From f2755315429157e21f5678d455254497f942fe75 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen
Date: Fri, 2 Feb 2024 10:57:15 +0100
Subject: [PATCH 001/731] Add support for TS 5.4-beta
---
.../lib/typescript/package-lock.json | 10 +-
.../extractor/lib/typescript/package.json | 4 +-
.../TypeScript/Types/printAst.expected | 151 ++++++++++++++----
.../TypeScript/Types/tests.expected | 20 +++
.../library-tests/TypeScript/Types/tst.ts | 8 +
5 files changed, 155 insertions(+), 38 deletions(-)
diff --git a/javascript/extractor/lib/typescript/package-lock.json b/javascript/extractor/lib/typescript/package-lock.json
index 2d448ae04488..fd672bf43c08 100644
--- a/javascript/extractor/lib/typescript/package-lock.json
+++ b/javascript/extractor/lib/typescript/package-lock.json
@@ -6,7 +6,7 @@
"": {
"name": "typescript-parser-wrapper",
"dependencies": {
- "typescript": "5.3.2"
+ "typescript": "5.4.0-beta"
},
"devDependencies": {
"@types/node": "18.15.3"
@@ -20,9 +20,9 @@
"license": "MIT"
},
"node_modules/typescript": {
- "version": "5.3.2",
- "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.3.2.tgz",
- "integrity": "sha512-6l+RyNy7oAHDfxC4FzSJcz9vnjTKxrLpDG5M2Vu4SHRVNg6xzqZp6LYSR9zjqQTu8DU/f5xwxUdADOkbrIX2gQ==",
+ "version": "5.4.0-beta",
+ "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.4.0-beta.tgz",
+ "integrity": "sha512-KgekV5JS7TQ7Bb8eO64QGxdM7MSBUUXOXq28OWX23d2MA8SiVtNYoo4s33tCTEGV8+6AGBRD2+KiXNNnexRRYw==",
"bin": {
"tsc": "bin/tsc",
"tsserver": "bin/tsserver"
@@ -32,4 +32,4 @@
}
}
}
-}
+}
\ No newline at end of file
diff --git a/javascript/extractor/lib/typescript/package.json b/javascript/extractor/lib/typescript/package.json
index 602379bc36a3..2a636c3cdf32 100644
--- a/javascript/extractor/lib/typescript/package.json
+++ b/javascript/extractor/lib/typescript/package.json
@@ -2,7 +2,7 @@
"name": "typescript-parser-wrapper",
"private": true,
"dependencies": {
- "typescript": "5.3.2"
+ "typescript": "5.4.0-beta"
},
"scripts": {
"build": "tsc --project tsconfig.json",
@@ -14,4 +14,4 @@
"devDependencies": {
"@types/node": "18.15.3"
}
-}
+}
\ No newline at end of file
diff --git a/javascript/ql/test/library-tests/TypeScript/Types/printAst.expected b/javascript/ql/test/library-tests/TypeScript/Types/printAst.expected
index 5f29995b8548..90fa2b8dcda2 100644
--- a/javascript/ql/test/library-tests/TypeScript/Types/printAst.expected
+++ b/javascript/ql/test/library-tests/TypeScript/Types/printAst.expected
@@ -124,6 +124,8 @@ nodes
| file://:0:0:0:0 | (Arguments) | semmle.label | (Arguments) |
| file://:0:0:0:0 | (Arguments) | semmle.label | (Arguments) |
| file://:0:0:0:0 | (Arguments) | semmle.label | (Arguments) |
+| file://:0:0:0:0 | (Arguments) | semmle.label | (Arguments) |
+| file://:0:0:0:0 | (Parameters) | semmle.label | (Parameters) |
| file://:0:0:0:0 | (Parameters) | semmle.label | (Parameters) |
| file://:0:0:0:0 | (Parameters) | semmle.label | (Parameters) |
| file://:0:0:0:0 | (Parameters) | semmle.label | (Parameters) |
@@ -183,6 +185,7 @@ nodes
| file://:0:0:0:0 | (TypeParameters) | semmle.label | (TypeParameters) |
| file://:0:0:0:0 | (TypeParameters) | semmle.label | (TypeParameters) |
| file://:0:0:0:0 | (TypeParameters) | semmle.label | (TypeParameters) |
+| file://:0:0:0:0 | (TypeParameters) | semmle.label | (TypeParameters) |
| middle-rest.ts:1:1:1:40 | [DeclStmt] let foo = ... | semmle.label | [DeclStmt] let foo = ... |
| middle-rest.ts:1:1:1:40 | [DeclStmt] let foo = ... | semmle.order | 16 |
| middle-rest.ts:1:5:1:7 | [VarDecl] foo | semmle.label | [VarDecl] foo |
@@ -1757,8 +1760,36 @@ nodes
| tst.ts:483:46:483:50 | [LocalTypeAccess] Pair3 | semmle.label | [LocalTypeAccess] Pair3 |
| tst.ts:483:46:483:58 | [GenericTypeExpr] Pair3 | semmle.label | [GenericTypeExpr] Pair3 |
| tst.ts:483:52:483:57 | [KeywordTypeExpr] string | semmle.label | [KeywordTypeExpr] string |
+| tst.ts:486:1:492:1 | [NamespaceDeclaration] module ... ow"); } | semmle.label | [NamespaceDeclaration] module ... ow"); } |
+| tst.ts:486:1:492:1 | [NamespaceDeclaration] module ... ow"); } | semmle.order | 90 |
+| tst.ts:486:8:486:11 | [VarDecl] TS54 | semmle.label | [VarDecl] TS54 |
+| tst.ts:487:3:489:3 | [FunctionDeclStmt] functio ... 0]; } | semmle.label | [FunctionDeclStmt] functio ... 0]; } |
+| tst.ts:487:12:487:28 | [VarDecl] createStreetLight | semmle.label | [VarDecl] createStreetLight |
+| tst.ts:487:30:487:30 | [Identifier] C | semmle.label | [Identifier] C |
+| tst.ts:487:30:487:45 | [TypeParameter] C extends string | semmle.label | [TypeParameter] C extends string |
+| tst.ts:487:40:487:45 | [KeywordTypeExpr] string | semmle.label | [KeywordTypeExpr] string |
+| tst.ts:487:48:487:53 | [SimpleParameter] colors | semmle.label | [SimpleParameter] colors |
+| tst.ts:487:56:487:56 | [LocalTypeAccess] C | semmle.label | [LocalTypeAccess] C |
+| tst.ts:487:56:487:58 | [ArrayTypeExpr] C[] | semmle.label | [ArrayTypeExpr] C[] |
+| tst.ts:487:61:487:72 | [SimpleParameter] defaultColor | semmle.label | [SimpleParameter] defaultColor |
+| tst.ts:487:76:487:82 | [LocalTypeAccess] NoInfer | semmle.label | [LocalTypeAccess] NoInfer |
+| tst.ts:487:76:487:85 | [GenericTypeExpr] NoInfer | semmle.label | [GenericTypeExpr] NoInfer |
+| tst.ts:487:84:487:84 | [LocalTypeAccess] C | semmle.label | [LocalTypeAccess] C |
+| tst.ts:487:88:489:3 | [BlockStmt] { r ... 0]; } | semmle.label | [BlockStmt] { r ... 0]; } |
+| tst.ts:488:5:488:21 | [ReturnStmt] return colors[0]; | semmle.label | [ReturnStmt] return colors[0]; |
+| tst.ts:488:12:488:17 | [VarRef] colors | semmle.label | [VarRef] colors |
+| tst.ts:488:12:488:20 | [IndexExpr] colors[0] | semmle.label | [IndexExpr] colors[0] |
+| tst.ts:488:19:488:19 | [Literal] 0 | semmle.label | [Literal] 0 |
+| tst.ts:491:3:491:19 | [VarRef] createStreetLight | semmle.label | [VarRef] createStreetLight |
+| tst.ts:491:3:491:57 | [CallExpr] createS ... ellow") | semmle.label | [CallExpr] createS ... ellow") |
+| tst.ts:491:3:491:58 | [ExprStmt] createS ... llow"); | semmle.label | [ExprStmt] createS ... llow"); |
+| tst.ts:491:21:491:46 | [ArrayExpr] ["red", ... green"] | semmle.label | [ArrayExpr] ["red", ... green"] |
+| tst.ts:491:22:491:26 | [Literal] "red" | semmle.label | [Literal] "red" |
+| tst.ts:491:29:491:36 | [Literal] "yellow" | semmle.label | [Literal] "yellow" |
+| tst.ts:491:39:491:45 | [Literal] "green" | semmle.label | [Literal] "green" |
+| tst.ts:491:49:491:56 | [Literal] "yellow" | semmle.label | [Literal] "yellow" |
| tstModuleCJS.cts:1:1:3:1 | [ExportDeclaration] export ... 'b'; } | semmle.label | [ExportDeclaration] export ... 'b'; } |
-| tstModuleCJS.cts:1:1:3:1 | [ExportDeclaration] export ... 'b'; } | semmle.order | 90 |
+| tstModuleCJS.cts:1:1:3:1 | [ExportDeclaration] export ... 'b'; } | semmle.order | 91 |
| tstModuleCJS.cts:1:8:3:1 | [FunctionDeclStmt] functio ... 'b'; } | semmle.label | [FunctionDeclStmt] functio ... 'b'; } |
| tstModuleCJS.cts:1:17:1:28 | [VarDecl] tstModuleCJS | semmle.label | [VarDecl] tstModuleCJS |
| tstModuleCJS.cts:1:33:1:35 | [LiteralTypeExpr] 'a' | semmle.label | [LiteralTypeExpr] 'a' |
@@ -1776,7 +1807,7 @@ nodes
| tstModuleCJS.cts:2:34:2:36 | [Literal] 'a' | semmle.label | [Literal] 'a' |
| tstModuleCJS.cts:2:40:2:42 | [Literal] 'b' | semmle.label | [Literal] 'b' |
| tstModuleES.mts:1:1:3:1 | [ExportDeclaration] export ... 'b'; } | semmle.label | [ExportDeclaration] export ... 'b'; } |
-| tstModuleES.mts:1:1:3:1 | [ExportDeclaration] export ... 'b'; } | semmle.order | 91 |
+| tstModuleES.mts:1:1:3:1 | [ExportDeclaration] export ... 'b'; } | semmle.order | 92 |
| tstModuleES.mts:1:16:3:1 | [FunctionDeclStmt] functio ... 'b'; } | semmle.label | [FunctionDeclStmt] functio ... 'b'; } |
| tstModuleES.mts:1:25:1:35 | [VarDecl] tstModuleES | semmle.label | [VarDecl] tstModuleES |
| tstModuleES.mts:1:40:1:42 | [LiteralTypeExpr] 'a' | semmle.label | [LiteralTypeExpr] 'a' |
@@ -1794,7 +1825,7 @@ nodes
| tstModuleES.mts:2:34:2:36 | [Literal] 'a' | semmle.label | [Literal] 'a' |
| tstModuleES.mts:2:40:2:42 | [Literal] 'b' | semmle.label | [Literal] 'b' |
| tstSuffixA.ts:1:1:3:1 | [ExportDeclaration] export ... .ts'; } | semmle.label | [ExportDeclaration] export ... .ts'; } |
-| tstSuffixA.ts:1:1:3:1 | [ExportDeclaration] export ... .ts'; } | semmle.order | 92 |
+| tstSuffixA.ts:1:1:3:1 | [ExportDeclaration] export ... .ts'; } | semmle.order | 93 |
| tstSuffixA.ts:1:8:3:1 | [FunctionDeclStmt] functio ... .ts'; } | semmle.label | [FunctionDeclStmt] functio ... .ts'; } |
| tstSuffixA.ts:1:17:1:28 | [VarDecl] resolvedFile | semmle.label | [VarDecl] resolvedFile |
| tstSuffixA.ts:1:33:1:47 | [LiteralTypeExpr] 'tstSuffixA.ts' | semmle.label | [LiteralTypeExpr] 'tstSuffixA.ts' |
@@ -1802,7 +1833,7 @@ nodes
| tstSuffixA.ts:2:5:2:27 | [ReturnStmt] return ... xA.ts'; | semmle.label | [ReturnStmt] return ... xA.ts'; |
| tstSuffixA.ts:2:12:2:26 | [Literal] 'tstSuffixA.ts' | semmle.label | [Literal] 'tstSuffixA.ts' |
| tstSuffixB.ios.ts:1:1:3:1 | [ExportDeclaration] export ... .ts'; } | semmle.label | [ExportDeclaration] export ... .ts'; } |
-| tstSuffixB.ios.ts:1:1:3:1 | [ExportDeclaration] export ... .ts'; } | semmle.order | 93 |
+| tstSuffixB.ios.ts:1:1:3:1 | [ExportDeclaration] export ... .ts'; } | semmle.order | 94 |
| tstSuffixB.ios.ts:1:8:3:1 | [FunctionDeclStmt] functio ... .ts'; } | semmle.label | [FunctionDeclStmt] functio ... .ts'; } |
| tstSuffixB.ios.ts:1:17:1:28 | [VarDecl] resolvedFile | semmle.label | [VarDecl] resolvedFile |
| tstSuffixB.ios.ts:1:33:1:51 | [LiteralTypeExpr] 'tstSuffixB.ios.ts' | semmle.label | [LiteralTypeExpr] 'tstSuffixB.ios.ts' |
@@ -1810,7 +1841,7 @@ nodes
| tstSuffixB.ios.ts:2:5:2:31 | [ReturnStmt] return ... os.ts'; | semmle.label | [ReturnStmt] return ... os.ts'; |
| tstSuffixB.ios.ts:2:12:2:30 | [Literal] 'tstSuffixB.ios.ts' | semmle.label | [Literal] 'tstSuffixB.ios.ts' |
| tstSuffixB.ts:1:1:3:1 | [ExportDeclaration] export ... .ts'; } | semmle.label | [ExportDeclaration] export ... .ts'; } |
-| tstSuffixB.ts:1:1:3:1 | [ExportDeclaration] export ... .ts'; } | semmle.order | 94 |
+| tstSuffixB.ts:1:1:3:1 | [ExportDeclaration] export ... .ts'; } | semmle.order | 95 |
| tstSuffixB.ts:1:8:3:1 | [FunctionDeclStmt] functio ... .ts'; } | semmle.label | [FunctionDeclStmt] functio ... .ts'; } |
| tstSuffixB.ts:1:17:1:28 | [VarDecl] resolvedFile | semmle.label | [VarDecl] resolvedFile |
| tstSuffixB.ts:1:33:1:47 | [LiteralTypeExpr] 'tstSuffixB.ts' | semmle.label | [LiteralTypeExpr] 'tstSuffixB.ts' |
@@ -1818,16 +1849,16 @@ nodes
| tstSuffixB.ts:2:5:2:27 | [ReturnStmt] return ... xB.ts'; | semmle.label | [ReturnStmt] return ... xB.ts'; |
| tstSuffixB.ts:2:12:2:26 | [Literal] 'tstSuffixB.ts' | semmle.label | [Literal] 'tstSuffixB.ts' |
| type_alias.ts:1:1:1:17 | [TypeAliasDeclaration,TypeDefinition] type B = boolean; | semmle.label | [TypeAliasDeclaration,TypeDefinition] type B = boolean; |
-| type_alias.ts:1:1:1:17 | [TypeAliasDeclaration,TypeDefinition] type B = boolean; | semmle.order | 95 |
+| type_alias.ts:1:1:1:17 | [TypeAliasDeclaration,TypeDefinition] type B = boolean; | semmle.order | 96 |
| type_alias.ts:1:6:1:6 | [Identifier] B | semmle.label | [Identifier] B |
| type_alias.ts:1:10:1:16 | [KeywordTypeExpr] boolean | semmle.label | [KeywordTypeExpr] boolean |
| type_alias.ts:3:1:3:9 | [DeclStmt] var b = ... | semmle.label | [DeclStmt] var b = ... |
-| type_alias.ts:3:1:3:9 | [DeclStmt] var b = ... | semmle.order | 96 |
+| type_alias.ts:3:1:3:9 | [DeclStmt] var b = ... | semmle.order | 97 |
| type_alias.ts:3:5:3:5 | [VarDecl] b | semmle.label | [VarDecl] b |
| type_alias.ts:3:5:3:8 | [VariableDeclarator] b: B | semmle.label | [VariableDeclarator] b: B |
| type_alias.ts:3:8:3:8 | [LocalTypeAccess] B | semmle.label | [LocalTypeAccess] B |
| type_alias.ts:5:1:5:50 | [TypeAliasDeclaration,TypeDefinition] type Va ... ay>; | semmle.label | [TypeAliasDeclaration,TypeDefinition] type Va ... ay>; |
-| type_alias.ts:5:1:5:50 | [TypeAliasDeclaration,TypeDefinition] type Va ... ay>; | semmle.order | 97 |
+| type_alias.ts:5:1:5:50 | [TypeAliasDeclaration,TypeDefinition] type Va ... ay>; | semmle.order | 98 |
| type_alias.ts:5:6:5:17 | [Identifier] ValueOrArray | semmle.label | [Identifier] ValueOrArray |
| type_alias.ts:5:19:5:19 | [Identifier] T | semmle.label | [Identifier] T |
| type_alias.ts:5:19:5:19 | [TypeParameter] T | semmle.label | [TypeParameter] T |
@@ -1839,14 +1870,14 @@ nodes
| type_alias.ts:5:34:5:48 | [GenericTypeExpr] ValueOrArray | semmle.label | [GenericTypeExpr] ValueOrArray |
| type_alias.ts:5:47:5:47 | [LocalTypeAccess] T | semmle.label | [LocalTypeAccess] T |
| type_alias.ts:7:1:7:28 | [DeclStmt] var c = ... | semmle.label | [DeclStmt] var c = ... |
-| type_alias.ts:7:1:7:28 | [DeclStmt] var c = ... | semmle.order | 98 |
+| type_alias.ts:7:1:7:28 | [DeclStmt] var c = ... | semmle.order | 99 |
| type_alias.ts:7:5:7:5 | [VarDecl] c | semmle.label | [VarDecl] c |
| type_alias.ts:7:5:7:27 | [VariableDeclarator] c: Valu ... number> | semmle.label | [VariableDeclarator] c: Valu ... number> |
| type_alias.ts:7:8:7:19 | [LocalTypeAccess] ValueOrArray | semmle.label | [LocalTypeAccess] ValueOrArray |
| type_alias.ts:7:8:7:27 | [GenericTypeExpr] ValueOrArray | semmle.label | [GenericTypeExpr] ValueOrArray |
| type_alias.ts:7:21:7:26 | [KeywordTypeExpr] number | semmle.label | [KeywordTypeExpr] number |
| type_alias.ts:9:1:15:13 | [TypeAliasDeclaration,TypeDefinition] type Js ... Json[]; | semmle.label | [TypeAliasDeclaration,TypeDefinition] type Js ... Json[]; |
-| type_alias.ts:9:1:15:13 | [TypeAliasDeclaration,TypeDefinition] type Js ... Json[]; | semmle.order | 99 |
+| type_alias.ts:9:1:15:13 | [TypeAliasDeclaration,TypeDefinition] type Js ... Json[]; | semmle.order | 100 |
| type_alias.ts:9:6:9:9 | [Identifier] Json | semmle.label | [Identifier] Json |
| type_alias.ts:10:5:15:12 | [UnionTypeExpr] \| strin ... Json[] | semmle.label | [UnionTypeExpr] \| strin ... Json[] |
| type_alias.ts:10:7:10:12 | [KeywordTypeExpr] string | semmle.label | [KeywordTypeExpr] string |
@@ -1862,12 +1893,12 @@ nodes
| type_alias.ts:15:7:15:10 | [LocalTypeAccess] Json | semmle.label | [LocalTypeAccess] Json |
| type_alias.ts:15:7:15:12 | [ArrayTypeExpr] Json[] | semmle.label | [ArrayTypeExpr] Json[] |
| type_alias.ts:17:1:17:15 | [DeclStmt] var json = ... | semmle.label | [DeclStmt] var json = ... |
-| type_alias.ts:17:1:17:15 | [DeclStmt] var json = ... | semmle.order | 100 |
+| type_alias.ts:17:1:17:15 | [DeclStmt] var json = ... | semmle.order | 101 |
| type_alias.ts:17:5:17:8 | [VarDecl] json | semmle.label | [VarDecl] json |
| type_alias.ts:17:5:17:14 | [VariableDeclarator] json: Json | semmle.label | [VariableDeclarator] json: Json |
| type_alias.ts:17:11:17:14 | [LocalTypeAccess] Json | semmle.label | [LocalTypeAccess] Json |
| type_alias.ts:19:1:21:57 | [TypeAliasDeclaration,TypeDefinition] type Vi ... ode[]]; | semmle.label | [TypeAliasDeclaration,TypeDefinition] type Vi ... ode[]]; |
-| type_alias.ts:19:1:21:57 | [TypeAliasDeclaration,TypeDefinition] type Vi ... ode[]]; | semmle.order | 101 |
+| type_alias.ts:19:1:21:57 | [TypeAliasDeclaration,TypeDefinition] type Vi ... ode[]]; | semmle.order | 102 |
| type_alias.ts:19:6:19:16 | [Identifier] VirtualNode | semmle.label | [Identifier] VirtualNode |
| type_alias.ts:20:5:21:56 | [UnionTypeExpr] \| strin ... Node[]] | semmle.label | [UnionTypeExpr] \| strin ... Node[]] |
| type_alias.ts:20:7:20:12 | [KeywordTypeExpr] string | semmle.label | [KeywordTypeExpr] string |
@@ -1883,7 +1914,7 @@ nodes
| type_alias.ts:21:43:21:53 | [LocalTypeAccess] VirtualNode | semmle.label | [LocalTypeAccess] VirtualNode |
| type_alias.ts:21:43:21:55 | [ArrayTypeExpr] VirtualNode[] | semmle.label | [ArrayTypeExpr] VirtualNode[] |
| type_alias.ts:23:1:27:6 | [DeclStmt] const myNode = ... | semmle.label | [DeclStmt] const myNode = ... |
-| type_alias.ts:23:1:27:6 | [DeclStmt] const myNode = ... | semmle.order | 102 |
+| type_alias.ts:23:1:27:6 | [DeclStmt] const myNode = ... | semmle.order | 103 |
| type_alias.ts:23:7:23:12 | [VarDecl] myNode | semmle.label | [VarDecl] myNode |
| type_alias.ts:23:7:27:5 | [VariableDeclarator] myNode: ... ] ] | semmle.label | [VariableDeclarator] myNode: ... ] ] |
| type_alias.ts:23:15:23:25 | [LocalTypeAccess] VirtualNode | semmle.label | [LocalTypeAccess] VirtualNode |
@@ -1908,12 +1939,12 @@ nodes
| type_alias.ts:26:23:26:36 | [Literal] "second-child" | semmle.label | [Literal] "second-child" |
| type_alias.ts:26:41:26:62 | [Literal] "I'm the second child" | semmle.label | [Literal] "I'm the second child" |
| type_definition_objects.ts:1:1:1:33 | [ImportDeclaration] import ... dummy"; | semmle.label | [ImportDeclaration] import ... dummy"; |
-| type_definition_objects.ts:1:1:1:33 | [ImportDeclaration] import ... dummy"; | semmle.order | 103 |
+| type_definition_objects.ts:1:1:1:33 | [ImportDeclaration] import ... dummy"; | semmle.order | 104 |
| type_definition_objects.ts:1:8:1:17 | [ImportSpecifier] * as dummy | semmle.label | [ImportSpecifier] * as dummy |
| type_definition_objects.ts:1:13:1:17 | [VarDecl] dummy | semmle.label | [VarDecl] dummy |
| type_definition_objects.ts:1:24:1:32 | [Literal] "./dummy" | semmle.label | [Literal] "./dummy" |
| type_definition_objects.ts:3:1:3:17 | [ExportDeclaration] export class C {} | semmle.label | [ExportDeclaration] export class C {} |
-| type_definition_objects.ts:3:1:3:17 | [ExportDeclaration] export class C {} | semmle.order | 104 |
+| type_definition_objects.ts:3:1:3:17 | [ExportDeclaration] export class C {} | semmle.order | 105 |
| type_definition_objects.ts:3:8:3:17 | [ClassDefinition,TypeDefinition] class C {} | semmle.label | [ClassDefinition,TypeDefinition] class C {} |
| type_definition_objects.ts:3:14:3:14 | [VarDecl] C | semmle.label | [VarDecl] C |
| type_definition_objects.ts:3:16:3:15 | [BlockStmt] {} | semmle.label | [BlockStmt] {} |
@@ -1921,36 +1952,36 @@ nodes
| type_definition_objects.ts:3:16:3:15 | [FunctionExpr] () {} | semmle.label | [FunctionExpr] () {} |
| type_definition_objects.ts:3:16:3:15 | [Label] constructor | semmle.label | [Label] constructor |
| type_definition_objects.ts:4:1:4:17 | [DeclStmt] let classObj = ... | semmle.label | [DeclStmt] let classObj = ... |
-| type_definition_objects.ts:4:1:4:17 | [DeclStmt] let classObj = ... | semmle.order | 105 |
+| type_definition_objects.ts:4:1:4:17 | [DeclStmt] let classObj = ... | semmle.order | 106 |
| type_definition_objects.ts:4:5:4:12 | [VarDecl] classObj | semmle.label | [VarDecl] classObj |
| type_definition_objects.ts:4:5:4:16 | [VariableDeclarator] classObj = C | semmle.label | [VariableDeclarator] classObj = C |
| type_definition_objects.ts:4:16:4:16 | [VarRef] C | semmle.label | [VarRef] C |
| type_definition_objects.ts:6:1:6:16 | [ExportDeclaration] export enum E {} | semmle.label | [ExportDeclaration] export enum E {} |
-| type_definition_objects.ts:6:1:6:16 | [ExportDeclaration] export enum E {} | semmle.order | 106 |
+| type_definition_objects.ts:6:1:6:16 | [ExportDeclaration] export enum E {} | semmle.order | 107 |
| type_definition_objects.ts:6:8:6:16 | [EnumDeclaration,TypeDefinition] enum E {} | semmle.label | [EnumDeclaration,TypeDefinition] enum E {} |
| type_definition_objects.ts:6:13:6:13 | [VarDecl] E | semmle.label | [VarDecl] E |
| type_definition_objects.ts:7:1:7:16 | [DeclStmt] let enumObj = ... | semmle.label | [DeclStmt] let enumObj = ... |
-| type_definition_objects.ts:7:1:7:16 | [DeclStmt] let enumObj = ... | semmle.order | 107 |
+| type_definition_objects.ts:7:1:7:16 | [DeclStmt] let enumObj = ... | semmle.order | 108 |
| type_definition_objects.ts:7:5:7:11 | [VarDecl] enumObj | semmle.label | [VarDecl] enumObj |
| type_definition_objects.ts:7:5:7:15 | [VariableDeclarator] enumObj = E | semmle.label | [VariableDeclarator] enumObj = E |
| type_definition_objects.ts:7:15:7:15 | [VarRef] E | semmle.label | [VarRef] E |
| type_definition_objects.ts:9:1:9:22 | [ExportDeclaration] export ... e N {;} | semmle.label | [ExportDeclaration] export ... e N {;} |
-| type_definition_objects.ts:9:1:9:22 | [ExportDeclaration] export ... e N {;} | semmle.order | 108 |
+| type_definition_objects.ts:9:1:9:22 | [ExportDeclaration] export ... e N {;} | semmle.order | 109 |
| type_definition_objects.ts:9:8:9:22 | [NamespaceDeclaration] namespace N {;} | semmle.label | [NamespaceDeclaration] namespace N {;} |
| type_definition_objects.ts:9:18:9:18 | [VarDecl] N | semmle.label | [VarDecl] N |
| type_definition_objects.ts:9:21:9:21 | [EmptyStmt] ; | semmle.label | [EmptyStmt] ; |
| type_definition_objects.ts:10:1:10:21 | [DeclStmt] let namespaceObj = ... | semmle.label | [DeclStmt] let namespaceObj = ... |
-| type_definition_objects.ts:10:1:10:21 | [DeclStmt] let namespaceObj = ... | semmle.order | 109 |
+| type_definition_objects.ts:10:1:10:21 | [DeclStmt] let namespaceObj = ... | semmle.order | 110 |
| type_definition_objects.ts:10:5:10:16 | [VarDecl] namespaceObj | semmle.label | [VarDecl] namespaceObj |
| type_definition_objects.ts:10:5:10:20 | [VariableDeclarator] namespaceObj = N | semmle.label | [VariableDeclarator] namespaceObj = N |
| type_definition_objects.ts:10:20:10:20 | [VarRef] N | semmle.label | [VarRef] N |
| type_definitions.ts:1:1:1:33 | [ImportDeclaration] import ... dummy"; | semmle.label | [ImportDeclaration] import ... dummy"; |
-| type_definitions.ts:1:1:1:33 | [ImportDeclaration] import ... dummy"; | semmle.order | 110 |
+| type_definitions.ts:1:1:1:33 | [ImportDeclaration] import ... dummy"; | semmle.order | 111 |
| type_definitions.ts:1:8:1:17 | [ImportSpecifier] * as dummy | semmle.label | [ImportSpecifier] * as dummy |
| type_definitions.ts:1:13:1:17 | [VarDecl] dummy | semmle.label | [VarDecl] dummy |
| type_definitions.ts:1:24:1:32 | [Literal] "./dummy" | semmle.label | [Literal] "./dummy" |
| type_definitions.ts:3:1:5:1 | [InterfaceDeclaration,TypeDefinition] interfa ... x: S; } | semmle.label | [InterfaceDeclaration,TypeDefinition] interfa ... x: S; } |
-| type_definitions.ts:3:1:5:1 | [InterfaceDeclaration,TypeDefinition] interfa ... x: S; } | semmle.order | 111 |
+| type_definitions.ts:3:1:5:1 | [InterfaceDeclaration,TypeDefinition] interfa ... x: S; } | semmle.order | 112 |
| type_definitions.ts:3:11:3:11 | [Identifier] I | semmle.label | [Identifier] I |
| type_definitions.ts:3:13:3:13 | [Identifier] S | semmle.label | [Identifier] S |
| type_definitions.ts:3:13:3:13 | [TypeParameter] S | semmle.label | [TypeParameter] S |
@@ -1958,14 +1989,14 @@ nodes
| type_definitions.ts:4:3:4:7 | [FieldDeclaration] x: S; | semmle.label | [FieldDeclaration] x: S; |
| type_definitions.ts:4:6:4:6 | [LocalTypeAccess] S | semmle.label | [LocalTypeAccess] S |
| type_definitions.ts:6:1:6:16 | [DeclStmt] let i = ... | semmle.label | [DeclStmt] let i = ... |
-| type_definitions.ts:6:1:6:16 | [DeclStmt] let i = ... | semmle.order | 112 |
+| type_definitions.ts:6:1:6:16 | [DeclStmt] let i = ... | semmle.order | 113 |
| type_definitions.ts:6:5:6:5 | [VarDecl] i | semmle.label | [VarDecl] i |
| type_definitions.ts:6:5:6:16 | [VariableDeclarator] i: I | semmle.label | [VariableDeclarator] i: I |
| type_definitions.ts:6:8:6:8 | [LocalTypeAccess] I | semmle.label | [LocalTypeAccess] I |
| type_definitions.ts:6:8:6:16 | [GenericTypeExpr] I | semmle.label | [GenericTypeExpr] I |
| type_definitions.ts:6:10:6:15 | [KeywordTypeExpr] number | semmle.label | [KeywordTypeExpr] number |
| type_definitions.ts:8:1:10:1 | [ClassDefinition,TypeDefinition] class C ... x: T } | semmle.label | [ClassDefinition,TypeDefinition] class C ... x: T } |
-| type_definitions.ts:8:1:10:1 | [ClassDefinition,TypeDefinition] class C ... x: T } | semmle.order | 113 |
+| type_definitions.ts:8:1:10:1 | [ClassDefinition,TypeDefinition] class C ... x: T } | semmle.order | 114 |
| type_definitions.ts:8:7:8:7 | [VarDecl] C | semmle.label | [VarDecl] C |
| type_definitions.ts:8:8:8:7 | [BlockStmt] {} | semmle.label | [BlockStmt] {} |
| type_definitions.ts:8:8:8:7 | [ClassInitializedMember,ConstructorDefinition] constructor() {} | semmle.label | [ClassInitializedMember,ConstructorDefinition] constructor() {} |
@@ -1977,14 +2008,14 @@ nodes
| type_definitions.ts:9:3:9:6 | [FieldDeclaration] x: T | semmle.label | [FieldDeclaration] x: T |
| type_definitions.ts:9:6:9:6 | [LocalTypeAccess] T | semmle.label | [LocalTypeAccess] T |
| type_definitions.ts:11:1:11:17 | [DeclStmt] let c = ... | semmle.label | [DeclStmt] let c = ... |
-| type_definitions.ts:11:1:11:17 | [DeclStmt] let c = ... | semmle.order | 114 |
+| type_definitions.ts:11:1:11:17 | [DeclStmt] let c = ... | semmle.order | 115 |
| type_definitions.ts:11:5:11:5 | [VarDecl] c | semmle.label | [VarDecl] c |
| type_definitions.ts:11:5:11:16 | [VariableDeclarator] c: C | semmle.label | [VariableDeclarator] c: C |
| type_definitions.ts:11:8:11:8 | [LocalTypeAccess] C | semmle.label | [LocalTypeAccess] C |
| type_definitions.ts:11:8:11:16 | [GenericTypeExpr] C | semmle.label | [GenericTypeExpr] C |
| type_definitions.ts:11:10:11:15 | [KeywordTypeExpr] number | semmle.label | [KeywordTypeExpr] number |
| type_definitions.ts:13:1:15:1 | [EnumDeclaration,TypeDefinition] enum Co ... blue } | semmle.label | [EnumDeclaration,TypeDefinition] enum Co ... blue } |
-| type_definitions.ts:13:1:15:1 | [EnumDeclaration,TypeDefinition] enum Co ... blue } | semmle.order | 115 |
+| type_definitions.ts:13:1:15:1 | [EnumDeclaration,TypeDefinition] enum Co ... blue } | semmle.order | 116 |
| type_definitions.ts:13:6:13:10 | [VarDecl] Color | semmle.label | [VarDecl] Color |
| type_definitions.ts:14:3:14:5 | [EnumMember,TypeDefinition] red | semmle.label | [EnumMember,TypeDefinition] red |
| type_definitions.ts:14:3:14:5 | [VarDecl] red | semmle.label | [VarDecl] red |
@@ -1993,29 +2024,29 @@ nodes
| type_definitions.ts:14:15:14:18 | [EnumMember,TypeDefinition] blue | semmle.label | [EnumMember,TypeDefinition] blue |
| type_definitions.ts:14:15:14:18 | [VarDecl] blue | semmle.label | [VarDecl] blue |
| type_definitions.ts:16:1:16:17 | [DeclStmt] let color = ... | semmle.label | [DeclStmt] let color = ... |
-| type_definitions.ts:16:1:16:17 | [DeclStmt] let color = ... | semmle.order | 116 |
+| type_definitions.ts:16:1:16:17 | [DeclStmt] let color = ... | semmle.order | 117 |
| type_definitions.ts:16:5:16:9 | [VarDecl] color | semmle.label | [VarDecl] color |
| type_definitions.ts:16:5:16:16 | [VariableDeclarator] color: Color | semmle.label | [VariableDeclarator] color: Color |
| type_definitions.ts:16:12:16:16 | [LocalTypeAccess] Color | semmle.label | [LocalTypeAccess] Color |
| type_definitions.ts:18:1:18:33 | [EnumDeclaration,TypeDefinition] enum En ... ember } | semmle.label | [EnumDeclaration,TypeDefinition] enum En ... ember } |
-| type_definitions.ts:18:1:18:33 | [EnumDeclaration,TypeDefinition] enum En ... ember } | semmle.order | 117 |
+| type_definitions.ts:18:1:18:33 | [EnumDeclaration,TypeDefinition] enum En ... ember } | semmle.order | 118 |
| type_definitions.ts:18:6:18:22 | [VarDecl] EnumWithOneMember | semmle.label | [VarDecl] EnumWithOneMember |
| type_definitions.ts:18:26:18:31 | [EnumMember,TypeDefinition] member | semmle.label | [EnumMember,TypeDefinition] member |
| type_definitions.ts:18:26:18:31 | [VarDecl] member | semmle.label | [VarDecl] member |
| type_definitions.ts:19:1:19:25 | [DeclStmt] let e = ... | semmle.label | [DeclStmt] let e = ... |
-| type_definitions.ts:19:1:19:25 | [DeclStmt] let e = ... | semmle.order | 118 |
+| type_definitions.ts:19:1:19:25 | [DeclStmt] let e = ... | semmle.order | 119 |
| type_definitions.ts:19:5:19:5 | [VarDecl] e | semmle.label | [VarDecl] e |
| type_definitions.ts:19:5:19:24 | [VariableDeclarator] e: EnumWithOneMember | semmle.label | [VariableDeclarator] e: EnumWithOneMember |
| type_definitions.ts:19:8:19:24 | [LocalTypeAccess] EnumWithOneMember | semmle.label | [LocalTypeAccess] EnumWithOneMember |
| type_definitions.ts:21:1:21:20 | [TypeAliasDeclaration,TypeDefinition] type Alias = T[]; | semmle.label | [TypeAliasDeclaration,TypeDefinition] type Alias = T[]; |
-| type_definitions.ts:21:1:21:20 | [TypeAliasDeclaration,TypeDefinition] type Alias = T[]; | semmle.order | 119 |
+| type_definitions.ts:21:1:21:20 | [TypeAliasDeclaration,TypeDefinition] type Alias = T[]; | semmle.order | 120 |
| type_definitions.ts:21:6:21:10 | [Identifier] Alias | semmle.label | [Identifier] Alias |
| type_definitions.ts:21:12:21:12 | [Identifier] T | semmle.label | [Identifier] T |
| type_definitions.ts:21:12:21:12 | [TypeParameter] T | semmle.label | [TypeParameter] T |
| type_definitions.ts:21:17:21:17 | [LocalTypeAccess] T | semmle.label | [LocalTypeAccess] T |
| type_definitions.ts:21:17:21:19 | [ArrayTypeExpr] T[] | semmle.label | [ArrayTypeExpr] T[] |
| type_definitions.ts:22:1:22:39 | [DeclStmt] let aliasForNumberArray = ... | semmle.label | [DeclStmt] let aliasForNumberArray = ... |
-| type_definitions.ts:22:1:22:39 | [DeclStmt] let aliasForNumberArray = ... | semmle.order | 120 |
+| type_definitions.ts:22:1:22:39 | [DeclStmt] let aliasForNumberArray = ... | semmle.order | 121 |
| type_definitions.ts:22:5:22:23 | [VarDecl] aliasForNumberArray | semmle.label | [VarDecl] aliasForNumberArray |
| type_definitions.ts:22:5:22:38 | [VariableDeclarator] aliasFo ... number> | semmle.label | [VariableDeclarator] aliasFo ... number> |
| type_definitions.ts:22:26:22:30 | [LocalTypeAccess] Alias | semmle.label | [LocalTypeAccess] Alias |
@@ -2216,6 +2247,10 @@ edges
| file://:0:0:0:0 | (Arguments) | tst.ts:478:17:478:42 | [IndexExpr] SomeCla ... tadata] | semmle.order | 0 |
| file://:0:0:0:0 | (Arguments) | tst.ts:483:17:483:58 | [SatisfiesExpr] ["hello ... string> | semmle.label | 0 |
| file://:0:0:0:0 | (Arguments) | tst.ts:483:17:483:58 | [SatisfiesExpr] ["hello ... string> | semmle.order | 0 |
+| file://:0:0:0:0 | (Arguments) | tst.ts:491:21:491:46 | [ArrayExpr] ["red", ... green"] | semmle.label | 0 |
+| file://:0:0:0:0 | (Arguments) | tst.ts:491:21:491:46 | [ArrayExpr] ["red", ... green"] | semmle.order | 0 |
+| file://:0:0:0:0 | (Arguments) | tst.ts:491:49:491:56 | [Literal] "yellow" | semmle.label | 1 |
+| file://:0:0:0:0 | (Arguments) | tst.ts:491:49:491:56 | [Literal] "yellow" | semmle.order | 1 |
| file://:0:0:0:0 | (Parameters) | tst.ts:14:17:14:17 | [SimpleParameter] x | semmle.label | 0 |
| file://:0:0:0:0 | (Parameters) | tst.ts:14:17:14:17 | [SimpleParameter] x | semmle.order | 0 |
| file://:0:0:0:0 | (Parameters) | tst.ts:14:28:14:28 | [SimpleParameter] y | semmle.label | 1 |
@@ -2314,6 +2349,10 @@ edges
| file://:0:0:0:0 | (Parameters) | tst.ts:474:12:474:18 | [SimpleParameter] _target | semmle.order | 0 |
| file://:0:0:0:0 | (Parameters) | tst.ts:474:21:474:28 | [SimpleParameter] _context | semmle.label | 1 |
| file://:0:0:0:0 | (Parameters) | tst.ts:474:21:474:28 | [SimpleParameter] _context | semmle.order | 1 |
+| file://:0:0:0:0 | (Parameters) | tst.ts:487:48:487:53 | [SimpleParameter] colors | semmle.label | 0 |
+| file://:0:0:0:0 | (Parameters) | tst.ts:487:48:487:53 | [SimpleParameter] colors | semmle.order | 0 |
+| file://:0:0:0:0 | (Parameters) | tst.ts:487:61:487:72 | [SimpleParameter] defaultColor | semmle.label | 1 |
+| file://:0:0:0:0 | (Parameters) | tst.ts:487:61:487:72 | [SimpleParameter] defaultColor | semmle.order | 1 |
| file://:0:0:0:0 | (Parameters) | type_alias.ts:14:10:14:17 | [SimpleParameter] property | semmle.label | 0 |
| file://:0:0:0:0 | (Parameters) | type_alias.ts:14:10:14:17 | [SimpleParameter] property | semmle.order | 0 |
| file://:0:0:0:0 | (Parameters) | type_alias.ts:21:19:21:21 | [SimpleParameter] key | semmle.label | 0 |
@@ -2346,6 +2385,8 @@ edges
| file://:0:0:0:0 | (TypeParameters) | tst.ts:462:40:462:72 | [TypeParameter] const T ... tring[] | semmle.order | 0 |
| file://:0:0:0:0 | (TypeParameters) | tst.ts:481:16:481:16 | [TypeParameter] T | semmle.label | 0 |
| file://:0:0:0:0 | (TypeParameters) | tst.ts:481:16:481:16 | [TypeParameter] T | semmle.order | 0 |
+| file://:0:0:0:0 | (TypeParameters) | tst.ts:487:30:487:45 | [TypeParameter] C extends string | semmle.label | 0 |
+| file://:0:0:0:0 | (TypeParameters) | tst.ts:487:30:487:45 | [TypeParameter] C extends string | semmle.order | 0 |
| file://:0:0:0:0 | (TypeParameters) | type_alias.ts:5:19:5:19 | [TypeParameter] T | semmle.label | 0 |
| file://:0:0:0:0 | (TypeParameters) | type_alias.ts:5:19:5:19 | [TypeParameter] T | semmle.order | 0 |
| file://:0:0:0:0 | (TypeParameters) | type_definitions.ts:3:13:3:13 | [TypeParameter] S | semmle.label | 0 |
@@ -5182,6 +5223,54 @@ edges
| tst.ts:483:46:483:58 | [GenericTypeExpr] Pair3 | tst.ts:483:46:483:50 | [LocalTypeAccess] Pair3 | semmle.order | 1 |
| tst.ts:483:46:483:58 | [GenericTypeExpr] Pair3 | tst.ts:483:52:483:57 | [KeywordTypeExpr] string | semmle.label | 2 |
| tst.ts:483:46:483:58 | [GenericTypeExpr] Pair3 | tst.ts:483:52:483:57 | [KeywordTypeExpr] string | semmle.order | 2 |
+| tst.ts:486:1:492:1 | [NamespaceDeclaration] module ... ow"); } | tst.ts:486:8:486:11 | [VarDecl] TS54 | semmle.label | 1 |
+| tst.ts:486:1:492:1 | [NamespaceDeclaration] module ... ow"); } | tst.ts:486:8:486:11 | [VarDecl] TS54 | semmle.order | 1 |
+| tst.ts:486:1:492:1 | [NamespaceDeclaration] module ... ow"); } | tst.ts:487:3:489:3 | [FunctionDeclStmt] functio ... 0]; } | semmle.label | 2 |
+| tst.ts:486:1:492:1 | [NamespaceDeclaration] module ... ow"); } | tst.ts:487:3:489:3 | [FunctionDeclStmt] functio ... 0]; } | semmle.order | 2 |
+| tst.ts:486:1:492:1 | [NamespaceDeclaration] module ... ow"); } | tst.ts:491:3:491:58 | [ExprStmt] createS ... llow"); | semmle.label | 3 |
+| tst.ts:486:1:492:1 | [NamespaceDeclaration] module ... ow"); } | tst.ts:491:3:491:58 | [ExprStmt] createS ... llow"); | semmle.order | 3 |
+| tst.ts:487:3:489:3 | [FunctionDeclStmt] functio ... 0]; } | file://:0:0:0:0 | (Parameters) | semmle.label | 1 |
+| tst.ts:487:3:489:3 | [FunctionDeclStmt] functio ... 0]; } | file://:0:0:0:0 | (Parameters) | semmle.order | 1 |
+| tst.ts:487:3:489:3 | [FunctionDeclStmt] functio ... 0]; } | file://:0:0:0:0 | (TypeParameters) | semmle.label | 2 |
+| tst.ts:487:3:489:3 | [FunctionDeclStmt] functio ... 0]; } | file://:0:0:0:0 | (TypeParameters) | semmle.order | 2 |
+| tst.ts:487:3:489:3 | [FunctionDeclStmt] functio ... 0]; } | tst.ts:487:12:487:28 | [VarDecl] createStreetLight | semmle.label | 0 |
+| tst.ts:487:3:489:3 | [FunctionDeclStmt] functio ... 0]; } | tst.ts:487:12:487:28 | [VarDecl] createStreetLight | semmle.order | 0 |
+| tst.ts:487:3:489:3 | [FunctionDeclStmt] functio ... 0]; } | tst.ts:487:88:489:3 | [BlockStmt] { r ... 0]; } | semmle.label | 5 |
+| tst.ts:487:3:489:3 | [FunctionDeclStmt] functio ... 0]; } | tst.ts:487:88:489:3 | [BlockStmt] { r ... 0]; } | semmle.order | 5 |
+| tst.ts:487:30:487:45 | [TypeParameter] C extends string | tst.ts:487:30:487:30 | [Identifier] C | semmle.label | 1 |
+| tst.ts:487:30:487:45 | [TypeParameter] C extends string | tst.ts:487:30:487:30 | [Identifier] C | semmle.order | 1 |
+| tst.ts:487:30:487:45 | [TypeParameter] C extends string | tst.ts:487:40:487:45 | [KeywordTypeExpr] string | semmle.label | 2 |
+| tst.ts:487:30:487:45 | [TypeParameter] C extends string | tst.ts:487:40:487:45 | [KeywordTypeExpr] string | semmle.order | 2 |
+| tst.ts:487:48:487:53 | [SimpleParameter] colors | tst.ts:487:56:487:58 | [ArrayTypeExpr] C[] | semmle.label | -2 |
+| tst.ts:487:48:487:53 | [SimpleParameter] colors | tst.ts:487:56:487:58 | [ArrayTypeExpr] C[] | semmle.order | -2 |
+| tst.ts:487:56:487:58 | [ArrayTypeExpr] C[] | tst.ts:487:56:487:56 | [LocalTypeAccess] C | semmle.label | 1 |
+| tst.ts:487:56:487:58 | [ArrayTypeExpr] C[] | tst.ts:487:56:487:56 | [LocalTypeAccess] C | semmle.order | 1 |
+| tst.ts:487:61:487:72 | [SimpleParameter] defaultColor | tst.ts:487:76:487:85 | [GenericTypeExpr] NoInfer | semmle.label | -2 |
+| tst.ts:487:61:487:72 | [SimpleParameter] defaultColor | tst.ts:487:76:487:85 | [GenericTypeExpr] NoInfer | semmle.order | -2 |
+| tst.ts:487:76:487:85 | [GenericTypeExpr] NoInfer | tst.ts:487:76:487:82 | [LocalTypeAccess] NoInfer | semmle.label | 1 |
+| tst.ts:487:76:487:85 | [GenericTypeExpr] NoInfer | tst.ts:487:76:487:82 | [LocalTypeAccess] NoInfer | semmle.order | 1 |
+| tst.ts:487:76:487:85 | [GenericTypeExpr] NoInfer | tst.ts:487:84:487:84 | [LocalTypeAccess] C | semmle.label | 2 |
+| tst.ts:487:76:487:85 | [GenericTypeExpr] NoInfer | tst.ts:487:84:487:84 | [LocalTypeAccess] C | semmle.order | 2 |
+| tst.ts:487:88:489:3 | [BlockStmt] { r ... 0]; } | tst.ts:488:5:488:21 | [ReturnStmt] return colors[0]; | semmle.label | 1 |
+| tst.ts:487:88:489:3 | [BlockStmt] { r ... 0]; } | tst.ts:488:5:488:21 | [ReturnStmt] return colors[0]; | semmle.order | 1 |
+| tst.ts:488:5:488:21 | [ReturnStmt] return colors[0]; | tst.ts:488:12:488:20 | [IndexExpr] colors[0] | semmle.label | 1 |
+| tst.ts:488:5:488:21 | [ReturnStmt] return colors[0]; | tst.ts:488:12:488:20 | [IndexExpr] colors[0] | semmle.order | 1 |
+| tst.ts:488:12:488:20 | [IndexExpr] colors[0] | tst.ts:488:12:488:17 | [VarRef] colors | semmle.label | 1 |
+| tst.ts:488:12:488:20 | [IndexExpr] colors[0] | tst.ts:488:12:488:17 | [VarRef] colors | semmle.order | 1 |
+| tst.ts:488:12:488:20 | [IndexExpr] colors[0] | tst.ts:488:19:488:19 | [Literal] 0 | semmle.label | 2 |
+| tst.ts:488:12:488:20 | [IndexExpr] colors[0] | tst.ts:488:19:488:19 | [Literal] 0 | semmle.order | 2 |
+| tst.ts:491:3:491:57 | [CallExpr] createS ... ellow") | file://:0:0:0:0 | (Arguments) | semmle.label | 1 |
+| tst.ts:491:3:491:57 | [CallExpr] createS ... ellow") | file://:0:0:0:0 | (Arguments) | semmle.order | 1 |
+| tst.ts:491:3:491:57 | [CallExpr] createS ... ellow") | tst.ts:491:3:491:19 | [VarRef] createStreetLight | semmle.label | 0 |
+| tst.ts:491:3:491:57 | [CallExpr] createS ... ellow") | tst.ts:491:3:491:19 | [VarRef] createStreetLight | semmle.order | 0 |
+| tst.ts:491:3:491:58 | [ExprStmt] createS ... llow"); | tst.ts:491:3:491:57 | [CallExpr] createS ... ellow") | semmle.label | 1 |
+| tst.ts:491:3:491:58 | [ExprStmt] createS ... llow"); | tst.ts:491:3:491:57 | [CallExpr] createS ... ellow") | semmle.order | 1 |
+| tst.ts:491:21:491:46 | [ArrayExpr] ["red", ... green"] | tst.ts:491:22:491:26 | [Literal] "red" | semmle.label | 1 |
+| tst.ts:491:21:491:46 | [ArrayExpr] ["red", ... green"] | tst.ts:491:22:491:26 | [Literal] "red" | semmle.order | 1 |
+| tst.ts:491:21:491:46 | [ArrayExpr] ["red", ... green"] | tst.ts:491:29:491:36 | [Literal] "yellow" | semmle.label | 2 |
+| tst.ts:491:21:491:46 | [ArrayExpr] ["red", ... green"] | tst.ts:491:29:491:36 | [Literal] "yellow" | semmle.order | 2 |
+| tst.ts:491:21:491:46 | [ArrayExpr] ["red", ... green"] | tst.ts:491:39:491:45 | [Literal] "green" | semmle.label | 3 |
+| tst.ts:491:21:491:46 | [ArrayExpr] ["red", ... green"] | tst.ts:491:39:491:45 | [Literal] "green" | semmle.order | 3 |
| tstModuleCJS.cts:1:1:3:1 | [ExportDeclaration] export ... 'b'; } | tstModuleCJS.cts:1:8:3:1 | [FunctionDeclStmt] functio ... 'b'; } | semmle.label | 1 |
| tstModuleCJS.cts:1:1:3:1 | [ExportDeclaration] export ... 'b'; } | tstModuleCJS.cts:1:8:3:1 | [FunctionDeclStmt] functio ... 'b'; } | semmle.order | 1 |
| tstModuleCJS.cts:1:8:3:1 | [FunctionDeclStmt] functio ... 'b'; } | tstModuleCJS.cts:1:17:1:28 | [VarDecl] tstModuleCJS | semmle.label | 0 |
diff --git a/javascript/ql/test/library-tests/TypeScript/Types/tests.expected b/javascript/ql/test/library-tests/TypeScript/Types/tests.expected
index 986ae56a6646..49a1f1e000f3 100644
--- a/javascript/ql/test/library-tests/TypeScript/Types/tests.expected
+++ b/javascript/ql/test/library-tests/TypeScript/Types/tests.expected
@@ -658,6 +658,17 @@ getExprType
| tst.ts:483:17:483:58 | ["hello ... string> | [first: string, string] |
| tst.ts:483:18:483:24 | "hello" | "hello" |
| tst.ts:483:27:483:33 | "world" | "world" |
+| tst.ts:486:8:486:11 | TS54 | typeof TS54 in library-tests/TypeScript/Types/tst.ts |
+| tst.ts:487:48:487:53 | colors | C[] |
+| tst.ts:488:12:488:17 | colors | C[] |
+| tst.ts:488:12:488:20 | colors[0] | C |
+| tst.ts:488:19:488:19 | 0 | 0 |
+| tst.ts:491:3:491:57 | createS ... ellow") | "red" \| "green" \| "yellow" |
+| tst.ts:491:21:491:46 | ["red", ... green"] | ("red" \| "green" \| "yellow")[] |
+| tst.ts:491:22:491:26 | "red" | "red" |
+| tst.ts:491:29:491:36 | "yellow" | "yellow" |
+| tst.ts:491:39:491:45 | "green" | "green" |
+| tst.ts:491:49:491:56 | "yellow" | "yellow" |
| tstModuleCJS.cts:1:17:1:28 | tstModuleCJS | () => "a" \| "b" |
| tstModuleCJS.cts:2:12:2:15 | Math | Math |
| tstModuleCJS.cts:2:12:2:22 | Math.random | () => number |
@@ -1138,6 +1149,12 @@ getTypeExprType
| tst.ts:483:46:483:50 | Pair3 | Pair3 |
| tst.ts:483:46:483:58 | Pair3 | Pair3 |
| tst.ts:483:52:483:57 | string | string |
+| tst.ts:487:30:487:30 | C | C |
+| tst.ts:487:40:487:45 | string | string |
+| tst.ts:487:56:487:56 | C | C |
+| tst.ts:487:56:487:58 | C[] | C[] |
+| tst.ts:487:76:487:82 | NoInfer | any |
+| tst.ts:487:84:487:84 | C | C |
| tstModuleCJS.cts:1:33:1:35 | 'a' | "a" |
| tstModuleCJS.cts:1:33:1:41 | 'a' \| 'b' | "a" \| "b" |
| tstModuleCJS.cts:1:39:1:41 | 'b' | "b" |
@@ -1359,16 +1376,19 @@ unionIndex
| "circle" | 0 | "circle" \| "square" |
| "function" | 7 | "string" \| "number" \| "bigint" \| "boolean" \| "s... |
| "green" | 1 | "red" \| "green" \| "blue" |
+| "green" | 1 | "red" \| "green" \| "yellow" |
| "hello" | 0 | "hello" \| 42 |
| "number" | 1 | "string" \| "number" \| "bigint" \| "boolean" \| "s... |
| "number" | 1 | keyof TypeMap |
| "object" | 6 | "string" \| "number" \| "bigint" \| "boolean" \| "s... |
| "red" | 0 | "red" \| "green" \| "blue" |
+| "red" | 0 | "red" \| "green" \| "yellow" |
| "square" | 1 | "circle" \| "square" |
| "string" | 0 | "string" \| "number" \| "bigint" \| "boolean" \| "s... |
| "string" | 0 | keyof TypeMap |
| "symbol" | 4 | "string" \| "number" \| "bigint" \| "boolean" \| "s... |
| "undefined" | 5 | "string" \| "number" \| "bigint" \| "boolean" \| "s... |
+| "yellow" | 2 | "red" \| "green" \| "yellow" |
| () => number | 0 | (() => number) \| (ClassMethodDecoratorContext number | 1 | void \| (() => number) |
| ClassMethodDecoratorContext numbe... | 1 | (() => number) \| (ClassMethodDecoratorContext = [first: T, T];
console.log(["hello", "world"] satisfies Pair3);
+}
+
+module TS54 {
+ function createStreetLight(colors: C[], defaultColor?: NoInfer) {
+ return colors[0];
+ }
+
+ createStreetLight(["red", "yellow", "green"], "yellow");
}
\ No newline at end of file
From f433039a2514cc03e6129f6496dc43a4bfad0ce8 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen
Date: Fri, 2 Feb 2024 11:23:35 +0100
Subject: [PATCH 002/731] Add change note
---
javascript/ql/lib/change-notes/2024-02-02-typescript-5-4.md | 4 ++++
1 file changed, 4 insertions(+)
create mode 100644 javascript/ql/lib/change-notes/2024-02-02-typescript-5-4.md
diff --git a/javascript/ql/lib/change-notes/2024-02-02-typescript-5-4.md b/javascript/ql/lib/change-notes/2024-02-02-typescript-5-4.md
new file mode 100644
index 000000000000..836719b5d6bf
--- /dev/null
+++ b/javascript/ql/lib/change-notes/2024-02-02-typescript-5-4.md
@@ -0,0 +1,4 @@
+---
+category: majorAnalysis
+---
+* Added support for TypeScript 5.4.
\ No newline at end of file
From 3b1751dc8a6716d9a8bb9eecda2475c1f4b2408e Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen
Date: Fri, 2 Feb 2024 11:45:21 +0100
Subject: [PATCH 003/731] Update supported versions
---
docs/codeql/reusables/supported-versions-compilers.rst | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/docs/codeql/reusables/supported-versions-compilers.rst b/docs/codeql/reusables/supported-versions-compilers.rst
index cb9ee322a04d..525fe7730a88 100644
--- a/docs/codeql/reusables/supported-versions-compilers.rst
+++ b/docs/codeql/reusables/supported-versions-compilers.rst
@@ -25,7 +25,7 @@
Python [9]_,"2.7, 3.5, 3.6, 3.7, 3.8, 3.9, 3.10, 3.11, 3.12",Not applicable,``.py``
Ruby [10]_,"up to 3.3",Not applicable,"``.rb``, ``.erb``, ``.gemspec``, ``Gemfile``"
Swift [11]_,"Swift 5.4-5.9.1","Swift compiler","``.swift``"
- TypeScript [12]_,"2.6-5.3",Standard TypeScript compiler,"``.ts``, ``.tsx``, ``.mts``, ``.cts``"
+ TypeScript [12]_,"2.6-5.4",Standard TypeScript compiler,"``.ts``, ``.tsx``, ``.mts``, ``.cts``"
.. container:: footnote-group
From 45bb4a0ee5344ec101618301bec112bbecfa242c Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen
Date: Thu, 8 Feb 2024 12:48:15 +0100
Subject: [PATCH 004/731] python: remove `TaintStepFromSummary` as it should be
covered by `SummarizedCallableFromModel`
Also move things around, to look more like the Ruby code.
---
.../python/dataflow/new/FlowSummary.qll | 31 +-------------
.../python/frameworks/data/ModelsAsData.qll | 41 ++++++++++++-------
2 files changed, 27 insertions(+), 45 deletions(-)
diff --git a/python/ql/lib/semmle/python/dataflow/new/FlowSummary.qll b/python/ql/lib/semmle/python/dataflow/new/FlowSummary.qll
index 800c9592dcc2..9c3033e61267 100644
--- a/python/ql/lib/semmle/python/dataflow/new/FlowSummary.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/FlowSummary.qll
@@ -2,7 +2,6 @@
private import python
private import semmle.python.dataflow.new.DataFlow
-private import semmle.python.frameworks.data.ModelsAsData
private import semmle.python.ApiGraphs
private import internal.FlowSummaryImpl as Impl
private import internal.DataFlowUtil
@@ -11,6 +10,7 @@ private import internal.DataFlowPrivate
// import all instances below
private module Summaries {
private import semmle.python.Frameworks
+ private import semmle.python.frameworks.data.ModelsAsData
}
deprecated class SummaryComponent = Impl::Private::SummaryComponent;
@@ -36,32 +36,3 @@ abstract class SummarizedCallable extends LibraryCallable, Impl::Public::Summari
}
deprecated class RequiredSummaryComponentStack = Impl::Private::RequiredSummaryComponentStack;
-
-private class SummarizedCallableFromModel extends SummarizedCallable {
- string type;
- string path;
-
- SummarizedCallableFromModel() {
- ModelOutput::relevantSummaryModel(type, path, _, _, _) and
- this = type + ";" + path
- }
-
- override CallCfgNode getACall() { ModelOutput::resolvedSummaryBase(type, path, result) }
-
- override ArgumentNode getACallback() {
- exists(API::Node base |
- ModelOutput::resolvedSummaryRefBase(type, path, base) and
- result = base.getAValueReachableFromSource()
- )
- }
-
- override predicate propagatesFlow(string input, string output, boolean preservesValue) {
- exists(string kind | ModelOutput::relevantSummaryModel(type, path, input, output, kind) |
- kind = "value" and
- preservesValue = true
- or
- kind = "taint" and
- preservesValue = false
- )
- }
-}
diff --git a/python/ql/lib/semmle/python/frameworks/data/ModelsAsData.qll b/python/ql/lib/semmle/python/frameworks/data/ModelsAsData.qll
index f8d7ae75ad02..34e484392716 100644
--- a/python/ql/lib/semmle/python/frameworks/data/ModelsAsData.qll
+++ b/python/ql/lib/semmle/python/frameworks/data/ModelsAsData.qll
@@ -17,7 +17,7 @@ import Shared::ModelOutput as ModelOutput
private import semmle.python.dataflow.new.RemoteFlowSources
private import semmle.python.dataflow.new.DataFlow
private import semmle.python.ApiGraphs
-private import semmle.python.dataflow.new.TaintTracking
+private import semmle.python.dataflow.new.FlowSummary
/**
* A remote flow source originating from a CSV source row.
@@ -28,20 +28,31 @@ private class RemoteFlowSourceFromCsv extends RemoteFlowSource {
override string getSourceType() { result = "Remote flow (from model)" }
}
-/**
- * Like `ModelOutput::summaryStep` but with API nodes mapped to data-flow nodes.
- */
-private predicate summaryStepNodes(DataFlow::Node pred, DataFlow::Node succ, string kind) {
- exists(API::Node predNode, API::Node succNode |
- Specific::summaryStep(predNode, succNode, kind) and
- pred = predNode.asSink() and
- succ = succNode.asSource()
- )
-}
+private class SummarizedCallableFromModel extends SummarizedCallable {
+ string type;
+ string path;
+
+ SummarizedCallableFromModel() {
+ ModelOutput::relevantSummaryModel(type, path, _, _, _) and
+ this = type + ";" + path
+ }
+
+ override DataFlow::CallCfgNode getACall() { ModelOutput::resolvedSummaryBase(type, path, result) }
+
+ override DataFlow::ArgumentNode getACallback() {
+ exists(API::Node base |
+ ModelOutput::resolvedSummaryRefBase(type, path, base) and
+ result = base.getAValueReachableFromSource()
+ )
+ }
-/** Taint steps induced by summary models of kind `taint`. */
-private class TaintStepFromSummary extends TaintTracking::AdditionalTaintStep {
- override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
- summaryStepNodes(pred, succ, "taint")
+ override predicate propagatesFlow(string input, string output, boolean preservesValue) {
+ exists(string kind | ModelOutput::relevantSummaryModel(type, path, input, output, kind) |
+ kind = "value" and
+ preservesValue = true
+ or
+ kind = "taint" and
+ preservesValue = false
+ )
}
}
From 580e68d5de4740a2d7ce7d1af38dfe814a853a7a Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen
Date: Fri, 9 Feb 2024 13:51:16 +0100
Subject: [PATCH 005/731] python: add support for lower bound position
---
.../dataflow/new/internal/DataFlowDispatch.qll | 16 ++++++++++++++++
.../dataflow/new/internal/FlowSummaryImpl.qll | 5 +++++
2 files changed, 21 insertions(+)
diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowDispatch.qll b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowDispatch.qll
index 87a278e0f6bc..9bf0ec960845 100644
--- a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowDispatch.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowDispatch.qll
@@ -57,6 +57,9 @@ newtype TParameterPosition =
// parameter positions available.
FlowSummaryImpl::ParsePositions::isParsedPositionalArgumentPosition(_, index)
} or
+ TPositionalParameterLowerBoundPosition(int pos) {
+ FlowSummaryImpl::ParsePositions::isParsedArgumentLowerBoundPosition(_, pos)
+ } or
TKeywordParameterPosition(string name) {
name = any(Parameter p).getName()
or
@@ -91,6 +94,9 @@ class ParameterPosition extends TParameterPosition {
/** Holds if this position represents a positional parameter at (0-based) `index`. */
predicate isPositional(int index) { this = TPositionalParameterPosition(index) }
+ /** Holds if this position represents any positional parameter starting from position `pos`. */
+ predicate isPositionalLowerBound(int pos) { this = TPositionalParameterLowerBoundPosition(pos) }
+
/** Holds if this position represents a keyword parameter named `name`. */
predicate isKeyword(string name) { this = TKeywordParameterPosition(name) }
@@ -123,6 +129,8 @@ class ParameterPosition extends TParameterPosition {
or
exists(int index | this.isPositional(index) and result = "position " + index)
or
+ exists(int pos | this.isPositionalLowerBound(pos) and result = "position " + pos + "..")
+ or
exists(string name | this.isKeyword(name) and result = "keyword " + name)
or
exists(int index | this.isStarArgs(index) and result = "*args at " + index)
@@ -211,6 +219,10 @@ predicate parameterMatch(ParameterPosition ppos, ArgumentPosition apos) {
or
exists(int index | ppos.isPositional(index) and apos.isPositional(index))
or
+ exists(int index1, int index2 |
+ ppos.isPositionalLowerBound(index1) and apos.isPositional(index2) and index2 >= index1
+ )
+ or
exists(string name | ppos.isKeyword(name) and apos.isKeyword(name))
or
exists(int index | ppos.isStarArgs(index) and apos.isStarArgs(index))
@@ -360,6 +372,10 @@ abstract class DataFlowFunction extends DataFlowCallable, TFunction {
result.getParameter() = func.getArg(index + this.positionalOffset())
)
or
+ exists(int index1, int index2 | ppos.isPositionalLowerBound(index1) and index2 >= index1 |
+ result.getParameter() = func.getArg(index2 + this.positionalOffset())
+ )
+ or
exists(string name | ppos.isKeyword(name) | result.getParameter() = func.getArgByName(name))
or
// `*args`
diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/FlowSummaryImpl.qll b/python/ql/lib/semmle/python/dataflow/new/internal/FlowSummaryImpl.qll
index 4a55d38edb6c..a673a1881334 100644
--- a/python/ql/lib/semmle/python/dataflow/new/internal/FlowSummaryImpl.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/FlowSummaryImpl.qll
@@ -195,6 +195,11 @@ module ParsePositions {
i = AccessPath::parseInt(c)
}
+ predicate isParsedArgumentLowerBoundPosition(string c, int i) {
+ isArgBody(c) and
+ i = AccessPath::parseLowerBound(c)
+ }
+
predicate isParsedKeywordArgumentPosition(string c, string argName) {
isArgBody(c) and
c = argName + ":"
From 5125973f9b257f37ff49f1f236b89badddf563ce Mon Sep 17 00:00:00 2001
From: Taus
Date: Thu, 22 Feb 2024 13:01:03 +0000
Subject: [PATCH 006/731] Python: Add test case for `.copy()` as a copy step
---
.../ModificationOfParameterWithDefault.expected | 10 ++++++++++
.../ModificationOfParameterWithDefault/test.py | 6 ++++++
2 files changed, 16 insertions(+)
diff --git a/python/ql/test/query-tests/Functions/ModificationOfParameterWithDefault/ModificationOfParameterWithDefault.expected b/python/ql/test/query-tests/Functions/ModificationOfParameterWithDefault/ModificationOfParameterWithDefault.expected
index 2bed4495c438..82bc41d780c9 100644
--- a/python/ql/test/query-tests/Functions/ModificationOfParameterWithDefault/ModificationOfParameterWithDefault.expected
+++ b/python/ql/test/query-tests/Functions/ModificationOfParameterWithDefault/ModificationOfParameterWithDefault.expected
@@ -40,6 +40,10 @@ edges
| test.py:195:28:195:28 | ControlFlowNode for x | test.py:181:28:181:28 | ControlFlowNode for x | provenance | |
| test.py:197:18:197:18 | ControlFlowNode for x | test.py:198:28:198:28 | ControlFlowNode for x | provenance | |
| test.py:198:28:198:28 | ControlFlowNode for x | test.py:181:28:181:28 | ControlFlowNode for x | provenance | |
+| test.py:222:26:222:26 | ControlFlowNode for x | test.py:223:9:223:9 | ControlFlowNode for x | provenance | |
+| test.py:223:5:223:5 | ControlFlowNode for y | test.py:224:5:224:5 | ControlFlowNode for y | provenance | |
+| test.py:223:9:223:9 | ControlFlowNode for x | test.py:223:9:223:16 | ControlFlowNode for Attribute() | provenance | |
+| test.py:223:9:223:16 | ControlFlowNode for Attribute() | test.py:223:5:223:5 | ControlFlowNode for y | provenance | |
nodes
| test.py:2:12:2:12 | ControlFlowNode for l | semmle.label | ControlFlowNode for l |
| test.py:3:5:3:5 | ControlFlowNode for l | semmle.label | ControlFlowNode for l |
@@ -107,6 +111,11 @@ nodes
| test.py:195:28:195:28 | ControlFlowNode for x | semmle.label | ControlFlowNode for x |
| test.py:197:18:197:18 | ControlFlowNode for x | semmle.label | ControlFlowNode for x |
| test.py:198:28:198:28 | ControlFlowNode for x | semmle.label | ControlFlowNode for x |
+| test.py:222:26:222:26 | ControlFlowNode for x | semmle.label | ControlFlowNode for x |
+| test.py:223:5:223:5 | ControlFlowNode for y | semmle.label | ControlFlowNode for y |
+| test.py:223:9:223:9 | ControlFlowNode for x | semmle.label | ControlFlowNode for x |
+| test.py:223:9:223:16 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
+| test.py:224:5:224:5 | ControlFlowNode for y | semmle.label | ControlFlowNode for y |
subpaths
#select
| test.py:3:5:3:5 | ControlFlowNode for l | test.py:2:12:2:12 | ControlFlowNode for l | test.py:3:5:3:5 | ControlFlowNode for l | This expression mutates a $@. | test.py:2:12:2:12 | ControlFlowNode for l | default value |
@@ -138,3 +147,4 @@ subpaths
| test.py:185:9:185:9 | ControlFlowNode for x | test.py:197:18:197:18 | ControlFlowNode for x | test.py:185:9:185:9 | ControlFlowNode for x | This expression mutates a $@. | test.py:197:18:197:18 | ControlFlowNode for x | default value |
| test.py:187:9:187:9 | ControlFlowNode for x | test.py:194:18:194:18 | ControlFlowNode for x | test.py:187:9:187:9 | ControlFlowNode for x | This expression mutates a $@. | test.py:194:18:194:18 | ControlFlowNode for x | default value |
| test.py:187:9:187:9 | ControlFlowNode for x | test.py:197:18:197:18 | ControlFlowNode for x | test.py:187:9:187:9 | ControlFlowNode for x | This expression mutates a $@. | test.py:197:18:197:18 | ControlFlowNode for x | default value |
+| test.py:224:5:224:5 | ControlFlowNode for y | test.py:222:26:222:26 | ControlFlowNode for x | test.py:224:5:224:5 | ControlFlowNode for y | This expression mutates a $@. | test.py:222:26:222:26 | ControlFlowNode for x | default value |
diff --git a/python/ql/test/query-tests/Functions/ModificationOfParameterWithDefault/test.py b/python/ql/test/query-tests/Functions/ModificationOfParameterWithDefault/test.py
index b67fa985f513..a79ca3d78878 100644
--- a/python/ql/test/query-tests/Functions/ModificationOfParameterWithDefault/test.py
+++ b/python/ql/test/query-tests/Functions/ModificationOfParameterWithDefault/test.py
@@ -216,3 +216,9 @@ def flow_from_within_deepcopy_fp():
def flow_through_deepcopy_fp(x=[]):
y = deepcopy(x)
y.append(1)
+
+# Use of copy method:
+
+def flow_through_copy_fp(x=[]):
+ y = x.copy()
+ y.append(1) #$ SPURIOUS: modification=y
From f1392712ee9ae31d69facdd2c00b990208afdc1f Mon Sep 17 00:00:00 2001
From: Taus
Date: Thu, 22 Feb 2024 13:09:27 +0000
Subject: [PATCH 007/731] Python: Add `.copy()` as a copy step
---
.../dataflow/new/internal/TaintTrackingPrivate.qll | 2 ++
.../ModificationOfParameterWithDefault.expected | 10 ----------
.../ModificationOfParameterWithDefault/test.py | 2 +-
3 files changed, 3 insertions(+), 11 deletions(-)
diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/TaintTrackingPrivate.qll b/python/ql/lib/semmle/python/dataflow/new/internal/TaintTrackingPrivate.qll
index 1841001c2f81..6eab2f48885c 100644
--- a/python/ql/lib/semmle/python/dataflow/new/internal/TaintTrackingPrivate.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/TaintTrackingPrivate.qll
@@ -195,6 +195,8 @@ predicate copyStep(DataFlow::CfgNode nodeFrom, DataFlow::CfgNode nodeTo) {
call = API::moduleImport("copy").getMember(["copy", "deepcopy"]).getACall() and
call.getArg(0) = nodeFrom
)
+ or
+ nodeTo.(DataFlow::MethodCallNode).calls(nodeFrom, "copy")
}
/**
diff --git a/python/ql/test/query-tests/Functions/ModificationOfParameterWithDefault/ModificationOfParameterWithDefault.expected b/python/ql/test/query-tests/Functions/ModificationOfParameterWithDefault/ModificationOfParameterWithDefault.expected
index 82bc41d780c9..2bed4495c438 100644
--- a/python/ql/test/query-tests/Functions/ModificationOfParameterWithDefault/ModificationOfParameterWithDefault.expected
+++ b/python/ql/test/query-tests/Functions/ModificationOfParameterWithDefault/ModificationOfParameterWithDefault.expected
@@ -40,10 +40,6 @@ edges
| test.py:195:28:195:28 | ControlFlowNode for x | test.py:181:28:181:28 | ControlFlowNode for x | provenance | |
| test.py:197:18:197:18 | ControlFlowNode for x | test.py:198:28:198:28 | ControlFlowNode for x | provenance | |
| test.py:198:28:198:28 | ControlFlowNode for x | test.py:181:28:181:28 | ControlFlowNode for x | provenance | |
-| test.py:222:26:222:26 | ControlFlowNode for x | test.py:223:9:223:9 | ControlFlowNode for x | provenance | |
-| test.py:223:5:223:5 | ControlFlowNode for y | test.py:224:5:224:5 | ControlFlowNode for y | provenance | |
-| test.py:223:9:223:9 | ControlFlowNode for x | test.py:223:9:223:16 | ControlFlowNode for Attribute() | provenance | |
-| test.py:223:9:223:16 | ControlFlowNode for Attribute() | test.py:223:5:223:5 | ControlFlowNode for y | provenance | |
nodes
| test.py:2:12:2:12 | ControlFlowNode for l | semmle.label | ControlFlowNode for l |
| test.py:3:5:3:5 | ControlFlowNode for l | semmle.label | ControlFlowNode for l |
@@ -111,11 +107,6 @@ nodes
| test.py:195:28:195:28 | ControlFlowNode for x | semmle.label | ControlFlowNode for x |
| test.py:197:18:197:18 | ControlFlowNode for x | semmle.label | ControlFlowNode for x |
| test.py:198:28:198:28 | ControlFlowNode for x | semmle.label | ControlFlowNode for x |
-| test.py:222:26:222:26 | ControlFlowNode for x | semmle.label | ControlFlowNode for x |
-| test.py:223:5:223:5 | ControlFlowNode for y | semmle.label | ControlFlowNode for y |
-| test.py:223:9:223:9 | ControlFlowNode for x | semmle.label | ControlFlowNode for x |
-| test.py:223:9:223:16 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
-| test.py:224:5:224:5 | ControlFlowNode for y | semmle.label | ControlFlowNode for y |
subpaths
#select
| test.py:3:5:3:5 | ControlFlowNode for l | test.py:2:12:2:12 | ControlFlowNode for l | test.py:3:5:3:5 | ControlFlowNode for l | This expression mutates a $@. | test.py:2:12:2:12 | ControlFlowNode for l | default value |
@@ -147,4 +138,3 @@ subpaths
| test.py:185:9:185:9 | ControlFlowNode for x | test.py:197:18:197:18 | ControlFlowNode for x | test.py:185:9:185:9 | ControlFlowNode for x | This expression mutates a $@. | test.py:197:18:197:18 | ControlFlowNode for x | default value |
| test.py:187:9:187:9 | ControlFlowNode for x | test.py:194:18:194:18 | ControlFlowNode for x | test.py:187:9:187:9 | ControlFlowNode for x | This expression mutates a $@. | test.py:194:18:194:18 | ControlFlowNode for x | default value |
| test.py:187:9:187:9 | ControlFlowNode for x | test.py:197:18:197:18 | ControlFlowNode for x | test.py:187:9:187:9 | ControlFlowNode for x | This expression mutates a $@. | test.py:197:18:197:18 | ControlFlowNode for x | default value |
-| test.py:224:5:224:5 | ControlFlowNode for y | test.py:222:26:222:26 | ControlFlowNode for x | test.py:224:5:224:5 | ControlFlowNode for y | This expression mutates a $@. | test.py:222:26:222:26 | ControlFlowNode for x | default value |
diff --git a/python/ql/test/query-tests/Functions/ModificationOfParameterWithDefault/test.py b/python/ql/test/query-tests/Functions/ModificationOfParameterWithDefault/test.py
index a79ca3d78878..ca7bb71d760e 100644
--- a/python/ql/test/query-tests/Functions/ModificationOfParameterWithDefault/test.py
+++ b/python/ql/test/query-tests/Functions/ModificationOfParameterWithDefault/test.py
@@ -221,4 +221,4 @@ def flow_through_deepcopy_fp(x=[]):
def flow_through_copy_fp(x=[]):
y = x.copy()
- y.append(1) #$ SPURIOUS: modification=y
+ y.append(1)
From 49d826f6674d9ce8dea47af920888028dd6e715c Mon Sep 17 00:00:00 2001
From: Harry Maclean
Date: Mon, 25 Sep 2023 11:48:27 +0100
Subject: [PATCH 008/731] Ruby: Add a query for CSRF protection not enabled
Specifically in Rails apps, we look for root ActionController classes
without a call to `protect_from_forgery`.
