Skip to content

Commit 06d6671

Browse files
turboturbo
authored
Merge pull request #16569 from github/sitedocs/2.17.3
Add changelogs for 2.17.2 and 2.17.3
2 parents 195ccb0 + 52a834d commit 06d6671

File tree

4 files changed

+247
-1
lines changed

4 files changed

+247
-1
lines changed

‎docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.17.2.rst

Lines changed: 170 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,170 @@
1+
.. _codeql-cli-2.17.2:
2+
3+
==========================
4+
CodeQL 2.17.2 (2024-05-07)
5+
==========================
6+
7+
.. contents:: Contents
8+
:depth: 2
9+
:local:
10+
:backlinks: none
11+
12+
This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the `code scanning section on the GitHub blog <https://github.blog/tag/code-scanning/>`__, `relevant GitHub Changelog updates <https://github.blog/changelog/label/code-scanning/>`__, `changes in the CodeQL extension for Visual Studio Code <https://marketplace.visualstudio.com/items/GitHub.vscode-codeql/changelog>`__, and the `CodeQL Action changelog <https://github.com/github/codeql-action/blob/main/CHANGELOG.md>`__.
13+
14+
Security Coverage
15+
-----------------
16+
17+
CodeQL 2.17.2 runs a total of 413 security queries when configured with the Default suite (covering 161 CWE). The Extended suite enables an additional 130 queries (covering 34 more CWE). 1 security query has been added with this release.
18+
19+
CodeQL CLI
20+
----------
21+
22+
Improvements
23+
~~~~~~~~~~~~
24+
25+
* When uploading a SARIF file to GitHub using :code:`codeql github upload-results`, the CodeQL CLI now waits for the file to be processed by GitHub. If any errors occurred during processing of the analysis results, the command will log these and return a non-zero exit code. To disable this behaviour, pass the
26+
:code:`--no-wait-for-processing` flag.
27+
28+
By default, the command will wait for the SARIF file to be processed for a maximum of 2 minutes, however this is configurable with the
29+
:code:`--wait-for-processing-timeout` option.
30+
31+
* The build tracer is no longer enabled when using the |link-code-none-build-mode-1|_
32+
to analyze a compiled language, thus improving performance.
33+
34+
Known Issues
35+
~~~~~~~~~~~~
36+
37+
* The beta support for analyzing Swift in this release and all previous releases requires :code:`g++-13` when running on Linux. Users analyzing Swift using the :code:`ubuntu-latest`, :code:`ubuntu-22.04`, or
38+
:code:`ubuntu-20.04` runner images for GitHub Actions should update their workflows to install :code:`g++-13`. For more information, see `the runner images announcement <https://github.com/actions/runner-images/issues/9679>`__.
39+
40+
Query Packs
41+
-----------
42+
43+
Minor Analysis Improvements
44+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
45+
46+
C/C++
47+
"""""
48+
49+
* The "Uncontrolled data used in path expression" query (:code:`cpp/path-injection`) query produces fewer near-duplicate results.
50+
* The "Global variable may be used before initialization" query (:code:`cpp/global-use-before-init`) no longer raises an alert on global variables that are initialized when they are declared.
51+
* The "Inconsistent null check of pointer" query (:code:`cpp/inconsistent-nullness-testing`) query no longer raises an alert when the guarded check is in a macro expansion.
52+
53+
Golang
54+
""""""
55+
56+
* The query :code:`go/incomplete-hostname-regexp` now recognizes more sources involving concatenation of string literals and also follows flow through string concatenation. This may lead to more alerts.
57+
* Added some more barriers to flow for :code:`go/incorrect-integer-conversion` to reduce false positives, especially around type switches.
58+
59+
JavaScript/TypeScript
60+
"""""""""""""""""""""
61+
62+
* The JavaScript extractor will on longer report syntax errors related to "strict mode".
63+
Files containing such errors are now being fully analyzed along with other sources files.
64+
This improves our support for source files that technically break the "strict mode" rules,
65+
but where a build steps transforms the code such that it ends up working at runtime.
66+
67+
Language Libraries
68+
------------------
69+
70+
Breaking Changes
71+
~~~~~~~~~~~~~~~~
72+
73+
C/C++
74+
"""""
75+
76+
* Deleted the deprecated :code:`GlobalValueNumberingImpl.qll` implementation.
77+
78+
C#
79+
""
80+
81+
* Deleted the deprecated :code:`getAssemblyName` predicate from the :code:`Operator` class. Use :code:`getFunctionName` instead.
82+
* Deleted the deprecated :code:`LShiftOperator`, :code:`RShiftOperator`, :code:`AssignLShiftExpr`, :code:`AssignRShiftExpr`, :code:`LShiftExpr`, and :code:`RShiftExpr` aliases.
83+
* Deleted the deprecated :code:`getCallableDescription` predicate from the :code:`ExternalApiDataNode` class. Use :code:`hasQualifiedName` instead.
