2.18.1 Upgrade #76

Windows might need some retrying around deleting the target directory.

…cli-2.18.0 Post-release preparation for codeql-cli-2.18.0

Go: fix `clear` sanitizer

Install script: Windows-compatible cleanup path.

…-to-code-scanning

…d-container-fp-4 C++: Fix `cpp/iterator-to-expired-container` FPs

So we have the info in the logs if the diagnostics processing fails

Moved lists of domains to data extensions, including adding those to the overall qlpack.yml Expanded scope of new query to further domains operated by the untrusted owners of polyfill.io

…ntainer-fp-5 C++: Add `cpp/iterator-to-expired-container` FP

Co-authored-by: Mathias Vorreiter Pedersen <[email protected]>

SSA: Add data flow integration layer

…rministic-file-order C#: Order files in buildless extraction

This could be made public in future. But I expect that we will want to use this logic for QL models as well then we will want to move it into a different file, which will be much easier if it's all private at the moment.

C#: Restore Windows dependencies when Windows Forms or WPF usage is detected

…exps C#: Perform fewer `regexpCapture`s when matching version numbers

Go: Add environment variable to include `vendor` directories in extraction

C++: Support more builtin operations

Go: Allow grouping import paths for models-as-data

…lmet-middleware JS/TS: insecure Helmet middleware (new query)

Java/Kotlin: Remove legacy $SEMMLE_DIST support

Implement NewArrayExpr.getArraySize()

…around Remove CI workaround for `DatabaseQualityDiagnostics.ql`

…te-headers Python: Model CookieWrites from HeaderWrites

… high.

Python : Arbitrary code execution due to Js2Py

…-mod SSA: Make barrier guards a parameterized module

Swift: Add GA change note.

C++: Test C++20 implicit array sizes.

C++: Assorted minor doc improvements

This reverts commit ccf56a2.

…ers for a string taint function.

…-type C++: Strip specifiers and typedefs when finding iterator parameter for string taint function

Docs suggestions accepted, thank you 🙏 Co-authored-by: Felicity Chapman <[email protected]>

Some of the internal tooling would not be too happy about this :D

…rministic-file-order-2 C#: Order syntax trees before creating compilation

…query help

…hub.com/aegilops/codeql into aegilops/polyfill-io-compromised-script

SSA: Reduce caching in data-flow integration layer

…xtractable Python: Handle diagnostics writing for `BuiltinModuleExtractable`

Co-authored-by: Felicity Chapman <[email protected]>

…mpromised-script

…ctions. None of these tests were relying on the removed rows.

… special member functions.

…sts-sink Java: add path-injection sink for `hudson.FilePath.exists()`

Update CSV framework coverage reports

Kotlin: Kotlin support is now out of beta, and generally available

…pired-container-to-code-scanning C++: Promote `cp/iterator-to-expired-container` to Code Scanning

Swift: Remove beta label

…generation C#: Narrow source model generation.

…elazarl Go: Convert chi echo and elazarl sources to MaD

Dataflow: Replace MakeSets with QlBuiltins::InternSets.

… step.

Java: Replace the MaD Object.clone() models with a non-aliasing value step.

Co-authored-by: Chris Smowton <[email protected]>

C++: Update tests to reflect on-demand indexing of special member functions.

…l-gin-mux Go: Convert go-restful, Gin and Mux sources to MaD

This avoids putting all the prefixes in the string pool.

Kotlin: Add 2.0.20 support

Java: Improve Android app detection

…summaries Java: add `IOUtils.toByteArray` summaries

…http Go: Convert Revel and net/http sources to MaD

…check Go: Change string prefix check

…ge-frameworks Go: Add frameworks to frameworks.csv

…mpares-eq-zero-fp-fixes C++: Fix FPs in `cpp/unsigned-difference-expression-compared-zero`

Go: use package grouping in existing models-as-data models

In MaD, `Argument[n]` corresponds to the post-update node of the argument, which in the old version of the test will be the definition of `dstReader` for the tests for `ReadBody`, `ReadLimitBody`, `ContinueReadBodyStream`, `ContinueReadBody`.

It is not supported yet.

Go/Bazel: use gazelle `go_deps` instead of a vendor directory

Bumps the extractor-dependencies group with 2 updates in the /go/extractor directory: [golang.org/x/mod](https://github.com/golang/mod) and [golang.org/x/tools](https://github.com/golang/tools). Updates `golang.org/x/mod` from 0.15.0 to 0.19.0 - [Commits](golang/mod@v0.15.0...v0.19.0) Updates `golang.org/x/tools` from 0.18.0 to 0.23.0 - [Release notes](https://github.com/golang/tools/releases) - [Commits](golang/tools@v0.18.0...v0.23.0) --- updated-dependencies: - dependency-name: golang.org/x/mod dependency-type: direct:production update-type: version-update:semver-minor dependency-group: extractor-dependencies - dependency-name: golang.org/x/tools dependency-type: direct:production update-type: version-update:semver-minor dependency-group: extractor-dependencies ... Signed-off-by: dependabot[bot] <[email protected]>

…extractor/extractor-dependencies-5727fbca95 Bump the extractor-dependencies group across 1 directory with 2 updates

…x for Swift.

C++: Add a new `MemoryLocation` to represent sets of `Allocation`s

C++: Support MaD alert provenance

Go: Convert fasthttp sources to MaD

Update CSV framework coverage reports

Java: Tag `java/non-https-url` with CWE-345 ("Insufficient Verification of Data Authenticity")

…rcer-test Java: Add test for autobuild with maven-enforcer

…che-zipmerge pkg.bzl: Disable remote caching of zipmerge steps.

Requires an internal PR.

…version Go: Output stdout/stderr for `go version` if something goes wrong

…ebsockets Go: convert models for websocket readers as remote flow sources to models-as-data

Integration tests: port to pytest.

Swift: Use shared library for sensitive private information heuristics

Update CSV framework coverage reports

Release preparation for version 2.18.1

…/2.18.1 Revert "Release preparation for version 2.18.1"

Release preparation for version 2.18.1

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

2.18.1 Upgrade #76

2.18.1 Upgrade #76

Commits on Jul 8, 2024

Commits on Jul 9, 2024

Commits on Jul 10, 2024

Commits on Jul 11, 2024

Commits on Jul 12, 2024

Commits on Jul 13, 2024

Commits on Jul 14, 2024

Commits on Jul 15, 2024

Commits on Jul 16, 2024

Commits on Jul 17, 2024

Commits on Jul 18, 2024

Commits on Jul 19, 2024

Commits on Jul 20, 2024

Commits on Jul 22, 2024

Commits on Jul 31, 2024