You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
| Misspelled variable name (`js/misspelled-variable-name`) | Message changed | The message for this query now correctly identifies the misspelled variable in additional cases. |
40
-
| Uncontrolled data used in path expression (`js/path-injection`) | More results | This query now recognizes additional file system calls. |
41
-
| Uncontrolled command line (`js/command-line-injection`) | More results | This query now recognizes additional command execution calls. |
42
-
| Client-side URL redirect (`js/client-side-unvalidated-url-redirection`) | Less results | This query now recognizes additional safe patterns of doing URL redirects. |
43
-
| Client-side cross-site scripting (`js/xss`) | Less results | This query now recognizes additional safe strings based on URLs. |
39
+
| Client-side URL redirect (`js/client-side-unvalidated-url-redirection`) | Fewer results | This query now recognizes additional safe patterns of doing URL redirects. |
40
+
| Client-side cross-site scripting (`js/xss`) | Fewer results | This query now recognizes additional safe strings based on URLs. |
41
+
| Code injection (`js/code-injection`) | More results | More potential vulnerabilities involving NoSQL code operators are now recognized. |
42
+
| Expression has no effect (`js/useless-expression`) | Fewer results | This query no longer flags an expression when that expression is the only content of the containing file. |
44
43
| Incomplete URL scheme check (`js/incomplete-url-scheme-check`) | More results | This query now recognizes additional url scheme checks. |
44
+
| Misspelled variable name (`js/misspelled-variable-name`) | Message changed | The message for this query now correctly identifies the misspelled variable in additional cases. |
45
45
| Prototype pollution in utility function (`js/prototype-pollution-utility`) | More results | This query now recognizes additional utility functions as vulnerable to prototype polution. |
46
-
| Expression has no effect (`js/useless-expression`) | Less results | This query no longer flags an expression when that expression is the only content of the containing file. |
47
-
| Unknown directive (`js/unknown-directive`) | Less results | This query no longer flags directives generated by the Babel compiler. |
48
-
| Code injection (`js/code-injection`) | More results | More potential vulnerabilities involving NoSQL code operators are now recognized. |
46
+
| Prototype pollution in utility function (`js/prototype-pollution-utility`) | More results | This query now recognizes more coding patterns that are vulnerable to prototype pollution. |
47
+
| Uncontrolled command line (`js/command-line-injection`) | More results | This query now recognizes additional command execution calls. |
48
+
| Uncontrolled data used in path expression (`js/path-injection`) | More results | This query now recognizes additional file system calls. |
49
+
| Unknown directive (`js/unknown-directive`) | Fewer results | This query no longer flags directives generated by the Babel compiler. |
50
+
| Unused property (`js/unused-property`) | Fewer results | This query no longer flags properties of objects that are operands of `yield` expressions. |
49
51
| Zip Slip (`js/zipslip`) | More results | This query now recognizes additional vulnerabilities. |
50
-
| Unused property (`js/unused-property`) | Less results | This query no longer flags properties of objects that are operands of `yield` expressions. |
51
52
52
53
The following low-precision queries are no longer run by default on LGTM (their results already were not displayed):
53
54
54
55
-`js/angular/dead-event-listener`
55
56
-`js/angular/unused-dependency`
56
-
-`js/conflicting-html-attribute`
57
-
-`js/useless-assignment-to-global`
58
-
-`js/too-many-parameters`
59
-
-`js/unused-property`
60
57
-`js/bitwise-sign-check`
61
58
-`js/comparison-of-identical-expressions`
62
-
-`js/misspelled-identifier`
59
+
-`js/conflicting-html-attribute`
60
+
-`js/ignored-setter-parameter`
63
61
-`js/jsdoc/malformed-param-tag`
64
-
-`js/jsdoc/unknown-parameter`
65
62
-`js/jsdoc/missing-parameter`
66
-
-`js/omitted-array-element`
67
-
-`js/ignored-setter-parameter`
63
+
-`js/jsdoc/unknown-parameter`
68
64
-`js/json-in-javascript-file`
65
+
-`js/misspelled-identifier`
66
+
-`js/nested-loops-with-same-variable`
69
67
-`js/node/cyclic-import`
70
68
-`js/node/unused-npm-dependency`
71
-
-`js/single-run-loop`
72
-
-`js/nested-loops-with-same-variable`
69
+
-`js/omitted-array-element`
73
70
-`js/return-outside-function`
71
+
-`js/single-run-loop`
72
+
-`js/too-many-parameters`
73
+
-`js/unused-property`
74
+
-`js/useless-assignment-to-global`
74
75
75
76
## Changes to libraries
76
77
@@ -80,3 +81,4 @@ The following low-precision queries are no longer run by default on LGTM (their
80
81
-`Parameter.flow()` now gets the correct data flow node for a parameter. Previously this had a result, but the node was disconnected from the data flow graph.
81
82
-`ParameterNode.asExpr()` and `.getAstNode()` now gets the parameter's AST node, whereas previously it had no result.
82
83
-`Expr.flow()` now has a more meaningful result for destructuring patterns. Previously this node was disconnected from the data flow graph. Now it represents the values being destructured by the pattern.
84
+
* The global data-flow and taint-tracking libraries now model indirect parameter accesses through the `arguments` object in some cases, which may lead to additional results from some of the security queries, particularly "Prototype pollution in utility function".
0 commit comments