Skip to content

1.0.0.md

Latest commit

 

History

History
11 lines (7 loc) · 1.25 KB

1.0.0.md

File metadata and controls

11 lines (7 loc) · 1.25 KB

1.0.0

Breaking Changes

  • CodeQL package management is now generally available, and all GitHub-produced CodeQL packages have had their version numbers increased to 1.0.0.
  • Removed local query variants. The results pertaining to local sources can be found using the non-local counterpart query. As an example, the results previously found by java/unvalidated-url-redirection-local can be found by java/unvalidated-url-redirection, if the local threat model is enabled. The removed queries are java/path-injection-local, java/command-line-injection-local, java/xss-local, java/sql-injection-local, java/http-response-splitting-local, java/improper-validation-of-array-construction-local, java/improper-validation-of-array-index-local, java/tainted-format-string-local, java/tainted-arithmetic-local, java/unvalidated-url-redirection-local, java/xxe-local and java/tainted-numeric-cast-local.

Minor Analysis Improvements

  • The alert message for the query "Trust boundary violation" (java/trust-boundary-violation) has been updated to include a link to the remote source.
  • The sanitizer of the query java/zipslip has been improved to include nodes that are safe due to having certain safe types. This reduces false positives.