Release preparation for version 2.13.1

github · Apr 28, 2023 · 3bd2917 · 3bd2917
1 parent 205bb76
commit 3bd2917
Show file tree

Hide file tree

Showing 106 changed files with 276 additions and 106 deletions.
diff --git a/cpp/ql/lib/CHANGELOG.md b/cpp/ql/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.7.1
+
+No user-facing changes.
+
 ## 0.7.0
 
 ### Breaking Changes

diff --git a/cpp/ql/lib/change-notes/released/0.7.1.md b/cpp/ql/lib/change-notes/released/0.7.1.md
@@ -0,0 +1,3 @@
+## 0.7.1
+
+No user-facing changes.
diff --git a/cpp/ql/lib/codeql-pack.release.yml b/cpp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.7.0
+lastReleaseVersion: 0.7.1
diff --git a/cpp/ql/lib/qlpack.yml b/cpp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 0.7.1-dev
+version: 0.7.1
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp

diff --git a/cpp/ql/src/CHANGELOG.md b/cpp/ql/src/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 0.6.1
+
+### New Queries
+
+* A new query `cpp/double-free` has been added. The query finds possible cases of deallocating the same pointer twice. The precision of the query has been set to "medium".
+* The query `cpp/use-after-free` has been modernized and assigned the precision "medium". The query finds cases of where a pointer is dereferenced after its memory has been deallocated.
+
 ## 0.6.0
 
 ### New Queries

diff --git a/cpp/ql/src/change-notes/2023-04-11-double-free.md b/cpp/ql/src/change-notes/2023-04-11-double-free.md
diff --git a/cpp/ql/src/change-notes/2023-04-11-use-after-free.md b/cpp/ql/src/change-notes/2023-04-11-use-after-free.md
diff --git a/cpp/ql/src/change-notes/released/0.6.1.md b/cpp/ql/src/change-notes/released/0.6.1.md
@@ -0,0 +1,6 @@
+## 0.6.1
+
+### New Queries
+
+* A new query `cpp/double-free` has been added. The query finds possible cases of deallocating the same pointer twice. The precision of the query has been set to "medium".
+* The query `cpp/use-after-free` has been modernized and assigned the precision "medium". The query finds cases of where a pointer is dereferenced after its memory has been deallocated.
diff --git a/cpp/ql/src/codeql-pack.release.yml b/cpp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.6.0
+lastReleaseVersion: 0.6.1
diff --git a/cpp/ql/src/qlpack.yml b/cpp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/cpp-queries
-version: 0.6.1-dev
+version: 0.6.1
 groups: 
   - cpp
   - queries

diff --git a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.5.1
+
+No user-facing changes.
+
 ## 1.5.0
 
 No user-facing changes.

diff --git a/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.5.1.md b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.5.1.md
@@ -0,0 +1,3 @@
+## 1.5.1
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.5.0
+lastReleaseVersion: 1.5.1
diff --git a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-all
-version: 1.5.1-dev
+version: 1.5.1
 groups:
     - csharp
     - solorigate

diff --git a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.5.1
+
+No user-facing changes.
+
 ## 1.5.0
 
 No user-facing changes.

diff --git a/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.5.1.md b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.5.1.md
@@ -0,0 +1,3 @@
+## 1.5.1
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.5.0
+lastReleaseVersion: 1.5.1
diff --git a/csharp/ql/campaigns/Solorigate/src/qlpack.yml b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-queries
-version: 1.5.1-dev
+version: 1.5.1
 groups:
     - csharp
     - solorigate

diff --git a/csharp/ql/lib/CHANGELOG.md b/csharp/ql/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.6.1
+
+No user-facing changes.
+
 ## 0.6.0
 
 ### Deprecated APIs

diff --git a/csharp/ql/lib/change-notes/released/0.6.1.md b/csharp/ql/lib/change-notes/released/0.6.1.md
@@ -0,0 +1,3 @@
+## 0.6.1
+
+No user-facing changes.
diff --git a/csharp/ql/lib/codeql-pack.release.yml b/csharp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.6.0
+lastReleaseVersion: 0.6.1
diff --git a/csharp/ql/lib/qlpack.yml b/csharp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/csharp-all
-version: 0.6.1-dev
+version: 0.6.1
 groups: csharp
 dbscheme: semmlecode.csharp.dbscheme
 extractor: csharp

diff --git a/csharp/ql/src/CHANGELOG.md b/csharp/ql/src/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 0.6.1
+
+### Minor Analysis Improvements
+
+* Additional sinks modelling writes to unencrypted local files have been added to `ExternalLocationSink`, used by the `cs/cleartext-storage` and `cs/exposure-of-sensitive-information` queries.
+
 ## 0.6.0
 
