Merge branch 'main' into atorralba/promote-mvel-injection

Author: atorralba

.codeqlmanifest.json

@@ -1,5 +1,6 @@
 { "provide": [ "*/ql/src/qlpack.yml",
                "*/ql/test/qlpack.yml",
+               "cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/qlpack.yml",
                "*/ql/examples/qlpack.yml",
                "*/upgrades/qlpack.yml",
                "misc/legacy-support/*/qlpack.yml",

.github/workflows/csv-coverage.yml

@@ -70,8 +70,8 @@ jobs:
       with:
         name: rst-flow-model-coverage
         path: flow-model-coverage-*.rst
-    - name: Check coverage files
-      if: github.event.pull_request
-      run: |
-        python script/misc/scripts/library-coverage/compare-files.py codeqlModels
+    # - name: Check coverage files
+    #   if: github.event.pull_request
+    #   run: |
+    #     python script/misc/scripts/library-coverage/compare-files.py codeqlModels
 

cpp/change-notes/2021-06-10-std-types.md

@@ -5,6 +5,7 @@
  * @kind problem
  * @id cpp/offset-use-before-range-check
  * @problem.severity warning
+ * @security-severity 5.9
  * @precision medium
  * @tags reliability
  *       security

cpp/ql/src/Best Practices/Likely Errors/OffsetUseBeforeRangeCheck.ql

@@ -4,6 +4,7 @@
  * @kind problem
  * @id cpp/descriptor-may-not-be-closed
  * @problem.severity warning
+ * @security-severity 5.9
  * @tags efficiency
  *       security
  *       external/cwe/cwe-775

cpp/ql/src/Critical/DescriptorMayNotBeClosed.ql

@@ -4,6 +4,7 @@
  * @kind problem
  * @id cpp/descriptor-never-closed
  * @problem.severity warning
+ * @security-severity 5.9
  * @tags efficiency
  *       security
  *       external/cwe/cwe-775

cpp/ql/src/Critical/DescriptorNeverClosed.ql

@@ -4,6 +4,7 @@
  * @kind problem
  * @id cpp/file-may-not-be-closed
  * @problem.severity warning
+ * @security-severity 5.9
  * @tags efficiency
  *       security
  *       external/cwe/cwe-775

cpp/ql/src/Critical/FileMayNotBeClosed.ql

@@ -4,6 +4,7 @@
  * @kind problem
  * @id cpp/file-never-closed
  * @problem.severity warning
+ * @security-severity 5.9
  * @tags efficiency
  *       security
  *       external/cwe/cwe-775

cpp/ql/src/Critical/FileNeverClosed.ql

@@ -4,6 +4,7 @@
  * @kind problem
  * @id cpp/global-use-before-init
  * @problem.severity warning
+ * @security-severity 6.9
  * @tags reliability
  *       security
  *       external/cwe/cwe-457

cpp/ql/src/Critical/GlobalUseBeforeInit.ql

@@ -4,6 +4,7 @@
  * @kind problem
  * @id cpp/inconsistent-nullness-testing
  * @problem.severity warning
+ * @security-severity 3.6
  * @tags reliability
  *       security
  *       external/cwe/cwe-476