Skip to content

Commit 5f81234

Browse files
coadaflorincoadaflorin
authored
Merge pull request #18338 from github/changedocs/2.20.0
Update CodeQL changelog for versions 2.19.4 and 2.20.0
2 parents 90d8fb1 + 82fdd11 commit 5f81234

File tree

3 files changed

+280
-0
lines changed

3 files changed

+280
-0
lines changed

‎docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.19.4.rst

+82
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
.. _codeql-cli-2.19.4:
2+
3+
==========================
4+
CodeQL 2.19.4 (2024-12-02)
5+
==========================
6+
7+
.. contents:: Contents
8+
:depth: 2
9+
:local:
10+
:backlinks: none
11+
12+
This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the `code scanning section on the GitHub blog <https://github.blog/tag/code-scanning/>`__, `relevant GitHub Changelog updates <https://github.blog/changelog/label/code-scanning/>`__, `changes in the CodeQL extension for Visual Studio Code <https://marketplace.visualstudio.com/items/GitHub.vscode-codeql/changelog>`__, and the `CodeQL Action changelog <https://github.com/github/codeql-action/blob/main/CHANGELOG.md>`__.
13+
14+
Security Coverage
15+
-----------------
16+
17+
CodeQL 2.19.4 runs a total of 432 security queries when configured with the Default suite (covering 164 CWE). The Extended suite enables an additional 128 queries (covering 34 more CWE). 5 security queries have been added with this release.
18+
19+
CodeQL CLI
20+
----------
21+
22+
Bug Fixes
23+
~~~~~~~~~
24+
25+
* On MacOS, :code:`arch -arm64` commands no longer fail when they are executed via :code:`codeql database create --command`,
26+
via :code:`codeql database trace-command`, or are run after :code:`codeql database init --begin-tracing`. Note that build commands invoked this way still will not normally be traced, so this is useful only for running ancillary commands which are incidental to building your code.
27+
* Fixed a bug where :code:`codeql test run` would not preserve test databases on disk after a test failed.
28+
29+
Improvements
30+
~~~~~~~~~~~~
31+
32+
* CodeQL now supports passing values containing the equals character (:code:`=`) to extractor options via the :code:`--extractor-option` flag. This allows cases like :code:`--extractor-option opt=key=value`, which sets the extractor option :code:`opt` to hold the value :code:`key=value`, whereas previously that would have been rejected with an error.
33+
* The :code:`codeql pack bundle` command now sets the numeric user and group IDs of entries in the generated
34+
:code:`tar` archive to :code:`0`. This avoids failures like :code:`IllegalArgumentException: user id '7111111' is too big ( > 2097151 )` when the numeric user ID is too large.
35+
36+
Language Libraries
37+
------------------
38+
39+
Bug Fixes
40+
~~~~~~~~~
41+
42+
Golang
43+
""""""
44+
45+
* The behaviour of the :code:`subtypes` column in models-as-data now matches other languages more closely.
46+
* Fixed a bug which meant that some qualified names for promoted methods were not being recognised in some very specific circumstances.
47+
48+
Major Analysis Improvements
49+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
50+
51+
Python
52+
""""""
53+
54+
* Added modeling of the :code:`bottle` framework, leading to new remote flow sources and header writes
55+
56+
Minor Analysis Improvements
57+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
58+
59+
C#
60+
""
61+
62+
* The Models as Data models for .NET 8 Runtime now include generated models for higher order methods.
63+
64+
Golang
65+
""""""
66+
67+
* The :code:`subtypes` column has been set to true in all models-as-data models except some tests. This means that existing models will apply in some cases where they didn't before, which may lead to more alerts.
68+
69+
Java/Kotlin
70+
"""""""""""
71+
72+
* In a switch statement with a constant switch expression, all non-matching cases were being marked as unreachable, including those that can be reached by falling through from the matching case. This has now been fixed.
73+
74+
JavaScript/TypeScript
75+
"""""""""""""""""""""
76+
77+
* Added taint-steps for :code:`Array.prototype.with`.
78+
* Added taint-steps for :code:`Array.prototype.toSpliced`
79+
* Added taint-steps for :code:`Array.prototype.toReversed`.
80+
* Added taint-steps for :code:`Array.prototype.toSorted`.
81+
* Added support for :code:`String.prototype.matchAll`.
82+
* Added taint-steps for :code:`Array.prototype.reverse`.

‎docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.20.0.rst

+196
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,196 @@
1+
.. _codeql-cli-2.20.0:
2+
3+
==========================
4+
CodeQL 2.20.0 (2024-12-09)
5+
==========================
6+
7+
.. contents:: Contents
8+
:depth: 2
9+
:local:
10+
:backlinks: none
11+
12+