---
.../ruby/frameworks/ActionController.qll | 80 +++++++++++--------
.../cwe-352/CSRFProtectionNotEnabled.qhelp | 65 +++++++++++++++
.../cwe-352/CSRFProtectionNotEnabled.ql | 23 ++++++
.../examples/ProtectFromForgeryGood.rb | 4 +
.../cwe-352/CSRFProtectionNotEnabled.expected | 1 +
.../cwe-352/CSRFProtectionNotEnabled.qlref | 1 +
.../alternative_root_controller.rb | 3 +
7 files changed, 144 insertions(+), 33 deletions(-)
create mode 100644 ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.qhelp
create mode 100644 ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.ql
create mode 100644 ruby/ql/src/queries/security/cwe-352/examples/ProtectFromForgeryGood.rb
create mode 100644 ruby/ql/test/query-tests/security/cwe-352/CSRFProtectionNotEnabled.expected
create mode 100644 ruby/ql/test/query-tests/security/cwe-352/CSRFProtectionNotEnabled.qlref
create mode 100644 ruby/ql/test/query-tests/security/cwe-352/railsapp/app/controllers/alternative_root_controller.rb
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll b/ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll
index be1df5066e1d..5500eca06079 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll
@@ -21,6 +21,35 @@ private import codeql.ruby.dataflow.internal.DataFlowDispatch
module ActionController {
// TODO: move the rest of this file inside this module.
import codeql.ruby.frameworks.actioncontroller.Filters
+
+ /**
+ * An ActionController class which sits at the top of the class hierarchy.
+ * In other words, it does not subclass any other class in source code.
+ */
+ class RootController extends ActionControllerClass {
+ RootController() {
+ not exists(ActionControllerClass parent | this != parent and this = parent.getADescendent())
+ }
+ }
+
+ /**
+ * A call to `protect_from_forgery`.
+ */
+ class ProtectFromForgeryCall extends CsrfProtectionSetting::Range, DataFlow::CallNode {
+ ProtectFromForgeryCall() {
+ this = actionControllerInstance().getAMethodCall("protect_from_forgery")
+ }
+
+ private string getWithValueText() {
+ result = this.getKeywordArgument("with").getConstantValue().getSymbol()
+ }
+
+ // Calls without `with: :exception` can allow for bypassing CSRF protection
+ // in some scenarios.
+ override boolean getVerificationSetting() {
+ if this.getWithValueText() = "exception" then result = true else result = false
+ }
+ }
}
/**
@@ -38,18 +67,10 @@ module ActionController {
*/
class ActionControllerClass extends DataFlow::ClassNode {
ActionControllerClass() {
- this =
- [
- DataFlow::getConstant("ActionController").getConstant("Base"),
- // In Rails applications `ApplicationController` typically extends `ActionController::Base`, but we
- // treat it separately in case the `ApplicationController` definition is not in the database.
- DataFlow::getConstant("ApplicationController"),
- // ActionController::Metal technically doesn't contain all of the
- // methods available in Base, such as those for rendering views.
- // However we prefer to be over-sensitive in this case in order to find
- // more results.
- DataFlow::getConstant("ActionController").getConstant("Metal")
- ].getADescendentModule()
+ this = DataFlow::getConstant("ApplicationController").getADescendentModule()
+ or
+ this = actionControllerBaseClass().getADescendentModule() and
+ not exists(DataFlow::ModuleNode m | m = actionControllerBaseClass().asModule() | this = m)
}
/**
@@ -73,6 +94,20 @@ class ActionControllerClass extends DataFlow::ClassNode {
}
}
+private DataFlow::ConstRef actionControllerBaseClass() {
+ result =
+ [
+ // In Rails applications `ApplicationController` typically extends `ActionController::Base`, but we
+ // treat it separately in case the `ApplicationController` definition is not in the database.
+ DataFlow::getConstant("ActionController").getConstant("Base"),
+ // ActionController::Metal technically doesn't contain all of the
+ // methods available in Base, such as those for rendering views.
+ // However we prefer to be over-sensitive in this case in order to find
+ // more results.
+ DataFlow::getConstant("ActionController").getConstant("Metal")
+ ]
+}
+
private API::Node actionControllerInstance() {
result = any(ActionControllerClass cls).getSelf().track()
}
@@ -406,27 +441,6 @@ class ActionControllerSkipForgeryProtectionCall extends CsrfProtectionSetting::R
override boolean getVerificationSetting() { result = false }
}
-/**
- * A call to `protect_from_forgery`.
- */
-private class ActionControllerProtectFromForgeryCall extends CsrfProtectionSetting::Range,
- DataFlow::CallNode
-{
- ActionControllerProtectFromForgeryCall() {
- this = actionControllerInstance().getAMethodCall("protect_from_forgery")
- }
-
- private string getWithValueText() {
- result = this.getKeywordArgument("with").getConstantValue().getSymbol()
- }
-
- // Calls without `with: :exception` can allow for bypassing CSRF protection
- // in some scenarios.
- override boolean getVerificationSetting() {
- if this.getWithValueText() = "exception" then result = true else result = false
- }
-}
-
/**
* A call to `send_file`, which sends the file at the given path to the client.
*/
diff --git a/ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.qhelp b/ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.qhelp
new file mode 100644
index 000000000000..9b8944b1d65c
--- /dev/null
+++ b/ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.qhelp
@@ -0,0 +1,65 @@
+
+
+
+
+
+ Cross-site request forgery (CSRF) is a type of vulnerability in which an
+ attacker is able to force a user to carry out an action that the user did
+ not intend.
+
+
+
+ The attacker tricks an authenticated user into submitting a request to the
+ web application. Typically this request will result in a state change on
+ the server, such as changing the user's password. The request can be
+ initiated when the user visits a site controlled by the attacker. If the
+ web application relies only on cookies for authentication, or on other
+ credentials that are automatically included in the request, then this
+ request will appear as legitimate to the server.
+
+
+
+ A common countermeasure for CSRF is to generate a unique token to be
+ included in the HTML sent from the server to a user. This token can be
+ used as a hidden field to be sent back with requests to the server, where
+ the server can then check that the token is valid and associated with the
+ relevant user session.
+
+
+
+
+
+ In the Rails web framework, CSRF protection is enabled by the adding a call to
+ the protect_from_forgery method inside an
+ ActionController class. Typically this is done in the
+ ApplicationController class, or an equivalent class from which
+ other controller classes are subclassed.
+
+ The default behaviour of this method is to null the session when an invalid
+ CSRF token is provided. This may not be sufficient to avoid a CSRF
+ vulnerability - for example if parts of the session are memoized. Calling
+ protect_from_forgery with: :exception can help to avoid this
+ by raising an exception on an invalid CSRF token instead.
+
+
+
+
+
+ The following example shows a case where CSRF protection is enabled with
+ a secure request handling strategy of :exception.
+
+
+
+
diff --git a/ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.ql b/ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.ql
new file mode 100644
index 000000000000..4210d798863a
--- /dev/null
+++ b/ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.ql
@@ -0,0 +1,23 @@
+/**
+ * @name CSRF protection not enabled
+ * @description Not enabling CSRF protection may make the application
+ * vulnerable to a Cross-Site Request Forgery (CSRF) attack.
+ * @kind problem
+ * @problem.severity warning
+ * @security-severity 8.8
+ * @precision high
+ * @id rb/csrf-protection-not-enabled
+ * @tags security
+ * external/cwe/cwe-352
+ */
+
+import codeql.ruby.AST
+import codeql.ruby.Concepts
+import codeql.ruby.frameworks.ActionController
+
+from ActionController::RootController c
+where
+ not exists(ActionController::ProtectFromForgeryCall call |
+ c.getSelf().flowsTo(call.getReceiver())
+ )
+select c, "Potential CSRF vulnerability due to forgery protection not being enabled"
diff --git a/ruby/ql/src/queries/security/cwe-352/examples/ProtectFromForgeryGood.rb b/ruby/ql/src/queries/security/cwe-352/examples/ProtectFromForgeryGood.rb
new file mode 100644
index 000000000000..ecab2c8ea45a
--- /dev/null
+++ b/ruby/ql/src/queries/security/cwe-352/examples/ProtectFromForgeryGood.rb
@@ -0,0 +1,4 @@
+class ApplicationController < ActionController::Base
+ protect_from_forgery with: :exception
+end
+
\ No newline at end of file
diff --git a/ruby/ql/test/query-tests/security/cwe-352/CSRFProtectionNotEnabled.expected b/ruby/ql/test/query-tests/security/cwe-352/CSRFProtectionNotEnabled.expected
new file mode 100644
index 000000000000..7fe8b3490a95
--- /dev/null
+++ b/ruby/ql/test/query-tests/security/cwe-352/CSRFProtectionNotEnabled.expected
@@ -0,0 +1 @@
+| railsapp/app/controllers/alternative_root_controller.rb:1:1:3:3 | AlternativeRootController | Potential CSRF vulnerability due to forgery protection not being enabled |
diff --git a/ruby/ql/test/query-tests/security/cwe-352/CSRFProtectionNotEnabled.qlref b/ruby/ql/test/query-tests/security/cwe-352/CSRFProtectionNotEnabled.qlref
new file mode 100644
index 000000000000..8e9e894fe518
--- /dev/null
+++ b/ruby/ql/test/query-tests/security/cwe-352/CSRFProtectionNotEnabled.qlref
@@ -0,0 +1 @@
+queries/security/cwe-352/CSRFProtectionNotEnabled.ql
\ No newline at end of file
diff --git a/ruby/ql/test/query-tests/security/cwe-352/railsapp/app/controllers/alternative_root_controller.rb b/ruby/ql/test/query-tests/security/cwe-352/railsapp/app/controllers/alternative_root_controller.rb
new file mode 100644
index 000000000000..8cbf31529c15
--- /dev/null
+++ b/ruby/ql/test/query-tests/security/cwe-352/railsapp/app/controllers/alternative_root_controller.rb
@@ -0,0 +1,3 @@
+class AlternativeRootController < ActionController::Base
+ # BAD: no protect_from_forgery call
+end
\ No newline at end of file
From 6d6f8ba512b4bdba57a09b6815aed8228a9425c4 Mon Sep 17 00:00:00 2001
From: Harry Maclean
Date: Mon, 25 Sep 2023 13:46:50 +0100
Subject: [PATCH 009/731] Ruby: Make CSRF query more sensitive
Generate an alert for every controller class that doesn't have or
inherity a `protect_from_forgery` setting.
---
.../cwe-352/CSRFProtectionNotEnabled.ql | 20 +++++++++++++------
.../cwe-352/CSRFProtectionNotEnabled.expected | 3 ++-
.../controllers/subscriptions_controller.rb | 3 +++
.../app/controllers/tags_controller.rb | 2 ++
4 files changed, 21 insertions(+), 7 deletions(-)
create mode 100644 ruby/ql/test/query-tests/security/cwe-352/railsapp/app/controllers/subscriptions_controller.rb
create mode 100644 ruby/ql/test/query-tests/security/cwe-352/railsapp/app/controllers/tags_controller.rb
diff --git a/ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.ql b/ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.ql
index 4210d798863a..235798e66d4e 100644
--- a/ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.ql
+++ b/ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.ql
@@ -15,9 +15,17 @@ import codeql.ruby.AST
import codeql.ruby.Concepts
import codeql.ruby.frameworks.ActionController
-from ActionController::RootController c
-where
- not exists(ActionController::ProtectFromForgeryCall call |
- c.getSelf().flowsTo(call.getReceiver())
- )
-select c, "Potential CSRF vulnerability due to forgery protection not being enabled"
+/**
+ * Holds if a call to `protect_from_forgery` is made in the controller class `definedIn`,
+ * which is inherited by the controller class `child`.
+ */
+private predicate protectFromForgeryCall(
+ ActionControllerClass definedIn, ActionControllerClass child,
+ ActionController::ProtectFromForgeryCall call
+) {
+ definedIn.getSelf().flowsTo(call.getReceiver()) and child = definedIn.getADescendent()
+}
+
+from ActionControllerClass c
+where not protectFromForgeryCall(_, c, _)
+select c, "Potential CSRF vulnerability due to forgery protection not being enabled."
diff --git a/ruby/ql/test/query-tests/security/cwe-352/CSRFProtectionNotEnabled.expected b/ruby/ql/test/query-tests/security/cwe-352/CSRFProtectionNotEnabled.expected
index 7fe8b3490a95..52e2b1aaa4b8 100644
--- a/ruby/ql/test/query-tests/security/cwe-352/CSRFProtectionNotEnabled.expected
+++ b/ruby/ql/test/query-tests/security/cwe-352/CSRFProtectionNotEnabled.expected
@@ -1 +1,2 @@
-| railsapp/app/controllers/alternative_root_controller.rb:1:1:3:3 | AlternativeRootController | Potential CSRF vulnerability due to forgery protection not being enabled |
+| railsapp/app/controllers/alternative_root_controller.rb:1:1:3:3 | AlternativeRootController | Potential CSRF vulnerability due to forgery protection not being enabled. |
+| railsapp/app/controllers/tags_controller.rb:1:1:2:3 | TagsController | Potential CSRF vulnerability due to forgery protection not being enabled. |
diff --git a/ruby/ql/test/query-tests/security/cwe-352/railsapp/app/controllers/subscriptions_controller.rb b/ruby/ql/test/query-tests/security/cwe-352/railsapp/app/controllers/subscriptions_controller.rb
new file mode 100644
index 000000000000..9e1cfcf9a1e5
--- /dev/null
+++ b/ruby/ql/test/query-tests/security/cwe-352/railsapp/app/controllers/subscriptions_controller.rb
@@ -0,0 +1,3 @@
+class SubscriptionsController < AlternativeRootController
+ protect_from_forgery with: :exception
+end
\ No newline at end of file
diff --git a/ruby/ql/test/query-tests/security/cwe-352/railsapp/app/controllers/tags_controller.rb b/ruby/ql/test/query-tests/security/cwe-352/railsapp/app/controllers/tags_controller.rb
new file mode 100644
index 000000000000..4c3f586b9fe6
--- /dev/null
+++ b/ruby/ql/test/query-tests/security/cwe-352/railsapp/app/controllers/tags_controller.rb
@@ -0,0 +1,2 @@
+class TagsController < AlternativeRootController
+end
\ No newline at end of file
From 581072721cac3d8e4e2ff42cbf0005af58b2f06d Mon Sep 17 00:00:00 2001
From: Harry Maclean
Date: Mon, 25 Sep 2023 13:57:30 +0100
Subject: [PATCH 010/731] Ruby: Add change note
---
.../change-notes/2023-09-25-csrf-protection-not-enabled.md | 4 ++++
1 file changed, 4 insertions(+)
create mode 100644 ruby/ql/src/change-notes/2023-09-25-csrf-protection-not-enabled.md
diff --git a/ruby/ql/src/change-notes/2023-09-25-csrf-protection-not-enabled.md b/ruby/ql/src/change-notes/2023-09-25-csrf-protection-not-enabled.md
new file mode 100644
index 000000000000..e8e7ac54e381
--- /dev/null
+++ b/ruby/ql/src/change-notes/2023-09-25-csrf-protection-not-enabled.md
@@ -0,0 +1,4 @@
+---
+category: newQuery
+---
+* Added a new experimental query, `rb/csrf-protection-not-enabled`, to detect cases where Cross-Site Request Forgery protection is not enabled in Ruby on Rails controllers.
From 3c69ab10f25d91107f78f5c6fa31c741fd1b70c8 Mon Sep 17 00:00:00 2001
From: Harry Maclean
Date: Fri, 29 Sep 2023 15:35:16 +0100
Subject: [PATCH 011/731] Ruby: Restrict rb/csrf-protection-not-enabled
This query only applies to codebases using Ruby on Rails < 5.2, or where
there is no call to `csrf_meta_tags` in the base ERb template.
---
.../ql/lib/codeql/ruby/frameworks/Gemfile.qll | 243 ++++++++++++++++++
.../cwe-352/CSRFProtectionNotEnabled.ql | 20 +-
2 files changed, 262 insertions(+), 1 deletion(-)
create mode 100644 ruby/ql/lib/codeql/ruby/frameworks/Gemfile.qll
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/Gemfile.qll b/ruby/ql/lib/codeql/ruby/frameworks/Gemfile.qll
new file mode 100644
index 000000000000..526e8cea7365
--- /dev/null
+++ b/ruby/ql/lib/codeql/ruby/frameworks/Gemfile.qll
@@ -0,0 +1,243 @@
+private import codeql.ruby.AST
+
+/**
+ * Provides classes and predicates for Gemfiles, including version constraint logic.
+ */
+module Gemfile {
+ private File getGemfile() { result.getBaseName() = "Gemfile" }
+
+ /**
+ * A call to `gem` inside a gemfile. This defines a dependency. For example:
+ *
+ * ```rb
+ * gem "actionpack", "~> 7.0.0"
+ * ```
+ *
+ * This call defines a dependency on the `actionpack` gem, with version constraint `~> 7.0.0`.
+ * For detail on version constraints, see the `VersionConstraint` class.
+ */
+ class Gem extends MethodCall {
+ Gem() { this.getMethodName() = "gem" and this.getFile() = getGemfile() }
+
+ string getName() { result = this.getArgument(0).getConstantValue().getStringlikeValue() }
+
+ /**
+ * Gets the `i`th version string for this gem. A single `gem` call may have multiple version constraints, for example:
+ *
+ * ```rb
+ * gem "json", "3.4.0", ">= 3.0"
+ * ```
+ */
+ string getVersionString(int i) {
+ result = this.getArgument(i + 1).getConstantValue().getStringlikeValue()
+ }
+
+ /**
+ * Gets a version constraint defined by this call.
+ */
+ VersionConstraint getAVersionConstraint() { result = this.getVersionString(_) }
+ }
+
+ private newtype TComparator =
+ TEq() or
+ TNeq() or
+ TGt() or
+ TLt() or
+ TGeq() or
+ TLeq() or
+ TPGeq()
+
+ /**
+ * A comparison operator in a version constraint.
+ */
+ private class Comparator extends TComparator {
+ string toString() { result = this.toSourceString() }
+
+ /**
+ * The representation of the comparator in source code.
+ * This is defined separately so that we can change the `toString` implementation without breaking `parseConstraint`.
+ */
+ string toSourceString() {
+ this = TEq() and result = "="
+ or
+ this = TNeq() and result = "!="
+ or
+ this = TGt() and result = ">"
+ or
+ this = TLt() and result = "<"
+ or
+ this = TGeq() and result = ">="
+ or
+ this = TLeq() and result = "<="
+ or
+ this = TPGeq() and result = "~>"
+ }
+ }
+
+ bindingset[s]
+ private predicate parseExactVersion(string s, string version) {
+ version = s.regexpCapture("\\s*(\\d+\\.\\d+\\.\\d+)\\s*", 1)
+ }
+
+ bindingset[s]
+ private predicate parseConstraint(string s, Comparator c, string version) {
+ exists(string pattern | pattern = "(=|!=|>=?|<=?|~>)\\s+(.+)" |
+ c.toSourceString() = s.regexpCapture(pattern, 1) and version = s.regexpCapture(pattern, 2)
+ )
+ }
+
+ class VersionConstraint extends string {
+ Comparator comp;
+ string versionString;
+
+ VersionConstraint() {
+ this = any(Gem g).getVersionString(_) and
+ (
+ parseConstraint(this, comp, versionString)
+ or
+ parseExactVersion(this, versionString) and comp = TEq()
+ )
+ }
+
+ /**
+ * Gets the string defining the version number used in this constraint.
+ */
+ string getVersionString() { result = versionString }
+
+ /**
+ * Gets the `Version` used in this constraint.
+ */
+ Version getVersion() { result = this.getVersionString() }
+
+ /**
+ * Holds if `other` is a version which is strictly greater than the range described by this version constraint.
+ */
+ bindingset[other]
+ predicate before(string other) {
+ comp = TEq() and this.getVersion().before(other)
+ or
+ comp = TLt() and
+ (this.getVersion().before(other) or this.getVersion().equal(other))
+ or
+ comp = TLeq() and this.getVersion().before(other)
+ or
+ // ~> x.y.z <=> >= x.y.z && < x.(y+1).0
+ // ~> x.y <=> >= x.y && < (x+1).0
+ comp = TPGeq() and
+ exists(int thisMajor, int thisMinor, int otherMajor, int otherMinor |
+ thisMajor = this.getVersion().getMajor() and
+ thisMinor = this.getVersion().getMinor() and
+ exists(string maj, string mi | normalizeSemver(other, _, maj, mi, _) |
+ otherMajor = maj.toInt() and otherMinor = mi.toInt()
+ )
+ |
+ exists(this.getVersion().getPatch()) and
+ (
+ thisMajor < otherMajor
+ or
+ thisMajor = otherMajor and
+ thisMinor < otherMinor
+ )
+ or
+ not exists(this.getVersion().getPatch()) and
+ thisMajor < otherMajor
+ )
+ // if the comparator is > or >=, it has no upper bound and therefore isn't guaranteed to be before any other version.
+ }
+ }
+
+ /**
+ * A version number in a version constraint. For example, in the following code
+ *
+ * ```rb
+ * gem "json", ">= 3.4.5"
+ * ```
+ *
+ * The version is `3.4.5`.
+ */
+ private class Version extends string {
+ string normalized;
+
+ Version() {
+ this = any(Gem c).getAVersionConstraint().getVersionString() and
+ normalized = normalizeSemver(this)
+ }
+
+ /**
+ * Holds if this version is strictly before the version defined by `other`.
+ */
+ bindingset[other]
+ predicate before(string other) { normalized < normalizeSemver(other) }
+
+ /**
+ * Holds if this versino is equal to the version defined by `other`.
+ */
+ bindingset[other]
+ predicate equal(string other) { normalized = normalizeSemver(other) }
+
+ /**
+ * Holds if this version is strictly after the version defined by `other`.
+ */
+ bindingset[other]
+ predicate after(string other) { normalized > normalizeSemver(other) }
+
+ /**
+ * Holds if this version defines a patch number.
+ */
+ predicate hasPatch() { exists(getPatch(this)) }
+
+ /**
+ * Gets the major number of this version.
+ */
+ int getMajor() { result = getMajor(normalized).toInt() }
+
+ /**
+ * Gets the minor number of this version, if it exists.
+ */
+ int getMinor() { result = getMinor(normalized).toInt() }
+
+ /**
+ * Gets the patch number of this version, if it exists.
+ */
+ int getPatch() { result = getPatch(normalized).toInt() }
+ }
+
+ /**
+ * Normalizes a SemVer string such that the lexicographical ordering
+ * of two normalized strings is consistent with the SemVer ordering.
+ *
+ * Pre-release information and build metadata is not supported.
+ */
+ bindingset[orig]
+ private predicate normalizeSemver(
+ string orig, string normalized, string major, string minor, string patch
+ ) {
+ major = getMajor(orig) and
+ (
+ minor = getMinor(orig)
+ or
+ not exists(getMinor(orig)) and minor = "0"
+ ) and
+ (
+ patch = getPatch(orig)
+ or
+ not exists(getPatch(orig)) and patch = "0"
+ ) and
+ normalized = leftPad(major) + "." + leftPad(minor) + "." + leftPad(patch)
+ }
+
+ bindingset[orig]
+ private string normalizeSemver(string orig) { normalizeSemver(orig, result, _, _, _) }
+
+ bindingset[s]
+ private string getMajor(string s) { result = s.regexpCapture("(\\d+).*", 1) }
+
+ bindingset[s]
+ private string getMinor(string s) { result = s.regexpCapture("(\\d+)\\.(\\d+).*", 2) }
+
+ bindingset[s]
+ private string getPatch(string s) { result = s.regexpCapture("(\\d+)\\.(\\d+)\\.(\\d+).*", 3) }
+
+ bindingset[str]
+ private string leftPad(string str) { result = ("000" + str).suffix(str.length()) }
+}
diff --git a/ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.ql b/ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.ql
index 235798e66d4e..8bbb8d79116b 100644
--- a/ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.ql
+++ b/ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.ql
@@ -14,6 +14,7 @@
import codeql.ruby.AST
import codeql.ruby.Concepts
import codeql.ruby.frameworks.ActionController
+import codeql.ruby.frameworks.Gemfile
/**
* Holds if a call to `protect_from_forgery` is made in the controller class `definedIn`,
@@ -26,6 +27,23 @@ private predicate protectFromForgeryCall(
definedIn.getSelf().flowsTo(call.getReceiver()) and child = definedIn.getADescendent()
}
+/**
+ * Holds if the Gemfile for this application specifies a version of "rails" < 3.0.0.
+ * Rails versions from 3.0.0 onwards enable CSRF protection by default.
+ */
+private predicate railsPreVersion3() {
+ exists(Gemfile::Gem g | g.getName() = "rails" and g.getAVersionConstraint().before("5.2"))
+}
+
from ActionControllerClass c
-where not protectFromForgeryCall(_, c, _)
+where
+ not protectFromForgeryCall(_, c, _) and
+ // Rails versions prior to 3.0.0 require CSRF protection to be explicitly enabled.
+ // For later versions, there must exist a call to `csrf_meta_tags` in every HTML response.
+ // We currently just check for a call to this method anywhere in the codebase.
+ (
+ railsPreVersion3()
+ or
+ not any(MethodCall m).getMethodName() = "csrf_meta_tags"
+ )
select c, "Potential CSRF vulnerability due to forgery protection not being enabled."
From f19a5a9837a87085be8b26680541fe6dddddd9ad Mon Sep 17 00:00:00 2001
From: Harry Maclean
Date: Tue, 10 Oct 2023 12:06:51 +0100
Subject: [PATCH 012/731] Ruby: Add tests for Gemfile modeling
---
.../library-tests/frameworks/gemfile/Gemfile | 9 +++++++++
.../frameworks/gemfile/Gemfile.expected | 8 ++++++++
.../library-tests/frameworks/gemfile/Gemfile.ql | 17 +++++++++++++++++
.../frameworks/gemfile/not_gemfile.rb | 1 +
4 files changed, 35 insertions(+)
create mode 100644 ruby/ql/test/library-tests/frameworks/gemfile/Gemfile
create mode 100644 ruby/ql/test/library-tests/frameworks/gemfile/Gemfile.expected
create mode 100644 ruby/ql/test/library-tests/frameworks/gemfile/Gemfile.ql
create mode 100644 ruby/ql/test/library-tests/frameworks/gemfile/not_gemfile.rb
diff --git a/ruby/ql/test/library-tests/frameworks/gemfile/Gemfile b/ruby/ql/test/library-tests/frameworks/gemfile/Gemfile
new file mode 100644
index 000000000000..2e3f2313bfb5
--- /dev/null
+++ b/ruby/ql/test/library-tests/frameworks/gemfile/Gemfile
@@ -0,0 +1,9 @@
+source "https://rubygems.org"
+
+gem "rails", "7.0.0"
+gem "json", "~> 2.6.0"
+gem "jwt"
+
+gem "loofah", ">= 2"
+
+gem "invalid-version", "abc"
diff --git a/ruby/ql/test/library-tests/frameworks/gemfile/Gemfile.expected b/ruby/ql/test/library-tests/frameworks/gemfile/Gemfile.expected
new file mode 100644
index 000000000000..9d87e77087e4
--- /dev/null
+++ b/ruby/ql/test/library-tests/frameworks/gemfile/Gemfile.expected
@@ -0,0 +1,8 @@
+gemCalls
+| Gemfile:3:1:3:20 | call to gem | rails | 7.0.0 | 7.0.0 |
+| Gemfile:4:1:4:22 | call to gem | json | ~> 2.6.0 | 2.6.0 |
+| Gemfile:7:1:7:20 | call to gem | loofah | >= 2 | 2 |
+versionBefore
+| 2 | 2.6.0 |
+| 2 | 7.0.0 |
+| 2.6.0 | 7.0.0 |
diff --git a/ruby/ql/test/library-tests/frameworks/gemfile/Gemfile.ql b/ruby/ql/test/library-tests/frameworks/gemfile/Gemfile.ql
new file mode 100644
index 000000000000..487d224777b9
--- /dev/null
+++ b/ruby/ql/test/library-tests/frameworks/gemfile/Gemfile.ql
@@ -0,0 +1,17 @@
+import codeql.ruby.frameworks.Gemfile
+
+query predicate gemCalls(
+ Gemfile::Gem gem, string name, Gemfile::VersionConstraint constraint, string version
+) {
+ name = gem.getName() and
+ constraint = gem.getAVersionConstraint() and
+ version = constraint.getVersion()
+}
+
+query predicate versionBefore(string before, string after) {
+ exists(Gemfile::VersionConstraint c1, Gemfile::VersionConstraint c2 |
+ c1.getVersion() = before and c2.getVersion() = after
+ |
+ c1.getVersion().before(after)
+ )
+}
diff --git a/ruby/ql/test/library-tests/frameworks/gemfile/not_gemfile.rb b/ruby/ql/test/library-tests/frameworks/gemfile/not_gemfile.rb
new file mode 100644
index 000000000000..a526277026c3
--- /dev/null
+++ b/ruby/ql/test/library-tests/frameworks/gemfile/not_gemfile.rb
@@ -0,0 +1 @@
+gem "this-gem-not-in-gemfile", "1.2"
From 0597b2ed1b3b77bcb266a957d074bdcfce82e24b Mon Sep 17 00:00:00 2001
From: Harry Maclean
Date: Tue, 10 Oct 2023 12:13:59 +0100
Subject: [PATCH 013/731] Ruby: recognise csrf_meta_tag
csrf_meta_tag is an alias for csrf_meta_tags, retained for backwards
compatibility.
---
.../ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.ql | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.ql b/ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.ql
index 8bbb8d79116b..cd7961d2f9a0 100644
--- a/ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.ql
+++ b/ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.ql
@@ -44,6 +44,6 @@ where
(
railsPreVersion3()
or
- not any(MethodCall m).getMethodName() = "csrf_meta_tags"
+ not any(MethodCall m).getMethodName() = ["csrf_meta_tags", "csrf_meta_tag"]
)
select c, "Potential CSRF vulnerability due to forgery protection not being enabled."
From 3499d169f9173223fa3be5f7e7227baa423e0473 Mon Sep 17 00:00:00 2001
From: Harry Maclean
Date: Tue, 10 Oct 2023 12:20:23 +0100
Subject: [PATCH 014/731] Ruby: Add missing QLDoc
---
ruby/ql/lib/codeql/ruby/frameworks/Gemfile.qll | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/Gemfile.qll b/ruby/ql/lib/codeql/ruby/frameworks/Gemfile.qll
index 526e8cea7365..c71a783387f7 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/Gemfile.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/Gemfile.qll
@@ -1,3 +1,7 @@
+/**
+ * Provides classes and predicates for Gemfiles, including version constraint logic.
+ */
+
private import codeql.ruby.AST
/**
@@ -19,6 +23,9 @@ module Gemfile {
class Gem extends MethodCall {
Gem() { this.getMethodName() = "gem" and this.getFile() = getGemfile() }
+ /**
+ * Gets the name of the gem in this version constraint.
+ */
string getName() { result = this.getArgument(0).getConstantValue().getStringlikeValue() }
/**
@@ -86,6 +93,10 @@ module Gemfile {
)
}
+ /**
+ * A version constraint in a `gem` call. This consists of a version number and an optional comparator, for example
+ * `>= 1.2.3`.
+ */
class VersionConstraint extends string {
Comparator comp;
string versionString;
From 1fbf177b546a1bb73178be73757e2eb352566c08 Mon Sep 17 00:00:00 2001
From: Harry Maclean
Date: Tue, 10 Oct 2023 12:21:34 +0100
Subject: [PATCH 015/731] Ruby: QLDoc fix
---
ruby/ql/lib/codeql/ruby/frameworks/Gemfile.qll | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/Gemfile.qll b/ruby/ql/lib/codeql/ruby/frameworks/Gemfile.qll
index c71a783387f7..83ebc27100a8 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/Gemfile.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/Gemfile.qll
@@ -61,7 +61,7 @@ module Gemfile {
string toString() { result = this.toSourceString() }
/**
- * The representation of the comparator in source code.
+ * Gets the representation of the comparator in source code.
* This is defined separately so that we can change the `toString` implementation without breaking `parseConstraint`.
*/
string toSourceString() {
From 32b775fdc36c2cf39daf3737fe5fadc74f3cf5eb Mon Sep 17 00:00:00 2001
From: Harry Maclean
Date: Tue, 10 Oct 2023 15:37:32 +0100
Subject: [PATCH 016/731] Ruby: reduce duplicate alerts for csrf query
Only generate an alert on the top-most vulnerable Rails controller in
the controller tree.
---
.../queries/security/cwe-352/CSRFProtectionNotEnabled.ql | 6 ++++--
.../security/cwe-352/CSRFProtectionNotEnabled.expected | 1 -
2 files changed, 4 insertions(+), 3 deletions(-)
diff --git a/ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.ql b/ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.ql
index cd7961d2f9a0..f3631eb45560 100644
--- a/ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.ql
+++ b/ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.ql
@@ -18,7 +18,7 @@ import codeql.ruby.frameworks.Gemfile
/**
* Holds if a call to `protect_from_forgery` is made in the controller class `definedIn`,
- * which is inherited by the controller class `child`.
+ * which is inherited by the controller class `child`. These classes may be the same.
*/
private predicate protectFromForgeryCall(
ActionControllerClass definedIn, ActionControllerClass child,
@@ -45,5 +45,7 @@ where
railsPreVersion3()
or
not any(MethodCall m).getMethodName() = ["csrf_meta_tags", "csrf_meta_tag"]
- )
+ ) and
+ // Only generate alerts for the topmost controller in the tree.
+ not exists(ActionControllerClass parent | c = parent.getAnImmediateDescendent())
select c, "Potential CSRF vulnerability due to forgery protection not being enabled."
diff --git a/ruby/ql/test/query-tests/security/cwe-352/CSRFProtectionNotEnabled.expected b/ruby/ql/test/query-tests/security/cwe-352/CSRFProtectionNotEnabled.expected
index 52e2b1aaa4b8..50da7dc07668 100644
--- a/ruby/ql/test/query-tests/security/cwe-352/CSRFProtectionNotEnabled.expected
+++ b/ruby/ql/test/query-tests/security/cwe-352/CSRFProtectionNotEnabled.expected
@@ -1,2 +1 @@
| railsapp/app/controllers/alternative_root_controller.rb:1:1:3:3 | AlternativeRootController | Potential CSRF vulnerability due to forgery protection not being enabled. |
-| railsapp/app/controllers/tags_controller.rb:1:1:2:3 | TagsController | Potential CSRF vulnerability due to forgery protection not being enabled. |
From 3ee425cc477d70382634dd6aedab98dd0dee3351 Mon Sep 17 00:00:00 2001
From: Harry Maclean
Date: Fri, 13 Oct 2023 11:52:39 +0100
Subject: [PATCH 017/731] Ruby: Identify ActionController::API
`ActionController::API < ActionController::Base` is a base controller
class, so we should recognise it as such.
---
ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll b/ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll
index 5500eca06079..adeaf79fe17f 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll
@@ -100,11 +100,11 @@ private DataFlow::ConstRef actionControllerBaseClass() {
// In Rails applications `ApplicationController` typically extends `ActionController::Base`, but we
// treat it separately in case the `ApplicationController` definition is not in the database.
DataFlow::getConstant("ActionController").getConstant("Base"),
- // ActionController::Metal technically doesn't contain all of the
+ // ActionController::Metal and ActionController::API technically don't contain all of the
// methods available in Base, such as those for rendering views.
- // However we prefer to be over-sensitive in this case in order to find
- // more results.
- DataFlow::getConstant("ActionController").getConstant("Metal")
+ // However we prefer to be over-sensitive in this case in order to find more results.
+ DataFlow::getConstant("ActionController").getConstant("Metal"),
+ DataFlow::getConstant("ActionController").getConstant("API")
]
}
From 081c1201edd177cbfa7d049e99db823210fc8784 Mon Sep 17 00:00:00 2001
From: Harry Maclean
Date: Tue, 17 Oct 2023 12:36:28 +0100
Subject: [PATCH 018/731] Ruby: Make csrf query more specific
CSRF protection only needs to be explicitly enabled on Rails
applications < 5.2 _or_ those that don't include a `load_defaults` call
with a version >= 5.2.
---
.../cwe-352/CSRFProtectionNotEnabled.ql | 35 ++++++++++++++-----
1 file changed, 26 insertions(+), 9 deletions(-)
diff --git a/ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.ql b/ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.ql
index f3631eb45560..bef764a61046 100644
--- a/ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.ql
+++ b/ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.ql
@@ -15,6 +15,7 @@ import codeql.ruby.AST
import codeql.ruby.Concepts
import codeql.ruby.frameworks.ActionController
import codeql.ruby.frameworks.Gemfile
+import codeql.ruby.DataFlow
/**
* Holds if a call to `protect_from_forgery` is made in the controller class `definedIn`,
@@ -28,23 +29,39 @@ private predicate protectFromForgeryCall(
}
/**
- * Holds if the Gemfile for this application specifies a version of "rails" < 3.0.0.
- * Rails versions from 3.0.0 onwards enable CSRF protection by default.
+ * Holds if the Gemfile for this application specifies a version of "rails" or "actionpack" < 5.2.
+ * Rails versions prior to 5.2 do not enable CSRF protection by default.
*/
-private predicate railsPreVersion3() {
- exists(Gemfile::Gem g | g.getName() = "rails" and g.getAVersionConstraint().before("5.2"))
+private predicate railsPreVersion5_2() {
+ exists(Gemfile::Gem g |
+ g.getName() = ["rails", "actionpack"] and g.getAVersionConstraint().before("5.2")
+ )
+}
+
+private float getRailsConfigDefaultVersion() {
+ exists(DataFlow::CallNode config, DataFlow::CallNode loadDefaultsCall |
+ DataFlow::getConstant("Rails")
+ .getConstant("Application")
+ .getADescendentModule()
+ .getAnImmediateReference()
+ .flowsTo(config.getReceiver()) and
+ config.getMethodName() = "config" and
+ loadDefaultsCall.getReceiver() = config and
+ loadDefaultsCall.getMethodName() = "load_defaults" and
+ result = loadDefaultsCall.getArgument(0).getConstantValue().getFloat()
+ )
}
from ActionControllerClass c
where
not protectFromForgeryCall(_, c, _) and
- // Rails versions prior to 3.0.0 require CSRF protection to be explicitly enabled.
- // For later versions, there must exist a call to `csrf_meta_tags` in every HTML response.
- // We currently just check for a call to this method anywhere in the codebase.
(
- railsPreVersion3()
+ // Rails versions prior to 5.2 require CSRF protection to be explicitly enabled.
+ railsPreVersion5_2()
or
- not any(MethodCall m).getMethodName() = ["csrf_meta_tags", "csrf_meta_tag"]
+ // For Rails >= 5.2, CSRF protection is enabled by default if there is a `load_defaults` call in the root application class
+ // which specifies a version >= 5.2.
+ not getRailsConfigDefaultVersion() >= 5.2
) and
// Only generate alerts for the topmost controller in the tree.
not exists(ActionControllerClass parent | c = parent.getAnImmediateDescendent())
From 7b3f1a098204388cc7915f7ed35d13fbecbbf804 Mon Sep 17 00:00:00 2001
From: Harry Maclean
Date: Fri, 23 Feb 2024 11:14:52 +0000
Subject: [PATCH 019/731] Ruby: fix comment
---
ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll b/ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll
index adeaf79fe17f..6fde1705018a 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll
@@ -67,6 +67,8 @@ module ActionController {
*/
class ActionControllerClass extends DataFlow::ClassNode {
ActionControllerClass() {
+ // In Rails applications `ApplicationController` typically extends `ActionController::Base`, but we
+ // treat it separately in case the `ApplicationController` definition is not in the database.
this = DataFlow::getConstant("ApplicationController").getADescendentModule()
or
this = actionControllerBaseClass().getADescendentModule() and
@@ -97,8 +99,6 @@ class ActionControllerClass extends DataFlow::ClassNode {
private DataFlow::ConstRef actionControllerBaseClass() {
result =
[
- // In Rails applications `ApplicationController` typically extends `ActionController::Base`, but we
- // treat it separately in case the `ApplicationController` definition is not in the database.
DataFlow::getConstant("ActionController").getConstant("Base"),
// ActionController::Metal and ActionController::API technically don't contain all of the
// methods available in Base, such as those for rendering views.
From f5be4079896f13f3b370734ed41cf1a91ce76564 Mon Sep 17 00:00:00 2001
From: Harry Maclean
Date: Fri, 23 Feb 2024 11:26:53 +0000
Subject: [PATCH 020/731] Ruby: deprecate old ProtectFromForgeryCall class
---
ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll b/ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll
index 6fde1705018a..c8667b2b2f23 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll
@@ -441,6 +441,11 @@ class ActionControllerSkipForgeryProtectionCall extends CsrfProtectionSetting::R
override boolean getVerificationSetting() { result = false }
}
+/**
+ * DEPRECATED: Use `ActionController::ProtectFromForgeryCall` instead.
+ */
+deprecated class ActionControllerProtectFromForgeryCall = ActionController::ProtectFromForgeryCall;
+
/**
* A call to `send_file`, which sends the file at the given path to the client.
*/
From 083f56921c8c4adced9e7e8ce2c945b1848dcd50 Mon Sep 17 00:00:00 2001
From: erik-krogh
Date: Sun, 25 Feb 2024 21:20:41 +0100
Subject: [PATCH 021/731] update to 5.4.1-rc
---
javascript/extractor/lib/typescript/package-lock.json | 8 ++++----
javascript/extractor/lib/typescript/package.json | 2 +-
2 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/javascript/extractor/lib/typescript/package-lock.json b/javascript/extractor/lib/typescript/package-lock.json
index fd672bf43c08..af309c3b4511 100644
--- a/javascript/extractor/lib/typescript/package-lock.json
+++ b/javascript/extractor/lib/typescript/package-lock.json
@@ -6,7 +6,7 @@
"": {
"name": "typescript-parser-wrapper",
"dependencies": {
- "typescript": "5.4.0-beta"
+ "typescript": "5.4.1-rc"
},
"devDependencies": {
"@types/node": "18.15.3"
@@ -20,9 +20,9 @@
"license": "MIT"
},
"node_modules/typescript": {
- "version": "5.4.0-beta",
- "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.4.0-beta.tgz",
- "integrity": "sha512-KgekV5JS7TQ7Bb8eO64QGxdM7MSBUUXOXq28OWX23d2MA8SiVtNYoo4s33tCTEGV8+6AGBRD2+KiXNNnexRRYw==",
+ "version": "5.4.1-rc",
+ "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.4.1-rc.tgz",
+ "integrity": "sha512-gInURzaO0bbfzfQAc3mfcHxh8qev+No4QOFUZHajo9vBgOLaljELJ3wuzyoGo/zHIzMSezdhtrsRdqL6E9SvNA==",
"bin": {
"tsc": "bin/tsc",
"tsserver": "bin/tsserver"
diff --git a/javascript/extractor/lib/typescript/package.json b/javascript/extractor/lib/typescript/package.json
index 2a636c3cdf32..6a315fed2927 100644
--- a/javascript/extractor/lib/typescript/package.json
+++ b/javascript/extractor/lib/typescript/package.json
@@ -2,7 +2,7 @@
"name": "typescript-parser-wrapper",
"private": true,
"dependencies": {
- "typescript": "5.4.0-beta"
+ "typescript": "5.4.1-rc"
},
"scripts": {
"build": "tsc --project tsconfig.json",
From dd092fd18f2778645896b5c2a557ccfbdd884601 Mon Sep 17 00:00:00 2001
From: Harry Maclean
Date: Mon, 26 Feb 2024 10:02:56 +0000
Subject: [PATCH 022/731] Ruby: Fix CSRF test
---
.../security/cwe-352/CSRFProtectionDisabled.expected | 2 +-
.../security/cwe-352/railsapp/config/application.rb | 3 ++-
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/ruby/ql/test/query-tests/security/cwe-352/CSRFProtectionDisabled.expected b/ruby/ql/test/query-tests/security/cwe-352/CSRFProtectionDisabled.expected
index d80c52afc669..be0df7c9da7a 100644
--- a/ruby/ql/test/query-tests/security/cwe-352/CSRFProtectionDisabled.expected
+++ b/ruby/ql/test/query-tests/security/cwe-352/CSRFProtectionDisabled.expected
@@ -1,5 +1,5 @@
| railsapp/app/controllers/application_controller.rb:5:3:5:22 | call to protect_from_forgery | Potential CSRF vulnerability due to forgery protection being disabled or weakened. |
| railsapp/app/controllers/users_controller.rb:4:3:4:47 | call to skip_before_action | Potential CSRF vulnerability due to forgery protection being disabled or weakened. |
-| railsapp/config/application.rb:15:5:15:53 | call to allow_forgery_protection= | Potential CSRF vulnerability due to forgery protection being disabled or weakened. |
+| railsapp/config/application.rb:16:5:16:53 | call to allow_forgery_protection= | Potential CSRF vulnerability due to forgery protection being disabled or weakened. |
| railsapp/config/environments/development.rb:5:3:5:51 | call to allow_forgery_protection= | Potential CSRF vulnerability due to forgery protection being disabled or weakened. |
| railsapp/config/environments/production.rb:5:3:5:51 | call to allow_forgery_protection= | Potential CSRF vulnerability due to forgery protection being disabled or weakened. |
diff --git a/ruby/ql/test/query-tests/security/cwe-352/railsapp/config/application.rb b/ruby/ql/test/query-tests/security/cwe-352/railsapp/config/application.rb
index 49ccf578c5eb..02b349a16304 100644
--- a/ruby/ql/test/query-tests/security/cwe-352/railsapp/config/application.rb
+++ b/ruby/ql/test/query-tests/security/cwe-352/railsapp/config/application.rb
@@ -9,7 +9,8 @@
module Railsapp
class Application < Rails::Application
# Initialize configuration defaults for originally generated Rails version.
- config.load_defaults 6.0
+ # This defaults version does NOT enable CSRF protection by default.
+ config.load_defaults 5.1
# BAD: Disabling forgery protection may open the application to CSRF attacks
config.action_controller.allow_forgery_protection = false
From a03c06802e7f08baadf6796dc19a968cd72fdc67 Mon Sep 17 00:00:00 2001
From: Harry Maclean
Date: Tue, 6 Feb 2024 09:34:20 +0000
Subject: [PATCH 023/731] Ruby: Add some more command injection sinks
---
ruby/ql/lib/codeql/ruby/frameworks/core/Kernel.qll | 10 ++++++++--
ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll | 8 +++++---
2 files changed, 13 insertions(+), 5 deletions(-)
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/core/Kernel.qll b/ruby/ql/lib/codeql/ruby/frameworks/core/Kernel.qll
index 96568e74902a..2aa46ab550ab 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/core/Kernel.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/core/Kernel.qll
@@ -130,13 +130,19 @@ module Kernel {
* `Kernel.spawn` takes the same argument forms as `Kernel.system`.
* See `KernelSystemCall` for details.
* Ruby documentation: https://docs.ruby-lang.org/en/3.0.0/Kernel.html#method-i-spawn
+ * Methods with the same effect exist in the `Process` and `PTY` classes, so they are also modeled here.
* TODO: document and handle the env and option arguments.
* ```
* spawn([env,] command... [,options]) -> pid
* ```
*/
- class KernelSpawnCall extends SystemCommandExecution::Range instanceof KernelMethodCall {
- KernelSpawnCall() { this.getMethodName() = "spawn" }
+ class KernelSpawnCall extends SystemCommandExecution::Range instanceof DataFlow::CallNode {
+ KernelSpawnCall() {
+ this.getMethodName() = "spawn" and
+ this instanceof KernelMethodCall
+ or
+ this = DataFlow::getConstant(["Process", "PTY"]).getAMethodCall("spawn")
+ }
override DataFlow::Node getAnArgument() { result = super.getArgument(_) }
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll b/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll
index e65f30055038..5f349c451f33 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll
@@ -7,7 +7,7 @@ private import codeql.ruby.ApiGraphs
private import codeql.ruby.Concepts
/**
- * Provides modeling for the `Open3` library.
+ * Provides modeling for the `Open3` and `Open4` libraries.
*/
module Open3 {
/**
@@ -18,8 +18,10 @@ module Open3 {
class Open3Call extends SystemCommandExecution::Range instanceof DataFlow::CallNode {
Open3Call() {
this =
- API::getTopLevelMember("Open3")
- .getAMethodCall(["popen3", "popen2", "popen2e", "capture3", "capture2", "capture2e"])
+ API::getTopLevelMember(["Open3", "Open4"])
+ .getAMethodCall([
+ "popen3", "popen2", "popen2e", "capture3", "capture2", "capture2e", "popen4"
+ ])
}
override DataFlow::Node getAnArgument() { result = super.getArgument(_) }
From beef9965cc48174538cc8346fa056ca5fdec5c22 Mon Sep 17 00:00:00 2001
From: Harry Maclean
Date: Mon, 26 Feb 2024 10:35:08 +0000
Subject: [PATCH 024/731] Ruby: Model Open4 library
Also remove duplicate modeling of Process.spawn.
---
.../codeql/ruby/frameworks/core/Kernel.qll | 3 ---
.../codeql/ruby/frameworks/stdlib/Open3.qll | 19 +++++++++++++++----
.../frameworks/stdlib/Open3.expected | 4 ++++
.../library-tests/frameworks/stdlib/Open3.ql | 2 ++
.../library-tests/frameworks/stdlib/Open3.rb | 6 +++++-
5 files changed, 26 insertions(+), 8 deletions(-)
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/core/Kernel.qll b/ruby/ql/lib/codeql/ruby/frameworks/core/Kernel.qll
index 2aa46ab550ab..cc3ce9feb973 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/core/Kernel.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/core/Kernel.qll
@@ -130,7 +130,6 @@ module Kernel {
* `Kernel.spawn` takes the same argument forms as `Kernel.system`.
* See `KernelSystemCall` for details.
* Ruby documentation: https://docs.ruby-lang.org/en/3.0.0/Kernel.html#method-i-spawn
- * Methods with the same effect exist in the `Process` and `PTY` classes, so they are also modeled here.
* TODO: document and handle the env and option arguments.
* ```
* spawn([env,] command... [,options]) -> pid
@@ -140,8 +139,6 @@ module Kernel {
KernelSpawnCall() {
this.getMethodName() = "spawn" and
this instanceof KernelMethodCall
- or
- this = DataFlow::getConstant(["Process", "PTY"]).getAMethodCall("spawn")
}
override DataFlow::Node getAnArgument() { result = super.getArgument(_) }
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll b/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll
index 5f349c451f33..f2eb16d2aa89 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll
@@ -18,10 +18,8 @@ module Open3 {
class Open3Call extends SystemCommandExecution::Range instanceof DataFlow::CallNode {
Open3Call() {
this =
- API::getTopLevelMember(["Open3", "Open4"])
- .getAMethodCall([
- "popen3", "popen2", "popen2e", "capture3", "capture2", "capture2e", "popen4"
- ])
+ API::getTopLevelMember("Open3")
+ .getAMethodCall(["popen3", "popen2", "popen2e", "capture3", "capture2", "capture2e"])
}
override DataFlow::Node getAnArgument() { result = super.getArgument(_) }
@@ -33,6 +31,19 @@ module Open3 {
}
}
+ class Open4Call extends SystemCommandExecution::Range instanceof DataFlow::CallNode {
+ Open4Call() {
+ this = API::getTopLevelMember("Open4").getAMethodCall(["open4", "popen4", "spawn"])
+ }
+
+ override DataFlow::Node getAnArgument() { result = super.getArgument(_) }
+
+ override predicate isShellInterpreted(DataFlow::Node arg) {
+ super.getNumberOfArguments() = 1 and
+ arg = this.getAnArgument()
+ }
+ }
+
/**
* A pipeline of system commands constructed via one of the `Open3` methods.
* These methods accept a variable argument list of commands.
diff --git a/ruby/ql/test/library-tests/frameworks/stdlib/Open3.expected b/ruby/ql/test/library-tests/frameworks/stdlib/Open3.expected
index a601d199ff6b..48bc6fc27f68 100644
--- a/ruby/ql/test/library-tests/frameworks/stdlib/Open3.expected
+++ b/ruby/ql/test/library-tests/frameworks/stdlib/Open3.expected
@@ -11,3 +11,7 @@ open3PipelineCallExecutions
| Open3.rb:9:1:9:40 | call to pipeline_w |
| Open3.rb:10:1:10:44 | call to pipeline_start |
| Open3.rb:11:1:11:38 | call to pipeline |
+open4CallExecutions
+| Open3.rb:13:1:13:24 | call to open4 |
+| Open3.rb:14:1:14:25 | call to popen4 |
+| Open3.rb:15:1:15:23 | call to spawn |
diff --git a/ruby/ql/test/library-tests/frameworks/stdlib/Open3.ql b/ruby/ql/test/library-tests/frameworks/stdlib/Open3.ql
index 8d98734832d8..014573d7010c 100644
--- a/ruby/ql/test/library-tests/frameworks/stdlib/Open3.ql
+++ b/ruby/ql/test/library-tests/frameworks/stdlib/Open3.ql
@@ -4,3 +4,5 @@ import codeql.ruby.DataFlow
query predicate open3CallExecutions(Open3Call c) { any() }
query predicate open3PipelineCallExecutions(Open3PipelineCall c) { any() }
+
+query predicate open4CallExecutions(Open4Call c) { any() }
diff --git a/ruby/ql/test/library-tests/frameworks/stdlib/Open3.rb b/ruby/ql/test/library-tests/frameworks/stdlib/Open3.rb
index b1a3d491be11..4a112335ffb7 100644
--- a/ruby/ql/test/library-tests/frameworks/stdlib/Open3.rb
+++ b/ruby/ql/test/library-tests/frameworks/stdlib/Open3.rb
@@ -8,4 +8,8 @@
Open3.pipeline_r("echo foo", "grep bar")
Open3.pipeline_w("echo foo", "grep bar")
Open3.pipeline_start("echo foo", "grep bar")
-Open3.pipeline("echo foo", "grep bar")
\ No newline at end of file
+Open3.pipeline("echo foo", "grep bar")
+
+Open4::open4("echo foo")
+Open4::popen4("echo foo")
+Open4.spawn("echo bar")
From d1847566b6b5988254f826a6fd42727308bbddcb Mon Sep 17 00:00:00 2001
From: Harry Maclean
Date: Mon, 26 Feb 2024 10:41:30 +0000
Subject: [PATCH 025/731] Ruby: Ql4QL fix
---
ruby/ql/lib/codeql/ruby/frameworks/core/Kernel.qll | 7 ++-----
ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll | 5 +++++
2 files changed, 7 insertions(+), 5 deletions(-)
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/core/Kernel.qll b/ruby/ql/lib/codeql/ruby/frameworks/core/Kernel.qll
index cc3ce9feb973..96568e74902a 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/core/Kernel.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/core/Kernel.qll
@@ -135,11 +135,8 @@ module Kernel {
* spawn([env,] command... [,options]) -> pid
* ```
*/
- class KernelSpawnCall extends SystemCommandExecution::Range instanceof DataFlow::CallNode {
- KernelSpawnCall() {
- this.getMethodName() = "spawn" and
- this instanceof KernelMethodCall
- }
+ class KernelSpawnCall extends SystemCommandExecution::Range instanceof KernelMethodCall {
+ KernelSpawnCall() { this.getMethodName() = "spawn" }
override DataFlow::Node getAnArgument() { result = super.getArgument(_) }
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll b/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll
index f2eb16d2aa89..16b9ecc37978 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll
@@ -31,6 +31,11 @@ module Open3 {
}
}
+ /**
+ * A system command executed via one of the `Open4` methods.
+ * These methods take the same argument forms as `Kernel.system`.
+ * See `KernelSystemCall` for details.
+ */
class Open4Call extends SystemCommandExecution::Range instanceof DataFlow::CallNode {
Open4Call() {
this = API::getTopLevelMember("Open4").getAMethodCall(["open4", "popen4", "spawn"])
From 9d13a1ff515b86bd84e3897335734736ad7354e3 Mon Sep 17 00:00:00 2001
From: Harry Maclean
Date: Mon, 26 Feb 2024 10:43:48 +0000
Subject: [PATCH 026/731] Ruby: Add model for Process.spawn
---
.../codeql/ruby/frameworks/stdlib/Process.qll | 35 +++++++++++++++++++
1 file changed, 35 insertions(+)
create mode 100644 ruby/ql/lib/codeql/ruby/frameworks/stdlib/Process.qll
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Process.qll b/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Process.qll
new file mode 100644
index 000000000000..1ffc15d691b8
--- /dev/null
+++ b/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Process.qll
@@ -0,0 +1,35 @@
+/**
+ * Provides modeling for the `Process` library.
+ */
+
+private import codeql.ruby.Concepts
+private import codeql.ruby.DataFlow
+private import codeql.ruby.controlflow.CfgNodes
+private import codeql.ruby.frameworks.core.Kernel
+
+/**
+ * Provides modeling for the `Process` library.
+ */
+module Process {
+ /**
+ * A call to `Process.spawn`.
+ * ```rb
+ * Process.spawn("tar xf ruby-2.0.0-p195.tar.bz2")
+ * Process.spawn({"ENV" => "VAR"}, "echo", "hi")
+ * ```
+ */
+ class SpawnCall extends SystemCommandExecution::Range instanceof DataFlow::CallNode {
+ SpawnCall() { this = DataFlow::getConstant(["Process", "PTY"]).getAMethodCall("spawn") }
+
+ // The command can be argument 0 or 1
+ // Options can be specified after the command, and we want to exclude those.
+ override DataFlow::Node getAnArgument() {
+ result = super.getArgument([0, 1]) and not result.asExpr() instanceof ExprNodes::PairCfgNode
+ }
+
+ override predicate isShellInterpreted(DataFlow::Node arg) {
+ // Process.spawn invokes a subshell if you provide a single string as argument
+ super.getNumberOfArguments() = 1 and arg = this.getAnArgument()
+ }
+ }
+}
From 8bed3fbed442ecdfee770b494d6a188f71025aa1 Mon Sep 17 00:00:00 2001
From: Harry Maclean
Date: Mon, 26 Feb 2024 10:57:17 +0000
Subject: [PATCH 027/731] Ruby: Add basic model for Terrapin library
---
.../codeql/ruby/frameworks/terrapin/model.yml | 41 +++++++++++++++++++
.../CommandInjection.expected | 10 +++++
.../CommandInjection/CommandInjection.rb | 11 ++++-
3 files changed, 61 insertions(+), 1 deletion(-)
create mode 100644 ruby/ql/lib/codeql/ruby/frameworks/terrapin/model.yml
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/terrapin/model.yml b/ruby/ql/lib/codeql/ruby/frameworks/terrapin/model.yml
new file mode 100644
index 000000000000..c111ca5efbc5
--- /dev/null
+++ b/ruby/ql/lib/codeql/ruby/frameworks/terrapin/model.yml
@@ -0,0 +1,41 @@
+extensions:
+ - addsTo:
+ pack: codeql/ruby-all
+ extensible: sourceModel
+ data: []
+
+ - addsTo:
+ pack: codeql/ruby-all
+ extensible: sinkModel
+ data:
+ - ["Terrapin::CommandLine!","Method[new].Argument[0]","command-injection"]
+ - ["Terrapin::CommandLine!","Method[new].Argument[1]","command-injection"]
+
+ - addsTo:
+ pack: codeql/ruby-all
+ extensible: summaryModel
+ data:
+ - ["Terrapin::CommandLine::Output!","Method[new]","Argument[1]","ReturnValue","value"]
+ - ["Terrapin::CommandLine!","Method[path=]","Argument[0]","ReturnValue","taint"]
+ - ["Terrapin::CommandLine!","Method[new]","Argument[2]","ReturnValue","taint"]
+
+ - addsTo:
+ pack: codeql/ruby-all
+ extensible: neutralModel
+ data: []
+
+ - addsTo:
+ pack: codeql/ruby-all
+ extensible: typeModel
+ data:
+ - ["Terrapin::CommandLine::Output","Terrapin::CommandLine::MultiPipe","Method[output].ReturnValue"]
+ - ["Terrapin::CommandLine::Output","Terrapin::CommandLine::FakeRunner","Method[call].ReturnValue"]
+ - ["Terrapin::CommandLine::Output","Terrapin::CommandLine::ProcessRunner","Method[call].ReturnValue"]
+ - ["Terrapin::CommandLine::Output","Terrapin::CommandLine!","Method[runner].ReturnValue.ReturnValue"]
+ - ["Terrapin::CommandLine::FakeRunner","Terrapin::CommandLine!","Method[runner].ReturnValue"]
+ - ["Terrapin::CommandLine::Output","Terrapin::CommandLine!","Method[fake!].ReturnValue.ReturnValue"]
+ - ["Terrapin::CommandLine::FakeRunner","Terrapin::CommandLine!","Method[fake!].ReturnValue"]
+ - ["Terrapin::CommandLine::Output","Terrapin::CommandLine","Method[output].ReturnValue"]
+ - ["Terrapin::CommandLineError","Terrapin::CommandNotFoundError",""]
+ - ["Terrapin::CommandLineError","Terrapin::ExitStatusError",""]
+ - ["Terrapin::CommandLineError","Terrapin::InterpolationError",""]
diff --git a/ruby/ql/test/query-tests/security/cwe-078/CommandInjection/CommandInjection.expected b/ruby/ql/test/query-tests/security/cwe-078/CommandInjection/CommandInjection.expected
index be4473409b78..0ca6e123e7b9 100644
--- a/ruby/ql/test/query-tests/security/cwe-078/CommandInjection/CommandInjection.expected
+++ b/ruby/ql/test/query-tests/security/cwe-078/CommandInjection/CommandInjection.expected
@@ -21,6 +21,9 @@ edges
| CommandInjection.rb:103:9:103:12 | file | CommandInjection.rb:104:16:104:28 | "cat #{...}" | provenance | |
| CommandInjection.rb:103:16:103:21 | call to params | CommandInjection.rb:103:16:103:28 | ...[...] | provenance | |
| CommandInjection.rb:103:16:103:28 | ...[...] | CommandInjection.rb:103:9:103:12 | file | provenance | |
+| CommandInjection.rb:111:33:111:38 | call to params | CommandInjection.rb:111:33:111:44 | ...[...] | provenance | |
+| CommandInjection.rb:113:44:113:49 | call to params | CommandInjection.rb:113:44:113:54 | ...[...] | provenance | |
+| CommandInjection.rb:113:44:113:54 | ...[...] | CommandInjection.rb:113:41:113:56 | "#{...}" | provenance | |
nodes
| CommandInjection.rb:6:9:6:11 | cmd | semmle.label | cmd |
| CommandInjection.rb:6:15:6:20 | call to params | semmle.label | call to params |
@@ -51,6 +54,11 @@ nodes
| CommandInjection.rb:103:16:103:21 | call to params | semmle.label | call to params |
| CommandInjection.rb:103:16:103:28 | ...[...] | semmle.label | ...[...] |
| CommandInjection.rb:104:16:104:28 | "cat #{...}" | semmle.label | "cat #{...}" |
+| CommandInjection.rb:111:33:111:38 | call to params | semmle.label | call to params |
+| CommandInjection.rb:111:33:111:44 | ...[...] | semmle.label | ...[...] |
+| CommandInjection.rb:113:41:113:56 | "#{...}" | semmle.label | "#{...}" |
+| CommandInjection.rb:113:44:113:49 | call to params | semmle.label | call to params |
+| CommandInjection.rb:113:44:113:54 | ...[...] | semmle.label | ...[...] |
subpaths
#select
| CommandInjection.rb:7:10:7:15 | #{...} | CommandInjection.rb:6:15:6:20 | call to params | CommandInjection.rb:7:10:7:15 | #{...} | This command depends on a $@. | CommandInjection.rb:6:15:6:20 | call to params | user-provided value |
@@ -67,3 +75,5 @@ subpaths
| CommandInjection.rb:82:14:82:34 | "echo #{...}" | CommandInjection.rb:81:23:81:33 | blah_number | CommandInjection.rb:82:14:82:34 | "echo #{...}" | This command depends on a $@. | CommandInjection.rb:81:23:81:33 | blah_number | user-provided value |
| CommandInjection.rb:91:14:91:39 | "echo #{...}" | CommandInjection.rb:91:22:91:37 | ...[...] | CommandInjection.rb:91:14:91:39 | "echo #{...}" | This command depends on a $@. | CommandInjection.rb:91:22:91:37 | ...[...] | user-provided value |
| CommandInjection.rb:104:16:104:28 | "cat #{...}" | CommandInjection.rb:103:16:103:21 | call to params | CommandInjection.rb:104:16:104:28 | "cat #{...}" | This command depends on a $@. | CommandInjection.rb:103:16:103:21 | call to params | user-provided value |
+| CommandInjection.rb:111:33:111:44 | ...[...] | CommandInjection.rb:111:33:111:38 | call to params | CommandInjection.rb:111:33:111:44 | ...[...] | This command depends on a $@. | CommandInjection.rb:111:33:111:38 | call to params | user-provided value |
+| CommandInjection.rb:113:41:113:56 | "#{...}" | CommandInjection.rb:113:44:113:49 | call to params | CommandInjection.rb:113:41:113:56 | "#{...}" | This command depends on a $@. | CommandInjection.rb:113:44:113:49 | call to params | user-provided value |
diff --git a/ruby/ql/test/query-tests/security/cwe-078/CommandInjection/CommandInjection.rb b/ruby/ql/test/query-tests/security/cwe-078/CommandInjection/CommandInjection.rb
index 4be9c95924a0..12c15a30b158 100644
--- a/ruby/ql/test/query-tests/security/cwe-078/CommandInjection/CommandInjection.rb
+++ b/ruby/ql/test/query-tests/security/cwe-078/CommandInjection/CommandInjection.rb
@@ -106,4 +106,13 @@ def create
system("cat #{file.shellescape}") # OK, because file is shell escaped
end
-end
\ No newline at end of file
+
+ def index
+ Terrapin::CommandLine.new(params[:foo], "bar") # BAD
+
+ Terrapin::CommandLine.new("echo", "#{params[foo]}") # BAD
+
+ cmd = Terrapin::CommandLine.new("echo", ":msg")
+ cmd.run(msg: params[:foo]) # GOOD
+ end
+end
From 3eb9491cb4e44659ddcbeed635bf6961eb49fef0 Mon Sep 17 00:00:00 2001
From: Rasmus Lerchedahl Petersen
Date: Mon, 26 Feb 2024 17:18:40 +0100
Subject: [PATCH 028/731] python: rewrite `HardcodedCredentials` away from
`PointsTo` - `ModuleValue.attr` and `ClassValue.lookup` are approximated by
`Function.getName` - `ClassValue.getName` is apprximated by `Class.getName` -
`Module::named` is approximated by `Module.getName` - `Value::named` is
approximated by `Builtins::likelyBuiltin` -
`FunctionValue.getNamedArgumentForCall` is approximated by
`ArgumentNode.argumentOf`
---
.../src/Security/CWE-798/HardcodedCredentials.ql | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
diff --git a/python/ql/src/Security/CWE-798/HardcodedCredentials.ql b/python/ql/src/Security/CWE-798/HardcodedCredentials.ql
index 0a92427ec230..04197b136103 100644
--- a/python/ql/src/Security/CWE-798/HardcodedCredentials.ql
+++ b/python/ql/src/Security/CWE-798/HardcodedCredentials.ql
@@ -16,6 +16,8 @@ import python
import semmle.python.dataflow.new.DataFlow
import semmle.python.dataflow.new.TaintTracking
import semmle.python.filters.Tests
+private import semmle.python.dataflow.new.internal.DataFlowDispatch as DataFlowDispatch
+private import semmle.python.dataflow.new.internal.Builtins::Builtins as Builtins
bindingset[char, fraction]
predicate fewer_characters_than(StrConst str, string char, float fraction) {
@@ -30,15 +32,13 @@ predicate fewer_characters_than(StrConst str, string char, float fraction) {
}
predicate possible_reflective_name(string name) {
- exists(any(ModuleValue m).attr(name))
+ any(Function f).getName() = name
or
- exists(any(ClassValue c).lookup(name))
+ any(Class c).getName() = name
or
- any(ClassValue c).getName() = name
+ any(Module m).getName() = name
or
- exists(Module::named(name))
- or
- exists(Value::named(name))
+ exists(Builtins::likelyBuiltin(name))
}
int char_count(StrConst str) { result = count(string c | c = str.getText().charAt(_)) }
@@ -84,7 +84,9 @@ class CredentialSink extends DataFlow::Node {
name.regexpMatch(getACredentialRegex()) and
not name.matches("%file")
|
- any(FunctionValue func).getNamedArgumentForCall(_, name) = this.asCfgNode()
+ exists(DataFlowDispatch::ArgumentPosition pos | pos.isKeyword(name) |
+ this.(DataFlow::ArgumentNode).argumentOf(_, pos)
+ )
or
exists(Keyword k | k.getArg() = name and k.getValue().getAFlowNode() = this.asCfgNode())
or
From 9ec17e6338c23a8189334c9082a6f9882f7c7027 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Mon, 26 Feb 2024 12:40:40 +0000
Subject: [PATCH 029/731] Shared: Pull out the shared parts of Java's type flow
library into a shared module.
---
shared/typeflow/codeql/typeflow/TypeFlow.qll | 118 +++++
.../codeql/typeflow/internal/TypeFlowImpl.qll | 445 ++++++++++++++++++
shared/typeflow/qlpack.yml | 7 +
3 files changed, 570 insertions(+)
create mode 100644 shared/typeflow/codeql/typeflow/TypeFlow.qll
create mode 100644 shared/typeflow/codeql/typeflow/internal/TypeFlowImpl.qll
create mode 100644 shared/typeflow/qlpack.yml
diff --git a/shared/typeflow/codeql/typeflow/TypeFlow.qll b/shared/typeflow/codeql/typeflow/TypeFlow.qll
new file mode 100644
index 000000000000..5df8e53a914b
--- /dev/null
+++ b/shared/typeflow/codeql/typeflow/TypeFlow.qll
@@ -0,0 +1,118 @@
+/**
+ * Provides predicates for giving improved type bounds on expressions.
+ *
+ * An inferred bound on the runtime type of an expression can be either exact
+ * or merely an upper bound. Bounds are only reported if they are likely to be
+ * better than the static bound, which can happen either if an inferred exact
+ * type has a subtype or if an inferred upper bound passed through at least one
+ * explicit or implicit cast that lost type information.
+ */
+
+/** Provides the input specification. */
+signature module TypeFlowInput {
+ /**
+ * A node for which type information is available. For example, expressions
+ * and method declarations.
+ */
+ class TypeFlowNode {
+ /** Gets a textual representation of this node. */
+ string toString();
+
+ /** Gets the type of this node. */
+ Type getType();
+
+ /**
+ * Holds if this element is at the specified location.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `filepath`.
+ * For more information, see
+ * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+ */
+ predicate hasLocationInfo(
+ string filepath, int startline, int startcolumn, int endline, int endcolumn
+ );
+ }
+
+ /**
+ * Holds if data can flow from `n1` to `n2` in one step, and `n1` is not
+ * necessarily functionally determined by `n2`.
+ */
+ predicate joinStep0(TypeFlowNode n1, TypeFlowNode n2);
+
+ /**
+ * Holds if data can flow from `n1` to `n2` in one step, and `n1` is
+ * functionally determined by `n2`.
+ */
+ predicate step(TypeFlowNode n1, TypeFlowNode n2);
+
+ /**
+ * Holds if `null` is the only value that flows to `n`.
+ */
+ predicate isNull(TypeFlowNode n);
+
+ /** A type. */
+ class Type {
+ /** Gets a textual representation of this type. */
+ string toString();
+
+ /** Gets a direct super type of this type. */
+ Type getASupertype();
+ }
+
+ /**
+ * Gets the source declaration of this type, or `t` if `t` is already a
+ * source declaration.
+ */
+ default Type getSourceDeclaration(Type t) { result = t }
+
+ /**
+ * Gets the erased version of this type. The erasure of a erasure of a
+ * parameterized type is its generic counterpart, or `t` if `t` is already
+ * fully erased.
+ */
+ default Type getErasure(Type t) { result = t }
+
+ /** Gets a direct or indirect supertype of this type, including itself. */
+ default Type getAnAncestor(Type sub) {
+ result = sub
+ or
+ exists(Type mid | result = mid.getASupertype() and sub = getAnAncestor(mid))
+ }
+
+ /**
+ * Holds if `t` is the most precise type of `n`, if any.
+ */
+ predicate exactTypeBase(TypeFlowNode n, Type t);
+
+ /**
+ * Holds if `n` has type `t` and this information is discarded, such that `t`
+ * might be a better type bound for nodes where `n` flows to. This might include
+ * multiple bounds for a single node.
+ */
+ predicate typeFlowBaseCand(TypeFlowNode n, Type t);
+
+ /**
+ * Holds if `n` is a value that is guarded by a disjunction of a dynamic type
+ * check that checks if `n` is an instance of type `t_i` where `t` is one of
+ * those `t_i`.
+ */
+ default predicate instanceofDisjunctionGuarded(TypeFlowNode n, Type t) { none() }
+
+ /**
+ * Holds if `t` is a raw type or parameterised type with unrestricted type
+ * arguments.
+ *
+ * By default, no types are unbound.
+ */
+ default predicate unbound(Type t) { none() }
+}
+
+private import internal.TypeFlowImpl as Impl
+
+/**
+ * Provides an implementation of type-flow using input `I`.
+ */
+cached
+module Make {
+ import Impl::TypeFlow
+}
diff --git a/shared/typeflow/codeql/typeflow/internal/TypeFlowImpl.qll b/shared/typeflow/codeql/typeflow/internal/TypeFlowImpl.qll
new file mode 100644
index 000000000000..121bc605dbc6
--- /dev/null
+++ b/shared/typeflow/codeql/typeflow/internal/TypeFlowImpl.qll
@@ -0,0 +1,445 @@
+private import codeql.typeflow.TypeFlow
+private import codeql.util.Unit
+
+module TypeFlow {
+ private import I
+
+ /**
+ * Holds if data can flow from `n1` to `n2` in one step, `n1` is not necessarily
+ * functionally determined by `n2`, and `n1` might take a non-null value.
+ */
+ predicate joinStep(TypeFlowNode n1, TypeFlowNode n2) { joinStep0(n1, n2) and not isNull(n1) }
+
+ private predicate anyStep(TypeFlowNode n1, TypeFlowNode n2) { joinStep(n1, n2) or step(n1, n2) }
+
+ private predicate sccEdge(TypeFlowNode n1, TypeFlowNode n2) {
+ anyStep(n1, n2) and anyStep+(n2, n1)
+ }
+
+ private module Scc = QlBuiltins::EquivalenceRelation;
+
+ private class TypeFlowScc = Scc::EquivalenceClass;
+
+ /** Holds if `n` is part of an SCC of size 2 or more represented by `scc`. */
+ private predicate sccRepr(TypeFlowNode n, TypeFlowScc scc) { scc = Scc::getEquivalenceClass(n) }
+
+ private predicate sccJoinStep(TypeFlowNode n, TypeFlowScc scc) {
+ exists(TypeFlowNode mid |
+ joinStep(n, mid) and
+ sccRepr(mid, scc) and
+ not sccRepr(n, scc)
+ )
+ }
+
+ private signature class NodeSig;
+
+ private signature module Edge {
+ class Node;
+
+ predicate edge(TypeFlowNode n1, Node n2);
+ }
+
+ private signature module RankedEdge {
+ predicate edgeRank(int r, TypeFlowNode n1, Node n2);
+
+ int lastRank(Node n);
+ }
+
+ private module RankEdge implements RankedEdge {
+ private import E
+
+ /**
+ * Holds if `r` is a ranking of the incoming edges `(n1,n2)` to `n2`. The used
+ * ordering is not necessarily total, so the ranking may have gaps.
+ */
+ private predicate edgeRank1(int r, TypeFlowNode n1, Node n2) {
+ n1 =
+ rank[r](TypeFlowNode n, int startline, int startcolumn |
+ edge(n, n2) and
+ n.hasLocationInfo(_, startline, startcolumn, _, _)
+ |
+ n order by startline, startcolumn
+ )
+ }
+
+ /**
+ * Holds if `r2` is a ranking of the ranks from `edgeRank1`. This removes the
+ * gaps from the ranking.
+ */
+ private predicate edgeRank2(int r2, int r1, Node n) {
+ r1 = rank[r2](int r | edgeRank1(r, _, n) | r)
+ }
+
+ /** Holds if `r` is a ranking of the incoming edges `(n1,n2)` to `n2`. */
+ predicate edgeRank(int r, TypeFlowNode n1, Node n2) {
+ exists(int r1 |
+ edgeRank1(r1, n1, n2) and
+ edgeRank2(r, r1, n2)
+ )
+ }
+
+ int lastRank(Node n) { result = max(int r | edgeRank(r, _, n)) }
+ }
+
+ private signature module TypePropagation {
+ class Typ;
+
+ predicate candType(TypeFlowNode n, Typ t);
+
+ bindingset[t]
+ predicate supportsType(TypeFlowNode n, Typ t);
+ }
+
+ /** Implements recursion through `forall` by way of edge ranking. */
+ private module ForAll E, TypePropagation T> {
+ /**
+ * Holds if `t` is a bound that holds on one of the incoming edges to `n` and
+ * thus is a candidate bound for `n`.
