|
35 | 35 |
|
36 | 36 | | **Query** | **Expected impact** | **Change** |
|
37 | 37 | |--------------------------------|------------------------------|---------------------------------------------------------------------------|
|
38 |
| -| Client-side URL redirect (`js/client-side-unvalidated-url-redirection`) | Less results | This query now recognizes additional safe patterns of doing URL redirects. | |
39 |
| -| Client-side cross-site scripting (`js/xss`) | Less results | This query now recognizes additional safe strings based on URLs. | |
| 38 | +| Client-side URL redirect (`js/client-side-unvalidated-url-redirection`) | Fewer results | This query now recognizes additional safe patterns of doing URL redirects. | |
| 39 | +| Client-side cross-site scripting (`js/xss`) | Fewer results | This query now recognizes additional safe strings based on URLs. | |
40 | 40 | | Code injection (`js/code-injection`) | More results | More potential vulnerabilities involving NoSQL code operators are now recognized. |
|
41 |
| -| Expression has no effect (`js/useless-expression`) | Less results | This query no longer flags an expression when that expression is the only content of the containing file. | |
| 41 | +| Expression has no effect (`js/useless-expression`) | Fewer results | This query no longer flags an expression when that expression is the only content of the containing file. | |
42 | 42 | | Incomplete URL scheme check (`js/incomplete-url-scheme-check`) | More results | This query now recognizes additional url scheme checks. |
|
43 | 43 | | Misspelled variable name (`js/misspelled-variable-name`) | Message changed | The message for this query now correctly identifies the misspelled variable in additional cases. |
|
44 | 44 | | Prototype pollution in utility function (`js/prototype-pollution-utility`) | More results | This query now recognizes additional utility functions as vulnerable to prototype polution. |
|
45 | 45 | | Prototype pollution in utility function (`js/prototype-pollution-utility`) | More results | This query now recognizes more coding patterns that are vulnerable to prototype pollution. |
|
46 | 46 | | Uncontrolled command line (`js/command-line-injection`) | More results | This query now recognizes additional command execution calls. |
|
47 | 47 | | Uncontrolled data used in path expression (`js/path-injection`) | More results | This query now recognizes additional file system calls. |
|
48 |
| -| Unknown directive (`js/unknown-directive`) | Less results | This query no longer flags directives generated by the Babel compiler. | |
49 |
| -| Unused property (`js/unused-property`) | Less results | This query no longer flags properties of objects that are operands of `yield` expressions. | |
| 48 | +| Unknown directive (`js/unknown-directive`) | Fewer results | This query no longer flags directives generated by the Babel compiler. | |
| 49 | +| Unused property (`js/unused-property`) | Fewer results | This query no longer flags properties of objects that are operands of `yield` expressions. | |
50 | 50 | | Zip Slip (`js/zipslip`) | More results | This query now recognizes additional vulnerabilities. |
|
51 | 51 |
|
52 | 52 | The following low-precision queries are no longer run by default on LGTM (their results already were not displayed):
|
|
0 commit comments