58 Pull requests merged by 26 people

• C++: Support C++20 range-based for initializers

  #15638 merged Feb 19, 2024

• Automodel: Release query pack.

  #15651 merged Feb 19, 2024

• Go: Promote `go/missing-jwt-signature-check` from experimental

  #15585 merged Feb 19, 2024

• Swift: update swift prebuilt package

  #15593 merged Feb 19, 2024

• Swift: remove test sdk

  #15653 merged Feb 19, 2024

• Dataflow: Bugfix for field reads in SimpleGlobal.

  #15634 merged Feb 19, 2024

• Kotlin 2: Accept changes in library-tests/methods

  #15645 merged Feb 19, 2024

• Dataflow: Fix flow-feature bug for parameterless static functions

  #15632 merged Feb 19, 2024

• C++: Change sources in `NonConstantFormat.ql`

  #15516 merged Feb 16, 2024

• Generate changelogs for 2.16.2

  #15644 merged Feb 16, 2024

• Kotlin 2: Accept changes in library-tests/controlflow/dominance

  #15641 merged Feb 16, 2024

• Kotlin 2: Accept changes in library-tests/controlflow/basic

  #15640 merged Feb 16, 2024

• Kotlin 2: Accept changes in library-tests/stmts

  #15639 merged Feb 16, 2024

• C++: Fix joins in `controlsBlock`

  #15637 merged Feb 16, 2024

• Fix change note on 2.16.2 release branch

  #15635 merged Feb 16, 2024

• Add `security-events: write` permission in `ql-for-ql-build.yml`

  #15631 merged Feb 16, 2024

• Move the JS java tests to be a proper `java_test` target.

  #15627 merged Feb 16, 2024

• C#: update the QHelp for `cs/web/unvalidated-url-redirection`

  #15623 merged Feb 16, 2024

• Extend permissions in `csv-coverage-update.yml`

  #15630 merged Feb 16, 2024

• C++: Don't strip specifiers away in `TFinalParameterUse`

  #15626 merged Feb 16, 2024

• Automodel: Improve handling of varargs and overriding in extraction queries

  #15554 merged Feb 16, 2024

• Kotlin 2: Accept more location changes

  #15616 merged Feb 15, 2024

• C++: Support `constexpr if` in the IR

  #15612 merged Feb 15, 2024

• Automodel: Make description of some negative characteristics more explicit.

  #15592 merged Feb 15, 2024

• Add new libraries we cover to frameworks.csv

  #15624 merged Feb 15, 2024

• C#: Add a few more sanitizers to `cs/web/unvalidated-url-redirection`

  #15596 merged Feb 15, 2024

• Declare permissions

  #15493 merged Feb 15, 2024

• Java: Expand ExactPathSanitizer to work on the argument of 'equals' too

  #15622 merged Feb 15, 2024

• C#: Code quality improvements (fixed log message, removed unused interface)

  #15621 merged Feb 15, 2024

• Python: Decompression Bombs

  #13557 merged Feb 15, 2024

• Ruby: Recognise raw Erb output as XSS sink

  #15520 merged Feb 15, 2024

• Ruby: add docs for customizing library models with data extensions

  #15488 merged Feb 15, 2024

• C# Only remove temp files for MVC view generation if needed

  #15614 merged Feb 15, 2024

• Fix typo in NettyRequestSplitting.java

  #15618 merged Feb 14, 2024

• Go: Use less confusing name for hardcoded credentials tests

  #15615 merged Feb 14, 2024

• Go: Promote `go/hardcoded-key` from experimental

  #15527 merged Feb 14, 2024

• C++: For unnamed local variable declaration entries consider the name of the variable

  #15611 merged Feb 14, 2024

• Kotlin: Fix build with latest 2.0.255 snapshots

  #15606 merged Feb 14, 2024

• Limit xl runner jobs to github org

  #15584 merged Feb 14, 2024

• JS: Fix flow through &&

  #15602 merged Feb 14, 2024

• C++: Output the declaration entries used in range-based for-loops

  #15609 merged Feb 14, 2024

• JS: Add library for naming endpoints

  #15380 merged Feb 14, 2024

• Data flow: Cache `viableCallableExt`

  #15582 merged Feb 14, 2024

• C# 12: Primary constructors.

  #15474 merged Feb 14, 2024

• Java: Document which assignment type is covered by which class

  #15451 merged Feb 14, 2024

• Swift: Trivial changes to swift/unsafe-unpacking

  #15607 merged Feb 13, 2024

• Go: Fix file info extraction for dummy files

  #15603 merged Feb 13, 2024

• C++: Update test results of `constexpr if` destructors

  #15597 merged Feb 13, 2024

• Swift: Add Unsafe Unpacking Query (CWE-022)

  #14888 merged Feb 13, 2024

• Bump the extractor-dependencies group in /go/extractor with 1 update

  #15590 merged Feb 13, 2024

• C++: Revert #15528

  #15601 merged Feb 13, 2024

• Kotlin 2: Accept more test changes

  #15561 merged Feb 13, 2024

• C++: Fix `memset` model

  #15587 merged Feb 13, 2024

• C++: Add additional IR tests for destructors

  #15594 merged Feb 13, 2024

• Use `!cancelled` in qhelp-pr-preview workflow

  #15589 merged Feb 13, 2024

• Python: Update BUILD.bazel files.