+ */
+ pragma[nomagic]
+ private predicate candJoinType(Node n, T::Typ t) {
+ exists(TypeFlowNode mid |
+ T::candType(mid, t) and
+ E::edgeRank(_, mid, n)
+ )
+ }
+
+ /**
+ * Holds if `t` is a candidate bound for `n` that is also valid for data coming
+ * through the edges into `n` ranked from `1` to `r`.
+ */
+ private predicate flowJoin(int r, Node n, T::Typ t) {
+ (
+ r = 1 and candJoinType(n, t)
+ or
+ flowJoin(r - 1, n, t) and E::edgeRank(r, _, n)
+ ) and
+ forall(TypeFlowNode mid | E::edgeRank(r, mid, n) | T::supportsType(mid, t))
+ }
+
+ /**
+ * Holds if `t` is a candidate bound for `n` that is also valid for data
+ * coming through all the incoming edges, and therefore is a valid bound for
+ * `n`.
+ */
+ predicate flowJoin(Node n, T::Typ t) { flowJoin(E::lastRank(n), n, t) }
+ }
+
+ private module JoinStep implements Edge {
+ class Node = TypeFlowNode;
+
+ predicate edge = joinStep/2;
+ }
+
+ private module SccJoinStep implements Edge {
+ class Node = TypeFlowScc;
+
+ predicate edge = sccJoinStep/2;
+ }
+
+ private module RankedJoinStep = RankEdge;
+
+ private module RankedSccJoinStep = RankEdge;
+
+ private module ExactTypePropagation implements TypePropagation {
+ class Typ = Type;
+
+ predicate candType = exactType/2;
+
+ predicate supportsType = exactType/2;
+ }
+
+ /**
+ * Holds if the runtime type of `n` is exactly `t` and if this bound is a
+ * non-trivial lower bound, that is, `t` has a subtype.
+ */
+ private predicate exactType(TypeFlowNode n, Type t) {
+ exactTypeBase(n, t)
+ or
+ exists(TypeFlowNode mid | exactType(mid, t) and step(mid, n))
+ or
+ // The following is an optimized version of
+ // `forex(TypeFlowNode mid | joinStep(mid, n) | exactType(mid, t))`
+ ForAll::flowJoin(n, t)
+ or
+ exists(TypeFlowScc scc |
+ sccRepr(n, scc) and
+ // Optimized version of
+ // `forex(TypeFlowNode mid | sccJoinStep(mid, scc) | exactType(mid, t))`
+ ForAll::flowJoin(scc, t)
+ )
+ }
+
+ /**
+ * Gets the source declaration of a direct supertype of this type, excluding itself.
+ */
+ private Type getASourceSupertype(Type t) {
+ result = getSourceDeclaration(t.getASupertype()) and
+ result != t
+ }
+
+ /**
+ * Holds if `n` has type `t` and this information is discarded, such that `t`
+ * might be a better type bound for nodes where `n` flows to. This only includes
+ * the best such bound for each node.
+ */
+ private predicate typeFlowBase(TypeFlowNode n, Type t) {
+ exists(Type te |
+ typeFlowBaseCand(n, t) and
+ te = getErasure(t) and
+ not exists(Type better |
+ typeFlowBaseCand(n, better) and
+ better != t and
+ not t.getASupertype+() = better
+ |
+ better.getASupertype+() = t or
+ getASourceSupertype+(getErasure(better)) = te
+ )
+ )
+ }
+
+ private module TypeFlowPropagation implements TypePropagation {
+ class Typ = Type;
+
+ predicate candType = typeFlow/2;
+
+ bindingset[t]
+ predicate supportsType(TypeFlowNode mid, Type t) {
+ exists(Type midtyp | exactType(mid, midtyp) or typeFlow(mid, midtyp) |
+ getAnAncestor(pragma[only_bind_out](midtyp)) = t
+ )
+ }
+ }
+
+ /**
+ * Holds if the runtime type of `n` is bounded by `t` and if this bound is
+ * likely to be better than the static type of `n`.
+ */
+ private predicate typeFlow(TypeFlowNode n, Type t) {
+ typeFlowBase(n, t)
+ or
+ exists(TypeFlowNode mid | typeFlow(mid, t) and step(mid, n))
+ or
+ ForAll::flowJoin(n, t)
+ or
+ exists(TypeFlowScc scc |
+ sccRepr(n, scc) and
+ ForAll::flowJoin(scc, t)
+ )
+ }
+
+ pragma[nomagic]
+ private predicate erasedTypeBound(Type t) {
+ exists(Type t0 | typeFlow(_, t0) and t = getErasure(t0))
+ }
+
+ pragma[nomagic]
+ private predicate typeBound(Type t) { typeFlow(_, t) }
+
+ /**
+ * Gets a direct or indirect supertype of this type.
+ * This does not include itself, unless this type is part of a cycle
+ * in the type hierarchy.
+ */
+ Type getAStrictAncestor(Type sub) { result = getAnAncestor(sub.getASupertype()) }
+
+ /**
+ * Holds if we have a bound for `n` that is better than `t`.
+ */
+ pragma[nomagic]
+ private predicate irrelevantBound(TypeFlowNode n, Type t) {
+ exists(Type bound |
+ typeFlow(n, bound) and
+ t = getAStrictAncestor(bound) and
+ typeBound(t) and
+ typeFlow(n, pragma[only_bind_into](t)) and
+ not getAnAncestor(t) = bound
+ or
+ n.getType() = pragma[only_bind_into](bound) and
+ typeFlow(n, t) and
+ t = getAnAncestor(bound)
+ )
+ }
+
+ /**
+ * Holds if we have a bound for `n` that is better than `t`, taking only erased
+ * types into account.
+ */
+ pragma[nomagic]
+ private predicate irrelevantErasedBound(TypeFlowNode n, Type t) {
+ exists(Type bound |
+ typeFlow(n, bound)
+ or
+ n.getType() = bound and typeFlow(n, _)
+ |
+ t = getASourceSupertype+(getErasure(bound)) and
+ erasedTypeBound(t)
+ )
+ }
+
+ /**
+ * Holds if the runtime type of `n` is bounded by `t`, if this bound is likely
+ * to be better than the static type of `n`, and if this the best such bound.
+ */
+ private predicate bestTypeFlow(TypeFlowNode n, Type t) {
+ typeFlow(n, t) and
+ not irrelevantErasedBound(n, getErasure(t)) and
+ not irrelevantBound(n, t)
+ }
+
+ predicate bestTypeFlow(TypeFlowNode n, Type t, boolean exact) {
+ exactType(n, t) and exact = true
+ or
+ not exactType(n, _) and bestTypeFlow(n, t) and exact = false
+ }
+
+ private predicate bestTypeFlowOrTypeFlowBase(TypeFlowNode n, Type t, boolean exact) {
+ bestTypeFlow(n, t, exact)
+ or
+ typeFlowBase(n, t) and
+ exact = false and
+ not bestTypeFlow(n, _, _)
+ }
+
+ /**
+ * Holds if `n` has type `t` and this information is not propagated as a
+ * universal bound to a subsequent node, such that `t` might form the basis for
+ * a union type bound for that node.
+ */
+ private predicate unionTypeFlowBaseCand(TypeFlowNode n, Type t, boolean exact) {
+ exists(TypeFlowNode next |
+ joinStep(n, next) and
+ bestTypeFlowOrTypeFlowBase(n, t, exact) and
+ not bestTypeFlowOrTypeFlowBase(next, t, exact) and
+ not exactType(next, _)
+ )
+ }
+
+ private module HasUnionTypePropagation implements TypePropagation {
+ class Typ = Unit;
+
+ predicate candType(TypeFlowNode mid, Unit unit) {
+ exists(unit) and
+ (unionTypeFlowBaseCand(mid, _, _) or hasUnionTypeFlow(mid))
+ }
+
+ predicate supportsType = candType/2;
+ }
+
+ /**
+ * Holds if all incoming type flow can be traced back to a
+ * `unionTypeFlowBaseCand`, such that we can compute a union type bound for `n`.
+ * Disregards nodes for which we have an exact bound.
+ */
+ private predicate hasUnionTypeFlow(TypeFlowNode n) {
+ not exactType(n, _) and
+ (
+ // Optimized version of
+ // `forex(TypeFlowNode mid | joinStep(mid, n) | unionTypeFlowBaseCand(mid, _, _) or hasUnionTypeFlow(mid))`
+ ForAll::flowJoin(n, _)
+ or
+ exists(TypeFlowScc scc |
+ sccRepr(n, scc) and
+ // Optimized version of
+ // `forex(TypeFlowNode mid | sccJoinStep(mid, scc) | unionTypeFlowBaseCand(mid, _, _) or hasUnionTypeFlow(mid))`
+ ForAll::flowJoin(scc, _)
+ )
+ or
+ exists(TypeFlowNode mid | step(mid, n) and hasUnionTypeFlow(mid))
+ or
+ instanceofDisjunctionGuarded(n, _)
+ )
+ }
+
+ pragma[nomagic]
+ private Type getTypeBound(TypeFlowNode n) {
+ bestTypeFlow(n, result)
+ or
+ not bestTypeFlow(n, _) and result = n.getType()
+ }
+
+ pragma[nomagic]
+ private predicate unionTypeFlow0(TypeFlowNode n, Type t, boolean exact) {
+ hasUnionTypeFlow(n) and
+ (
+ exists(TypeFlowNode mid | anyStep(mid, n) |
+ unionTypeFlowBaseCand(mid, t, exact) or unionTypeFlow(mid, t, exact)
+ )
+ or
+ instanceofDisjunctionGuarded(n, t) and exact = false
+ )
+ }
+
+ /**
+ * Holds if there is a common (reflexive, transitive) subtype of the erased
+ * types `t1` and `t2`.
+ */
+ private predicate erasedHaveIntersection(Type t1, Type t2) {
+ exists(Type commonSub | commonSub = getSourceDeclaration(commonSub) |
+ getASourceSupertype*(commonSub) = t1 and
+ getASourceSupertype*(commonSub) = t2
+ ) and
+ t1 = getErasure(_) and
+ t2 = getErasure(_)
+ }
+
+ /** Holds if we have a union type bound for `n` and `t` is one of its parts. */
+ private predicate unionTypeFlow(TypeFlowNode n, Type t, boolean exact) {
+ unionTypeFlow0(n, t, exact) and
+ // filter impossible union parts:
+ exists(Type tErased, Type boundErased |
+ pragma[only_bind_into](tErased) = getErasure(t) and
+ pragma[only_bind_into](boundErased) = getErasure(getTypeBound(n))
+ |
+ if exact = true
+ then getASourceSupertype*(tErased) = boundErased
+ else erasedHaveIntersection(tErased, boundErased)
+ )
+ }
+
+ /**
+ * Holds if the inferred union type bound for `n` contains the best universal
+ * bound and thus is irrelevant.
+ */
+ private predicate irrelevantUnionType(TypeFlowNode n) {
+ exists(Type t, Type nt, Type te, Type nte |
+ unionTypeFlow(n, t, false) and
+ nt = getTypeBound(n) and
+ te = getErasure(t) and
+ nte = getErasure(nt)
+ |
+ nt.getASupertype*() = t
+ or
+ getASourceSupertype+(nte) = te
+ or
+ nte = te and unbound(t)
+ )
+ }
+
+ /**
+ * Holds if `t` is an irrelevant part of the union type bound for `n` due to
+ * being contained in another part of the union type bound.
+ */
+ private predicate irrelevantUnionTypePart(TypeFlowNode n, Type t, boolean exact) {
+ unionTypeFlow(n, t, exact) and
+ not irrelevantUnionType(n) and
+ exists(Type weaker |
+ unionTypeFlow(n, weaker, false) and
+ t.getASupertype*() = weaker
+ |
+ exact = true or not weaker.getASupertype*() = t
+ )
+ }
+
+ /**
+ * Holds if the runtime type of `n` is bounded by a union type and if this
+ * bound is likely to be better than the static type of `n`. The union type is
+ * made up of the types `t` related to `n` by this predicate, and the flag
+ * `exact` indicates whether `t` is an exact bound or merely an upper bound.
+ */
+ predicate bestUnionType(TypeFlowNode n, Type t, boolean exact) {
+ unionTypeFlow(n, t, exact) and
+ not irrelevantUnionType(n) and
+ not irrelevantUnionTypePart(n, t, exact)
+ }
+}
diff --git a/shared/typeflow/qlpack.yml b/shared/typeflow/qlpack.yml
new file mode 100644
index 000000000000..6bc23bcd4fc4
--- /dev/null
+++ b/shared/typeflow/qlpack.yml
@@ -0,0 +1,7 @@
+name: codeql/typeflow
+version: 0.0.1-dev
+groups: shared
+library: true
+dependencies:
+ codeql/util: ${workspace}
+warnOnImplicitThis: true
\ No newline at end of file
From 1d4c889ab87d4a1094b1c912e4e865d6805e089d Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Mon, 26 Feb 2024 12:40:56 +0000
Subject: [PATCH 030/731] Java: Use the shared type-flow library.
---
java/ql/lib/qlpack.yml | 1 +
.../semmle/code/java/dataflow/TypeFlow.qll | 979 ++++++------------
2 files changed, 295 insertions(+), 685 deletions(-)
diff --git a/java/ql/lib/qlpack.yml b/java/ql/lib/qlpack.yml
index 15b4982d41eb..82701ce60668 100644
--- a/java/ql/lib/qlpack.yml
+++ b/java/ql/lib/qlpack.yml
@@ -13,6 +13,7 @@ dependencies:
codeql/threat-models: ${workspace}
codeql/tutorial: ${workspace}
codeql/typetracking: ${workspace}
+ codeql/typeflow: ${workspace}
codeql/util: ${workspace}
dataExtensions:
- ext/*.model.yml
diff --git a/java/ql/lib/semmle/code/java/dataflow/TypeFlow.qll b/java/ql/lib/semmle/code/java/dataflow/TypeFlow.qll
index ea0df55d60fb..9a29809f15cc 100644
--- a/java/ql/lib/semmle/code/java/dataflow/TypeFlow.qll
+++ b/java/ql/lib/semmle/code/java/dataflow/TypeFlow.qll
@@ -8,747 +8,356 @@
* explicit or implicit cast that lost type information.
*/
-import java
+import java as J
private import semmle.code.java.dispatch.VirtualDispatch
private import semmle.code.java.dataflow.internal.BaseSSA
private import semmle.code.java.controlflow.Guards
-
-private newtype TTypeFlowNode =
- TField(Field f) { not f.getType() instanceof PrimitiveType } or
- TSsa(BaseSsaVariable ssa) { not ssa.getSourceVariable().getType() instanceof PrimitiveType } or
- TExpr(Expr e) or
- TMethod(Method m) { not m.getReturnType() instanceof PrimitiveType }
-
-/**
- * A `Field`, `BaseSsaVariable`, `Expr`, or `Method`.
- */
-private class TypeFlowNode extends TTypeFlowNode {
- string toString() {
- result = this.asField().toString() or
- result = this.asSsa().toString() or
- result = this.asExpr().toString() or
- result = this.asMethod().toString()
+private import codeql.typeflow.TypeFlow
+
+private module Input implements TypeFlowInput {
+ private newtype TTypeFlowNode =
+ TField(Field f) { not f.getType() instanceof PrimitiveType } or
+ TSsa(BaseSsaVariable ssa) { not ssa.getSourceVariable().getType() instanceof PrimitiveType } or
+ TExpr(Expr e) or
+ TMethod(Method m) { not m.getReturnType() instanceof PrimitiveType }
+
+ /** Gets `t` if it is a `RefType` or the boxed type if `t` is a primitive type. */
+ private RefType boxIfNeeded(J::Type t) {
+ t.(J::PrimitiveType).getBoxedType() = result or
+ result = t
}
- Location getLocation() {
- result = this.asField().getLocation() or
- result = this.asSsa().getLocation() or
- result = this.asExpr().getLocation() or
- result = this.asMethod().getLocation()
+ /**
+ * A `Field`, `BaseSsaVariable`, `Expr`, or `Method`.
+ */
+ class TypeFlowNode extends TTypeFlowNode {
+ string toString() {
+ result = this.asField().toString() or
+ result = this.asSsa().toString() or
+ result = this.asExpr().toString() or
+ result = this.asMethod().toString()
+ }
+
+ predicate hasLocationInfo(
+ string filepath, int startline, int startcolumn, int endline, int endcolumn
+ ) {
+ this.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+ }
+
+ Location getLocation() {
+ result = this.asField().getLocation() or
+ result = this.asSsa().getLocation() or
+ result = this.asExpr().getLocation() or
+ result = this.asMethod().getLocation()
+ }
+
+ Field asField() { this = TField(result) }
+
+ BaseSsaVariable asSsa() { this = TSsa(result) }
+
+ Expr asExpr() { this = TExpr(result) }
+
+ Method asMethod() { this = TMethod(result) }
+
+ RefType getType() {
+ result = this.asField().getType() or
+ result = this.asSsa().getSourceVariable().getType() or
+ result = boxIfNeeded(this.asExpr().getType()) or
+ result = this.asMethod().getReturnType()
+ }
}
- Field asField() { this = TField(result) }
-
- BaseSsaVariable asSsa() { this = TSsa(result) }
-
- Expr asExpr() { this = TExpr(result) }
+ class Type = J::RefType;
- Method asMethod() { this = TMethod(result) }
-
- RefType getType() {
- result = this.asField().getType() or
- result = this.asSsa().getSourceVariable().getType() or
- result = boxIfNeeded(this.asExpr().getType()) or
- result = this.asMethod().getReturnType()
+ /**
+ * Holds if `arg` is an argument for the parameter `p` in a private callable.
+ */
+ private predicate privateParamArg(Parameter p, Argument arg) {
+ p.getAnArgument() = arg and
+ p.getCallable().isPrivate()
}
-}
-
-/** Gets `t` if it is a `RefType` or the boxed type if `t` is a primitive type. */
-private RefType boxIfNeeded(Type t) {
- t.(PrimitiveType).getBoxedType() = result or
- result = t
-}
-
-/**
- * Holds if `arg` is an argument for the parameter `p` in a private callable.
- */
-private predicate privateParamArg(Parameter p, Argument arg) {
- p.getAnArgument() = arg and
- p.getCallable().isPrivate()
-}
-
-/**
- * Holds if data can flow from `n1` to `n2` in one step, and `n1` is not
- * necessarily functionally determined by `n2`.
- */
-private predicate joinStep0(TypeFlowNode n1, TypeFlowNode n2) {
- n2.asExpr().(ChooseExpr).getAResultExpr() = n1.asExpr()
- or
- exists(Field f, Expr e |
- f = n2.asField() and
- f.getAnAssignedValue() = e and
- e = n1.asExpr() and
- not e.(FieldAccess).getField() = f
- )
- or
- n2.asSsa().(BaseSsaPhiNode).getAnUltimateLocalDefinition() = n1.asSsa()
- or
- exists(ReturnStmt ret |
- n2.asMethod() = ret.getEnclosingCallable() and ret.getResult() = n1.asExpr()
- )
- or
- viableImpl_v1(n2.asExpr()) = n1.asMethod()
- or
- exists(Argument arg, Parameter p |
- privateParamArg(p, arg) and
- n1.asExpr() = arg and
- n2.asSsa().(BaseSsaImplicitInit).isParameterDefinition(p) and
- // skip trivial recursion
- not arg = n2.asSsa().getAUse()
- )
-}
-
-/**
- * Holds if data can flow from `n1` to `n2` in one step, and `n1` is
- * functionally determined by `n2`.
- */
-private predicate step(TypeFlowNode n1, TypeFlowNode n2) {
- n2.asExpr() = n1.asField().getAnAccess()
- or
- n2.asExpr() = n1.asSsa().getAUse()
- or
- n2.asExpr().(CastingExpr).getExpr() = n1.asExpr() and
- not n2.asExpr().getType() instanceof PrimitiveType
- or
- n2.asExpr().(AssignExpr).getSource() = n1.asExpr() and
- not n2.asExpr().getType() instanceof PrimitiveType
- or
- n2.asSsa().(BaseSsaUpdate).getDefiningExpr().(VariableAssign).getSource() = n1.asExpr()
- or
- n2.asSsa().(BaseSsaImplicitInit).captures(n1.asSsa())
-}
-
-/**
- * Holds if `null` is the only value that flows to `n`.
- */
-private predicate isNull(TypeFlowNode n) {
- n.asExpr() instanceof NullLiteral
- or
- exists(LocalVariableDeclExpr decl |
- n.asSsa().(BaseSsaUpdate).getDefiningExpr() = decl and
- not decl.hasImplicitInit() and
- not exists(decl.getInit())
- )
- or
- exists(TypeFlowNode mid | isNull(mid) and step(mid, n))
- or
- forex(TypeFlowNode mid | joinStep0(mid, n) | isNull(mid)) and
- // Fields that are never assigned a non-null value are probably set by
- // reflection and are thus not always null.
- not exists(n.asField())
-}
-
-/**
- * Holds if data can flow from `n1` to `n2` in one step, `n1` is not necessarily
- * functionally determined by `n2`, and `n1` might take a non-null value.
- */
-private predicate joinStep(TypeFlowNode n1, TypeFlowNode n2) {
- joinStep0(n1, n2) and not isNull(n1)
-}
-
-private predicate anyStep(TypeFlowNode n1, TypeFlowNode n2) { joinStep(n1, n2) or step(n1, n2) }
-
-private predicate sccEdge(TypeFlowNode n1, TypeFlowNode n2) { anyStep(n1, n2) and anyStep+(n2, n1) }
-
-private module Scc = QlBuiltins::EquivalenceRelation;
-
-private class TypeFlowScc = Scc::EquivalenceClass;
-
-/** Holds if `n` is part of an SCC of size 2 or more represented by `scc`. */
-private predicate sccRepr(TypeFlowNode n, TypeFlowScc scc) { scc = Scc::getEquivalenceClass(n) }
-
-private predicate sccJoinStep(TypeFlowNode n, TypeFlowScc scc) {
- exists(TypeFlowNode mid |
- joinStep(n, mid) and
- sccRepr(mid, scc) and
- not sccRepr(n, scc)
- )
-}
-
-private signature class NodeSig;
-
-private signature module Edge {
- class Node;
-
- predicate edge(TypeFlowNode n1, Node n2);
-}
-
-private signature module RankedEdge {
- predicate edgeRank(int r, TypeFlowNode n1, Node n2);
-
- int lastRank(Node n);
-}
-
-private module RankEdge implements RankedEdge {
- private import E
/**
- * Holds if `r` is a ranking of the incoming edges `(n1,n2)` to `n2`. The used
- * ordering is not necessarily total, so the ranking may have gaps.
+ * Holds if data can flow from `n1` to `n2` in one step, and `n1` is not
+ * necessarily functionally determined by `n2`.
*/
- private predicate edgeRank1(int r, TypeFlowNode n1, Node n2) {
- n1 =
- rank[r](TypeFlowNode n |
- edge(n, n2)
- |
- n order by n.getLocation().getStartLine(), n.getLocation().getStartColumn()
- )
+ predicate joinStep0(TypeFlowNode n1, TypeFlowNode n2) {
+ n2.asExpr().(ChooseExpr).getAResultExpr() = n1.asExpr()
+ or
+ exists(Field f, Expr e |
+ f = n2.asField() and
+ f.getAnAssignedValue() = e and
+ e = n1.asExpr() and
+ not e.(FieldAccess).getField() = f
+ )
+ or
+ n2.asSsa().(BaseSsaPhiNode).getAnUltimateLocalDefinition() = n1.asSsa()
+ or
+ exists(ReturnStmt ret |
+ n2.asMethod() = ret.getEnclosingCallable() and ret.getResult() = n1.asExpr()
+ )
+ or
+ viableImpl_v1(n2.asExpr()) = n1.asMethod()
+ or
+ exists(Argument arg, Parameter p |
+ privateParamArg(p, arg) and
+ n1.asExpr() = arg and
+ n2.asSsa().(BaseSsaImplicitInit).isParameterDefinition(p) and
+ // skip trivial recursion
+ not arg = n2.asSsa().getAUse()
+ )
}
/**
- * Holds if `r2` is a ranking of the ranks from `edgeRank1`. This removes the
- * gaps from the ranking.
+ * Holds if data can flow from `n1` to `n2` in one step, and `n1` is
+ * functionally determined by `n2`.
*/
- private predicate edgeRank2(int r2, int r1, Node n) {
- r1 = rank[r2](int r | edgeRank1(r, _, n) | r)
+ predicate step(TypeFlowNode n1, TypeFlowNode n2) {
+ n2.asExpr() = n1.asField().getAnAccess()
+ or
+ n2.asExpr() = n1.asSsa().getAUse()
+ or
+ n2.asExpr().(CastingExpr).getExpr() = n1.asExpr() and
+ not n2.asExpr().getType() instanceof PrimitiveType
+ or
+ n2.asExpr().(AssignExpr).getSource() = n1.asExpr() and
+ not n2.asExpr().getType() instanceof PrimitiveType
+ or
+ n2.asSsa().(BaseSsaUpdate).getDefiningExpr().(VariableAssign).getSource() = n1.asExpr()
+ or
+ n2.asSsa().(BaseSsaImplicitInit).captures(n1.asSsa())
}
- /** Holds if `r` is a ranking of the incoming edges `(n1,n2)` to `n2`. */
- predicate edgeRank(int r, TypeFlowNode n1, Node n2) {
- exists(int r1 |
- edgeRank1(r1, n1, n2) and
- edgeRank2(r, r1, n2)
+ /**
+ * Holds if `null` is the only value that flows to `n`.
+ */
+ predicate isNull(TypeFlowNode n) {
+ n.asExpr() instanceof NullLiteral
+ or
+ exists(LocalVariableDeclExpr decl |
+ n.asSsa().(BaseSsaUpdate).getDefiningExpr() = decl and
+ not decl.hasImplicitInit() and
+ not exists(decl.getInit())
)
+ or
+ exists(TypeFlowNode mid | isNull(mid) and step(mid, n))
+ or
+ forex(TypeFlowNode mid | joinStep0(mid, n) | isNull(mid)) and
+ // Fields that are never assigned a non-null value are probably set by
+ // reflection and are thus not always null.
+ not exists(n.asField())
}
- int lastRank(Node n) { result = max(int r | edgeRank(r, _, n)) }
-}
-
-private signature module TypePropagation {
- class Typ;
-
- predicate candType(TypeFlowNode n, Typ t);
-
- bindingset[t]
- predicate supportsType(TypeFlowNode n, Typ t);
-}
+ predicate exactTypeBase(TypeFlowNode n, RefType t) {
+ exists(J::ClassInstanceExpr e |
+ n.asExpr() = e and
+ e.getType() = t and
+ not e instanceof FunctionalExpr and
+ exists(SrcRefType sub | sub.getASourceSupertype() = t.getSourceDeclaration())
+ )
+ }
-/** Implements recursion through `forall` by way of edge ranking. */
-private module ForAll E, TypePropagation T> {
/**
- * Holds if `t` is a bound that holds on one of the incoming edges to `n` and
- * thus is a candidate bound for `n`.
+ * Holds if `n` occurs in a position where type information might be discarded;
+ * `t1` is the type of `n`, `t1e` is the erasure of `t1`, `t2` is the type of
+ * the implicit or explicit cast, and `t2e` is the erasure of `t2`.
*/
pragma[nomagic]
- private predicate candJoinType(Node n, T::Typ t) {
- exists(TypeFlowNode mid |
- T::candType(mid, t) and
- E::edgeRank(_, mid, n)
+ private predicate upcastCand(TypeFlowNode n, RefType t1, RefType t1e, RefType t2, RefType t2e) {
+ exists(TypeFlowNode next | step(n, next) or Make::joinStep(n, next) |
+ n.getType() = t1 and
+ next.getType() = t2 and
+ t1.getErasure() = t1e and
+ t2.getErasure() = t2e and
+ t1 != t2
)
}
- /**
- * Holds if `t` is a candidate bound for `n` that is also valid for data coming
- * through the edges into `n` ranked from `1` to `r`.
- */
- private predicate flowJoin(int r, Node n, T::Typ t) {
- (
- r = 1 and candJoinType(n, t)
+ /** Holds if `n` occurs in a position where type information is discarded. */
+ private predicate upcast(TypeFlowNode n, RefType t1) {
+ exists(RefType t1e, RefType t2, RefType t2e | upcastCand(n, t1, t1e, t2, t2e) |
+ t1e.getASourceSupertype+() = t2e
or
- flowJoin(r - 1, n, t) and E::edgeRank(r, _, n)
- ) and
- forall(TypeFlowNode mid | E::edgeRank(r, mid, n) | T::supportsType(mid, t))
+ t1e = t2e and
+ unbound(t2) and
+ not unbound(t1)
+ )
}
- /**
- * Holds if `t` is a candidate bound for `n` that is also valid for data
- * coming through all the incoming edges, and therefore is a valid bound for
- * `n`.
- */
- predicate flowJoin(Node n, T::Typ t) { flowJoin(E::lastRank(n), n, t) }
-}
-
-private module JoinStep implements Edge {
- class Node = TypeFlowNode;
-
- predicate edge = joinStep/2;
-}
-
-private module SccJoinStep implements Edge {
- class Node = TypeFlowScc;
-
- predicate edge = sccJoinStep/2;
-}
-
-private module RankedJoinStep = RankEdge;
-
-private module RankedSccJoinStep = RankEdge;
-
-private predicate exactTypeBase(TypeFlowNode n, RefType t) {
- exists(ClassInstanceExpr e |
- n.asExpr() = e and
- e.getType() = t and
- not e instanceof FunctionalExpr and
- exists(SrcRefType sub | sub.getASourceSupertype() = t.getSourceDeclaration())
- )
-}
-
-private module ExactTypePropagation implements TypePropagation {
- class Typ = RefType;
-
- predicate candType = exactType/2;
-
- predicate supportsType = exactType/2;
-}
-
-/**
- * Holds if the runtime type of `n` is exactly `t` and if this bound is a
- * non-trivial lower bound, that is, `t` has a subtype.
- */
-private predicate exactType(TypeFlowNode n, RefType t) {
- exactTypeBase(n, t)
- or
- exists(TypeFlowNode mid | exactType(mid, t) and step(mid, n))
- or
- // The following is an optimized version of
- // `forex(TypeFlowNode mid | joinStep(mid, n) | exactType(mid, t))`
- ForAll::flowJoin(n, t)
- or
- exists(TypeFlowScc scc |
- sccRepr(n, scc) and
- // Optimized version of
- // `forex(TypeFlowNode mid | sccJoinStep(mid, scc) | exactType(mid, t))`
- ForAll::flowJoin(scc, t)
- )
-}
-
-/**
- * Holds if `n` occurs in a position where type information might be discarded;
- * `t1` is the type of `n`, `t1e` is the erasure of `t1`, `t2` is the type of
- * the implicit or explicit cast, and `t2e` is the erasure of `t2`.
- */
-pragma[nomagic]
-private predicate upcastCand(TypeFlowNode n, RefType t1, RefType t1e, RefType t2, RefType t2e) {
- exists(TypeFlowNode next | step(n, next) or joinStep(n, next) |
- n.getType() = t1 and
- next.getType() = t2 and
- t1.getErasure() = t1e and
- t2.getErasure() = t2e and
- t1 != t2
- )
-}
-
-private predicate unconstrained(BoundedType t) {
- t.(Wildcard).isUnconstrained()
- or
- t.getUpperBoundType() instanceof TypeObject and
- not t.(Wildcard).hasLowerBound()
- or
- unconstrained(t.getUpperBoundType())
- or
- unconstrained(t.(Wildcard).getLowerBoundType())
-}
-
-/** Holds if `t` is a raw type or parameterised type with unrestricted type arguments. */
-private predicate unbound(RefType t) {
- t instanceof RawType
- or
- exists(ParameterizedType pt | pt = t |
- forex(RefType arg | arg = pt.getATypeArgument() | unconstrained(arg))
- )
-}
-
-/** Holds if `n` occurs in a position where type information is discarded. */
-private predicate upcast(TypeFlowNode n, RefType t1) {
- exists(RefType t1e, RefType t2, RefType t2e | upcastCand(n, t1, t1e, t2, t2e) |
- t1e.getASourceSupertype+() = t2e
+ /** Gets the element type of an array or subtype of `Iterable`. */
+ private J::Type elementType(RefType t) {
+ result = t.(Array).getComponentType()
or
- t1e = t2e and
- unbound(t2) and
- not unbound(t1)
- )
-}
-
-/** Gets the element type of an array or subtype of `Iterable`. */
-private Type elementType(RefType t) {
- result = t.(Array).getComponentType()
- or
- exists(ParameterizedType it |
- it.getSourceDeclaration().hasQualifiedName("java.lang", "Iterable") and
- result = it.getATypeArgument() and
- t.extendsOrImplements*(it)
- )
-}
-
-private predicate upcastEnhancedForStmtAux(BaseSsaUpdate v, RefType t, RefType t1, RefType t2) {
- exists(EnhancedForStmt for |
- for.getVariable() = v.getDefiningExpr() and
- v.getSourceVariable().getType().getErasure() = t2 and
- t = boxIfNeeded(elementType(for.getExpr().getType())) and
- t.getErasure() = t1
- )
-}
+ exists(ParameterizedType it |
+ it.getSourceDeclaration().hasQualifiedName("java.lang", "Iterable") and
+ result = it.getATypeArgument() and
+ t.extendsOrImplements*(it)
+ )
+ }
-/**
- * Holds if `v` is the iteration variable of an enhanced for statement, `t` is
- * the type of the elements being iterated over, and this type is more precise
- * than the type of `v`.
- */
-private predicate upcastEnhancedForStmt(BaseSsaUpdate v, RefType t) {
- exists(RefType t1, RefType t2 |
- upcastEnhancedForStmtAux(v, t, t1, t2) and
- t1.getASourceSupertype+() = t2
- )
-}
+ private predicate upcastEnhancedForStmtAux(BaseSsaUpdate v, RefType t, RefType t1, RefType t2) {
+ exists(EnhancedForStmt for |
+ for.getVariable() = v.getDefiningExpr() and
+ v.getSourceVariable().getType().getErasure() = t2 and
+ t = boxIfNeeded(elementType(for.getExpr().getType())) and
+ t.getErasure() = t1
+ )
+ }
-private predicate downcastSuccessorAux(
- CastingExpr cast, BaseSsaVariable v, RefType t, RefType t1, RefType t2
-) {
- cast.getExpr() = v.getAUse() and
- t = cast.getType() and
- t1 = t.getErasure() and
- t2 = v.getSourceVariable().getType().getErasure()
-}
+ /**
+ * Holds if `v` is the iteration variable of an enhanced for statement, `t` is
+ * the type of the elements being iterated over, and this type is more precise
+ * than the type of `v`.
+ */
+ private predicate upcastEnhancedForStmt(BaseSsaUpdate v, RefType t) {
+ exists(RefType t1, RefType t2 |
+ upcastEnhancedForStmtAux(v, t, t1, t2) and
+ t1.getASourceSupertype+() = t2
+ )
+ }
-/**
- * Holds if `va` is an access to a value that has previously been downcast to `t`.
- */
-private predicate downcastSuccessor(VarAccess va, RefType t) {
- exists(CastingExpr cast, BaseSsaVariable v, RefType t1, RefType t2 |
- downcastSuccessorAux(pragma[only_bind_into](cast), v, t, t1, t2) and
- t1.getASourceSupertype+() = t2 and
- va = v.getAUse() and
- dominates(cast, va) and
- dominates(cast.(ControlFlowNode).getANormalSuccessor(), va)
- )
-}
+ private predicate downcastSuccessorAux(
+ CastingExpr cast, BaseSsaVariable v, RefType t, RefType t1, RefType t2
+ ) {
+ cast.getExpr() = v.getAUse() and
+ t = cast.getType() and
+ t1 = t.getErasure() and
+ t2 = v.getSourceVariable().getType().getErasure()
+ }
-/**
- * Holds if `va` is an access to a value that is guarded by `instanceof t` or `case e t`.
- */
-private predicate typeTestGuarded(VarAccess va, RefType t) {
- exists(Guard typeTest, BaseSsaVariable v |
- typeTest.appliesTypeTest(v.getAUse(), t, _) and
- va = v.getAUse() and
- guardControls_v1(typeTest, va.getBasicBlock(), true)
- )
-}
+ /**
+ * Holds if `va` is an access to a value that has previously been downcast to `t`.
+ */
+ private predicate downcastSuccessor(VarAccess va, RefType t) {
+ exists(CastingExpr cast, BaseSsaVariable v, RefType t1, RefType t2 |
+ downcastSuccessorAux(pragma[only_bind_into](cast), v, t, t1, t2) and
+ t1.getASourceSupertype+() = t2 and
+ va = v.getAUse() and
+ dominates(cast, va) and
+ dominates(cast.(ControlFlowNode).getANormalSuccessor(), va)
+ )
+ }
-/**
- * Holds if `aa` is an access to a value that is guarded by `instanceof t` or `case e t`.
- */
-predicate arrayTypeTestGuarded(ArrayAccess aa, RefType t) {
- exists(Guard typeTest, BaseSsaVariable v1, BaseSsaVariable v2, ArrayAccess aa1 |
- typeTest.appliesTypeTest(aa1, t, _) and
- aa1.getArray() = v1.getAUse() and
- aa1.getIndexExpr() = v2.getAUse() and
- aa.getArray() = v1.getAUse() and
- aa.getIndexExpr() = v2.getAUse() and
- guardControls_v1(typeTest, aa.getBasicBlock(), true)
- )
-}
+ /**
+ * Holds if `va` is an access to a value that is guarded by `instanceof t` or `case e t`.
+ */
+ private predicate typeTestGuarded(VarAccess va, RefType t) {
+ exists(Guard typeTest, BaseSsaVariable v |
+ typeTest.appliesTypeTest(v.getAUse(), t, _) and
+ va = v.getAUse() and
+ guardControls_v1(typeTest, va.getBasicBlock(), true)
+ )
+ }
-/**
- * Holds if `t` is the type of the `this` value corresponding to the the
- * `SuperAccess`. As the `SuperAccess` expression has the type of the supertype,
- * the type `t` is a stronger type bound.
- */
-private predicate superAccess(SuperAccess sup, RefType t) {
- sup.isEnclosingInstanceAccess(t)
- or
- sup.isOwnInstanceAccess() and
- t = sup.getEnclosingCallable().getDeclaringType()
-}
+ /**
+ * Holds if `aa` is an access to a value that is guarded by `instanceof t` or `case e t`.
+ */
+ private predicate arrayTypeTestGuarded(ArrayAccess aa, RefType t) {
+ exists(Guard typeTest, BaseSsaVariable v1, BaseSsaVariable v2, ArrayAccess aa1 |
+ typeTest.appliesTypeTest(aa1, t, _) and
+ aa1.getArray() = v1.getAUse() and
+ aa1.getIndexExpr() = v2.getAUse() and
+ aa.getArray() = v1.getAUse() and
+ aa.getIndexExpr() = v2.getAUse() and
+ guardControls_v1(typeTest, aa.getBasicBlock(), true)
+ )
+ }
-/**
- * Holds if `n` has type `t` and this information is discarded, such that `t`
- * might be a better type bound for nodes where `n` flows to. This might include
- * multiple bounds for a single node.
- */
-private predicate typeFlowBaseCand(TypeFlowNode n, RefType t) {
- exists(RefType srctype |
- upcast(n, srctype) or
- upcastEnhancedForStmt(n.asSsa(), srctype) or
- downcastSuccessor(n.asExpr(), srctype) or
- typeTestGuarded(n.asExpr(), srctype) or
- arrayTypeTestGuarded(n.asExpr(), srctype) or
- n.asExpr().(FunctionalExpr).getConstructedType() = srctype or
- superAccess(n.asExpr(), srctype)
- |
- t = srctype.(BoundedType).getAnUltimateUpperBoundType()
+ /**
+ * Holds if `t` is the type of the `this` value corresponding to the the
+ * `SuperAccess`. As the `SuperAccess` expression has the type of the supertype,
+ * the type `t` is a stronger type bound.
+ */
+ private predicate superAccess(SuperAccess sup, RefType t) {
+ sup.isEnclosingInstanceAccess(t)
or
- t = srctype and not srctype instanceof BoundedType
- )
-}
+ sup.isOwnInstanceAccess() and
+ t = sup.getEnclosingCallable().getDeclaringType()
+ }
-/**
- * Holds if `n` has type `t` and this information is discarded, such that `t`
- * might be a better type bound for nodes where `n` flows to. This only includes
- * the best such bound for each node.
- */
-private predicate typeFlowBase(TypeFlowNode n, RefType t) {
- exists(RefType te |
- typeFlowBaseCand(n, t) and
- te = t.getErasure() and
- not exists(RefType better |
- typeFlowBaseCand(n, better) and
- better != t and
- not t.getASupertype+() = better
+ /**
+ * Holds if `n` has type `t` and this information is discarded, such that `t`
+ * might be a better type bound for nodes where `n` flows to. This might include
+ * multiple bounds for a single node.
+ */
+ predicate typeFlowBaseCand(TypeFlowNode n, RefType t) {
+ exists(RefType srctype |
+ upcast(n, srctype) or
+ upcastEnhancedForStmt(n.asSsa(), srctype) or
+ downcastSuccessor(n.asExpr(), srctype) or
+ typeTestGuarded(n.asExpr(), srctype) or
+ arrayTypeTestGuarded(n.asExpr(), srctype) or
+ n.asExpr().(FunctionalExpr).getConstructedType() = srctype or
+ superAccess(n.asExpr(), srctype)
|
- better.getASupertype+() = t or
- better.getErasure().(RefType).getASourceSupertype+() = te
+ t = srctype.(BoundedType).getAnUltimateUpperBoundType()
+ or
+ t = srctype and not srctype instanceof BoundedType
)
- )
-}
+ }
-private module TypeFlowPropagation implements TypePropagation {
- class Typ = RefType;
+ /**
+ * Holds if `ioe` checks `v`, its true-successor is `bb`, and `bb` has multiple
+ * predecessors.
+ */
+ private predicate instanceofDisjunct(InstanceOfExpr ioe, BasicBlock bb, BaseSsaVariable v) {
+ ioe.getExpr() = v.getAUse() and
+ strictcount(bb.getABBPredecessor()) > 1 and
+ exists(ConditionBlock cb | cb.getCondition() = ioe and cb.getTestSuccessor(true) = bb)
+ }
- predicate candType = typeFlow/2;
+ /** Holds if `bb` is disjunctively guarded by multiple `instanceof` tests on `v`. */
+ private predicate instanceofDisjunction(BasicBlock bb, BaseSsaVariable v) {
+ strictcount(InstanceOfExpr ioe | instanceofDisjunct(ioe, bb, v)) =
+ strictcount(bb.getABBPredecessor())
+ }
- bindingset[t]
- predicate supportsType(TypeFlowNode mid, RefType t) {
- exists(RefType midtyp | exactType(mid, midtyp) or typeFlow(mid, midtyp) |
- pragma[only_bind_out](midtyp).getAnAncestor() = t
+ /**
+ * Holds if `n` is a value that is guarded by a disjunction of
+ * `instanceof t_i` where `t` is one of those `t_i`.
+ */
+ predicate instanceofDisjunctionGuarded(TypeFlowNode n, RefType t) {
+ exists(BasicBlock bb, InstanceOfExpr ioe, BaseSsaVariable v, VarAccess va |
+ instanceofDisjunction(bb, v) and
+ bb.bbDominates(va.getBasicBlock()) and
+ va = v.getAUse() and
+ instanceofDisjunct(ioe, bb, v) and
+ t = ioe.getSyntacticCheckedType() and
+ n.asExpr() = va
)
}
-}
-
-/**
- * Holds if the runtime type of `n` is bounded by `t` and if this bound is
- * likely to be better than the static type of `n`.
- */
-private predicate typeFlow(TypeFlowNode n, RefType t) {
- typeFlowBase(n, t)
- or
- exists(TypeFlowNode mid | typeFlow(mid, t) and step(mid, n))
- or
- ForAll::flowJoin(n, t)
- or
- exists(TypeFlowScc scc |
- sccRepr(n, scc) and
- ForAll::flowJoin(scc, t)
- )
-}
-
-pragma[nomagic]
-private predicate erasedTypeBound(RefType t) {
- exists(RefType t0 | typeFlow(_, t0) and t = t0.getErasure())
-}
-
-pragma[nomagic]
-private predicate typeBound(RefType t) { typeFlow(_, t) }
-/**
- * Holds if we have a bound for `n` that is better than `t`, taking only erased
- * types into account.
- */
-pragma[nomagic]
-private predicate irrelevantErasedBound(TypeFlowNode n, RefType t) {
- exists(RefType bound |
- typeFlow(n, bound)
+ private predicate unconstrained(BoundedType t) {
+ t.(Wildcard).isUnconstrained()
or
- n.getType() = bound and typeFlow(n, _)
- |
- t = bound.getErasure().(RefType).getASourceSupertype+() and
- erasedTypeBound(t)
- )
-}
-
-/**
- * Holds if we have a bound for `n` that is better than `t`.
- */
-pragma[nomagic]
-private predicate irrelevantBound(TypeFlowNode n, RefType t) {
- exists(RefType bound |
- typeFlow(n, bound) and
- t = bound.getAStrictAncestor() and
- typeBound(t) and
- typeFlow(n, pragma[only_bind_into](t)) and
- not t.getAnAncestor() = bound
+ t.getUpperBoundType() instanceof TypeObject and
+ not t.(Wildcard).hasLowerBound()
or
- n.getType() = pragma[only_bind_into](bound) and
- typeFlow(n, t) and
- t = bound.getAnAncestor()
- )
-}
-
-/**
- * Holds if the runtime type of `n` is bounded by `t`, if this bound is likely
- * to be better than the static type of `n`, and if this the best such bound.
- */
-private predicate bestTypeFlow(TypeFlowNode n, RefType t) {
- typeFlow(n, t) and
- not irrelevantErasedBound(n, t.getErasure()) and
- not irrelevantBound(n, t)
-}
-
-private predicate bestTypeFlow(TypeFlowNode n, RefType t, boolean exact) {
- exactType(n, t) and exact = true
- or
- not exactType(n, _) and bestTypeFlow(n, t) and exact = false
-}
-
-private predicate bestTypeFlowOrTypeFlowBase(TypeFlowNode n, RefType t, boolean exact) {
- bestTypeFlow(n, t, exact)
- or
- typeFlowBase(n, t) and
- exact = false and
- not bestTypeFlow(n, _, _)
-}
-
-/**
- * Holds if `n` has type `t` and this information is not propagated as a
- * universal bound to a subsequent node, such that `t` might form the basis for
- * a union type bound for that node.
- */
-private predicate unionTypeFlowBaseCand(TypeFlowNode n, RefType t, boolean exact) {
- exists(TypeFlowNode next |
- joinStep(n, next) and
- bestTypeFlowOrTypeFlowBase(n, t, exact) and
- not bestTypeFlowOrTypeFlowBase(next, t, exact) and
- not exactType(next, _)
- )
-}
-
-/**
- * Holds if `ioe` checks `v`, its true-successor is `bb`, and `bb` has multiple
- * predecessors.
- */
-private predicate instanceofDisjunct(InstanceOfExpr ioe, BasicBlock bb, BaseSsaVariable v) {
- ioe.getExpr() = v.getAUse() and
- strictcount(bb.getABBPredecessor()) > 1 and
- exists(ConditionBlock cb | cb.getCondition() = ioe and cb.getTestSuccessor(true) = bb)
-}
-
-/** Holds if `bb` is disjunctively guarded by multiple `instanceof` tests on `v`. */
-private predicate instanceofDisjunction(BasicBlock bb, BaseSsaVariable v) {
- strictcount(InstanceOfExpr ioe | instanceofDisjunct(ioe, bb, v)) =
- strictcount(bb.getABBPredecessor())
-}
-
-/**
- * Holds if `n` is a value that is guarded by a disjunction of
- * `instanceof t_i` where `t` is one of those `t_i`.
- */
-private predicate instanceofDisjunctionGuarded(TypeFlowNode n, RefType t) {
- exists(BasicBlock bb, InstanceOfExpr ioe, BaseSsaVariable v, VarAccess va |
- instanceofDisjunction(bb, v) and
- bb.bbDominates(va.getBasicBlock()) and
- va = v.getAUse() and
- instanceofDisjunct(ioe, bb, v) and
- t = ioe.getSyntacticCheckedType() and
- n.asExpr() = va
- )
-}
-
-private module HasUnionTypePropagation implements TypePropagation {
- class Typ = Unit;
-
- predicate candType(TypeFlowNode mid, Unit unit) {
- exists(unit) and
- (unionTypeFlowBaseCand(mid, _, _) or hasUnionTypeFlow(mid))
+ unconstrained(t.getUpperBoundType())
+ or
+ unconstrained(t.(Wildcard).getLowerBoundType())
}
- predicate supportsType = candType/2;
-}
-
-/**
- * Holds if all incoming type flow can be traced back to a
- * `unionTypeFlowBaseCand`, such that we can compute a union type bound for `n`.
- * Disregards nodes for which we have an exact bound.
- */
-private predicate hasUnionTypeFlow(TypeFlowNode n) {
- not exactType(n, _) and
- (
- // Optimized version of
- // `forex(TypeFlowNode mid | joinStep(mid, n) | unionTypeFlowBaseCand(mid, _, _) or hasUnionTypeFlow(mid))`
- ForAll::flowJoin(n, _)
+ /** Holds if `t` is a raw type or parameterised type with unrestricted type arguments. */
+ predicate unbound(RefType t) {
+ t instanceof RawType
or
- exists(TypeFlowScc scc |
- sccRepr(n, scc) and
- // Optimized version of
- // `forex(TypeFlowNode mid | sccJoinStep(mid, scc) | unionTypeFlowBaseCand(mid, _, _) or hasUnionTypeFlow(mid))`
- ForAll::flowJoin(scc, _)
+ exists(ParameterizedType pt | pt = t |
+ forex(RefType arg | arg = pt.getATypeArgument() | unconstrained(arg))
)
- or
- exists(TypeFlowNode mid | step(mid, n) and hasUnionTypeFlow(mid))
- or
- instanceofDisjunctionGuarded(n, _)
- )
-}
-
-pragma[nomagic]
-private RefType getTypeBound(TypeFlowNode n) {
- bestTypeFlow(n, result)
- or
- not bestTypeFlow(n, _) and result = n.getType()
-}
-
-pragma[nomagic]
-private predicate unionTypeFlow0(TypeFlowNode n, RefType t, boolean exact) {
- hasUnionTypeFlow(n) and
- (
- exists(TypeFlowNode mid | anyStep(mid, n) |
- unionTypeFlowBaseCand(mid, t, exact) or unionTypeFlow(mid, t, exact)
- )
- or
- instanceofDisjunctionGuarded(n, t) and exact = false
- )
-}
-
-/** Holds if we have a union type bound for `n` and `t` is one of its parts. */
-private predicate unionTypeFlow(TypeFlowNode n, RefType t, boolean exact) {
- unionTypeFlow0(n, t, exact) and
- // filter impossible union parts:
- exists(RefType tErased, RefType boundErased |
- pragma[only_bind_into](tErased) = t.getErasure() and
- pragma[only_bind_into](boundErased) = getTypeBound(n).getErasure()
- |
- if exact = true
- then tErased.getASourceSupertype*() = boundErased
- else erasedHaveIntersection(tErased, boundErased)
- )
-}
+ }
-/**
- * Holds if the inferred union type bound for `n` contains the best universal
- * bound and thus is irrelevant.
- */
-private predicate irrelevantUnionType(TypeFlowNode n) {
- exists(RefType t, RefType nt, RefType te, RefType nte |
- unionTypeFlow(n, t, false) and
- nt = getTypeBound(n) and
- te = t.getErasure() and
- nte = nt.getErasure()
- |
- nt.getASupertype*() = t
- or
- nte.getASourceSupertype+() = te
- or
- nte = te and unbound(t)
- )
-}
+ Type getErasure(Type t) { result = t.getErasure() }
-/**
- * Holds if `t` is an irrelevant part of the union type bound for `n` due to
- * being contained in another part of the union type bound.
- */
-private predicate irrelevantUnionTypePart(TypeFlowNode n, RefType t, boolean exact) {
- unionTypeFlow(n, t, exact) and
- not irrelevantUnionType(n) and
- exists(RefType weaker |
- unionTypeFlow(n, weaker, false) and
- t.getASupertype*() = weaker
- |
- exact = true or not weaker.getASupertype*() = t
- )
-}
+ Type getAnAncestor(Type sub) { result = sub.getAnAncestor() }
-/**
- * Holds if the runtime type of `n` is bounded by a union type and if this
- * bound is likely to be better than the static type of `n`. The union type is
- * made up of the types `t` related to `n` by this predicate, and the flag
- * `exact` indicates whether `t` is an exact bound or merely an upper bound.
- */
-private predicate bestUnionType(TypeFlowNode n, RefType t, boolean exact) {
- unionTypeFlow(n, t, exact) and
- not irrelevantUnionType(n) and
- not irrelevantUnionTypePart(n, t, exact)
+ RefType getSourceDeclaration(Type t) { result = t.getSourceDeclaration() }
}
cached
private module TypeFlowBounds {
+ private module TypeFlow = Make;
+
/**
* Holds if the runtime type of `f` is bounded by `t` and if this bound is
* likely to be better than the static type of `f`. The flag `exact` indicates
@@ -756,9 +365,9 @@ private module TypeFlowBounds {
*/
cached
predicate fieldTypeFlow(Field f, RefType t, boolean exact) {
- exists(TypeFlowNode n |
+ exists(Input::TypeFlowNode n |
n.asField() = f and
- bestTypeFlow(n, t, exact)
+ TypeFlow::bestTypeFlow(n, t, exact)
)
}
@@ -769,9 +378,9 @@ private module TypeFlowBounds {
*/
cached
predicate exprTypeFlow(Expr e, RefType t, boolean exact) {
- exists(TypeFlowNode n |
+ exists(Input::TypeFlowNode n |
n.asExpr() = e and
- bestTypeFlow(n, t, exact)
+ TypeFlow::bestTypeFlow(n, t, exact)
)
}
@@ -783,9 +392,9 @@ private module TypeFlowBounds {
*/
cached
predicate exprUnionTypeFlow(Expr e, RefType t, boolean exact) {
- exists(TypeFlowNode n |
+ exists(Input::TypeFlowNode n |
n.asExpr() = e and
- bestUnionType(n, t, exact)
+ TypeFlow::bestUnionType(n, t, exact)
)
}
}
From 690fdc076d2e65b9e238589dbc15f05ad57be3cf Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Mon, 26 Feb 2024 16:21:35 +0000
Subject: [PATCH 031/731] Shared: Add change note.
---
shared/typeflow/change-notes/2024-02-26-initial-version.md | 4 ++++
1 file changed, 4 insertions(+)
create mode 100644 shared/typeflow/change-notes/2024-02-26-initial-version.md
diff --git a/shared/typeflow/change-notes/2024-02-26-initial-version.md b/shared/typeflow/change-notes/2024-02-26-initial-version.md
new file mode 100644
index 000000000000..6b3dc3449387
--- /dev/null
+++ b/shared/typeflow/change-notes/2024-02-26-initial-version.md
@@ -0,0 +1,4 @@
+---
+category: feature
+---
+* Initial release. Adds a library to implement type-flow analysis.
From b4b5ae2a2c53503538b1cab99c7499ca97f536a1 Mon Sep 17 00:00:00 2001
From: erik-krogh
Date: Tue, 27 Feb 2024 10:05:26 +0100
Subject: [PATCH 032/731] add some request-forgery sanitizers, inspired from C#
---
.../code/java/security/RequestForgery.qll | 77 +++++++++++++++++++
.../CWE-601/semmle/tests/UrlRedirect.expected | 2 +
.../CWE-601/semmle/tests/UrlRedirect2.java | 52 +++++++++++++
3 files changed, 131 insertions(+)
create mode 100644 java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect2.java
diff --git a/java/ql/lib/semmle/code/java/security/RequestForgery.qll b/java/ql/lib/semmle/code/java/security/RequestForgery.qll
index 7a72faeb5e4d..e083977c74f9 100644
--- a/java/ql/lib/semmle/code/java/security/RequestForgery.qll
+++ b/java/ql/lib/semmle/code/java/security/RequestForgery.qll
@@ -8,6 +8,7 @@ import semmle.code.java.frameworks.JaxWS
import semmle.code.java.frameworks.javase.Http
import semmle.code.java.dataflow.DataFlow
import semmle.code.java.frameworks.Properties
+private import semmle.code.java.controlflow.Guards
private import semmle.code.java.dataflow.StringPrefixes
private import semmle.code.java.dataflow.ExternalFlow
private import semmle.code.java.security.Sanitizers
@@ -83,3 +84,79 @@ private class HostnameSanitizingPrefix extends InterestingPrefix {
private class HostnameSantizer extends RequestForgerySanitizer {
HostnameSantizer() { this.asExpr() = any(HostnameSanitizingPrefix hsp).getAnAppendedExpression() }
}
+
+/**
+ * An argument to a call to `List.contains()` that is a sanitizer for URL redirects.
+ */
+private predicate isContainsUrlSanitizer(Guard guard, Expr e, boolean branch) {
+ guard =
+ any(MethodCall method |
+ method.getMethod().getName() = "contains" and
+ e = method.getArgument(0) and
+ branch = true
+ )
+}
+
+/**
+ * An URL argument to a call to `.contains()` that is a sanitizer for URL redirects.
+ *
+ * This `contains` method is usually called on a list, but the sanitizer matches any call to a method
+ * called `contains`, so other methods with the same name will also be considered sanitizers.
+ */
+class ContainsUrlSanitizer extends RequestForgerySanitizer {
+ ContainsUrlSanitizer() {
+ this = DataFlow::BarrierGuard::getABarrierNode()
+ }
+}
+
+/**
+ * A check that the URL is relative, and therefore safe for URL redirects.
+ */
+private predicate isRelativeUrlSanitizer(Guard guard, Expr e, boolean branch) {
+ guard =
+ any(MethodCall call |
+ exists(Method method |
+ call.getMethod() = method and
+ method.getName() = "isAbsolute" and
+ method.getDeclaringType().hasQualifiedName("java.net", "URI")
+ ) and
+ e = call.getQualifier() and
+ branch = false
+ )
+}
+
+/**
+ * A check that the URL is relative, and therefore safe for URL redirects.
+ */
+class RelativeUrlSanitizer extends RequestForgerySanitizer {
+ RelativeUrlSanitizer() {
+ this = DataFlow::BarrierGuard::getABarrierNode()
+ }
+}
+
+/**
+ * A comparison on the host of a url, that is a sanitizer for URL redirects.
+ * E.g. `"example.org".equals(url.getHost())"`
+ */
+private predicate isHostComparisonSanitizer(Guard guard, Expr e, boolean branch) {
+ guard =
+ any(MethodCall equalsCall |
+ equalsCall.getMethod().getName() = "equals" and
+ branch = true and
+ exists(MethodCall hostCall |
+ hostCall = [equalsCall.getQualifier(), equalsCall.getArgument(0)] and
+ hostCall.getMethod().getName() = "getHost" and
+ hostCall.getMethod().getDeclaringType().hasQualifiedName("java.net", "URI") and
+ e = hostCall.getQualifier()
+ )
+ )
+}
+
+/**
+ * A comparison on the `Host` property of a url, that is a sanitizer for URL redirects.
+ */
+class HostComparisonSanitizer extends RequestForgerySanitizer {
+ HostComparisonSanitizer() {
+ this = DataFlow::BarrierGuard::getABarrierNode()
+ }
+}
diff --git a/java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect.expected b/java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect.expected
index 3757e51134b6..cf5af88efd85 100644
--- a/java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect.expected
+++ b/java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect.expected
@@ -6,6 +6,7 @@ edges
| mad/Test.java:9:16:9:41 | getParameter(...) : String | mad/Test.java:14:31:14:38 | source(...) : String | provenance | |
| mad/Test.java:14:31:14:38 | source(...) : String | mad/Test.java:14:22:14:38 | (...)... | provenance | |
nodes
+| UrlRedirect2.java:27:25:27:54 | getParameter(...) | semmle.label | getParameter(...) |
| UrlRedirect.java:23:25:23:54 | getParameter(...) | semmle.label | getParameter(...) |
| UrlRedirect.java:32:25:32:67 | weakCleanup(...) | semmle.label | weakCleanup(...) |
| UrlRedirect.java:32:37:32:66 | getParameter(...) : String | semmle.label | getParameter(...) : String |
@@ -20,6 +21,7 @@ nodes
subpaths
| UrlRedirect.java:32:37:32:66 | getParameter(...) : String | UrlRedirect.java:45:28:45:39 | input : String | UrlRedirect.java:46:10:46:40 | replaceAll(...) : String | UrlRedirect.java:32:25:32:67 | weakCleanup(...) |
#select
+| UrlRedirect2.java:27:25:27:54 | getParameter(...) | UrlRedirect2.java:27:25:27:54 | getParameter(...) | UrlRedirect2.java:27:25:27:54 | getParameter(...) | Untrusted URL redirection depends on a $@. | UrlRedirect2.java:27:25:27:54 | getParameter(...) | user-provided value |
| UrlRedirect.java:23:25:23:54 | getParameter(...) | UrlRedirect.java:23:25:23:54 | getParameter(...) | UrlRedirect.java:23:25:23:54 | getParameter(...) | Untrusted URL redirection depends on a $@. | UrlRedirect.java:23:25:23:54 | getParameter(...) | user-provided value |
| UrlRedirect.java:32:25:32:67 | weakCleanup(...) | UrlRedirect.java:32:37:32:66 | getParameter(...) : String | UrlRedirect.java:32:25:32:67 | weakCleanup(...) | Untrusted URL redirection depends on a $@. | UrlRedirect.java:32:37:32:66 | getParameter(...) | user-provided value |
| UrlRedirect.java:39:34:39:63 | getParameter(...) | UrlRedirect.java:39:34:39:63 | getParameter(...) | UrlRedirect.java:39:34:39:63 | getParameter(...) | Untrusted URL redirection depends on a $@. | UrlRedirect.java:39:34:39:63 | getParameter(...) | user-provided value |
diff --git a/java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect2.java b/java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect2.java
new file mode 100644
index 000000000000..9014dcae7f29
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect2.java
@@ -0,0 +1,52 @@
+// Test case for
+// CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
+// http://cwe.mitre.org/data/definitions/601.html
+
+package test.cwe601.cwe.examples;
+
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.List;
+import java.net.URI;
+import java.net.URISyntaxException;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+public class UrlRedirect2 extends HttpServlet {
+ private static final List VALID_REDIRECTS = Arrays.asList(
+ "http://cwe.mitre.org/data/definitions/601.html",
+ "http://cwe.mitre.org/data/definitions/79.html"
+ );
+
+ protected void doGet(HttpServletRequest request, HttpServletResponse response)
+ throws ServletException, IOException {
+ // BAD: a request parameter is incorporated without validation into a URL redirect
+ response.sendRedirect(request.getParameter("target"));
+
+ // GOOD: the request parameter is validated against a known list of strings
+ String target = request.getParameter("target");
+ if (VALID_REDIRECTS.contains(target)) {
+ response.sendRedirect(target);
+ }
+
+ try {
+ String urlString = request.getParameter("page");
+ URI url = new URI(urlString);
+
+ if (!url.isAbsolute()) {
+ // GOOD: The redirect is to a relative URL
+ response.sendRedirect(url.toString());
+ }
+
+ if ("example.org".equals(url.getHost())) {
+ // GOOD: The redirect is to a known host
+ response.sendRedirect(url.toString());
+ }
+ } catch (URISyntaxException e) {
+ // handle exception
+ }
+ }
+}
From d0e7fbc871de377f6ab2693ce624e325902ea754 Mon Sep 17 00:00:00 2001
From: Harry Maclean
Date: Tue, 27 Feb 2024 09:47:51 +0000
Subject: [PATCH 033/731] Ruby: Add changenote
---
ruby/ql/lib/change-notes/2024-02-27-process-spawn.md | 4 ++++
1 file changed, 4 insertions(+)
create mode 100644 ruby/ql/lib/change-notes/2024-02-27-process-spawn.md
diff --git a/ruby/ql/lib/change-notes/2024-02-27-process-spawn.md b/ruby/ql/lib/change-notes/2024-02-27-process-spawn.md
new file mode 100644
index 000000000000..30feedcbd209
--- /dev/null
+++ b/ruby/ql/lib/change-notes/2024-02-27-process-spawn.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* New command injection sinks have been added, including `Process.spawn`, `Terrapin::CommandLine` and the `open4` gem.
\ No newline at end of file
From 2fd57f6ee771e760d54749e649ceea8f3a8716af Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Wed, 28 Feb 2024 16:24:21 +0000
Subject: [PATCH 034/731] Shared: Remove cached annotation.
---
shared/typeflow/codeql/typeflow/TypeFlow.qll | 1 -
1 file changed, 1 deletion(-)
diff --git a/shared/typeflow/codeql/typeflow/TypeFlow.qll b/shared/typeflow/codeql/typeflow/TypeFlow.qll
index 5df8e53a914b..bdf90dab7cf7 100644
--- a/shared/typeflow/codeql/typeflow/TypeFlow.qll
+++ b/shared/typeflow/codeql/typeflow/TypeFlow.qll
@@ -112,7 +112,6 @@ private import internal.TypeFlowImpl as Impl
/**
* Provides an implementation of type-flow using input `I`.
*/
-cached
module Make {
import Impl::TypeFlow
}
From 052a8e7f8187026396db06545647afc47f2dbde4 Mon Sep 17 00:00:00 2001
From: Asger F
Date: Wed, 28 Feb 2024 14:58:04 +0100
Subject: [PATCH 035/731] JS: Avoid spurious recursion in AMD
---
javascript/ql/lib/semmle/javascript/AMD.qll | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/javascript/ql/lib/semmle/javascript/AMD.qll b/javascript/ql/lib/semmle/javascript/AMD.qll
index 20b1c26275a7..7214005b5937 100644
--- a/javascript/ql/lib/semmle/javascript/AMD.qll
+++ b/javascript/ql/lib/semmle/javascript/AMD.qll
@@ -102,9 +102,10 @@ class AmdModuleDefinition extends CallExpr instanceof AmdModuleDefinition::Range
/**
* Holds if `p` is the parameter corresponding to dependency `dep`.
*/
- predicate dependencyParameter(PathExpr dep, Parameter p) {
+ predicate dependencyParameter(Expr dep, Parameter p) {
exists(int i |
- dep = this.getDependency(i) and
+ // Note: to avoid spurious recursion, do not depend on PathExpr here
+ dep = this.getDependencies().getElement(i) and
p = this.getFactoryParameter(i)
)
}
@@ -122,9 +123,9 @@ class AmdModuleDefinition extends CallExpr instanceof AmdModuleDefinition::Range
* `dep1` and `dep2`.
*/
Parameter getDependencyParameter(string name) {
- exists(PathExpr dep |
+ exists(Expr dep |
this.dependencyParameter(dep, result) and
- dep.getValue() = name
+ name = dep.getStringValue()
)
}
From 853397361fceb4395df26e52d1a5b46b259d2915 Mon Sep 17 00:00:00 2001
From: Asger F
Date: Wed, 28 Feb 2024 13:51:28 +0100
Subject: [PATCH 036/731] JS: Do not treat AMD pseudo-dependencies as file
paths
---
javascript/ql/lib/semmle/javascript/AMD.qll | 14 ++++++++++++--
.../ql/test/library-tests/AMD/tests.expected | 1 -
2 files changed, 12 insertions(+), 3 deletions(-)
diff --git a/javascript/ql/lib/semmle/javascript/AMD.qll b/javascript/ql/lib/semmle/javascript/AMD.qll
index 7214005b5937..b28dd5b9b72d 100644
--- a/javascript/ql/lib/semmle/javascript/AMD.qll
+++ b/javascript/ql/lib/semmle/javascript/AMD.qll
@@ -61,7 +61,13 @@ class AmdModuleDefinition extends CallExpr instanceof AmdModuleDefinition::Range
}
/** Gets the `i`th dependency of this module definition. */
- PathExpr getDependency(int i) { result = this.getDependencies().getElement(i) }
+ PathExpr getDependency(int i) {
+ exists(Expr expr |
+ expr = this.getDependencies().getElement(i) and
+ not isPseudoDependency(expr.getStringValue()) and
+ result = expr
+ )
+ }
/** Gets a dependency of this module definition. */
PathExpr getADependency() {
@@ -203,11 +209,15 @@ class AmdModuleDefinition extends CallExpr instanceof AmdModuleDefinition::Range
}
}
+private predicate isPseudoDependency(string s) { s = ["exports", "require", "module"] }
+
/** An AMD dependency, considered as a path expression. */
private class AmdDependencyPath extends PathExprCandidate {
AmdDependencyPath() {
exists(AmdModuleDefinition amd |
- this = amd.getDependencies().getAnElement() or
+ this = amd.getDependencies().getAnElement() and
+ not isPseudoDependency(this.getStringValue())
+ or
this = amd.getARequireCall().getAnArgument()
)
}
diff --git a/javascript/ql/test/library-tests/AMD/tests.expected b/javascript/ql/test/library-tests/AMD/tests.expected
index 265a7f291dfe..ce9d6f60f5dd 100644
--- a/javascript/ql/test/library-tests/AMD/tests.expected
+++ b/javascript/ql/test/library-tests/AMD/tests.expected
@@ -61,7 +61,6 @@ amdModuleDefinition
| umd.js:4:9:4:43 | define( ... actory) | umd.js:1:18:1:24 | factory |
| umd.js:4:9:4:43 | define( ... actory) | umd.js:9:9:14:1 | functio ... };\\n} |
amdModuleDependencies
-| tst2.js:1:1:3:2 | define( ... 42;\\n}) | tst2.js:1:9:1:17 | 'exports' |
| tst3.js:1:1:3:2 | define( ... 42;\\n}) | tst3.js:2:21:2:25 | './a' |
| tst4.js:1:1:11:2 | define( ... };\\n}) | tst4.js:2:9:2:14 | 'a.js' |
| tst4.js:1:1:11:2 | define( ... };\\n}) | tst4.js:3:9:3:13 | 'foo' |
From 9f01ea68f7d3ce004d54cf3d4132c2a2b89b0bea Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen
Date: Fri, 1 Mar 2024 10:19:49 +0100
Subject: [PATCH 037/731] Python: Add type-tracking consistency query
For now I'm only ignoring stdlib nodes, so it's easy for reviewer to see
why we need to have more excludes :)
---
.../TypeTrackingConsistency.ql | 12 +++++
.../TypeTrackingConsistency.expected | 50 +++++++++++++++++++
2 files changed, 62 insertions(+)
create mode 100644 python/ql/consistency-queries/TypeTrackingConsistency.ql
create mode 100644 python/ql/test/experimental/dataflow/typetracking/CONSISTENCY/TypeTrackingConsistency.expected
diff --git a/python/ql/consistency-queries/TypeTrackingConsistency.ql b/python/ql/consistency-queries/TypeTrackingConsistency.ql
new file mode 100644
index 000000000000..f338c4dcb1d6
--- /dev/null
+++ b/python/ql/consistency-queries/TypeTrackingConsistency.ql
@@ -0,0 +1,12 @@
+private import python
+private import semmle.python.dataflow.new.DataFlow
+private import semmle.python.dataflow.new.internal.DataFlowPrivate as DataFlowPrivate
+private import semmle.python.dataflow.new.internal.TypeTrackingImpl
+
+private module ConsistencyChecksInput implements ConsistencyChecksInputSig {
+ predicate unreachableNodeExclude(DataFlow::Node n) {
+ not exists(n.getLocation().getFile().getRelativePath())
+ }
+}
+
+import ConsistencyChecks
diff --git a/python/ql/test/experimental/dataflow/typetracking/CONSISTENCY/TypeTrackingConsistency.expected b/python/ql/test/experimental/dataflow/typetracking/CONSISTENCY/TypeTrackingConsistency.expected
new file mode 100644
index 000000000000..8f036153e537
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/typetracking/CONSISTENCY/TypeTrackingConsistency.expected
@@ -0,0 +1,50 @@
+unreachableNode
+| attribute_tests.py:6:5:6:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:12:9:12:9 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:13:5:13:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:28:5:28:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:29:17:29:17 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:30:5:30:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:39:13:39:13 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:45:5:45:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:77:10:77:16 | [post] ControlFlowNode for MyClass | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:89:13:89:13 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:95:5:95:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:102:13:102:13 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:109:5:109:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:117:5:117:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:123:5:123:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:130:5:130:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:137:5:137:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:150:18:150:21 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:153:19:153:22 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:156:34:156:37 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:159:12:159:21 | [pre] ControlFlowNode for MyClass2() | Unreachable node in step of kind call. |
+| attribute_tests.py:160:7:160:14 | [post] ControlFlowNode for instance | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:167:20:167:23 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:170:19:170:22 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:173:34:173:37 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:177:1:177:8 | [post] ControlFlowNode for instance | Unreachable node in step of kind simpleLocalSmallStep. |
+| attribute_tests.py:178:1:178:8 | [post] ControlFlowNode for instance | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:54:5:54:12 | [post] ControlFlowNode for mymodule | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:55:9:55:16 | [post] ControlFlowNode for mymodule | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:72:15:72:15 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:74:13:74:17 | [post] ControlFlowNode for print | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:92:9:92:13 | [post] ControlFlowNode for print | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:98:2:98:13 | [post] ControlFlowNode for my_decorator | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:130:15:130:18 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:133:15:133:18 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:136:15:136:18 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:142:15:142:18 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:145:15:145:18 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:148:15:148:18 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:151:20:151:23 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:152:9:152:12 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:153:9:153:13 | [post] ControlFlowNode for super | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:162:5:162:7 | [post] ControlFlowNode for foo | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:163:9:163:11 | [post] ControlFlowNode for foo | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:179:14:179:24 | [post] ControlFlowNode for get_tracked | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:181:1:181:5 | [post] ControlFlowNode for print | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:188:9:188:13 | [post] ControlFlowNode for print | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:192:9:192:13 | [post] ControlFlowNode for print | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:208:14:208:30 | [post] ControlFlowNode for yielding_function | Unreachable node in step of kind simpleLocalSmallStep. |
From bbe8c6dcaa3f0702741b83d9706f01ca5d713be2 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen
Date: Fri, 1 Mar 2024 10:23:50 +0100
Subject: [PATCH 038/731] Python: Remove synth postupdate nodes from
tt-consistency
---
.../TypeTrackingConsistency.ql | 2 +
.../TypeTrackingConsistency.expected | 48 -------------------
2 files changed, 2 insertions(+), 48 deletions(-)
diff --git a/python/ql/consistency-queries/TypeTrackingConsistency.ql b/python/ql/consistency-queries/TypeTrackingConsistency.ql
index f338c4dcb1d6..772960b08a8a 100644
--- a/python/ql/consistency-queries/TypeTrackingConsistency.ql
+++ b/python/ql/consistency-queries/TypeTrackingConsistency.ql
@@ -6,6 +6,8 @@ private import semmle.python.dataflow.new.internal.TypeTrackingImpl
private module ConsistencyChecksInput implements ConsistencyChecksInputSig {
predicate unreachableNodeExclude(DataFlow::Node n) {
not exists(n.getLocation().getFile().getRelativePath())
+ or
+ n instanceof DataFlowPrivate::SyntheticPostUpdateNode
}
}
diff --git a/python/ql/test/experimental/dataflow/typetracking/CONSISTENCY/TypeTrackingConsistency.expected b/python/ql/test/experimental/dataflow/typetracking/CONSISTENCY/TypeTrackingConsistency.expected
index 8f036153e537..8cba9c02c17c 100644
--- a/python/ql/test/experimental/dataflow/typetracking/CONSISTENCY/TypeTrackingConsistency.expected
+++ b/python/ql/test/experimental/dataflow/typetracking/CONSISTENCY/TypeTrackingConsistency.expected
@@ -1,50 +1,2 @@
unreachableNode
-| attribute_tests.py:6:5:6:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:12:9:12:9 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:13:5:13:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:28:5:28:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:29:17:29:17 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:30:5:30:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:39:13:39:13 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:45:5:45:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:77:10:77:16 | [post] ControlFlowNode for MyClass | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:89:13:89:13 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:95:5:95:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:102:13:102:13 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:109:5:109:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:117:5:117:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:123:5:123:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:130:5:130:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:137:5:137:5 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:150:18:150:21 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:153:19:153:22 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:156:34:156:37 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
| attribute_tests.py:159:12:159:21 | [pre] ControlFlowNode for MyClass2() | Unreachable node in step of kind call. |
-| attribute_tests.py:160:7:160:14 | [post] ControlFlowNode for instance | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:167:20:167:23 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:170:19:170:22 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:173:34:173:37 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:177:1:177:8 | [post] ControlFlowNode for instance | Unreachable node in step of kind simpleLocalSmallStep. |
-| attribute_tests.py:178:1:178:8 | [post] ControlFlowNode for instance | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:54:5:54:12 | [post] ControlFlowNode for mymodule | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:55:9:55:16 | [post] ControlFlowNode for mymodule | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:72:15:72:15 | [post] ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:74:13:74:17 | [post] ControlFlowNode for print | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:92:9:92:13 | [post] ControlFlowNode for print | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:98:2:98:13 | [post] ControlFlowNode for my_decorator | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:130:15:130:18 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:133:15:133:18 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:136:15:136:18 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:142:15:142:18 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:145:15:145:18 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:148:15:148:18 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:151:20:151:23 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:152:9:152:12 | [post] ControlFlowNode for self | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:153:9:153:13 | [post] ControlFlowNode for super | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:162:5:162:7 | [post] ControlFlowNode for foo | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:163:9:163:11 | [post] ControlFlowNode for foo | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:179:14:179:24 | [post] ControlFlowNode for get_tracked | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:181:1:181:5 | [post] ControlFlowNode for print | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:188:9:188:13 | [post] ControlFlowNode for print | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:192:9:192:13 | [post] ControlFlowNode for print | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:208:14:208:30 | [post] ControlFlowNode for yielding_function | Unreachable node in step of kind simpleLocalSmallStep. |
From ff5f79475099580c8652062988352f37143206bb Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen
Date: Fri, 1 Mar 2024 10:27:29 +0100
Subject: [PATCH 039/731] Python: Exclude synth preupdate nodes from
tt-consistency
... and that should be it :+1: (so that's why I'm allowing the tests to
run on all data-flow nodes again)
---
python/ql/consistency-queries/TypeTrackingConsistency.ql | 4 ++--
.../typetracking/CONSISTENCY/TypeTrackingConsistency.expected | 2 --
2 files changed, 2 insertions(+), 4 deletions(-)
delete mode 100644 python/ql/test/experimental/dataflow/typetracking/CONSISTENCY/TypeTrackingConsistency.expected
diff --git a/python/ql/consistency-queries/TypeTrackingConsistency.ql b/python/ql/consistency-queries/TypeTrackingConsistency.ql
index 772960b08a8a..3083f2b5f1a3 100644
--- a/python/ql/consistency-queries/TypeTrackingConsistency.ql
+++ b/python/ql/consistency-queries/TypeTrackingConsistency.ql
@@ -5,9 +5,9 @@ private import semmle.python.dataflow.new.internal.TypeTrackingImpl
private module ConsistencyChecksInput implements ConsistencyChecksInputSig {
predicate unreachableNodeExclude(DataFlow::Node n) {
- not exists(n.getLocation().getFile().getRelativePath())
- or
n instanceof DataFlowPrivate::SyntheticPostUpdateNode
+ or
+ n instanceof DataFlowPrivate::SyntheticPreUpdateNode
}
}
diff --git a/python/ql/test/experimental/dataflow/typetracking/CONSISTENCY/TypeTrackingConsistency.expected b/python/ql/test/experimental/dataflow/typetracking/CONSISTENCY/TypeTrackingConsistency.expected
deleted file mode 100644
index 8cba9c02c17c..000000000000
--- a/python/ql/test/experimental/dataflow/typetracking/CONSISTENCY/TypeTrackingConsistency.expected
+++ /dev/null
@@ -1,2 +0,0 @@
-unreachableNode
-| attribute_tests.py:159:12:159:21 | [pre] ControlFlowNode for MyClass2() | Unreachable node in step of kind call. |
From bff95c4c1b5ed5fca74215dccd3190758b9679e9 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen
Date: Fri, 1 Mar 2024 13:58:33 +0100
Subject: [PATCH 040/731] Python: Add example of consistency failure
---
.../Arguments/CONSISTENCY/TypeTrackingConsistency.expected | 7 +++++++
1 file changed, 7 insertions(+)
create mode 100644 python/ql/test/query-tests/Classes/Arguments/CONSISTENCY/TypeTrackingConsistency.expected
diff --git a/python/ql/test/query-tests/Classes/Arguments/CONSISTENCY/TypeTrackingConsistency.expected b/python/ql/test/query-tests/Classes/Arguments/CONSISTENCY/TypeTrackingConsistency.expected
new file mode 100644
index 000000000000..c48725c1ebf0
--- /dev/null
+++ b/python/ql/test/query-tests/Classes/Arguments/CONSISTENCY/TypeTrackingConsistency.expected
@@ -0,0 +1,7 @@
+unreachableNode
+| wrong_arguments.py:65:1:65:7 | SynthDictSplatArgumentNode | Unreachable node in step of kind call. |
+| wrong_arguments.py:66:1:66:7 | SynthDictSplatArgumentNode | Unreachable node in step of kind call. |
+| wrong_arguments.py:67:1:67:12 | SynthDictSplatArgumentNode | Unreachable node in step of kind call. |
+| wrong_arguments.py:71:1:71:7 | SynthDictSplatArgumentNode | Unreachable node in step of kind call. |
+| wrong_arguments.py:72:1:72:12 | SynthDictSplatArgumentNode | Unreachable node in step of kind call. |
+| wrong_arguments.py:73:1:73:7 | SynthDictSplatArgumentNode | Unreachable node in step of kind call. |
From 1658a1cb801e140d185e6064a190c2bc0f613126 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen
Date: Fri, 1 Mar 2024 13:59:00 +0100
Subject: [PATCH 041/731] Python: Ignore SynthDictSplatArgumentNode failures
---
python/ql/consistency-queries/TypeTrackingConsistency.ql | 3 +++
.../Arguments/CONSISTENCY/TypeTrackingConsistency.expected | 7 -------
2 files changed, 3 insertions(+), 7 deletions(-)
delete mode 100644 python/ql/test/query-tests/Classes/Arguments/CONSISTENCY/TypeTrackingConsistency.expected
diff --git a/python/ql/consistency-queries/TypeTrackingConsistency.ql b/python/ql/consistency-queries/TypeTrackingConsistency.ql
index 3083f2b5f1a3..68f9e9e5fa7f 100644
--- a/python/ql/consistency-queries/TypeTrackingConsistency.ql
+++ b/python/ql/consistency-queries/TypeTrackingConsistency.ql
@@ -8,6 +8,9 @@ private module ConsistencyChecksInput implements ConsistencyChecksInputSig {
n instanceof DataFlowPrivate::SyntheticPostUpdateNode
or
n instanceof DataFlowPrivate::SyntheticPreUpdateNode
+ or
+ // TODO: when adding support for proper content, handle **kwargs passing better!