84+
85+
Golang
86+
""""""
87+
88+
* Deleted the deprecated :code:`CsvRemoteSource` alias. Use :code:`MaDRemoteSource` instead.
89+
90+
Java
91+
""""
92+
93+
* Deleted the deprecated :code:`AssignLShiftExpr`, :code:`AssignRShiftExpr`, :code:`AssignURShiftExpr`, :code:`LShiftExpr`, :code:`RShiftExpr`, and :code:`URShiftExpr` aliases.
94+
95+
JavaScript/TypeScript
96+
"""""""""""""""""""""
97+
98+
* Deleted the deprecated :code:`getInput` predicate from the :code:`CryptographicOperation` class. Use :code:`getAnInput` instead.
99+
* Deleted the deprecated :code:`RegExpPatterns` module from :code:`Regexp.qll`.
100+
* Deleted the deprecated :code:`semmle/javascript/security/BadTagFilterQuery.qll`, :code:`semmle/javascript/security/OverlyLargeRangeQuery.qll`, :code:`semmle/javascript/security/regexp/RegexpMatching.qll`, and :code:`Security/CWE-020/HostnameRegexpShared.qll` files.
101+
102+
Python
103+
""""""
104+
105+
* Deleted the deprecated :code:`RegExpPatterns` module from :code:`Regexp.qll`.
106+
* Deleted the deprecated :code:`Security/CWE-020/HostnameRegexpShared.qll` file.
107+
108+
Ruby
109+
""""
110+
111+
* Deleted the deprecated :code:`RegExpPatterns` module from :code:`Regexp.qll`.
112+
* Deleted the deprecated :code:`security/cwe-020/HostnameRegexpShared.qll` file.
113+
114+
Minor Analysis Improvements
115+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
116+
117+
C/C++
118+
"""""
119+
120+
* Source models have been added for the standard library function :code:`getc` (and variations).
121+
* Source, sink and flow models for the ZeroMQ (ZMQ) networking library have been added.
122+
* Parameters of functions without definitions now have :code:`ParameterNode`\ s.
123+
* The alias analysis used internally by various libraries has been improved to answer alias questions more conservatively. As a result, some queries may report fewer false positives.
124+
125+
C#
126+
""
127+
128+
* Generated .NET Runtime models for properties with both getters and setters have been removed as this is now handled by the data flow library.
129+
130+
JavaScript/TypeScript
131+
"""""""""""""""""""""
132+
133+
* Improved detection of whether a file uses CommonJS module system.
134+
135+
Deprecated APIs
136+
~~~~~~~~~~~~~~~
137+
138+
Golang
139+
""""""
140+
141+
* To make Go consistent with other language libraries, the :code:`UntrustedFlowSource` name has been deprecated throughout. Use :code:`RemoteFlowSource` instead, which replaces it.
142+
* Where modules have classes named :code:`UntrustedFlowAsSource`, these are also deprecated and the :code:`Source` class in the same module or the :code:`RemoteFlowSource` class should be used instead.
143+
144+
Python
145+
""""""
146+
147+
* Renamed the :code:`StrConst` class to :code:`StringLiteral`, for greater consistency with other languages. The :code:`StrConst` and :code:`Str` classes are now deprecated and will be removed in a future release.
148+
149+
New Features
150+
~~~~~~~~~~~~
151+
152+
C/C++
153+
"""""
154+
155+
* Models-as-Data support has been added for C/C++. This feature allows flow sources, sinks and summaries to be expressed in compact strings as an alternative to modelling each source / sink / summary with explicit QL. See :code:`dataflow/ExternalFlow.qll` for documentation and specification of the model format, and :code:`models/implementations/ZMQ.qll` for a simple example of models. Importing models from :code:`.yml` is not yet supported.
156+
157+
Shared Libraries
158+
----------------
159+
160+
Major Analysis Improvements
161+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
162+
163+
Dataflow Analysis
164+
"""""""""""""""""
165+
166+
* The data flow library performs heuristic filtering of code paths that have a high degree of control-flow uncertainty for improved performance in cases that are deemed unlikely to yield true positive flow paths. This filtering can be controlled with the :code:`fieldFlowBranchLimit` predicate in configurations. Two bugs have been fixed in relation to this: Some cases of high uncertainty were not being correctly identified. This fix improves performance in certain scenarios. Another group of cases of low uncertainty were also being misidentified, which led to false negatives. Taken together, we generally expect some additional query results with more true positives and fewer false positives.
167+
168+
.. |link-code-none-build-mode-1| replace:: :code:`none` build mode
169+
.. _link-code-none-build-mode-1: https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#codeql-build-modes
170+

‎docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.17.3.rst

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
.. _codeql-cli-2.17.3:
2+
3+
==========================
4+
CodeQL 2.17.3 (2024-05-17)