This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the `code scanning section on the GitHub blog <https://github.blog/tag/code-scanning/>`__, `relevant GitHub Changelog updates <https://github.blog/changelog/label/code-scanning/>`__, `changes in the CodeQL extension for Visual Studio Code <https://marketplace.visualstudio.com/items/GitHub.vscode-codeql/changelog>`__, and the `CodeQL Action changelog <https://github.com/github/codeql-action/blob/main/CHANGELOG.md>`__.
13+
14+
Security Coverage
15+
-----------------
16+
17+
CodeQL 2.20.0 runs a total of 432 security queries when configured with the Default suite (covering 164 CWE). The Extended suite enables an additional 128 queries (covering 34 more CWE).
18+
19+
CodeQL CLI
20+
----------
21+
22+
New Features
23+
~~~~~~~~~~~~
24+
25+
* The |link-code-QlBuiltins-BigInt-type-1|_ of arbitrary precision integers is generally available and no longer hidden behind the
26+
:code:`--allow-experimental=bigint` CLI feature flag.
27+
28+
Known Issues
29+
~~~~~~~~~~~~
30+
31+
* The Windows executable for this release is labeled with an incorrect version number within its properties: the version number should be 2.20.0 rather than 2.19.4.
32+
:code:`codeql version` reports the correct version number.
33+
34+
Miscellaneous
35+
~~~~~~~~~~~~~
36+
37+
* Backslashes are now escaped when writing output in the Graphviz DOT format (:code:`--format=dot`).
38+
* The build of Eclipse Temurin OpenJDK that is used to run the CodeQL CLI has been updated to version 21.0.5.
39+
40+
Query Packs
41+
-----------
42+
43+
Minor Analysis Improvements
44+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
45+
46+
C/C++
47+
"""""
48+
49+
* The "Call to function with fewer arguments than declared parameters" query (:code:`cpp/too-few-arguments`) no longer produces results if the function has been implicitly declared.
50+
51+
C#
52+
""
53+
54+
* :code:`csharp/diagnostic/database-quality` has been changed to exclude various property access expressions from database quality evaluation. The excluded property access expressions are expected to have no target callables even in manual or autobuilt databases.
55+
56+
Golang
57+
""""""
58+
59+
* Added value flow models for functions in the :code:`slices` package which do not involve the :code:`iter` package.
60+
61+
Java/Kotlin
62+
"""""""""""
63+
64+
* Added SHA-384 to the list of secure hashing algorithms. As a result the :code:`java/potentially-weak-cryptographic-algorithm` query should no longer flag up uses of SHA-384.
65+
* Added SHA3 to the list of secure hashing algorithms. As a result the :code:`java/potentially-weak-cryptographic-algorithm` query should no longer flag up uses of SHA3.
66+
* The :code:`java/weak-cryptographic-algorithm` query has been updated to no longer report uses of hash functions such as :code:`MD5` and :code:`SHA1` even if they are known to be weak. These hash algorithms are used very often in non-sensitive contexts, making the query too imprecise in practice. The :code:`java/potentially-weak-cryptographic-algorithm` query has been updated to report these uses instead.
67+
68+
New Queries
69+
~~~~~~~~~~~
70+
71+
C/C++
72+
"""""
73+
74+
* Added a new high-precision quality query, :code:`cpp/guarded-free`, which detects useless NULL pointer checks before calls to :code:`free`. A variation of this query was originally contributed as an `experimental query by @mario-campos <https://github.com/github/codeql/pull/16331>`__.
75+
76+
Language Libraries
77+
------------------
78+
79+
Bug Fixes
80+
~~~~~~~~~
81+
82+
Golang
83+
""""""
84+
85+
* Fixed a bug which meant that promoted fields and methods were missing when the embedded parent was not promoted due to a name clash.
86+
87+
Python
88+
""""""
89+
90+
* Fixed a problem with the control-flow graph construction, where writing :code:`case True:` or :code:`case False:` would cause parts of the graph to be pruned by mistake.
91+
92+
Breaking Changes
93+
~~~~~~~~~~~~~~~~
94+
95+
C/C++
96+
"""""
97+
98+
* Deleted the old deprecated data flow API that was based on extending a configuration class. See https://github.blog/changelog/2023-08-14-new-dataflow-api-for-writing-custom-codeql-queries for instructions on migrating your queries to use the new API.
99+
100+
C#
101+
""
102+
103+
* Deleted the old deprecated data flow API that was based on extending a configuration class. See https://github.blog/changelog/2023-08-14-new-dataflow-api-for-writing-custom-codeql-queries for instructions on migrating your queries to use the new API.
104+
105+
Golang
106+
""""""
107+
108+
* Deleted the old deprecated data flow API that was based on extending a configuration class. See https://github.blog/changelog/2023-08-14-new-dataflow-api-for-writing-custom-codeql-queries for instructions on migrating your queries to use the new API.
109+
110+
Java/Kotlin
111+
"""""""""""
112+
113+
