|
| 1 | +.. _codeql-cli-2.17.0: |
| 2 | + |
| 3 | +========================== |
| 4 | +CodeQL 2.17.0 (2024-04-04) |
| 5 | +========================== |
| 6 | + |
| 7 | +.. contents:: Contents |
| 8 | + :depth: 2 |
| 9 | + :local: |
| 10 | + :backlinks: none |
| 11 | + |
| 12 | +This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the `code scanning section on the GitHub blog <https://github.blog/tag/code-scanning/>`__, `relevant GitHub Changelog updates <https://github.blog/changelog/label/code-scanning/>`__, `changes in the CodeQL extension for Visual Studio Code <https://marketplace.visualstudio.com/items/GitHub.vscode-codeql/changelog>`__, and the `CodeQL Action changelog <https://github.com/github/codeql-action/blob/main/CHANGELOG.md>`__. |
| 13 | + |
| 14 | +Security Coverage |
| 15 | +----------------- |
| 16 | + |
| 17 | +CodeQL 2.17.0 runs a total of 410 security queries when configured with the Default suite (covering 160 CWE). The Extended suite enables an additional 130 queries (covering 34 more CWE). |
| 18 | + |
| 19 | +CodeQL CLI |
| 20 | +---------- |
| 21 | + |
| 22 | +Deprecations |
| 23 | +~~~~~~~~~~~~ |
| 24 | + |
| 25 | +* The :code:`--[no-]analysis-summary-v2` and :code:`--[no-]new-analysis-summary` options that were used to enable (or disable) improved summary information printed at the end of a :code:`codeql database analyze` invocation are no longer supported. |
| 26 | + Improved summary information is now enabled for all invocations. |
| 27 | +* Support for overwriting default CodeQL SARIF run properties using the |
| 28 | + :code:`--sarif-run-property` command line option has been removed. This removes the ability to overwrite the :code:`semmle.formatSpecifier`, :code:`metricResults`, and |
| 29 | + :code:`codeqlConfigSummary` properties in the SARIF run file. |
| 30 | + |
| 31 | +Improvements |
| 32 | +~~~~~~~~~~~~ |
| 33 | + |
| 34 | +* TRAP import (a part of :code:`codeql database create` and :code:`codeql database finalize`) |
| 35 | + now performs better in low-memory situations. (Put another way, it now needs less RAM to achieve the same performance as before.) |
| 36 | + |
| 37 | +* The worst-case performance of transitive closure computation (using the :code:`+` or :code:`*` postfix operators or the :code:`fastTC` higher-order primitive in QL) has been greatly improved. |
| 38 | + |
| 39 | +Miscellaneous |
| 40 | +~~~~~~~~~~~~~ |
| 41 | + |
| 42 | +* The build of Eclipse Temurin OpenJDK that is used to run the CodeQL CLI has been updated to version 21.0.2. |
| 43 | + |
| 44 | +Query Packs |
| 45 | +----------- |
| 46 | + |
| 47 | +Major Analysis Improvements |
| 48 | +~~~~~~~~~~~~~~~~~~~~~~~~~~~ |
| 49 | + |
| 50 | +C# |
| 51 | +"" |
| 52 | + |
| 53 | +* The :code:`Stored` variants of some queries (:code:`cs/stored-command-line-injection`, :code:`cs/web/stored-xss`, :code:`cs/stored-ldap-injection`, :code:`cs/xml/stored-xpath-injection`, :code:`cs/second-order-sql-injection`) have been removed. If you were using these queries, their results can be restored by enabling the :code:`file` and :code:`database` threat models in your threat model configuration. |
| 54 | + |
| 55 | +Java |
| 56 | +"""" |
| 57 | + |
| 58 | +* The :code:`java/missing-case-in-switch` query now gives only a single alert for each switch statement, giving some examples of the missing cases as well as a count of how many are missing. |
| 59 | + |
| 60 | +Minor Analysis Improvements |
| 61 | +~~~~~~~~~~~~~~~~~~~~~~~~~~~ |
| 62 | + |
| 63 | +C/C++ |
| 64 | +""""" |
| 65 | + |
| 66 | +* The "Missing return-value check for a 'scanf'-like function" query (:code:`cpp/missing-check-scanf`) has been converted to a :code:`path-problem` query. |
| 67 | +* The "Potentially uninitialized local variable" query (:code:`cpp/uninitialized-local`) has been converted to a :code:`path-problem` query. |
| 68 | +* Added models for :code:`GLib` allocation and deallocation functions. |
| 69 | + |
| 70 | +C# |
| 71 | +"" |
| 72 | + |
| 73 | +* The alert message of :code:`cs/wrong-compareto-signature` has been changed to remove unnecessary element references. |
| 74 | +* Data flow queries that track flow from *local* flow sources now use the current *threat model* configuration instead. This may lead to changes in the produced alerts if the threat model configuration only uses *remote* flow sources. The changed queries are :code:`cs/code-injection`, :code:`cs/resource-injection`, :code:`cs/sql-injection`, and :code:`cs/uncontrolled-format-string`. |
| 75 | + |
| 76 | +Golang |
| 77 | +"""""" |
| 78 | + |