5+
==========================
6+
7+
.. contents:: Contents
8+
:depth: 2
9+
:local:
10+
:backlinks: none
11+
12+
This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the `code scanning section on the GitHub blog <https://github.blog/tag/code-scanning/>`__, `relevant GitHub Changelog updates <https://github.blog/changelog/label/code-scanning/>`__, `changes in the CodeQL extension for Visual Studio Code <https://marketplace.visualstudio.com/items/GitHub.vscode-codeql/changelog>`__, and the `CodeQL Action changelog <https://github.com/github/codeql-action/blob/main/CHANGELOG.md>`__.
13+
14+
Security Coverage
15+
-----------------
16+
17+
CodeQL 2.17.3 runs a total of 414 security queries when configured with the Default suite (covering 161 CWE). The Extended suite enables an additional 131 queries (covering 35 more CWE). 2 security queries have been added with this release.
18+
19+
CodeQL CLI
20+
----------
21+
22+
Improvements
23+
~~~~~~~~~~~~
24+
25+
* The language server that our IDE integration is built on now defaults to fine-grained dependency tracking for incremental error-checking after file changes. This slightly improves the latency of refreshing errors after local source code edits and will enable significant speedups in the future.
26+
* We now properly handle globs (such as :code:`folder/**/*.py`) in :code:`paths` configuration to specify what files to include for Python analysis (see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#specifying-directories-to-scan).
27+
* TRAP import (a part of :code:`codeql database create` and :code:`codeql database finalize`)
28+
now supports allocating 2^32 IDs during the import process. The previous limit was 2^31 IDs.
29+
30+
Query Packs
31+
-----------
32+
33+
New Queries
34+
~~~~~~~~~~~
35+
36+
C/C++
37+
"""""
38+
39+
* Added a new query, :code:`cpp/iterator-to-expired-container`, to detect the creation of iterators owned by a temporary objects that are about to be destroyed.
40+
41+
Python
42+
""""""
43+
44+
* The :code:`py/header-injection` query, originally contributed to the experimental query pack by @jorgectf, has been promoted to the main query pack and renamed to :code:`py/http-response-splitting`. This query finds instances of http header injection / response splitting vulnerabilities.
45+
46+
Language Libraries
47+
------------------
48+
49+
Breaking Changes
50+
~~~~~~~~~~~~~~~~
51+
52+
Java
53+
""""
54+
55+
* The Java extractor no longer supports the :code:`ODASA_JAVA_LAYOUT`, :code:`ODASA_TOOLS` and :code:`ODASA_HOME` legacy environment variables.
56+
* The Java extractor no longer supports the :code:`ODASA_BUILD_ERROR_DIR` legacy environment variable.
57+
58+
Major Analysis Improvements
59+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
60+
61+
Python
62+
""""""
63+
64+
* Added modeling of the :code:`pyramid` framework, leading to new remote flow sources and sinks.
65+
66+
Minor Analysis Improvements
67+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
68+
69+
Golang
70+
""""""
71+
72+
* Fixed a bug that stopped built-in functions from being referenced using the predicate :code:`hasQualifiedName` because technically they do not belong to any package. Now you can use the empty string as the package, e.g. :code:`f.hasQualifiedName("", "len")`.
73+
* Fixed a bug that stopped data flow models for built-in functions from having any effect because the package "" was not parsed correctly.
74+
* Fixed a bug that stopped data flow from being followed through variadic arguments to built-in functions or to functions called using a variable.

‎docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.8.1.rst

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ Bug Fixes
8282
Python
8383
""""""
8484

85-
* The `View AST functionality <https://docs.github.com/en/code-security/codeql-for-vs-code/using-the-advanced-functionality-of-the-codeql-for-vs-code-extension/exploring-the-structure-of-your-source-code/>`__ no longer prints detailed information about regular expressions, greatly improving performance.
85+
* The `View AST functionality <https://docs.github.com/en/code-security/codeql-for-vs-code/using-the-advanced-functionality-of-the-codeql-for-vs-code-extension/exploring-the-structure-of-your-source-code>`__ no longer prints detailed information about regular expressions, greatly improving performance.
8686

8787
Minor Analysis Improvements
8888
~~~~~~~~~~~~~~~~~~~~~~~~~~~

‎docs/codeql/codeql-overview/codeql-changelog/index.rst

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ A list of queries for each suite and language `is available here <https://docs.g
1111
.. toctree::
1212
:maxdepth: 1
1313

14+
codeql-cli-2.17.3
15+
codeql-cli-2.17.2
1416
codeql-cli-2.17.1
1517
codeql-cli-2.17.0
1618
codeql-cli-2.16.6

0 commit comments

Comments
 (0)