+ n instanceof DataFlowPrivate::SynthDictSplatArgumentNode
}
}
diff --git a/python/ql/test/query-tests/Classes/Arguments/CONSISTENCY/TypeTrackingConsistency.expected b/python/ql/test/query-tests/Classes/Arguments/CONSISTENCY/TypeTrackingConsistency.expected
deleted file mode 100644
index c48725c1ebf0..000000000000
--- a/python/ql/test/query-tests/Classes/Arguments/CONSISTENCY/TypeTrackingConsistency.expected
+++ /dev/null
@@ -1,7 +0,0 @@
-unreachableNode
-| wrong_arguments.py:65:1:65:7 | SynthDictSplatArgumentNode | Unreachable node in step of kind call. |
-| wrong_arguments.py:66:1:66:7 | SynthDictSplatArgumentNode | Unreachable node in step of kind call. |
-| wrong_arguments.py:67:1:67:12 | SynthDictSplatArgumentNode | Unreachable node in step of kind call. |
-| wrong_arguments.py:71:1:71:7 | SynthDictSplatArgumentNode | Unreachable node in step of kind call. |
-| wrong_arguments.py:72:1:72:12 | SynthDictSplatArgumentNode | Unreachable node in step of kind call. |
-| wrong_arguments.py:73:1:73:7 | SynthDictSplatArgumentNode | Unreachable node in step of kind call. |
From 5d212514c63ae288371b3878d64f6ed01d7e543b Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen
Date: Fri, 1 Mar 2024 14:07:08 +0100
Subject: [PATCH 042/731] Python: Add example of consistency failure
---
.../TypeTrackingConsistency.expected | 51 +++++++++++++++++++
1 file changed, 51 insertions(+)
create mode 100644 python/ql/test/experimental/dataflow/match/CONSISTENCY/TypeTrackingConsistency.expected
diff --git a/python/ql/test/experimental/dataflow/match/CONSISTENCY/TypeTrackingConsistency.expected b/python/ql/test/experimental/dataflow/match/CONSISTENCY/TypeTrackingConsistency.expected
new file mode 100644
index 000000000000..52cd572e19fa
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/match/CONSISTENCY/TypeTrackingConsistency.expected
@@ -0,0 +1,51 @@
+unreachableNode
+| test.py:72:15:72:15 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:72:15:72:15 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:72:18:72:18 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:72:18:72:18 | ControlFlowNode for y | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:73:20:73:20 | ControlFlowNode for x | Unreachable node in step of kind call. |
+| test.py:74:18:74:18 | ControlFlowNode for y | Unreachable node in step of kind call. |
+| test.py:79:15:79:15 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:79:15:79:15 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:79:18:79:18 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:79:18:79:18 | ControlFlowNode for y | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:80:20:80:20 | ControlFlowNode for x | Unreachable node in step of kind call. |
+| test.py:81:18:81:18 | ControlFlowNode for y | Unreachable node in step of kind call. |
+| test.py:89:15:89:15 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:89:15:89:15 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:89:19:89:19 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:89:19:89:19 | ControlFlowNode for y | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:90:20:90:20 | ControlFlowNode for x | Unreachable node in step of kind call. |
+| test.py:96:15:96:15 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:96:15:96:15 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:96:19:96:19 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:96:19:96:19 | ControlFlowNode for y | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:97:18:97:18 | ControlFlowNode for x | Unreachable node in step of kind call. |
+| test.py:103:15:103:15 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:103:15:103:15 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:103:19:103:19 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:103:19:103:19 | ControlFlowNode for y | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:104:20:104:20 | ControlFlowNode for x | Unreachable node in step of kind call. |
+| test.py:110:15:110:15 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:110:15:110:15 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:110:19:110:19 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:110:19:110:19 | ControlFlowNode for y | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:111:18:111:18 | ControlFlowNode for x | Unreachable node in step of kind call. |
+| test.py:117:20:117:20 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:117:20:117:20 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:117:28:117:28 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:117:28:117:28 | ControlFlowNode for y | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:118:20:118:20 | ControlFlowNode for x | Unreachable node in step of kind call. |
+| test.py:119:18:119:18 | ControlFlowNode for y | Unreachable node in step of kind call. |
+| test.py:125:20:125:20 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:125:20:125:20 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:126:20:126:20 | ControlFlowNode for x | Unreachable node in step of kind call. |
+| test.py:132:20:132:20 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:132:20:132:20 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:133:18:133:18 | ControlFlowNode for x | Unreachable node in step of kind call. |
+| test.py:151:27:151:27 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:151:27:151:27 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:152:18:152:18 | ControlFlowNode for x | Unreachable node in step of kind call. |
+| test.py:155:27:155:27 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:155:27:155:27 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:156:20:156:20 | ControlFlowNode for x | Unreachable node in step of kind call. |
From bcd5c08ebd2693690e5bdba177c023668cf45e5b Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen
Date: Fri, 1 Mar 2024 14:15:32 +0100
Subject: [PATCH 043/731] Python: Ignore match-related inconsistencies
---
.../TypeTrackingConsistency.ql | 9 ++++
.../TypeTrackingConsistency.expected | 51 -------------------
2 files changed, 9 insertions(+), 51 deletions(-)
delete mode 100644 python/ql/test/experimental/dataflow/match/CONSISTENCY/TypeTrackingConsistency.expected
diff --git a/python/ql/consistency-queries/TypeTrackingConsistency.ql b/python/ql/consistency-queries/TypeTrackingConsistency.ql
index 68f9e9e5fa7f..b2349fc0f1c3 100644
--- a/python/ql/consistency-queries/TypeTrackingConsistency.ql
+++ b/python/ql/consistency-queries/TypeTrackingConsistency.ql
@@ -11,6 +11,15 @@ private module ConsistencyChecksInput implements ConsistencyChecksInputSig {
or
// TODO: when adding support for proper content, handle **kwargs passing better!
n instanceof DataFlowPrivate::SynthDictSplatArgumentNode
+ or
+ // TODO: when adding support for proper content, handle unpacking tuples in match
+ // cases better, such as
+ //
+ // match (NONSOURCE, SOURCE):
+ // case (x, y): ...
+ exists(DataFlow::Node m | m.asCfgNode().getNode() instanceof MatchCapturePattern |
+ TypeTrackingInput::simpleLocalSmallStep*(m, n)
+ )
}
}
diff --git a/python/ql/test/experimental/dataflow/match/CONSISTENCY/TypeTrackingConsistency.expected b/python/ql/test/experimental/dataflow/match/CONSISTENCY/TypeTrackingConsistency.expected
deleted file mode 100644
index 52cd572e19fa..000000000000
--- a/python/ql/test/experimental/dataflow/match/CONSISTENCY/TypeTrackingConsistency.expected
+++ /dev/null
@@ -1,51 +0,0 @@
-unreachableNode
-| test.py:72:15:72:15 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:72:15:72:15 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:72:18:72:18 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:72:18:72:18 | ControlFlowNode for y | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:73:20:73:20 | ControlFlowNode for x | Unreachable node in step of kind call. |
-| test.py:74:18:74:18 | ControlFlowNode for y | Unreachable node in step of kind call. |
-| test.py:79:15:79:15 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:79:15:79:15 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:79:18:79:18 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:79:18:79:18 | ControlFlowNode for y | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:80:20:80:20 | ControlFlowNode for x | Unreachable node in step of kind call. |
-| test.py:81:18:81:18 | ControlFlowNode for y | Unreachable node in step of kind call. |
-| test.py:89:15:89:15 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:89:15:89:15 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:89:19:89:19 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:89:19:89:19 | ControlFlowNode for y | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:90:20:90:20 | ControlFlowNode for x | Unreachable node in step of kind call. |
-| test.py:96:15:96:15 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:96:15:96:15 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:96:19:96:19 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:96:19:96:19 | ControlFlowNode for y | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:97:18:97:18 | ControlFlowNode for x | Unreachable node in step of kind call. |
-| test.py:103:15:103:15 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:103:15:103:15 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:103:19:103:19 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:103:19:103:19 | ControlFlowNode for y | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:104:20:104:20 | ControlFlowNode for x | Unreachable node in step of kind call. |
-| test.py:110:15:110:15 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:110:15:110:15 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:110:19:110:19 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:110:19:110:19 | ControlFlowNode for y | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:111:18:111:18 | ControlFlowNode for x | Unreachable node in step of kind call. |
-| test.py:117:20:117:20 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:117:20:117:20 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:117:28:117:28 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:117:28:117:28 | ControlFlowNode for y | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:118:20:118:20 | ControlFlowNode for x | Unreachable node in step of kind call. |
-| test.py:119:18:119:18 | ControlFlowNode for y | Unreachable node in step of kind call. |
-| test.py:125:20:125:20 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:125:20:125:20 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:126:20:126:20 | ControlFlowNode for x | Unreachable node in step of kind call. |
-| test.py:132:20:132:20 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:132:20:132:20 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:133:18:133:18 | ControlFlowNode for x | Unreachable node in step of kind call. |
-| test.py:151:27:151:27 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:151:27:151:27 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:152:18:152:18 | ControlFlowNode for x | Unreachable node in step of kind call. |
-| test.py:155:27:155:27 | ControlFlowNode for MatchCapturePattern | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:155:27:155:27 | ControlFlowNode for x | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:156:20:156:20 | ControlFlowNode for x | Unreachable node in step of kind call. |
From 7e3e5db3dbde7aa9304c758bd21141deff2225e6 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen
Date: Fri, 1 Mar 2024 14:21:16 +0100
Subject: [PATCH 044/731] Python: Add example of consistency failure
---
.../TypeTrackingConsistency.expected | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
create mode 100644 python/ql/test/experimental/dataflow/coverage/CONSISTENCY/TypeTrackingConsistency.expected
diff --git a/python/ql/test/experimental/dataflow/coverage/CONSISTENCY/TypeTrackingConsistency.expected b/python/ql/test/experimental/dataflow/coverage/CONSISTENCY/TypeTrackingConsistency.expected
new file mode 100644
index 000000000000..30f0348dc6d0
--- /dev/null
+++ b/python/ql/test/experimental/dataflow/coverage/CONSISTENCY/TypeTrackingConsistency.expected
@@ -0,0 +1,18 @@
+unreachableNode
+| test.py:215:16:215:19 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:226:17:226:20 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:231:20:231:24 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:580:9:580:12 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:589:5:589:11 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:589:6:589:10 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:589:7:589:9 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:618:7:618:16 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:626:7:626:16 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:634:6:634:17 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:646:6:646:14 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:655:7:655:13 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:664:7:664:13 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:673:6:673:14 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:693:9:693:11 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:701:9:701:12 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
+| test.py:710:9:710:14 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
From 7c60562132247d13ee75a9e466caa73f8e1ebba6 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen
Date: Fri, 1 Mar 2024 14:22:18 +0100
Subject: [PATCH 045/731] Python: Ignore IterableSequenceNode inconsistencies
---
.../TypeTrackingConsistency.ql | 4 ++++
.../TypeTrackingConsistency.expected | 18 ------------------
2 files changed, 4 insertions(+), 18 deletions(-)
delete mode 100644 python/ql/test/experimental/dataflow/coverage/CONSISTENCY/TypeTrackingConsistency.expected
diff --git a/python/ql/consistency-queries/TypeTrackingConsistency.ql b/python/ql/consistency-queries/TypeTrackingConsistency.ql
index b2349fc0f1c3..b8f1e3a1b48c 100644
--- a/python/ql/consistency-queries/TypeTrackingConsistency.ql
+++ b/python/ql/consistency-queries/TypeTrackingConsistency.ql
@@ -20,6 +20,10 @@ private module ConsistencyChecksInput implements ConsistencyChecksInputSig {
exists(DataFlow::Node m | m.asCfgNode().getNode() instanceof MatchCapturePattern |
TypeTrackingInput::simpleLocalSmallStep*(m, n)
)
+ or
+ // TODO: when adding support for proper content, handle iterable unpacking better
+ // such as `for k,v in items:`, or `a, (b,c) = ...`
+ n instanceof DataFlow::IterableSequenceNode
}
}
diff --git a/python/ql/test/experimental/dataflow/coverage/CONSISTENCY/TypeTrackingConsistency.expected b/python/ql/test/experimental/dataflow/coverage/CONSISTENCY/TypeTrackingConsistency.expected
deleted file mode 100644
index 30f0348dc6d0..000000000000
--- a/python/ql/test/experimental/dataflow/coverage/CONSISTENCY/TypeTrackingConsistency.expected
+++ /dev/null
@@ -1,18 +0,0 @@
-unreachableNode
-| test.py:215:16:215:19 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:226:17:226:20 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:231:20:231:24 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:580:9:580:12 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:589:5:589:11 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:589:6:589:10 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:589:7:589:9 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:618:7:618:16 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:626:7:626:16 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:634:6:634:17 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:646:6:646:14 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:655:7:655:13 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:664:7:664:13 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:673:6:673:14 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:693:9:693:11 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:701:9:701:12 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
-| test.py:710:9:710:14 | IterableSequence | Unreachable node in step of kind simpleLocalSmallStep. |
From c95abd47ce4e0b24f87fd7b544a8b5e3cd1f47a2 Mon Sep 17 00:00:00 2001
From: Ed Minnix
Date: Thu, 15 Feb 2024 17:31:46 -0500
Subject: [PATCH 046/731] Remove stored variants of queries
---
.../CWE-078/StoredCommandInjection.qhelp | 6 ---
.../CWE-078/StoredCommandInjection.ql | 34 ----------------
.../Security Features/CWE-079/StoredXSS.qhelp | 6 ---
.../Security Features/CWE-079/StoredXSS.ql | 39 -------------------
.../CWE-090/StoredLDAPInjection.qhelp | 6 ---
.../CWE-090/StoredLDAPInjection.ql | 32 ---------------
.../CWE-643/StoredXPathInjection.qhelp | 6 ---
.../CWE-643/StoredXPathInjection.ql | 32 ---------------
8 files changed, 161 deletions(-)
delete mode 100644 csharp/ql/src/Security Features/CWE-078/StoredCommandInjection.qhelp
delete mode 100644 csharp/ql/src/Security Features/CWE-078/StoredCommandInjection.ql
delete mode 100644 csharp/ql/src/Security Features/CWE-079/StoredXSS.qhelp
delete mode 100644 csharp/ql/src/Security Features/CWE-079/StoredXSS.ql
delete mode 100644 csharp/ql/src/Security Features/CWE-090/StoredLDAPInjection.qhelp
delete mode 100644 csharp/ql/src/Security Features/CWE-090/StoredLDAPInjection.ql
delete mode 100644 csharp/ql/src/Security Features/CWE-643/StoredXPathInjection.qhelp
delete mode 100644 csharp/ql/src/Security Features/CWE-643/StoredXPathInjection.ql
diff --git a/csharp/ql/src/Security Features/CWE-078/StoredCommandInjection.qhelp b/csharp/ql/src/Security Features/CWE-078/StoredCommandInjection.qhelp
deleted file mode 100644
index c9b2874372b6..000000000000
--- a/csharp/ql/src/Security Features/CWE-078/StoredCommandInjection.qhelp
+++ /dev/null
@@ -1,6 +0,0 @@
-
-
-
-
diff --git a/csharp/ql/src/Security Features/CWE-078/StoredCommandInjection.ql b/csharp/ql/src/Security Features/CWE-078/StoredCommandInjection.ql
deleted file mode 100644
index 5f728db84735..000000000000
--- a/csharp/ql/src/Security Features/CWE-078/StoredCommandInjection.ql
+++ /dev/null
@@ -1,34 +0,0 @@
-/**
- * @name Uncontrolled command line from stored user input
- * @description Using externally controlled strings in a command line may allow a malicious
- * user to change the meaning of the command.
- * @kind path-problem
- * @problem.severity error
- * @security-severity 9.8
- * @precision medium
- * @id cs/stored-command-line-injection
- * @tags correctness
- * security
- * external/cwe/cwe-078
- * external/cwe/cwe-088
- */
-
-import csharp
-import semmle.code.csharp.security.dataflow.flowsources.Stored
-import semmle.code.csharp.security.dataflow.CommandInjectionQuery
-import StoredCommandInjection::PathGraph
-
-module StoredCommandInjectionConfig implements DataFlow::ConfigSig {
- predicate isSource(DataFlow::Node source) { source instanceof StoredFlowSource }
-
- predicate isSink = CommandInjectionConfig::isSink/1;
-
- predicate isBarrier = CommandInjectionConfig::isBarrier/1;
-}
-
-module StoredCommandInjection = TaintTracking::Global;
-
-from StoredCommandInjection::PathNode source, StoredCommandInjection::PathNode sink
-where StoredCommandInjection::flowPath(source, sink)
-select sink.getNode(), source, sink, "This command line depends on a $@.", source.getNode(),
- "stored (potentially user-provided) value"
diff --git a/csharp/ql/src/Security Features/CWE-079/StoredXSS.qhelp b/csharp/ql/src/Security Features/CWE-079/StoredXSS.qhelp
deleted file mode 100644
index 8bd2e14ef084..000000000000
--- a/csharp/ql/src/Security Features/CWE-079/StoredXSS.qhelp
+++ /dev/null
@@ -1,6 +0,0 @@
-
-
-
-
diff --git a/csharp/ql/src/Security Features/CWE-079/StoredXSS.ql b/csharp/ql/src/Security Features/CWE-079/StoredXSS.ql
deleted file mode 100644
index 140dedfec51d..000000000000
--- a/csharp/ql/src/Security Features/CWE-079/StoredXSS.ql
+++ /dev/null
@@ -1,39 +0,0 @@
-/**
- * @name Stored cross-site scripting
- * @description Writing input from the database directly to a web page indicates a cross-site
- * scripting vulnerability if the data was originally user-provided.
- * @kind path-problem
- * @problem.severity error
- * @security-severity 6.1
- * @precision medium
- * @id cs/web/stored-xss
- * @tags security
- * external/cwe/cwe-079
- * external/cwe/cwe-116
- */
-
-import csharp
-import semmle.code.csharp.security.dataflow.flowsources.Stored
-import semmle.code.csharp.security.dataflow.XSSQuery
-import semmle.code.csharp.security.dataflow.XSSSinks
-import StoredXss::PathGraph
-
-module StoredXssTrackingConfig implements DataFlow::ConfigSig {
- predicate isSource(DataFlow::Node source) { source instanceof StoredFlowSource }
-
- predicate isSink = XssTrackingConfig::isSink/1;
-
- predicate isBarrier = XssTrackingConfig::isBarrier/1;
-}
-
-module StoredXss = TaintTracking::Global;
-
-from StoredXss::PathNode source, StoredXss::PathNode sink, string explanation
-where
- StoredXss::flowPath(source, sink) and
- if exists(sink.getNode().(Sink).explanation())
- then explanation = " (" + sink.getNode().(Sink).explanation() + ")"
- else explanation = ""
-select sink.getNode(), source, sink,
- "This HTML or JavaScript write" + explanation + " depends on a $@.", source.getNode(),
- "stored (potentially user-provided) value"
diff --git a/csharp/ql/src/Security Features/CWE-090/StoredLDAPInjection.qhelp b/csharp/ql/src/Security Features/CWE-090/StoredLDAPInjection.qhelp
deleted file mode 100644
index f547d512fbcd..000000000000
--- a/csharp/ql/src/Security Features/CWE-090/StoredLDAPInjection.qhelp
+++ /dev/null
@@ -1,6 +0,0 @@
-
-
-
-
diff --git a/csharp/ql/src/Security Features/CWE-090/StoredLDAPInjection.ql b/csharp/ql/src/Security Features/CWE-090/StoredLDAPInjection.ql
deleted file mode 100644
index e5015892fc4e..000000000000
--- a/csharp/ql/src/Security Features/CWE-090/StoredLDAPInjection.ql
+++ /dev/null
@@ -1,32 +0,0 @@
-/**
- * @name LDAP query built from stored user-controlled sources
- * @description Building an LDAP query from stored user-controlled sources is vulnerable to
- * insertion of malicious LDAP code by the user.
- * @kind path-problem
- * @problem.severity error
- * @security-severity 9.8
- * @precision medium
- * @id cs/stored-ldap-injection
- * @tags security
- * external/cwe/cwe-090
- */
-
-import csharp
-import semmle.code.csharp.security.dataflow.LDAPInjectionQuery
-import semmle.code.csharp.security.dataflow.flowsources.Stored
-import StoredLdapInjection::PathGraph
-
-module StoredLdapInjectionConfig implements DataFlow::ConfigSig {
- predicate isSource(DataFlow::Node source) { source instanceof StoredFlowSource }
-
- predicate isSink = LdapInjectionConfig::isSink/1;
-
- predicate isBarrier = LdapInjectionConfig::isBarrier/1;
-}
-
-module StoredLdapInjection = TaintTracking::Global;
-
-from StoredLdapInjection::PathNode source, StoredLdapInjection::PathNode sink
-where StoredLdapInjection::flowPath(source, sink)
-select sink.getNode(), source, sink, "This LDAP query depends on a $@.", source.getNode(),
- "stored (potentially user-provided) value"
diff --git a/csharp/ql/src/Security Features/CWE-643/StoredXPathInjection.qhelp b/csharp/ql/src/Security Features/CWE-643/StoredXPathInjection.qhelp
deleted file mode 100644
index f705e0bbde9f..000000000000
--- a/csharp/ql/src/Security Features/CWE-643/StoredXPathInjection.qhelp
+++ /dev/null
@@ -1,6 +0,0 @@
-
-
-
-
\ No newline at end of file
diff --git a/csharp/ql/src/Security Features/CWE-643/StoredXPathInjection.ql b/csharp/ql/src/Security Features/CWE-643/StoredXPathInjection.ql
deleted file mode 100644
index 3042997ec7ac..000000000000
--- a/csharp/ql/src/Security Features/CWE-643/StoredXPathInjection.ql
+++ /dev/null
@@ -1,32 +0,0 @@
-/**
- * @name Stored XPath injection
- * @description Building an XPath expression from stored data which may have been provided by the
- * user is vulnerable to insertion of malicious code by the user.
- * @kind path-problem
- * @problem.severity error
- * @security-severity 9.8
- * @precision medium
- * @id cs/xml/stored-xpath-injection
- * @tags security
- * external/cwe/cwe-643
- */
-
-import csharp
-import semmle.code.csharp.security.dataflow.flowsources.Stored
-import semmle.code.csharp.security.dataflow.XPathInjectionQuery
-import StoredXpathInjection::PathGraph
-
-module StoredXpathInjectionConfig implements DataFlow::ConfigSig {
- predicate isSource(DataFlow::Node source) { source instanceof StoredFlowSource }
-
- predicate isSink = XpathInjectionConfig::isSink/1;
-
- predicate isBarrier = XpathInjectionConfig::isBarrier/1;
-}
-
-module StoredXpathInjection = TaintTracking::Global;
-
-from StoredXpathInjection::PathNode source, StoredXpathInjection::PathNode sink
-where StoredXpathInjection::flowPath(source, sink)
-select sink.getNode(), source, sink, "This XPath expression depends on a $@.", source.getNode(),
- "stored (potentially user-provided) value"
From be3c1ed0be057c2323337f3fd2df66a4a01cc544 Mon Sep 17 00:00:00 2001
From: Ed Minnix
Date: Thu, 15 Feb 2024 17:36:55 -0500
Subject: [PATCH 047/731] Change note
---
.../change-notes/2024-03-11-remove-stored-query-variants.md | 5 +++++
1 file changed, 5 insertions(+)
create mode 100644 csharp/ql/src/change-notes/2024-03-11-remove-stored-query-variants.md
diff --git a/csharp/ql/src/change-notes/2024-03-11-remove-stored-query-variants.md b/csharp/ql/src/change-notes/2024-03-11-remove-stored-query-variants.md
new file mode 100644
index 000000000000..48c1e409d030
--- /dev/null
+++ b/csharp/ql/src/change-notes/2024-03-11-remove-stored-query-variants.md
@@ -0,0 +1,5 @@
+---
+category: majorAnalysis
+---
+* The `Stored` variants of some queries (`cs/stored-command-line-injection`, `cs/web/stored-xss`, `cs/stored-ldap-injection`, `cs/xml/stored-xpath-injection`) have been removed. If you were using these queries, their results can be restored by enabling the `stored` threat model in your threat model settings.
+
From c3671c7625d195dd907931e1e700c897b311146d Mon Sep 17 00:00:00 2001
From: Ed Minnix
Date: Thu, 15 Feb 2024 17:41:14 -0500
Subject: [PATCH 048/731] Fix change note
---
.../src/change-notes/2024-03-11-remove-stored-query-variants.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/csharp/ql/src/change-notes/2024-03-11-remove-stored-query-variants.md b/csharp/ql/src/change-notes/2024-03-11-remove-stored-query-variants.md
index 48c1e409d030..f62d293dc046 100644
--- a/csharp/ql/src/change-notes/2024-03-11-remove-stored-query-variants.md
+++ b/csharp/ql/src/change-notes/2024-03-11-remove-stored-query-variants.md
@@ -1,5 +1,5 @@
---
category: majorAnalysis
---
-* The `Stored` variants of some queries (`cs/stored-command-line-injection`, `cs/web/stored-xss`, `cs/stored-ldap-injection`, `cs/xml/stored-xpath-injection`) have been removed. If you were using these queries, their results can be restored by enabling the `stored` threat model in your threat model settings.
+* The `Stored` variants of some queries (`cs/stored-command-line-injection`, `cs/web/stored-xss`, `cs/stored-ldap-injection`, `cs/xml/stored-xpath-injection`) have been removed. If you were using these queries, their results can be restored by enabling the `local` threat model in your threat model settings.
From e84a50997615d598f095759208e02d8d67c06a21 Mon Sep 17 00:00:00 2001
From: Ed Minnix
Date: Tue, 20 Feb 2024 13:56:34 -0500
Subject: [PATCH 049/731] Modify test cases
---
.../CWE-078/CommandInjection.cs | 19 +++++
.../CWE-078/CommandInjection.expected | 70 ++++++++++++---
.../CWE-078/CommandInjection.ext.yml | 7 ++
.../CWE-078/StoredCommandInjection.cs | 28 ------
.../CWE-078/StoredCommandInjection.expected | 8 --
.../CWE-078/StoredCommandInjection.qlref | 1 -
.../CWE-079/StoredXSS/StoredXSS.ext.yml | 7 ++
.../CWE-079/StoredXSS/StoredXSS.qlref | 2 +-
.../CWE-090/LDAPInjection.cs | 15 ++++
.../CWE-090/LDAPInjection.expected | 41 +++++++--
.../CWE-090/LDAPInjection.ext.yml | 7 ++
.../CWE-090/StoredLDAPInjection.cs | 28 ------
.../CWE-090/StoredLDAPInjection.expected | 8 --
.../CWE-090/StoredLDAPInjection.qlref | 1 -
.../CWE-643/StoredXPathInjection.cs | 37 --------
.../CWE-643/StoredXPathInjection.expected | 20 -----
.../CWE-643/StoredXPathInjection.qlref | 1 -
.../CWE-643/XPathInjection.cs | 27 ++++++
.../CWE-643/XPathInjection.expected | 85 ++++++++++++++++---
.../CWE-643/XPathInjection.ext.yml | 7 ++
20 files changed, 254 insertions(+), 165 deletions(-)
create mode 100644 csharp/ql/test/query-tests/Security Features/CWE-078/CommandInjection.ext.yml
delete mode 100644 csharp/ql/test/query-tests/Security Features/CWE-078/StoredCommandInjection.cs
delete mode 100644 csharp/ql/test/query-tests/Security Features/CWE-078/StoredCommandInjection.expected
delete mode 100644 csharp/ql/test/query-tests/Security Features/CWE-078/StoredCommandInjection.qlref
create mode 100644 csharp/ql/test/query-tests/Security Features/CWE-079/StoredXSS/StoredXSS.ext.yml
create mode 100644 csharp/ql/test/query-tests/Security Features/CWE-090/LDAPInjection.ext.yml
delete mode 100644 csharp/ql/test/query-tests/Security Features/CWE-090/StoredLDAPInjection.cs
delete mode 100644 csharp/ql/test/query-tests/Security Features/CWE-090/StoredLDAPInjection.expected
delete mode 100644 csharp/ql/test/query-tests/Security Features/CWE-090/StoredLDAPInjection.qlref
delete mode 100644 csharp/ql/test/query-tests/Security Features/CWE-643/StoredXPathInjection.cs
delete mode 100644 csharp/ql/test/query-tests/Security Features/CWE-643/StoredXPathInjection.expected
delete mode 100644 csharp/ql/test/query-tests/Security Features/CWE-643/StoredXPathInjection.qlref
create mode 100644 csharp/ql/test/query-tests/Security Features/CWE-643/XPathInjection.ext.yml
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-078/CommandInjection.cs b/csharp/ql/test/query-tests/Security Features/CWE-078/CommandInjection.cs
index 85a95df55e4f..df3db94b4335 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-078/CommandInjection.cs
+++ b/csharp/ql/test/query-tests/Security Features/CWE-078/CommandInjection.cs
@@ -1,4 +1,6 @@
using System;
+using System.Data.SqlClient;
+using System.Diagnostics;
namespace System.Web.UI.WebControls
{
@@ -34,5 +36,22 @@ public void WebCommandInjection()
startInfoProps.WorkingDirectory = userInput;
Process.Start(startInfoProps);
}
+
+ public void StoredCommandInjection()
+ {
+ using (SqlConnection connection = new SqlConnection(""))
+ {
+ connection.Open();
+ SqlCommand customerCommand = new SqlCommand("SELECT * FROM customers", connection);
+ SqlDataReader customerReader = customerCommand.ExecuteReader();
+
+ while (customerReader.Read())
+ {
+ // BAD: Read from database, and use it to directly execute a command
+ Process.Start("foo.exe", "/c " + customerReader.GetString(1));
+ }
+ customerReader.Close();
+ }
+ }
}
}
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-078/CommandInjection.expected b/csharp/ql/test/query-tests/Security Features/CWE-078/CommandInjection.expected
index 11b83a0ae20c..1e8317bac241 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-078/CommandInjection.expected
+++ b/csharp/ql/test/query-tests/Security Features/CWE-078/CommandInjection.expected
@@ -1,4 +1,5 @@
edges
+<<<<<<< HEAD
| CommandInjection.cs:25:20:25:28 | access to local variable userInput : String | CommandInjection.cs:26:27:26:47 | ... + ... | provenance | |
| CommandInjection.cs:25:20:25:28 | access to local variable userInput : String | CommandInjection.cs:26:50:26:66 | ... + ... | provenance | |
| CommandInjection.cs:25:20:25:28 | access to local variable userInput : String | CommandInjection.cs:28:63:28:71 | access to local variable userInput | provenance | |
@@ -42,18 +43,63 @@ nodes
| CommandInjection.cs:33:13:33:26 | [post] access to local variable startInfoProps : ProcessStartInfo | semmle.label | [post] access to local variable startInfoProps : ProcessStartInfo |
| CommandInjection.cs:33:40:33:48 | access to local variable userInput | semmle.label | access to local variable userInput |
| CommandInjection.cs:33:40:33:48 | access to local variable userInput : String | semmle.label | access to local variable userInput : String |
+=======
+| CommandInjection.cs:27:32:27:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:27:32:27:51 | access to property Text : String | provenance | |
+| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:28:27:28:47 | ... + ... | provenance | |
+| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:28:50:28:66 | ... + ... | provenance | |
+| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:30:63:30:71 | access to local variable userInput | provenance | |
+| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:30:63:30:71 | access to local variable userInput : String | provenance | |
+| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:30:74:30:82 | access to local variable userInput | provenance | |
+| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:30:74:30:82 | access to local variable userInput : String | provenance | |
+| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:34:39:34:47 | access to local variable userInput | provenance | |
+| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:34:39:34:47 | access to local variable userInput : String | provenance | |
+| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:35:40:35:48 | access to local variable userInput | provenance | |
+| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:35:40:35:48 | access to local variable userInput : String | provenance | |
+| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:36:47:36:55 | access to local variable userInput | provenance | |
+| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:36:47:36:55 | access to local variable userInput : String | provenance | |
+| CommandInjection.cs:30:42:30:83 | object creation of type ProcessStartInfo : ProcessStartInfo | CommandInjection.cs:31:27:31:35 | access to local variable startInfo | provenance | |
+| CommandInjection.cs:30:63:30:71 | access to local variable userInput : String | CommandInjection.cs:30:42:30:83 | object creation of type ProcessStartInfo : ProcessStartInfo | provenance | |
+| CommandInjection.cs:30:74:30:82 | access to local variable userInput : String | CommandInjection.cs:30:42:30:83 | object creation of type ProcessStartInfo : ProcessStartInfo | provenance | |
+| CommandInjection.cs:34:13:34:26 | [post] access to local variable startInfoProps : ProcessStartInfo | CommandInjection.cs:37:27:37:40 | access to local variable startInfoProps | provenance | |
+| CommandInjection.cs:34:39:34:47 | access to local variable userInput : String | CommandInjection.cs:34:13:34:26 | [post] access to local variable startInfoProps : ProcessStartInfo | provenance | |
+| CommandInjection.cs:35:13:35:26 | [post] access to local variable startInfoProps : ProcessStartInfo | CommandInjection.cs:37:27:37:40 | access to local variable startInfoProps | provenance | |
+| CommandInjection.cs:35:40:35:48 | access to local variable userInput : String | CommandInjection.cs:35:13:35:26 | [post] access to local variable startInfoProps : ProcessStartInfo | provenance | |
+| CommandInjection.cs:36:13:36:26 | [post] access to local variable startInfoProps : ProcessStartInfo | CommandInjection.cs:37:27:37:40 | access to local variable startInfoProps | provenance | |
+| CommandInjection.cs:36:47:36:55 | access to local variable userInput : String | CommandInjection.cs:36:13:36:26 | [post] access to local variable startInfoProps : ProcessStartInfo | provenance | |
+| CommandInjection.cs:51:54:51:80 | call to method GetString : String | CommandInjection.cs:51:46:51:80 | ... + ... | provenance | |
+nodes
+| CommandInjection.cs:27:32:27:46 | access to field categoryTextBox : TextBox | semmle.label | access to field categoryTextBox : TextBox |
+| CommandInjection.cs:27:32:27:51 | access to property Text : String | semmle.label | access to property Text : String |
+| CommandInjection.cs:28:27:28:47 | ... + ... | semmle.label | ... + ... |
+| CommandInjection.cs:28:50:28:66 | ... + ... | semmle.label | ... + ... |
+| CommandInjection.cs:30:42:30:83 | object creation of type ProcessStartInfo : ProcessStartInfo | semmle.label | object creation of type ProcessStartInfo : ProcessStartInfo |
+| CommandInjection.cs:30:63:30:71 | access to local variable userInput | semmle.label | access to local variable userInput |
+| CommandInjection.cs:30:63:30:71 | access to local variable userInput : String | semmle.label | access to local variable userInput : String |
+| CommandInjection.cs:30:74:30:82 | access to local variable userInput | semmle.label | access to local variable userInput |
+| CommandInjection.cs:30:74:30:82 | access to local variable userInput : String | semmle.label | access to local variable userInput : String |
+| CommandInjection.cs:31:27:31:35 | access to local variable startInfo | semmle.label | access to local variable startInfo |
+>>>>>>> 4fc83a3267 (Modify test cases)
| CommandInjection.cs:34:13:34:26 | [post] access to local variable startInfoProps : ProcessStartInfo | semmle.label | [post] access to local variable startInfoProps : ProcessStartInfo |
-| CommandInjection.cs:34:47:34:55 | access to local variable userInput | semmle.label | access to local variable userInput |
-| CommandInjection.cs:34:47:34:55 | access to local variable userInput : String | semmle.label | access to local variable userInput : String |
-| CommandInjection.cs:35:27:35:40 | access to local variable startInfoProps | semmle.label | access to local variable startInfoProps |
+| CommandInjection.cs:34:39:34:47 | access to local variable userInput | semmle.label | access to local variable userInput |
+| CommandInjection.cs:34:39:34:47 | access to local variable userInput : String | semmle.label | access to local variable userInput : String |
+| CommandInjection.cs:35:13:35:26 | [post] access to local variable startInfoProps : ProcessStartInfo | semmle.label | [post] access to local variable startInfoProps : ProcessStartInfo |
+| CommandInjection.cs:35:40:35:48 | access to local variable userInput | semmle.label | access to local variable userInput |
+| CommandInjection.cs:35:40:35:48 | access to local variable userInput : String | semmle.label | access to local variable userInput : String |
+| CommandInjection.cs:36:13:36:26 | [post] access to local variable startInfoProps : ProcessStartInfo | semmle.label | [post] access to local variable startInfoProps : ProcessStartInfo |
+| CommandInjection.cs:36:47:36:55 | access to local variable userInput | semmle.label | access to local variable userInput |
+| CommandInjection.cs:36:47:36:55 | access to local variable userInput : String | semmle.label | access to local variable userInput : String |
+| CommandInjection.cs:37:27:37:40 | access to local variable startInfoProps | semmle.label | access to local variable startInfoProps |
+| CommandInjection.cs:51:46:51:80 | ... + ... | semmle.label | ... + ... |
+| CommandInjection.cs:51:54:51:80 | call to method GetString : String | semmle.label | call to method GetString : String |
subpaths
#select
-| CommandInjection.cs:26:27:26:47 | ... + ... | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:26:27:26:47 | ... + ... | This command line depends on a $@. | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox | user-provided value |
-| CommandInjection.cs:26:50:26:66 | ... + ... | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:26:50:26:66 | ... + ... | This command line depends on a $@. | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox | user-provided value |
-| CommandInjection.cs:28:63:28:71 | access to local variable userInput | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:28:63:28:71 | access to local variable userInput | This command line depends on a $@. | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox | user-provided value |
-| CommandInjection.cs:28:74:28:82 | access to local variable userInput | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:28:74:28:82 | access to local variable userInput | This command line depends on a $@. | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox | user-provided value |
-| CommandInjection.cs:29:27:29:35 | access to local variable startInfo | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:29:27:29:35 | access to local variable startInfo | This command line depends on a $@. | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox | user-provided value |
-| CommandInjection.cs:32:39:32:47 | access to local variable userInput | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:32:39:32:47 | access to local variable userInput | This command line depends on a $@. | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox | user-provided value |
-| CommandInjection.cs:33:40:33:48 | access to local variable userInput | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:33:40:33:48 | access to local variable userInput | This command line depends on a $@. | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox | user-provided value |
-| CommandInjection.cs:34:47:34:55 | access to local variable userInput | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:34:47:34:55 | access to local variable userInput | This command line depends on a $@. | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox | user-provided value |
-| CommandInjection.cs:35:27:35:40 | access to local variable startInfoProps | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:35:27:35:40 | access to local variable startInfoProps | This command line depends on a $@. | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox | user-provided value |
+| CommandInjection.cs:28:27:28:47 | ... + ... | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:28:27:28:47 | ... + ... | This command line depends on a $@. | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox | user-provided value |
+| CommandInjection.cs:28:50:28:66 | ... + ... | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:28:50:28:66 | ... + ... | This command line depends on a $@. | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox | user-provided value |
+| CommandInjection.cs:30:63:30:71 | access to local variable userInput | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:30:63:30:71 | access to local variable userInput | This command line depends on a $@. | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox | user-provided value |
+| CommandInjection.cs:30:74:30:82 | access to local variable userInput | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:30:74:30:82 | access to local variable userInput | This command line depends on a $@. | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox | user-provided value |
+| CommandInjection.cs:31:27:31:35 | access to local variable startInfo | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:31:27:31:35 | access to local variable startInfo | This command line depends on a $@. | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox | user-provided value |
+| CommandInjection.cs:34:39:34:47 | access to local variable userInput | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:34:39:34:47 | access to local variable userInput | This command line depends on a $@. | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox | user-provided value |
+| CommandInjection.cs:35:40:35:48 | access to local variable userInput | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:35:40:35:48 | access to local variable userInput | This command line depends on a $@. | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox | user-provided value |
+| CommandInjection.cs:36:47:36:55 | access to local variable userInput | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:36:47:36:55 | access to local variable userInput | This command line depends on a $@. | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox | user-provided value |
+| CommandInjection.cs:37:27:37:40 | access to local variable startInfoProps | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:37:27:37:40 | access to local variable startInfoProps | This command line depends on a $@. | CommandInjection.cs:27:32:27:46 | access to field categoryTextBox | user-provided value |
+| CommandInjection.cs:51:46:51:80 | ... + ... | CommandInjection.cs:51:54:51:80 | call to method GetString : String | CommandInjection.cs:51:46:51:80 | ... + ... | This command line depends on a $@. | CommandInjection.cs:51:54:51:80 | call to method GetString | user-provided value |
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-078/CommandInjection.ext.yml b/csharp/ql/test/query-tests/Security Features/CWE-078/CommandInjection.ext.yml
new file mode 100644
index 000000000000..82f107ae1d71
--- /dev/null
+++ b/csharp/ql/test/query-tests/Security Features/CWE-078/CommandInjection.ext.yml
@@ -0,0 +1,7 @@
+extensions:
+
+ - addsTo:
+ pack: codeql/threat-models
+ extensible: threatModelConfiguration
+ data:
+ - ["local", true, 0]
\ No newline at end of file
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-078/StoredCommandInjection.cs b/csharp/ql/test/query-tests/Security Features/CWE-078/StoredCommandInjection.cs
deleted file mode 100644
index b9f4ca1de9de..000000000000
--- a/csharp/ql/test/query-tests/Security Features/CWE-078/StoredCommandInjection.cs
+++ /dev/null
@@ -1,28 +0,0 @@
-using System;
-using System.Data.SqlClient;
-using System.Diagnostics;
-
-namespace Test
-{
-
- class StoredCommandInjection
- {
-
- public void Test()
- {
- using (SqlConnection connection = new SqlConnection(""))
- {
- connection.Open();
- SqlCommand customerCommand = new SqlCommand("SELECT * FROM customers", connection);
- SqlDataReader customerReader = customerCommand.ExecuteReader();
-
- while (customerReader.Read())
- {
- // BAD: Read from database, and use it to directly execute a command
- Process.Start("foo.exe", "/c " + customerReader.GetString(1));
- }
- customerReader.Close();
- }
- }
- }
-}
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-078/StoredCommandInjection.expected b/csharp/ql/test/query-tests/Security Features/CWE-078/StoredCommandInjection.expected
deleted file mode 100644
index 46c85f7abbe6..000000000000
--- a/csharp/ql/test/query-tests/Security Features/CWE-078/StoredCommandInjection.expected
+++ /dev/null
@@ -1,8 +0,0 @@
-edges
-| StoredCommandInjection.cs:22:54:22:80 | call to method GetString : String | StoredCommandInjection.cs:22:46:22:80 | ... + ... | provenance | |
-nodes
-| StoredCommandInjection.cs:22:46:22:80 | ... + ... | semmle.label | ... + ... |
-| StoredCommandInjection.cs:22:54:22:80 | call to method GetString : String | semmle.label | call to method GetString : String |
-subpaths
-#select
-| StoredCommandInjection.cs:22:46:22:80 | ... + ... | StoredCommandInjection.cs:22:54:22:80 | call to method GetString : String | StoredCommandInjection.cs:22:46:22:80 | ... + ... | This command line depends on a $@. | StoredCommandInjection.cs:22:54:22:80 | call to method GetString | stored (potentially user-provided) value |
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-078/StoredCommandInjection.qlref b/csharp/ql/test/query-tests/Security Features/CWE-078/StoredCommandInjection.qlref
deleted file mode 100644
index c2df5055b37b..000000000000
--- a/csharp/ql/test/query-tests/Security Features/CWE-078/StoredCommandInjection.qlref
+++ /dev/null
@@ -1 +0,0 @@
-Security Features/CWE-078/StoredCommandInjection.ql
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/StoredXSS/StoredXSS.ext.yml b/csharp/ql/test/query-tests/Security Features/CWE-079/StoredXSS/StoredXSS.ext.yml
new file mode 100644
index 000000000000..82f107ae1d71
--- /dev/null
+++ b/csharp/ql/test/query-tests/Security Features/CWE-079/StoredXSS/StoredXSS.ext.yml
@@ -0,0 +1,7 @@
+extensions:
+
+ - addsTo:
+ pack: codeql/threat-models
+ extensible: threatModelConfiguration
+ data:
+ - ["local", true, 0]
\ No newline at end of file
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/StoredXSS/StoredXSS.qlref b/csharp/ql/test/query-tests/Security Features/CWE-079/StoredXSS/StoredXSS.qlref
index 196efd7f0e42..faad1d6403c1 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-079/StoredXSS/StoredXSS.qlref
+++ b/csharp/ql/test/query-tests/Security Features/CWE-079/StoredXSS/StoredXSS.qlref
@@ -1 +1 @@
-Security Features/CWE-079/StoredXSS.ql
+Security Features/CWE-079/XSS.ql
\ No newline at end of file
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-090/LDAPInjection.cs b/csharp/ql/test/query-tests/Security Features/CWE-090/LDAPInjection.cs
index 2f43a4d4c125..ddd24e19729f 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-090/LDAPInjection.cs
+++ b/csharp/ql/test/query-tests/Security Features/CWE-090/LDAPInjection.cs
@@ -1,4 +1,5 @@
using System;
+using System.Data.SqlClient;
using System.DirectoryServices;
using System.DirectoryServices.Protocols;
using System.Web;
@@ -27,6 +28,20 @@ public void ProcessRequest(HttpContext ctx)
DirectoryEntry de = new DirectoryEntry("LDAP://Cn=" + userName);
DirectoryEntry de2 = new DirectoryEntry();
de2.Path = "LDAP://Cn=" + userName;
+
+ using (SqlConnection connection = new SqlConnection(""))
+ {
+ connection.Open();
+ SqlCommand customerCommand = new SqlCommand("SELECT * FROM customers", connection);
+ SqlDataReader customerReader = customerCommand.ExecuteReader();
+
+ while (customerReader.Read())
+ {
+ // BAD: Read from database, write it straight to a response
+ DirectorySearcher ds4 = new DirectorySearcher("accountname=" + customerReader.GetString(1));
+ }
+ customerReader.Close();
+ }
}
public string LDAPEncode(string value)
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-090/LDAPInjection.expected b/csharp/ql/test/query-tests/Security Features/CWE-090/LDAPInjection.expected
index 59be23198dc3..87b4ba8da1e9 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-090/LDAPInjection.expected
+++ b/csharp/ql/test/query-tests/Security Features/CWE-090/LDAPInjection.expected
@@ -1,4 +1,5 @@
edges
+<<<<<<< HEAD
| LDAPInjection.cs:11:16:11:23 | access to local variable userName : String | LDAPInjection.cs:14:54:14:78 | ... + ... | provenance | |
| LDAPInjection.cs:11:16:11:23 | access to local variable userName : String | LDAPInjection.cs:16:21:16:45 | ... + ... | provenance | |
| LDAPInjection.cs:11:16:11:23 | access to local variable userName : String | LDAPInjection.cs:23:21:23:45 | ... + ... | provenance | |
@@ -18,11 +19,39 @@ nodes
| LDAPInjection.cs:24:53:24:77 | ... + ... | semmle.label | ... + ... |
| LDAPInjection.cs:27:48:27:70 | ... + ... | semmle.label | ... + ... |
| LDAPInjection.cs:29:20:29:42 | ... + ... | semmle.label | ... + ... |
+=======
+| LDAPInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | LDAPInjection.cs:12:27:12:61 | access to indexer : String | provenance | |
+| LDAPInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | LDAPInjection.cs:15:54:15:78 | ... + ... | provenance | |
+| LDAPInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | LDAPInjection.cs:17:21:17:45 | ... + ... | provenance | |
+| LDAPInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | LDAPInjection.cs:24:21:24:45 | ... + ... | provenance | |
+| LDAPInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | LDAPInjection.cs:25:53:25:77 | ... + ... | provenance | |
+| LDAPInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | LDAPInjection.cs:28:48:28:70 | ... + ... | provenance | |
+| LDAPInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | LDAPInjection.cs:30:20:30:42 | ... + ... | provenance | |
+| LDAPInjection.cs:12:27:12:61 | access to indexer : String | LDAPInjection.cs:15:54:15:78 | ... + ... | provenance | |
+| LDAPInjection.cs:12:27:12:61 | access to indexer : String | LDAPInjection.cs:17:21:17:45 | ... + ... | provenance | |
+| LDAPInjection.cs:12:27:12:61 | access to indexer : String | LDAPInjection.cs:24:21:24:45 | ... + ... | provenance | |
+| LDAPInjection.cs:12:27:12:61 | access to indexer : String | LDAPInjection.cs:25:53:25:77 | ... + ... | provenance | |
+| LDAPInjection.cs:12:27:12:61 | access to indexer : String | LDAPInjection.cs:28:48:28:70 | ... + ... | provenance | |
+| LDAPInjection.cs:12:27:12:61 | access to indexer : String | LDAPInjection.cs:30:20:30:42 | ... + ... | provenance | |
+| LDAPInjection.cs:41:80:41:106 | call to method GetString : String | LDAPInjection.cs:41:63:41:106 | ... + ... | provenance | |
+nodes
+| LDAPInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
+| LDAPInjection.cs:12:27:12:61 | access to indexer : String | semmle.label | access to indexer : String |
+| LDAPInjection.cs:15:54:15:78 | ... + ... | semmle.label | ... + ... |
+| LDAPInjection.cs:17:21:17:45 | ... + ... | semmle.label | ... + ... |
+| LDAPInjection.cs:24:21:24:45 | ... + ... | semmle.label | ... + ... |
+| LDAPInjection.cs:25:53:25:77 | ... + ... | semmle.label | ... + ... |
+| LDAPInjection.cs:28:48:28:70 | ... + ... | semmle.label | ... + ... |
+| LDAPInjection.cs:30:20:30:42 | ... + ... | semmle.label | ... + ... |
+| LDAPInjection.cs:41:63:41:106 | ... + ... | semmle.label | ... + ... |
+| LDAPInjection.cs:41:80:41:106 | call to method GetString : String | semmle.label | call to method GetString : String |
+>>>>>>> 4fc83a3267 (Modify test cases)
subpaths
#select
-| LDAPInjection.cs:14:54:14:78 | ... + ... | LDAPInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | LDAPInjection.cs:14:54:14:78 | ... + ... | This LDAP query depends on a $@. | LDAPInjection.cs:11:27:11:49 | access to property QueryString | user-provided value |
-| LDAPInjection.cs:16:21:16:45 | ... + ... | LDAPInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | LDAPInjection.cs:16:21:16:45 | ... + ... | This LDAP query depends on a $@. | LDAPInjection.cs:11:27:11:49 | access to property QueryString | user-provided value |
-| LDAPInjection.cs:23:21:23:45 | ... + ... | LDAPInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | LDAPInjection.cs:23:21:23:45 | ... + ... | This LDAP query depends on a $@. | LDAPInjection.cs:11:27:11:49 | access to property QueryString | user-provided value |
-| LDAPInjection.cs:24:53:24:77 | ... + ... | LDAPInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | LDAPInjection.cs:24:53:24:77 | ... + ... | This LDAP query depends on a $@. | LDAPInjection.cs:11:27:11:49 | access to property QueryString | user-provided value |
-| LDAPInjection.cs:27:48:27:70 | ... + ... | LDAPInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | LDAPInjection.cs:27:48:27:70 | ... + ... | This LDAP query depends on a $@. | LDAPInjection.cs:11:27:11:49 | access to property QueryString | user-provided value |
-| LDAPInjection.cs:29:20:29:42 | ... + ... | LDAPInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | LDAPInjection.cs:29:20:29:42 | ... + ... | This LDAP query depends on a $@. | LDAPInjection.cs:11:27:11:49 | access to property QueryString | user-provided value |
+| LDAPInjection.cs:15:54:15:78 | ... + ... | LDAPInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | LDAPInjection.cs:15:54:15:78 | ... + ... | This LDAP query depends on a $@. | LDAPInjection.cs:12:27:12:49 | access to property QueryString | user-provided value |
+| LDAPInjection.cs:17:21:17:45 | ... + ... | LDAPInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | LDAPInjection.cs:17:21:17:45 | ... + ... | This LDAP query depends on a $@. | LDAPInjection.cs:12:27:12:49 | access to property QueryString | user-provided value |
+| LDAPInjection.cs:24:21:24:45 | ... + ... | LDAPInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | LDAPInjection.cs:24:21:24:45 | ... + ... | This LDAP query depends on a $@. | LDAPInjection.cs:12:27:12:49 | access to property QueryString | user-provided value |
+| LDAPInjection.cs:25:53:25:77 | ... + ... | LDAPInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | LDAPInjection.cs:25:53:25:77 | ... + ... | This LDAP query depends on a $@. | LDAPInjection.cs:12:27:12:49 | access to property QueryString | user-provided value |
+| LDAPInjection.cs:28:48:28:70 | ... + ... | LDAPInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | LDAPInjection.cs:28:48:28:70 | ... + ... | This LDAP query depends on a $@. | LDAPInjection.cs:12:27:12:49 | access to property QueryString | user-provided value |
+| LDAPInjection.cs:30:20:30:42 | ... + ... | LDAPInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | LDAPInjection.cs:30:20:30:42 | ... + ... | This LDAP query depends on a $@. | LDAPInjection.cs:12:27:12:49 | access to property QueryString | user-provided value |
+| LDAPInjection.cs:41:63:41:106 | ... + ... | LDAPInjection.cs:41:80:41:106 | call to method GetString : String | LDAPInjection.cs:41:63:41:106 | ... + ... | This LDAP query depends on a $@. | LDAPInjection.cs:41:80:41:106 | call to method GetString | user-provided value |
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-090/LDAPInjection.ext.yml b/csharp/ql/test/query-tests/Security Features/CWE-090/LDAPInjection.ext.yml
new file mode 100644
index 000000000000..82f107ae1d71
--- /dev/null
+++ b/csharp/ql/test/query-tests/Security Features/CWE-090/LDAPInjection.ext.yml
@@ -0,0 +1,7 @@
+extensions:
+
+ - addsTo:
+ pack: codeql/threat-models
+ extensible: threatModelConfiguration
+ data:
+ - ["local", true, 0]
\ No newline at end of file
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-090/StoredLDAPInjection.cs b/csharp/ql/test/query-tests/Security Features/CWE-090/StoredLDAPInjection.cs
deleted file mode 100644
index 975d1cb86f25..000000000000
--- a/csharp/ql/test/query-tests/Security Features/CWE-090/StoredLDAPInjection.cs
+++ /dev/null
@@ -1,28 +0,0 @@
-using System;
-using System.Data.SqlClient;
-using System.DirectoryServices;
-
-namespace Test
-{
-
- class StoredLDAPInjection
- {
-
- public void processRequest()
- {
- using (SqlConnection connection = new SqlConnection(""))
- {
- connection.Open();
- SqlCommand customerCommand = new SqlCommand("SELECT * FROM customers", connection);
- SqlDataReader customerReader = customerCommand.ExecuteReader();
-
- while (customerReader.Read())
- {
- // BAD: Read from database, write it straight to a response
- DirectorySearcher ds = new DirectorySearcher("accountname=" + customerReader.GetString(1));
- }
- customerReader.Close();
- }
- }
- }
-}
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-090/StoredLDAPInjection.expected b/csharp/ql/test/query-tests/Security Features/CWE-090/StoredLDAPInjection.expected
deleted file mode 100644
index d66714c82cc5..000000000000
--- a/csharp/ql/test/query-tests/Security Features/CWE-090/StoredLDAPInjection.expected
+++ /dev/null
@@ -1,8 +0,0 @@
-edges
-| StoredLDAPInjection.cs:22:83:22:109 | call to method GetString : String | StoredLDAPInjection.cs:22:66:22:109 | ... + ... | provenance | |
-nodes
-| StoredLDAPInjection.cs:22:66:22:109 | ... + ... | semmle.label | ... + ... |
-| StoredLDAPInjection.cs:22:83:22:109 | call to method GetString : String | semmle.label | call to method GetString : String |
-subpaths
-#select
-| StoredLDAPInjection.cs:22:66:22:109 | ... + ... | StoredLDAPInjection.cs:22:83:22:109 | call to method GetString : String | StoredLDAPInjection.cs:22:66:22:109 | ... + ... | This LDAP query depends on a $@. | StoredLDAPInjection.cs:22:83:22:109 | call to method GetString | stored (potentially user-provided) value |
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-090/StoredLDAPInjection.qlref b/csharp/ql/test/query-tests/Security Features/CWE-090/StoredLDAPInjection.qlref
deleted file mode 100644
index 0f41e1b15c90..000000000000
--- a/csharp/ql/test/query-tests/Security Features/CWE-090/StoredLDAPInjection.qlref
+++ /dev/null
@@ -1 +0,0 @@
-Security Features/CWE-090/StoredLDAPInjection.ql
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-643/StoredXPathInjection.cs b/csharp/ql/test/query-tests/Security Features/CWE-643/StoredXPathInjection.cs
deleted file mode 100644
index 91b8291b5cf3..000000000000
--- a/csharp/ql/test/query-tests/Security Features/CWE-643/StoredXPathInjection.cs
+++ /dev/null
@@ -1,37 +0,0 @@
-using System;
-using System.Data.SqlClient;
-using System.Xml;
-using System.Xml.XPath;
-
-namespace Test
-{
-
- class StoredXPathInjection
- {
-
- public void processRequest()
- {
- using (SqlConnection connection = new SqlConnection(""))
- {
- connection.Open();
- SqlCommand customerCommand = new SqlCommand("SELECT * FROM customers", connection);
- SqlDataReader customerReader = customerCommand.ExecuteReader();
-
- while (customerReader.Read())
- {
- string userName = customerReader.GetString(1);
- string password = customerReader.GetString(2);
- // BAD: User input used directly in an XPath expression
- XPathExpression.Compile("//users/user[login/text()='" + userName + "' and password/text() = '" + password + "']/home_dir/text()");
- XmlNode xmlNode = null;
- // BAD: User input used directly in an XPath expression to SelectNodes
- xmlNode.SelectNodes("//users/user[login/text()='" + userName + "' and password/text() = '" + password + "']/home_dir/text()");
-
- // GOOD: Uses parameters to avoid including user input directly in XPath expression
- XPathExpression.Compile("//users/user[login/text()=$username]/home_dir/text()");
- }
- customerReader.Close();
- }
- }
- }
-}
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-643/StoredXPathInjection.expected b/csharp/ql/test/query-tests/Security Features/CWE-643/StoredXPathInjection.expected
deleted file mode 100644
index 0b963f38d7b5..000000000000
--- a/csharp/ql/test/query-tests/Security Features/CWE-643/StoredXPathInjection.expected
+++ /dev/null
@@ -1,20 +0,0 @@
-edges
-| StoredXPathInjection.cs:22:28:22:35 | access to local variable userName : String | StoredXPathInjection.cs:25:45:25:148 | ... + ... | provenance | |
-| StoredXPathInjection.cs:22:28:22:35 | access to local variable userName : String | StoredXPathInjection.cs:28:41:28:144 | ... + ... | provenance | |
-| StoredXPathInjection.cs:22:39:22:65 | call to method GetString : String | StoredXPathInjection.cs:22:28:22:35 | access to local variable userName : String | provenance | |
-| StoredXPathInjection.cs:23:28:23:35 | access to local variable password : String | StoredXPathInjection.cs:25:45:25:148 | ... + ... | provenance | |
-| StoredXPathInjection.cs:23:28:23:35 | access to local variable password : String | StoredXPathInjection.cs:28:41:28:144 | ... + ... | provenance | |
-| StoredXPathInjection.cs:23:39:23:65 | call to method GetString : String | StoredXPathInjection.cs:23:28:23:35 | access to local variable password : String | provenance | |
-nodes
-| StoredXPathInjection.cs:22:28:22:35 | access to local variable userName : String | semmle.label | access to local variable userName : String |
-| StoredXPathInjection.cs:22:39:22:65 | call to method GetString : String | semmle.label | call to method GetString : String |
-| StoredXPathInjection.cs:23:28:23:35 | access to local variable password : String | semmle.label | access to local variable password : String |
-| StoredXPathInjection.cs:23:39:23:65 | call to method GetString : String | semmle.label | call to method GetString : String |
-| StoredXPathInjection.cs:25:45:25:148 | ... + ... | semmle.label | ... + ... |
-| StoredXPathInjection.cs:28:41:28:144 | ... + ... | semmle.label | ... + ... |
-subpaths
-#select
-| StoredXPathInjection.cs:25:45:25:148 | ... + ... | StoredXPathInjection.cs:22:39:22:65 | call to method GetString : String | StoredXPathInjection.cs:25:45:25:148 | ... + ... | This XPath expression depends on a $@. | StoredXPathInjection.cs:22:39:22:65 | call to method GetString | stored (potentially user-provided) value |
-| StoredXPathInjection.cs:25:45:25:148 | ... + ... | StoredXPathInjection.cs:23:39:23:65 | call to method GetString : String | StoredXPathInjection.cs:25:45:25:148 | ... + ... | This XPath expression depends on a $@. | StoredXPathInjection.cs:23:39:23:65 | call to method GetString | stored (potentially user-provided) value |
-| StoredXPathInjection.cs:28:41:28:144 | ... + ... | StoredXPathInjection.cs:22:39:22:65 | call to method GetString : String | StoredXPathInjection.cs:28:41:28:144 | ... + ... | This XPath expression depends on a $@. | StoredXPathInjection.cs:22:39:22:65 | call to method GetString | stored (potentially user-provided) value |
-| StoredXPathInjection.cs:28:41:28:144 | ... + ... | StoredXPathInjection.cs:23:39:23:65 | call to method GetString : String | StoredXPathInjection.cs:28:41:28:144 | ... + ... | This XPath expression depends on a $@. | StoredXPathInjection.cs:23:39:23:65 | call to method GetString | stored (potentially user-provided) value |
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-643/StoredXPathInjection.qlref b/csharp/ql/test/query-tests/Security Features/CWE-643/StoredXPathInjection.qlref
deleted file mode 100644
index 91ffd2d2074d..000000000000
--- a/csharp/ql/test/query-tests/Security Features/CWE-643/StoredXPathInjection.qlref
+++ /dev/null
@@ -1 +0,0 @@
-Security Features/CWE-643/StoredXPathInjection.ql
\ No newline at end of file
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-643/XPathInjection.cs b/csharp/ql/test/query-tests/Security Features/CWE-643/XPathInjection.cs
index 53cdbb73cc13..a42a629cc7ec 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-643/XPathInjection.cs
+++ b/csharp/ql/test/query-tests/Security Features/CWE-643/XPathInjection.cs
@@ -1,4 +1,5 @@
using System;
+using System.Data.SqlClient;
using System.Web;
using System.Xml;
using System.Xml.XPath;
@@ -62,4 +63,30 @@ public bool IsReusable
return true;
}
}
+
+ public void ProcessStoredRequest()
+ {
+
+ using (SqlConnection connection = new SqlConnection(""))
+ {
+ connection.Open();
+ SqlCommand customerCommand = new SqlCommand("SELECT * FROM customers", connection);
+ SqlDataReader customerReader = customerCommand.ExecuteReader();
+
+ while (customerReader.Read())
+ {
+ string userName = customerReader.GetString(1);
+ string password = customerReader.GetString(2);
+ // BAD: User input used directly in an XPath expression
+ XPathExpression.Compile("//users/user[login/text()='" + userName + "' and password/text() = '" + password + "']/home_dir/text()");
+ XmlNode xmlNode = null;
+ // BAD: User input used directly in an XPath expression to SelectNodes
+ xmlNode.SelectNodes("//users/user[login/text()='" + userName + "' and password/text() = '" + password + "']/home_dir/text()");
+
+ // GOOD: Uses parameters to avoid including user input directly in XPath expression
+ XPathExpression.Compile("//users/user[login/text()=$username]/home_dir/text()");
+ }
+ customerReader.Close();
+ }
+ }
}
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-643/XPathInjection.expected b/csharp/ql/test/query-tests/Security Features/CWE-643/XPathInjection.expected
index f722ab15f6b3..9229f3a62869 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-643/XPathInjection.expected
+++ b/csharp/ql/test/query-tests/Security Features/CWE-643/XPathInjection.expected
@@ -1,4 +1,5 @@
edges
+<<<<<<< HEAD
| XPathInjection.cs:10:16:10:23 | access to local variable userName : String | XPathInjection.cs:13:13:13:13 | access to local variable s : String | provenance | |
| XPathInjection.cs:10:27:10:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:10:16:10:23 | access to local variable userName : String | provenance | |
| XPathInjection.cs:10:27:10:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:10:27:10:61 | access to indexer : String | provenance | |
@@ -29,19 +30,75 @@ nodes
| XPathInjection.cs:40:21:40:21 | access to local variable s | semmle.label | access to local variable s |
| XPathInjection.cs:46:22:46:22 | access to local variable s | semmle.label | access to local variable s |
| XPathInjection.cs:52:21:52:21 | access to local variable s | semmle.label | access to local variable s |
+=======
+| XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:11:27:11:61 | access to indexer : String | provenance | |
+| XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:17:33:17:33 | access to local variable s | provenance | |
+| XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:20:29:20:29 | access to local variable s | provenance | |
+| XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:29:20:29:20 | access to local variable s | provenance | |
+| XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:35:30:35:30 | access to local variable s | provenance | |
+| XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:41:21:41:21 | access to local variable s | provenance | |
+| XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:47:22:47:22 | access to local variable s | provenance | |
+| XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:53:21:53:21 | access to local variable s | provenance | |
+| XPathInjection.cs:11:27:11:61 | access to indexer : String | XPathInjection.cs:17:33:17:33 | access to local variable s | provenance | |
+| XPathInjection.cs:11:27:11:61 | access to indexer : String | XPathInjection.cs:20:29:20:29 | access to local variable s | provenance | |
+| XPathInjection.cs:11:27:11:61 | access to indexer : String | XPathInjection.cs:29:20:29:20 | access to local variable s | provenance | |
+| XPathInjection.cs:11:27:11:61 | access to indexer : String | XPathInjection.cs:35:30:35:30 | access to local variable s | provenance | |
+| XPathInjection.cs:11:27:11:61 | access to indexer : String | XPathInjection.cs:41:21:41:21 | access to local variable s | provenance | |
+| XPathInjection.cs:11:27:11:61 | access to indexer : String | XPathInjection.cs:47:22:47:22 | access to local variable s | provenance | |
+| XPathInjection.cs:11:27:11:61 | access to indexer : String | XPathInjection.cs:53:21:53:21 | access to local variable s | provenance | |
+| XPathInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:12:27:12:61 | access to indexer : String | provenance | |
+| XPathInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:17:33:17:33 | access to local variable s | provenance | |
+| XPathInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:20:29:20:29 | access to local variable s | provenance | |
+| XPathInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:29:20:29:20 | access to local variable s | provenance | |
+| XPathInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:35:30:35:30 | access to local variable s | provenance | |
+| XPathInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:41:21:41:21 | access to local variable s | provenance | |
+| XPathInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:47:22:47:22 | access to local variable s | provenance | |
+| XPathInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:53:21:53:21 | access to local variable s | provenance | |
+| XPathInjection.cs:12:27:12:61 | access to indexer : String | XPathInjection.cs:17:33:17:33 | access to local variable s | provenance | |
+| XPathInjection.cs:12:27:12:61 | access to indexer : String | XPathInjection.cs:20:29:20:29 | access to local variable s | provenance | |
+| XPathInjection.cs:12:27:12:61 | access to indexer : String | XPathInjection.cs:29:20:29:20 | access to local variable s | provenance | |
+| XPathInjection.cs:12:27:12:61 | access to indexer : String | XPathInjection.cs:35:30:35:30 | access to local variable s | provenance | |
+| XPathInjection.cs:12:27:12:61 | access to indexer : String | XPathInjection.cs:41:21:41:21 | access to local variable s | provenance | |
+| XPathInjection.cs:12:27:12:61 | access to indexer : String | XPathInjection.cs:47:22:47:22 | access to local variable s | provenance | |
+| XPathInjection.cs:12:27:12:61 | access to indexer : String | XPathInjection.cs:53:21:53:21 | access to local variable s | provenance | |
+| XPathInjection.cs:78:35:78:61 | call to method GetString : String | XPathInjection.cs:81:41:81:144 | ... + ... | provenance | |
+| XPathInjection.cs:78:35:78:61 | call to method GetString : String | XPathInjection.cs:84:37:84:140 | ... + ... | provenance | |
+| XPathInjection.cs:79:35:79:61 | call to method GetString : String | XPathInjection.cs:81:41:81:144 | ... + ... | provenance | |
+| XPathInjection.cs:79:35:79:61 | call to method GetString : String | XPathInjection.cs:84:37:84:140 | ... + ... | provenance | |
+nodes
+| XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
+| XPathInjection.cs:11:27:11:61 | access to indexer : String | semmle.label | access to indexer : String |
+| XPathInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
+| XPathInjection.cs:12:27:12:61 | access to indexer : String | semmle.label | access to indexer : String |
+| XPathInjection.cs:17:33:17:33 | access to local variable s | semmle.label | access to local variable s |
+| XPathInjection.cs:20:29:20:29 | access to local variable s | semmle.label | access to local variable s |
+| XPathInjection.cs:29:20:29:20 | access to local variable s | semmle.label | access to local variable s |
+| XPathInjection.cs:35:30:35:30 | access to local variable s | semmle.label | access to local variable s |
+| XPathInjection.cs:41:21:41:21 | access to local variable s | semmle.label | access to local variable s |
+| XPathInjection.cs:47:22:47:22 | access to local variable s | semmle.label | access to local variable s |
+| XPathInjection.cs:53:21:53:21 | access to local variable s | semmle.label | access to local variable s |
+| XPathInjection.cs:78:35:78:61 | call to method GetString : String | semmle.label | call to method GetString : String |
+| XPathInjection.cs:79:35:79:61 | call to method GetString : String | semmle.label | call to method GetString : String |
+| XPathInjection.cs:81:41:81:144 | ... + ... | semmle.label | ... + ... |
+| XPathInjection.cs:84:37:84:140 | ... + ... | semmle.label | ... + ... |
+>>>>>>> 4fc83a3267 (Modify test cases)
subpaths
#select
-| XPathInjection.cs:16:33:16:33 | access to local variable s | XPathInjection.cs:10:27:10:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:16:33:16:33 | access to local variable s | This XPath expression depends on a $@. | XPathInjection.cs:10:27:10:49 | access to property QueryString | user-provided value |
-| XPathInjection.cs:16:33:16:33 | access to local variable s | XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:16:33:16:33 | access to local variable s | This XPath expression depends on a $@. | XPathInjection.cs:11:27:11:49 | access to property QueryString | user-provided value |
-| XPathInjection.cs:19:29:19:29 | access to local variable s | XPathInjection.cs:10:27:10:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:19:29:19:29 | access to local variable s | This XPath expression depends on a $@. | XPathInjection.cs:10:27:10:49 | access to property QueryString | user-provided value |
-| XPathInjection.cs:19:29:19:29 | access to local variable s | XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:19:29:19:29 | access to local variable s | This XPath expression depends on a $@. | XPathInjection.cs:11:27:11:49 | access to property QueryString | user-provided value |
-| XPathInjection.cs:28:20:28:20 | access to local variable s | XPathInjection.cs:10:27:10:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:28:20:28:20 | access to local variable s | This XPath expression depends on a $@. | XPathInjection.cs:10:27:10:49 | access to property QueryString | user-provided value |
-| XPathInjection.cs:28:20:28:20 | access to local variable s | XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:28:20:28:20 | access to local variable s | This XPath expression depends on a $@. | XPathInjection.cs:11:27:11:49 | access to property QueryString | user-provided value |
-| XPathInjection.cs:34:30:34:30 | access to local variable s | XPathInjection.cs:10:27:10:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:34:30:34:30 | access to local variable s | This XPath expression depends on a $@. | XPathInjection.cs:10:27:10:49 | access to property QueryString | user-provided value |
-| XPathInjection.cs:34:30:34:30 | access to local variable s | XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:34:30:34:30 | access to local variable s | This XPath expression depends on a $@. | XPathInjection.cs:11:27:11:49 | access to property QueryString | user-provided value |
-| XPathInjection.cs:40:21:40:21 | access to local variable s | XPathInjection.cs:10:27:10:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:40:21:40:21 | access to local variable s | This XPath expression depends on a $@. | XPathInjection.cs:10:27:10:49 | access to property QueryString | user-provided value |
-| XPathInjection.cs:40:21:40:21 | access to local variable s | XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:40:21:40:21 | access to local variable s | This XPath expression depends on a $@. | XPathInjection.cs:11:27:11:49 | access to property QueryString | user-provided value |
-| XPathInjection.cs:46:22:46:22 | access to local variable s | XPathInjection.cs:10:27:10:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:46:22:46:22 | access to local variable s | This XPath expression depends on a $@. | XPathInjection.cs:10:27:10:49 | access to property QueryString | user-provided value |
-| XPathInjection.cs:46:22:46:22 | access to local variable s | XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:46:22:46:22 | access to local variable s | This XPath expression depends on a $@. | XPathInjection.cs:11:27:11:49 | access to property QueryString | user-provided value |
-| XPathInjection.cs:52:21:52:21 | access to local variable s | XPathInjection.cs:10:27:10:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:52:21:52:21 | access to local variable s | This XPath expression depends on a $@. | XPathInjection.cs:10:27:10:49 | access to property QueryString | user-provided value |
-| XPathInjection.cs:52:21:52:21 | access to local variable s | XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:52:21:52:21 | access to local variable s | This XPath expression depends on a $@. | XPathInjection.cs:11:27:11:49 | access to property QueryString | user-provided value |
+| XPathInjection.cs:17:33:17:33 | access to local variable s | XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:17:33:17:33 | access to local variable s | This XPath expression depends on a $@. | XPathInjection.cs:11:27:11:49 | access to property QueryString | user-provided value |
+| XPathInjection.cs:17:33:17:33 | access to local variable s | XPathInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:17:33:17:33 | access to local variable s | This XPath expression depends on a $@. | XPathInjection.cs:12:27:12:49 | access to property QueryString | user-provided value |
+| XPathInjection.cs:20:29:20:29 | access to local variable s | XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:20:29:20:29 | access to local variable s | This XPath expression depends on a $@. | XPathInjection.cs:11:27:11:49 | access to property QueryString | user-provided value |
+| XPathInjection.cs:20:29:20:29 | access to local variable s | XPathInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:20:29:20:29 | access to local variable s | This XPath expression depends on a $@. | XPathInjection.cs:12:27:12:49 | access to property QueryString | user-provided value |
+| XPathInjection.cs:29:20:29:20 | access to local variable s | XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:29:20:29:20 | access to local variable s | This XPath expression depends on a $@. | XPathInjection.cs:11:27:11:49 | access to property QueryString | user-provided value |
+| XPathInjection.cs:29:20:29:20 | access to local variable s | XPathInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:29:20:29:20 | access to local variable s | This XPath expression depends on a $@. | XPathInjection.cs:12:27:12:49 | access to property QueryString | user-provided value |
+| XPathInjection.cs:35:30:35:30 | access to local variable s | XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:35:30:35:30 | access to local variable s | This XPath expression depends on a $@. | XPathInjection.cs:11:27:11:49 | access to property QueryString | user-provided value |
+| XPathInjection.cs:35:30:35:30 | access to local variable s | XPathInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:35:30:35:30 | access to local variable s | This XPath expression depends on a $@. | XPathInjection.cs:12:27:12:49 | access to property QueryString | user-provided value |
+| XPathInjection.cs:41:21:41:21 | access to local variable s | XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:41:21:41:21 | access to local variable s | This XPath expression depends on a $@. | XPathInjection.cs:11:27:11:49 | access to property QueryString | user-provided value |
+| XPathInjection.cs:41:21:41:21 | access to local variable s | XPathInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:41:21:41:21 | access to local variable s | This XPath expression depends on a $@. | XPathInjection.cs:12:27:12:49 | access to property QueryString | user-provided value |
+| XPathInjection.cs:47:22:47:22 | access to local variable s | XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:47:22:47:22 | access to local variable s | This XPath expression depends on a $@. | XPathInjection.cs:11:27:11:49 | access to property QueryString | user-provided value |
+| XPathInjection.cs:47:22:47:22 | access to local variable s | XPathInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:47:22:47:22 | access to local variable s | This XPath expression depends on a $@. | XPathInjection.cs:12:27:12:49 | access to property QueryString | user-provided value |
+| XPathInjection.cs:53:21:53:21 | access to local variable s | XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:53:21:53:21 | access to local variable s | This XPath expression depends on a $@. | XPathInjection.cs:11:27:11:49 | access to property QueryString | user-provided value |
+| XPathInjection.cs:53:21:53:21 | access to local variable s | XPathInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:53:21:53:21 | access to local variable s | This XPath expression depends on a $@. | XPathInjection.cs:12:27:12:49 | access to property QueryString | user-provided value |
+| XPathInjection.cs:81:41:81:144 | ... + ... | XPathInjection.cs:78:35:78:61 | call to method GetString : String | XPathInjection.cs:81:41:81:144 | ... + ... | This XPath expression depends on a $@. | XPathInjection.cs:78:35:78:61 | call to method GetString | user-provided value |
+| XPathInjection.cs:81:41:81:144 | ... + ... | XPathInjection.cs:79:35:79:61 | call to method GetString : String | XPathInjection.cs:81:41:81:144 | ... + ... | This XPath expression depends on a $@. | XPathInjection.cs:79:35:79:61 | call to method GetString | user-provided value |
+| XPathInjection.cs:84:37:84:140 | ... + ... | XPathInjection.cs:78:35:78:61 | call to method GetString : String | XPathInjection.cs:84:37:84:140 | ... + ... | This XPath expression depends on a $@. | XPathInjection.cs:78:35:78:61 | call to method GetString | user-provided value |
+| XPathInjection.cs:84:37:84:140 | ... + ... | XPathInjection.cs:79:35:79:61 | call to method GetString : String | XPathInjection.cs:84:37:84:140 | ... + ... | This XPath expression depends on a $@. | XPathInjection.cs:79:35:79:61 | call to method GetString | user-provided value |
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-643/XPathInjection.ext.yml b/csharp/ql/test/query-tests/Security Features/CWE-643/XPathInjection.ext.yml
new file mode 100644
index 000000000000..82f107ae1d71
--- /dev/null
+++ b/csharp/ql/test/query-tests/Security Features/CWE-643/XPathInjection.ext.yml
@@ -0,0 +1,7 @@
+extensions:
+
+ - addsTo:
+ pack: codeql/threat-models
+ extensible: threatModelConfiguration
+ data:
+ - ["local", true, 0]
\ No newline at end of file
From 1ba3efb111040c0837289bd4fc963a5b1f68a019 Mon Sep 17 00:00:00 2001
From: Ed Minnix
Date: Tue, 20 Feb 2024 21:51:44 -0500
Subject: [PATCH 050/731] Change note updates
---
.../src/change-notes/2024-03-11-remove-stored-query-variants.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/csharp/ql/src/change-notes/2024-03-11-remove-stored-query-variants.md b/csharp/ql/src/change-notes/2024-03-11-remove-stored-query-variants.md
index f62d293dc046..6b580be7e65c 100644
--- a/csharp/ql/src/change-notes/2024-03-11-remove-stored-query-variants.md
+++ b/csharp/ql/src/change-notes/2024-03-11-remove-stored-query-variants.md
@@ -1,5 +1,5 @@
---
category: majorAnalysis
---
-* The `Stored` variants of some queries (`cs/stored-command-line-injection`, `cs/web/stored-xss`, `cs/stored-ldap-injection`, `cs/xml/stored-xpath-injection`) have been removed. If you were using these queries, their results can be restored by enabling the `local` threat model in your threat model settings.
