Skip to content

Commit 54632b2

Browse files
coadaflorincoadaflorin
committed
Adding unified changelog for 2.19.0
1 parent e99d7db commit 54632b2

File tree

3 files changed

+244
-0
lines changed

3 files changed

+244
-0
lines changed

‎docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.18.4.rst

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
.. _codeql-cli-2.18.4:
2+
3+
==========================
4+
CodeQL 2.18.4 (2024-09-12)
5+
==========================
6+
7+
.. contents:: Contents
8+
:depth: 2
9+
:local:
10+
:backlinks: none
11+
12+
This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the `code scanning section on the GitHub blog <https://github.blog/tag/code-scanning/>`__, `relevant GitHub Changelog updates <https://github.blog/changelog/label/code-scanning/>`__, `changes in the CodeQL extension for Visual Studio Code <https://marketplace.visualstudio.com/items/GitHub.vscode-codeql/changelog>`__, and the `CodeQL Action changelog <https://github.com/github/codeql-action/blob/main/CHANGELOG.md>`__.
13+
14+
Security Coverage
15+
-----------------
16+
17+
CodeQL 2.18.4 runs a total of 425 security queries when configured with the Default suite (covering 164 CWE). The Extended suite enables an additional 128 queries (covering 34 more CWE).
18+
19+
CodeQL CLI
20+
----------
21+
22+
New Features
23+
~~~~~~~~~~~~
24+
25+
* C# support for :code:`build-mode: none` is now out of beta, and generally available.
26+
* Go 1.23 is now supported.
27+
28+
Language Libraries
29+
------------------
30+
31+
Major Analysis Improvements
32+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
33+
34+
Golang
35+
""""""
36+
37+
* Go 1.23 is now supported.
38+
39+
New Features
40+
~~~~~~~~~~~~
41+
42+
C#
43+
""
44+
45+
* C# support for :code:`build-mode: none` is now out of beta, and generally available.