 ### Minor Analysis Improvements

diff --git a/...tes/2023-04-05-external-location-sinks.md → csharp/ql/src/change-notes/released/0.6.1.md b/...tes/2023-04-05-external-location-sinks.md → csharp/ql/src/change-notes/released/0.6.1.md
@@ -1,4 +1,5 @@
----
-category: minorAnalysis
----
-* Additional sinks modelling writes to unencrypted local files have been added to `ExternalLocationSink`, used by the `cs/cleartext-storage` and `cs/exposure-of-sensitive-information` queries.
+## 0.6.1
+
+### Minor Analysis Improvements
+
+* Additional sinks modelling writes to unencrypted local files have been added to `ExternalLocationSink`, used by the `cs/cleartext-storage` and `cs/exposure-of-sensitive-information` queries.
diff --git a/csharp/ql/src/codeql-pack.release.yml b/csharp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.6.0
+lastReleaseVersion: 0.6.1
diff --git a/csharp/ql/src/qlpack.yml b/csharp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/csharp-queries
-version: 0.6.1-dev
+version: 0.6.1
 groups: 
   - csharp
   - queries

diff --git a/go/ql/lib/CHANGELOG.md b/go/ql/lib/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 0.5.1
+
+### Minor Analysis Improvements
+
+* Taking a slice is now considered a sanitizer for `SafeUrlFlow`.
+
 ## 0.5.0
 
 ### Deprecated APIs

diff --git a/...-URLs-should-not-sanitize-against-SSRF.md → go/ql/lib/change-notes/released/0.5.1.md b/...-URLs-should-not-sanitize-against-SSRF.md → go/ql/lib/change-notes/released/0.5.1.md
@@ -1,4 +1,5 @@
----
-category: minorAnalysis
----
+## 0.5.1
+
+### Minor Analysis Improvements
+
 * Taking a slice is now considered a sanitizer for `SafeUrlFlow`.
diff --git a/go/ql/lib/codeql-pack.release.yml b/go/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.5.0
+lastReleaseVersion: 0.5.1
diff --git a/go/ql/lib/qlpack.yml b/go/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/go-all
-version: 0.5.1-dev
+version: 0.5.1
 groups: go
 dbscheme: go.dbscheme
 extractor: go

diff --git a/go/ql/src/CHANGELOG.md b/go/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.5.1
+
+No user-facing changes.
+
 ## 0.5.0
 
 ### Minor Analysis Improvements

diff --git a/go/ql/src/change-notes/released/0.5.1.md b/go/ql/src/change-notes/released/0.5.1.md
@@ -0,0 +1,3 @@
+## 0.5.1
+
+No user-facing changes.
diff --git a/go/ql/src/codeql-pack.release.yml b/go/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.5.0
+lastReleaseVersion: 0.5.1
diff --git a/go/ql/src/qlpack.yml b/go/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/go-queries
-version: 0.5.1-dev
+version: 0.5.1
 groups:
   - go
   - queries

diff --git a/java/ql/lib/CHANGELOG.md b/java/ql/lib/CHANGELOG.md
@@ -1,3 +1,18 @@
+## 0.6.1
+
+### Deprecated APIs
+
+* The `sensitiveResultReceiver` predicate in `SensitiveResultReceiverQuery.qll` has been deprecated and replaced with `isSensitiveResultReceiver` in order to use the new dataflow API.
+
+### Minor Analysis Improvements
+
+* Changed some models of Spring's `FileCopyUtils.copy` to be path injection sinks instead of summaries.
+* Added models for the following packages:
+  * java.nio.file
+* Added models for [Apache HttpComponents](https://hc.apache.org/) versions 4 and 5.
+* Added sanitizers that recognize line breaks to the query `java/log-injection`.
+* Added new flow steps for `java.util.StringJoiner`.
+
 ## 0.6.0
 
 ### Deprecated APIs

diff --git a/java/ql/lib/change-notes/2022-09-22-stringjoiner-summaries.md b/java/ql/lib/change-notes/2022-09-22-stringjoiner-summaries.md
diff --git a/java/ql/lib/change-notes/2022-10-06-log-injection-sanitizers.md b/java/ql/lib/change-notes/2022-10-06-log-injection-sanitizers.md
diff --git a/...l/lib/change-notes/2023-04-05-deprecated-sensitive-result-receiver-predicate.md b/...l/lib/change-notes/2023-04-05-deprecated-sensitive-result-receiver-predicate.md
diff --git a/java/ql/lib/change-notes/2023-04-06-add-apache-models.md b/java/ql/lib/change-notes/2023-04-06-add-apache-models.md
diff --git a/java/ql/lib/change-notes/2023-04-12-new-models-io.md b/java/ql/lib/change-notes/2023-04-12-new-models-io.md
diff --git a/java/ql/lib/change-notes/2023-04-24-spring-filecopyutils-sinks.md b/java/ql/lib/change-notes/2023-04-24-spring-filecopyutils-sinks.md
diff --git a/java/ql/lib/change-notes/released/0.6.1.md b/java/ql/lib/change-notes/released/0.6.1.md
@@ -0,0 +1,14 @@
+## 0.6.1
+
+### Deprecated APIs
+
+* The `sensitiveResultReceiver` predicate in `SensitiveResultReceiverQuery.qll` has been deprecated and replaced with `isSensitiveResultReceiver` in order to use the new dataflow API.
+
+### Minor Analysis Improvements
+
+* Changed some models of Spring's `FileCopyUtils.copy` to be path injection sinks instead of summaries.
+* Added models for the following packages:
+  * java.nio.file
+* Added models for [Apache HttpComponents](https://hc.apache.org/) versions 4 and 5.
+* Added sanitizers that recognize line breaks to the query `java/log-injection`.
+* Added new flow steps for `java.util.StringJoiner`.
diff --git a/java/ql/lib/codeql-pack.release.yml b/java/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.6.0
+lastReleaseVersion: 0.6.1
diff --git a/java/ql/lib/qlpack.yml b/java/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/java-all
-version: 0.6.1-dev
+version: 0.6.1
 groups: java
 dbscheme: config/semmlecode.dbscheme
 extractor: java