+* The `Stored` variants of some queries (`cs/stored-command-line-injection`, `cs/web/stored-xss`, `cs/stored-ldap-injection`, `cs/xml/stored-xpath-injection`) have been removed. If you were using these queries, their results can be restored by enabling the `file` and `database` threat models in your threat model configuration.
From 4dc605354cb59a4ab8e9b1de331d6a3e6590a3d3 Mon Sep 17 00:00:00 2001
From: Ed Minnix
Date: Tue, 20 Feb 2024 22:19:38 -0500
Subject: [PATCH 051/731] Second-order SQL injection
---
.../CWE-089/SecondOrderSqlInjection.qhelp | 6 --
.../CWE-089/SecondOrderSqlInjection.ql | 32 -----------
...2024-03-11-remove-stored-query-variants.md | 2 +-
.../CWE-089/SecondOrderSqlInjection.expected | 56 -------------------
.../CWE-089/SecondOrderSqlInjection.qlref | 1 -
.../CWE-089/SqlInjection.ext.yml | 7 +++
6 files changed, 8 insertions(+), 96 deletions(-)
delete mode 100644 csharp/ql/src/Security Features/CWE-089/SecondOrderSqlInjection.qhelp
delete mode 100644 csharp/ql/src/Security Features/CWE-089/SecondOrderSqlInjection.ql
delete mode 100644 csharp/ql/test/query-tests/Security Features/CWE-089/SecondOrderSqlInjection.expected
delete mode 100644 csharp/ql/test/query-tests/Security Features/CWE-089/SecondOrderSqlInjection.qlref
create mode 100644 csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjection.ext.yml
diff --git a/csharp/ql/src/Security Features/CWE-089/SecondOrderSqlInjection.qhelp b/csharp/ql/src/Security Features/CWE-089/SecondOrderSqlInjection.qhelp
deleted file mode 100644
index 83ec163ed784..000000000000
--- a/csharp/ql/src/Security Features/CWE-089/SecondOrderSqlInjection.qhelp
+++ /dev/null
@@ -1,6 +0,0 @@
-
-
-
-
diff --git a/csharp/ql/src/Security Features/CWE-089/SecondOrderSqlInjection.ql b/csharp/ql/src/Security Features/CWE-089/SecondOrderSqlInjection.ql
deleted file mode 100644
index 33c2479147d8..000000000000
--- a/csharp/ql/src/Security Features/CWE-089/SecondOrderSqlInjection.ql
+++ /dev/null
@@ -1,32 +0,0 @@
-/**
- * @name SQL query built from stored user-controlled sources
- * @description Building a SQL query from stored user-controlled sources is vulnerable to insertion
- * of malicious SQL code by the user.
- * @kind path-problem
- * @problem.severity error
- * @security-severity 8.8
- * @precision medium
- * @id cs/second-order-sql-injection
- * @tags security
- * external/cwe/cwe-089
- */
-
-import csharp
-import semmle.code.csharp.security.dataflow.SqlInjectionQuery
-import semmle.code.csharp.security.dataflow.flowsources.Stored
-import StoredSqlInjection::PathGraph
-
-module StoredSqlInjectionConfig implements DataFlow::ConfigSig {
- predicate isSource(DataFlow::Node source) { source instanceof StoredFlowSource }
-
- predicate isSink = SqlInjectionConfig::isSink/1;
-
- predicate isBarrier = SqlInjectionConfig::isBarrier/1;
-}
-
-module StoredSqlInjection = TaintTracking::Global;
-
-from StoredSqlInjection::PathNode source, StoredSqlInjection::PathNode sink
-where StoredSqlInjection::flowPath(source, sink)
-select sink.getNode(), source, sink, "This SQL query depends on a $@.", source.getNode(),
- "stored user-provided value"
diff --git a/csharp/ql/src/change-notes/2024-03-11-remove-stored-query-variants.md b/csharp/ql/src/change-notes/2024-03-11-remove-stored-query-variants.md
index 6b580be7e65c..f86836b1219f 100644
--- a/csharp/ql/src/change-notes/2024-03-11-remove-stored-query-variants.md
+++ b/csharp/ql/src/change-notes/2024-03-11-remove-stored-query-variants.md
@@ -1,5 +1,5 @@
---
category: majorAnalysis
---
-* The `Stored` variants of some queries (`cs/stored-command-line-injection`, `cs/web/stored-xss`, `cs/stored-ldap-injection`, `cs/xml/stored-xpath-injection`) have been removed. If you were using these queries, their results can be restored by enabling the `file` and `database` threat models in your threat model configuration.
+* The `Stored` variants of some queries (`cs/stored-command-line-injection`, `cs/web/stored-xss`, `cs/stored-ldap-injection`, `cs/xml/stored-xpath-injection`. `cs/second-order-sql-injection`) have been removed. If you were using these queries, their results can be restored by enabling the `file` and `database` threat models in your threat model configuration.
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-089/SecondOrderSqlInjection.expected b/csharp/ql/test/query-tests/Security Features/CWE-089/SecondOrderSqlInjection.expected
deleted file mode 100644
index fccccdb3c738..000000000000
--- a/csharp/ql/test/query-tests/Security Features/CWE-089/SecondOrderSqlInjection.expected
+++ /dev/null
@@ -1,56 +0,0 @@
-edges
-| SecondOrderSqlInjection.cs:25:119:25:145 | call to method GetString : String | SecondOrderSqlInjection.cs:25:71:25:145 | ... + ... | provenance | |
-| SecondOrderSqlInjection.cs:33:31:33:32 | access to local variable fs : FileStream | SecondOrderSqlInjection.cs:35:59:35:60 | access to local variable fs : FileStream | provenance | |
-| SecondOrderSqlInjection.cs:33:36:33:78 | object creation of type FileStream : FileStream | SecondOrderSqlInjection.cs:33:31:33:32 | access to local variable fs : FileStream | provenance | |
-| SecondOrderSqlInjection.cs:35:37:35:38 | access to local variable sr : StreamReader | SecondOrderSqlInjection.cs:38:35:38:36 | access to local variable sr : StreamReader | provenance | |
-| SecondOrderSqlInjection.cs:35:42:35:76 | object creation of type StreamReader : StreamReader | SecondOrderSqlInjection.cs:35:37:35:38 | access to local variable sr : StreamReader | provenance | |
-| SecondOrderSqlInjection.cs:35:59:35:60 | access to local variable fs : FileStream | SecondOrderSqlInjection.cs:35:42:35:76 | object creation of type StreamReader : StreamReader | provenance | |
-| SecondOrderSqlInjection.cs:38:29:38:31 | access to local variable sql : String | SecondOrderSqlInjection.cs:40:31:40:33 | access to local variable sql : String | provenance | |
-| SecondOrderSqlInjection.cs:38:35:38:36 | access to local variable sr : StreamReader | SecondOrderSqlInjection.cs:38:35:38:47 | call to method ReadLine : String | provenance | |
-| SecondOrderSqlInjection.cs:38:35:38:47 | call to method ReadLine : String | SecondOrderSqlInjection.cs:38:29:38:31 | access to local variable sql : String | provenance | |
-| SecondOrderSqlInjection.cs:40:25:40:27 | access to local variable sql : String | SecondOrderSqlInjection.cs:45:57:45:59 | access to local variable sql | provenance | |
-| SecondOrderSqlInjection.cs:40:31:40:33 | access to local variable sql : String | SecondOrderSqlInjection.cs:40:31:40:40 | call to method Trim : String | provenance | |
-| SecondOrderSqlInjection.cs:40:31:40:40 | call to method Trim : String | SecondOrderSqlInjection.cs:40:25:40:27 | access to local variable sql : String | provenance | |
-| SqlInjectionSqlite.cs:49:31:49:32 | access to local variable fs : FileStream | SqlInjectionSqlite.cs:51:59:51:60 | access to local variable fs : FileStream | provenance | |
-| SqlInjectionSqlite.cs:49:36:49:84 | object creation of type FileStream : FileStream | SqlInjectionSqlite.cs:49:31:49:32 | access to local variable fs : FileStream | provenance | |
-| SqlInjectionSqlite.cs:51:37:51:38 | access to local variable sr : StreamReader | SqlInjectionSqlite.cs:54:35:54:36 | access to local variable sr : StreamReader | provenance | |
-| SqlInjectionSqlite.cs:51:42:51:76 | object creation of type StreamReader : StreamReader | SqlInjectionSqlite.cs:51:37:51:38 | access to local variable sr : StreamReader | provenance | |
-| SqlInjectionSqlite.cs:51:59:51:60 | access to local variable fs : FileStream | SqlInjectionSqlite.cs:51:42:51:76 | object creation of type StreamReader : StreamReader | provenance | |
-| SqlInjectionSqlite.cs:54:29:54:31 | access to local variable sql : String | SqlInjectionSqlite.cs:56:31:56:33 | access to local variable sql : String | provenance | |
-| SqlInjectionSqlite.cs:54:35:54:36 | access to local variable sr : StreamReader | SqlInjectionSqlite.cs:54:35:54:47 | call to method ReadLine : String | provenance | |
-| SqlInjectionSqlite.cs:54:35:54:47 | call to method ReadLine : String | SqlInjectionSqlite.cs:54:29:54:31 | access to local variable sql : String | provenance | |
-| SqlInjectionSqlite.cs:56:25:56:27 | access to local variable sql : String | SqlInjectionSqlite.cs:61:53:61:55 | access to local variable sql | provenance | |
-| SqlInjectionSqlite.cs:56:31:56:33 | access to local variable sql : String | SqlInjectionSqlite.cs:56:31:56:40 | call to method Trim : String | provenance | |
-| SqlInjectionSqlite.cs:56:31:56:40 | call to method Trim : String | SqlInjectionSqlite.cs:56:25:56:27 | access to local variable sql : String | provenance | |
-nodes
-| SecondOrderSqlInjection.cs:25:71:25:145 | ... + ... | semmle.label | ... + ... |
-| SecondOrderSqlInjection.cs:25:119:25:145 | call to method GetString : String | semmle.label | call to method GetString : String |
-| SecondOrderSqlInjection.cs:33:31:33:32 | access to local variable fs : FileStream | semmle.label | access to local variable fs : FileStream |
-| SecondOrderSqlInjection.cs:33:36:33:78 | object creation of type FileStream : FileStream | semmle.label | object creation of type FileStream : FileStream |
-| SecondOrderSqlInjection.cs:35:37:35:38 | access to local variable sr : StreamReader | semmle.label | access to local variable sr : StreamReader |
-| SecondOrderSqlInjection.cs:35:42:35:76 | object creation of type StreamReader : StreamReader | semmle.label | object creation of type StreamReader : StreamReader |
-| SecondOrderSqlInjection.cs:35:59:35:60 | access to local variable fs : FileStream | semmle.label | access to local variable fs : FileStream |
-| SecondOrderSqlInjection.cs:38:29:38:31 | access to local variable sql : String | semmle.label | access to local variable sql : String |
-| SecondOrderSqlInjection.cs:38:35:38:36 | access to local variable sr : StreamReader | semmle.label | access to local variable sr : StreamReader |
-| SecondOrderSqlInjection.cs:38:35:38:47 | call to method ReadLine : String | semmle.label | call to method ReadLine : String |
-| SecondOrderSqlInjection.cs:40:25:40:27 | access to local variable sql : String | semmle.label | access to local variable sql : String |
-| SecondOrderSqlInjection.cs:40:31:40:33 | access to local variable sql : String | semmle.label | access to local variable sql : String |
-| SecondOrderSqlInjection.cs:40:31:40:40 | call to method Trim : String | semmle.label | call to method Trim : String |
-| SecondOrderSqlInjection.cs:45:57:45:59 | access to local variable sql | semmle.label | access to local variable sql |
-| SqlInjectionSqlite.cs:49:31:49:32 | access to local variable fs : FileStream | semmle.label | access to local variable fs : FileStream |
-| SqlInjectionSqlite.cs:49:36:49:84 | object creation of type FileStream : FileStream | semmle.label | object creation of type FileStream : FileStream |
-| SqlInjectionSqlite.cs:51:37:51:38 | access to local variable sr : StreamReader | semmle.label | access to local variable sr : StreamReader |
-| SqlInjectionSqlite.cs:51:42:51:76 | object creation of type StreamReader : StreamReader | semmle.label | object creation of type StreamReader : StreamReader |
-| SqlInjectionSqlite.cs:51:59:51:60 | access to local variable fs : FileStream | semmle.label | access to local variable fs : FileStream |
-| SqlInjectionSqlite.cs:54:29:54:31 | access to local variable sql : String | semmle.label | access to local variable sql : String |
-| SqlInjectionSqlite.cs:54:35:54:36 | access to local variable sr : StreamReader | semmle.label | access to local variable sr : StreamReader |
-| SqlInjectionSqlite.cs:54:35:54:47 | call to method ReadLine : String | semmle.label | call to method ReadLine : String |
-| SqlInjectionSqlite.cs:56:25:56:27 | access to local variable sql : String | semmle.label | access to local variable sql : String |
-| SqlInjectionSqlite.cs:56:31:56:33 | access to local variable sql : String | semmle.label | access to local variable sql : String |
-| SqlInjectionSqlite.cs:56:31:56:40 | call to method Trim : String | semmle.label | call to method Trim : String |
-| SqlInjectionSqlite.cs:61:53:61:55 | access to local variable sql | semmle.label | access to local variable sql |
-subpaths
-#select
-| SecondOrderSqlInjection.cs:25:71:25:145 | ... + ... | SecondOrderSqlInjection.cs:25:119:25:145 | call to method GetString : String | SecondOrderSqlInjection.cs:25:71:25:145 | ... + ... | This SQL query depends on a $@. | SecondOrderSqlInjection.cs:25:119:25:145 | call to method GetString | stored user-provided value |
-| SecondOrderSqlInjection.cs:45:57:45:59 | access to local variable sql | SecondOrderSqlInjection.cs:33:36:33:78 | object creation of type FileStream : FileStream | SecondOrderSqlInjection.cs:45:57:45:59 | access to local variable sql | This SQL query depends on a $@. | SecondOrderSqlInjection.cs:33:36:33:78 | object creation of type FileStream | stored user-provided value |
-| SqlInjectionSqlite.cs:61:53:61:55 | access to local variable sql | SqlInjectionSqlite.cs:49:36:49:84 | object creation of type FileStream : FileStream | SqlInjectionSqlite.cs:61:53:61:55 | access to local variable sql | This SQL query depends on a $@. | SqlInjectionSqlite.cs:49:36:49:84 | object creation of type FileStream | stored user-provided value |
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-089/SecondOrderSqlInjection.qlref b/csharp/ql/test/query-tests/Security Features/CWE-089/SecondOrderSqlInjection.qlref
deleted file mode 100644
index 265e69959850..000000000000
--- a/csharp/ql/test/query-tests/Security Features/CWE-089/SecondOrderSqlInjection.qlref
+++ /dev/null
@@ -1 +0,0 @@
-Security Features/CWE-089/SecondOrderSqlInjection.ql
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjection.ext.yml b/csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjection.ext.yml
new file mode 100644
index 000000000000..82f107ae1d71
--- /dev/null
+++ b/csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjection.ext.yml
@@ -0,0 +1,7 @@
+extensions:
+
+ - addsTo:
+ pack: codeql/threat-models
+ extensible: threatModelConfiguration
+ data:
+ - ["local", true, 0]
\ No newline at end of file
From 45e1be875c187cdd72a4a9a9050b1708a8e2e467 Mon Sep 17 00:00:00 2001
From: Ed Minnix
Date: Wed, 21 Feb 2024 13:19:43 -0500
Subject: [PATCH 052/731] Fix test expectations
---
.../CWE-079/StoredXSS/StoredXSS.expected | 2 +-
.../CWE-089/SqlInjection.expected | 27 +++++++++++++++++++
2 files changed, 28 insertions(+), 1 deletion(-)
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/StoredXSS/StoredXSS.expected b/csharp/ql/test/query-tests/Security Features/CWE-079/StoredXSS/StoredXSS.expected
index 488df85e1c4f..cad4dc8f7419 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-079/StoredXSS/StoredXSS.expected
+++ b/csharp/ql/test/query-tests/Security Features/CWE-079/StoredXSS/StoredXSS.expected
@@ -5,4 +5,4 @@ nodes
| StoredXSS.cs:22:60:22:86 | call to method GetString : String | semmle.label | call to method GetString : String |
subpaths
#select
-| StoredXSS.cs:22:44:22:86 | ... + ... | StoredXSS.cs:22:60:22:86 | call to method GetString : String | StoredXSS.cs:22:44:22:86 | ... + ... | This HTML or JavaScript write depends on a $@. | StoredXSS.cs:22:60:22:86 | call to method GetString | stored (potentially user-provided) value |
+| StoredXSS.cs:22:44:22:86 | ... + ... | StoredXSS.cs:22:60:22:86 | call to method GetString : String | StoredXSS.cs:22:44:22:86 | ... + ... | $@ flows to here and is written to HTML or JavaScript. | StoredXSS.cs:22:60:22:86 | call to method GetString : String | User-provided value |
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjection.expected b/csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjection.expected
index 4b4da20c97a5..abc86ce1fc1c 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjection.expected
+++ b/csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjection.expected
@@ -1,5 +1,16 @@
edges
+<<<<<<< HEAD
| SqlInjection.cs:32:21:32:26 | access to local variable query1 : String | SqlInjection.cs:34:50:34:55 | access to local variable query1 | provenance | |
+=======
+| SecondOrderSqlInjection.cs:25:119:25:145 | call to method GetString : String | SecondOrderSqlInjection.cs:25:71:25:145 | ... + ... | provenance | |
+| SecondOrderSqlInjection.cs:33:36:33:78 | object creation of type FileStream : FileStream | SecondOrderSqlInjection.cs:35:59:35:60 | access to local variable fs : FileStream | provenance | |
+| SecondOrderSqlInjection.cs:35:42:35:76 | object creation of type StreamReader : StreamReader | SecondOrderSqlInjection.cs:38:35:38:36 | access to local variable sr : StreamReader | provenance | |
+| SecondOrderSqlInjection.cs:35:59:35:60 | access to local variable fs : FileStream | SecondOrderSqlInjection.cs:35:42:35:76 | object creation of type StreamReader : StreamReader | provenance | |
+| SecondOrderSqlInjection.cs:38:35:38:36 | access to local variable sr : StreamReader | SecondOrderSqlInjection.cs:38:35:38:47 | call to method ReadLine : String | provenance | |
+| SecondOrderSqlInjection.cs:38:35:38:47 | call to method ReadLine : String | SecondOrderSqlInjection.cs:40:31:40:33 | access to local variable sql : String | provenance | |
+| SecondOrderSqlInjection.cs:40:31:40:33 | access to local variable sql : String | SecondOrderSqlInjection.cs:40:31:40:40 | call to method Trim : String | provenance | |
+| SecondOrderSqlInjection.cs:40:31:40:40 | call to method Trim : String | SecondOrderSqlInjection.cs:45:57:45:59 | access to local variable sql | provenance | |
+>>>>>>> 1ebb89f785 (Fix test expectations)
| SqlInjection.cs:33:21:33:35 | access to field categoryTextBox : TextBox | SqlInjection.cs:33:21:33:40 | access to property Text : String | provenance | |
| SqlInjection.cs:33:21:33:40 | access to property Text : String | SqlInjection.cs:32:21:32:26 | access to local variable query1 : String | provenance | |
| SqlInjection.cs:67:25:67:30 | access to local variable query1 : String | SqlInjection.cs:69:56:69:61 | access to local variable query1 | provenance | |
@@ -50,7 +61,20 @@ edges
| SqlInjectionSqlite.cs:56:31:56:33 | access to local variable sql : String | SqlInjectionSqlite.cs:56:31:56:40 | call to method Trim : String | provenance | |
| SqlInjectionSqlite.cs:56:31:56:40 | call to method Trim : String | SqlInjectionSqlite.cs:56:25:56:27 | access to local variable sql : String | provenance | |
nodes
+<<<<<<< HEAD
| SqlInjection.cs:32:21:32:26 | access to local variable query1 : String | semmle.label | access to local variable query1 : String |
+=======
+| SecondOrderSqlInjection.cs:25:71:25:145 | ... + ... | semmle.label | ... + ... |
+| SecondOrderSqlInjection.cs:25:119:25:145 | call to method GetString : String | semmle.label | call to method GetString : String |
+| SecondOrderSqlInjection.cs:33:36:33:78 | object creation of type FileStream : FileStream | semmle.label | object creation of type FileStream : FileStream |
+| SecondOrderSqlInjection.cs:35:42:35:76 | object creation of type StreamReader : StreamReader | semmle.label | object creation of type StreamReader : StreamReader |
+| SecondOrderSqlInjection.cs:35:59:35:60 | access to local variable fs : FileStream | semmle.label | access to local variable fs : FileStream |
+| SecondOrderSqlInjection.cs:38:35:38:36 | access to local variable sr : StreamReader | semmle.label | access to local variable sr : StreamReader |
+| SecondOrderSqlInjection.cs:38:35:38:47 | call to method ReadLine : String | semmle.label | call to method ReadLine : String |
+| SecondOrderSqlInjection.cs:40:31:40:33 | access to local variable sql : String | semmle.label | access to local variable sql : String |
+| SecondOrderSqlInjection.cs:40:31:40:40 | call to method Trim : String | semmle.label | call to method Trim : String |
+| SecondOrderSqlInjection.cs:45:57:45:59 | access to local variable sql | semmle.label | access to local variable sql |
+>>>>>>> 1ebb89f785 (Fix test expectations)
| SqlInjection.cs:33:21:33:35 | access to field categoryTextBox : TextBox | semmle.label | access to field categoryTextBox : TextBox |
| SqlInjection.cs:33:21:33:40 | access to property Text : String | semmle.label | access to property Text : String |
| SqlInjection.cs:34:50:34:55 | access to local variable query1 | semmle.label | access to local variable query1 |
@@ -118,6 +142,8 @@ nodes
| SqlInjectionSqlite.cs:61:53:61:55 | access to local variable sql | semmle.label | access to local variable sql |
subpaths
#select
+| SecondOrderSqlInjection.cs:25:71:25:145 | ... + ... | SecondOrderSqlInjection.cs:25:119:25:145 | call to method GetString : String | SecondOrderSqlInjection.cs:25:71:25:145 | ... + ... | This query depends on $@. | SecondOrderSqlInjection.cs:25:119:25:145 | call to method GetString : String | this database input |
+| SecondOrderSqlInjection.cs:45:57:45:59 | access to local variable sql | SecondOrderSqlInjection.cs:33:36:33:78 | object creation of type FileStream : FileStream | SecondOrderSqlInjection.cs:45:57:45:59 | access to local variable sql | This query depends on $@. | SecondOrderSqlInjection.cs:33:36:33:78 | object creation of type FileStream : FileStream | this file stream |
| SqlInjection.cs:34:50:34:55 | access to local variable query1 | SqlInjection.cs:33:21:33:35 | access to field categoryTextBox : TextBox | SqlInjection.cs:34:50:34:55 | access to local variable query1 | This query depends on $@. | SqlInjection.cs:33:21:33:35 | access to field categoryTextBox : TextBox | this ASP.NET user input |
| SqlInjection.cs:69:56:69:61 | access to local variable query1 | SqlInjection.cs:68:33:68:47 | access to field categoryTextBox : TextBox | SqlInjection.cs:69:56:69:61 | access to local variable query1 | This query depends on $@. | SqlInjection.cs:68:33:68:47 | access to field categoryTextBox : TextBox | this ASP.NET user input |
| SqlInjection.cs:70:55:70:60 | access to local variable query1 | SqlInjection.cs:68:33:68:47 | access to field categoryTextBox : TextBox | SqlInjection.cs:70:55:70:60 | access to local variable query1 | This query depends on $@. | SqlInjection.cs:68:33:68:47 | access to field categoryTextBox : TextBox | this ASP.NET user input |
@@ -136,4 +162,5 @@ subpaths
| SqlInjectionSqlite.cs:33:49:33:66 | access to property Text | SqlInjectionSqlite.cs:33:49:33:61 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:33:49:33:66 | access to property Text | This query depends on $@. | SqlInjectionSqlite.cs:33:49:33:61 | access to field untrustedData : TextBox | this ASP.NET user input |
| SqlInjectionSqlite.cs:39:45:39:62 | access to property Text | SqlInjectionSqlite.cs:39:45:39:57 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:39:45:39:62 | access to property Text | This query depends on $@. | SqlInjectionSqlite.cs:39:45:39:57 | access to field untrustedData : TextBox | this ASP.NET user input |
| SqlInjectionSqlite.cs:44:45:44:47 | access to local variable cmd | SqlInjectionSqlite.cs:24:41:24:53 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:44:45:44:47 | access to local variable cmd | This query depends on $@. | SqlInjectionSqlite.cs:24:41:24:53 | access to field untrustedData : TextBox | this ASP.NET user input |
+| SqlInjectionSqlite.cs:61:53:61:55 | access to local variable sql | SqlInjectionSqlite.cs:49:36:49:84 | object creation of type FileStream : FileStream | SqlInjectionSqlite.cs:61:53:61:55 | access to local variable sql | This query depends on $@. | SqlInjectionSqlite.cs:49:36:49:84 | object creation of type FileStream : FileStream | this file stream |
| SqlInjectionSqlite.cs:61:53:61:55 | access to local variable sql | SqlInjectionSqlite.cs:49:51:49:63 | access to field untrustedData : TextBox | SqlInjectionSqlite.cs:61:53:61:55 | access to local variable sql | This query depends on $@. | SqlInjectionSqlite.cs:49:51:49:63 | access to field untrustedData : TextBox | this ASP.NET user input |
From 59b14f6a69ead708bc20e06200f939f2a0217ab5 Mon Sep 17 00:00:00 2001
From: Ed Minnix
Date: Mon, 26 Feb 2024 13:14:32 -0500
Subject: [PATCH 053/731] Fix test expectations (merge conflict)
---
.../CWE-078/CommandInjection.expected | 76 ++++------------
.../CWE-089/SqlInjection.expected | 26 +++---
.../CWE-090/LDAPInjection.expected | 43 ++-------
.../CWE-643/XPathInjection.expected | 89 +++++--------------
4 files changed, 64 insertions(+), 170 deletions(-)
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-078/CommandInjection.expected b/csharp/ql/test/query-tests/Security Features/CWE-078/CommandInjection.expected
index 1e8317bac241..fe27701d59d0 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-078/CommandInjection.expected
+++ b/csharp/ql/test/query-tests/Security Features/CWE-078/CommandInjection.expected
@@ -1,63 +1,20 @@
edges
-<<<<<<< HEAD
-| CommandInjection.cs:25:20:25:28 | access to local variable userInput : String | CommandInjection.cs:26:27:26:47 | ... + ... | provenance | |
-| CommandInjection.cs:25:20:25:28 | access to local variable userInput : String | CommandInjection.cs:26:50:26:66 | ... + ... | provenance | |
-| CommandInjection.cs:25:20:25:28 | access to local variable userInput : String | CommandInjection.cs:28:63:28:71 | access to local variable userInput | provenance | |
-| CommandInjection.cs:25:20:25:28 | access to local variable userInput : String | CommandInjection.cs:28:63:28:71 | access to local variable userInput : String | provenance | |
-| CommandInjection.cs:25:20:25:28 | access to local variable userInput : String | CommandInjection.cs:28:74:28:82 | access to local variable userInput | provenance | |
-| CommandInjection.cs:25:20:25:28 | access to local variable userInput : String | CommandInjection.cs:28:74:28:82 | access to local variable userInput : String | provenance | |
-| CommandInjection.cs:25:20:25:28 | access to local variable userInput : String | CommandInjection.cs:32:39:32:47 | access to local variable userInput | provenance | |
-| CommandInjection.cs:25:20:25:28 | access to local variable userInput : String | CommandInjection.cs:32:39:32:47 | access to local variable userInput : String | provenance | |
-| CommandInjection.cs:25:20:25:28 | access to local variable userInput : String | CommandInjection.cs:33:40:33:48 | access to local variable userInput | provenance | |
-| CommandInjection.cs:25:20:25:28 | access to local variable userInput : String | CommandInjection.cs:33:40:33:48 | access to local variable userInput : String | provenance | |
-| CommandInjection.cs:25:20:25:28 | access to local variable userInput : String | CommandInjection.cs:34:47:34:55 | access to local variable userInput | provenance | |
-| CommandInjection.cs:25:20:25:28 | access to local variable userInput : String | CommandInjection.cs:34:47:34:55 | access to local variable userInput : String | provenance | |
-| CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:25:32:25:51 | access to property Text : String | provenance | |
-| CommandInjection.cs:25:32:25:51 | access to property Text : String | CommandInjection.cs:25:20:25:28 | access to local variable userInput : String | provenance | |
-| CommandInjection.cs:28:30:28:38 | access to local variable startInfo : ProcessStartInfo | CommandInjection.cs:29:27:29:35 | access to local variable startInfo | provenance | |
-| CommandInjection.cs:28:42:28:83 | object creation of type ProcessStartInfo : ProcessStartInfo | CommandInjection.cs:28:30:28:38 | access to local variable startInfo : ProcessStartInfo | provenance | |
-| CommandInjection.cs:28:63:28:71 | access to local variable userInput : String | CommandInjection.cs:28:42:28:83 | object creation of type ProcessStartInfo : ProcessStartInfo | provenance | |
-| CommandInjection.cs:28:74:28:82 | access to local variable userInput : String | CommandInjection.cs:28:42:28:83 | object creation of type ProcessStartInfo : ProcessStartInfo | provenance | |
-| CommandInjection.cs:32:13:32:26 | [post] access to local variable startInfoProps : ProcessStartInfo | CommandInjection.cs:35:27:35:40 | access to local variable startInfoProps | provenance | |
-| CommandInjection.cs:32:39:32:47 | access to local variable userInput : String | CommandInjection.cs:32:13:32:26 | [post] access to local variable startInfoProps : ProcessStartInfo | provenance | |
-| CommandInjection.cs:33:13:33:26 | [post] access to local variable startInfoProps : ProcessStartInfo | CommandInjection.cs:35:27:35:40 | access to local variable startInfoProps | provenance | |
-| CommandInjection.cs:33:40:33:48 | access to local variable userInput : String | CommandInjection.cs:33:13:33:26 | [post] access to local variable startInfoProps : ProcessStartInfo | provenance | |
-| CommandInjection.cs:34:13:34:26 | [post] access to local variable startInfoProps : ProcessStartInfo | CommandInjection.cs:35:27:35:40 | access to local variable startInfoProps | provenance | |
-| CommandInjection.cs:34:47:34:55 | access to local variable userInput : String | CommandInjection.cs:34:13:34:26 | [post] access to local variable startInfoProps : ProcessStartInfo | provenance | |
-nodes
-| CommandInjection.cs:25:20:25:28 | access to local variable userInput : String | semmle.label | access to local variable userInput : String |
-| CommandInjection.cs:25:32:25:46 | access to field categoryTextBox : TextBox | semmle.label | access to field categoryTextBox : TextBox |
-| CommandInjection.cs:25:32:25:51 | access to property Text : String | semmle.label | access to property Text : String |
-| CommandInjection.cs:26:27:26:47 | ... + ... | semmle.label | ... + ... |
-| CommandInjection.cs:26:50:26:66 | ... + ... | semmle.label | ... + ... |
-| CommandInjection.cs:28:30:28:38 | access to local variable startInfo : ProcessStartInfo | semmle.label | access to local variable startInfo : ProcessStartInfo |
-| CommandInjection.cs:28:42:28:83 | object creation of type ProcessStartInfo : ProcessStartInfo | semmle.label | object creation of type ProcessStartInfo : ProcessStartInfo |
-| CommandInjection.cs:28:63:28:71 | access to local variable userInput | semmle.label | access to local variable userInput |
-| CommandInjection.cs:28:63:28:71 | access to local variable userInput : String | semmle.label | access to local variable userInput : String |
-| CommandInjection.cs:28:74:28:82 | access to local variable userInput | semmle.label | access to local variable userInput |
-| CommandInjection.cs:28:74:28:82 | access to local variable userInput : String | semmle.label | access to local variable userInput : String |
-| CommandInjection.cs:29:27:29:35 | access to local variable startInfo | semmle.label | access to local variable startInfo |
-| CommandInjection.cs:32:13:32:26 | [post] access to local variable startInfoProps : ProcessStartInfo | semmle.label | [post] access to local variable startInfoProps : ProcessStartInfo |
-| CommandInjection.cs:32:39:32:47 | access to local variable userInput | semmle.label | access to local variable userInput |
-| CommandInjection.cs:32:39:32:47 | access to local variable userInput : String | semmle.label | access to local variable userInput : String |
-| CommandInjection.cs:33:13:33:26 | [post] access to local variable startInfoProps : ProcessStartInfo | semmle.label | [post] access to local variable startInfoProps : ProcessStartInfo |
-| CommandInjection.cs:33:40:33:48 | access to local variable userInput | semmle.label | access to local variable userInput |
-| CommandInjection.cs:33:40:33:48 | access to local variable userInput : String | semmle.label | access to local variable userInput : String |
-=======
+| CommandInjection.cs:27:20:27:28 | access to local variable userInput : String | CommandInjection.cs:28:27:28:47 | ... + ... | provenance | |
+| CommandInjection.cs:27:20:27:28 | access to local variable userInput : String | CommandInjection.cs:28:50:28:66 | ... + ... | provenance | |
+| CommandInjection.cs:27:20:27:28 | access to local variable userInput : String | CommandInjection.cs:30:63:30:71 | access to local variable userInput | provenance | |
+| CommandInjection.cs:27:20:27:28 | access to local variable userInput : String | CommandInjection.cs:30:63:30:71 | access to local variable userInput : String | provenance | |
+| CommandInjection.cs:27:20:27:28 | access to local variable userInput : String | CommandInjection.cs:30:74:30:82 | access to local variable userInput | provenance | |
+| CommandInjection.cs:27:20:27:28 | access to local variable userInput : String | CommandInjection.cs:30:74:30:82 | access to local variable userInput : String | provenance | |
+| CommandInjection.cs:27:20:27:28 | access to local variable userInput : String | CommandInjection.cs:34:39:34:47 | access to local variable userInput | provenance | |
+| CommandInjection.cs:27:20:27:28 | access to local variable userInput : String | CommandInjection.cs:34:39:34:47 | access to local variable userInput : String | provenance | |
+| CommandInjection.cs:27:20:27:28 | access to local variable userInput : String | CommandInjection.cs:35:40:35:48 | access to local variable userInput | provenance | |
+| CommandInjection.cs:27:20:27:28 | access to local variable userInput : String | CommandInjection.cs:35:40:35:48 | access to local variable userInput : String | provenance | |
+| CommandInjection.cs:27:20:27:28 | access to local variable userInput : String | CommandInjection.cs:36:47:36:55 | access to local variable userInput | provenance | |
+| CommandInjection.cs:27:20:27:28 | access to local variable userInput : String | CommandInjection.cs:36:47:36:55 | access to local variable userInput : String | provenance | |
| CommandInjection.cs:27:32:27:46 | access to field categoryTextBox : TextBox | CommandInjection.cs:27:32:27:51 | access to property Text : String | provenance | |
-| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:28:27:28:47 | ... + ... | provenance | |
-| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:28:50:28:66 | ... + ... | provenance | |
-| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:30:63:30:71 | access to local variable userInput | provenance | |
-| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:30:63:30:71 | access to local variable userInput : String | provenance | |
-| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:30:74:30:82 | access to local variable userInput | provenance | |
-| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:30:74:30:82 | access to local variable userInput : String | provenance | |
-| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:34:39:34:47 | access to local variable userInput | provenance | |
-| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:34:39:34:47 | access to local variable userInput : String | provenance | |
-| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:35:40:35:48 | access to local variable userInput | provenance | |
-| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:35:40:35:48 | access to local variable userInput : String | provenance | |
-| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:36:47:36:55 | access to local variable userInput | provenance | |
-| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:36:47:36:55 | access to local variable userInput : String | provenance | |
-| CommandInjection.cs:30:42:30:83 | object creation of type ProcessStartInfo : ProcessStartInfo | CommandInjection.cs:31:27:31:35 | access to local variable startInfo | provenance | |
+| CommandInjection.cs:27:32:27:51 | access to property Text : String | CommandInjection.cs:27:20:27:28 | access to local variable userInput : String | provenance | |
+| CommandInjection.cs:30:30:30:38 | access to local variable startInfo : ProcessStartInfo | CommandInjection.cs:31:27:31:35 | access to local variable startInfo | provenance | |
+| CommandInjection.cs:30:42:30:83 | object creation of type ProcessStartInfo : ProcessStartInfo | CommandInjection.cs:30:30:30:38 | access to local variable startInfo : ProcessStartInfo | provenance | |
| CommandInjection.cs:30:63:30:71 | access to local variable userInput : String | CommandInjection.cs:30:42:30:83 | object creation of type ProcessStartInfo : ProcessStartInfo | provenance | |
| CommandInjection.cs:30:74:30:82 | access to local variable userInput : String | CommandInjection.cs:30:42:30:83 | object creation of type ProcessStartInfo : ProcessStartInfo | provenance | |
| CommandInjection.cs:34:13:34:26 | [post] access to local variable startInfoProps : ProcessStartInfo | CommandInjection.cs:37:27:37:40 | access to local variable startInfoProps | provenance | |
@@ -68,17 +25,18 @@ nodes
| CommandInjection.cs:36:47:36:55 | access to local variable userInput : String | CommandInjection.cs:36:13:36:26 | [post] access to local variable startInfoProps : ProcessStartInfo | provenance | |
| CommandInjection.cs:51:54:51:80 | call to method GetString : String | CommandInjection.cs:51:46:51:80 | ... + ... | provenance | |
nodes
+| CommandInjection.cs:27:20:27:28 | access to local variable userInput : String | semmle.label | access to local variable userInput : String |
| CommandInjection.cs:27:32:27:46 | access to field categoryTextBox : TextBox | semmle.label | access to field categoryTextBox : TextBox |
| CommandInjection.cs:27:32:27:51 | access to property Text : String | semmle.label | access to property Text : String |
| CommandInjection.cs:28:27:28:47 | ... + ... | semmle.label | ... + ... |
| CommandInjection.cs:28:50:28:66 | ... + ... | semmle.label | ... + ... |
+| CommandInjection.cs:30:30:30:38 | access to local variable startInfo : ProcessStartInfo | semmle.label | access to local variable startInfo : ProcessStartInfo |
| CommandInjection.cs:30:42:30:83 | object creation of type ProcessStartInfo : ProcessStartInfo | semmle.label | object creation of type ProcessStartInfo : ProcessStartInfo |
| CommandInjection.cs:30:63:30:71 | access to local variable userInput | semmle.label | access to local variable userInput |
| CommandInjection.cs:30:63:30:71 | access to local variable userInput : String | semmle.label | access to local variable userInput : String |
| CommandInjection.cs:30:74:30:82 | access to local variable userInput | semmle.label | access to local variable userInput |
| CommandInjection.cs:30:74:30:82 | access to local variable userInput : String | semmle.label | access to local variable userInput : String |
| CommandInjection.cs:31:27:31:35 | access to local variable startInfo | semmle.label | access to local variable startInfo |
->>>>>>> 4fc83a3267 (Modify test cases)
| CommandInjection.cs:34:13:34:26 | [post] access to local variable startInfoProps : ProcessStartInfo | semmle.label | [post] access to local variable startInfoProps : ProcessStartInfo |
| CommandInjection.cs:34:39:34:47 | access to local variable userInput | semmle.label | access to local variable userInput |
| CommandInjection.cs:34:39:34:47 | access to local variable userInput : String | semmle.label | access to local variable userInput : String |
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjection.expected b/csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjection.expected
index abc86ce1fc1c..c156c3def8bb 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjection.expected
+++ b/csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjection.expected
@@ -1,16 +1,17 @@
edges
-<<<<<<< HEAD
-| SqlInjection.cs:32:21:32:26 | access to local variable query1 : String | SqlInjection.cs:34:50:34:55 | access to local variable query1 | provenance | |
-=======
| SecondOrderSqlInjection.cs:25:119:25:145 | call to method GetString : String | SecondOrderSqlInjection.cs:25:71:25:145 | ... + ... | provenance | |
-| SecondOrderSqlInjection.cs:33:36:33:78 | object creation of type FileStream : FileStream | SecondOrderSqlInjection.cs:35:59:35:60 | access to local variable fs : FileStream | provenance | |
-| SecondOrderSqlInjection.cs:35:42:35:76 | object creation of type StreamReader : StreamReader | SecondOrderSqlInjection.cs:38:35:38:36 | access to local variable sr : StreamReader | provenance | |
+| SecondOrderSqlInjection.cs:33:31:33:32 | access to local variable fs : FileStream | SecondOrderSqlInjection.cs:35:59:35:60 | access to local variable fs : FileStream | provenance | |
+| SecondOrderSqlInjection.cs:33:36:33:78 | object creation of type FileStream : FileStream | SecondOrderSqlInjection.cs:33:31:33:32 | access to local variable fs : FileStream | provenance | |
+| SecondOrderSqlInjection.cs:35:37:35:38 | access to local variable sr : StreamReader | SecondOrderSqlInjection.cs:38:35:38:36 | access to local variable sr : StreamReader | provenance | |
+| SecondOrderSqlInjection.cs:35:42:35:76 | object creation of type StreamReader : StreamReader | SecondOrderSqlInjection.cs:35:37:35:38 | access to local variable sr : StreamReader | provenance | |
| SecondOrderSqlInjection.cs:35:59:35:60 | access to local variable fs : FileStream | SecondOrderSqlInjection.cs:35:42:35:76 | object creation of type StreamReader : StreamReader | provenance | |
+| SecondOrderSqlInjection.cs:38:29:38:31 | access to local variable sql : String | SecondOrderSqlInjection.cs:40:31:40:33 | access to local variable sql : String | provenance | |
| SecondOrderSqlInjection.cs:38:35:38:36 | access to local variable sr : StreamReader | SecondOrderSqlInjection.cs:38:35:38:47 | call to method ReadLine : String | provenance | |
-| SecondOrderSqlInjection.cs:38:35:38:47 | call to method ReadLine : String | SecondOrderSqlInjection.cs:40:31:40:33 | access to local variable sql : String | provenance | |
+| SecondOrderSqlInjection.cs:38:35:38:47 | call to method ReadLine : String | SecondOrderSqlInjection.cs:38:29:38:31 | access to local variable sql : String | provenance | |
+| SecondOrderSqlInjection.cs:40:25:40:27 | access to local variable sql : String | SecondOrderSqlInjection.cs:45:57:45:59 | access to local variable sql | provenance | |
| SecondOrderSqlInjection.cs:40:31:40:33 | access to local variable sql : String | SecondOrderSqlInjection.cs:40:31:40:40 | call to method Trim : String | provenance | |
-| SecondOrderSqlInjection.cs:40:31:40:40 | call to method Trim : String | SecondOrderSqlInjection.cs:45:57:45:59 | access to local variable sql | provenance | |
->>>>>>> 1ebb89f785 (Fix test expectations)
+| SecondOrderSqlInjection.cs:40:31:40:40 | call to method Trim : String | SecondOrderSqlInjection.cs:40:25:40:27 | access to local variable sql : String | provenance | |
+| SqlInjection.cs:32:21:32:26 | access to local variable query1 : String | SqlInjection.cs:34:50:34:55 | access to local variable query1 | provenance | |
| SqlInjection.cs:33:21:33:35 | access to field categoryTextBox : TextBox | SqlInjection.cs:33:21:33:40 | access to property Text : String | provenance | |
| SqlInjection.cs:33:21:33:40 | access to property Text : String | SqlInjection.cs:32:21:32:26 | access to local variable query1 : String | provenance | |
| SqlInjection.cs:67:25:67:30 | access to local variable query1 : String | SqlInjection.cs:69:56:69:61 | access to local variable query1 | provenance | |
@@ -61,20 +62,21 @@ edges
| SqlInjectionSqlite.cs:56:31:56:33 | access to local variable sql : String | SqlInjectionSqlite.cs:56:31:56:40 | call to method Trim : String | provenance | |
| SqlInjectionSqlite.cs:56:31:56:40 | call to method Trim : String | SqlInjectionSqlite.cs:56:25:56:27 | access to local variable sql : String | provenance | |
nodes
-<<<<<<< HEAD
-| SqlInjection.cs:32:21:32:26 | access to local variable query1 : String | semmle.label | access to local variable query1 : String |
-=======
| SecondOrderSqlInjection.cs:25:71:25:145 | ... + ... | semmle.label | ... + ... |
| SecondOrderSqlInjection.cs:25:119:25:145 | call to method GetString : String | semmle.label | call to method GetString : String |
+| SecondOrderSqlInjection.cs:33:31:33:32 | access to local variable fs : FileStream | semmle.label | access to local variable fs : FileStream |
| SecondOrderSqlInjection.cs:33:36:33:78 | object creation of type FileStream : FileStream | semmle.label | object creation of type FileStream : FileStream |
+| SecondOrderSqlInjection.cs:35:37:35:38 | access to local variable sr : StreamReader | semmle.label | access to local variable sr : StreamReader |
| SecondOrderSqlInjection.cs:35:42:35:76 | object creation of type StreamReader : StreamReader | semmle.label | object creation of type StreamReader : StreamReader |
| SecondOrderSqlInjection.cs:35:59:35:60 | access to local variable fs : FileStream | semmle.label | access to local variable fs : FileStream |
+| SecondOrderSqlInjection.cs:38:29:38:31 | access to local variable sql : String | semmle.label | access to local variable sql : String |
| SecondOrderSqlInjection.cs:38:35:38:36 | access to local variable sr : StreamReader | semmle.label | access to local variable sr : StreamReader |
| SecondOrderSqlInjection.cs:38:35:38:47 | call to method ReadLine : String | semmle.label | call to method ReadLine : String |
+| SecondOrderSqlInjection.cs:40:25:40:27 | access to local variable sql : String | semmle.label | access to local variable sql : String |
| SecondOrderSqlInjection.cs:40:31:40:33 | access to local variable sql : String | semmle.label | access to local variable sql : String |
| SecondOrderSqlInjection.cs:40:31:40:40 | call to method Trim : String | semmle.label | call to method Trim : String |
| SecondOrderSqlInjection.cs:45:57:45:59 | access to local variable sql | semmle.label | access to local variable sql |
->>>>>>> 1ebb89f785 (Fix test expectations)
+| SqlInjection.cs:32:21:32:26 | access to local variable query1 : String | semmle.label | access to local variable query1 : String |
| SqlInjection.cs:33:21:33:35 | access to field categoryTextBox : TextBox | semmle.label | access to field categoryTextBox : TextBox |
| SqlInjection.cs:33:21:33:40 | access to property Text : String | semmle.label | access to property Text : String |
| SqlInjection.cs:34:50:34:55 | access to local variable query1 | semmle.label | access to local variable query1 |
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-090/LDAPInjection.expected b/csharp/ql/test/query-tests/Security Features/CWE-090/LDAPInjection.expected
index 87b4ba8da1e9..a04278ad9942 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-090/LDAPInjection.expected
+++ b/csharp/ql/test/query-tests/Security Features/CWE-090/LDAPInjection.expected
@@ -1,40 +1,16 @@
edges
-<<<<<<< HEAD
-| LDAPInjection.cs:11:16:11:23 | access to local variable userName : String | LDAPInjection.cs:14:54:14:78 | ... + ... | provenance | |
-| LDAPInjection.cs:11:16:11:23 | access to local variable userName : String | LDAPInjection.cs:16:21:16:45 | ... + ... | provenance | |
-| LDAPInjection.cs:11:16:11:23 | access to local variable userName : String | LDAPInjection.cs:23:21:23:45 | ... + ... | provenance | |
-| LDAPInjection.cs:11:16:11:23 | access to local variable userName : String | LDAPInjection.cs:24:53:24:77 | ... + ... | provenance | |
-| LDAPInjection.cs:11:16:11:23 | access to local variable userName : String | LDAPInjection.cs:27:48:27:70 | ... + ... | provenance | |
-| LDAPInjection.cs:11:16:11:23 | access to local variable userName : String | LDAPInjection.cs:29:20:29:42 | ... + ... | provenance | |
-| LDAPInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | LDAPInjection.cs:11:16:11:23 | access to local variable userName : String | provenance | |
-| LDAPInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | LDAPInjection.cs:11:27:11:61 | access to indexer : String | provenance | |
-| LDAPInjection.cs:11:27:11:61 | access to indexer : String | LDAPInjection.cs:11:16:11:23 | access to local variable userName : String | provenance | |
-nodes
-| LDAPInjection.cs:11:16:11:23 | access to local variable userName : String | semmle.label | access to local variable userName : String |
-| LDAPInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
-| LDAPInjection.cs:11:27:11:61 | access to indexer : String | semmle.label | access to indexer : String |
-| LDAPInjection.cs:14:54:14:78 | ... + ... | semmle.label | ... + ... |
-| LDAPInjection.cs:16:21:16:45 | ... + ... | semmle.label | ... + ... |
-| LDAPInjection.cs:23:21:23:45 | ... + ... | semmle.label | ... + ... |
-| LDAPInjection.cs:24:53:24:77 | ... + ... | semmle.label | ... + ... |
-| LDAPInjection.cs:27:48:27:70 | ... + ... | semmle.label | ... + ... |
-| LDAPInjection.cs:29:20:29:42 | ... + ... | semmle.label | ... + ... |
-=======
+| LDAPInjection.cs:12:16:12:23 | access to local variable userName : String | LDAPInjection.cs:15:54:15:78 | ... + ... | provenance | |
+| LDAPInjection.cs:12:16:12:23 | access to local variable userName : String | LDAPInjection.cs:17:21:17:45 | ... + ... | provenance | |
+| LDAPInjection.cs:12:16:12:23 | access to local variable userName : String | LDAPInjection.cs:24:21:24:45 | ... + ... | provenance | |
+| LDAPInjection.cs:12:16:12:23 | access to local variable userName : String | LDAPInjection.cs:25:53:25:77 | ... + ... | provenance | |
+| LDAPInjection.cs:12:16:12:23 | access to local variable userName : String | LDAPInjection.cs:28:48:28:70 | ... + ... | provenance | |
+| LDAPInjection.cs:12:16:12:23 | access to local variable userName : String | LDAPInjection.cs:30:20:30:42 | ... + ... | provenance | |
+| LDAPInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | LDAPInjection.cs:12:16:12:23 | access to local variable userName : String | provenance | |
| LDAPInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | LDAPInjection.cs:12:27:12:61 | access to indexer : String | provenance | |
-| LDAPInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | LDAPInjection.cs:15:54:15:78 | ... + ... | provenance | |
-| LDAPInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | LDAPInjection.cs:17:21:17:45 | ... + ... | provenance | |
-| LDAPInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | LDAPInjection.cs:24:21:24:45 | ... + ... | provenance | |
-| LDAPInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | LDAPInjection.cs:25:53:25:77 | ... + ... | provenance | |
-| LDAPInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | LDAPInjection.cs:28:48:28:70 | ... + ... | provenance | |
-| LDAPInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | LDAPInjection.cs:30:20:30:42 | ... + ... | provenance | |
-| LDAPInjection.cs:12:27:12:61 | access to indexer : String | LDAPInjection.cs:15:54:15:78 | ... + ... | provenance | |
-| LDAPInjection.cs:12:27:12:61 | access to indexer : String | LDAPInjection.cs:17:21:17:45 | ... + ... | provenance | |
-| LDAPInjection.cs:12:27:12:61 | access to indexer : String | LDAPInjection.cs:24:21:24:45 | ... + ... | provenance | |
-| LDAPInjection.cs:12:27:12:61 | access to indexer : String | LDAPInjection.cs:25:53:25:77 | ... + ... | provenance | |
-| LDAPInjection.cs:12:27:12:61 | access to indexer : String | LDAPInjection.cs:28:48:28:70 | ... + ... | provenance | |
-| LDAPInjection.cs:12:27:12:61 | access to indexer : String | LDAPInjection.cs:30:20:30:42 | ... + ... | provenance | |
+| LDAPInjection.cs:12:27:12:61 | access to indexer : String | LDAPInjection.cs:12:16:12:23 | access to local variable userName : String | provenance | |
| LDAPInjection.cs:41:80:41:106 | call to method GetString : String | LDAPInjection.cs:41:63:41:106 | ... + ... | provenance | |
nodes
+| LDAPInjection.cs:12:16:12:23 | access to local variable userName : String | semmle.label | access to local variable userName : String |
| LDAPInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
| LDAPInjection.cs:12:27:12:61 | access to indexer : String | semmle.label | access to indexer : String |
| LDAPInjection.cs:15:54:15:78 | ... + ... | semmle.label | ... + ... |
@@ -45,7 +21,6 @@ nodes
| LDAPInjection.cs:30:20:30:42 | ... + ... | semmle.label | ... + ... |
| LDAPInjection.cs:41:63:41:106 | ... + ... | semmle.label | ... + ... |
| LDAPInjection.cs:41:80:41:106 | call to method GetString : String | semmle.label | call to method GetString : String |
->>>>>>> 4fc83a3267 (Modify test cases)
subpaths
#select
| LDAPInjection.cs:15:54:15:78 | ... + ... | LDAPInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | LDAPInjection.cs:15:54:15:78 | ... + ... | This LDAP query depends on a $@. | LDAPInjection.cs:12:27:12:49 | access to property QueryString | user-provided value |
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-643/XPathInjection.expected b/csharp/ql/test/query-tests/Security Features/CWE-643/XPathInjection.expected
index 9229f3a62869..f957dc1e6a07 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-643/XPathInjection.expected
+++ b/csharp/ql/test/query-tests/Security Features/CWE-643/XPathInjection.expected
@@ -1,75 +1,33 @@
edges
-<<<<<<< HEAD
-| XPathInjection.cs:10:16:10:23 | access to local variable userName : String | XPathInjection.cs:13:13:13:13 | access to local variable s : String | provenance | |
-| XPathInjection.cs:10:27:10:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:10:16:10:23 | access to local variable userName : String | provenance | |
-| XPathInjection.cs:10:27:10:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:10:27:10:61 | access to indexer : String | provenance | |
-| XPathInjection.cs:10:27:10:61 | access to indexer : String | XPathInjection.cs:10:16:10:23 | access to local variable userName : String | provenance | |
-| XPathInjection.cs:11:16:11:23 | access to local variable password : String | XPathInjection.cs:13:13:13:13 | access to local variable s : String | provenance | |
-| XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:11:16:11:23 | access to local variable password : String | provenance | |
+| XPathInjection.cs:11:16:11:23 | access to local variable userName : String | XPathInjection.cs:14:13:14:13 | access to local variable s : String | provenance | |
+| XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:11:16:11:23 | access to local variable userName : String | provenance | |
| XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:11:27:11:61 | access to indexer : String | provenance | |
-| XPathInjection.cs:11:27:11:61 | access to indexer : String | XPathInjection.cs:11:16:11:23 | access to local variable password : String | provenance | |
-| XPathInjection.cs:13:13:13:13 | access to local variable s : String | XPathInjection.cs:16:33:16:33 | access to local variable s | provenance | |
-| XPathInjection.cs:13:13:13:13 | access to local variable s : String | XPathInjection.cs:19:29:19:29 | access to local variable s | provenance | |
-| XPathInjection.cs:13:13:13:13 | access to local variable s : String | XPathInjection.cs:28:20:28:20 | access to local variable s | provenance | |
-| XPathInjection.cs:13:13:13:13 | access to local variable s : String | XPathInjection.cs:34:30:34:30 | access to local variable s | provenance | |
-| XPathInjection.cs:13:13:13:13 | access to local variable s : String | XPathInjection.cs:40:21:40:21 | access to local variable s | provenance | |
-| XPathInjection.cs:13:13:13:13 | access to local variable s : String | XPathInjection.cs:46:22:46:22 | access to local variable s | provenance | |
-| XPathInjection.cs:13:13:13:13 | access to local variable s : String | XPathInjection.cs:52:21:52:21 | access to local variable s | provenance | |
-nodes
-| XPathInjection.cs:10:16:10:23 | access to local variable userName : String | semmle.label | access to local variable userName : String |
-| XPathInjection.cs:10:27:10:49 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
-| XPathInjection.cs:10:27:10:61 | access to indexer : String | semmle.label | access to indexer : String |
-| XPathInjection.cs:11:16:11:23 | access to local variable password : String | semmle.label | access to local variable password : String |
-| XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
-| XPathInjection.cs:11:27:11:61 | access to indexer : String | semmle.label | access to indexer : String |
-| XPathInjection.cs:13:13:13:13 | access to local variable s : String | semmle.label | access to local variable s : String |
-| XPathInjection.cs:16:33:16:33 | access to local variable s | semmle.label | access to local variable s |
-| XPathInjection.cs:19:29:19:29 | access to local variable s | semmle.label | access to local variable s |
-| XPathInjection.cs:28:20:28:20 | access to local variable s | semmle.label | access to local variable s |
-| XPathInjection.cs:34:30:34:30 | access to local variable s | semmle.label | access to local variable s |
-| XPathInjection.cs:40:21:40:21 | access to local variable s | semmle.label | access to local variable s |
-| XPathInjection.cs:46:22:46:22 | access to local variable s | semmle.label | access to local variable s |
-| XPathInjection.cs:52:21:52:21 | access to local variable s | semmle.label | access to local variable s |
-=======
-| XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:11:27:11:61 | access to indexer : String | provenance | |
-| XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:17:33:17:33 | access to local variable s | provenance | |
-| XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:20:29:20:29 | access to local variable s | provenance | |
-| XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:29:20:29:20 | access to local variable s | provenance | |
-| XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:35:30:35:30 | access to local variable s | provenance | |
-| XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:41:21:41:21 | access to local variable s | provenance | |
-| XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:47:22:47:22 | access to local variable s | provenance | |
-| XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:53:21:53:21 | access to local variable s | provenance | |
-| XPathInjection.cs:11:27:11:61 | access to indexer : String | XPathInjection.cs:17:33:17:33 | access to local variable s | provenance | |
-| XPathInjection.cs:11:27:11:61 | access to indexer : String | XPathInjection.cs:20:29:20:29 | access to local variable s | provenance | |
-| XPathInjection.cs:11:27:11:61 | access to indexer : String | XPathInjection.cs:29:20:29:20 | access to local variable s | provenance | |
-| XPathInjection.cs:11:27:11:61 | access to indexer : String | XPathInjection.cs:35:30:35:30 | access to local variable s | provenance | |
-| XPathInjection.cs:11:27:11:61 | access to indexer : String | XPathInjection.cs:41:21:41:21 | access to local variable s | provenance | |
-| XPathInjection.cs:11:27:11:61 | access to indexer : String | XPathInjection.cs:47:22:47:22 | access to local variable s | provenance | |
-| XPathInjection.cs:11:27:11:61 | access to indexer : String | XPathInjection.cs:53:21:53:21 | access to local variable s | provenance | |
+| XPathInjection.cs:11:27:11:61 | access to indexer : String | XPathInjection.cs:11:16:11:23 | access to local variable userName : String | provenance | |
+| XPathInjection.cs:12:16:12:23 | access to local variable password : String | XPathInjection.cs:14:13:14:13 | access to local variable s : String | provenance | |
+| XPathInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:12:16:12:23 | access to local variable password : String | provenance | |
| XPathInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:12:27:12:61 | access to indexer : String | provenance | |
-| XPathInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:17:33:17:33 | access to local variable s | provenance | |
-| XPathInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:20:29:20:29 | access to local variable s | provenance | |
-| XPathInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:29:20:29:20 | access to local variable s | provenance | |
-| XPathInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:35:30:35:30 | access to local variable s | provenance | |
-| XPathInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:41:21:41:21 | access to local variable s | provenance | |
-| XPathInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:47:22:47:22 | access to local variable s | provenance | |
-| XPathInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:53:21:53:21 | access to local variable s | provenance | |
-| XPathInjection.cs:12:27:12:61 | access to indexer : String | XPathInjection.cs:17:33:17:33 | access to local variable s | provenance | |
-| XPathInjection.cs:12:27:12:61 | access to indexer : String | XPathInjection.cs:20:29:20:29 | access to local variable s | provenance | |
-| XPathInjection.cs:12:27:12:61 | access to indexer : String | XPathInjection.cs:29:20:29:20 | access to local variable s | provenance | |
-| XPathInjection.cs:12:27:12:61 | access to indexer : String | XPathInjection.cs:35:30:35:30 | access to local variable s | provenance | |
-| XPathInjection.cs:12:27:12:61 | access to indexer : String | XPathInjection.cs:41:21:41:21 | access to local variable s | provenance | |
-| XPathInjection.cs:12:27:12:61 | access to indexer : String | XPathInjection.cs:47:22:47:22 | access to local variable s | provenance | |
-| XPathInjection.cs:12:27:12:61 | access to indexer : String | XPathInjection.cs:53:21:53:21 | access to local variable s | provenance | |
-| XPathInjection.cs:78:35:78:61 | call to method GetString : String | XPathInjection.cs:81:41:81:144 | ... + ... | provenance | |
-| XPathInjection.cs:78:35:78:61 | call to method GetString : String | XPathInjection.cs:84:37:84:140 | ... + ... | provenance | |
-| XPathInjection.cs:79:35:79:61 | call to method GetString : String | XPathInjection.cs:81:41:81:144 | ... + ... | provenance | |
-| XPathInjection.cs:79:35:79:61 | call to method GetString : String | XPathInjection.cs:84:37:84:140 | ... + ... | provenance | |
+| XPathInjection.cs:12:27:12:61 | access to indexer : String | XPathInjection.cs:12:16:12:23 | access to local variable password : String | provenance | |
+| XPathInjection.cs:14:13:14:13 | access to local variable s : String | XPathInjection.cs:17:33:17:33 | access to local variable s | provenance | |
+| XPathInjection.cs:14:13:14:13 | access to local variable s : String | XPathInjection.cs:20:29:20:29 | access to local variable s | provenance | |
+| XPathInjection.cs:14:13:14:13 | access to local variable s : String | XPathInjection.cs:29:20:29:20 | access to local variable s | provenance | |
+| XPathInjection.cs:14:13:14:13 | access to local variable s : String | XPathInjection.cs:35:30:35:30 | access to local variable s | provenance | |
+| XPathInjection.cs:14:13:14:13 | access to local variable s : String | XPathInjection.cs:41:21:41:21 | access to local variable s | provenance | |
+| XPathInjection.cs:14:13:14:13 | access to local variable s : String | XPathInjection.cs:47:22:47:22 | access to local variable s | provenance | |
+| XPathInjection.cs:14:13:14:13 | access to local variable s : String | XPathInjection.cs:53:21:53:21 | access to local variable s | provenance | |
+| XPathInjection.cs:78:24:78:31 | access to local variable userName : String | XPathInjection.cs:81:41:81:144 | ... + ... | provenance | |
+| XPathInjection.cs:78:24:78:31 | access to local variable userName : String | XPathInjection.cs:84:37:84:140 | ... + ... | provenance | |
+| XPathInjection.cs:78:35:78:61 | call to method GetString : String | XPathInjection.cs:78:24:78:31 | access to local variable userName : String | provenance | |
+| XPathInjection.cs:79:24:79:31 | access to local variable password : String | XPathInjection.cs:81:41:81:144 | ... + ... | provenance | |
+| XPathInjection.cs:79:24:79:31 | access to local variable password : String | XPathInjection.cs:84:37:84:140 | ... + ... | provenance | |
+| XPathInjection.cs:79:35:79:61 | call to method GetString : String | XPathInjection.cs:79:24:79:31 | access to local variable password : String | provenance | |
nodes
+| XPathInjection.cs:11:16:11:23 | access to local variable userName : String | semmle.label | access to local variable userName : String |
| XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
| XPathInjection.cs:11:27:11:61 | access to indexer : String | semmle.label | access to indexer : String |
+| XPathInjection.cs:12:16:12:23 | access to local variable password : String | semmle.label | access to local variable password : String |
| XPathInjection.cs:12:27:12:49 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
| XPathInjection.cs:12:27:12:61 | access to indexer : String | semmle.label | access to indexer : String |
+| XPathInjection.cs:14:13:14:13 | access to local variable s : String | semmle.label | access to local variable s : String |
| XPathInjection.cs:17:33:17:33 | access to local variable s | semmle.label | access to local variable s |
| XPathInjection.cs:20:29:20:29 | access to local variable s | semmle.label | access to local variable s |
| XPathInjection.cs:29:20:29:20 | access to local variable s | semmle.label | access to local variable s |
@@ -77,11 +35,12 @@ nodes
| XPathInjection.cs:41:21:41:21 | access to local variable s | semmle.label | access to local variable s |
| XPathInjection.cs:47:22:47:22 | access to local variable s | semmle.label | access to local variable s |
| XPathInjection.cs:53:21:53:21 | access to local variable s | semmle.label | access to local variable s |
+| XPathInjection.cs:78:24:78:31 | access to local variable userName : String | semmle.label | access to local variable userName : String |
| XPathInjection.cs:78:35:78:61 | call to method GetString : String | semmle.label | call to method GetString : String |
+| XPathInjection.cs:79:24:79:31 | access to local variable password : String | semmle.label | access to local variable password : String |
| XPathInjection.cs:79:35:79:61 | call to method GetString : String | semmle.label | call to method GetString : String |
| XPathInjection.cs:81:41:81:144 | ... + ... | semmle.label | ... + ... |
| XPathInjection.cs:84:37:84:140 | ... + ... | semmle.label | ... + ... |
->>>>>>> 4fc83a3267 (Modify test cases)
subpaths
#select
| XPathInjection.cs:17:33:17:33 | access to local variable s | XPathInjection.cs:11:27:11:49 | access to property QueryString : NameValueCollection | XPathInjection.cs:17:33:17:33 | access to local variable s | This XPath expression depends on a $@. | XPathInjection.cs:11:27:11:49 | access to property QueryString | user-provided value |
From 2b2ea597ce384aa1488de9c98ec7bb229ee0aa2c Mon Sep 17 00:00:00 2001
From: Angela P Wen
Date: Mon, 4 Mar 2024 16:42:38 +0000
Subject: [PATCH 054/731] Fix formatting on changenotes
---
ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md | 2 +-
ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md b/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
index 56d2dcf5c73c..6f3a90768bab 100644
--- a/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
+++ b/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
@@ -1,4 +1,4 @@
---
category: minorAnalysis
---
-Calls to `Arel::Nodes::SqlLiteral.new` are now modeled as instances of the `SqlConstruction` concept, as well as propagating taint from their argument.