‎docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.19.0.rst

Lines changed: 197 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,197 @@
1+
.. _codeql-cli-2.19.0:
2+
3+
==========================
4+
CodeQL 2.19.0 (2024-09-18)
5+
==========================
6+
7+
.. contents:: Contents
8+
:depth: 2
9+
:local:
10+
:backlinks: none
11+
12+
This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the `code scanning section on the GitHub blog <https://github.blog/tag/code-scanning/>`__, `relevant GitHub Changelog updates <https://github.blog/changelog/label/code-scanning/>`__, `changes in the CodeQL extension for Visual Studio Code <https://marketplace.visualstudio.com/items/GitHub.vscode-codeql/changelog>`__, and the `CodeQL Action changelog <https://github.com/github/codeql-action/blob/main/CHANGELOG.md>`__.
13+
14+
Security Coverage
15+
-----------------
16+
17+
CodeQL 2.19.0 runs a total of 426 security queries when configured with the Default suite (covering 164 CWE). The Extended suite enables an additional 128 queries (covering 34 more CWE). 1 security query has been added with this release.
18+
19+
CodeQL CLI
20+
----------
21+
22+
Improvements
23+
~~~~~~~~~~~~
24+
25+
* :code:`codeql database analyze` and :code:`codeql database interpret-results` now support the :code:`--sarif-run-property` option. You can provide this option when using a SARIF output format to add a key-value pair to the property bag of the run object.
26+
27+
Miscellaneous
28+
~~~~~~~~~~~~~
29+
30+
* The build of Eclipse Temurin OpenJDK that is used to run the CodeQL CLI has been updated to version 21.0.4.
31+
32+
Query Packs
33+
-----------
34+
35+
Major Analysis Improvements
36+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
37+
38+
JavaScript/TypeScript
39+
"""""""""""""""""""""
40+
41+
* Added a new query (:code:`js/actions/actions-artifact-leak`) to detect GitHub Actions artifacts that may leak the GITHUB_TOKEN token.
42+
43+
Minor Analysis Improvements
44+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
45+
46+
C/C++
47+
"""""
48+
49+
* Removed false positives caused by buffer accesses in unreachable code
50+
* Removed false positives caused by inconsistent type checking
51+
* Add modeling of C functions that don't throw, thereby increasing the precision of the :code:`cpp/incorrect-allocation-error-handling` ("Incorrect allocation-error handling") query. The query now produces additional true positives.
52+
53+
Python
54+
""""""
55+
56+
* The :code:`py/clear-text-logging-sensitive-data` and :code:`py/clear-text-storage-sensitive-data` queries have been updated to exclude the :code:`certificate` classification of sensitive sources, which often do not contain sensitive data.
57+
58+
Language Libraries
59+
------------------
60+
61+
Bug Fixes
62+
~~~~~~~~~
63+
64+
Golang
65+
""""""
66+
67+
* Golang vendor directories not at the root of a repository are now correctly excluded from the baseline Go file count. This means code coverage information will be more accurate.
68+
69+
Breaking Changes
70+
~~~~~~~~~~~~~~~~
71+
72+
C/C++
73+
"""""
74+
75+
* Deleted many deprecated taint-tracking configurations based on :code:`TaintTracking::Configuration`.
76+
* Deleted many deprecated dataflow configurations based on :code:`DataFlow::Configuration`.
77+
* Deleted the deprecated :code:`hasQualifiedName` and :code:`isDefined` predicates from the :code:`Declaration` class, use :code:`hasGlobalName` and :code:`hasDefinition` respectively instead.
78+
* Deleted the :code:`getFullSignature` predicate from the :code:`Function` class, use :code:`getIdentityString(Declaration)` from :code:`semmle.code.cpp.Print` instead.
79+
* Deleted the deprecated :code:`freeCall` predicate from :code:`Alloc.qll`. Use :code:`DeallocationExpr` instead.
80+
* Deleted the deprecated :code:`explorationLimit` predicate from :code:`DataFlow::Configuration`, use :code:`FlowExploration<explorationLimit>` instead.
81+
* Deleted the deprecated :code:`getFieldExpr` predicate from :code:`ClassAggregateLiteral`, use :code:`getAFieldExpr` instead.
82+
* Deleted the deprecated :code:`getElementExpr` predicate from :code:`ArrayOrVectorAggregateLiteral`, use :code:`getAnElementExpr` instead.
83+
84+
C#
85+
""
86+
87+
* Deleted many deprecated taint-tracking configurations based on :code:`TaintTracking::Configuration`.
88+
* Deleted many deprecated dataflow configurations based on :code:`DataFlow::Configuration`.
89+
* Deleted the deprecated :code:`explorationLimit` predicate from :code:`DataFlow::Configuration`, use :code:`FlowExploration<explorationLimit>` instead.
90+
91+
Golang
92+
""""""
93+
94+
* Deleted many deprecated taint-tracking configurations based on :code:`TaintTracking::Configuration`.
95+
* Deleted the deprecated :code:`explorationLimit` predicate from :code:`DataFlow::Configuration`, use :code:`FlowExploration<explorationLimit>` instead.
96+
97+
Java/Kotlin
98+
"""""""""""
99+
100+
* Deleted the deprecated :code:`ProcessBuilderConstructor`, :code:`MethodProcessBuilderCommand`, and :code:`MethodRuntimeExec` from :code:`JDK.qll`.
101+
* Deleted the deprecated :code:`explorationLimit` predicate from :code:`DataFlow::Configuration`, use :code:`FlowExploration<explorationLimit>` instead.
102+
* Deleted many deprecated taint-tracking configurations based on :code:`TaintTracking::Configuration`.
103+
* Deleted the deprecated :code:`getURI` predicate from :code:`CamelJavaDslToDecl` and :code:`SpringCamelXmlToElement`, use :code:`getUri` instead.
104+
* Deleted the deprecated :code:`ExecCallable` class from :code:`ExternalProcess.qll`.
105+
* Deleted many deprecated dataflow configurations based on :code:`DataFlow::Configuration`.
106+
* Deleted the deprecated :code:`PathCreation.qll` file.
107+
* Deleted the deprecated :code:`WebviewDubuggingEnabledQuery.qll` file.
108+
109+
JavaScript/TypeScript
110+
"""""""""""""""""""""
111+
112+
* Deleted the deprecated :code:`isHTMLElement` and :code:`getDOMName` predicates from the JSX library, use :code:`isHtmlElement` and :code:`getDomName` respectively instead.