| 79 | +* The query :code:`go/hardcoded-credentials` no longer discards string literals based on "weak password" heuristics. |
| 80 | +* The query :code:`go/sql-injection` now recognizes more sinks in the package :code:`github.com/Masterminds/squirrel`. |
| 81 | + |
| 82 | +Java |
| 83 | +"""" |
| 84 | + |
| 85 | +* Variables named :code:`tokenImage` are no longer sources for the :code:`java/sensitive-log` query. This is because this variable name is used in parsing code generated by JavaCC, so it causes a large number of false positive alerts. |
| 86 | +* Added sanitizers for relative URLs, :code:`List.contains()`, and checking the host of a URI to the :code:`java/ssrf` and :code:`java/unvalidated-url-redirection` queries. |
| 87 | + |
| 88 | +JavaScript/TypeScript |
| 89 | +""""""""""""""""""""" |
| 90 | + |
| 91 | +* The call graph has been improved, leading to more alerts for data flow based queries. |
| 92 | + |
| 93 | +New Queries |
| 94 | +~~~~~~~~~~~ |
| 95 | + |
| 96 | +C/C++ |
| 97 | +""""" |
| 98 | + |
| 99 | +* Added a new query, :code:`cpp/type-confusion`, to detect casts to invalid types. |
| 100 | + |
| 101 | +Golang |
| 102 | +"""""" |
| 103 | + |
| 104 | +* The query "Slice memory allocation with excessive size value" (:code:`go/uncontrolled-allocation-size`) has been promoted from experimental to the main query pack. Its results will now appear by default. This query was originally `submitted as an experimental query by @Malayke <https://github.com/github/codeql/pull/15130>`__. |
| 105 | + |
| 106 | +Java |
| 107 | +"""" |
| 108 | + |
| 109 | +* The query :code:`java/unsafe-url-forward-dispatch-load` has been promoted from experimental to the main query pack as :code:`java/unvalidated-url-forward`. Its results will now appear by default. This query was originally submitted as an experimental query `by @haby0 <https://github.com/github/codeql/pull/6240>`__ and `by @luchua-bc <https://github.com/github/codeql/pull/7286>`__. |
| 110 | + |
| 111 | +Query Metadata Changes |
| 112 | +~~~~~~~~~~~~~~~~~~~~~~ |
| 113 | + |
| 114 | +C/C++ |
| 115 | +""""" |
| 116 | + |
| 117 | +* :code:`@precision medium` metadata was added to the :code:`cpp/boost/tls-settings-misconfiguration` and :code:`cpp/boost/use-of-deprecated-hardcoded-security-protocol` queries, and these queries are now included in the security-extended suite. The :code:`@name` metadata of these queries were also updated. |
| 118 | + |
| 119 | +JavaScript/TypeScript |
| 120 | +""""""""""""""""""""" |
| 121 | + |
| 122 | +* The :code:`@precision` of the :code:`js/unsafe-external-link` has been reduced to :code:`low` to reflect the fact that modern browsers do not expose the opening window for such links. This mitigates the potential security risk of having a link with :code:`target="_blank"`. |
| 123 | + |
| 124 | +Language Libraries |
| 125 | +------------------ |
| 126 | + |
| 127 | +Breaking Changes |
| 128 | +~~~~~~~~~~~~~~~~ |
| 129 | + |
| 130 | +C# |
| 131 | +"" |
| 132 | + |
| 133 | +* The CIL extractor has been deleted and the corresponding extractor option :code:`cil` has been removed. It is no longer possible to do CIL extraction. |
| 134 | +* The QL library C# classes no longer extend their corresponding :code:`DotNet` classes. Furthermore, CIL related data flow functionality has been deleted and all :code:`DotNet` and :code:`CIL` related classes have been deprecated. This effectively means that it no longer has any effect to enable CIL extraction. |
| 135 | + |
| 136 | +Java |
| 137 | +"""" |
| 138 | + |
| 139 | +* The Java extractor no longer supports the :code:`ODASA_SNAPSHOT` legacy environment variable. |
| 140 | + |
| 141 | +Major Analysis Improvements |
| 142 | +~~~~~~~~~~~~~~~~~~~~~~~~~~~ |
| 143 | + |
| 144 | +JavaScript/TypeScript |
| 145 | +""""""""""""""""""""" |
| 146 | + |
| 147 | +* Added support for TypeScript 5.4. |
| 148 | + |
| 149 | +Swift |
| 150 | +""""" |
| 151 | + |
| 152 | +* Upgraded to Swift 5.10 |
| 153 | +* New AST node is extracted: :code:`ThenStmt` |
| 154 | + |
| 155 | +Minor Analysis Improvements |
| 156 | +~~~~~~~~~~~~~~~~~~~~~~~~~~~ |
| 157 | + |
| 158 | +C/C++ |
| 159 | +""""" |
| 160 | + |
| 161 | +* Added destructors for temporary objects with extended lifetimes to the intermediate representation. |
| 162 | + |
| 163 | +C# |
| 164 | +"" |
| 165 | + |
| 166 | +* Added new source models for the :code:`Dapper` package. These models can be enabled by enabling the :code:`database` threat model. |
| 167 | +* Additional models have been added for :code:`System.IO`. These are primarily source models with the :code:`file` threat model, and summaries related to reading from a file or stream. |