diff --git a/java/ql/src/CHANGELOG.md b/java/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.6.1
+
+No user-facing changes.
+
 ## 0.6.0
 
 ### New Queries

diff --git a/java/ql/src/change-notes/released/0.6.1.md b/java/ql/src/change-notes/released/0.6.1.md
@@ -0,0 +1,3 @@
+## 0.6.1
+
+No user-facing changes.
diff --git a/java/ql/src/codeql-pack.release.yml b/java/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.6.0
+lastReleaseVersion: 0.6.1
diff --git a/java/ql/src/qlpack.yml b/java/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/java-queries
-version: 0.6.1-dev
+version: 0.6.1
 groups: 
   - java
   - queries

diff --git a/javascript/ql/lib/CHANGELOG.md b/javascript/ql/lib/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 0.6.1
+
+### Major Analysis Improvements
+
+* The Yaml.qll library was moved into a shared library pack named `codeql/yaml` to make it possible for other languages to re-use it. This change should be backwards compatible for existing JavaScript queries.
+
 ## 0.6.0
 
 ### Major Analysis Improvements

diff --git a/...hange-notes/2023-04-17-shared-yaml-lib.md → ...ipt/ql/lib/change-notes/released/0.6.1.md b/...hange-notes/2023-04-17-shared-yaml-lib.md → ...ipt/ql/lib/change-notes/released/0.6.1.md
@@ -1,4 +1,5 @@
----
-category: majorAnalysis
----
+## 0.6.1
+
+### Major Analysis Improvements
+
 * The Yaml.qll library was moved into a shared library pack named `codeql/yaml` to make it possible for other languages to re-use it. This change should be backwards compatible for existing JavaScript queries.
diff --git a/javascript/ql/lib/codeql-pack.release.yml b/javascript/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.6.0
+lastReleaseVersion: 0.6.1
diff --git a/javascript/ql/lib/qlpack.yml b/javascript/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/javascript-all
-version: 0.6.1-dev
+version: 0.6.1
 groups: javascript
 dbscheme: semmlecode.javascript.dbscheme
 extractor: javascript

diff --git a/javascript/ql/src/CHANGELOG.md b/javascript/ql/src/CHANGELOG.md
@@ -1,3 +1,15 @@
+## 0.6.1
+
+### Minor Analysis Improvements
+
+* Improved the call graph to better handle the case where a function is stored on
+  a plain object and subsequently copied to a new host object via an `extend` call.
+
+### Bug Fixes
+
+* Fixes an issue that would cause TypeScript extraction to hang in rare cases when extracting
+  code containing recursive generic type aliases.
+
 ## 0.6.0
 
 ### Minor Analysis Improvements

diff --git a/javascript/ql/src/change-notes/2023-04-14-more-call-graph-steps.md b/javascript/ql/src/change-notes/2023-04-14-more-call-graph-steps.md
diff --git a/javascript/ql/src/change-notes/2023-04-26-typescript-compiler-crash.md b/javascript/ql/src/change-notes/2023-04-26-typescript-compiler-crash.md
diff --git a/javascript/ql/src/change-notes/released/0.6.1.md b/javascript/ql/src/change-notes/released/0.6.1.md
@@ -0,0 +1,11 @@
+## 0.6.1
+
+### Minor Analysis Improvements
+
+* Improved the call graph to better handle the case where a function is stored on
+  a plain object and subsequently copied to a new host object via an `extend` call.
+
+### Bug Fixes
+
+* Fixes an issue that would cause TypeScript extraction to hang in rare cases when extracting
+  code containing recursive generic type aliases.
diff --git a/javascript/ql/src/codeql-pack.release.yml b/javascript/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.6.0
+lastReleaseVersion: 0.6.1
diff --git a/javascript/ql/src/qlpack.yml b/javascript/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/javascript-queries
-version: 0.6.1-dev
+version: 0.6.1
 groups: 
   - javascript
   - queries