.4.3 +version: 0.4.4-dev groups: cpp dbscheme: semmlecode.cpp.dbscheme extractor: cpp diff --git a/cpp/ql/src/qlpack.yml b/cpp/ql/src/qlpack.yml index 2b9ba3b6a2bd..3a44ef8b743d 100644 --- a/cpp/ql/src/qlpack.yml +++ b/cpp/ql/src/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/cpp-queries -version: 0.4.3 +version: 0.4.4-dev groups: - cpp - queries diff --git a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml index dbb24b17c4e1..ccab1b3a8b8d 100644 --- a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml +++ b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/csharp-solorigate-all -version: 1.3.3 +version: 1.3.4-dev groups: - csharp - solorigate diff --git a/csharp/ql/campaigns/Solorigate/src/qlpack.yml b/csharp/ql/campaigns/Solorigate/src/qlpack.yml index 3a77ada168d4..209538a20149 100644 --- a/csharp/ql/campaigns/Solorigate/src/qlpack.yml +++ b/csharp/ql/campaigns/Solorigate/src/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/csharp-solorigate-queries -version: 1.3.3 +version: 1.3.4-dev groups: - csharp - solorigate diff --git a/csharp/ql/lib/qlpack.yml b/csharp/ql/lib/qlpack.yml index 74be764d08d8..0e1fd3c55aea 100644 --- a/csharp/ql/lib/qlpack.yml +++ b/csharp/ql/lib/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/csharp-all -version: 0.4.3 +version: 0.4.4-dev groups: csharp dbscheme: semmlecode.csharp.dbscheme extractor: csharp diff --git a/csharp/ql/src/qlpack.yml b/csharp/ql/src/qlpack.yml index d783b74a3ce8..7f537bcae495 100644 --- a/csharp/ql/src/qlpack.yml +++ b/csharp/ql/src/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/csharp-queries -version: 0.4.3 +version: 0.4.4-dev groups: - csharp - queries diff --git a/go/ql/lib/qlpack.yml b/go/ql/lib/qlpack.yml index 2a4336e09f9d..9daccdd80b60 100644 --- a/go/ql/lib/qlpack.yml +++ b/go/ql/lib/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/go-all -version: 0.3.3 +version: 0.3.4-dev groups: go dbscheme: go.dbscheme extractor: go diff --git a/go/ql/src/qlpack.yml b/go/ql/src/qlpack.yml index d6aea5402d25..e44f8ef80d96 100644 --- a/go/ql/src/qlpack.yml +++ b/go/ql/src/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/go-queries -version: 0.3.3 +version: 0.3.4-dev groups: - go - queries diff --git a/java/ql/lib/qlpack.yml b/java/ql/lib/qlpack.yml index 41604876de06..0d8258e5ef13 100644 --- a/java/ql/lib/qlpack.yml +++ b/java/ql/lib/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/java-all -version: 0.4.3 +version: 0.4.4-dev groups: java dbscheme: config/semmlecode.dbscheme extractor: java diff --git a/java/ql/src/qlpack.yml b/java/ql/src/qlpack.yml index 81a41dd63b64..872678934130 100644 --- a/java/ql/src/qlpack.yml +++ b/java/ql/src/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/java-queries -version: 0.4.3 +version: 0.4.4-dev groups: - java - queries diff --git a/javascript/ql/lib/qlpack.yml b/javascript/ql/lib/qlpack.yml index 85ac7bd42797..0a3a773e368f 100644 --- a/javascript/ql/lib/qlpack.yml +++ b/javascript/ql/lib/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/javascript-all -version: 0.3.3 +version: 0.3.4-dev groups: javascript dbscheme: semmlecode.javascript.dbscheme extractor: javascript diff --git a/javascript/ql/src/qlpack.yml b/javascript/ql/src/qlpack.yml index 6d0c5dbdf5c9..0d9eb306ee9e 100644 --- a/javascript/ql/src/qlpack.yml +++ b/javascript/ql/src/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/javascript-queries -version: 0.4.3 +version: 0.4.4-dev groups: - javascript - queries diff --git a/misc/suite-helpers/qlpack.yml b/misc/suite-helpers/qlpack.yml index d0624712842d..6a377895b2ab 100644 --- a/misc/suite-helpers/qlpack.yml +++ b/misc/suite-helpers/qlpack.yml @@ -1,3 +1,3 @@ name: codeql/suite-helpers -version: 0.3.3 +version: 0.3.4-dev groups: shared diff --git a/python/ql/lib/qlpack.yml b/python/ql/lib/qlpack.yml index 9522c9d8ee58..9d8ac91c0a68 100644 --- a/python/ql/lib/qlpack.yml +++ b/python/ql/lib/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/python-all -version: 0.6.3 +version: 0.6.4-dev groups: python dbscheme: semmlecode.python.dbscheme extractor: python diff --git a/python/ql/src/qlpack.yml b/python/ql/src/qlpack.yml index 0471a6a2b062..c5f06d5b4648 100644 --- a/python/ql/src/qlpack.yml +++ b/python/ql/src/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/python-queries -version: 0.5.3 +version: 0.5.4-dev groups: - python - queries diff --git a/ruby/ql/lib/qlpack.yml b/ruby/ql/lib/qlpack.yml index 1c56ebac3222..016f75260eb0 100644 --- a/ruby/ql/lib/qlpack.yml +++ b/ruby/ql/lib/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/ruby-all -version: 0.4.3 +version: 0.4.4-dev groups: ruby extractor: ruby dbscheme: ruby.dbscheme diff --git a/ruby/ql/src/qlpack.yml b/ruby/ql/src/qlpack.yml index eec4604b2f82..93c261cc2645 100644 --- a/ruby/ql/src/qlpack.yml +++ b/ruby/ql/src/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/ruby-queries -version: 0.4.3 +version: 0.4.4-dev groups: - ruby - queries diff --git a/shared/ssa/qlpack.yml b/shared/ssa/qlpack.yml index 2cedad6efbce..80e454bf99fa 100644 --- a/shared/ssa/qlpack.yml +++ b/shared/ssa/qlpack.yml @@ -1,4 +1,4 @@ name: codeql/ssa -version: 0.0.4 +version: 0.0.5-dev groups: shared library: true diff --git a/shared/typos/qlpack.yml b/shared/typos/qlpack.yml index edeca64558de..1bada6ef1ff2 100644 --- a/shared/typos/qlpack.yml +++ b/shared/typos/qlpack.yml @@ -1,4 +1,4 @@ name: codeql/typos -version: 0.0.4 +version: 0.0.5-dev groups: shared library: true