113+
* Deleted the deprecated :code:`getPackageJSON` predicate from the :code:`SourceMappingComment` class, use :code:`SourceMappingComment` instead.
114+
* Deleted many deprecated directives from the :code:`Stmt.qll` file, use the :code:`Directive::` module instead.
115+
* Deleted the deprecated :code:`YAMLNode`, :code:`YAMLValue`, and :code:`YAMLScalar` classes from the YAML libraries, use :code:`YamlNode`, :code:`YamlValue`, and :code:`YamlScalar` respectively instead.
116+
* Deleted the deprecated :code:`getARouteHandlerExpr` predicate from :code:`Connect.qll`, use :code:`getARouteHandlerNode` instead.
117+
* Deleted the deprecated :code:`getGWTVersion` predicate from :code:`GWT.qll`, use :code:`getGwtVersion` instead.
118+
* Deleted the deprecated :code:`getOwnOptionsObject` predicate from :code:`Vue.qll`, use :code:`getOwnOptions().getASink()` instead.
119+
120+
Python
121+
""""""
122+
123+
* Deleted the deprecated :code:`explorationLimit` predicate from :code:`DataFlow::Configuration`, use :code:`FlowExploration<explorationLimit>` instead.
124+
* Deleted the deprecated :code:`semmle.python.RegexTreeView` module, use :code:`semmle.python.regexp.RegexTreeView` instead.
125+
* Deleted the deprecated :code:`RegexString` class from :code:`regex.qll`.
126+
* Deleted the deprecated :code:`Regex` class, use :code:`RegExp` instead.
127+
* Deleted the deprecated :code:`semmle/python/security/SQL.qll` file.
128+
* Deleted the deprecated :code:`useSSL` predicates from the LDAP libraries, use :code:`useSsl` instead.
129+
130+
Ruby
131+
""""
132+
133+
* Deleted the deprecated :code:`getURL` predicate the :code:`Http::Request` class, use :code:`getAUrlPart` instead.
134+
* Deleted the deprecated :code:`getNode` predicate from the :code:`CfgNode` class, use :code:`getAstNode` instead.
135+
* Deleted the deprecated :code:`explorationLimit` predicate from :code:`DataFlow::Configuration`, use :code:`FlowExploration<explorationLimit>` instead.
136+
* Deleted many deprecated dataflow configurations based on :code:`DataFlow::Configuration`.
137+
* Deleted many deprecated taint-tracking configurations based on :code:`TaintTracking::Configuration`.
138+
139+
Swift
140+
"""""
141+
142+
* Deleted the deprecated :code:`explorationLimit` predicate from :code:`DataFlow::Configuration`, use :code:`FlowExploration<explorationLimit>` instead.
143+
* Deleted the deprecated :code:`getDerivedTypeDecl` predicate from the :code:`TypeDecl` class, use :code:`getADerivedTypeDecl` or :code:`getABaseTypeDecl` instead.
144+
145+
Major Analysis Improvements
146+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
147+
148+
Java/Kotlin
149+
"""""""""""
150+
151+
* A generated (Models as Data) summary model is no longer used, if there exists a source code alternative. This primarily affects the analysis, when the analysis includes generated models for the source code being analysed.
152+
153+
JavaScript/TypeScript
154+
"""""""""""""""""""""
155+
156+
* Added support for TypeScript 5.6.
157+
158+
Minor Analysis Improvements
159+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
160+
161+
C/C++
162+
"""""
163+
164+
* Added a data flow model for :code:`swap` member functions, which were previously modeled as taint tracking functions. This change improves the precision of queries where flow through :code:`swap` member functions might affect the results.
165+
* Added a data flow model for :code:`realloc`\ -like functions, which were previously modeled as a taint tracking functions. This change improves the precision of queries where flow through :code:`realloc`\ -like functions might affect the results.
166+
167+
C#
168+
""
169+
170+
* Parameters of public methods in abstract controller-like classes are now considered remote flow sources.
171+
* The reported location of :code:`partial` methods has been changed from the definition to the implementation part.
172+
173+
Golang
174+
""""""
175+
176+
* When a function or type has more than one anonymous type parameters, they were mistakenly being treated as the same type parameter. This has now been fixed.
177+
* Local source models for reading and parsing environment variables have been added for the following libraries:
178+
179+
* os
180+
* syscall
181+
* github.com/caarlos0/env
182+
* github.com/gobuffalo/envy
183+
* github.com/hashicorp/go-envparse
184+
* github.com/joho/godotenv
185+
* github.com/kelseyhightower/envconfig
186+
187+
* Local source models have been added for the APIs which open files in the :code:`io/fs`, :code:`io/ioutil` and :code:`os` packages in the Go standard library. You can optionally include threat models as appropriate when using the CodeQL CLI and in GitHub code scanning. For more information, see `Analyzing your code with CodeQL queries <https://docs.github.com/code-security/codeql-cli/getting-started-with-the-codeql-cli/analyzing-your-code-with-codeql-queries#including-model-packs-to-add-potential-sources-of-tainted-data%3E>`__ and `Customizing your advanced setup for code scanning <https://docs.github.com/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#extending-codeql-coverage-with-threat-models>`__.
188+
189+
New Features
190+
~~~~~~~~~~~~
191+
192+
C/C++
193+
"""""
194+
195+
* Added a class :code:`C11GenericExpr` to represent C11 generic selection expressions. The generic selection is represented as a :code:`Conversion` on the expression that will be selected.
196+
* Added subclasses of :code:`BuiltInOperations` for the :code:`__is_scoped_enum`, :code:`__is_trivially_equality_comparable`, and :code:`__is_trivially_relocatable` builtin operations.
197+
* Added a subclass of :code:`Expr` for :code:`__datasizeof` expressions.

‎docs/codeql/codeql-overview/codeql-changelog/index.rst

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ A list of queries for each suite and language `is available here <https://docs.g
1111
.. toctree::
1212
:maxdepth: 1
1313

14+
codeql-cli-2.19.0
15+
codeql-cli-2.18.4
1416
codeql-cli-2.18.3
1517
codeql-cli-2.18.2
1618
codeql-cli-2.18.1

0 commit comments

Comments
 (0)