  #15586 merged Feb 13, 2024

• C#: Improve the `cs/path-injection` QHelp

  #15519 merged Feb 13, 2024

• C# - Add default nuget feed if there's none

  #15577 merged Feb 13, 2024

19 Pull requests opened by 13 people

• Dataflow: wip test of fieldflowbranchlimit adjustment

  #15599 opened Feb 13, 2024

• C# Change desktop dotnet assembly lookup to fall back to nuget reference assemblies

  #15600 opened Feb 13, 2024

• Ruby: add additional sources on the request object of Rails

  #15604 opened Feb 13, 2024

• C#: Add more `environment` and `commandargs` sources for the C# Standard Library

  #15605 opened Feb 13, 2024

• Golang: fix flow from a map value via a range statement

  #15613 opened Feb 14, 2024

• Ruby: Add additional sql sinks for ActiveRecord connection methods

  #15619 opened Feb 14, 2024

• C# 12: Primary constructor inititalizers.

  #15625 opened Feb 15, 2024

• Cpp non constant format as path query

  #15628 opened Feb 15, 2024

• C#: Remove `Stored` variants of queries

  #15629 opened Feb 15, 2024

• C++: Assume modelled functions always override buffers by default

  #15633 opened Feb 16, 2024

• Java: Sensitive Logging: Simplify definition of source and improve QLDoc

  #15643 opened Feb 16, 2024

• Java: Add tests for Maven wrapper

  #15646 opened Feb 16, 2024

• Update CSV framework coverage reports

  #15648 opened Feb 17, 2024

• C#: Add fallback logic to `nuget install`

  #15650 opened Feb 19, 2024

• C#: Read-only property flow.

  #15652 opened Feb 19, 2024

• Java: Switch helper flow from Global to SimpleGlobal in StaticInitializationVectorQuery.

  #15654 opened Feb 19, 2024

• Python: Support model editor

  #15655 opened Feb 19, 2024

• Ruby: Start building the language pack using bazel.

  #15656 opened Feb 19, 2024

• C#: Use primary constructors for record types for dataflow.

  #15657 opened Feb 19, 2024

7 Issues closed by 5 people

• Yaml scripts appear to be non-executable

  #15598 closed Feb 19, 2024

• Java: Add sinks for `sun.misc.Unsafe`

  #15247 closed Feb 15, 2024

• False negative: NestJS TypeORM SQLInjection vulnerability not detected

  #15299 closed Feb 14, 2024

• False positive - Incomplete string escaping or encoding

  #15610 closed Feb 14, 2024

• Workflows get stuck on forks

  #15464 closed Feb 14, 2024

• Java: VariableAssign (LocalVariableDeclExpr) is not an Assignment

  #3266 closed Feb 14, 2024

• `.github/workflows/qhelp-pr-preview.yml` shouldn't upload-artifact if `cancelled()`

  #15588 closed Feb 13, 2024

3 Issues opened by 3 people

• IOException while executing process with args

  #15649 opened Feb 18, 2024

• support Go 1.22.0

  #15647 opened Feb 17, 2024

• Autobuild uses very old maven and maven wrapper

  #15636 opened Feb 16, 2024

17 Unresolved conversations

Sometimes conversations happen on old items that aren’t yet closed. Here is a list of all the Issues and Pull Requests with unresolved conversations.

• C#: Models as Data Documentation

  #15563 commented on Feb 19, 2024 • 12 new comments

• C++: Add implicit destructors for named variables to the IR

  #15506 commented on Feb 19, 2024 • 8 new comments

• Bazel: use bzlmod

  #15583 commented on Feb 19, 2024 • 2 new comments

• Java: Add query for insecurely generated keys for local authentication.

  #15548 commented on Feb 19, 2024 • 2 new comments

• Ruby: Block flow into flow sources

  #15483 commented on Feb 13, 2024 • 2 new comments

• Java: Fix `ClassInstanceExpr::isDiamond` not working for anonymous classes

  #15429 commented on Feb 19, 2024 • 2 new comments

• Go: Update autobuilder to deal with the upcoming deprecation of the legacy GOPATH mode

  #15361 commented on Feb 19, 2024 • 2 new comments

• Go: new query for detect DOS vulnerability

  #15130 commented on Feb 15, 2024 • 1 new comment

• Java: Cache interpretElement.

  #15570 commented on Feb 13, 2024 • 1 new comment

• False positive - LogInjection (CWE 117) is not mitigated via Log4j2 %{encodeCRLF) pattern

  #15574 commented on Feb 13, 2024 • 1 new comment

• C#: Refactor C# queries to use `ThreatModelFlowSource` instead of `RemoteFlowSource`

  #15419 commented on Feb 15, 2024 • 0 new comments

• [Python] Add Unicode DoS (qhelp, tests and the query)

  #15319 commented on Feb 13, 2024 • 0 new comments

• Java: test changes for making buildless' classpath ordering deterministic

  #15445 commented on Feb 19, 2024 • 0 new comments

• C++: Accept test changes after frontend upgrade

  #15213 commented on Feb 19, 2024 • 0 new comments

• Go: Support Go 1.22

  #15202 commented on Feb 16, 2024 • 0 new comments

• Data flow: prune context-sensitivity relations

  #15140 commented on Feb 19, 2024 • 0 new comments

• Kotlin: Compile tests using the same jdk as the java tests.

  #15568 commented on Feb 15, 2024 • 0 new comments