* Deleted the old deprecated data flow API that was based on extending a configuration class. See https://github.blog/changelog/2023-08-14-new-dataflow-api-for-writing-custom-codeql-queries for instructions on migrating your queries to use the new API.
114+
115+
Python
116+
""""""
117+
118+
* Deleted the old deprecated data flow API that was based on extending a configuration class. See https://github.blog/changelog/2023-08-14-new-dataflow-api-for-writing-custom-codeql-queries for instructions on migrating your queries to use the new API.
119+
120+
Ruby
121+
""""
122+
123+
* Deleted the old deprecated data flow API that was based on extending a configuration class. See https://github.blog/changelog/2023-08-14-new-dataflow-api-for-writing-custom-codeql-queries for instructions on migrating your queries to use the new API.
124+
125+
Swift
126+
"""""
127+
128+
* Deleted the old deprecated data flow API that was based on extending a configuration class. See https://github.blog/changelog/2023-08-14-new-dataflow-api-for-writing-custom-codeql-queries for instructions on migrating your queries to use the new API.
129+
130+
Major Analysis Improvements
131+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
132+
133+
JavaScript/TypeScript
134+
"""""""""""""""""""""
135+
136+
* The :code:`js/incomplete-sanitization` query now also checks regular expressions constructed using :code:`new RegExp(..)`. Previously it only checked regular expression literals.
137+
* Regular expression-based sanitisers implemented with :code:`new RegExp(..)` are now detected in more cases.
138+
* Regular expression related queries now account for unknown flags.
139+
140+
Minor Analysis Improvements
141+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
142+
143+
C#
144+
""
145+
146+
* Added support for data-flow through member accesses of objects with :code:`dynamic` types.
147+
* Only extract *public* and *protected* members from reference assemblies. This yields an approximate average speed-up of around 10% for extraction and query execution. Custom MaD rows using :code:`Field`\ -based summaries may need to be changed to :code:`SyntheticField`\ -based flows if they reference private fields.
148+
* Added :code:`Microsoft.AspNetCore.Components.NagivationManager::Uri` as a remote flow source, since this value may contain user-specified values.
149+
* Added the following URI-parsing methods as summaries, as they may be tainted with user-specified values:
150+
151+
* :code:`System.Web.HttpUtility::ParseQueryString`
152+
* :code:`Microsoft.AspNetCore.WebUtilities.QueryHelpers::ParseQuery`
153+
* :code:`Microsoft.AspNetCore.WebUtilities.QueryHelpers::ParseNullableQuery`
154+
155+
* Added :code:`js-interop` sinks for the :code:`InvokeAsync` and :code:`InvokeVoidAsync` methods of :code:`Microsoft.JSInterop.IJSRuntime`, which can run arbitrary JavaScript.
156+
157+
Golang
158+
""""""
159+
160+
* A call to a method whose name starts with "Debug", "Error", "Fatal", "Info", "Log", "Output", "Panic", "Print", "Trace", "Warn" or "With" defined on an interface whose name ends in "logger" or "Logger" is now considered a LoggerCall. In particular, it is a sink for :code:`go/clear-text-logging` and :code:`go/log-injection`. This may lead to some more alerts in those queries.
161+
162+
Java/Kotlin
163+
"""""""""""
164+
165+
* Calling :code:`coll.contains(x)` is now a taint sanitizer (for any query) for the value :code:`x`, where :code:`coll` is a collection of constants.
166+
167+
JavaScript/TypeScript
168+
"""""""""""""""""""""
169+
170+
* Added taint-steps for :code:`String.prototype.toWellFormed`.
171+
* Added taint-steps for :code:`Map.groupBy` and :code:`Object.groupBy`.
172+
* Added taint-steps for :code:`Array.prototype.findLast`.
173+
* Added taint-steps for :code:`Array.prototype.findLastIndex`.
174+
175+
Deprecated APIs
176+
~~~~~~~~~~~~~~~
177+
178+
C/C++
179+
"""""
180+
181+
* The :code:`NonThrowingFunction` class (:code:`semmle.code.cpp.models.interfaces.NonThrowing.NonThrowingFunction`) has been deprecated. Please use the :code:`NonCppThrowingFunction` class instead.
182+
183+
Shared Libraries
184+
----------------
185+
186+
Breaking Changes
187+
~~~~~~~~~~~~~~~~
188+
189+
Utility Classes
190+
"""""""""""""""
191+
192+
* Deleted the old deprecated inline expectation test API that was based on the :code:`InlineExpectationsTest` class.
193+
194+
.. |link-code-QlBuiltins-BigInt-type-1| replace:: :code:`QlBuiltins::BigInt` type
195+
.. _link-code-QlBuiltins-BigInt-type-1: https://codeql.github.com/docs/ql-language-reference/modules/#bigint
196+

‎docs/codeql/codeql-overview/codeql-changelog/index.rst

+2
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ A list of queries for each suite and language `is available here <https://docs.g
1111
.. toctree::
1212
:maxdepth: 1
1313

14+
codeql-cli-2.20.0
15+
codeql-cli-2.19.4
1416
codeql-cli-2.19.3
1517
codeql-cli-2.19.2
1618
codeql-cli-2.19.1

0 commit comments

Comments
 (0)