\ No newline at end of file
+* Calls to `Arel::Nodes::SqlLiteral.new` are now modeled as instances of the `SqlConstruction` concept, as well as propagating taint from their argument.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md b/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
index f08bd54efa20..350e049b5bfc 100644
--- a/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
+++ b/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
@@ -1,4 +1,4 @@
---
category: minorAnalysis
---
-Calls to `I18n.translate` as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
\ No newline at end of file
+* Calls to `I18n.translate` as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
\ No newline at end of file
From a67218a0277be5516730cf3bdb0fb1932c14b2c1 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
Date: Mon, 4 Mar 2024 17:42:08 +0000
Subject: [PATCH 055/731] Release preparation for version 2.16.4
---
cpp/ql/lib/CHANGELOG.md | 6 ++++++
.../0.12.7.md} | 9 +++++----
cpp/ql/lib/codeql-pack.release.yml | 2 +-
cpp/ql/lib/qlpack.yml | 2 +-
cpp/ql/src/CHANGELOG.md | 7 +++++++
.../2024-02-29-non-constant-format-path-query.md | 4 ----
.../0.9.6.md} | 8 +++++---
cpp/ql/src/codeql-pack.release.yml | 2 +-
cpp/ql/src/qlpack.yml | 2 +-
csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md | 4 ++++
.../Solorigate/lib/change-notes/released/1.7.10.md | 3 +++
.../Solorigate/lib/codeql-pack.release.yml | 2 +-
csharp/ql/campaigns/Solorigate/lib/qlpack.yml | 2 +-
csharp/ql/campaigns/Solorigate/src/CHANGELOG.md | 4 ++++
.../Solorigate/src/change-notes/released/1.7.10.md | 3 +++
.../Solorigate/src/codeql-pack.release.yml | 2 +-
csharp/ql/campaigns/Solorigate/src/qlpack.yml | 2 +-
csharp/ql/lib/CHANGELOG.md | 14 ++++++++++++++
.../change-notes/2024-02-21-getonly-properties.md | 4 ----
.../ql/lib/change-notes/2024-02-22-no-db-stats.md | 4 ----
.../change-notes/2024-02-23-compiler-generated.md | 4 ----
.../2024-02-26-variable-capture-flow.md | 4 ----
.../2024-02-28-experimental-attribute.md | 4 ----
.../2024-02-28-refreadonly-parameter.md | 4 ----
csharp/ql/lib/change-notes/released/0.8.10.md | 13 +++++++++++++
csharp/ql/lib/codeql-pack.release.yml | 2 +-
csharp/ql/lib/qlpack.yml | 2 +-
csharp/ql/src/CHANGELOG.md | 6 ++++++
.../0.8.10.md} | 9 +++++----
csharp/ql/src/codeql-pack.release.yml | 2 +-
csharp/ql/src/qlpack.yml | 2 +-
go/ql/consistency-queries/CHANGELOG.md | 4 ++++
.../change-notes/released/0.0.9.md | 3 +++
go/ql/consistency-queries/codeql-pack.release.yml | 2 +-
go/ql/consistency-queries/qlpack.yml | 2 +-
go/ql/lib/CHANGELOG.md | 11 +++++++++++
.../lib/change-notes/2024-02-14-range-map-read.md | 4 ----
.../0.7.10.md} | 11 ++++++++---
go/ql/lib/codeql-pack.release.yml | 2 +-
go/ql/lib/qlpack.yml | 2 +-
go/ql/src/CHANGELOG.md | 4 ++++
go/ql/src/change-notes/released/0.7.10.md | 3 +++
go/ql/src/codeql-pack.release.yml | 2 +-
go/ql/src/qlpack.yml | 2 +-
java/ql/automodel/src/CHANGELOG.md | 4 ++++
.../automodel/src/change-notes/released/0.0.17.md | 3 +++
java/ql/automodel/src/codeql-pack.release.yml | 2 +-
java/ql/automodel/src/qlpack.yml | 2 +-
java/ql/lib/CHANGELOG.md | 11 +++++++++++
.../change-notes/2024-02-23-widget-flowsteps.md | 4 ----
java/ql/lib/change-notes/2024-02-27-error-types.md | 4 ----
.../lib/change-notes/2024-02-27-mvnw-versions.md | 4 ----
java/ql/lib/change-notes/released/0.8.10.md | 10 ++++++++++
java/ql/lib/codeql-pack.release.yml | 2 +-
java/ql/lib/qlpack.yml | 2 +-
java/ql/src/CHANGELOG.md | 10 ++++++++++
.../2024-02-12-android-insecure-keys.md | 4 ----
.../0.8.10.md} | 11 ++++++++---
java/ql/src/codeql-pack.release.yml | 2 +-
java/ql/src/qlpack.yml | 2 +-
javascript/ql/lib/CHANGELOG.md | 4 ++++
javascript/ql/lib/change-notes/released/0.8.10.md | 3 +++
javascript/ql/lib/codeql-pack.release.yml | 2 +-
javascript/ql/lib/qlpack.yml | 2 +-
javascript/ql/src/CHANGELOG.md | 4 ++++
javascript/ql/src/change-notes/released/0.8.10.md | 3 +++
javascript/ql/src/codeql-pack.release.yml | 2 +-
javascript/ql/src/qlpack.yml | 2 +-
misc/suite-helpers/CHANGELOG.md | 4 ++++
misc/suite-helpers/change-notes/released/0.7.10.md | 3 +++
misc/suite-helpers/codeql-pack.release.yml | 2 +-
misc/suite-helpers/qlpack.yml | 2 +-
python/ql/lib/CHANGELOG.md | 7 +++++++
.../2024-02-28-iterable-unpacking-module-scope.md | 4 ----
.../0.11.10.md} | 8 +++++---
python/ql/lib/codeql-pack.release.yml | 2 +-
python/ql/lib/qlpack.yml | 2 +-
python/ql/src/CHANGELOG.md | 6 ++++++
.../0.9.10.md} | 7 ++++---
python/ql/src/codeql-pack.release.yml | 2 +-
python/ql/src/qlpack.yml | 2 +-
ruby/ql/lib/CHANGELOG.md | 9 +++++++++
...2024-02-15-activerecord_connection_sql_sinks.md | 4 ----
.../2024-02-20-activerecord-sql-sink-arguments.md | 4 ----
.../lib/change-notes/2024-02-26-arel-sqlliteral.md | 4 ----
.../lib/change-notes/2024-02-29-i18n-translate.md | 4 ----
ruby/ql/lib/change-notes/released/0.8.10.md | 8 ++++++++
ruby/ql/lib/codeql-pack.release.yml | 2 +-
ruby/ql/lib/qlpack.yml | 2 +-
ruby/ql/src/CHANGELOG.md | 7 +++++++
.../2024-02-13-rails-more-request-sources.md | 4 ----
.../0.8.10.md} | 10 ++++++----
ruby/ql/src/codeql-pack.release.yml | 2 +-
ruby/ql/src/qlpack.yml | 2 +-
shared/controlflow/CHANGELOG.md | 4 ++++
shared/controlflow/change-notes/released/0.1.10.md | 3 +++
shared/controlflow/codeql-pack.release.yml | 2 +-
shared/controlflow/qlpack.yml | 2 +-
shared/dataflow/CHANGELOG.md | 4 ++++
shared/dataflow/change-notes/released/0.2.1.md | 3 +++
shared/dataflow/codeql-pack.release.yml | 2 +-
shared/dataflow/qlpack.yml | 2 +-
shared/mad/CHANGELOG.md | 4 ++++
shared/mad/change-notes/released/0.2.10.md | 3 +++
shared/mad/codeql-pack.release.yml | 2 +-
shared/mad/qlpack.yml | 2 +-
shared/rangeanalysis/CHANGELOG.md | 4 ++++
.../rangeanalysis/change-notes/released/0.0.9.md | 3 +++
shared/rangeanalysis/codeql-pack.release.yml | 2 +-
shared/rangeanalysis/qlpack.yml | 2 +-
shared/regex/CHANGELOG.md | 4 ++++
shared/regex/change-notes/released/0.2.10.md | 3 +++
shared/regex/codeql-pack.release.yml | 2 +-
shared/regex/qlpack.yml | 2 +-
shared/ssa/CHANGELOG.md | 4 ++++
shared/ssa/change-notes/released/0.2.10.md | 3 +++
shared/ssa/codeql-pack.release.yml | 2 +-
shared/ssa/qlpack.yml | 2 +-
shared/threat-models/CHANGELOG.md | 4 ++++
.../threat-models/change-notes/released/0.0.9.md | 3 +++
shared/threat-models/codeql-pack.release.yml | 2 +-
shared/threat-models/qlpack.yml | 2 +-
shared/tutorial/CHANGELOG.md | 4 ++++
shared/tutorial/change-notes/released/0.2.10.md | 3 +++
shared/tutorial/codeql-pack.release.yml | 2 +-
shared/tutorial/qlpack.yml | 2 +-
shared/typetracking/CHANGELOG.md | 4 ++++
.../typetracking/change-notes/released/0.2.10.md | 3 +++
shared/typetracking/codeql-pack.release.yml | 2 +-
shared/typetracking/qlpack.yml | 2 +-
shared/typos/CHANGELOG.md | 4 ++++
shared/typos/change-notes/released/0.2.10.md | 3 +++
shared/typos/codeql-pack.release.yml | 2 +-
shared/typos/qlpack.yml | 2 +-
shared/util/CHANGELOG.md | 4 ++++
shared/util/change-notes/released/0.2.10.md | 3 +++
shared/util/codeql-pack.release.yml | 2 +-
shared/util/qlpack.yml | 2 +-
shared/yaml/CHANGELOG.md | 4 ++++
shared/yaml/change-notes/released/0.2.10.md | 3 +++
shared/yaml/codeql-pack.release.yml | 2 +-
shared/yaml/qlpack.yml | 2 +-
swift/ql/lib/CHANGELOG.md | 6 ++++++
.../0.3.10.md} | 7 ++++---
swift/ql/lib/codeql-pack.release.yml | 2 +-
swift/ql/lib/qlpack.yml | 2 +-
swift/ql/src/CHANGELOG.md | 4 ++++
swift/ql/src/change-notes/released/0.3.10.md | 3 +++
swift/ql/src/codeql-pack.release.yml | 2 +-
swift/ql/src/qlpack.yml | 2 +-
150 files changed, 394 insertions(+), 168 deletions(-)
rename cpp/ql/lib/change-notes/{2024-02-26-ir-named-destructors.md => released/0.12.7.md} (54%)
delete mode 100644 cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md
rename cpp/ql/src/change-notes/{2024-02-16-modelled-functions-block-flow.md => released/0.9.6.md} (77%)
create mode 100644 csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md
create mode 100644 csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md
create mode 100644 csharp/ql/lib/change-notes/released/0.8.10.md
rename csharp/ql/src/change-notes/{2024-02-06-threat-models.md => released/0.8.10.md} (88%)
create mode 100644 go/ql/consistency-queries/change-notes/released/0.0.9.md
delete mode 100644 go/ql/lib/change-notes/2024-02-14-range-map-read.md
rename go/ql/lib/change-notes/{2024-03-04-autobuilder-changes.md => released/0.7.10.md} (68%)
create mode 100644 go/ql/src/change-notes/released/0.7.10.md
create mode 100644 java/ql/automodel/src/change-notes/released/0.0.17.md
delete mode 100644 java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md
delete mode 100644 java/ql/lib/change-notes/2024-02-27-error-types.md
delete mode 100644 java/ql/lib/change-notes/2024-02-27-mvnw-versions.md
create mode 100644 java/ql/lib/change-notes/released/0.8.10.md
delete mode 100644 java/ql/src/change-notes/2024-02-12-android-insecure-keys.md
rename java/ql/src/change-notes/{2024-03-04-sensitive-log-remove-null-from-sources.md => released/0.8.10.md} (54%)
create mode 100644 javascript/ql/lib/change-notes/released/0.8.10.md
create mode 100644 javascript/ql/src/change-notes/released/0.8.10.md
create mode 100644 misc/suite-helpers/change-notes/released/0.7.10.md
delete mode 100644 python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md
rename python/ql/lib/change-notes/{2024-03-01-dict-update-content.md => released/0.11.10.md} (52%)
rename python/ql/src/change-notes/{2024-03-04-nosql-injection.md => released/0.9.10.md} (81%)
delete mode 100644 ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md
delete mode 100644 ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md
delete mode 100644 ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
delete mode 100644 ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
create mode 100644 ruby/ql/lib/change-notes/released/0.8.10.md
delete mode 100644 ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md
rename ruby/ql/src/change-notes/{2024-03-01-method-code-injection-sinks.md => released/0.8.10.md} (51%)
create mode 100644 shared/controlflow/change-notes/released/0.1.10.md
create mode 100644 shared/dataflow/change-notes/released/0.2.1.md
create mode 100644 shared/mad/change-notes/released/0.2.10.md
create mode 100644 shared/rangeanalysis/change-notes/released/0.0.9.md
create mode 100644 shared/regex/change-notes/released/0.2.10.md
create mode 100644 shared/ssa/change-notes/released/0.2.10.md
create mode 100644 shared/threat-models/change-notes/released/0.0.9.md
create mode 100644 shared/tutorial/change-notes/released/0.2.10.md
create mode 100644 shared/typetracking/change-notes/released/0.2.10.md
create mode 100644 shared/typos/change-notes/released/0.2.10.md
create mode 100644 shared/util/change-notes/released/0.2.10.md
create mode 100644 shared/yaml/change-notes/released/0.2.10.md
rename swift/ql/lib/change-notes/{2024-02-22-extension-patch.md => released/0.3.10.md} (83%)
create mode 100644 swift/ql/src/change-notes/released/0.3.10.md
diff --git a/cpp/ql/lib/CHANGELOG.md b/cpp/ql/lib/CHANGELOG.md
index b3091ec37d8f..e1c0dfbecd9a 100644
--- a/cpp/ql/lib/CHANGELOG.md
+++ b/cpp/ql/lib/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 0.12.7
+
+### Minor Analysis Improvements
+
+* Added destructors for named objects to the intermediate representation.
+
## 0.12.6
### New Features
diff --git a/cpp/ql/lib/change-notes/2024-02-26-ir-named-destructors.md b/cpp/ql/lib/change-notes/released/0.12.7.md
similarity index 54%
rename from cpp/ql/lib/change-notes/2024-02-26-ir-named-destructors.md
rename to cpp/ql/lib/change-notes/released/0.12.7.md
index 4e35decaf8ed..856a8b665c74 100644
--- a/cpp/ql/lib/change-notes/2024-02-26-ir-named-destructors.md
+++ b/cpp/ql/lib/change-notes/released/0.12.7.md
@@ -1,4 +1,5 @@
----
-category: minorAnalysis
----
-* Added destructors for named objects to the intermediate representation.
\ No newline at end of file
+## 0.12.7
+
+### Minor Analysis Improvements
+
+* Added destructors for named objects to the intermediate representation.
diff --git a/cpp/ql/lib/codeql-pack.release.yml b/cpp/ql/lib/codeql-pack.release.yml
index 170a312c1047..20419e9c6100 100644
--- a/cpp/ql/lib/codeql-pack.release.yml
+++ b/cpp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.12.6
+lastReleaseVersion: 0.12.7
diff --git a/cpp/ql/lib/qlpack.yml b/cpp/ql/lib/qlpack.yml
index 8e201fff5943..3bb9229bf94d 100644
--- a/cpp/ql/lib/qlpack.yml
+++ b/cpp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-all
-version: 0.12.7-dev
+version: 0.12.7
groups: cpp
dbscheme: semmlecode.cpp.dbscheme
extractor: cpp
diff --git a/cpp/ql/src/CHANGELOG.md b/cpp/ql/src/CHANGELOG.md
index ffcd73ff5d72..f6acd424bb05 100644
--- a/cpp/ql/src/CHANGELOG.md
+++ b/cpp/ql/src/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 0.9.6
+
+### Minor Analysis Improvements
+
+* The "non-constant format string" query (`cpp/non-constant-format`) has been converted to a `path-problem` query.
+* The new C/C++ dataflow and taint-tracking libraries (`semmle.code.cpp.dataflow.new.DataFlow` and `semmle.code.cpp.dataflow.new.TaintTracking`) now implicitly assume that dataflow and taint modelled via `DataFlowFunction` and `TaintFunction` always fully overwrite their buffers and thus act as flow barriers. As a result, many dataflow and taint-tracking queries now produce fewer false positives. To remove this assumption and go back to the previous behavior for a given model, one can override the new `isPartialWrite` predicate.
+
## 0.9.5
### Minor Analysis Improvements
diff --git a/cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md b/cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md
deleted file mode 100644
index 2e5933a61e86..000000000000
--- a/cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The "non-constant format string" query (`cpp/non-constant-format`) has been converted to a `path-problem` query.
\ No newline at end of file
diff --git a/cpp/ql/src/change-notes/2024-02-16-modelled-functions-block-flow.md b/cpp/ql/src/change-notes/released/0.9.6.md
similarity index 77%
rename from cpp/ql/src/change-notes/2024-02-16-modelled-functions-block-flow.md
rename to cpp/ql/src/change-notes/released/0.9.6.md
index d6ef3c3e0569..0c85f3f9f0f0 100644
--- a/cpp/ql/src/change-notes/2024-02-16-modelled-functions-block-flow.md
+++ b/cpp/ql/src/change-notes/released/0.9.6.md
@@ -1,4 +1,6 @@
----
-category: minorAnalysis
----
+## 0.9.6
+
+### Minor Analysis Improvements
+
+* The "non-constant format string" query (`cpp/non-constant-format`) has been converted to a `path-problem` query.
* The new C/C++ dataflow and taint-tracking libraries (`semmle.code.cpp.dataflow.new.DataFlow` and `semmle.code.cpp.dataflow.new.TaintTracking`) now implicitly assume that dataflow and taint modelled via `DataFlowFunction` and `TaintFunction` always fully overwrite their buffers and thus act as flow barriers. As a result, many dataflow and taint-tracking queries now produce fewer false positives. To remove this assumption and go back to the previous behavior for a given model, one can override the new `isPartialWrite` predicate.
diff --git a/cpp/ql/src/codeql-pack.release.yml b/cpp/ql/src/codeql-pack.release.yml
index 460240feafff..19139c132b2d 100644
--- a/cpp/ql/src/codeql-pack.release.yml
+++ b/cpp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.9.5
+lastReleaseVersion: 0.9.6
diff --git a/cpp/ql/src/qlpack.yml b/cpp/ql/src/qlpack.yml
index 31bd20166b2b..4052647bb97f 100644
--- a/cpp/ql/src/qlpack.yml
+++ b/cpp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-queries
-version: 0.9.6-dev
+version: 0.9.6
groups:
- cpp
- queries
diff --git a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
index 190b83b0f25a..82eacfc84f70 100644
--- a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
+++ b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.7.10
+
+No user-facing changes.
+
## 1.7.9
No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md
new file mode 100644
index 000000000000..8e8007d8475f
--- /dev/null
+++ b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md
@@ -0,0 +1,3 @@
+## 1.7.10
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
index 678da6bc37e9..31c7fe07020b 100644
--- a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.7.9
+lastReleaseVersion: 1.7.10
diff --git a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
index 7e643b0fac33..ee993bed0c91 100644
--- a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-all
-version: 1.7.10-dev
+version: 1.7.10
groups:
- csharp
- solorigate
diff --git a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
index 190b83b0f25a..82eacfc84f70 100644
--- a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
+++ b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.7.10
+
+No user-facing changes.
+
## 1.7.9
No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md
new file mode 100644
index 000000000000..8e8007d8475f
--- /dev/null
+++ b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md
@@ -0,0 +1,3 @@
+## 1.7.10
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
index 678da6bc37e9..31c7fe07020b 100644
--- a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
+++ b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.7.9
+lastReleaseVersion: 1.7.10
diff --git a/csharp/ql/campaigns/Solorigate/src/qlpack.yml b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
index 8654bbfd0312..1f421754fc82 100644
--- a/csharp/ql/campaigns/Solorigate/src/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-queries
-version: 1.7.10-dev
+version: 1.7.10
groups:
- csharp
- solorigate
diff --git a/csharp/ql/lib/CHANGELOG.md b/csharp/ql/lib/CHANGELOG.md
index 95fd64c52704..16cc14259e19 100644
--- a/csharp/ql/lib/CHANGELOG.md
+++ b/csharp/ql/lib/CHANGELOG.md
@@ -1,3 +1,17 @@
+## 0.8.10
+
+### Major Analysis Improvements
+
+* Improved support for flow through captured variables that properly adheres to inter-procedural control flow.
+* We no longer make use of CodeQL database stats, which may affect join-orders in custom queries. It is therefore recommended to test performance of custom queries after upgrading to this version.
+
+### Minor Analysis Improvements
+
+* C# 12: Add QL library support (`ExperimentalAttribute`) for the experimental attribute.
+* C# 12: Add extractor and QL library support for `ref readonly` parameters.
+* C#: The table `expr_compiler_generated` has been deleted and its content has been added to `compiler_generated`.
+* Data flow via get only properties like `public object Obj { get; }` is now captured by the data flow library.
+
## 0.8.9
### Minor Analysis Improvements
diff --git a/csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md b/csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md
deleted file mode 100644
index 6bb8e99c71ef..000000000000
--- a/csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Data flow via get only properties like `public object Obj { get; }` is now captured by the data flow library.
diff --git a/csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md b/csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md
deleted file mode 100644
index d6ffbd523ac6..000000000000
--- a/csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: majorAnalysis
----
-* We no longer make use of CodeQL database stats, which may affect join-orders in custom queries. It is therefore recommended to test performance of custom queries after upgrading to this version.
diff --git a/csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md b/csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md
deleted file mode 100644
index 9b1739b9b6da..000000000000
--- a/csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* C#: The table `expr_compiler_generated` has been deleted and its content has been added to `compiler_generated`.
diff --git a/csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md b/csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md
deleted file mode 100644
index 66ab65083dc3..000000000000
--- a/csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: majorAnalysis
----
-* Improved support for flow through captured variables that properly adheres to inter-procedural control flow.
\ No newline at end of file
diff --git a/csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md b/csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md
deleted file mode 100644
index 8749c790954e..000000000000
--- a/csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* C# 12: Add QL library support (`ExperimentalAttribute`) for the experimental attribute.
diff --git a/csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md b/csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md
deleted file mode 100644
index 586b5341d293..000000000000
--- a/csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* C# 12: Add extractor and QL library support for `ref readonly` parameters.
diff --git a/csharp/ql/lib/change-notes/released/0.8.10.md b/csharp/ql/lib/change-notes/released/0.8.10.md
new file mode 100644
index 000000000000..f591ddc5b21a
--- /dev/null
+++ b/csharp/ql/lib/change-notes/released/0.8.10.md
@@ -0,0 +1,13 @@
+## 0.8.10
+
+### Major Analysis Improvements
+
+* Improved support for flow through captured variables that properly adheres to inter-procedural control flow.
+* We no longer make use of CodeQL database stats, which may affect join-orders in custom queries. It is therefore recommended to test performance of custom queries after upgrading to this version.
+
+### Minor Analysis Improvements
+
+* C# 12: Add QL library support (`ExperimentalAttribute`) for the experimental attribute.
+* C# 12: Add extractor and QL library support for `ref readonly` parameters.
+* C#: The table `expr_compiler_generated` has been deleted and its content has been added to `compiler_generated`.
+* Data flow via get only properties like `public object Obj { get; }` is now captured by the data flow library.
diff --git a/csharp/ql/lib/codeql-pack.release.yml b/csharp/ql/lib/codeql-pack.release.yml
index 5290c29b7fe7..0521f0f75fad 100644
--- a/csharp/ql/lib/codeql-pack.release.yml
+++ b/csharp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/csharp/ql/lib/qlpack.yml b/csharp/ql/lib/qlpack.yml
index d75ea3c63207..93c5c1120a24 100644
--- a/csharp/ql/lib/qlpack.yml
+++ b/csharp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-all
-version: 0.8.10-dev
+version: 0.8.10
groups: csharp
dbscheme: semmlecode.csharp.dbscheme
extractor: csharp
diff --git a/csharp/ql/src/CHANGELOG.md b/csharp/ql/src/CHANGELOG.md
index 9fe1609363fc..46c939e5cee1 100644
--- a/csharp/ql/src/CHANGELOG.md
+++ b/csharp/ql/src/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. The changed queries are `cs/code-injection`, `cs/command-line-injection`, `cs/user-controlled-bypass`, `cs/count-untrusted-data-external-api`, `cs/untrusted-data-to-external-api`, `cs/ldap-injection`, `cs/log-forging`, `cs/xml/missing-validation`, `cs/redos`, `cs/regex-injection`, `cs/resource-injection`, `cs/sql-injection`, `cs/path-injection`, `cs/unsafe-deserialization-untrusted-input`, `cs/web/unvalidated-url-redirection`, `cs/xml/insecure-dtd-handling`, `cs/xml/xpath-injection`, `cs/web/xss`, and `cs/uncontrolled-format-string`.
+
## 0.8.9
### Minor Analysis Improvements
diff --git a/csharp/ql/src/change-notes/2024-02-06-threat-models.md b/csharp/ql/src/change-notes/released/0.8.10.md
similarity index 88%
rename from csharp/ql/src/change-notes/2024-02-06-threat-models.md
rename to csharp/ql/src/change-notes/released/0.8.10.md
index 69ac4e4dc17a..702161c3d28f 100644
--- a/csharp/ql/src/change-notes/2024-02-06-threat-models.md
+++ b/csharp/ql/src/change-notes/released/0.8.10.md
@@ -1,4 +1,5 @@
----
-category: minorAnalysis
----
-* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. The changed queries are `cs/code-injection`, `cs/command-line-injection`, `cs/user-controlled-bypass`, `cs/count-untrusted-data-external-api`, `cs/untrusted-data-to-external-api`, `cs/ldap-injection`, `cs/log-forging`, `cs/xml/missing-validation`, `cs/redos`, `cs/regex-injection`, `cs/resource-injection`, `cs/sql-injection`, `cs/path-injection`, `cs/unsafe-deserialization-untrusted-input`, `cs/web/unvalidated-url-redirection`, `cs/xml/insecure-dtd-handling`, `cs/xml/xpath-injection`, `cs/web/xss`, and `cs/uncontrolled-format-string`.
\ No newline at end of file
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. The changed queries are `cs/code-injection`, `cs/command-line-injection`, `cs/user-controlled-bypass`, `cs/count-untrusted-data-external-api`, `cs/untrusted-data-to-external-api`, `cs/ldap-injection`, `cs/log-forging`, `cs/xml/missing-validation`, `cs/redos`, `cs/regex-injection`, `cs/resource-injection`, `cs/sql-injection`, `cs/path-injection`, `cs/unsafe-deserialization-untrusted-input`, `cs/web/unvalidated-url-redirection`, `cs/xml/insecure-dtd-handling`, `cs/xml/xpath-injection`, `cs/web/xss`, and `cs/uncontrolled-format-string`.
diff --git a/csharp/ql/src/codeql-pack.release.yml b/csharp/ql/src/codeql-pack.release.yml
index 5290c29b7fe7..0521f0f75fad 100644
--- a/csharp/ql/src/codeql-pack.release.yml
+++ b/csharp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/csharp/ql/src/qlpack.yml b/csharp/ql/src/qlpack.yml
index 9ee23cc73078..46384094b19e 100644
--- a/csharp/ql/src/qlpack.yml
+++ b/csharp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-queries
-version: 0.8.10-dev
+version: 0.8.10
groups:
- csharp
- queries
diff --git a/go/ql/consistency-queries/CHANGELOG.md b/go/ql/consistency-queries/CHANGELOG.md
index fba2a8703562..a59e560c4155 100644
--- a/go/ql/consistency-queries/CHANGELOG.md
+++ b/go/ql/consistency-queries/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.0.9
+
+No user-facing changes.
+
## 0.0.8
No user-facing changes.
diff --git a/go/ql/consistency-queries/change-notes/released/0.0.9.md b/go/ql/consistency-queries/change-notes/released/0.0.9.md
new file mode 100644
index 000000000000..c9e17c6d6cf2
--- /dev/null
+++ b/go/ql/consistency-queries/change-notes/released/0.0.9.md
@@ -0,0 +1,3 @@
+## 0.0.9
+
+No user-facing changes.
diff --git a/go/ql/consistency-queries/codeql-pack.release.yml b/go/ql/consistency-queries/codeql-pack.release.yml
index 58fdc6b45deb..ecdd64fbab86 100644
--- a/go/ql/consistency-queries/codeql-pack.release.yml
+++ b/go/ql/consistency-queries/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.8
+lastReleaseVersion: 0.0.9
diff --git a/go/ql/consistency-queries/qlpack.yml b/go/ql/consistency-queries/qlpack.yml
index b574796b9954..d5a2fbee5f19 100644
--- a/go/ql/consistency-queries/qlpack.yml
+++ b/go/ql/consistency-queries/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql-go-consistency-queries
-version: 0.0.9-dev
+version: 0.0.9
groups:
- go
- queries
diff --git a/go/ql/lib/CHANGELOG.md b/go/ql/lib/CHANGELOG.md
index 65a2376217b1..fee5fd37a267 100644
--- a/go/ql/lib/CHANGELOG.md
+++ b/go/ql/lib/CHANGELOG.md
@@ -1,3 +1,14 @@
+## 0.7.10
+
+### Major Analysis Improvements
+
+* We have significantly improved the Go autobuilder to understand a greater range of project layouts, which allows Go source files to be analysed that could previously not be processed.
+* Go 1.22 has been included in the range of supported Go versions.
+
+### Bug Fixes
+
+* Fixed dataflow out of a `map` using a `range` statement.
+
## 0.7.9
No user-facing changes.
diff --git a/go/ql/lib/change-notes/2024-02-14-range-map-read.md b/go/ql/lib/change-notes/2024-02-14-range-map-read.md
deleted file mode 100644
index ea45737a72ea..000000000000
--- a/go/ql/lib/change-notes/2024-02-14-range-map-read.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: fix
----
-* Fixed dataflow out of a `map` using a `range` statement.
diff --git a/go/ql/lib/change-notes/2024-03-04-autobuilder-changes.md b/go/ql/lib/change-notes/released/0.7.10.md
similarity index 68%
rename from go/ql/lib/change-notes/2024-03-04-autobuilder-changes.md
rename to go/ql/lib/change-notes/released/0.7.10.md
index 0442a571029f..55954f8a3945 100644
--- a/go/ql/lib/change-notes/2024-03-04-autobuilder-changes.md
+++ b/go/ql/lib/change-notes/released/0.7.10.md
@@ -1,5 +1,10 @@
----
-category: majorAnalysis
----
+## 0.7.10
+
+### Major Analysis Improvements
+
* We have significantly improved the Go autobuilder to understand a greater range of project layouts, which allows Go source files to be analysed that could previously not be processed.
* Go 1.22 has been included in the range of supported Go versions.
+
+### Bug Fixes
+
+* Fixed dataflow out of a `map` using a `range` statement.
diff --git a/go/ql/lib/codeql-pack.release.yml b/go/ql/lib/codeql-pack.release.yml
index 576395f3405e..675185672974 100644
--- a/go/ql/lib/codeql-pack.release.yml
+++ b/go/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.7.9
+lastReleaseVersion: 0.7.10
diff --git a/go/ql/lib/qlpack.yml b/go/ql/lib/qlpack.yml
index f21e478efa68..8cc190fa880a 100644
--- a/go/ql/lib/qlpack.yml
+++ b/go/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-all
-version: 0.7.10-dev
+version: 0.7.10
groups: go
dbscheme: go.dbscheme
extractor: go
diff --git a/go/ql/src/CHANGELOG.md b/go/ql/src/CHANGELOG.md
index d95165a3a34e..24e38b9890e1 100644
--- a/go/ql/src/CHANGELOG.md
+++ b/go/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.7.10
+
+No user-facing changes.
+
## 0.7.9
### New Queries
diff --git a/go/ql/src/change-notes/released/0.7.10.md b/go/ql/src/change-notes/released/0.7.10.md
new file mode 100644
index 000000000000..989c5b8f6823
--- /dev/null
+++ b/go/ql/src/change-notes/released/0.7.10.md
@@ -0,0 +1,3 @@
+## 0.7.10
+
+No user-facing changes.
diff --git a/go/ql/src/codeql-pack.release.yml b/go/ql/src/codeql-pack.release.yml
index 576395f3405e..675185672974 100644
--- a/go/ql/src/codeql-pack.release.yml
+++ b/go/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.7.9
+lastReleaseVersion: 0.7.10
diff --git a/go/ql/src/qlpack.yml b/go/ql/src/qlpack.yml
index d91cab596127..4ded3a52f63e 100644
--- a/go/ql/src/qlpack.yml
+++ b/go/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-queries
-version: 0.7.10-dev
+version: 0.7.10
groups:
- go
- queries
diff --git a/java/ql/automodel/src/CHANGELOG.md b/java/ql/automodel/src/CHANGELOG.md
index 4a3c54adb385..c3282c773a9d 100644
--- a/java/ql/automodel/src/CHANGELOG.md
+++ b/java/ql/automodel/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.0.17
+
+No user-facing changes.
+
## 0.0.16
No user-facing changes.
diff --git a/java/ql/automodel/src/change-notes/released/0.0.17.md b/java/ql/automodel/src/change-notes/released/0.0.17.md
new file mode 100644
index 000000000000..62cc89030a62
--- /dev/null
+++ b/java/ql/automodel/src/change-notes/released/0.0.17.md
@@ -0,0 +1,3 @@
+## 0.0.17
+
+No user-facing changes.
diff --git a/java/ql/automodel/src/codeql-pack.release.yml b/java/ql/automodel/src/codeql-pack.release.yml
index a49f7be4cff3..cbc3d3cd4934 100644
--- a/java/ql/automodel/src/codeql-pack.release.yml
+++ b/java/ql/automodel/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.16
+lastReleaseVersion: 0.0.17
diff --git a/java/ql/automodel/src/qlpack.yml b/java/ql/automodel/src/qlpack.yml
index 898239be0989..59fab0cdcc53 100644
--- a/java/ql/automodel/src/qlpack.yml
+++ b/java/ql/automodel/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-automodel-queries
-version: 0.0.17-dev
+version: 0.0.17
groups:
- java
- automodel
diff --git a/java/ql/lib/CHANGELOG.md b/java/ql/lib/CHANGELOG.md
index d369cbdc9318..2a02ccee6abb 100644
--- a/java/ql/lib/CHANGELOG.md
+++ b/java/ql/lib/CHANGELOG.md
@@ -1,3 +1,14 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Java expressions with erroneous types (e.g. the result of a call whose callee couldn't be resolved during extraction) are now given a CodeQL `ErrorType` more often.
+
+### Bug Fixes
+
+* Fixed the Java autobuilder overriding the version of Maven used by a project when the Maven wrapper `mvnw` is in use and the `maven-wrapper.jar` file is not present in the repository.
+* Some flow steps related to `android.text.Editable.toString` that were accidentally disabled have been re-enabled.
+
## 0.8.9
### Deprecated APIs
diff --git a/java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md b/java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md
deleted file mode 100644
index eb560fba07da..000000000000
--- a/java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: fix
----
-* Some flow steps related to `android.text.Editable.toString` that were accidentally disabled have been re-enabled.
diff --git a/java/ql/lib/change-notes/2024-02-27-error-types.md b/java/ql/lib/change-notes/2024-02-27-error-types.md
deleted file mode 100644
index cdc6d7620aa8..000000000000
--- a/java/ql/lib/change-notes/2024-02-27-error-types.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Java expressions with erroneous types (e.g. the result of a call whose callee couldn't be resolved during extraction) are now given a CodeQL `ErrorType` more often.
diff --git a/java/ql/lib/change-notes/2024-02-27-mvnw-versions.md b/java/ql/lib/change-notes/2024-02-27-mvnw-versions.md
deleted file mode 100644
index a0227088ae97..000000000000
--- a/java/ql/lib/change-notes/2024-02-27-mvnw-versions.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: fix
----
-* Fixed the Java autobuilder overriding the version of Maven used by a project when the Maven wrapper `mvnw` is in use and the `maven-wrapper.jar` file is not present in the repository.
diff --git a/java/ql/lib/change-notes/released/0.8.10.md b/java/ql/lib/change-notes/released/0.8.10.md
new file mode 100644
index 000000000000..b45f14bf347a
--- /dev/null
+++ b/java/ql/lib/change-notes/released/0.8.10.md
@@ -0,0 +1,10 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Java expressions with erroneous types (e.g. the result of a call whose callee couldn't be resolved during extraction) are now given a CodeQL `ErrorType` more often.
+
+### Bug Fixes
+
+* Fixed the Java autobuilder overriding the version of Maven used by a project when the Maven wrapper `mvnw` is in use and the `maven-wrapper.jar` file is not present in the repository.
+* Some flow steps related to `android.text.Editable.toString` that were accidentally disabled have been re-enabled.
diff --git a/java/ql/lib/codeql-pack.release.yml b/java/ql/lib/codeql-pack.release.yml
index 5290c29b7fe7..0521f0f75fad 100644
--- a/java/ql/lib/codeql-pack.release.yml
+++ b/java/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/java/ql/lib/qlpack.yml b/java/ql/lib/qlpack.yml
index 15b4982d41eb..428eedc75e3d 100644
--- a/java/ql/lib/qlpack.yml
+++ b/java/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-all
-version: 0.8.10-dev
+version: 0.8.10
groups: java
dbscheme: config/semmlecode.dbscheme
extractor: java
diff --git a/java/ql/src/CHANGELOG.md b/java/ql/src/CHANGELOG.md
index 5d8353514538..c61275f5ed84 100644
--- a/java/ql/src/CHANGELOG.md
+++ b/java/ql/src/CHANGELOG.md
@@ -1,3 +1,13 @@
+## 0.8.10
+
+### New Queries
+
+* Added a new query `java/android/insecure-local-key-gen` for finding instances of keys generated for biometric authentication in an insecure way.
+
+### Minor Analysis Improvements
+
+* To reduce the number of false positives in the query "Insertion of sensitive information into log files" (`java/sensitive-log`), variables with names that contain "null" (case-insensitively) are no longer considered sources of sensitive information.
+
## 0.8.9
### New Queries
diff --git a/java/ql/src/change-notes/2024-02-12-android-insecure-keys.md b/java/ql/src/change-notes/2024-02-12-android-insecure-keys.md
deleted file mode 100644
index 1de077277962..000000000000
--- a/java/ql/src/change-notes/2024-02-12-android-insecure-keys.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: newQuery
----
-* Added a new query `java/android/insecure-local-key-gen` for finding instances of keys generated for biometric authentication in an insecure way.
\ No newline at end of file
diff --git a/java/ql/src/change-notes/2024-03-04-sensitive-log-remove-null-from-sources.md b/java/ql/src/change-notes/released/0.8.10.md
similarity index 54%
rename from java/ql/src/change-notes/2024-03-04-sensitive-log-remove-null-from-sources.md
rename to java/ql/src/change-notes/released/0.8.10.md
index 0bb4f18f2bd9..c5d18ae33794 100644
--- a/java/ql/src/change-notes/2024-03-04-sensitive-log-remove-null-from-sources.md
+++ b/java/ql/src/change-notes/released/0.8.10.md
@@ -1,4 +1,9 @@
----
-category: minorAnalysis
----
+## 0.8.10
+
+### New Queries
+
+* Added a new query `java/android/insecure-local-key-gen` for finding instances of keys generated for biometric authentication in an insecure way.
+
+### Minor Analysis Improvements
+
* To reduce the number of false positives in the query "Insertion of sensitive information into log files" (`java/sensitive-log`), variables with names that contain "null" (case-insensitively) are no longer considered sources of sensitive information.
diff --git a/java/ql/src/codeql-pack.release.yml b/java/ql/src/codeql-pack.release.yml
index 5290c29b7fe7..0521f0f75fad 100644
--- a/java/ql/src/codeql-pack.release.yml
+++ b/java/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/java/ql/src/qlpack.yml b/java/ql/src/qlpack.yml
index 8f4de528e213..ebbdbeee3b2c 100644
--- a/java/ql/src/qlpack.yml
+++ b/java/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-queries
-version: 0.8.10-dev
+version: 0.8.10
groups:
- java
- queries
diff --git a/javascript/ql/lib/CHANGELOG.md b/javascript/ql/lib/CHANGELOG.md
index 5b97ebbb22b3..d5edcc005131 100644
--- a/javascript/ql/lib/CHANGELOG.md
+++ b/javascript/ql/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.8.10
+
+No user-facing changes.
+
## 0.8.9
### Minor Analysis Improvements
diff --git a/javascript/ql/lib/change-notes/released/0.8.10.md b/javascript/ql/lib/change-notes/released/0.8.10.md
new file mode 100644
index 000000000000..777bbd2fdede
--- /dev/null
+++ b/javascript/ql/lib/change-notes/released/0.8.10.md
@@ -0,0 +1,3 @@
+## 0.8.10
+
+No user-facing changes.
diff --git a/javascript/ql/lib/codeql-pack.release.yml b/javascript/ql/lib/codeql-pack.release.yml
index 5290c29b7fe7..0521f0f75fad 100644
--- a/javascript/ql/lib/codeql-pack.release.yml
+++ b/javascript/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/javascript/ql/lib/qlpack.yml b/javascript/ql/lib/qlpack.yml
index ef3ca7521aca..da16493a21c9 100644
--- a/javascript/ql/lib/qlpack.yml
+++ b/javascript/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-all
-version: 0.8.10-dev
+version: 0.8.10
groups: javascript
dbscheme: semmlecode.javascript.dbscheme
extractor: javascript
diff --git a/javascript/ql/src/CHANGELOG.md b/javascript/ql/src/CHANGELOG.md
index 85516e3625d1..b9627cac5eee 100644
--- a/javascript/ql/src/CHANGELOG.md
+++ b/javascript/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.8.10
+
+No user-facing changes.
+
## 0.8.9
### Bug Fixes
diff --git a/javascript/ql/src/change-notes/released/0.8.10.md b/javascript/ql/src/change-notes/released/0.8.10.md
new file mode 100644
index 000000000000..777bbd2fdede
--- /dev/null
+++ b/javascript/ql/src/change-notes/released/0.8.10.md
@@ -0,0 +1,3 @@
+## 0.8.10
+
+No user-facing changes.
diff --git a/javascript/ql/src/codeql-pack.release.yml b/javascript/ql/src/codeql-pack.release.yml
index 5290c29b7fe7..0521f0f75fad 100644
--- a/javascript/ql/src/codeql-pack.release.yml
+++ b/javascript/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/javascript/ql/src/qlpack.yml b/javascript/ql/src/qlpack.yml
index b6181aa30e99..d224952c5641 100644
--- a/javascript/ql/src/qlpack.yml
+++ b/javascript/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-queries
-version: 0.8.10-dev
+version: 0.8.10
groups:
- javascript
- queries
diff --git a/misc/suite-helpers/CHANGELOG.md b/misc/suite-helpers/CHANGELOG.md
index 3c06dd69b0f5..1c4455b66c43 100644
--- a/misc/suite-helpers/CHANGELOG.md
+++ b/misc/suite-helpers/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.7.10
+
+No user-facing changes.
+
## 0.7.9
No user-facing changes.
diff --git a/misc/suite-helpers/change-notes/released/0.7.10.md b/misc/suite-helpers/change-notes/released/0.7.10.md
new file mode 100644
index 000000000000..989c5b8f6823
--- /dev/null
+++ b/misc/suite-helpers/change-notes/released/0.7.10.md
@@ -0,0 +1,3 @@
+## 0.7.10
+
+No user-facing changes.
diff --git a/misc/suite-helpers/codeql-pack.release.yml b/misc/suite-helpers/codeql-pack.release.yml
index 576395f3405e..675185672974 100644
--- a/misc/suite-helpers/codeql-pack.release.yml
+++ b/misc/suite-helpers/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.7.9
+lastReleaseVersion: 0.7.10
diff --git a/misc/suite-helpers/qlpack.yml b/misc/suite-helpers/qlpack.yml
index 49b7a6bda4c2..54d978d5efe7 100644
--- a/misc/suite-helpers/qlpack.yml
+++ b/misc/suite-helpers/qlpack.yml
@@ -1,4 +1,4 @@
name: codeql/suite-helpers
-version: 0.7.10-dev
+version: 0.7.10
groups: shared
warnOnImplicitThis: true
diff --git a/python/ql/lib/CHANGELOG.md b/python/ql/lib/CHANGELOG.md
index e6f318c51ea8..f095607ca1bf 100644
--- a/python/ql/lib/CHANGELOG.md
+++ b/python/ql/lib/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 0.11.10
+
+### Minor Analysis Improvements
+
+* Fixed missing flow for dictionary updates (`d[] = ...`) when `` is a string constant not used in dictionary literals or as name of keyword-argument.
+* Fixed flow for iterable unpacking (`a,b = my_tuple`) when it occurs on top-level (module) scope.
+
## 0.11.9
### Minor Analysis Improvements
diff --git a/python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md b/python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md
deleted file mode 100644
index 3c47c6ba866a..000000000000
--- a/python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Fixed flow for iterable unpacking (`a,b = my_tuple`) when it occurs on top-level (module) scope.
diff --git a/python/ql/lib/change-notes/2024-03-01-dict-update-content.md b/python/ql/lib/change-notes/released/0.11.10.md
similarity index 52%
rename from python/ql/lib/change-notes/2024-03-01-dict-update-content.md
rename to python/ql/lib/change-notes/released/0.11.10.md
index dfb8d247fffa..ed873724e4f2 100644
--- a/python/ql/lib/change-notes/2024-03-01-dict-update-content.md
+++ b/python/ql/lib/change-notes/released/0.11.10.md
@@ -1,4 +1,6 @@
----
-category: minorAnalysis
----
+## 0.11.10
+
+### Minor Analysis Improvements
+
* Fixed missing flow for dictionary updates (`d[] = ...`) when `` is a string constant not used in dictionary literals or as name of keyword-argument.
+* Fixed flow for iterable unpacking (`a,b = my_tuple`) when it occurs on top-level (module) scope.
diff --git a/python/ql/lib/codeql-pack.release.yml b/python/ql/lib/codeql-pack.release.yml
index b064d1778a10..ddddcbe9193d 100644
--- a/python/ql/lib/codeql-pack.release.yml
+++ b/python/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.11.9
+lastReleaseVersion: 0.11.10
diff --git a/python/ql/lib/qlpack.yml b/python/ql/lib/qlpack.yml
index e9f66e205f24..59a8b4c96d17 100644
--- a/python/ql/lib/qlpack.yml
+++ b/python/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-all
-version: 0.11.10-dev
+version: 0.11.10
groups: python
dbscheme: semmlecode.python.dbscheme
extractor: python
diff --git a/python/ql/src/CHANGELOG.md b/python/ql/src/CHANGELOG.md
index 50762bcbf34e..d4245aba7a62 100644
--- a/python/ql/src/CHANGELOG.md
+++ b/python/ql/src/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 0.9.10
+
+### New Queries
+
+* The query `py/nosql-injection` for finding NoSQL injection vulnerabilities is now part of the default security suite.
+
## 0.9.9
No user-facing changes.
diff --git a/python/ql/src/change-notes/2024-03-04-nosql-injection.md b/python/ql/src/change-notes/released/0.9.10.md
similarity index 81%
rename from python/ql/src/change-notes/2024-03-04-nosql-injection.md
rename to python/ql/src/change-notes/released/0.9.10.md
index 6e98540c757c..4cbb221b789f 100644
--- a/python/ql/src/change-notes/2024-03-04-nosql-injection.md
+++ b/python/ql/src/change-notes/released/0.9.10.md
@@ -1,4 +1,5 @@
----
-category: newQuery
----
+## 0.9.10
+
+### New Queries
+
* The query `py/nosql-injection` for finding NoSQL injection vulnerabilities is now part of the default security suite.
diff --git a/python/ql/src/codeql-pack.release.yml b/python/ql/src/codeql-pack.release.yml
index aabed7c396b7..d086ed69541d 100644
--- a/python/ql/src/codeql-pack.release.yml
+++ b/python/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.9.9
+lastReleaseVersion: 0.9.10
diff --git a/python/ql/src/qlpack.yml b/python/ql/src/qlpack.yml
index aa18f2d87074..c920f667836b 100644
--- a/python/ql/src/qlpack.yml
+++ b/python/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-queries
-version: 0.9.10-dev
+version: 0.9.10
groups:
- python
- queries
diff --git a/ruby/ql/lib/CHANGELOG.md b/ruby/ql/lib/CHANGELOG.md
index a623a151e891..c61a12e0f4ad 100644
--- a/ruby/ql/lib/CHANGELOG.md
+++ b/ruby/ql/lib/CHANGELOG.md
@@ -1,3 +1,12 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Calls to `I18n.translate` as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
+* Calls to `Arel::Nodes::SqlLiteral.new` are now modeled as instances of the `SqlConstruction` concept, as well as propagating taint from their argument.
+* Additional arguments beyond the first of calls to the `ActiveRecord` methods `select`, `reselect`, `order`, `reorder`, `joins`, `group`, and `pluck` are now recognized as sql injection sinks.
+* Calls to several methods of `ActiveRecord::Connection`, such as `ActiveRecord::Connection#exec_query`, are now recognized as SQL executions, including those via subclasses.
+
## 0.8.9
### Minor Analysis Improvements
diff --git a/ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md b/ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md
deleted file mode 100644
index c2276f284a84..000000000000
--- a/ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Calls to several methods of `ActiveRecord::Connection`, such as `ActiveRecord::Connection#exec_query`, are now recognized as SQL executions, including those via subclasses.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md b/ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md
deleted file mode 100644
index 1486c7a472d1..000000000000
--- a/ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Additional arguments beyond the first of calls to the `ActiveRecord` methods `select`, `reselect`, `order`, `reorder`, `joins`, `group`, and `pluck` are now recognized as sql injection sinks.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md b/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
deleted file mode 100644
index 6f3a90768bab..000000000000
--- a/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Calls to `Arel::Nodes::SqlLiteral.new` are now modeled as instances of the `SqlConstruction` concept, as well as propagating taint from their argument.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md b/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
deleted file mode 100644
index 350e049b5bfc..000000000000
--- a/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Calls to `I18n.translate` as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/released/0.8.10.md b/ruby/ql/lib/change-notes/released/0.8.10.md
new file mode 100644
index 000000000000..666e28f840e7
--- /dev/null
+++ b/ruby/ql/lib/change-notes/released/0.8.10.md
@@ -0,0 +1,8 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Calls to `I18n.translate` as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
+* Calls to `Arel::Nodes::SqlLiteral.new` are now modeled as instances of the `SqlConstruction` concept, as well as propagating taint from their argument.
+* Additional arguments beyond the first of calls to the `ActiveRecord` methods `select`, `reselect`, `order`, `reorder`, `joins`, `group`, and `pluck` are now recognized as sql injection sinks.
+* Calls to several methods of `ActiveRecord::Connection`, such as `ActiveRecord::Connection#exec_query`, are now recognized as SQL executions, including those via subclasses.
diff --git a/ruby/ql/lib/codeql-pack.release.yml b/ruby/ql/lib/codeql-pack.release.yml
index 5290c29b7fe7..0521f0f75fad 100644
--- a/ruby/ql/lib/codeql-pack.release.yml
+++ b/ruby/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/ruby/ql/lib/qlpack.yml b/ruby/ql/lib/qlpack.yml
index 7d409b83adbd..de5b41999fe1 100644
--- a/ruby/ql/lib/qlpack.yml
+++ b/ruby/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-all
-version: 0.8.10-dev
+version: 0.8.10
groups: ruby
extractor: ruby
dbscheme: ruby.dbscheme
diff --git a/ruby/ql/src/CHANGELOG.md b/ruby/ql/src/CHANGELOG.md
index 4149c728effa..f875b6d16ad4 100644
--- a/ruby/ql/src/CHANGELOG.md
+++ b/ruby/ql/src/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Calls to `Object#method`, `Object#public_method` and `Object#singleton_method` with untrusted data are now recognised as sinks for code injection.
+* Added additional request sources for Ruby on Rails.
+
## 0.8.9
No user-facing changes.
diff --git a/ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md b/ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md
deleted file mode 100644
index 84ea696dfef4..000000000000
--- a/ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Added additional request sources for Ruby on Rails.
\ No newline at end of file
diff --git a/ruby/ql/src/change-notes/2024-03-01-method-code-injection-sinks.md b/ruby/ql/src/change-notes/released/0.8.10.md
similarity index 51%
rename from ruby/ql/src/change-notes/2024-03-01-method-code-injection-sinks.md
rename to ruby/ql/src/change-notes/released/0.8.10.md
index 43e40d3fd536..985cdf8d22e0 100644
--- a/ruby/ql/src/change-notes/2024-03-01-method-code-injection-sinks.md
+++ b/ruby/ql/src/change-notes/released/0.8.10.md
@@ -1,4 +1,6 @@
----
-category: minorAnalysis
----
-* Calls to `Object#method`, `Object#public_method` and `Object#singleton_method` with untrusted data are now recognised as sinks for code injection.
\ No newline at end of file
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Calls to `Object#method`, `Object#public_method` and `Object#singleton_method` with untrusted data are now recognised as sinks for code injection.
+* Added additional request sources for Ruby on Rails.
diff --git a/ruby/ql/src/codeql-pack.release.yml b/ruby/ql/src/codeql-pack.release.yml
index 5290c29b7fe7..0521f0f75fad 100644
--- a/ruby/ql/src/codeql-pack.release.yml
+++ b/ruby/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/ruby/ql/src/qlpack.yml b/ruby/ql/src/qlpack.yml
index 8af7f9fd7976..5e3792682346 100644
--- a/ruby/ql/src/qlpack.yml
+++ b/ruby/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-queries
-version: 0.8.10-dev
+version: 0.8.10
groups:
- ruby
- queries
diff --git a/shared/controlflow/CHANGELOG.md b/shared/controlflow/CHANGELOG.md
index dbfa6ef4512d..75f2ca53f987 100644
--- a/shared/controlflow/CHANGELOG.md
+++ b/shared/controlflow/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.1.10
+
+No user-facing changes.
+
## 0.1.9
No user-facing changes.
diff --git a/shared/controlflow/change-notes/released/0.1.10.md b/shared/controlflow/change-notes/released/0.1.10.md
new file mode 100644
index 000000000000..47358eeee934
--- /dev/null
+++ b/shared/controlflow/change-notes/released/0.1.10.md
@@ -0,0 +1,3 @@
+## 0.1.10
+
+No user-facing changes.
diff --git a/shared/controlflow/codeql-pack.release.yml b/shared/controlflow/codeql-pack.release.yml
index 1425c0edf7f8..30f5ca88be0e 100644
--- a/shared/controlflow/codeql-pack.release.yml
+++ b/shared/controlflow/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.1.9
+lastReleaseVersion: 0.1.10
diff --git a/shared/controlflow/qlpack.yml b/shared/controlflow/qlpack.yml
index 9d35a6782761..1d43802be421 100644
--- a/shared/controlflow/qlpack.yml
+++ b/shared/controlflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/controlflow
-version: 0.1.10-dev
+version: 0.1.10
groups: shared
library: true
dependencies:
diff --git a/shared/dataflow/CHANGELOG.md b/shared/dataflow/CHANGELOG.md
index 67a5bf589f4f..ef80788bded6 100644
--- a/shared/dataflow/CHANGELOG.md
+++ b/shared/dataflow/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.1
+
+No user-facing changes.
+
## 0.2.0
### Breaking Changes
diff --git a/shared/dataflow/change-notes/released/0.2.1.md b/shared/dataflow/change-notes/released/0.2.1.md
new file mode 100644
index 000000000000..3dbfc85fe11d
--- /dev/null
+++ b/shared/dataflow/change-notes/released/0.2.1.md
@@ -0,0 +1,3 @@
+## 0.2.1
+
+No user-facing changes.
diff --git a/shared/dataflow/codeql-pack.release.yml b/shared/dataflow/codeql-pack.release.yml
index 5274e27ed522..df29a726bccc 100644
--- a/shared/dataflow/codeql-pack.release.yml
+++ b/shared/dataflow/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.0
+lastReleaseVersion: 0.2.1
diff --git a/shared/dataflow/qlpack.yml b/shared/dataflow/qlpack.yml
index 1e7becf71c4f..ee422e02ea9a 100644
--- a/shared/dataflow/qlpack.yml
+++ b/shared/dataflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/dataflow
-version: 0.2.1-dev
+version: 0.2.1
groups: shared
library: true
dependencies:
diff --git a/shared/mad/CHANGELOG.md b/shared/mad/CHANGELOG.md
index 4d09057118ce..4730366775ea 100644
--- a/shared/mad/CHANGELOG.md
+++ b/shared/mad/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/mad/change-notes/released/0.2.10.md b/shared/mad/change-notes/released/0.2.10.md
new file mode 100644
index 000000000000..81c9722b19fe
--- /dev/null
+++ b/shared/mad/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/mad/codeql-pack.release.yml b/shared/mad/codeql-pack.release.yml
index d021cf0a6bed..a71167814cb7 100644
--- a/shared/mad/codeql-pack.release.yml
+++ b/shared/mad/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/mad/qlpack.yml b/shared/mad/qlpack.yml
index 22c8f271ccc6..6d7269ef3da8 100644
--- a/shared/mad/qlpack.yml
+++ b/shared/mad/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/mad
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
dependencies: null
diff --git a/shared/rangeanalysis/CHANGELOG.md b/shared/rangeanalysis/CHANGELOG.md
index 5b8dbcfab22c..9943dcb79727 100644
--- a/shared/rangeanalysis/CHANGELOG.md
+++ b/shared/rangeanalysis/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.0.9
+
+No user-facing changes.
+
## 0.0.8
No user-facing changes.
diff --git a/shared/rangeanalysis/change-notes/released/0.0.9.md b/shared/rangeanalysis/change-notes/released/0.0.9.md
new file mode 100644
index 000000000000..c9e17c6d6cf2
--- /dev/null
+++ b/shared/rangeanalysis/change-notes/released/0.0.9.md
@@ -0,0 +1,3 @@
+## 0.0.9
+
+No user-facing changes.
diff --git a/shared/rangeanalysis/codeql-pack.release.yml b/shared/rangeanalysis/codeql-pack.release.yml
index 58fdc6b45deb..ecdd64fbab86 100644
--- a/shared/rangeanalysis/codeql-pack.release.yml
+++ b/shared/rangeanalysis/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.8
+lastReleaseVersion: 0.0.9
diff --git a/shared/rangeanalysis/qlpack.yml b/shared/rangeanalysis/qlpack.yml
index 836fe51ee344..01db5d5734d0 100644
--- a/shared/rangeanalysis/qlpack.yml
+++ b/shared/rangeanalysis/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/rangeanalysis
-version: 0.0.9-dev
+version: 0.0.9
groups: shared
library: true
dependencies:
diff --git a/shared/regex/CHANGELOG.md b/shared/regex/CHANGELOG.md
index cd5f91f71ec1..c05869c153d3 100644
--- a/shared/regex/CHANGELOG.md
+++ b/shared/regex/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/regex/change-notes/released/0.2.10.md b/shared/regex/change-notes/released/0.2.10.md
new file mode 100644
index 000000000000..81c9722b19fe
--- /dev/null
+++ b/shared/regex/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/regex/codeql-pack.release.yml b/shared/regex/codeql-pack.release.yml
index d021cf0a6bed..a71167814cb7 100644
--- a/shared/regex/codeql-pack.release.yml
+++ b/shared/regex/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/regex/qlpack.yml b/shared/regex/qlpack.yml
index ea3f7f9b2389..0d4f485312f7 100644
--- a/shared/regex/qlpack.yml
+++ b/shared/regex/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/regex
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
dependencies:
diff --git a/shared/ssa/CHANGELOG.md b/shared/ssa/CHANGELOG.md
index 01acfae01489..a9161ff578b0 100644
--- a/shared/ssa/CHANGELOG.md
+++ b/shared/ssa/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/ssa/change-notes/released/0.2.10.md b/shared/ssa/change-notes/released/0.2.10.md
new file mode 100644
index 000000000000..81c9722b19fe
--- /dev/null
+++ b/shared/ssa/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/ssa/codeql-pack.release.yml b/shared/ssa/codeql-pack.release.yml
index d021cf0a6bed..a71167814cb7 100644
--- a/shared/ssa/codeql-pack.release.yml
+++ b/shared/ssa/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/ssa/qlpack.yml b/shared/ssa/qlpack.yml
index 19304ad107f1..2ad254711a50 100644
--- a/shared/ssa/qlpack.yml
+++ b/shared/ssa/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ssa
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
dependencies:
diff --git a/shared/threat-models/CHANGELOG.md b/shared/threat-models/CHANGELOG.md
index fba2a8703562..a59e560c4155 100644
--- a/shared/threat-models/CHANGELOG.md
+++ b/shared/threat-models/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.0.9
+
+No user-facing changes.
+
## 0.0.8
No user-facing changes.
diff --git a/shared/threat-models/change-notes/released/0.0.9.md b/shared/threat-models/change-notes/released/0.0.9.md
new file mode 100644
index 000000000000..c9e17c6d6cf2
--- /dev/null
+++ b/shared/threat-models/change-notes/released/0.0.9.md
@@ -0,0 +1,3 @@
+## 0.0.9
+
+No user-facing changes.
diff --git a/shared/threat-models/codeql-pack.release.yml b/shared/threat-models/codeql-pack.release.yml
index 58fdc6b45deb..ecdd64fbab86 100644
--- a/shared/threat-models/codeql-pack.release.yml
+++ b/shared/threat-models/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.8
+lastReleaseVersion: 0.0.9
diff --git a/shared/threat-models/qlpack.yml b/shared/threat-models/qlpack.yml
index d0ed9a913b21..60cbbc56fcb3 100644
--- a/shared/threat-models/qlpack.yml
+++ b/shared/threat-models/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/threat-models
-version: 0.0.9-dev
+version: 0.0.9
library: true
groups: shared
dataExtensions:
diff --git a/shared/tutorial/CHANGELOG.md b/shared/tutorial/CHANGELOG.md
index 1db3a01af0b1..560ad058d5b3 100644
--- a/shared/tutorial/CHANGELOG.md
+++ b/shared/tutorial/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/tutorial/change-notes/released/0.2.10.md b/shared/tutorial/change-notes/released/0.2.10.md
new file mode 100644
index 000000000000..81c9722b19fe
--- /dev/null
+++ b/shared/tutorial/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/tutorial/codeql-pack.release.yml b/shared/tutorial/codeql-pack.release.yml
index d021cf0a6bed..a71167814cb7 100644
--- a/shared/tutorial/codeql-pack.release.yml
+++ b/shared/tutorial/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/tutorial/qlpack.yml b/shared/tutorial/qlpack.yml
index b595ae9ee70a..69116705c1bf 100644
--- a/shared/tutorial/qlpack.yml
+++ b/shared/tutorial/qlpack.yml
@@ -1,7 +1,7 @@
name: codeql/tutorial
description: Library for the CodeQL detective tutorials, helping new users learn to
write CodeQL queries.
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/typetracking/CHANGELOG.md b/shared/typetracking/CHANGELOG.md
index afc857bc6bce..350f9ecbeae0 100644
--- a/shared/typetracking/CHANGELOG.md
+++ b/shared/typetracking/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/typetracking/change-notes/released/0.2.10.md b/shared/typetracking/change-notes/released/0.2.10.md
new file mode 100644
index 000000000000..81c9722b19fe
--- /dev/null
+++ b/shared/typetracking/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/typetracking/codeql-pack.release.yml b/shared/typetracking/codeql-pack.release.yml
index d021cf0a6bed..a71167814cb7 100644
--- a/shared/typetracking/codeql-pack.release.yml
+++ b/shared/typetracking/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/typetracking/qlpack.yml b/shared/typetracking/qlpack.yml
index b55927f59bb7..fbbdcf5162a1 100644
--- a/shared/typetracking/qlpack.yml
+++ b/shared/typetracking/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typetracking
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
dependencies:
diff --git a/shared/typos/CHANGELOG.md b/shared/typos/CHANGELOG.md
index 66c5871d9821..54b1eaa4d589 100644
--- a/shared/typos/CHANGELOG.md
+++ b/shared/typos/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/typos/change-notes/released/0.2.10.md b/shared/typos/change-notes/released/0.2.10.md
new file mode 100644
index 000000000000..81c9722b19fe
--- /dev/null
+++ b/shared/typos/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/typos/codeql-pack.release.yml b/shared/typos/codeql-pack.release.yml
index d021cf0a6bed..a71167814cb7 100644
--- a/shared/typos/codeql-pack.release.yml
+++ b/shared/typos/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/typos/qlpack.yml b/shared/typos/qlpack.yml
index 644bfe11bff7..4d59d9b3c342 100644
--- a/shared/typos/qlpack.yml
+++ b/shared/typos/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typos
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/util/CHANGELOG.md b/shared/util/CHANGELOG.md
index 63832e927fa5..1ca1f71bcbc2 100644
--- a/shared/util/CHANGELOG.md
+++ b/shared/util/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/util/change-notes/released/0.2.10.md b/shared/util/change-notes/released/0.2.10.md
new file mode 100644
index 000000000000..81c9722b19fe
--- /dev/null
+++ b/shared/util/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/util/codeql-pack.release.yml b/shared/util/codeql-pack.release.yml
index d021cf0a6bed..a71167814cb7 100644
--- a/shared/util/codeql-pack.release.yml
+++ b/shared/util/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/util/qlpack.yml b/shared/util/qlpack.yml
index ca1a866a53d4..28ed738a93dd 100644
--- a/shared/util/qlpack.yml
+++ b/shared/util/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/util
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
dependencies: null
diff --git a/shared/yaml/CHANGELOG.md b/shared/yaml/CHANGELOG.md
index e5495abcd503..9fd5ebc26ab2 100644
--- a/shared/yaml/CHANGELOG.md
+++ b/shared/yaml/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/yaml/change-notes/released/0.2.10.md b/shared/yaml/change-notes/released/0.2.10.md
new file mode 100644
index 000000000000..81c9722b19fe
--- /dev/null
+++ b/shared/yaml/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/yaml/codeql-pack.release.yml b/shared/yaml/codeql-pack.release.yml
index d021cf0a6bed..a71167814cb7 100644
--- a/shared/yaml/codeql-pack.release.yml
+++ b/shared/yaml/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/yaml/qlpack.yml b/shared/yaml/qlpack.yml
index de5b47e120ae..9643ffcec66b 100644
--- a/shared/yaml/qlpack.yml
+++ b/shared/yaml/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/yaml
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/swift/ql/lib/CHANGELOG.md b/swift/ql/lib/CHANGELOG.md
index e88cd0259ccf..8f14bfcedc9c 100644
--- a/swift/ql/lib/CHANGELOG.md
+++ b/swift/ql/lib/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 0.3.10
+
+### Bug Fixes
+
+* Fixed an issue where `TypeDecl.getFullName` would get stuck in an loop and fail when minor database inconsistencies are present.
+
## 0.3.9
### Minor Analysis Improvements
diff --git a/swift/ql/lib/change-notes/2024-02-22-extension-patch.md b/swift/ql/lib/change-notes/released/0.3.10.md
similarity index 83%
rename from swift/ql/lib/change-notes/2024-02-22-extension-patch.md
rename to swift/ql/lib/change-notes/released/0.3.10.md
index 7bd78f3b785c..9d6286ff58a7 100644
--- a/swift/ql/lib/change-notes/2024-02-22-extension-patch.md
+++ b/swift/ql/lib/change-notes/released/0.3.10.md
@@ -1,4 +1,5 @@
----
-category: fix
----
+## 0.3.10
+
+### Bug Fixes
+
* Fixed an issue where `TypeDecl.getFullName` would get stuck in an loop and fail when minor database inconsistencies are present.
diff --git a/swift/ql/lib/codeql-pack.release.yml b/swift/ql/lib/codeql-pack.release.yml
index 3fa5180bcb49..76ca0ac8ba76 100644
--- a/swift/ql/lib/codeql-pack.release.yml
+++ b/swift/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.3.9
+lastReleaseVersion: 0.3.10
diff --git a/swift/ql/lib/qlpack.yml b/swift/ql/lib/qlpack.yml
index a37a4cb3d580..70ec4798ea85 100644
--- a/swift/ql/lib/qlpack.yml
+++ b/swift/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-all
-version: 0.3.10-dev
+version: 0.3.10
groups: swift
extractor: swift
dbscheme: swift.dbscheme
diff --git a/swift/ql/src/CHANGELOG.md b/swift/ql/src/CHANGELOG.md
index 96615d069729..bda9834c9bca 100644
--- a/swift/ql/src/CHANGELOG.md
+++ b/swift/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.3.10
+
+No user-facing changes.
+
## 0.3.9
### New Queries
diff --git a/swift/ql/src/change-notes/released/0.3.10.md b/swift/ql/src/change-notes/released/0.3.10.md
new file mode 100644
index 000000000000..925a48fc52e0
--- /dev/null
+++ b/swift/ql/src/change-notes/released/0.3.10.md
@@ -0,0 +1,3 @@
+## 0.3.10
+
+No user-facing changes.
diff --git a/swift/ql/src/codeql-pack.release.yml b/swift/ql/src/codeql-pack.release.yml
index 3fa5180bcb49..76ca0ac8ba76 100644
--- a/swift/ql/src/codeql-pack.release.yml
+++ b/swift/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.3.9
+lastReleaseVersion: 0.3.10
diff --git a/swift/ql/src/qlpack.yml b/swift/ql/src/qlpack.yml
index e3ead42c98bf..ba66b065529b 100644
--- a/swift/ql/src/qlpack.yml
+++ b/swift/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-queries
-version: 0.3.10-dev
+version: 0.3.10
groups:
- swift
- queries
From 87f3b43576864cc32cd9b677bf62273c506388f1 Mon Sep 17 00:00:00 2001
From: Harry Maclean
Date: Tue, 5 Mar 2024 08:28:16 +0000
Subject: [PATCH 056/731] Ruby: remove deprecated private class
---
ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll | 5 -----
1 file changed, 5 deletions(-)
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll b/ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll
index c8667b2b2f23..6fde1705018a 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll
@@ -441,11 +441,6 @@ class ActionControllerSkipForgeryProtectionCall extends CsrfProtectionSetting::R
override boolean getVerificationSetting() { result = false }
}
-/**
- * DEPRECATED: Use `ActionController::ProtectFromForgeryCall` instead.
- */
-deprecated class ActionControllerProtectFromForgeryCall = ActionController::ProtectFromForgeryCall;
-
/**
* A call to `send_file`, which sends the file at the given path to the client.
*/
From 179aaa134201089df6374ff5ba2132df749d3e12 Mon Sep 17 00:00:00 2001
From: Harry Maclean
Date: Tue, 5 Mar 2024 09:35:18 +0000
Subject: [PATCH 057/731] Ruby: model Open4.popen4ext
---
.../lib/codeql/ruby/frameworks/stdlib/Open3.qll | 16 ++++++++++++++--
.../frameworks/stdlib/Open3.expected | 4 ++++
.../library-tests/frameworks/stdlib/Open3.rb | 4 ++++
3 files changed, 22 insertions(+), 2 deletions(-)
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll b/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll
index 16b9ecc37978..0e9b6245880e 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Open3.qll
@@ -38,14 +38,26 @@ module Open3 {
*/
class Open4Call extends SystemCommandExecution::Range instanceof DataFlow::CallNode {
Open4Call() {
- this = API::getTopLevelMember("Open4").getAMethodCall(["open4", "popen4", "spawn"])
+ this =
+ API::getTopLevelMember("Open4").getAMethodCall(["open4", "popen4", "spawn", "popen4ext"])
}
- override DataFlow::Node getAnArgument() { result = super.getArgument(_) }
+ override DataFlow::Node getAnArgument() {
+ // `popen4ext` takes an optional boolean as its first argument, but it is unlikely that we will be
+ // tracking flow into a boolean value so it doesn't seem worth modeling that special case here.
+ result = super.getArgument(_)
+ }
override predicate isShellInterpreted(DataFlow::Node arg) {
super.getNumberOfArguments() = 1 and
arg = this.getAnArgument()
+ or
+ // ```rb
+ // Open4.popen4ext(true, "some cmd")
+ // ```
+ super.getNumberOfArguments() = 2 and
+ super.getArgument(0).getConstantValue().isBoolean(_) and
+ arg = super.getArgument(1)
}
}
diff --git a/ruby/ql/test/library-tests/frameworks/stdlib/Open3.expected b/ruby/ql/test/library-tests/frameworks/stdlib/Open3.expected
index 48bc6fc27f68..9589d721a296 100644
--- a/ruby/ql/test/library-tests/frameworks/stdlib/Open3.expected
+++ b/ruby/ql/test/library-tests/frameworks/stdlib/Open3.expected
@@ -15,3 +15,7 @@ open4CallExecutions
| Open3.rb:13:1:13:24 | call to open4 |
| Open3.rb:14:1:14:25 | call to popen4 |
| Open3.rb:15:1:15:23 | call to spawn |
+| Open3.rb:16:1:16:27 | call to popen4ext |
+| Open3.rb:17:1:17:30 | call to popen4ext |
+| Open3.rb:18:1:18:33 | call to popen4ext |
+| Open3.rb:19:1:19:36 | call to popen4ext |
diff --git a/ruby/ql/test/library-tests/frameworks/stdlib/Open3.rb b/ruby/ql/test/library-tests/frameworks/stdlib/Open3.rb
index 4a112335ffb7..9cc7ea7fd5c4 100644
--- a/ruby/ql/test/library-tests/frameworks/stdlib/Open3.rb
+++ b/ruby/ql/test/library-tests/frameworks/stdlib/Open3.rb
@@ -13,3 +13,7 @@
Open4::open4("echo foo")
Open4::popen4("echo foo")
Open4.spawn("echo bar")
+Open4.popen4ext("echo foo")
+Open4.popen4ext("echo", "foo")
+Open4.popen4ext(true, "echo foo")
+Open4.popen4ext(true, "echo", "foo")
From 91cb2a37fd4ec3d8d9a2effa4f1e51761792d9db Mon Sep 17 00:00:00 2001
From: Harry Maclean
Date: Tue, 5 Mar 2024 10:19:22 +0000
Subject: [PATCH 058/731] Ruby: Model Process.exec
---
ruby/ql/lib/codeql/ruby/frameworks/Stdlib.qll | 1 +
.../codeql/ruby/frameworks/stdlib/Process.qll | 14 ++++++++
.../stdlib/CommandExecution.expected | 32 +++++++++++++++++++
.../frameworks/stdlib/CommandExecution.ql | 12 +++++++
.../frameworks/stdlib/process.rb | 5 +++
5 files changed, 64 insertions(+)
create mode 100644 ruby/ql/test/library-tests/frameworks/stdlib/CommandExecution.expected
create mode 100644 ruby/ql/test/library-tests/frameworks/stdlib/CommandExecution.ql
create mode 100644 ruby/ql/test/library-tests/frameworks/stdlib/process.rb
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/Stdlib.qll b/ruby/ql/lib/codeql/ruby/frameworks/Stdlib.qll
index f735f9daf8b5..139f1d619d6a 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/Stdlib.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/Stdlib.qll
@@ -5,3 +5,4 @@
import stdlib.Open3
import stdlib.Logger
import stdlib.Pathname
+import stdlib.Process
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Process.qll b/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Process.qll
index 1ffc15d691b8..e4516f220388 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Process.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/stdlib/Process.qll
@@ -32,4 +32,18 @@ module Process {
super.getNumberOfArguments() = 1 and arg = this.getAnArgument()
}
}
+
+ /**
+ * A system command executed via the `Process.exec` method.
+ */
+ class ExecCall extends SystemCommandExecution::Range instanceof DataFlow::CallNode {
+ ExecCall() { this = DataFlow::getConstant("Process").getAMethodCall("exec") }
+
+ override DataFlow::Node getAnArgument() { result = super.getArgument(_) }
+
+ override predicate isShellInterpreted(DataFlow::Node arg) {
+ // Process.exec invokes a subshell if you provide a single string as argument
+ super.getNumberOfArguments() = 1 and arg = this.getAnArgument()
+ }
+ }
}
diff --git a/ruby/ql/test/library-tests/frameworks/stdlib/CommandExecution.expected b/ruby/ql/test/library-tests/frameworks/stdlib/CommandExecution.expected
new file mode 100644
index 000000000000..e29aaf35baca
--- /dev/null
+++ b/ruby/ql/test/library-tests/frameworks/stdlib/CommandExecution.expected
@@ -0,0 +1,32 @@
+| Open3.rb:1:1:1:24 | call to popen3 | Open3.rb:1:14:1:23 | "echo foo" | true |
+| Open3.rb:2:1:2:24 | call to popen2 | Open3.rb:2:14:2:23 | "echo foo" | true |
+| Open3.rb:3:1:3:25 | call to popen2e | Open3.rb:3:15:3:24 | "echo foo" | true |
+| Open3.rb:4:1:4:26 | call to capture3 | Open3.rb:4:16:4:25 | "echo foo" | true |
+| Open3.rb:5:1:5:26 | call to capture2 | Open3.rb:5:16:5:25 | "echo foo" | true |
+| Open3.rb:6:1:6:27 | call to capture2e | Open3.rb:6:17:6:26 | "echo foo" | true |
+| Open3.rb:7:1:7:41 | call to pipeline_rw | Open3.rb:7:19:7:28 | "echo foo" | true |
+| Open3.rb:7:1:7:41 | call to pipeline_rw | Open3.rb:7:31:7:40 | "grep bar" | true |
+| Open3.rb:8:1:8:40 | call to pipeline_r | Open3.rb:8:18:8:27 | "echo foo" | true |
+| Open3.rb:8:1:8:40 | call to pipeline_r | Open3.rb:8:30:8:39 | "grep bar" | true |
+| Open3.rb:9:1:9:40 | call to pipeline_w | Open3.rb:9:18:9:27 | "echo foo" | true |
+| Open3.rb:9:1:9:40 | call to pipeline_w | Open3.rb:9:30:9:39 | "grep bar" | true |
+| Open3.rb:10:1:10:44 | call to pipeline_start | Open3.rb:10:22:10:31 | "echo foo" | true |
+| Open3.rb:10:1:10:44 | call to pipeline_start | Open3.rb:10:34:10:43 | "grep bar" | true |
+| Open3.rb:11:1:11:38 | call to pipeline | Open3.rb:11:16:11:25 | "echo foo" | true |
+| Open3.rb:11:1:11:38 | call to pipeline | Open3.rb:11:28:11:37 | "grep bar" | true |
+| Open3.rb:13:1:13:24 | call to open4 | Open3.rb:13:14:13:23 | "echo foo" | true |
+| Open3.rb:14:1:14:25 | call to popen4 | Open3.rb:14:15:14:24 | "echo foo" | true |
+| Open3.rb:15:1:15:23 | call to spawn | Open3.rb:15:13:15:22 | "echo bar" | true |
+| Open3.rb:16:1:16:27 | call to popen4ext | Open3.rb:16:17:16:26 | "echo foo" | true |
+| Open3.rb:17:1:17:30 | call to popen4ext | Open3.rb:17:17:17:22 | "echo" | false |
+| Open3.rb:17:1:17:30 | call to popen4ext | Open3.rb:17:25:17:29 | "foo" | false |
+| Open3.rb:18:1:18:33 | call to popen4ext | Open3.rb:18:17:18:20 | true | false |
+| Open3.rb:18:1:18:33 | call to popen4ext | Open3.rb:18:23:18:32 | "echo foo" | true |
+| Open3.rb:19:1:19:36 | call to popen4ext | Open3.rb:19:17:19:20 | true | false |
+| Open3.rb:19:1:19:36 | call to popen4ext | Open3.rb:19:23:19:28 | "echo" | false |
+| Open3.rb:19:1:19:36 | call to popen4ext | Open3.rb:19:31:19:35 | "foo" | false |
+| process.rb:1:1:1:25 | call to spawn | process.rb:1:15:1:24 | "echo foo" | true |
+| process.rb:2:1:2:30 | call to spawn | process.rb:2:15:2:29 | call to [] | true |
+| process.rb:3:1:3:24 | call to exec | process.rb:3:14:3:23 | "echo foo" | true |
+| process.rb:4:1:4:29 | call to exec | process.rb:4:14:4:28 | call to [] | true |
+| process.rb:5:1:5:21 | call to spawn | process.rb:5:11:5:20 | "echo foo" | true |
diff --git a/ruby/ql/test/library-tests/frameworks/stdlib/CommandExecution.ql b/ruby/ql/test/library-tests/frameworks/stdlib/CommandExecution.ql
new file mode 100644
index 000000000000..4de7304272b6
--- /dev/null
+++ b/ruby/ql/test/library-tests/frameworks/stdlib/CommandExecution.ql
@@ -0,0 +1,12 @@
+import codeql.ruby.Frameworks
+import codeql.ruby.Concepts
+import codeql.ruby.DataFlow
+
+query predicate commandExecutions(
+ SystemCommandExecution execution, DataFlow::Node arg, boolean isShellInterpreted
+) {
+ arg = execution.getAnArgument() and
+ if execution.isShellInterpreted(arg)
+ then isShellInterpreted = true
+ else isShellInterpreted = false
+}
diff --git a/ruby/ql/test/library-tests/frameworks/stdlib/process.rb b/ruby/ql/test/library-tests/frameworks/stdlib/process.rb
new file mode 100644
index 000000000000..2a40e7fa94e0
--- /dev/null
+++ b/ruby/ql/test/library-tests/frameworks/stdlib/process.rb
@@ -0,0 +1,5 @@
+Process.spawn("echo foo")
+Process.spawn(["echo", "foo"])
+Process.exec("echo foo")
+Process.exec(["echo", "foo"])
+PTY.spawn("echo foo")
From 148241183a3a52d15f145fdb97218180d37ba50b Mon Sep 17 00:00:00 2001
From: Harry Maclean
Date: Tue, 5 Mar 2024 10:20:22 +0000
Subject: [PATCH 059/731] Ruby: update changenote
---
ruby/ql/lib/change-notes/2024-02-27-process-spawn.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/ruby/ql/lib/change-notes/2024-02-27-process-spawn.md b/ruby/ql/lib/change-notes/2024-02-27-process-spawn.md
index 30feedcbd209..9c20f05d8659 100644
--- a/ruby/ql/lib/change-notes/2024-02-27-process-spawn.md
+++ b/ruby/ql/lib/change-notes/2024-02-27-process-spawn.md
@@ -1,4 +1,4 @@
---
category: minorAnalysis
---
-* New command injection sinks have been added, including `Process.spawn`, `Terrapin::CommandLine` and the `open4` gem.
\ No newline at end of file
+* New command injection sinks have been added, including `Process.spawn`, `Process.exec`, `Terrapin::CommandLine` and the `open4` gem.
\ No newline at end of file
From 2aa093c95cde5faed2aef27e119f8266e660863b Mon Sep 17 00:00:00 2001
From: "Michael B. Gale"
Date: Tue, 5 Mar 2024 11:25:02 +0000
Subject: [PATCH 060/731] Go: Move `getImportPath` to shared `util` package
---
.../cli/go-autobuilder/go-autobuilder.go | 60 +------------------
go/extractor/util/util.go | 59 ++++++++++++++++++
.../util_test.go} | 2 +-
3 files changed, 61 insertions(+), 60 deletions(-)
rename go/extractor/{cli/go-autobuilder/go-autobuilder_test.go => util/util_test.go} (98%)
diff --git a/go/extractor/cli/go-autobuilder/go-autobuilder.go b/go/extractor/cli/go-autobuilder/go-autobuilder.go
index 91291c771448..b2e2a78666f6 100644
--- a/go/extractor/cli/go-autobuilder/go-autobuilder.go
+++ b/go/extractor/cli/go-autobuilder/go-autobuilder.go
@@ -3,7 +3,6 @@ package main
import (
"fmt"
"log"
- "net/url"
"os"
"os/exec"
"path/filepath"
@@ -56,63 +55,6 @@ Build behavior:
fmt.Fprintf(os.Stderr, "Usage:\n\n %s\n", os.Args[0])
}
-// Returns the import path of the package being built, or "" if it cannot be determined.
-func getImportPath() (importpath string) {
- importpath = os.Getenv("LGTM_INDEX_IMPORT_PATH")
- if importpath == "" {
- repourl := os.Getenv("SEMMLE_REPO_URL")
- if repourl == "" {
- githubrepo := os.Getenv("GITHUB_REPOSITORY")
- if githubrepo == "" {
- log.Printf("Unable to determine import path, as neither LGTM_INDEX_IMPORT_PATH nor GITHUB_REPOSITORY is set\n")
- return ""
- } else {
- importpath = "github.com/" + githubrepo
- }
- } else {
- importpath = getImportPathFromRepoURL(repourl)
- if importpath == "" {
- log.Printf("Failed to determine import path from SEMMLE_REPO_URL '%s'\n", repourl)
- return
- }
- }
- }
- log.Printf("Import path is '%s'\n", importpath)
- return
-}
-
-// Returns the import path of the package being built from `repourl`, or "" if it cannot be
-// determined.