| 168 | +* Support for C# 12 / .NET8. |
| 169 | +* Added the :code:`windows-registry` source kind and threat model to represent values which come from the registry on Windows. |
| 170 | +* The models for :code:`System.Net.Http.HttpRequestMessage` have been modified to better model the flow of tainted URIs. |
| 171 | +* The .NET standard libraries APIs for accessing command line arguments and environment variables have been modeled using the :code:`commandargs` and :code:`environment` threat models. |
| 172 | +* The :code:`cs/assembly-path-injection` query has been modified so that it's sources rely on :code:`ThreatModelFlowSource`. In order to restore results from command line arguments, you should enable the :code:`commandargs` threat model. |
| 173 | +* The models for :code:`System.IO.TextReader` have been modified to better model the flow of tainted text from a :code:`TextReader`. |
| 174 | + |
| 175 | +Golang |
| 176 | +"""""" |
| 177 | + |
| 178 | +* The :code:`CODEQL_EXTRACTOR_GO_FAST_PACKAGE_INFO` option, which speeds up retrieval of dependency information, is now on by default. This was originally an external contribution by @xhd2015. |
| 179 | +* Added dataflow sources for the package :code:`gopkg.in/macaron.v1`. |
| 180 | + |
| 181 | +Java |
| 182 | +"""" |
| 183 | + |
| 184 | +* Increased the precision of some dataflow models of the class :code:`java.net.URL` by distinguishing the parts of a URL. |
| 185 | +* The Java extractor and QL libraries now support Java 22, including support for anonymous variables, lambda parameters and patterns. |
| 186 | +* Pattern cases with multiple patterns and that fall through to or from other pattern cases are now supported. The :code:`PatternCase` class gains the new :code:`getPatternAtIndex` and :code:`getAPattern` predicates, and deprecates :code:`getPattern`. |
| 187 | +* Added a :code:`path-injection` sink for the :code:`open` methods of the :code:`android.os.ParcelFileDescriptor` class. |
| 188 | + |
| 189 | +Ruby |
| 190 | +"""" |
| 191 | + |
| 192 | +* Data flow is now tracked through :code:`ActiveRecord` scopes. |
| 193 | +* Modeled instances of :code:`ActionDispatch::Http::UploadedFile` that can be obtained from element reads of :code:`ActionController::Parameters`, with calls to :code:`original_filename`, :code:`content_type`, and :code:`read` now propagating taint from their receiver. |
| 194 | +* The second argument, :code:`subquery_name`, of the :code:`ActiveRecord::QueryMethods::from` method, is now recognized as an sql injection sink. |
| 195 | +* Calls to :code:`Typhoeus::Request.new` are now considered as instances of the :code:`Http::Client::Request` concept, with the response body being treated as a remote flow source. |
| 196 | +* New command injection sinks have been added, including :code:`Process.spawn`, :code:`Process.exec`, :code:`Terrapin::CommandLine` and the :code:`open4` gem. |
| 197 | + |
| 198 | +New Features |
| 199 | +~~~~~~~~~~~~ |
| 200 | + |
| 201 | +C/C++ |
| 202 | +""""" |
| 203 | + |
| 204 | +* Added a :code:`TaintInheritingContent` class that can be extended to model taint flowing from a qualifier to a field. |
| 205 | +* Added a predicate :code:`GuardCondition.comparesEq/4` to query whether an expression is compared to a constant. |
| 206 | +* Added a predicate :code:`GuardCondition.ensuresEq/4` to query whether a basic block is guarded by an expression being equal to a constant. |
| 207 | +* Added a predicate :code:`GuardCondition.comparesLt/4` to query whether an expression is compared to a constant. |
| 208 | +* Added a predicate :code:`GuardCondition.ensuresLt/4` to query whether a basic block is guarded by an expression being less than a constant. |
| 209 | +* Added a predicate :code:`GuardCondition.valueControls` to query whether a basic block is guarded by a particular :code:`case` of a :code:`switch` statement. |
| 210 | + |
| 211 | +Shared Libraries |
| 212 | +---------------- |
| 213 | + |
| 214 | +Minor Analysis Improvements |
| 215 | +~~~~~~~~~~~~~~~~~~~~~~~~~~~ |
| 216 | + |
| 217 | +Dataflow Analysis |
| 218 | +""""""""""""""""" |
| 219 | + |
| 220 | +* Path explanations now include flow that goes through callbacks passed into library functions. For example, if :code:`map` is a library function, then in :code:`result = map(xs, x => x + 1)` we will now include the step from :code:`x` to :code:`x + 1` in the path explanation, instead of going directly from :code:`xs` to :code:`result`. Note that this change does not affect actual query results, but only how path explanations are computed. |
0 commit comments