-func getImportPathFromRepoURL(repourl string) string {
- // check for scp-like URL as in "git@github.com:github/codeql-go.git"
- shorturl := regexp.MustCompile(`^([^@]+@)?([^:]+):([^/].*?)(\.git)?$`)
- m := shorturl.FindStringSubmatch(repourl)
- if m != nil {
- return m[2] + "/" + m[3]
- }
-
- // otherwise parse as proper URL
- u, err := url.Parse(repourl)
- if err != nil {
- log.Fatalf("Malformed repository URL '%s'\n", repourl)
- }
-
- if u.Scheme == "file" {
- // we can't determine import paths from file paths
- return ""
- }
-
- if u.Hostname() == "" || u.Path == "" {
- return ""
- }
-
- host := u.Hostname()
- path := u.Path
- // strip off leading slashes and trailing `.git` if present
- path = regexp.MustCompile(`^/+|\.git$`).ReplaceAllString(path, "")
- return host + "/" + path
-}
-
func restoreRepoLayout(fromDir string, dirEntries []string, scratchDirName string, toDir string) {
for _, dirEntry := range dirEntries {
if dirEntry != scratchDirName {
@@ -568,7 +510,7 @@ func installDependenciesAndBuild() {
if len(workspaces) == 1 {
workspace := workspaces[0]
- importpath := getImportPath()
+ importpath := util.GetImportPath()
needGopath := getNeedGopath(workspace, importpath)
inLGTM := os.Getenv("LGTM_SRC") != "" || os.Getenv("LGTM_INDEX_NEED_GOPATH") != ""
diff --git a/go/extractor/util/util.go b/go/extractor/util/util.go
index b5b28089e789..2ae6a2b0cd2b 100644
--- a/go/extractor/util/util.go
+++ b/go/extractor/util/util.go
@@ -6,9 +6,11 @@ import (
"io"
"io/fs"
"log"
+ "net/url"
"os"
"os/exec"
"path/filepath"
+ "regexp"
"runtime"
"slices"
"strings"
@@ -350,3 +352,60 @@ func GetParentDirs(paths []string) []string {
}
return dirs
}
+
+// Returns the import path of the package being built, or "" if it cannot be determined.
+func GetImportPath() (importpath string) {
+ importpath = os.Getenv("LGTM_INDEX_IMPORT_PATH")
+ if importpath == "" {
+ repourl := os.Getenv("SEMMLE_REPO_URL")
+ if repourl == "" {
+ githubrepo := os.Getenv("GITHUB_REPOSITORY")
+ if githubrepo == "" {
+ log.Printf("Unable to determine import path, as neither LGTM_INDEX_IMPORT_PATH nor GITHUB_REPOSITORY is set\n")
+ return ""
+ } else {
+ importpath = "github.com/" + githubrepo
+ }
+ } else {
+ importpath = getImportPathFromRepoURL(repourl)
+ if importpath == "" {
+ log.Printf("Failed to determine import path from SEMMLE_REPO_URL '%s'\n", repourl)
+ return
+ }
+ }
+ }
+ log.Printf("Import path is '%s'\n", importpath)
+ return
+}
+
+// Returns the import path of the package being built from `repourl`, or "" if it cannot be
+// determined.
+func getImportPathFromRepoURL(repourl string) string {
+ // check for scp-like URL as in "git@github.com:github/codeql-go.git"
+ shorturl := regexp.MustCompile(`^([^@]+@)?([^:]+):([^/].*?)(\.git)?$`)
+ m := shorturl.FindStringSubmatch(repourl)
+ if m != nil {
+ return m[2] + "/" + m[3]
+ }
+
+ // otherwise parse as proper URL
+ u, err := url.Parse(repourl)
+ if err != nil {
+ log.Fatalf("Malformed repository URL '%s'\n", repourl)
+ }
+
+ if u.Scheme == "file" {
+ // we can't determine import paths from file paths
+ return ""
+ }
+
+ if u.Hostname() == "" || u.Path == "" {
+ return ""
+ }
+
+ host := u.Hostname()
+ path := u.Path
+ // strip off leading slashes and trailing `.git` if present
+ path = regexp.MustCompile(`^/+|\.git$`).ReplaceAllString(path, "")
+ return host + "/" + path
+}
diff --git a/go/extractor/cli/go-autobuilder/go-autobuilder_test.go b/go/extractor/util/util_test.go
similarity index 98%
rename from go/extractor/cli/go-autobuilder/go-autobuilder_test.go
rename to go/extractor/util/util_test.go
index f4e8405fe365..45d32bda3e1b 100644
--- a/go/extractor/cli/go-autobuilder/go-autobuilder_test.go
+++ b/go/extractor/util/util_test.go
@@ -1,4 +1,4 @@
-package main
+package util
import "testing"
From 367ecf75d5889bb20da8e8a2123804d6cb76d79b Mon Sep 17 00:00:00 2001
From: "Michael B. Gale"
Date: Tue, 5 Mar 2024 11:37:51 +0000
Subject: [PATCH 061/731] Go: Use import path for auto-generated Go module
names
---
go/extractor/toolchain/toolchain.go | 17 ++++++++++++++++-
1 file changed, 16 insertions(+), 1 deletion(-)
diff --git a/go/extractor/toolchain/toolchain.go b/go/extractor/toolchain/toolchain.go
index 38abfd43874c..104894c59757 100644
--- a/go/extractor/toolchain/toolchain.go
+++ b/go/extractor/toolchain/toolchain.go
@@ -5,8 +5,10 @@ import (
"log"
"os"
"os/exec"
+ "path/filepath"
"strings"
+ "github.com/github/codeql-go/extractor/util"
"golang.org/x/mod/semver"
)
@@ -81,7 +83,20 @@ func TidyModule(path string) *exec.Cmd {
// Run `go mod init` in the directory given by `path`.
func InitModule(path string) *exec.Cmd {
- modInit := exec.Command("go", "mod", "init", "codeql/auto-project")
+ moduleName := "codeql/auto-project"
+
+ if importpath := util.GetImportPath(); importpath != "" {
+ // This should be something like `github.com/user/repo`
+ moduleName = importpath
+
+ // If we are not initialising the new module in the root directory of the workspace,
+ // append the relative path to the module name.
+ if relPath, err := filepath.Rel(".", path); err != nil && relPath != "." {
+ moduleName = moduleName + "/" + relPath
+ }
+ }
+
+ modInit := exec.Command("go", "mod", "init", moduleName)
modInit.Dir = path
return modInit
}
From b1e0bc03ab34a271563ac8a5ba66577b0f59b954 Mon Sep 17 00:00:00 2001
From: "Michael B. Gale"
Date: Tue, 5 Mar 2024 11:55:10 +0000
Subject: [PATCH 062/731] Go: Fix check for whether it is safe to initialise a
`go.mod` file in a given directory
---
go/extractor/project/project.go | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
diff --git a/go/extractor/project/project.go b/go/extractor/project/project.go
index 187389ecd553..9315a33f04cf 100644
--- a/go/extractor/project/project.go
+++ b/go/extractor/project/project.go
@@ -439,8 +439,9 @@ func getBuildRoots(emitDiagnostics bool) (goWorkspaces []GoWorkspace, totalModul
for _, component := range components {
path = filepath.Join(path, component)
- // Try to initialize a `go.mod` file automatically for the stray source files.
- if !slices.Contains(goModDirs, path) {
+ // Try to initialize a `go.mod` file automatically for the stray source files if
+ // doing so would not place it in a parent directory of an existing `go.mod` file.
+ if !startsWithAnyOf(path, goModDirs) {
goWorkspaces = append(goWorkspaces, GoWorkspace{
BaseDir: path,
DepMode: GoGetNoModules,
@@ -477,6 +478,16 @@ func getBuildRoots(emitDiagnostics bool) (goWorkspaces []GoWorkspace, totalModul
return
}
+// Determines whether `str` starts with any of `prefixes`.
+func startsWithAnyOf(str string, prefixes []string) bool {
+ for _, prefix := range prefixes {
+ if strings.HasPrefix(str, prefix) {
+ return true
+ }
+ }
+ return false
+}
+
// Finds Go workspaces in the current working directory.
func GetWorkspaceInfo(emitDiagnostics bool) []GoWorkspace {
bazelPaths := slices.Concat(
From ac394dc80ce6e3488285fd5abc01f2c5543ba0fb Mon Sep 17 00:00:00 2001
From: "Michael B. Gale"
Date: Tue, 5 Mar 2024 13:46:33 +0000
Subject: [PATCH 063/731] Go: Better check for path prefixes
---
go/extractor/project/project.go | 2 +-
go/extractor/project/project_test.go | 27 +++++++++++++++++++++++++++
2 files changed, 28 insertions(+), 1 deletion(-)
create mode 100644 go/extractor/project/project_test.go
diff --git a/go/extractor/project/project.go b/go/extractor/project/project.go
index 9315a33f04cf..22c0f856c798 100644
--- a/go/extractor/project/project.go
+++ b/go/extractor/project/project.go
@@ -481,7 +481,7 @@ func getBuildRoots(emitDiagnostics bool) (goWorkspaces []GoWorkspace, totalModul
// Determines whether `str` starts with any of `prefixes`.
func startsWithAnyOf(str string, prefixes []string) bool {
for _, prefix := range prefixes {
- if strings.HasPrefix(str, prefix) {
+ if relPath, err := filepath.Rel(str, prefix); err == nil && !strings.HasPrefix(relPath, "..") {
return true
}
}
diff --git a/go/extractor/project/project_test.go b/go/extractor/project/project_test.go
new file mode 100644
index 000000000000..f2de420773f9
--- /dev/null
+++ b/go/extractor/project/project_test.go
@@ -0,0 +1,27 @@
+package project
+
+import (
+ "path/filepath"
+ "testing"
+)
+
+func testStartsWithAnyOf(t *testing.T, path string, prefix string, expectation bool) {
+ result := startsWithAnyOf(path, []string{prefix})
+ if result != expectation {
+ t.Errorf("Expected startsWithAnyOf(%s, %s) to be %t, but it is %t.", path, prefix, expectation, result)
+ }
+}
+
+func TestStartsWithAnyOf(t *testing.T) {
+ testStartsWithAnyOf(t, ".", ".", true)
+ testStartsWithAnyOf(t, ".", "dir", true)
+ testStartsWithAnyOf(t, ".", filepath.Join("foo", "bar"), true)
+ testStartsWithAnyOf(t, "dir", "dir", true)
+ testStartsWithAnyOf(t, "foo", filepath.Join("foo", "bar"), true)
+ testStartsWithAnyOf(t, filepath.Join("foo", "bar"), filepath.Join("foo", "bar"), true)
+ testStartsWithAnyOf(t, filepath.Join("foo", "bar"), filepath.Join("foo", "bar", "baz"), true)
+
+ testStartsWithAnyOf(t, filepath.Join("foo", "bar"), "foo", false)
+ testStartsWithAnyOf(t, filepath.Join("foo", "bar"), "bar", false)
+ testStartsWithAnyOf(t, filepath.Join("foo", "bar"), filepath.Join("foo", "baz"), false)
+}
From a8d240dd7278a4d0e73b92daff10bfd1e7d17d98 Mon Sep 17 00:00:00 2001
From: "Michael B. Gale"
Date: Tue, 5 Mar 2024 14:08:16 +0000
Subject: [PATCH 064/731] Go: Add integration test for mixed layout project
---
.../go/mixed-layout/diagnostics.expected | 28 +++++++++++++++++++
.../force_sequential_test_execution | 2 ++
.../go/mixed-layout/src/module/go.mod | 5 ++++
.../go/mixed-layout/src/module/go.sum | 7 +++++
.../go/mixed-layout/src/module/test.go | 13 +++++++++
.../go/mixed-layout/src/stray-files/test.go | 13 +++++++++
.../go/mixed-layout/src/workspace/go.work | 3 ++
.../mixed-layout/src/workspace/subdir/go.mod | 5 ++++
.../mixed-layout/src/workspace/subdir/go.sum | 7 +++++
.../mixed-layout/src/workspace/subdir/test.go | 13 +++++++++
.../go/mixed-layout/test.expected | 8 ++++++
.../all-platforms/go/mixed-layout/test.py | 18 ++++++++++++
.../all-platforms/go/mixed-layout/test.ql | 8 ++++++
13 files changed, 130 insertions(+)
create mode 100644 go/ql/integration-tests/all-platforms/go/mixed-layout/diagnostics.expected
create mode 100644 go/ql/integration-tests/all-platforms/go/mixed-layout/force_sequential_test_execution
create mode 100644 go/ql/integration-tests/all-platforms/go/mixed-layout/src/module/go.mod
create mode 100644 go/ql/integration-tests/all-platforms/go/mixed-layout/src/module/go.sum
create mode 100644 go/ql/integration-tests/all-platforms/go/mixed-layout/src/module/test.go
create mode 100644 go/ql/integration-tests/all-platforms/go/mixed-layout/src/stray-files/test.go
create mode 100644 go/ql/integration-tests/all-platforms/go/mixed-layout/src/workspace/go.work
create mode 100644 go/ql/integration-tests/all-platforms/go/mixed-layout/src/workspace/subdir/go.mod
create mode 100644 go/ql/integration-tests/all-platforms/go/mixed-layout/src/workspace/subdir/go.sum
create mode 100644 go/ql/integration-tests/all-platforms/go/mixed-layout/src/workspace/subdir/test.go
create mode 100644 go/ql/integration-tests/all-platforms/go/mixed-layout/test.expected
create mode 100644 go/ql/integration-tests/all-platforms/go/mixed-layout/test.py
create mode 100644 go/ql/integration-tests/all-platforms/go/mixed-layout/test.ql
diff --git a/go/ql/integration-tests/all-platforms/go/mixed-layout/diagnostics.expected b/go/ql/integration-tests/all-platforms/go/mixed-layout/diagnostics.expected
new file mode 100644
index 000000000000..bbbdd515d68b
--- /dev/null
+++ b/go/ql/integration-tests/all-platforms/go/mixed-layout/diagnostics.expected
@@ -0,0 +1,28 @@
+{
+ "markdownMessage": "1 `go.work` file was found:\n\n`workspace/go.work`",
+ "severity": "note",
+ "source": {
+ "extractorName": "go",
+ "id": "go/autobuilder/go-work-found",
+ "name": "`go.work` file found"
+ },
+ "visibility": {
+ "cliSummaryTable": false,
+ "statusPage": false,
+ "telemetry": true
+ }
+}
+{
+ "markdownMessage": "Go files were found outside of the Go modules corresponding to these `go.mod` files.\n\n`workspace/subdir/go.mod`, `module/go.mod`",
+ "severity": "note",
+ "source": {
+ "extractorName": "go",
+ "id": "go/autobuilder/go-files-outside-go-modules",
+ "name": "Go files were found outside Go modules"
+ },
+ "visibility": {
+ "cliSummaryTable": false,
+ "statusPage": false,
+ "telemetry": true
+ }
+}
diff --git a/go/ql/integration-tests/all-platforms/go/mixed-layout/force_sequential_test_execution b/go/ql/integration-tests/all-platforms/go/mixed-layout/force_sequential_test_execution
new file mode 100644
index 000000000000..47ca99290999
--- /dev/null
+++ b/go/ql/integration-tests/all-platforms/go/mixed-layout/force_sequential_test_execution
@@ -0,0 +1,2 @@
+# go get has been observed to sometimes fail when multiple tests try to simultaneously fetch the same package.
+goget
diff --git a/go/ql/integration-tests/all-platforms/go/mixed-layout/src/module/go.mod b/go/ql/integration-tests/all-platforms/go/mixed-layout/src/module/go.mod
new file mode 100644
index 000000000000..0b8f33b9069d
--- /dev/null
+++ b/go/ql/integration-tests/all-platforms/go/mixed-layout/src/module/go.mod
@@ -0,0 +1,5 @@
+go 1.14
+
+require golang.org/x/net v0.0.0-20200505041828-1ed23360d12c
+
+module module
diff --git a/go/ql/integration-tests/all-platforms/go/mixed-layout/src/module/go.sum b/go/ql/integration-tests/all-platforms/go/mixed-layout/src/module/go.sum
new file mode 100644
index 000000000000..6c5ffa613d0a
--- /dev/null
+++ b/go/ql/integration-tests/all-platforms/go/mixed-layout/src/module/go.sum
@@ -0,0 +1,7 @@
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/net v0.0.0-20200505041828-1ed23360d12c h1:zJ0mtu4jCalhKg6Oaukv6iIkb+cOvDrajDH9DH46Q4M=
+golang.org/x/net v0.0.0-20200505041828-1ed23360d12c/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd h1:xhmwyvizuTgC2qz7ZlMluP20uW+C3Rm0FD/WLDX8884=
+golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
diff --git a/go/ql/integration-tests/all-platforms/go/mixed-layout/src/module/test.go b/go/ql/integration-tests/all-platforms/go/mixed-layout/src/module/test.go
new file mode 100644
index 000000000000..afc86ac3a126
--- /dev/null
+++ b/go/ql/integration-tests/all-platforms/go/mixed-layout/src/module/test.go
@@ -0,0 +1,13 @@
+package subdir
+
+import (
+ "fmt"
+
+ "golang.org/x/net/ipv4"
+)
+
+func test() {
+
+ header := ipv4.Header{}
+ fmt.Print(header.String())
+}
diff --git a/go/ql/integration-tests/all-platforms/go/mixed-layout/src/stray-files/test.go b/go/ql/integration-tests/all-platforms/go/mixed-layout/src/stray-files/test.go
new file mode 100644
index 000000000000..afc86ac3a126
--- /dev/null
+++ b/go/ql/integration-tests/all-platforms/go/mixed-layout/src/stray-files/test.go
@@ -0,0 +1,13 @@
+package subdir
+
+import (
+ "fmt"
+
+ "golang.org/x/net/ipv4"
+)
+
+func test() {
+
+ header := ipv4.Header{}
+ fmt.Print(header.String())
+}
diff --git a/go/ql/integration-tests/all-platforms/go/mixed-layout/src/workspace/go.work b/go/ql/integration-tests/all-platforms/go/mixed-layout/src/workspace/go.work
new file mode 100644
index 000000000000..e7e866fbe27d
--- /dev/null
+++ b/go/ql/integration-tests/all-platforms/go/mixed-layout/src/workspace/go.work
@@ -0,0 +1,3 @@
+go 1.22.0
+
+use ./subdir
diff --git a/go/ql/integration-tests/all-platforms/go/mixed-layout/src/workspace/subdir/go.mod b/go/ql/integration-tests/all-platforms/go/mixed-layout/src/workspace/subdir/go.mod
new file mode 100644
index 000000000000..40a3b330c385
--- /dev/null
+++ b/go/ql/integration-tests/all-platforms/go/mixed-layout/src/workspace/subdir/go.mod
@@ -0,0 +1,5 @@
+go 1.22.0
+
+require golang.org/x/net v0.0.0-20200505041828-1ed23360d12c
+
+module subdir
diff --git a/go/ql/integration-tests/all-platforms/go/mixed-layout/src/workspace/subdir/go.sum b/go/ql/integration-tests/all-platforms/go/mixed-layout/src/workspace/subdir/go.sum
new file mode 100644
index 000000000000..6c5ffa613d0a
--- /dev/null
+++ b/go/ql/integration-tests/all-platforms/go/mixed-layout/src/workspace/subdir/go.sum
@@ -0,0 +1,7 @@
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/net v0.0.0-20200505041828-1ed23360d12c h1:zJ0mtu4jCalhKg6Oaukv6iIkb+cOvDrajDH9DH46Q4M=
+golang.org/x/net v0.0.0-20200505041828-1ed23360d12c/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd h1:xhmwyvizuTgC2qz7ZlMluP20uW+C3Rm0FD/WLDX8884=
+golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
diff --git a/go/ql/integration-tests/all-platforms/go/mixed-layout/src/workspace/subdir/test.go b/go/ql/integration-tests/all-platforms/go/mixed-layout/src/workspace/subdir/test.go
new file mode 100644
index 000000000000..afc86ac3a126
--- /dev/null
+++ b/go/ql/integration-tests/all-platforms/go/mixed-layout/src/workspace/subdir/test.go
@@ -0,0 +1,13 @@
+package subdir
+
+import (
+ "fmt"
+
+ "golang.org/x/net/ipv4"
+)
+
+func test() {
+
+ header := ipv4.Header{}
+ fmt.Print(header.String())
+}
diff --git a/go/ql/integration-tests/all-platforms/go/mixed-layout/test.expected b/go/ql/integration-tests/all-platforms/go/mixed-layout/test.expected
new file mode 100644
index 000000000000..ddd1888562f2
--- /dev/null
+++ b/go/ql/integration-tests/all-platforms/go/mixed-layout/test.expected
@@ -0,0 +1,8 @@
+extractedFiles
+| src/module/go.mod:0:0:0:0 | src/module/go.mod |
+| src/module/test.go:0:0:0:0 | src/module/test.go |
+| src/stray-files/go.mod:0:0:0:0 | src/stray-files/go.mod |
+| src/stray-files/test.go:0:0:0:0 | src/stray-files/test.go |
+| src/workspace/subdir/go.mod:0:0:0:0 | src/workspace/subdir/go.mod |
+| src/workspace/subdir/test.go:0:0:0:0 | src/workspace/subdir/test.go |
+#select
diff --git a/go/ql/integration-tests/all-platforms/go/mixed-layout/test.py b/go/ql/integration-tests/all-platforms/go/mixed-layout/test.py
new file mode 100644
index 000000000000..43c7d1b38e88
--- /dev/null
+++ b/go/ql/integration-tests/all-platforms/go/mixed-layout/test.py
@@ -0,0 +1,18 @@
+import os
+import subprocess
+
+from create_database_utils import *
+from diagnostics_test_utils import *
+
+# Set up a GOPATH relative to this test's root directory;
+# we set os.environ instead of using extra_env because we
+# need it to be set for the call to "go clean -modcache" later
+goPath = os.path.join(os.path.abspath(os.getcwd()), ".go")
+os.environ['GOPATH'] = goPath
+run_codeql_database_create([], lang="go", source="src")
+
+check_diagnostics()
+
+# Clean up the temporary GOPATH to prevent Bazel failures next
+# time the tests are run; see https://github.com/golang/go/issues/27161
+subprocess.call(["go", "clean", "-modcache"])
diff --git a/go/ql/integration-tests/all-platforms/go/mixed-layout/test.ql b/go/ql/integration-tests/all-platforms/go/mixed-layout/test.ql
new file mode 100644
index 000000000000..459a43015602
--- /dev/null
+++ b/go/ql/integration-tests/all-platforms/go/mixed-layout/test.ql
@@ -0,0 +1,8 @@
+import go
+import semmle.go.DiagnosticsReporting
+
+query predicate extractedFiles(File f) { any() }
+
+from string msg, int sev
+where reportableDiagnostics(_, msg, sev)
+select msg, sev
From 40ff75db07a66f4663ba00b7d76ea8d7ff870aa6 Mon Sep 17 00:00:00 2001
From: "Michael B. Gale"
Date: Tue, 5 Mar 2024 14:56:51 +0000
Subject: [PATCH 065/731] Go: Update list of expected files for
`single-go-mod-and-go-files-not-under-it` test
---
.../go/single-go-mod-and-go-files-not-under-it/test.expected | 2 --
1 file changed, 2 deletions(-)
diff --git a/go/ql/integration-tests/all-platforms/go/single-go-mod-and-go-files-not-under-it/test.expected b/go/ql/integration-tests/all-platforms/go/single-go-mod-and-go-files-not-under-it/test.expected
index 957d2f845a41..66ba3ef588fd 100644
--- a/go/ql/integration-tests/all-platforms/go/single-go-mod-and-go-files-not-under-it/test.expected
+++ b/go/ql/integration-tests/all-platforms/go/single-go-mod-and-go-files-not-under-it/test.expected
@@ -1,6 +1,4 @@
extractedFiles
-| src/go.mod:0:0:0:0 | src/go.mod |
-| src/main.go:0:0:0:0 | src/main.go |
| src/subdir/go.mod:0:0:0:0 | src/subdir/go.mod |
| src/subdir/subsubdir/add.go:0:0:0:0 | src/subdir/subsubdir/add.go |
| src/subdir/test.go:0:0:0:0 | src/subdir/test.go |
From 967963a6534b1fcdda3d4f5b6960c29346516303 Mon Sep 17 00:00:00 2001
From: Angela P Wen
Date: Tue, 5 Mar 2024 08:53:33 -0800
Subject: [PATCH 066/731] Revert "Release preparation for version 2.16.4"
---
cpp/ql/lib/CHANGELOG.md | 6 ------
....12.7.md => 2024-02-26-ir-named-destructors.md} | 9 ++++-----
cpp/ql/lib/codeql-pack.release.yml | 2 +-
cpp/ql/lib/qlpack.yml | 2 +-
cpp/ql/src/CHANGELOG.md | 7 -------
...=> 2024-02-16-modelled-functions-block-flow.md} | 8 +++-----
.../2024-02-29-non-constant-format-path-query.md | 4 ++++
cpp/ql/src/codeql-pack.release.yml | 2 +-
cpp/ql/src/qlpack.yml | 2 +-
csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md | 4 ----
.../Solorigate/lib/change-notes/released/1.7.10.md | 3 ---
.../Solorigate/lib/codeql-pack.release.yml | 2 +-
csharp/ql/campaigns/Solorigate/lib/qlpack.yml | 2 +-
csharp/ql/campaigns/Solorigate/src/CHANGELOG.md | 4 ----
.../Solorigate/src/change-notes/released/1.7.10.md | 3 ---
.../Solorigate/src/codeql-pack.release.yml | 2 +-
csharp/ql/campaigns/Solorigate/src/qlpack.yml | 2 +-
csharp/ql/lib/CHANGELOG.md | 14 --------------
.../change-notes/2024-02-21-getonly-properties.md | 4 ++++
.../ql/lib/change-notes/2024-02-22-no-db-stats.md | 4 ++++
.../change-notes/2024-02-23-compiler-generated.md | 4 ++++
.../2024-02-26-variable-capture-flow.md | 4 ++++
.../2024-02-28-experimental-attribute.md | 4 ++++
.../2024-02-28-refreadonly-parameter.md | 4 ++++
csharp/ql/lib/change-notes/released/0.8.10.md | 13 -------------
csharp/ql/lib/codeql-pack.release.yml | 2 +-
csharp/ql/lib/qlpack.yml | 2 +-
csharp/ql/src/CHANGELOG.md | 6 ------
.../0.8.10.md => 2024-02-06-threat-models.md} | 9 ++++-----
csharp/ql/src/codeql-pack.release.yml | 2 +-
csharp/ql/src/qlpack.yml | 2 +-
go/ql/consistency-queries/CHANGELOG.md | 4 ----
.../change-notes/released/0.0.9.md | 3 ---
go/ql/consistency-queries/codeql-pack.release.yml | 2 +-
go/ql/consistency-queries/qlpack.yml | 2 +-
go/ql/lib/CHANGELOG.md | 11 -----------
.../lib/change-notes/2024-02-14-range-map-read.md | 4 ++++
...0.7.10.md => 2024-03-04-autobuilder-changes.md} | 11 +++--------
go/ql/lib/codeql-pack.release.yml | 2 +-
go/ql/lib/qlpack.yml | 2 +-
go/ql/src/CHANGELOG.md | 4 ----
go/ql/src/change-notes/released/0.7.10.md | 3 ---
go/ql/src/codeql-pack.release.yml | 2 +-
go/ql/src/qlpack.yml | 2 +-
java/ql/automodel/src/CHANGELOG.md | 4 ----
.../automodel/src/change-notes/released/0.0.17.md | 3 ---
java/ql/automodel/src/codeql-pack.release.yml | 2 +-
java/ql/automodel/src/qlpack.yml | 2 +-
java/ql/lib/CHANGELOG.md | 11 -----------
.../change-notes/2024-02-23-widget-flowsteps.md | 4 ++++
java/ql/lib/change-notes/2024-02-27-error-types.md | 4 ++++
.../lib/change-notes/2024-02-27-mvnw-versions.md | 4 ++++
java/ql/lib/change-notes/released/0.8.10.md | 10 ----------
java/ql/lib/codeql-pack.release.yml | 2 +-
java/ql/lib/qlpack.yml | 2 +-
java/ql/src/CHANGELOG.md | 10 ----------
.../2024-02-12-android-insecure-keys.md | 4 ++++
...3-04-sensitive-log-remove-null-from-sources.md} | 11 +++--------
java/ql/src/codeql-pack.release.yml | 2 +-
java/ql/src/qlpack.yml | 2 +-
javascript/ql/lib/CHANGELOG.md | 4 ----
javascript/ql/lib/change-notes/released/0.8.10.md | 3 ---
javascript/ql/lib/codeql-pack.release.yml | 2 +-
javascript/ql/lib/qlpack.yml | 2 +-
javascript/ql/src/CHANGELOG.md | 4 ----
javascript/ql/src/change-notes/released/0.8.10.md | 3 ---
javascript/ql/src/codeql-pack.release.yml | 2 +-
javascript/ql/src/qlpack.yml | 2 +-
misc/suite-helpers/CHANGELOG.md | 4 ----
misc/suite-helpers/change-notes/released/0.7.10.md | 3 ---
misc/suite-helpers/codeql-pack.release.yml | 2 +-
misc/suite-helpers/qlpack.yml | 2 +-
python/ql/lib/CHANGELOG.md | 7 -------
.../2024-02-28-iterable-unpacking-module-scope.md | 4 ++++
....11.10.md => 2024-03-01-dict-update-content.md} | 8 +++-----
python/ql/lib/codeql-pack.release.yml | 2 +-
python/ql/lib/qlpack.yml | 2 +-
python/ql/src/CHANGELOG.md | 6 ------
.../0.9.10.md => 2024-03-04-nosql-injection.md} | 7 +++----
python/ql/src/codeql-pack.release.yml | 2 +-
python/ql/src/qlpack.yml | 2 +-
ruby/ql/lib/CHANGELOG.md | 9 ---------
...2024-02-15-activerecord_connection_sql_sinks.md | 4 ++++
.../2024-02-20-activerecord-sql-sink-arguments.md | 4 ++++
.../lib/change-notes/2024-02-26-arel-sqlliteral.md | 4 ++++
.../lib/change-notes/2024-02-29-i18n-translate.md | 4 ++++
ruby/ql/lib/change-notes/released/0.8.10.md | 8 --------
ruby/ql/lib/codeql-pack.release.yml | 2 +-
ruby/ql/lib/qlpack.yml | 2 +-
ruby/ql/src/CHANGELOG.md | 7 -------
.../2024-02-13-rails-more-request-sources.md | 4 ++++
...d => 2024-03-01-method-code-injection-sinks.md} | 10 ++++------
ruby/ql/src/codeql-pack.release.yml | 2 +-
ruby/ql/src/qlpack.yml | 2 +-
shared/controlflow/CHANGELOG.md | 4 ----
shared/controlflow/change-notes/released/0.1.10.md | 3 ---
shared/controlflow/codeql-pack.release.yml | 2 +-
shared/controlflow/qlpack.yml | 2 +-
shared/dataflow/CHANGELOG.md | 4 ----
shared/dataflow/change-notes/released/0.2.1.md | 3 ---
shared/dataflow/codeql-pack.release.yml | 2 +-
shared/dataflow/qlpack.yml | 2 +-
shared/mad/CHANGELOG.md | 4 ----
shared/mad/change-notes/released/0.2.10.md | 3 ---
shared/mad/codeql-pack.release.yml | 2 +-
shared/mad/qlpack.yml | 2 +-
shared/rangeanalysis/CHANGELOG.md | 4 ----
.../rangeanalysis/change-notes/released/0.0.9.md | 3 ---
shared/rangeanalysis/codeql-pack.release.yml | 2 +-
shared/rangeanalysis/qlpack.yml | 2 +-
shared/regex/CHANGELOG.md | 4 ----
shared/regex/change-notes/released/0.2.10.md | 3 ---
shared/regex/codeql-pack.release.yml | 2 +-
shared/regex/qlpack.yml | 2 +-
shared/ssa/CHANGELOG.md | 4 ----
shared/ssa/change-notes/released/0.2.10.md | 3 ---
shared/ssa/codeql-pack.release.yml | 2 +-
shared/ssa/qlpack.yml | 2 +-
shared/threat-models/CHANGELOG.md | 4 ----
.../threat-models/change-notes/released/0.0.9.md | 3 ---
shared/threat-models/codeql-pack.release.yml | 2 +-
shared/threat-models/qlpack.yml | 2 +-
shared/tutorial/CHANGELOG.md | 4 ----
shared/tutorial/change-notes/released/0.2.10.md | 3 ---
shared/tutorial/codeql-pack.release.yml | 2 +-
shared/tutorial/qlpack.yml | 2 +-
shared/typetracking/CHANGELOG.md | 4 ----
.../typetracking/change-notes/released/0.2.10.md | 3 ---
shared/typetracking/codeql-pack.release.yml | 2 +-
shared/typetracking/qlpack.yml | 2 +-
shared/typos/CHANGELOG.md | 4 ----
shared/typos/change-notes/released/0.2.10.md | 3 ---
shared/typos/codeql-pack.release.yml | 2 +-
shared/typos/qlpack.yml | 2 +-
shared/util/CHANGELOG.md | 4 ----
shared/util/change-notes/released/0.2.10.md | 3 ---
shared/util/codeql-pack.release.yml | 2 +-
shared/util/qlpack.yml | 2 +-
shared/yaml/CHANGELOG.md | 4 ----
shared/yaml/change-notes/released/0.2.10.md | 3 ---
shared/yaml/codeql-pack.release.yml | 2 +-
shared/yaml/qlpack.yml | 2 +-
swift/ql/lib/CHANGELOG.md | 6 ------
.../0.3.10.md => 2024-02-22-extension-patch.md} | 7 +++----
swift/ql/lib/codeql-pack.release.yml | 2 +-
swift/ql/lib/qlpack.yml | 2 +-
swift/ql/src/CHANGELOG.md | 4 ----
swift/ql/src/change-notes/released/0.3.10.md | 3 ---
swift/ql/src/codeql-pack.release.yml | 2 +-
swift/ql/src/qlpack.yml | 2 +-
150 files changed, 168 insertions(+), 394 deletions(-)
rename cpp/ql/lib/change-notes/{released/0.12.7.md => 2024-02-26-ir-named-destructors.md} (54%)
rename cpp/ql/src/change-notes/{released/0.9.6.md => 2024-02-16-modelled-functions-block-flow.md} (77%)
create mode 100644 cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md
delete mode 100644 csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md
delete mode 100644 csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md
create mode 100644 csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md
create mode 100644 csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md
create mode 100644 csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md
create mode 100644 csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md
create mode 100644 csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md
create mode 100644 csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md
delete mode 100644 csharp/ql/lib/change-notes/released/0.8.10.md
rename csharp/ql/src/change-notes/{released/0.8.10.md => 2024-02-06-threat-models.md} (88%)
delete mode 100644 go/ql/consistency-queries/change-notes/released/0.0.9.md
create mode 100644 go/ql/lib/change-notes/2024-02-14-range-map-read.md
rename go/ql/lib/change-notes/{released/0.7.10.md => 2024-03-04-autobuilder-changes.md} (68%)
delete mode 100644 go/ql/src/change-notes/released/0.7.10.md
delete mode 100644 java/ql/automodel/src/change-notes/released/0.0.17.md
create mode 100644 java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md
create mode 100644 java/ql/lib/change-notes/2024-02-27-error-types.md
create mode 100644 java/ql/lib/change-notes/2024-02-27-mvnw-versions.md
delete mode 100644 java/ql/lib/change-notes/released/0.8.10.md
create mode 100644 java/ql/src/change-notes/2024-02-12-android-insecure-keys.md
rename java/ql/src/change-notes/{released/0.8.10.md => 2024-03-04-sensitive-log-remove-null-from-sources.md} (54%)
delete mode 100644 javascript/ql/lib/change-notes/released/0.8.10.md
delete mode 100644 javascript/ql/src/change-notes/released/0.8.10.md
delete mode 100644 misc/suite-helpers/change-notes/released/0.7.10.md
create mode 100644 python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md
rename python/ql/lib/change-notes/{released/0.11.10.md => 2024-03-01-dict-update-content.md} (52%)
rename python/ql/src/change-notes/{released/0.9.10.md => 2024-03-04-nosql-injection.md} (81%)
create mode 100644 ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md
create mode 100644 ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md
create mode 100644 ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
create mode 100644 ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
delete mode 100644 ruby/ql/lib/change-notes/released/0.8.10.md
create mode 100644 ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md
rename ruby/ql/src/change-notes/{released/0.8.10.md => 2024-03-01-method-code-injection-sinks.md} (51%)
delete mode 100644 shared/controlflow/change-notes/released/0.1.10.md
delete mode 100644 shared/dataflow/change-notes/released/0.2.1.md
delete mode 100644 shared/mad/change-notes/released/0.2.10.md
delete mode 100644 shared/rangeanalysis/change-notes/released/0.0.9.md
delete mode 100644 shared/regex/change-notes/released/0.2.10.md
delete mode 100644 shared/ssa/change-notes/released/0.2.10.md
delete mode 100644 shared/threat-models/change-notes/released/0.0.9.md
delete mode 100644 shared/tutorial/change-notes/released/0.2.10.md
delete mode 100644 shared/typetracking/change-notes/released/0.2.10.md
delete mode 100644 shared/typos/change-notes/released/0.2.10.md
delete mode 100644 shared/util/change-notes/released/0.2.10.md
delete mode 100644 shared/yaml/change-notes/released/0.2.10.md
rename swift/ql/lib/change-notes/{released/0.3.10.md => 2024-02-22-extension-patch.md} (83%)
delete mode 100644 swift/ql/src/change-notes/released/0.3.10.md
diff --git a/cpp/ql/lib/CHANGELOG.md b/cpp/ql/lib/CHANGELOG.md
index e1c0dfbecd9a..b3091ec37d8f 100644
--- a/cpp/ql/lib/CHANGELOG.md
+++ b/cpp/ql/lib/CHANGELOG.md
@@ -1,9 +1,3 @@
-## 0.12.7
-
-### Minor Analysis Improvements
-
-* Added destructors for named objects to the intermediate representation.
-
## 0.12.6
### New Features
diff --git a/cpp/ql/lib/change-notes/released/0.12.7.md b/cpp/ql/lib/change-notes/2024-02-26-ir-named-destructors.md
similarity index 54%
rename from cpp/ql/lib/change-notes/released/0.12.7.md
rename to cpp/ql/lib/change-notes/2024-02-26-ir-named-destructors.md
index 856a8b665c74..4e35decaf8ed 100644
--- a/cpp/ql/lib/change-notes/released/0.12.7.md
+++ b/cpp/ql/lib/change-notes/2024-02-26-ir-named-destructors.md
@@ -1,5 +1,4 @@
-## 0.12.7
-
-### Minor Analysis Improvements
-
-* Added destructors for named objects to the intermediate representation.
+---
+category: minorAnalysis
+---
+* Added destructors for named objects to the intermediate representation.
\ No newline at end of file
diff --git a/cpp/ql/lib/codeql-pack.release.yml b/cpp/ql/lib/codeql-pack.release.yml
index 20419e9c6100..170a312c1047 100644
--- a/cpp/ql/lib/codeql-pack.release.yml
+++ b/cpp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.12.7
+lastReleaseVersion: 0.12.6
diff --git a/cpp/ql/lib/qlpack.yml b/cpp/ql/lib/qlpack.yml
index 3bb9229bf94d..8e201fff5943 100644
--- a/cpp/ql/lib/qlpack.yml
+++ b/cpp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-all
-version: 0.12.7
+version: 0.12.7-dev
groups: cpp
dbscheme: semmlecode.cpp.dbscheme
extractor: cpp
diff --git a/cpp/ql/src/CHANGELOG.md b/cpp/ql/src/CHANGELOG.md
index f6acd424bb05..ffcd73ff5d72 100644
--- a/cpp/ql/src/CHANGELOG.md
+++ b/cpp/ql/src/CHANGELOG.md
@@ -1,10 +1,3 @@
-## 0.9.6
-
-### Minor Analysis Improvements
-
-* The "non-constant format string" query (`cpp/non-constant-format`) has been converted to a `path-problem` query.
-* The new C/C++ dataflow and taint-tracking libraries (`semmle.code.cpp.dataflow.new.DataFlow` and `semmle.code.cpp.dataflow.new.TaintTracking`) now implicitly assume that dataflow and taint modelled via `DataFlowFunction` and `TaintFunction` always fully overwrite their buffers and thus act as flow barriers. As a result, many dataflow and taint-tracking queries now produce fewer false positives. To remove this assumption and go back to the previous behavior for a given model, one can override the new `isPartialWrite` predicate.
-
## 0.9.5
### Minor Analysis Improvements
diff --git a/cpp/ql/src/change-notes/released/0.9.6.md b/cpp/ql/src/change-notes/2024-02-16-modelled-functions-block-flow.md
similarity index 77%
rename from cpp/ql/src/change-notes/released/0.9.6.md
rename to cpp/ql/src/change-notes/2024-02-16-modelled-functions-block-flow.md
index 0c85f3f9f0f0..d6ef3c3e0569 100644
--- a/cpp/ql/src/change-notes/released/0.9.6.md
+++ b/cpp/ql/src/change-notes/2024-02-16-modelled-functions-block-flow.md
@@ -1,6 +1,4 @@
-## 0.9.6
-
-### Minor Analysis Improvements
-
-* The "non-constant format string" query (`cpp/non-constant-format`) has been converted to a `path-problem` query.
+---
+category: minorAnalysis
+---
* The new C/C++ dataflow and taint-tracking libraries (`semmle.code.cpp.dataflow.new.DataFlow` and `semmle.code.cpp.dataflow.new.TaintTracking`) now implicitly assume that dataflow and taint modelled via `DataFlowFunction` and `TaintFunction` always fully overwrite their buffers and thus act as flow barriers. As a result, many dataflow and taint-tracking queries now produce fewer false positives. To remove this assumption and go back to the previous behavior for a given model, one can override the new `isPartialWrite` predicate.
diff --git a/cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md b/cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md
new file mode 100644
index 000000000000..2e5933a61e86
--- /dev/null
+++ b/cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The "non-constant format string" query (`cpp/non-constant-format`) has been converted to a `path-problem` query.
\ No newline at end of file
diff --git a/cpp/ql/src/codeql-pack.release.yml b/cpp/ql/src/codeql-pack.release.yml
index 19139c132b2d..460240feafff 100644
--- a/cpp/ql/src/codeql-pack.release.yml
+++ b/cpp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.9.6
+lastReleaseVersion: 0.9.5
diff --git a/cpp/ql/src/qlpack.yml b/cpp/ql/src/qlpack.yml
index 4052647bb97f..31bd20166b2b 100644
--- a/cpp/ql/src/qlpack.yml
+++ b/cpp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-queries
-version: 0.9.6
+version: 0.9.6-dev
groups:
- cpp
- queries
diff --git a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
index 82eacfc84f70..190b83b0f25a 100644
--- a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
+++ b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 1.7.10
-
-No user-facing changes.
-
## 1.7.9
No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md
deleted file mode 100644
index 8e8007d8475f..000000000000
--- a/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 1.7.10
-
-No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
index 31c7fe07020b..678da6bc37e9 100644
--- a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.7.10
+lastReleaseVersion: 1.7.9
diff --git a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
index ee993bed0c91..7e643b0fac33 100644
--- a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-all
-version: 1.7.10
+version: 1.7.10-dev
groups:
- csharp
- solorigate
diff --git a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
index 82eacfc84f70..190b83b0f25a 100644
--- a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
+++ b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 1.7.10
-
-No user-facing changes.
-
## 1.7.9
No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md
deleted file mode 100644
index 8e8007d8475f..000000000000
--- a/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 1.7.10
-
-No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
index 31c7fe07020b..678da6bc37e9 100644
--- a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
+++ b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.7.10
+lastReleaseVersion: 1.7.9
diff --git a/csharp/ql/campaigns/Solorigate/src/qlpack.yml b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
index 1f421754fc82..8654bbfd0312 100644
--- a/csharp/ql/campaigns/Solorigate/src/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-queries
-version: 1.7.10
+version: 1.7.10-dev
groups:
- csharp
- solorigate
diff --git a/csharp/ql/lib/CHANGELOG.md b/csharp/ql/lib/CHANGELOG.md
index 16cc14259e19..95fd64c52704 100644
--- a/csharp/ql/lib/CHANGELOG.md
+++ b/csharp/ql/lib/CHANGELOG.md
@@ -1,17 +1,3 @@
-## 0.8.10
-
-### Major Analysis Improvements
-
-* Improved support for flow through captured variables that properly adheres to inter-procedural control flow.
-* We no longer make use of CodeQL database stats, which may affect join-orders in custom queries. It is therefore recommended to test performance of custom queries after upgrading to this version.
-
-### Minor Analysis Improvements
-
-* C# 12: Add QL library support (`ExperimentalAttribute`) for the experimental attribute.
-* C# 12: Add extractor and QL library support for `ref readonly` parameters.
-* C#: The table `expr_compiler_generated` has been deleted and its content has been added to `compiler_generated`.
-* Data flow via get only properties like `public object Obj { get; }` is now captured by the data flow library.
-
## 0.8.9
### Minor Analysis Improvements
diff --git a/csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md b/csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md
new file mode 100644
index 000000000000..6bb8e99c71ef
--- /dev/null
+++ b/csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Data flow via get only properties like `public object Obj { get; }` is now captured by the data flow library.
diff --git a/csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md b/csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md
new file mode 100644
index 000000000000..d6ffbd523ac6
--- /dev/null
+++ b/csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md
@@ -0,0 +1,4 @@
+---
+category: majorAnalysis
+---
+* We no longer make use of CodeQL database stats, which may affect join-orders in custom queries. It is therefore recommended to test performance of custom queries after upgrading to this version.
diff --git a/csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md b/csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md
new file mode 100644
index 000000000000..9b1739b9b6da
--- /dev/null
+++ b/csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* C#: The table `expr_compiler_generated` has been deleted and its content has been added to `compiler_generated`.
diff --git a/csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md b/csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md
new file mode 100644
index 000000000000..66ab65083dc3
--- /dev/null
+++ b/csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md
@@ -0,0 +1,4 @@
+---
+category: majorAnalysis
+---
+* Improved support for flow through captured variables that properly adheres to inter-procedural control flow.
\ No newline at end of file
diff --git a/csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md b/csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md
new file mode 100644
index 000000000000..8749c790954e
--- /dev/null
+++ b/csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* C# 12: Add QL library support (`ExperimentalAttribute`) for the experimental attribute.
diff --git a/csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md b/csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md
new file mode 100644
index 000000000000..586b5341d293
--- /dev/null
+++ b/csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* C# 12: Add extractor and QL library support for `ref readonly` parameters.
diff --git a/csharp/ql/lib/change-notes/released/0.8.10.md b/csharp/ql/lib/change-notes/released/0.8.10.md
deleted file mode 100644
index f591ddc5b21a..000000000000
--- a/csharp/ql/lib/change-notes/released/0.8.10.md
+++ /dev/null
@@ -1,13 +0,0 @@
-## 0.8.10
-
-### Major Analysis Improvements
-
-* Improved support for flow through captured variables that properly adheres to inter-procedural control flow.
-* We no longer make use of CodeQL database stats, which may affect join-orders in custom queries. It is therefore recommended to test performance of custom queries after upgrading to this version.
-
-### Minor Analysis Improvements
-
-* C# 12: Add QL library support (`ExperimentalAttribute`) for the experimental attribute.
-* C# 12: Add extractor and QL library support for `ref readonly` parameters.
-* C#: The table `expr_compiler_generated` has been deleted and its content has been added to `compiler_generated`.
-* Data flow via get only properties like `public object Obj { get; }` is now captured by the data flow library.
diff --git a/csharp/ql/lib/codeql-pack.release.yml b/csharp/ql/lib/codeql-pack.release.yml
index 0521f0f75fad..5290c29b7fe7 100644
--- a/csharp/ql/lib/codeql-pack.release.yml
+++ b/csharp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.10
+lastReleaseVersion: 0.8.9
diff --git a/csharp/ql/lib/qlpack.yml b/csharp/ql/lib/qlpack.yml
index 93c5c1120a24..d75ea3c63207 100644
--- a/csharp/ql/lib/qlpack.yml
+++ b/csharp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-all
-version: 0.8.10
+version: 0.8.10-dev
groups: csharp
dbscheme: semmlecode.csharp.dbscheme
extractor: csharp
diff --git a/csharp/ql/src/CHANGELOG.md b/csharp/ql/src/CHANGELOG.md
index 46c939e5cee1..9fe1609363fc 100644
--- a/csharp/ql/src/CHANGELOG.md
+++ b/csharp/ql/src/CHANGELOG.md
@@ -1,9 +1,3 @@
-## 0.8.10
-
-### Minor Analysis Improvements
-
-* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. The changed queries are `cs/code-injection`, `cs/command-line-injection`, `cs/user-controlled-bypass`, `cs/count-untrusted-data-external-api`, `cs/untrusted-data-to-external-api`, `cs/ldap-injection`, `cs/log-forging`, `cs/xml/missing-validation`, `cs/redos`, `cs/regex-injection`, `cs/resource-injection`, `cs/sql-injection`, `cs/path-injection`, `cs/unsafe-deserialization-untrusted-input`, `cs/web/unvalidated-url-redirection`, `cs/xml/insecure-dtd-handling`, `cs/xml/xpath-injection`, `cs/web/xss`, and `cs/uncontrolled-format-string`.
-
## 0.8.9
### Minor Analysis Improvements
diff --git a/csharp/ql/src/change-notes/released/0.8.10.md b/csharp/ql/src/change-notes/2024-02-06-threat-models.md
similarity index 88%
rename from csharp/ql/src/change-notes/released/0.8.10.md
rename to csharp/ql/src/change-notes/2024-02-06-threat-models.md
index 702161c3d28f..69ac4e4dc17a 100644
--- a/csharp/ql/src/change-notes/released/0.8.10.md
+++ b/csharp/ql/src/change-notes/2024-02-06-threat-models.md
@@ -1,5 +1,4 @@
-## 0.8.10
-
-### Minor Analysis Improvements
-
-* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. The changed queries are `cs/code-injection`, `cs/command-line-injection`, `cs/user-controlled-bypass`, `cs/count-untrusted-data-external-api`, `cs/untrusted-data-to-external-api`, `cs/ldap-injection`, `cs/log-forging`, `cs/xml/missing-validation`, `cs/redos`, `cs/regex-injection`, `cs/resource-injection`, `cs/sql-injection`, `cs/path-injection`, `cs/unsafe-deserialization-untrusted-input`, `cs/web/unvalidated-url-redirection`, `cs/xml/insecure-dtd-handling`, `cs/xml/xpath-injection`, `cs/web/xss`, and `cs/uncontrolled-format-string`.
+---
+category: minorAnalysis
+---
+* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. The changed queries are `cs/code-injection`, `cs/command-line-injection`, `cs/user-controlled-bypass`, `cs/count-untrusted-data-external-api`, `cs/untrusted-data-to-external-api`, `cs/ldap-injection`, `cs/log-forging`, `cs/xml/missing-validation`, `cs/redos`, `cs/regex-injection`, `cs/resource-injection`, `cs/sql-injection`, `cs/path-injection`, `cs/unsafe-deserialization-untrusted-input`, `cs/web/unvalidated-url-redirection`, `cs/xml/insecure-dtd-handling`, `cs/xml/xpath-injection`, `cs/web/xss`, and `cs/uncontrolled-format-string`.
\ No newline at end of file
diff --git a/csharp/ql/src/codeql-pack.release.yml b/csharp/ql/src/codeql-pack.release.yml
index 0521f0f75fad..5290c29b7fe7 100644
--- a/csharp/ql/src/codeql-pack.release.yml
+++ b/csharp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.10
+lastReleaseVersion: 0.8.9
diff --git a/csharp/ql/src/qlpack.yml b/csharp/ql/src/qlpack.yml
index 46384094b19e..9ee23cc73078 100644
--- a/csharp/ql/src/qlpack.yml
+++ b/csharp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-queries
-version: 0.8.10
+version: 0.8.10-dev
groups:
- csharp
- queries
diff --git a/go/ql/consistency-queries/CHANGELOG.md b/go/ql/consistency-queries/CHANGELOG.md
index a59e560c4155..fba2a8703562 100644
--- a/go/ql/consistency-queries/CHANGELOG.md
+++ b/go/ql/consistency-queries/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.0.9
-
-No user-facing changes.
-
## 0.0.8
No user-facing changes.
diff --git a/go/ql/consistency-queries/change-notes/released/0.0.9.md b/go/ql/consistency-queries/change-notes/released/0.0.9.md
deleted file mode 100644
index c9e17c6d6cf2..000000000000
--- a/go/ql/consistency-queries/change-notes/released/0.0.9.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.0.9
-
-No user-facing changes.
diff --git a/go/ql/consistency-queries/codeql-pack.release.yml b/go/ql/consistency-queries/codeql-pack.release.yml
index ecdd64fbab86..58fdc6b45deb 100644
--- a/go/ql/consistency-queries/codeql-pack.release.yml
+++ b/go/ql/consistency-queries/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.9
+lastReleaseVersion: 0.0.8
diff --git a/go/ql/consistency-queries/qlpack.yml b/go/ql/consistency-queries/qlpack.yml
index d5a2fbee5f19..b574796b9954 100644
--- a/go/ql/consistency-queries/qlpack.yml
+++ b/go/ql/consistency-queries/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql-go-consistency-queries
-version: 0.0.9
+version: 0.0.9-dev
groups:
- go
- queries
diff --git a/go/ql/lib/CHANGELOG.md b/go/ql/lib/CHANGELOG.md
index fee5fd37a267..65a2376217b1 100644
--- a/go/ql/lib/CHANGELOG.md
+++ b/go/ql/lib/CHANGELOG.md
@@ -1,14 +1,3 @@
-## 0.7.10
-
-### Major Analysis Improvements
-
-* We have significantly improved the Go autobuilder to understand a greater range of project layouts, which allows Go source files to be analysed that could previously not be processed.
-* Go 1.22 has been included in the range of supported Go versions.
-
-### Bug Fixes
-
-* Fixed dataflow out of a `map` using a `range` statement.
-
## 0.7.9
No user-facing changes.
diff --git a/go/ql/lib/change-notes/2024-02-14-range-map-read.md b/go/ql/lib/change-notes/2024-02-14-range-map-read.md
new file mode 100644
index 000000000000..ea45737a72ea
--- /dev/null
+++ b/go/ql/lib/change-notes/2024-02-14-range-map-read.md
@@ -0,0 +1,4 @@
+---
+category: fix
+---
+* Fixed dataflow out of a `map` using a `range` statement.
diff --git a/go/ql/lib/change-notes/released/0.7.10.md b/go/ql/lib/change-notes/2024-03-04-autobuilder-changes.md
similarity index 68%
rename from go/ql/lib/change-notes/released/0.7.10.md
rename to go/ql/lib/change-notes/2024-03-04-autobuilder-changes.md
index 55954f8a3945..0442a571029f 100644
--- a/go/ql/lib/change-notes/released/0.7.10.md
+++ b/go/ql/lib/change-notes/2024-03-04-autobuilder-changes.md
@@ -1,10 +1,5 @@
-## 0.7.10
-
-### Major Analysis Improvements
-
+---
+category: majorAnalysis
+---
* We have significantly improved the Go autobuilder to understand a greater range of project layouts, which allows Go source files to be analysed that could previously not be processed.
* Go 1.22 has been included in the range of supported Go versions.
-
-### Bug Fixes
-
-* Fixed dataflow out of a `map` using a `range` statement.
diff --git a/go/ql/lib/codeql-pack.release.yml b/go/ql/lib/codeql-pack.release.yml
index 675185672974..576395f3405e 100644
--- a/go/ql/lib/codeql-pack.release.yml
+++ b/go/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.7.10
+lastReleaseVersion: 0.7.9
diff --git a/go/ql/lib/qlpack.yml b/go/ql/lib/qlpack.yml
index 8cc190fa880a..f21e478efa68 100644
--- a/go/ql/lib/qlpack.yml
+++ b/go/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-all
-version: 0.7.10
+version: 0.7.10-dev
groups: go
dbscheme: go.dbscheme
extractor: go
diff --git a/go/ql/src/CHANGELOG.md b/go/ql/src/CHANGELOG.md
index 24e38b9890e1..d95165a3a34e 100644
--- a/go/ql/src/CHANGELOG.md
+++ b/go/ql/src/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.7.10
-
-No user-facing changes.
-
## 0.7.9
### New Queries
diff --git a/go/ql/src/change-notes/released/0.7.10.md b/go/ql/src/change-notes/released/0.7.10.md
deleted file mode 100644
index 989c5b8f6823..000000000000
--- a/go/ql/src/change-notes/released/0.7.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.7.10
-
-No user-facing changes.
diff --git a/go/ql/src/codeql-pack.release.yml b/go/ql/src/codeql-pack.release.yml
index 675185672974..576395f3405e 100644
--- a/go/ql/src/codeql-pack.release.yml
+++ b/go/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.7.10
+lastReleaseVersion: 0.7.9
diff --git a/go/ql/src/qlpack.yml b/go/ql/src/qlpack.yml
index 4ded3a52f63e..d91cab596127 100644
--- a/go/ql/src/qlpack.yml
+++ b/go/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-queries
-version: 0.7.10
+version: 0.7.10-dev
groups:
- go
- queries
diff --git a/java/ql/automodel/src/CHANGELOG.md b/java/ql/automodel/src/CHANGELOG.md
index c3282c773a9d..4a3c54adb385 100644
--- a/java/ql/automodel/src/CHANGELOG.md
+++ b/java/ql/automodel/src/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.0.17
-
-No user-facing changes.
-
## 0.0.16
No user-facing changes.
diff --git a/java/ql/automodel/src/change-notes/released/0.0.17.md b/java/ql/automodel/src/change-notes/released/0.0.17.md
deleted file mode 100644
index 62cc89030a62..000000000000
--- a/java/ql/automodel/src/change-notes/released/0.0.17.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.0.17
-
-No user-facing changes.
diff --git a/java/ql/automodel/src/codeql-pack.release.yml b/java/ql/automodel/src/codeql-pack.release.yml
index cbc3d3cd4934..a49f7be4cff3 100644
--- a/java/ql/automodel/src/codeql-pack.release.yml
+++ b/java/ql/automodel/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.17
+lastReleaseVersion: 0.0.16
diff --git a/java/ql/automodel/src/qlpack.yml b/java/ql/automodel/src/qlpack.yml
index 59fab0cdcc53..898239be0989 100644
--- a/java/ql/automodel/src/qlpack.yml
+++ b/java/ql/automodel/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-automodel-queries
-version: 0.0.17
+version: 0.0.17-dev
groups:
- java
- automodel
diff --git a/java/ql/lib/CHANGELOG.md b/java/ql/lib/CHANGELOG.md
index 2a02ccee6abb..d369cbdc9318 100644
--- a/java/ql/lib/CHANGELOG.md
+++ b/java/ql/lib/CHANGELOG.md
@@ -1,14 +1,3 @@
-## 0.8.10
-
-### Minor Analysis Improvements
-
-* Java expressions with erroneous types (e.g. the result of a call whose callee couldn't be resolved during extraction) are now given a CodeQL `ErrorType` more often.
-
-### Bug Fixes
-
-* Fixed the Java autobuilder overriding the version of Maven used by a project when the Maven wrapper `mvnw` is in use and the `maven-wrapper.jar` file is not present in the repository.
-* Some flow steps related to `android.text.Editable.toString` that were accidentally disabled have been re-enabled.
-
## 0.8.9
### Deprecated APIs
diff --git a/java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md b/java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md
new file mode 100644
index 000000000000..eb560fba07da
--- /dev/null
+++ b/java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md
@@ -0,0 +1,4 @@
+---
+category: fix
+---
+* Some flow steps related to `android.text.Editable.toString` that were accidentally disabled have been re-enabled.
diff --git a/java/ql/lib/change-notes/2024-02-27-error-types.md b/java/ql/lib/change-notes/2024-02-27-error-types.md
new file mode 100644
index 000000000000..cdc6d7620aa8
--- /dev/null
+++ b/java/ql/lib/change-notes/2024-02-27-error-types.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Java expressions with erroneous types (e.g. the result of a call whose callee couldn't be resolved during extraction) are now given a CodeQL `ErrorType` more often.
diff --git a/java/ql/lib/change-notes/2024-02-27-mvnw-versions.md b/java/ql/lib/change-notes/2024-02-27-mvnw-versions.md
new file mode 100644
index 000000000000..a0227088ae97
--- /dev/null
+++ b/java/ql/lib/change-notes/2024-02-27-mvnw-versions.md
@@ -0,0 +1,4 @@
+---
+category: fix
+---
+* Fixed the Java autobuilder overriding the version of Maven used by a project when the Maven wrapper `mvnw` is in use and the `maven-wrapper.jar` file is not present in the repository.
diff --git a/java/ql/lib/change-notes/released/0.8.10.md b/java/ql/lib/change-notes/released/0.8.10.md
deleted file mode 100644
index b45f14bf347a..000000000000
--- a/java/ql/lib/change-notes/released/0.8.10.md
+++ /dev/null
@@ -1,10 +0,0 @@
-## 0.8.10
-
-### Minor Analysis Improvements
-
-* Java expressions with erroneous types (e.g. the result of a call whose callee couldn't be resolved during extraction) are now given a CodeQL `ErrorType` more often.
-
-### Bug Fixes
-
-* Fixed the Java autobuilder overriding the version of Maven used by a project when the Maven wrapper `mvnw` is in use and the `maven-wrapper.jar` file is not present in the repository.
-* Some flow steps related to `android.text.Editable.toString` that were accidentally disabled have been re-enabled.
diff --git a/java/ql/lib/codeql-pack.release.yml b/java/ql/lib/codeql-pack.release.yml
index 0521f0f75fad..5290c29b7fe7 100644
--- a/java/ql/lib/codeql-pack.release.yml
+++ b/java/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.10
+lastReleaseVersion: 0.8.9
diff --git a/java/ql/lib/qlpack.yml b/java/ql/lib/qlpack.yml
index 428eedc75e3d..15b4982d41eb 100644
--- a/java/ql/lib/qlpack.yml
+++ b/java/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-all
-version: 0.8.10
+version: 0.8.10-dev
groups: java
dbscheme: config/semmlecode.dbscheme
extractor: java
diff --git a/java/ql/src/CHANGELOG.md b/java/ql/src/CHANGELOG.md
index c61275f5ed84..5d8353514538 100644
--- a/java/ql/src/CHANGELOG.md
+++ b/java/ql/src/CHANGELOG.md
@@ -1,13 +1,3 @@
-## 0.8.10
-
-### New Queries
-
-* Added a new query `java/android/insecure-local-key-gen` for finding instances of keys generated for biometric authentication in an insecure way.
-
-### Minor Analysis Improvements
-
-* To reduce the number of false positives in the query "Insertion of sensitive information into log files" (`java/sensitive-log`), variables with names that contain "null" (case-insensitively) are no longer considered sources of sensitive information.
-
## 0.8.9
### New Queries
diff --git a/java/ql/src/change-notes/2024-02-12-android-insecure-keys.md b/java/ql/src/change-notes/2024-02-12-android-insecure-keys.md
new file mode 100644
index 000000000000..1de077277962
--- /dev/null
+++ b/java/ql/src/change-notes/2024-02-12-android-insecure-keys.md
@@ -0,0 +1,4 @@
+---
+category: newQuery
+---
+* Added a new query `java/android/insecure-local-key-gen` for finding instances of keys generated for biometric authentication in an insecure way.
\ No newline at end of file
diff --git a/java/ql/src/change-notes/released/0.8.10.md b/java/ql/src/change-notes/2024-03-04-sensitive-log-remove-null-from-sources.md
similarity index 54%
rename from java/ql/src/change-notes/released/0.8.10.md
rename to java/ql/src/change-notes/2024-03-04-sensitive-log-remove-null-from-sources.md
index c5d18ae33794..0bb4f18f2bd9 100644
--- a/java/ql/src/change-notes/released/0.8.10.md
+++ b/java/ql/src/change-notes/2024-03-04-sensitive-log-remove-null-from-sources.md
@@ -1,9 +1,4 @@
-## 0.8.10
-
-### New Queries
-
-* Added a new query `java/android/insecure-local-key-gen` for finding instances of keys generated for biometric authentication in an insecure way.
-
-### Minor Analysis Improvements
-
+---
+category: minorAnalysis
+---
* To reduce the number of false positives in the query "Insertion of sensitive information into log files" (`java/sensitive-log`), variables with names that contain "null" (case-insensitively) are no longer considered sources of sensitive information.
diff --git a/java/ql/src/codeql-pack.release.yml b/java/ql/src/codeql-pack.release.yml
index 0521f0f75fad..5290c29b7fe7 100644
--- a/java/ql/src/codeql-pack.release.yml
+++ b/java/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.10
+lastReleaseVersion: 0.8.9
diff --git a/java/ql/src/qlpack.yml b/java/ql/src/qlpack.yml
index ebbdbeee3b2c..8f4de528e213 100644
--- a/java/ql/src/qlpack.yml
+++ b/java/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-queries
-version: 0.8.10
+version: 0.8.10-dev
groups:
- java
- queries
diff --git a/javascript/ql/lib/CHANGELOG.md b/javascript/ql/lib/CHANGELOG.md
index d5edcc005131..5b97ebbb22b3 100644
--- a/javascript/ql/lib/CHANGELOG.md
+++ b/javascript/ql/lib/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.8.10
-
-No user-facing changes.
-
## 0.8.9
### Minor Analysis Improvements
diff --git a/javascript/ql/lib/change-notes/released/0.8.10.md b/javascript/ql/lib/change-notes/released/0.8.10.md
deleted file mode 100644
index 777bbd2fdede..000000000000
--- a/javascript/ql/lib/change-notes/released/0.8.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.8.10
-
-No user-facing changes.
diff --git a/javascript/ql/lib/codeql-pack.release.yml b/javascript/ql/lib/codeql-pack.release.yml
index 0521f0f75fad..5290c29b7fe7 100644
--- a/javascript/ql/lib/codeql-pack.release.yml
+++ b/javascript/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.10
+lastReleaseVersion: 0.8.9
diff --git a/javascript/ql/lib/qlpack.yml b/javascript/ql/lib/qlpack.yml
index da16493a21c9..ef3ca7521aca 100644
--- a/javascript/ql/lib/qlpack.yml
+++ b/javascript/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-all
-version: 0.8.10
+version: 0.8.10-dev
groups: javascript
dbscheme: semmlecode.javascript.dbscheme
extractor: javascript
diff --git a/javascript/ql/src/CHANGELOG.md b/javascript/ql/src/CHANGELOG.md
index b9627cac5eee..85516e3625d1 100644
--- a/javascript/ql/src/CHANGELOG.md
+++ b/javascript/ql/src/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.8.10
-
-No user-facing changes.
-
## 0.8.9
### Bug Fixes
diff --git a/javascript/ql/src/change-notes/released/0.8.10.md b/javascript/ql/src/change-notes/released/0.8.10.md
deleted file mode 100644
index 777bbd2fdede..000000000000
--- a/javascript/ql/src/change-notes/released/0.8.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.8.10
-
-No user-facing changes.
diff --git a/javascript/ql/src/codeql-pack.release.yml b/javascript/ql/src/codeql-pack.release.yml
index 0521f0f75fad..5290c29b7fe7 100644
--- a/javascript/ql/src/codeql-pack.release.yml
+++ b/javascript/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.10
+lastReleaseVersion: 0.8.9
diff --git a/javascript/ql/src/qlpack.yml b/javascript/ql/src/qlpack.yml
index d224952c5641..b6181aa30e99 100644
--- a/javascript/ql/src/qlpack.yml
+++ b/javascript/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-queries
-version: 0.8.10
+version: 0.8.10-dev
groups:
- javascript
- queries
diff --git a/misc/suite-helpers/CHANGELOG.md b/misc/suite-helpers/CHANGELOG.md
index 1c4455b66c43..3c06dd69b0f5 100644
--- a/misc/suite-helpers/CHANGELOG.md
+++ b/misc/suite-helpers/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.7.10
-
-No user-facing changes.
-
## 0.7.9
No user-facing changes.
diff --git a/misc/suite-helpers/change-notes/released/0.7.10.md b/misc/suite-helpers/change-notes/released/0.7.10.md
deleted file mode 100644
index 989c5b8f6823..000000000000
--- a/misc/suite-helpers/change-notes/released/0.7.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.7.10
-
-No user-facing changes.
diff --git a/misc/suite-helpers/codeql-pack.release.yml b/misc/suite-helpers/codeql-pack.release.yml
index 675185672974..576395f3405e 100644
--- a/misc/suite-helpers/codeql-pack.release.yml
+++ b/misc/suite-helpers/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.7.10
+lastReleaseVersion: 0.7.9
diff --git a/misc/suite-helpers/qlpack.yml b/misc/suite-helpers/qlpack.yml
index 54d978d5efe7..49b7a6bda4c2 100644
--- a/misc/suite-helpers/qlpack.yml
+++ b/misc/suite-helpers/qlpack.yml
@@ -1,4 +1,4 @@
name: codeql/suite-helpers
-version: 0.7.10
+version: 0.7.10-dev
groups: shared
warnOnImplicitThis: true
diff --git a/python/ql/lib/CHANGELOG.md b/python/ql/lib/CHANGELOG.md
index f095607ca1bf..e6f318c51ea8 100644
--- a/python/ql/lib/CHANGELOG.md
+++ b/python/ql/lib/CHANGELOG.md
@@ -1,10 +1,3 @@
-## 0.11.10
-
-### Minor Analysis Improvements
-
-* Fixed missing flow for dictionary updates (`d[] = ...`) when `` is a string constant not used in dictionary literals or as name of keyword-argument.
-* Fixed flow for iterable unpacking (`a,b = my_tuple`) when it occurs on top-level (module) scope.
-
## 0.11.9
### Minor Analysis Improvements
diff --git a/python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md b/python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md
new file mode 100644
index 000000000000..3c47c6ba866a
--- /dev/null
+++ b/python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Fixed flow for iterable unpacking (`a,b = my_tuple`) when it occurs on top-level (module) scope.
diff --git a/python/ql/lib/change-notes/released/0.11.10.md b/python/ql/lib/change-notes/2024-03-01-dict-update-content.md
similarity index 52%
rename from python/ql/lib/change-notes/released/0.11.10.md
rename to python/ql/lib/change-notes/2024-03-01-dict-update-content.md
index ed873724e4f2..dfb8d247fffa 100644
--- a/python/ql/lib/change-notes/released/0.11.10.md
+++ b/python/ql/lib/change-notes/2024-03-01-dict-update-content.md
@@ -1,6 +1,4 @@
-## 0.11.10
-
-### Minor Analysis Improvements
-
+---
+category: minorAnalysis
+---
* Fixed missing flow for dictionary updates (`d[] = ...`) when `` is a string constant not used in dictionary literals or as name of keyword-argument.
-* Fixed flow for iterable unpacking (`a,b = my_tuple`) when it occurs on top-level (module) scope.
diff --git a/python/ql/lib/codeql-pack.release.yml b/python/ql/lib/codeql-pack.release.yml
index ddddcbe9193d..b064d1778a10 100644
--- a/python/ql/lib/codeql-pack.release.yml
+++ b/python/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.11.10
+lastReleaseVersion: 0.11.9
diff --git a/python/ql/lib/qlpack.yml b/python/ql/lib/qlpack.yml
index 59a8b4c96d17..e9f66e205f24 100644
--- a/python/ql/lib/qlpack.yml
+++ b/python/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-all
-version: 0.11.10
+version: 0.11.10-dev
groups: python
dbscheme: semmlecode.python.dbscheme
extractor: python
diff --git a/python/ql/src/CHANGELOG.md b/python/ql/src/CHANGELOG.md
index d4245aba7a62..50762bcbf34e 100644
--- a/python/ql/src/CHANGELOG.md
+++ b/python/ql/src/CHANGELOG.md
@@ -1,9 +1,3 @@
-## 0.9.10
-
-### New Queries
-
-* The query `py/nosql-injection` for finding NoSQL injection vulnerabilities is now part of the default security suite.
-
## 0.9.9
No user-facing changes.
diff --git a/python/ql/src/change-notes/released/0.9.10.md b/python/ql/src/change-notes/2024-03-04-nosql-injection.md
similarity index 81%
rename from python/ql/src/change-notes/released/0.9.10.md
rename to python/ql/src/change-notes/2024-03-04-nosql-injection.md
index 4cbb221b789f..6e98540c757c 100644
--- a/python/ql/src/change-notes/released/0.9.10.md
+++ b/python/ql/src/change-notes/2024-03-04-nosql-injection.md
@@ -1,5 +1,4 @@
-## 0.9.10
-
-### New Queries
-
+---
+category: newQuery
+---
* The query `py/nosql-injection` for finding NoSQL injection vulnerabilities is now part of the default security suite.
diff --git a/python/ql/src/codeql-pack.release.yml b/python/ql/src/codeql-pack.release.yml
index d086ed69541d..aabed7c396b7 100644
--- a/python/ql/src/codeql-pack.release.yml
+++ b/python/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.9.10
+lastReleaseVersion: 0.9.9
diff --git a/python/ql/src/qlpack.yml b/python/ql/src/qlpack.yml
index c920f667836b..aa18f2d87074 100644
--- a/python/ql/src/qlpack.yml
+++ b/python/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-queries
-version: 0.9.10
+version: 0.9.10-dev
groups:
- python
- queries
diff --git a/ruby/ql/lib/CHANGELOG.md b/ruby/ql/lib/CHANGELOG.md
index c61a12e0f4ad..a623a151e891 100644
--- a/ruby/ql/lib/CHANGELOG.md
+++ b/ruby/ql/lib/CHANGELOG.md
@@ -1,12 +1,3 @@
-## 0.8.10
-
-### Minor Analysis Improvements
-
-* Calls to `I18n.translate` as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
-* Calls to `Arel::Nodes::SqlLiteral.new` are now modeled as instances of the `SqlConstruction` concept, as well as propagating taint from their argument.
-* Additional arguments beyond the first of calls to the `ActiveRecord` methods `select`, `reselect`, `order`, `reorder`, `joins`, `group`, and `pluck` are now recognized as sql injection sinks.
-* Calls to several methods of `ActiveRecord::Connection`, such as `ActiveRecord::Connection#exec_query`, are now recognized as SQL executions, including those via subclasses.
-
## 0.8.9
### Minor Analysis Improvements
diff --git a/ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md b/ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md
new file mode 100644
index 000000000000..c2276f284a84
--- /dev/null
+++ b/ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Calls to several methods of `ActiveRecord::Connection`, such as `ActiveRecord::Connection#exec_query`, are now recognized as SQL executions, including those via subclasses.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md b/ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md
new file mode 100644
index 000000000000..1486c7a472d1
--- /dev/null
+++ b/ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Additional arguments beyond the first of calls to the `ActiveRecord` methods `select`, `reselect`, `order`, `reorder`, `joins`, `group`, and `pluck` are now recognized as sql injection sinks.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md b/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
new file mode 100644
index 000000000000..6f3a90768bab
--- /dev/null
+++ b/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Calls to `Arel::Nodes::SqlLiteral.new` are now modeled as instances of the `SqlConstruction` concept, as well as propagating taint from their argument.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md b/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
new file mode 100644
index 000000000000..350e049b5bfc
--- /dev/null
+++ b/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Calls to `I18n.translate` as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/released/0.8.10.md b/ruby/ql/lib/change-notes/released/0.8.10.md
deleted file mode 100644
index 666e28f840e7..000000000000
--- a/ruby/ql/lib/change-notes/released/0.8.10.md
+++ /dev/null
@@ -1,8 +0,0 @@
-## 0.8.10
-
-### Minor Analysis Improvements
-
-* Calls to `I18n.translate` as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
-* Calls to `Arel::Nodes::SqlLiteral.new` are now modeled as instances of the `SqlConstruction` concept, as well as propagating taint from their argument.
-* Additional arguments beyond the first of calls to the `ActiveRecord` methods `select`, `reselect`, `order`, `reorder`, `joins`, `group`, and `pluck` are now recognized as sql injection sinks.
-* Calls to several methods of `ActiveRecord::Connection`, such as `ActiveRecord::Connection#exec_query`, are now recognized as SQL executions, including those via subclasses.
diff --git a/ruby/ql/lib/codeql-pack.release.yml b/ruby/ql/lib/codeql-pack.release.yml
index 0521f0f75fad..5290c29b7fe7 100644
--- a/ruby/ql/lib/codeql-pack.release.yml
+++ b/ruby/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.10
+lastReleaseVersion: 0.8.9
diff --git a/ruby/ql/lib/qlpack.yml b/ruby/ql/lib/qlpack.yml
index de5b41999fe1..7d409b83adbd 100644
--- a/ruby/ql/lib/qlpack.yml
+++ b/ruby/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-all
-version: 0.8.10
+version: 0.8.10-dev
groups: ruby
extractor: ruby
dbscheme: ruby.dbscheme
diff --git a/ruby/ql/src/CHANGELOG.md b/ruby/ql/src/CHANGELOG.md
index f875b6d16ad4..4149c728effa 100644
--- a/ruby/ql/src/CHANGELOG.md
+++ b/ruby/ql/src/CHANGELOG.md
@@ -1,10 +1,3 @@
-## 0.8.10
-
-### Minor Analysis Improvements
-
-* Calls to `Object#method`, `Object#public_method` and `Object#singleton_method` with untrusted data are now recognised as sinks for code injection.
-* Added additional request sources for Ruby on Rails.
-
## 0.8.9
No user-facing changes.
diff --git a/ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md b/ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md
new file mode 100644
index 000000000000..84ea696dfef4
--- /dev/null
+++ b/ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added additional request sources for Ruby on Rails.
\ No newline at end of file
diff --git a/ruby/ql/src/change-notes/released/0.8.10.md b/ruby/ql/src/change-notes/2024-03-01-method-code-injection-sinks.md
similarity index 51%
rename from ruby/ql/src/change-notes/released/0.8.10.md
rename to ruby/ql/src/change-notes/2024-03-01-method-code-injection-sinks.md
index 985cdf8d22e0..43e40d3fd536 100644
--- a/ruby/ql/src/change-notes/released/0.8.10.md
+++ b/ruby/ql/src/change-notes/2024-03-01-method-code-injection-sinks.md
@@ -1,6 +1,4 @@
-## 0.8.10
-
-### Minor Analysis Improvements
-
-* Calls to `Object#method`, `Object#public_method` and `Object#singleton_method` with untrusted data are now recognised as sinks for code injection.
-* Added additional request sources for Ruby on Rails.
+---
+category: minorAnalysis
+---
+* Calls to `Object#method`, `Object#public_method` and `Object#singleton_method` with untrusted data are now recognised as sinks for code injection.
\ No newline at end of file
diff --git a/ruby/ql/src/codeql-pack.release.yml b/ruby/ql/src/codeql-pack.release.yml
index 0521f0f75fad..5290c29b7fe7 100644
--- a/ruby/ql/src/codeql-pack.release.yml
+++ b/ruby/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.10
+lastReleaseVersion: 0.8.9
diff --git a/ruby/ql/src/qlpack.yml b/ruby/ql/src/qlpack.yml
index 5e3792682346..8af7f9fd7976 100644
--- a/ruby/ql/src/qlpack.yml
+++ b/ruby/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-queries
-version: 0.8.10
+version: 0.8.10-dev
groups:
- ruby
- queries
diff --git a/shared/controlflow/CHANGELOG.md b/shared/controlflow/CHANGELOG.md
index 75f2ca53f987..dbfa6ef4512d 100644
--- a/shared/controlflow/CHANGELOG.md
+++ b/shared/controlflow/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.1.10
-
-No user-facing changes.
-
## 0.1.9
No user-facing changes.
diff --git a/shared/controlflow/change-notes/released/0.1.10.md b/shared/controlflow/change-notes/released/0.1.10.md
deleted file mode 100644
index 47358eeee934..000000000000
--- a/shared/controlflow/change-notes/released/0.1.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.1.10
-
-No user-facing changes.
diff --git a/shared/controlflow/codeql-pack.release.yml b/shared/controlflow/codeql-pack.release.yml
index 30f5ca88be0e..1425c0edf7f8 100644
--- a/shared/controlflow/codeql-pack.release.yml
+++ b/shared/controlflow/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.1.10
+lastReleaseVersion: 0.1.9
diff --git a/shared/controlflow/qlpack.yml b/shared/controlflow/qlpack.yml
index 1d43802be421..9d35a6782761 100644
--- a/shared/controlflow/qlpack.yml
+++ b/shared/controlflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/controlflow
-version: 0.1.10
+version: 0.1.10-dev
groups: shared
library: true
dependencies:
diff --git a/shared/dataflow/CHANGELOG.md b/shared/dataflow/CHANGELOG.md
index ef80788bded6..67a5bf589f4f 100644
--- a/shared/dataflow/CHANGELOG.md
+++ b/shared/dataflow/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.1
-
-No user-facing changes.
-
## 0.2.0
### Breaking Changes
diff --git a/shared/dataflow/change-notes/released/0.2.1.md b/shared/dataflow/change-notes/released/0.2.1.md
deleted file mode 100644
index 3dbfc85fe11d..000000000000
--- a/shared/dataflow/change-notes/released/0.2.1.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.1
-
-No user-facing changes.
diff --git a/shared/dataflow/codeql-pack.release.yml b/shared/dataflow/codeql-pack.release.yml
index df29a726bccc..5274e27ed522 100644
--- a/shared/dataflow/codeql-pack.release.yml
+++ b/shared/dataflow/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.1
+lastReleaseVersion: 0.2.0
diff --git a/shared/dataflow/qlpack.yml b/shared/dataflow/qlpack.yml
index ee422e02ea9a..1e7becf71c4f 100644
--- a/shared/dataflow/qlpack.yml
+++ b/shared/dataflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/dataflow
-version: 0.2.1
+version: 0.2.1-dev
groups: shared
library: true
dependencies:
diff --git a/shared/mad/CHANGELOG.md b/shared/mad/CHANGELOG.md
index 4730366775ea..4d09057118ce 100644
--- a/shared/mad/CHANGELOG.md
+++ b/shared/mad/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.10
-
-No user-facing changes.
-
## 0.2.9
No user-facing changes.
diff --git a/shared/mad/change-notes/released/0.2.10.md b/shared/mad/change-notes/released/0.2.10.md
deleted file mode 100644
index 81c9722b19fe..000000000000
--- a/shared/mad/change-notes/released/0.2.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.10
-
-No user-facing changes.
diff --git a/shared/mad/codeql-pack.release.yml b/shared/mad/codeql-pack.release.yml
index a71167814cb7..d021cf0a6bed 100644
--- a/shared/mad/codeql-pack.release.yml
+++ b/shared/mad/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.10
+lastReleaseVersion: 0.2.9
diff --git a/shared/mad/qlpack.yml b/shared/mad/qlpack.yml
index 6d7269ef3da8..22c8f271ccc6 100644
--- a/shared/mad/qlpack.yml
+++ b/shared/mad/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/mad
-version: 0.2.10
+version: 0.2.10-dev
groups: shared
library: true
dependencies: null
diff --git a/shared/rangeanalysis/CHANGELOG.md b/shared/rangeanalysis/CHANGELOG.md
index 9943dcb79727..5b8dbcfab22c 100644
--- a/shared/rangeanalysis/CHANGELOG.md
+++ b/shared/rangeanalysis/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.0.9
-
-No user-facing changes.
-
## 0.0.8
No user-facing changes.
diff --git a/shared/rangeanalysis/change-notes/released/0.0.9.md b/shared/rangeanalysis/change-notes/released/0.0.9.md
deleted file mode 100644
index c9e17c6d6cf2..000000000000
--- a/shared/rangeanalysis/change-notes/released/0.0.9.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.0.9
-
-No user-facing changes.
diff --git a/shared/rangeanalysis/codeql-pack.release.yml b/shared/rangeanalysis/codeql-pack.release.yml
index ecdd64fbab86..58fdc6b45deb 100644
--- a/shared/rangeanalysis/codeql-pack.release.yml
+++ b/shared/rangeanalysis/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.9
+lastReleaseVersion: 0.0.8
diff --git a/shared/rangeanalysis/qlpack.yml b/shared/rangeanalysis/qlpack.yml
index 01db5d5734d0..836fe51ee344 100644
--- a/shared/rangeanalysis/qlpack.yml
+++ b/shared/rangeanalysis/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/rangeanalysis
-version: 0.0.9
+version: 0.0.9-dev
groups: shared
library: true
dependencies:
diff --git a/shared/regex/CHANGELOG.md b/shared/regex/CHANGELOG.md
index c05869c153d3..cd5f91f71ec1 100644
--- a/shared/regex/CHANGELOG.md
+++ b/shared/regex/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.10
-
-No user-facing changes.
-
## 0.2.9
No user-facing changes.
diff --git a/shared/regex/change-notes/released/0.2.10.md b/shared/regex/change-notes/released/0.2.10.md
deleted file mode 100644
index 81c9722b19fe..000000000000
--- a/shared/regex/change-notes/released/0.2.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.10
-
-No user-facing changes.
diff --git a/shared/regex/codeql-pack.release.yml b/shared/regex/codeql-pack.release.yml
index a71167814cb7..d021cf0a6bed 100644
--- a/shared/regex/codeql-pack.release.yml
+++ b/shared/regex/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.10
+lastReleaseVersion: 0.2.9
diff --git a/shared/regex/qlpack.yml b/shared/regex/qlpack.yml
index 0d4f485312f7..ea3f7f9b2389 100644
--- a/shared/regex/qlpack.yml
+++ b/shared/regex/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/regex
-version: 0.2.10
+version: 0.2.10-dev
groups: shared
library: true
dependencies:
diff --git a/shared/ssa/CHANGELOG.md b/shared/ssa/CHANGELOG.md
index a9161ff578b0..01acfae01489 100644
--- a/shared/ssa/CHANGELOG.md
+++ b/shared/ssa/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.10
-
-No user-facing changes.
-
## 0.2.9
No user-facing changes.
diff --git a/shared/ssa/change-notes/released/0.2.10.md b/shared/ssa/change-notes/released/0.2.10.md
deleted file mode 100644
index 81c9722b19fe..000000000000
--- a/shared/ssa/change-notes/released/0.2.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.10
-
-No user-facing changes.
diff --git a/shared/ssa/codeql-pack.release.yml b/shared/ssa/codeql-pack.release.yml
index a71167814cb7..d021cf0a6bed 100644
--- a/shared/ssa/codeql-pack.release.yml
+++ b/shared/ssa/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.10
+lastReleaseVersion: 0.2.9
diff --git a/shared/ssa/qlpack.yml b/shared/ssa/qlpack.yml
index 2ad254711a50..19304ad107f1 100644
--- a/shared/ssa/qlpack.yml
+++ b/shared/ssa/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ssa
-version: 0.2.10
+version: 0.2.10-dev
groups: shared
library: true
dependencies:
diff --git a/shared/threat-models/CHANGELOG.md b/shared/threat-models/CHANGELOG.md
index a59e560c4155..fba2a8703562 100644
--- a/shared/threat-models/CHANGELOG.md
+++ b/shared/threat-models/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.0.9
-
-No user-facing changes.
-
## 0.0.8
No user-facing changes.
diff --git a/shared/threat-models/change-notes/released/0.0.9.md b/shared/threat-models/change-notes/released/0.0.9.md
deleted file mode 100644
index c9e17c6d6cf2..000000000000
--- a/shared/threat-models/change-notes/released/0.0.9.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.0.9
-
-No user-facing changes.
diff --git a/shared/threat-models/codeql-pack.release.yml b/shared/threat-models/codeql-pack.release.yml
index ecdd64fbab86..58fdc6b45deb 100644
--- a/shared/threat-models/codeql-pack.release.yml
+++ b/shared/threat-models/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.9
+lastReleaseVersion: 0.0.8
diff --git a/shared/threat-models/qlpack.yml b/shared/threat-models/qlpack.yml
index 60cbbc56fcb3..d0ed9a913b21 100644
--- a/shared/threat-models/qlpack.yml
+++ b/shared/threat-models/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/threat-models
-version: 0.0.9
+version: 0.0.9-dev
library: true
groups: shared
dataExtensions:
diff --git a/shared/tutorial/CHANGELOG.md b/shared/tutorial/CHANGELOG.md
index 560ad058d5b3..1db3a01af0b1 100644
--- a/shared/tutorial/CHANGELOG.md
+++ b/shared/tutorial/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.10
-
-No user-facing changes.
-
## 0.2.9
No user-facing changes.
diff --git a/shared/tutorial/change-notes/released/0.2.10.md b/shared/tutorial/change-notes/released/0.2.10.md
deleted file mode 100644
index 81c9722b19fe..000000000000
--- a/shared/tutorial/change-notes/released/0.2.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.10
-
-No user-facing changes.
diff --git a/shared/tutorial/codeql-pack.release.yml b/shared/tutorial/codeql-pack.release.yml
index a71167814cb7..d021cf0a6bed 100644
--- a/shared/tutorial/codeql-pack.release.yml
+++ b/shared/tutorial/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.10
+lastReleaseVersion: 0.2.9
diff --git a/shared/tutorial/qlpack.yml b/shared/tutorial/qlpack.yml
index 69116705c1bf..b595ae9ee70a 100644
--- a/shared/tutorial/qlpack.yml
+++ b/shared/tutorial/qlpack.yml
@@ -1,7 +1,7 @@
name: codeql/tutorial
description: Library for the CodeQL detective tutorials, helping new users learn to
write CodeQL queries.
-version: 0.2.10
+version: 0.2.10-dev
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/typetracking/CHANGELOG.md b/shared/typetracking/CHANGELOG.md
index 350f9ecbeae0..afc857bc6bce 100644
--- a/shared/typetracking/CHANGELOG.md
+++ b/shared/typetracking/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.10
-
-No user-facing changes.
-
## 0.2.9
No user-facing changes.
diff --git a/shared/typetracking/change-notes/released/0.2.10.md b/shared/typetracking/change-notes/released/0.2.10.md
deleted file mode 100644
index 81c9722b19fe..000000000000
--- a/shared/typetracking/change-notes/released/0.2.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.10
-
-No user-facing changes.
diff --git a/shared/typetracking/codeql-pack.release.yml b/shared/typetracking/codeql-pack.release.yml
index a71167814cb7..d021cf0a6bed 100644
--- a/shared/typetracking/codeql-pack.release.yml
+++ b/shared/typetracking/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.10
+lastReleaseVersion: 0.2.9
diff --git a/shared/typetracking/qlpack.yml b/shared/typetracking/qlpack.yml
index fbbdcf5162a1..b55927f59bb7 100644
--- a/shared/typetracking/qlpack.yml
+++ b/shared/typetracking/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typetracking
-version: 0.2.10
+version: 0.2.10-dev
groups: shared
library: true
dependencies:
diff --git a/shared/typos/CHANGELOG.md b/shared/typos/CHANGELOG.md
index 54b1eaa4d589..66c5871d9821 100644
--- a/shared/typos/CHANGELOG.md
+++ b/shared/typos/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.10
-
-No user-facing changes.
-
## 0.2.9
No user-facing changes.
diff --git a/shared/typos/change-notes/released/0.2.10.md b/shared/typos/change-notes/released/0.2.10.md
deleted file mode 100644
index 81c9722b19fe..000000000000
--- a/shared/typos/change-notes/released/0.2.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.10
-
-No user-facing changes.
diff --git a/shared/typos/codeql-pack.release.yml b/shared/typos/codeql-pack.release.yml
index a71167814cb7..d021cf0a6bed 100644
--- a/shared/typos/codeql-pack.release.yml
+++ b/shared/typos/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.10
+lastReleaseVersion: 0.2.9
diff --git a/shared/typos/qlpack.yml b/shared/typos/qlpack.yml
index 4d59d9b3c342..644bfe11bff7 100644
--- a/shared/typos/qlpack.yml
+++ b/shared/typos/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typos
-version: 0.2.10
+version: 0.2.10-dev
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/util/CHANGELOG.md b/shared/util/CHANGELOG.md
index 1ca1f71bcbc2..63832e927fa5 100644
--- a/shared/util/CHANGELOG.md
+++ b/shared/util/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.10
-
-No user-facing changes.
-
## 0.2.9
No user-facing changes.
diff --git a/shared/util/change-notes/released/0.2.10.md b/shared/util/change-notes/released/0.2.10.md
deleted file mode 100644
index 81c9722b19fe..000000000000
--- a/shared/util/change-notes/released/0.2.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.10
-
-No user-facing changes.
diff --git a/shared/util/codeql-pack.release.yml b/shared/util/codeql-pack.release.yml
index a71167814cb7..d021cf0a6bed 100644
--- a/shared/util/codeql-pack.release.yml
+++ b/shared/util/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.10
+lastReleaseVersion: 0.2.9
diff --git a/shared/util/qlpack.yml b/shared/util/qlpack.yml
index 28ed738a93dd..ca1a866a53d4 100644
--- a/shared/util/qlpack.yml
+++ b/shared/util/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/util
-version: 0.2.10
+version: 0.2.10-dev
groups: shared
library: true
dependencies: null
diff --git a/shared/yaml/CHANGELOG.md b/shared/yaml/CHANGELOG.md
index 9fd5ebc26ab2..e5495abcd503 100644
--- a/shared/yaml/CHANGELOG.md
+++ b/shared/yaml/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.10
-
-No user-facing changes.
-
## 0.2.9
No user-facing changes.
diff --git a/shared/yaml/change-notes/released/0.2.10.md b/shared/yaml/change-notes/released/0.2.10.md
deleted file mode 100644
index 81c9722b19fe..000000000000
--- a/shared/yaml/change-notes/released/0.2.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.10
-
-No user-facing changes.
diff --git a/shared/yaml/codeql-pack.release.yml b/shared/yaml/codeql-pack.release.yml
index a71167814cb7..d021cf0a6bed 100644
--- a/shared/yaml/codeql-pack.release.yml
+++ b/shared/yaml/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.10
+lastReleaseVersion: 0.2.9
diff --git a/shared/yaml/qlpack.yml b/shared/yaml/qlpack.yml
index 9643ffcec66b..de5b47e120ae 100644
--- a/shared/yaml/qlpack.yml
+++ b/shared/yaml/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/yaml
-version: 0.2.10
+version: 0.2.10-dev
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/swift/ql/lib/CHANGELOG.md b/swift/ql/lib/CHANGELOG.md
index 8f14bfcedc9c..e88cd0259ccf 100644
--- a/swift/ql/lib/CHANGELOG.md
+++ b/swift/ql/lib/CHANGELOG.md
@@ -1,9 +1,3 @@
-## 0.3.10
-
-### Bug Fixes
-
-* Fixed an issue where `TypeDecl.getFullName` would get stuck in an loop and fail when minor database inconsistencies are present.
-
## 0.3.9
### Minor Analysis Improvements
diff --git a/swift/ql/lib/change-notes/released/0.3.10.md b/swift/ql/lib/change-notes/2024-02-22-extension-patch.md
similarity index 83%
rename from swift/ql/lib/change-notes/released/0.3.10.md
rename to swift/ql/lib/change-notes/2024-02-22-extension-patch.md
index 9d6286ff58a7..7bd78f3b785c 100644
--- a/swift/ql/lib/change-notes/released/0.3.10.md
+++ b/swift/ql/lib/change-notes/2024-02-22-extension-patch.md
@@ -1,5 +1,4 @@
-## 0.3.10
-
-### Bug Fixes
-
+---
+category: fix
+---
* Fixed an issue where `TypeDecl.getFullName` would get stuck in an loop and fail when minor database inconsistencies are present.
diff --git a/swift/ql/lib/codeql-pack.release.yml b/swift/ql/lib/codeql-pack.release.yml
index 76ca0ac8ba76..3fa5180bcb49 100644
--- a/swift/ql/lib/codeql-pack.release.yml
+++ b/swift/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.3.10
+lastReleaseVersion: 0.3.9
diff --git a/swift/ql/lib/qlpack.yml b/swift/ql/lib/qlpack.yml
index 70ec4798ea85..a37a4cb3d580 100644
--- a/swift/ql/lib/qlpack.yml
+++ b/swift/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-all
-version: 0.3.10
+version: 0.3.10-dev
groups: swift
extractor: swift
dbscheme: swift.dbscheme
diff --git a/swift/ql/src/CHANGELOG.md b/swift/ql/src/CHANGELOG.md
index bda9834c9bca..96615d069729 100644
--- a/swift/ql/src/CHANGELOG.md
+++ b/swift/ql/src/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.3.10
-
-No user-facing changes.
-
## 0.3.9
### New Queries
diff --git a/swift/ql/src/change-notes/released/0.3.10.md b/swift/ql/src/change-notes/released/0.3.10.md
deleted file mode 100644
index 925a48fc52e0..000000000000
--- a/swift/ql/src/change-notes/released/0.3.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.3.10
-
-No user-facing changes.
diff --git a/swift/ql/src/codeql-pack.release.yml b/swift/ql/src/codeql-pack.release.yml
index 76ca0ac8ba76..3fa5180bcb49 100644
--- a/swift/ql/src/codeql-pack.release.yml
+++ b/swift/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.3.10
+lastReleaseVersion: 0.3.9
diff --git a/swift/ql/src/qlpack.yml b/swift/ql/src/qlpack.yml
index ba66b065529b..e3ead42c98bf 100644
--- a/swift/ql/src/qlpack.yml
+++ b/swift/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-queries
-version: 0.3.10
+version: 0.3.10-dev
groups:
- swift
- queries
From 661e68dab5ee8d71edcec82139314a481dd983d5 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
Date: Tue, 5 Mar 2024 18:13:58 +0000
Subject: [PATCH 067/731] Release preparation for version 2.16.4
---
cpp/ql/lib/CHANGELOG.md | 6 ++++++
.../0.12.7.md} | 9 +++++----
cpp/ql/lib/codeql-pack.release.yml | 2 +-
cpp/ql/lib/qlpack.yml | 2 +-
cpp/ql/src/CHANGELOG.md | 7 +++++++
.../2024-02-29-non-constant-format-path-query.md | 4 ----
.../0.9.6.md} | 8 +++++---
cpp/ql/src/codeql-pack.release.yml | 2 +-
cpp/ql/src/qlpack.yml | 2 +-
csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md | 4 ++++
.../Solorigate/lib/change-notes/released/1.7.10.md | 3 +++
.../Solorigate/lib/codeql-pack.release.yml | 2 +-
csharp/ql/campaigns/Solorigate/lib/qlpack.yml | 2 +-
csharp/ql/campaigns/Solorigate/src/CHANGELOG.md | 4 ++++
.../Solorigate/src/change-notes/released/1.7.10.md | 3 +++
.../Solorigate/src/codeql-pack.release.yml | 2 +-
csharp/ql/campaigns/Solorigate/src/qlpack.yml | 2 +-
csharp/ql/lib/CHANGELOG.md | 14 ++++++++++++++
.../change-notes/2024-02-21-getonly-properties.md | 4 ----
.../ql/lib/change-notes/2024-02-22-no-db-stats.md | 4 ----
.../change-notes/2024-02-23-compiler-generated.md | 4 ----
.../2024-02-26-variable-capture-flow.md | 4 ----
.../2024-02-28-experimental-attribute.md | 4 ----
.../2024-02-28-refreadonly-parameter.md | 4 ----
csharp/ql/lib/change-notes/released/0.8.10.md | 13 +++++++++++++
csharp/ql/lib/codeql-pack.release.yml | 2 +-
csharp/ql/lib/qlpack.yml | 2 +-
csharp/ql/src/CHANGELOG.md | 6 ++++++
.../0.8.10.md} | 9 +++++----
csharp/ql/src/codeql-pack.release.yml | 2 +-
csharp/ql/src/qlpack.yml | 2 +-
go/ql/consistency-queries/CHANGELOG.md | 4 ++++
.../change-notes/released/0.0.9.md | 3 +++
go/ql/consistency-queries/codeql-pack.release.yml | 2 +-
go/ql/consistency-queries/qlpack.yml | 2 +-
go/ql/lib/CHANGELOG.md | 11 +++++++++++
.../lib/change-notes/2024-02-14-range-map-read.md | 4 ----
.../0.7.10.md} | 11 ++++++++---
go/ql/lib/codeql-pack.release.yml | 2 +-
go/ql/lib/qlpack.yml | 2 +-
go/ql/src/CHANGELOG.md | 4 ++++
go/ql/src/change-notes/released/0.7.10.md | 3 +++
go/ql/src/codeql-pack.release.yml | 2 +-
go/ql/src/qlpack.yml | 2 +-
java/ql/automodel/src/CHANGELOG.md | 4 ++++
.../automodel/src/change-notes/released/0.0.17.md | 3 +++
java/ql/automodel/src/codeql-pack.release.yml | 2 +-
java/ql/automodel/src/qlpack.yml | 2 +-
java/ql/lib/CHANGELOG.md | 11 +++++++++++
.../change-notes/2024-02-23-widget-flowsteps.md | 4 ----
java/ql/lib/change-notes/2024-02-27-error-types.md | 4 ----
.../lib/change-notes/2024-02-27-mvnw-versions.md | 4 ----
java/ql/lib/change-notes/released/0.8.10.md | 10 ++++++++++
java/ql/lib/codeql-pack.release.yml | 2 +-
java/ql/lib/qlpack.yml | 2 +-
java/ql/src/CHANGELOG.md | 10 ++++++++++
.../2024-02-12-android-insecure-keys.md | 4 ----
.../0.8.10.md} | 11 ++++++++---
java/ql/src/codeql-pack.release.yml | 2 +-
java/ql/src/qlpack.yml | 2 +-
javascript/ql/lib/CHANGELOG.md | 4 ++++
javascript/ql/lib/change-notes/released/0.8.10.md | 3 +++
javascript/ql/lib/codeql-pack.release.yml | 2 +-
javascript/ql/lib/qlpack.yml | 2 +-
javascript/ql/src/CHANGELOG.md | 4 ++++
javascript/ql/src/change-notes/released/0.8.10.md | 3 +++
javascript/ql/src/codeql-pack.release.yml | 2 +-
javascript/ql/src/qlpack.yml | 2 +-
misc/suite-helpers/CHANGELOG.md | 4 ++++
misc/suite-helpers/change-notes/released/0.7.10.md | 3 +++
misc/suite-helpers/codeql-pack.release.yml | 2 +-
misc/suite-helpers/qlpack.yml | 2 +-
python/ql/lib/CHANGELOG.md | 7 +++++++
.../2024-02-28-iterable-unpacking-module-scope.md | 4 ----
.../0.11.10.md} | 8 +++++---
python/ql/lib/codeql-pack.release.yml | 2 +-
python/ql/lib/qlpack.yml | 2 +-
python/ql/src/CHANGELOG.md | 6 ++++++
.../0.9.10.md} | 7 ++++---
python/ql/src/codeql-pack.release.yml | 2 +-
python/ql/src/qlpack.yml | 2 +-
ruby/ql/lib/CHANGELOG.md | 9 +++++++++
...2024-02-15-activerecord_connection_sql_sinks.md | 4 ----
.../2024-02-20-activerecord-sql-sink-arguments.md | 4 ----
.../lib/change-notes/2024-02-26-arel-sqlliteral.md | 4 ----
.../lib/change-notes/2024-02-29-i18n-translate.md | 4 ----
ruby/ql/lib/change-notes/released/0.8.10.md | 8 ++++++++
ruby/ql/lib/codeql-pack.release.yml | 2 +-
ruby/ql/lib/qlpack.yml | 2 +-
ruby/ql/src/CHANGELOG.md | 7 +++++++
.../2024-02-13-rails-more-request-sources.md | 4 ----
.../0.8.10.md} | 10 ++++++----
ruby/ql/src/codeql-pack.release.yml | 2 +-
ruby/ql/src/qlpack.yml | 2 +-
shared/controlflow/CHANGELOG.md | 4 ++++
shared/controlflow/change-notes/released/0.1.10.md | 3 +++
shared/controlflow/codeql-pack.release.yml | 2 +-
shared/controlflow/qlpack.yml | 2 +-
shared/dataflow/CHANGELOG.md | 4 ++++
shared/dataflow/change-notes/released/0.2.1.md | 3 +++
shared/dataflow/codeql-pack.release.yml | 2 +-
shared/dataflow/qlpack.yml | 2 +-
shared/mad/CHANGELOG.md | 4 ++++
shared/mad/change-notes/released/0.2.10.md | 3 +++
shared/mad/codeql-pack.release.yml | 2 +-
shared/mad/qlpack.yml | 2 +-
shared/rangeanalysis/CHANGELOG.md | 4 ++++
.../rangeanalysis/change-notes/released/0.0.9.md | 3 +++
shared/rangeanalysis/codeql-pack.release.yml | 2 +-
shared/rangeanalysis/qlpack.yml | 2 +-
shared/regex/CHANGELOG.md | 4 ++++
shared/regex/change-notes/released/0.2.10.md | 3 +++
shared/regex/codeql-pack.release.yml | 2 +-
shared/regex/qlpack.yml | 2 +-
shared/ssa/CHANGELOG.md | 4 ++++
shared/ssa/change-notes/released/0.2.10.md | 3 +++
shared/ssa/codeql-pack.release.yml | 2 +-
shared/ssa/qlpack.yml | 2 +-
shared/threat-models/CHANGELOG.md | 4 ++++
.../threat-models/change-notes/released/0.0.9.md | 3 +++
shared/threat-models/codeql-pack.release.yml | 2 +-
shared/threat-models/qlpack.yml | 2 +-
shared/tutorial/CHANGELOG.md | 4 ++++
shared/tutorial/change-notes/released/0.2.10.md | 3 +++
shared/tutorial/codeql-pack.release.yml | 2 +-
shared/tutorial/qlpack.yml | 2 +-
shared/typetracking/CHANGELOG.md | 4 ++++
.../typetracking/change-notes/released/0.2.10.md | 3 +++
shared/typetracking/codeql-pack.release.yml | 2 +-
shared/typetracking/qlpack.yml | 2 +-
shared/typos/CHANGELOG.md | 4 ++++
shared/typos/change-notes/released/0.2.10.md | 3 +++
shared/typos/codeql-pack.release.yml | 2 +-
shared/typos/qlpack.yml | 2 +-
shared/util/CHANGELOG.md | 4 ++++
shared/util/change-notes/released/0.2.10.md | 3 +++
shared/util/codeql-pack.release.yml | 2 +-
shared/util/qlpack.yml | 2 +-
shared/yaml/CHANGELOG.md | 4 ++++
shared/yaml/change-notes/released/0.2.10.md | 3 +++
shared/yaml/codeql-pack.release.yml | 2 +-
shared/yaml/qlpack.yml | 2 +-
swift/ql/lib/CHANGELOG.md | 6 ++++++
.../0.3.10.md} | 7 ++++---
swift/ql/lib/codeql-pack.release.yml | 2 +-
swift/ql/lib/qlpack.yml | 2 +-
swift/ql/src/CHANGELOG.md | 4 ++++
swift/ql/src/change-notes/released/0.3.10.md | 3 +++
swift/ql/src/codeql-pack.release.yml | 2 +-
swift/ql/src/qlpack.yml | 2 +-
150 files changed, 394 insertions(+), 168 deletions(-)
rename cpp/ql/lib/change-notes/{2024-02-26-ir-named-destructors.md => released/0.12.7.md} (54%)
delete mode 100644 cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md
rename cpp/ql/src/change-notes/{2024-02-16-modelled-functions-block-flow.md => released/0.9.6.md} (77%)
create mode 100644 csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md
create mode 100644 csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md
create mode 100644 csharp/ql/lib/change-notes/released/0.8.10.md
rename csharp/ql/src/change-notes/{2024-02-06-threat-models.md => released/0.8.10.md} (88%)
create mode 100644 go/ql/consistency-queries/change-notes/released/0.0.9.md
delete mode 100644 go/ql/lib/change-notes/2024-02-14-range-map-read.md
rename go/ql/lib/change-notes/{2024-03-04-autobuilder-changes.md => released/0.7.10.md} (68%)
create mode 100644 go/ql/src/change-notes/released/0.7.10.md
create mode 100644 java/ql/automodel/src/change-notes/released/0.0.17.md
delete mode 100644 java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md
delete mode 100644 java/ql/lib/change-notes/2024-02-27-error-types.md
delete mode 100644 java/ql/lib/change-notes/2024-02-27-mvnw-versions.md
create mode 100644 java/ql/lib/change-notes/released/0.8.10.md
delete mode 100644 java/ql/src/change-notes/2024-02-12-android-insecure-keys.md
rename java/ql/src/change-notes/{2024-03-04-sensitive-log-remove-null-from-sources.md => released/0.8.10.md} (54%)
create mode 100644 javascript/ql/lib/change-notes/released/0.8.10.md
create mode 100644 javascript/ql/src/change-notes/released/0.8.10.md
create mode 100644 misc/suite-helpers/change-notes/released/0.7.10.md
delete mode 100644 python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md
rename python/ql/lib/change-notes/{2024-03-01-dict-update-content.md => released/0.11.10.md} (52%)
rename python/ql/src/change-notes/{2024-03-04-nosql-injection.md => released/0.9.10.md} (81%)
delete mode 100644 ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md
delete mode 100644 ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md
delete mode 100644 ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
delete mode 100644 ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
create mode 100644 ruby/ql/lib/change-notes/released/0.8.10.md
delete mode 100644 ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md
rename ruby/ql/src/change-notes/{2024-03-01-method-code-injection-sinks.md => released/0.8.10.md} (51%)
create mode 100644 shared/controlflow/change-notes/released/0.1.10.md
create mode 100644 shared/dataflow/change-notes/released/0.2.1.md
create mode 100644 shared/mad/change-notes/released/0.2.10.md
create mode 100644 shared/rangeanalysis/change-notes/released/0.0.9.md
create mode 100644 shared/regex/change-notes/released/0.2.10.md
create mode 100644 shared/ssa/change-notes/released/0.2.10.md
create mode 100644 shared/threat-models/change-notes/released/0.0.9.md
create mode 100644 shared/tutorial/change-notes/released/0.2.10.md
create mode 100644 shared/typetracking/change-notes/released/0.2.10.md
create mode 100644 shared/typos/change-notes/released/0.2.10.md
create mode 100644 shared/util/change-notes/released/0.2.10.md
create mode 100644 shared/yaml/change-notes/released/0.2.10.md
rename swift/ql/lib/change-notes/{2024-02-22-extension-patch.md => released/0.3.10.md} (83%)
create mode 100644 swift/ql/src/change-notes/released/0.3.10.md
diff --git a/cpp/ql/lib/CHANGELOG.md b/cpp/ql/lib/CHANGELOG.md
index b3091ec37d8f..e1c0dfbecd9a 100644
--- a/cpp/ql/lib/CHANGELOG.md
+++ b/cpp/ql/lib/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 0.12.7
+
+### Minor Analysis Improvements
+
+* Added destructors for named objects to the intermediate representation.
+
## 0.12.6
### New Features
diff --git a/cpp/ql/lib/change-notes/2024-02-26-ir-named-destructors.md b/cpp/ql/lib/change-notes/released/0.12.7.md
similarity index 54%
rename from cpp/ql/lib/change-notes/2024-02-26-ir-named-destructors.md
rename to cpp/ql/lib/change-notes/released/0.12.7.md
index 4e35decaf8ed..856a8b665c74 100644
--- a/cpp/ql/lib/change-notes/2024-02-26-ir-named-destructors.md
+++ b/cpp/ql/lib/change-notes/released/0.12.7.md
@@ -1,4 +1,5 @@
----
-category: minorAnalysis
----
-* Added destructors for named objects to the intermediate representation.
\ No newline at end of file
+## 0.12.7
+
+### Minor Analysis Improvements
+
+* Added destructors for named objects to the intermediate representation.
diff --git a/cpp/ql/lib/codeql-pack.release.yml b/cpp/ql/lib/codeql-pack.release.yml
index 170a312c1047..20419e9c6100 100644
--- a/cpp/ql/lib/codeql-pack.release.yml
+++ b/cpp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.12.6
+lastReleaseVersion: 0.12.7
diff --git a/cpp/ql/lib/qlpack.yml b/cpp/ql/lib/qlpack.yml
index 8e201fff5943..3bb9229bf94d 100644
--- a/cpp/ql/lib/qlpack.yml
+++ b/cpp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-all
-version: 0.12.7-dev
+version: 0.12.7
groups: cpp
dbscheme: semmlecode.cpp.dbscheme
extractor: cpp
diff --git a/cpp/ql/src/CHANGELOG.md b/cpp/ql/src/CHANGELOG.md
index ffcd73ff5d72..f6acd424bb05 100644
--- a/cpp/ql/src/CHANGELOG.md
+++ b/cpp/ql/src/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 0.9.6
+
+### Minor Analysis Improvements
+
+* The "non-constant format string" query (`cpp/non-constant-format`) has been converted to a `path-problem` query.
+* The new C/C++ dataflow and taint-tracking libraries (`semmle.code.cpp.dataflow.new.DataFlow` and `semmle.code.cpp.dataflow.new.TaintTracking`) now implicitly assume that dataflow and taint modelled via `DataFlowFunction` and `TaintFunction` always fully overwrite their buffers and thus act as flow barriers. As a result, many dataflow and taint-tracking queries now produce fewer false positives. To remove this assumption and go back to the previous behavior for a given model, one can override the new `isPartialWrite` predicate.
+
## 0.9.5
### Minor Analysis Improvements
diff --git a/cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md b/cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md
deleted file mode 100644
index 2e5933a61e86..000000000000
--- a/cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The "non-constant format string" query (`cpp/non-constant-format`) has been converted to a `path-problem` query.
\ No newline at end of file
diff --git a/cpp/ql/src/change-notes/2024-02-16-modelled-functions-block-flow.md b/cpp/ql/src/change-notes/released/0.9.6.md
similarity index 77%
rename from cpp/ql/src/change-notes/2024-02-16-modelled-functions-block-flow.md
rename to cpp/ql/src/change-notes/released/0.9.6.md
index d6ef3c3e0569..0c85f3f9f0f0 100644
--- a/cpp/ql/src/change-notes/2024-02-16-modelled-functions-block-flow.md
+++ b/cpp/ql/src/change-notes/released/0.9.6.md
@@ -1,4 +1,6 @@
----
-category: minorAnalysis
----
+## 0.9.6
+
+### Minor Analysis Improvements
+
+* The "non-constant format string" query (`cpp/non-constant-format`) has been converted to a `path-problem` query.
* The new C/C++ dataflow and taint-tracking libraries (`semmle.code.cpp.dataflow.new.DataFlow` and `semmle.code.cpp.dataflow.new.TaintTracking`) now implicitly assume that dataflow and taint modelled via `DataFlowFunction` and `TaintFunction` always fully overwrite their buffers and thus act as flow barriers. As a result, many dataflow and taint-tracking queries now produce fewer false positives. To remove this assumption and go back to the previous behavior for a given model, one can override the new `isPartialWrite` predicate.
diff --git a/cpp/ql/src/codeql-pack.release.yml b/cpp/ql/src/codeql-pack.release.yml
index 460240feafff..19139c132b2d 100644
--- a/cpp/ql/src/codeql-pack.release.yml
+++ b/cpp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.9.5
+lastReleaseVersion: 0.9.6
diff --git a/cpp/ql/src/qlpack.yml b/cpp/ql/src/qlpack.yml
index 31bd20166b2b..4052647bb97f 100644
--- a/cpp/ql/src/qlpack.yml
+++ b/cpp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-queries
-version: 0.9.6-dev
+version: 0.9.6
groups:
- cpp
- queries
diff --git a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
index 190b83b0f25a..82eacfc84f70 100644
--- a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
+++ b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.7.10
+
+No user-facing changes.
+
## 1.7.9
No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md
new file mode 100644
index 000000000000..8e8007d8475f
--- /dev/null
+++ b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md
@@ -0,0 +1,3 @@
+## 1.7.10
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
index 678da6bc37e9..31c7fe07020b 100644
--- a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.7.9
+lastReleaseVersion: 1.7.10
diff --git a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
index 7e643b0fac33..ee993bed0c91 100644
--- a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-all
-version: 1.7.10-dev
+version: 1.7.10
groups:
- csharp
- solorigate
diff --git a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
index 190b83b0f25a..82eacfc84f70 100644
--- a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
+++ b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.7.10
+
+No user-facing changes.
+
## 1.7.9
No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md
new file mode 100644
index 000000000000..8e8007d8475f
--- /dev/null
+++ b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md
@@ -0,0 +1,3 @@
+## 1.7.10
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
index 678da6bc37e9..31c7fe07020b 100644
--- a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
+++ b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.7.9
+lastReleaseVersion: 1.7.10
diff --git a/csharp/ql/campaigns/Solorigate/src/qlpack.yml b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
index 8654bbfd0312..1f421754fc82 100644
--- a/csharp/ql/campaigns/Solorigate/src/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-queries
-version: 1.7.10-dev
+version: 1.7.10
groups:
- csharp
- solorigate
diff --git a/csharp/ql/lib/CHANGELOG.md b/csharp/ql/lib/CHANGELOG.md
index 95fd64c52704..16cc14259e19 100644
--- a/csharp/ql/lib/CHANGELOG.md
+++ b/csharp/ql/lib/CHANGELOG.md
@@ -1,3 +1,17 @@
+## 0.8.10
+
+### Major Analysis Improvements
+
+* Improved support for flow through captured variables that properly adheres to inter-procedural control flow.
+* We no longer make use of CodeQL database stats, which may affect join-orders in custom queries. It is therefore recommended to test performance of custom queries after upgrading to this version.
+
+### Minor Analysis Improvements
+
+* C# 12: Add QL library support (`ExperimentalAttribute`) for the experimental attribute.
+* C# 12: Add extractor and QL library support for `ref readonly` parameters.
+* C#: The table `expr_compiler_generated` has been deleted and its content has been added to `compiler_generated`.
+* Data flow via get only properties like `public object Obj { get; }` is now captured by the data flow library.
+
## 0.8.9
### Minor Analysis Improvements
diff --git a/csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md b/csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md
deleted file mode 100644
index 6bb8e99c71ef..000000000000
--- a/csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Data flow via get only properties like `public object Obj { get; }` is now captured by the data flow library.
diff --git a/csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md b/csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md
deleted file mode 100644
index d6ffbd523ac6..000000000000
--- a/csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: majorAnalysis
----
-* We no longer make use of CodeQL database stats, which may affect join-orders in custom queries. It is therefore recommended to test performance of custom queries after upgrading to this version.
diff --git a/csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md b/csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md
deleted file mode 100644
index 9b1739b9b6da..000000000000
--- a/csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* C#: The table `expr_compiler_generated` has been deleted and its content has been added to `compiler_generated`.
diff --git a/csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md b/csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md
deleted file mode 100644
index 66ab65083dc3..000000000000
--- a/csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: majorAnalysis
----
-* Improved support for flow through captured variables that properly adheres to inter-procedural control flow.
\ No newline at end of file
diff --git a/csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md b/csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md
deleted file mode 100644
index 8749c790954e..000000000000
--- a/csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* C# 12: Add QL library support (`ExperimentalAttribute`) for the experimental attribute.
diff --git a/csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md b/csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md
deleted file mode 100644
index 586b5341d293..000000000000
--- a/csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* C# 12: Add extractor and QL library support for `ref readonly` parameters.
diff --git a/csharp/ql/lib/change-notes/released/0.8.10.md b/csharp/ql/lib/change-notes/released/0.8.10.md
new file mode 100644
index 000000000000..f591ddc5b21a
--- /dev/null
+++ b/csharp/ql/lib/change-notes/released/0.8.10.md
@@ -0,0 +1,13 @@
+## 0.8.10
+
+### Major Analysis Improvements
+
+* Improved support for flow through captured variables that properly adheres to inter-procedural control flow.
+* We no longer make use of CodeQL database stats, which may affect join-orders in custom queries. It is therefore recommended to test performance of custom queries after upgrading to this version.
+
+### Minor Analysis Improvements
+
+* C# 12: Add QL library support (`ExperimentalAttribute`) for the experimental attribute.
+* C# 12: Add extractor and QL library support for `ref readonly` parameters.
+* C#: The table `expr_compiler_generated` has been deleted and its content has been added to `compiler_generated`.
+* Data flow via get only properties like `public object Obj { get; }` is now captured by the data flow library.
diff --git a/csharp/ql/lib/codeql-pack.release.yml b/csharp/ql/lib/codeql-pack.release.yml
index 5290c29b7fe7..0521f0f75fad 100644
--- a/csharp/ql/lib/codeql-pack.release.yml
+++ b/csharp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/csharp/ql/lib/qlpack.yml b/csharp/ql/lib/qlpack.yml
index d75ea3c63207..93c5c1120a24 100644
--- a/csharp/ql/lib/qlpack.yml
+++ b/csharp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-all
-version: 0.8.10-dev
+version: 0.8.10
groups: csharp
dbscheme: semmlecode.csharp.dbscheme
extractor: csharp
diff --git a/csharp/ql/src/CHANGELOG.md b/csharp/ql/src/CHANGELOG.md
index 9fe1609363fc..46c939e5cee1 100644
--- a/csharp/ql/src/CHANGELOG.md
+++ b/csharp/ql/src/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. The changed queries are `cs/code-injection`, `cs/command-line-injection`, `cs/user-controlled-bypass`, `cs/count-untrusted-data-external-api`, `cs/untrusted-data-to-external-api`, `cs/ldap-injection`, `cs/log-forging`, `cs/xml/missing-validation`, `cs/redos`, `cs/regex-injection`, `cs/resource-injection`, `cs/sql-injection`, `cs/path-injection`, `cs/unsafe-deserialization-untrusted-input`, `cs/web/unvalidated-url-redirection`, `cs/xml/insecure-dtd-handling`, `cs/xml/xpath-injection`, `cs/web/xss`, and `cs/uncontrolled-format-string`.
+
## 0.8.9
### Minor Analysis Improvements
diff --git a/csharp/ql/src/change-notes/2024-02-06-threat-models.md b/csharp/ql/src/change-notes/released/0.8.10.md
similarity index 88%
rename from csharp/ql/src/change-notes/2024-02-06-threat-models.md
rename to csharp/ql/src/change-notes/released/0.8.10.md
index 69ac4e4dc17a..702161c3d28f 100644
--- a/csharp/ql/src/change-notes/2024-02-06-threat-models.md
+++ b/csharp/ql/src/change-notes/released/0.8.10.md
@@ -1,4 +1,5 @@
----
-category: minorAnalysis
----
-* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. The changed queries are `cs/code-injection`, `cs/command-line-injection`, `cs/user-controlled-bypass`, `cs/count-untrusted-data-external-api`, `cs/untrusted-data-to-external-api`, `cs/ldap-injection`, `cs/log-forging`, `cs/xml/missing-validation`, `cs/redos`, `cs/regex-injection`, `cs/resource-injection`, `cs/sql-injection`, `cs/path-injection`, `cs/unsafe-deserialization-untrusted-input`, `cs/web/unvalidated-url-redirection`, `cs/xml/insecure-dtd-handling`, `cs/xml/xpath-injection`, `cs/web/xss`, and `cs/uncontrolled-format-string`.
\ No newline at end of file
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. The changed queries are `cs/code-injection`, `cs/command-line-injection`, `cs/user-controlled-bypass`, `cs/count-untrusted-data-external-api`, `cs/untrusted-data-to-external-api`, `cs/ldap-injection`, `cs/log-forging`, `cs/xml/missing-validation`, `cs/redos`, `cs/regex-injection`, `cs/resource-injection`, `cs/sql-injection`, `cs/path-injection`, `cs/unsafe-deserialization-untrusted-input`, `cs/web/unvalidated-url-redirection`, `cs/xml/insecure-dtd-handling`, `cs/xml/xpath-injection`, `cs/web/xss`, and `cs/uncontrolled-format-string`.
diff --git a/csharp/ql/src/codeql-pack.release.yml b/csharp/ql/src/codeql-pack.release.yml
index 5290c29b7fe7..0521f0f75fad 100644
--- a/csharp/ql/src/codeql-pack.release.yml
+++ b/csharp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/csharp/ql/src/qlpack.yml b/csharp/ql/src/qlpack.yml
index 9ee23cc73078..46384094b19e 100644
--- a/csharp/ql/src/qlpack.yml
+++ b/csharp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-queries
-version: 0.8.10-dev
+version: 0.8.10
groups:
- csharp
- queries
diff --git a/go/ql/consistency-queries/CHANGELOG.md b/go/ql/consistency-queries/CHANGELOG.md
index fba2a8703562..a59e560c4155 100644
--- a/go/ql/consistency-queries/CHANGELOG.md
+++ b/go/ql/consistency-queries/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.0.9
+
+No user-facing changes.
+
## 0.0.8
No user-facing changes.
diff --git a/go/ql/consistency-queries/change-notes/released/0.0.9.md b/go/ql/consistency-queries/change-notes/released/0.0.9.md
new file mode 100644
index 000000000000..c9e17c6d6cf2
--- /dev/null
+++ b/go/ql/consistency-queries/change-notes/released/0.0.9.md
@@ -0,0 +1,3 @@
+## 0.0.9
+
+No user-facing changes.
diff --git a/go/ql/consistency-queries/codeql-pack.release.yml b/go/ql/consistency-queries/codeql-pack.release.yml
index 58fdc6b45deb..ecdd64fbab86 100644
--- a/go/ql/consistency-queries/codeql-pack.release.yml
+++ b/go/ql/consistency-queries/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.8
+lastReleaseVersion: 0.0.9
diff --git a/go/ql/consistency-queries/qlpack.yml b/go/ql/consistency-queries/qlpack.yml
index b574796b9954..d5a2fbee5f19 100644
--- a/go/ql/consistency-queries/qlpack.yml
+++ b/go/ql/consistency-queries/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql-go-consistency-queries
-version: 0.0.9-dev
+version: 0.0.9
groups:
- go
- queries
diff --git a/go/ql/lib/CHANGELOG.md b/go/ql/lib/CHANGELOG.md
index 65a2376217b1..fee5fd37a267 100644
--- a/go/ql/lib/CHANGELOG.md
+++ b/go/ql/lib/CHANGELOG.md
@@ -1,3 +1,14 @@
+## 0.7.10
+
+### Major Analysis Improvements
+
+* We have significantly improved the Go autobuilder to understand a greater range of project layouts, which allows Go source files to be analysed that could previously not be processed.
+* Go 1.22 has been included in the range of supported Go versions.
+
+### Bug Fixes
+
+* Fixed dataflow out of a `map` using a `range` statement.
+
## 0.7.9
No user-facing changes.
diff --git a/go/ql/lib/change-notes/2024-02-14-range-map-read.md b/go/ql/lib/change-notes/2024-02-14-range-map-read.md
deleted file mode 100644
index ea45737a72ea..000000000000
--- a/go/ql/lib/change-notes/2024-02-14-range-map-read.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: fix
----
-* Fixed dataflow out of a `map` using a `range` statement.
diff --git a/go/ql/lib/change-notes/2024-03-04-autobuilder-changes.md b/go/ql/lib/change-notes/released/0.7.10.md
similarity index 68%
rename from go/ql/lib/change-notes/2024-03-04-autobuilder-changes.md
rename to go/ql/lib/change-notes/released/0.7.10.md
index 0442a571029f..55954f8a3945 100644
--- a/go/ql/lib/change-notes/2024-03-04-autobuilder-changes.md
+++ b/go/ql/lib/change-notes/released/0.7.10.md
@@ -1,5 +1,10 @@
----
-category: majorAnalysis
----
+## 0.7.10
+
+### Major Analysis Improvements
+
* We have significantly improved the Go autobuilder to understand a greater range of project layouts, which allows Go source files to be analysed that could previously not be processed.
* Go 1.22 has been included in the range of supported Go versions.
+
+### Bug Fixes
+
+* Fixed dataflow out of a `map` using a `range` statement.
diff --git a/go/ql/lib/codeql-pack.release.yml b/go/ql/lib/codeql-pack.release.yml
index 576395f3405e..675185672974 100644
--- a/go/ql/lib/codeql-pack.release.yml
+++ b/go/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.7.9
+lastReleaseVersion: 0.7.10
diff --git a/go/ql/lib/qlpack.yml b/go/ql/lib/qlpack.yml
index f21e478efa68..8cc190fa880a 100644
--- a/go/ql/lib/qlpack.yml
+++ b/go/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-all
-version: 0.7.10-dev
+version: 0.7.10
groups: go
dbscheme: go.dbscheme
extractor: go
diff --git a/go/ql/src/CHANGELOG.md b/go/ql/src/CHANGELOG.md
index d95165a3a34e..24e38b9890e1 100644
--- a/go/ql/src/CHANGELOG.md
+++ b/go/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.7.10
+
+No user-facing changes.
+
## 0.7.9
### New Queries
diff --git a/go/ql/src/change-notes/released/0.7.10.md b/go/ql/src/change-notes/released/0.7.10.md
new file mode 100644
index 000000000000..989c5b8f6823
--- /dev/null
+++ b/go/ql/src/change-notes/released/0.7.10.md
@@ -0,0 +1,3 @@
+## 0.7.10
+
+No user-facing changes.
diff --git a/go/ql/src/codeql-pack.release.yml b/go/ql/src/codeql-pack.release.yml
index 576395f3405e..675185672974 100644
--- a/go/ql/src/codeql-pack.release.yml
+++ b/go/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.7.9
+lastReleaseVersion: 0.7.10
diff --git a/go/ql/src/qlpack.yml b/go/ql/src/qlpack.yml
index d91cab596127..4ded3a52f63e 100644
--- a/go/ql/src/qlpack.yml
+++ b/go/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-queries
-version: 0.7.10-dev
+version: 0.7.10
groups:
- go
- queries
diff --git a/java/ql/automodel/src/CHANGELOG.md b/java/ql/automodel/src/CHANGELOG.md
index 4a3c54adb385..c3282c773a9d 100644
--- a/java/ql/automodel/src/CHANGELOG.md
+++ b/java/ql/automodel/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.0.17
+
+No user-facing changes.
+
## 0.0.16
No user-facing changes.
diff --git a/java/ql/automodel/src/change-notes/released/0.0.17.md b/java/ql/automodel/src/change-notes/released/0.0.17.md
new file mode 100644
index 000000000000..62cc89030a62
--- /dev/null
+++ b/java/ql/automodel/src/change-notes/released/0.0.17.md
@@ -0,0 +1,3 @@
+## 0.0.17
+
+No user-facing changes.
diff --git a/java/ql/automodel/src/codeql-pack.release.yml b/java/ql/automodel/src/codeql-pack.release.yml
index a49f7be4cff3..cbc3d3cd4934 100644
--- a/java/ql/automodel/src/codeql-pack.release.yml
+++ b/java/ql/automodel/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.16
+lastReleaseVersion: 0.0.17
diff --git a/java/ql/automodel/src/qlpack.yml b/java/ql/automodel/src/qlpack.yml
index 898239be0989..59fab0cdcc53 100644
--- a/java/ql/automodel/src/qlpack.yml
+++ b/java/ql/automodel/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-automodel-queries
-version: 0.0.17-dev
+version: 0.0.17
groups:
- java
- automodel
diff --git a/java/ql/lib/CHANGELOG.md b/java/ql/lib/CHANGELOG.md
index d369cbdc9318..2a02ccee6abb 100644
--- a/java/ql/lib/CHANGELOG.md
+++ b/java/ql/lib/CHANGELOG.md
@@ -1,3 +1,14 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Java expressions with erroneous types (e.g. the result of a call whose callee couldn't be resolved during extraction) are now given a CodeQL `ErrorType` more often.
+
+### Bug Fixes
+
+* Fixed the Java autobuilder overriding the version of Maven used by a project when the Maven wrapper `mvnw` is in use and the `maven-wrapper.jar` file is not present in the repository.
+* Some flow steps related to `android.text.Editable.toString` that were accidentally disabled have been re-enabled.
+
## 0.8.9
### Deprecated APIs
diff --git a/java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md b/java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md
deleted file mode 100644
index eb560fba07da..000000000000
--- a/java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: fix
----
-* Some flow steps related to `android.text.Editable.toString` that were accidentally disabled have been re-enabled.
diff --git a/java/ql/lib/change-notes/2024-02-27-error-types.md b/java/ql/lib/change-notes/2024-02-27-error-types.md
deleted file mode 100644
index cdc6d7620aa8..000000000000
--- a/java/ql/lib/change-notes/2024-02-27-error-types.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Java expressions with erroneous types (e.g. the result of a call whose callee couldn't be resolved during extraction) are now given a CodeQL `ErrorType` more often.
diff --git a/java/ql/lib/change-notes/2024-02-27-mvnw-versions.md b/java/ql/lib/change-notes/2024-02-27-mvnw-versions.md
deleted file mode 100644
index a0227088ae97..000000000000
--- a/java/ql/lib/change-notes/2024-02-27-mvnw-versions.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: fix
----
-* Fixed the Java autobuilder overriding the version of Maven used by a project when the Maven wrapper `mvnw` is in use and the `maven-wrapper.jar` file is not present in the repository.
diff --git a/java/ql/lib/change-notes/released/0.8.10.md b/java/ql/lib/change-notes/released/0.8.10.md
new file mode 100644
index 000000000000..b45f14bf347a
--- /dev/null
+++ b/java/ql/lib/change-notes/released/0.8.10.md
@@ -0,0 +1,10 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Java expressions with erroneous types (e.g. the result of a call whose callee couldn't be resolved during extraction) are now given a CodeQL `ErrorType` more often.
+
+### Bug Fixes
+
+* Fixed the Java autobuilder overriding the version of Maven used by a project when the Maven wrapper `mvnw` is in use and the `maven-wrapper.jar` file is not present in the repository.
+* Some flow steps related to `android.text.Editable.toString` that were accidentally disabled have been re-enabled.
diff --git a/java/ql/lib/codeql-pack.release.yml b/java/ql/lib/codeql-pack.release.yml
index 5290c29b7fe7..0521f0f75fad 100644
--- a/java/ql/lib/codeql-pack.release.yml
+++ b/java/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/java/ql/lib/qlpack.yml b/java/ql/lib/qlpack.yml
index 15b4982d41eb..428eedc75e3d 100644
--- a/java/ql/lib/qlpack.yml
+++ b/java/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-all
-version: 0.8.10-dev
+version: 0.8.10
groups: java
dbscheme: config/semmlecode.dbscheme
extractor: java
diff --git a/java/ql/src/CHANGELOG.md b/java/ql/src/CHANGELOG.md
index 5d8353514538..c61275f5ed84 100644
--- a/java/ql/src/CHANGELOG.md
+++ b/java/ql/src/CHANGELOG.md
@@ -1,3 +1,13 @@
+## 0.8.10
+
+### New Queries
+
+* Added a new query `java/android/insecure-local-key-gen` for finding instances of keys generated for biometric authentication in an insecure way.
+
+### Minor Analysis Improvements
+
+* To reduce the number of false positives in the query "Insertion of sensitive information into log files" (`java/sensitive-log`), variables with names that contain "null" (case-insensitively) are no longer considered sources of sensitive information.
+
## 0.8.9
### New Queries
diff --git a/java/ql/src/change-notes/2024-02-12-android-insecure-keys.md b/java/ql/src/change-notes/2024-02-12-android-insecure-keys.md
deleted file mode 100644
index 1de077277962..000000000000
--- a/java/ql/src/change-notes/2024-02-12-android-insecure-keys.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: newQuery
----
-* Added a new query `java/android/insecure-local-key-gen` for finding instances of keys generated for biometric authentication in an insecure way.
\ No newline at end of file
diff --git a/java/ql/src/change-notes/2024-03-04-sensitive-log-remove-null-from-sources.md b/java/ql/src/change-notes/released/0.8.10.md
similarity index 54%
rename from java/ql/src/change-notes/2024-03-04-sensitive-log-remove-null-from-sources.md
rename to java/ql/src/change-notes/released/0.8.10.md
index 0bb4f18f2bd9..c5d18ae33794 100644
--- a/java/ql/src/change-notes/2024-03-04-sensitive-log-remove-null-from-sources.md
+++ b/java/ql/src/change-notes/released/0.8.10.md
@@ -1,4 +1,9 @@
----
-category: minorAnalysis
----
+## 0.8.10
+
+### New Queries
+
+* Added a new query `java/android/insecure-local-key-gen` for finding instances of keys generated for biometric authentication in an insecure way.
+
+### Minor Analysis Improvements
+
* To reduce the number of false positives in the query "Insertion of sensitive information into log files" (`java/sensitive-log`), variables with names that contain "null" (case-insensitively) are no longer considered sources of sensitive information.
diff --git a/java/ql/src/codeql-pack.release.yml b/java/ql/src/codeql-pack.release.yml
index 5290c29b7fe7..0521f0f75fad 100644
--- a/java/ql/src/codeql-pack.release.yml
+++ b/java/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/java/ql/src/qlpack.yml b/java/ql/src/qlpack.yml
index 8f4de528e213..ebbdbeee3b2c 100644
--- a/java/ql/src/qlpack.yml
+++ b/java/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-queries
-version: 0.8.10-dev
+version: 0.8.10
groups:
- java
- queries
diff --git a/javascript/ql/lib/CHANGELOG.md b/javascript/ql/lib/CHANGELOG.md
index 5b97ebbb22b3..d5edcc005131 100644
--- a/javascript/ql/lib/CHANGELOG.md
+++ b/javascript/ql/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.8.10
+
+No user-facing changes.
+
## 0.8.9
### Minor Analysis Improvements
diff --git a/javascript/ql/lib/change-notes/released/0.8.10.md b/javascript/ql/lib/change-notes/released/0.8.10.md
new file mode 100644
index 000000000000..777bbd2fdede
--- /dev/null
+++ b/javascript/ql/lib/change-notes/released/0.8.10.md
@@ -0,0 +1,3 @@
+## 0.8.10
+
+No user-facing changes.
diff --git a/javascript/ql/lib/codeql-pack.release.yml b/javascript/ql/lib/codeql-pack.release.yml
index 5290c29b7fe7..0521f0f75fad 100644
--- a/javascript/ql/lib/codeql-pack.release.yml
+++ b/javascript/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/javascript/ql/lib/qlpack.yml b/javascript/ql/lib/qlpack.yml
index ef3ca7521aca..da16493a21c9 100644
--- a/javascript/ql/lib/qlpack.yml
+++ b/javascript/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-all
-version: 0.8.10-dev
+version: 0.8.10
groups: javascript
dbscheme: semmlecode.javascript.dbscheme
extractor: javascript
diff --git a/javascript/ql/src/CHANGELOG.md b/javascript/ql/src/CHANGELOG.md
index 85516e3625d1..b9627cac5eee 100644
--- a/javascript/ql/src/CHANGELOG.md
+++ b/javascript/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.8.10
+
+No user-facing changes.
+
## 0.8.9
### Bug Fixes
diff --git a/javascript/ql/src/change-notes/released/0.8.10.md b/javascript/ql/src/change-notes/released/0.8.10.md
new file mode 100644
index 000000000000..777bbd2fdede
--- /dev/null
+++ b/javascript/ql/src/change-notes/released/0.8.10.md
@@ -0,0 +1,3 @@
+## 0.8.10
+
+No user-facing changes.
diff --git a/javascript/ql/src/codeql-pack.release.yml b/javascript/ql/src/codeql-pack.release.yml
index 5290c29b7fe7..0521f0f75fad 100644
--- a/javascript/ql/src/codeql-pack.release.yml
+++ b/javascript/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/javascript/ql/src/qlpack.yml b/javascript/ql/src/qlpack.yml
index b6181aa30e99..d224952c5641 100644
--- a/javascript/ql/src/qlpack.yml
+++ b/javascript/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-queries
-version: 0.8.10-dev
+version: 0.8.10
groups:
- javascript
- queries
diff --git a/misc/suite-helpers/CHANGELOG.md b/misc/suite-helpers/CHANGELOG.md
index 3c06dd69b0f5..1c4455b66c43 100644
--- a/misc/suite-helpers/CHANGELOG.md
+++ b/misc/suite-helpers/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.7.10
+
+No user-facing changes.
+
## 0.7.9
No user-facing changes.
diff --git a/misc/suite-helpers/change-notes/released/0.7.10.md b/misc/suite-helpers/change-notes/released/0.7.10.md
new file mode 100644
index 000000000000..989c5b8f6823
--- /dev/null
+++ b/misc/suite-helpers/change-notes/released/0.7.10.md
@@ -0,0 +1,3 @@
+## 0.7.10
+
+No user-facing changes.
diff --git a/misc/suite-helpers/codeql-pack.release.yml b/misc/suite-helpers/codeql-pack.release.yml
index 576395f3405e..675185672974 100644
--- a/misc/suite-helpers/codeql-pack.release.yml
+++ b/misc/suite-helpers/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.7.9
+lastReleaseVersion: 0.7.10
diff --git a/misc/suite-helpers/qlpack.yml b/misc/suite-helpers/qlpack.yml
index 49b7a6bda4c2..54d978d5efe7 100644
--- a/misc/suite-helpers/qlpack.yml
+++ b/misc/suite-helpers/qlpack.yml
@@ -1,4 +1,4 @@
name: codeql/suite-helpers
-version: 0.7.10-dev
+version: 0.7.10
groups: shared
warnOnImplicitThis: true
diff --git a/python/ql/lib/CHANGELOG.md b/python/ql/lib/CHANGELOG.md
index e6f318c51ea8..f095607ca1bf 100644
--- a/python/ql/lib/CHANGELOG.md
+++ b/python/ql/lib/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 0.11.10
+
+### Minor Analysis Improvements
+
+* Fixed missing flow for dictionary updates (`d[] = ...`) when `` is a string constant not used in dictionary literals or as name of keyword-argument.
+* Fixed flow for iterable unpacking (`a,b = my_tuple`) when it occurs on top-level (module) scope.
+
## 0.11.9
### Minor Analysis Improvements
diff --git a/python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md b/python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md
deleted file mode 100644
index 3c47c6ba866a..000000000000
--- a/python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Fixed flow for iterable unpacking (`a,b = my_tuple`) when it occurs on top-level (module) scope.
diff --git a/python/ql/lib/change-notes/2024-03-01-dict-update-content.md b/python/ql/lib/change-notes/released/0.11.10.md
similarity index 52%
rename from python/ql/lib/change-notes/2024-03-01-dict-update-content.md
rename to python/ql/lib/change-notes/released/0.11.10.md
index dfb8d247fffa..ed873724e4f2 100644
--- a/python/ql/lib/change-notes/2024-03-01-dict-update-content.md
+++ b/python/ql/lib/change-notes/released/0.11.10.md
@@ -1,4 +1,6 @@
----
-category: minorAnalysis
----
+## 0.11.10
+
+### Minor Analysis Improvements
+
* Fixed missing flow for dictionary updates (`d[] = ...`) when `` is a string constant not used in dictionary literals or as name of keyword-argument.
+* Fixed flow for iterable unpacking (`a,b = my_tuple`) when it occurs on top-level (module) scope.
diff --git a/python/ql/lib/codeql-pack.release.yml b/python/ql/lib/codeql-pack.release.yml
index b064d1778a10..ddddcbe9193d 100644
--- a/python/ql/lib/codeql-pack.release.yml
+++ b/python/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.11.9
+lastReleaseVersion: 0.11.10
diff --git a/python/ql/lib/qlpack.yml b/python/ql/lib/qlpack.yml
index e9f66e205f24..59a8b4c96d17 100644
--- a/python/ql/lib/qlpack.yml
+++ b/python/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-all
-version: 0.11.10-dev
+version: 0.11.10
groups: python
dbscheme: semmlecode.python.dbscheme
extractor: python
diff --git a/python/ql/src/CHANGELOG.md b/python/ql/src/CHANGELOG.md
index 50762bcbf34e..d4245aba7a62 100644
--- a/python/ql/src/CHANGELOG.md
+++ b/python/ql/src/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 0.9.10
+
+### New Queries
+
+* The query `py/nosql-injection` for finding NoSQL injection vulnerabilities is now part of the default security suite.
+
## 0.9.9
No user-facing changes.
diff --git a/python/ql/src/change-notes/2024-03-04-nosql-injection.md b/python/ql/src/change-notes/released/0.9.10.md
similarity index 81%
rename from python/ql/src/change-notes/2024-03-04-nosql-injection.md
rename to python/ql/src/change-notes/released/0.9.10.md
index 6e98540c757c..4cbb221b789f 100644
--- a/python/ql/src/change-notes/2024-03-04-nosql-injection.md
+++ b/python/ql/src/change-notes/released/0.9.10.md
@@ -1,4 +1,5 @@
----
-category: newQuery
----
+## 0.9.10
+
+### New Queries
+
* The query `py/nosql-injection` for finding NoSQL injection vulnerabilities is now part of the default security suite.
diff --git a/python/ql/src/codeql-pack.release.yml b/python/ql/src/codeql-pack.release.yml
index aabed7c396b7..d086ed69541d 100644
--- a/python/ql/src/codeql-pack.release.yml
+++ b/python/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.9.9
+lastReleaseVersion: 0.9.10
diff --git a/python/ql/src/qlpack.yml b/python/ql/src/qlpack.yml
index aa18f2d87074..c920f667836b 100644
--- a/python/ql/src/qlpack.yml
+++ b/python/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-queries
-version: 0.9.10-dev
+version: 0.9.10
groups:
- python
- queries
diff --git a/ruby/ql/lib/CHANGELOG.md b/ruby/ql/lib/CHANGELOG.md
index a623a151e891..c61a12e0f4ad 100644
--- a/ruby/ql/lib/CHANGELOG.md
+++ b/ruby/ql/lib/CHANGELOG.md
@@ -1,3 +1,12 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Calls to `I18n.translate` as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
+* Calls to `Arel::Nodes::SqlLiteral.new` are now modeled as instances of the `SqlConstruction` concept, as well as propagating taint from their argument.
+* Additional arguments beyond the first of calls to the `ActiveRecord` methods `select`, `reselect`, `order`, `reorder`, `joins`, `group`, and `pluck` are now recognized as sql injection sinks.
+* Calls to several methods of `ActiveRecord::Connection`, such as `ActiveRecord::Connection#exec_query`, are now recognized as SQL executions, including those via subclasses.
+
## 0.8.9
### Minor Analysis Improvements
diff --git a/ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md b/ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md
deleted file mode 100644
index c2276f284a84..000000000000
--- a/ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Calls to several methods of `ActiveRecord::Connection`, such as `ActiveRecord::Connection#exec_query`, are now recognized as SQL executions, including those via subclasses.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md b/ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md
deleted file mode 100644
index 1486c7a472d1..000000000000
--- a/ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Additional arguments beyond the first of calls to the `ActiveRecord` methods `select`, `reselect`, `order`, `reorder`, `joins`, `group`, and `pluck` are now recognized as sql injection sinks.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md b/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
deleted file mode 100644
index 6f3a90768bab..000000000000
--- a/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Calls to `Arel::Nodes::SqlLiteral.new` are now modeled as instances of the `SqlConstruction` concept, as well as propagating taint from their argument.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md b/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
deleted file mode 100644
index 350e049b5bfc..000000000000
--- a/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Calls to `I18n.translate` as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/released/0.8.10.md b/ruby/ql/lib/change-notes/released/0.8.10.md
new file mode 100644
index 000000000000..666e28f840e7
--- /dev/null
+++ b/ruby/ql/lib/change-notes/released/0.8.10.md
@@ -0,0 +1,8 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Calls to `I18n.translate` as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
+* Calls to `Arel::Nodes::SqlLiteral.new` are now modeled as instances of the `SqlConstruction` concept, as well as propagating taint from their argument.
+* Additional arguments beyond the first of calls to the `ActiveRecord` methods `select`, `reselect`, `order`, `reorder`, `joins`, `group`, and `pluck` are now recognized as sql injection sinks.
+* Calls to several methods of `ActiveRecord::Connection`, such as `ActiveRecord::Connection#exec_query`, are now recognized as SQL executions, including those via subclasses.
diff --git a/ruby/ql/lib/codeql-pack.release.yml b/ruby/ql/lib/codeql-pack.release.yml
index 5290c29b7fe7..0521f0f75fad 100644
--- a/ruby/ql/lib/codeql-pack.release.yml
+++ b/ruby/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/ruby/ql/lib/qlpack.yml b/ruby/ql/lib/qlpack.yml
index 7d409b83adbd..de5b41999fe1 100644
--- a/ruby/ql/lib/qlpack.yml
+++ b/ruby/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-all
-version: 0.8.10-dev
+version: 0.8.10
groups: ruby
extractor: ruby
dbscheme: ruby.dbscheme
diff --git a/ruby/ql/src/CHANGELOG.md b/ruby/ql/src/CHANGELOG.md
index 4149c728effa..f875b6d16ad4 100644
--- a/ruby/ql/src/CHANGELOG.md
+++ b/ruby/ql/src/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Calls to `Object#method`, `Object#public_method` and `Object#singleton_method` with untrusted data are now recognised as sinks for code injection.
+* Added additional request sources for Ruby on Rails.
+
## 0.8.9
No user-facing changes.
diff --git a/ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md b/ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md
deleted file mode 100644
index 84ea696dfef4..000000000000
--- a/ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Added additional request sources for Ruby on Rails.
\ No newline at end of file
diff --git a/ruby/ql/src/change-notes/2024-03-01-method-code-injection-sinks.md b/ruby/ql/src/change-notes/released/0.8.10.md
similarity index 51%
rename from ruby/ql/src/change-notes/2024-03-01-method-code-injection-sinks.md
rename to ruby/ql/src/change-notes/released/0.8.10.md
index 43e40d3fd536..985cdf8d22e0 100644
--- a/ruby/ql/src/change-notes/2024-03-01-method-code-injection-sinks.md
+++ b/ruby/ql/src/change-notes/released/0.8.10.md
@@ -1,4 +1,6 @@
----
-category: minorAnalysis
----
-* Calls to `Object#method`, `Object#public_method` and `Object#singleton_method` with untrusted data are now recognised as sinks for code injection.
\ No newline at end of file
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Calls to `Object#method`, `Object#public_method` and `Object#singleton_method` with untrusted data are now recognised as sinks for code injection.
+* Added additional request sources for Ruby on Rails.
diff --git a/ruby/ql/src/codeql-pack.release.yml b/ruby/ql/src/codeql-pack.release.yml
index 5290c29b7fe7..0521f0f75fad 100644
--- a/ruby/ql/src/codeql-pack.release.yml
+++ b/ruby/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/ruby/ql/src/qlpack.yml b/ruby/ql/src/qlpack.yml
index 8af7f9fd7976..5e3792682346 100644
--- a/ruby/ql/src/qlpack.yml
+++ b/ruby/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-queries
-version: 0.8.10-dev
+version: 0.8.10
groups:
- ruby
- queries
diff --git a/shared/controlflow/CHANGELOG.md b/shared/controlflow/CHANGELOG.md
index dbfa6ef4512d..75f2ca53f987 100644
--- a/shared/controlflow/CHANGELOG.md
+++ b/shared/controlflow/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.1.10
+
+No user-facing changes.
+
## 0.1.9
No user-facing changes.
diff --git a/shared/controlflow/change-notes/released/0.1.10.md b/shared/controlflow/change-notes/released/0.1.10.md
new file mode 100644
index 000000000000..47358eeee934
--- /dev/null
+++ b/shared/controlflow/change-notes/released/0.1.10.md
@@ -0,0 +1,3 @@
+## 0.1.10
+
+No user-facing changes.
diff --git a/shared/controlflow/codeql-pack.release.yml b/shared/controlflow/codeql-pack.release.yml
index 1425c0edf7f8..30f5ca88be0e 100644
--- a/shared/controlflow/codeql-pack.release.yml
+++ b/shared/controlflow/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.1.9
+lastReleaseVersion: 0.1.10
diff --git a/shared/controlflow/qlpack.yml b/shared/controlflow/qlpack.yml
index 9d35a6782761..1d43802be421 100644
--- a/shared/controlflow/qlpack.yml
+++ b/shared/controlflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/controlflow
-version: 0.1.10-dev
+version: 0.1.10
groups: shared
library: true
dependencies:
diff --git a/shared/dataflow/CHANGELOG.md b/shared/dataflow/CHANGELOG.md
index 67a5bf589f4f..ef80788bded6 100644
--- a/shared/dataflow/CHANGELOG.md
+++ b/shared/dataflow/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.1
+
+No user-facing changes.
+
## 0.2.0
### Breaking Changes
diff --git a/shared/dataflow/change-notes/released/0.2.1.md b/shared/dataflow/change-notes/released/0.2.1.md
new file mode 100644
index 000000000000..3dbfc85fe11d
--- /dev/null
+++ b/shared/dataflow/change-notes/released/0.2.1.md
@@ -0,0 +1,3 @@
+## 0.2.1
+
+No user-facing changes.
diff --git a/shared/dataflow/codeql-pack.release.yml b/shared/dataflow/codeql-pack.release.yml
index 5274e27ed522..df29a726bccc 100644
--- a/shared/dataflow/codeql-pack.release.yml
+++ b/shared/dataflow/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.0
+lastReleaseVersion: 0.2.1
diff --git a/shared/dataflow/qlpack.yml b/shared/dataflow/qlpack.yml
index 1e7becf71c4f..ee422e02ea9a 100644
--- a/shared/dataflow/qlpack.yml
+++ b/shared/dataflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/dataflow
-version: 0.2.1-dev
+version: 0.2.1
groups: shared
library: true
dependencies:
diff --git a/shared/mad/CHANGELOG.md b/shared/mad/CHANGELOG.md
index 4d09057118ce..4730366775ea 100644
--- a/shared/mad/CHANGELOG.md
+++ b/shared/mad/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/mad/change-notes/released/0.2.10.md b/shared/mad/change-notes/released/0.2.10.md
new file mode 100644
index 000000000000..81c9722b19fe
--- /dev/null
+++ b/shared/mad/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/mad/codeql-pack.release.yml b/shared/mad/codeql-pack.release.yml
index d021cf0a6bed..a71167814cb7 100644
--- a/shared/mad/codeql-pack.release.yml
+++ b/shared/mad/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/mad/qlpack.yml b/shared/mad/qlpack.yml
index 22c8f271ccc6..6d7269ef3da8 100644
--- a/shared/mad/qlpack.yml
+++ b/shared/mad/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/mad
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
dependencies: null
diff --git a/shared/rangeanalysis/CHANGELOG.md b/shared/rangeanalysis/CHANGELOG.md
index 5b8dbcfab22c..9943dcb79727 100644
--- a/shared/rangeanalysis/CHANGELOG.md
+++ b/shared/rangeanalysis/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.0.9
+
+No user-facing changes.
+
## 0.0.8
No user-facing changes.
diff --git a/shared/rangeanalysis/change-notes/released/0.0.9.md b/shared/rangeanalysis/change-notes/released/0.0.9.md
new file mode 100644
index 000000000000..c9e17c6d6cf2
--- /dev/null
+++ b/shared/rangeanalysis/change-notes/released/0.0.9.md
@@ -0,0 +1,3 @@
+## 0.0.9
+
+No user-facing changes.
diff --git a/shared/rangeanalysis/codeql-pack.release.yml b/shared/rangeanalysis/codeql-pack.release.yml
index 58fdc6b45deb..ecdd64fbab86 100644
--- a/shared/rangeanalysis/codeql-pack.release.yml
+++ b/shared/rangeanalysis/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.8
+lastReleaseVersion: 0.0.9
diff --git a/shared/rangeanalysis/qlpack.yml b/shared/rangeanalysis/qlpack.yml
index 836fe51ee344..01db5d5734d0 100644
--- a/shared/rangeanalysis/qlpack.yml
+++ b/shared/rangeanalysis/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/rangeanalysis
-version: 0.0.9-dev
+version: 0.0.9
groups: shared
library: true
dependencies:
diff --git a/shared/regex/CHANGELOG.md b/shared/regex/CHANGELOG.md
index cd5f91f71ec1..c05869c153d3 100644
--- a/shared/regex/CHANGELOG.md
+++ b/shared/regex/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/regex/change-notes/released/0.2.10.md b/shared/regex/change-notes/released/0.2.10.md
new file mode 100644
index 000000000000..81c9722b19fe
--- /dev/null
+++ b/shared/regex/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/regex/codeql-pack.release.yml b/shared/regex/codeql-pack.release.yml
index d021cf0a6bed..a71167814cb7 100644
--- a/shared/regex/codeql-pack.release.yml
+++ b/shared/regex/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/regex/qlpack.yml b/shared/regex/qlpack.yml
index ea3f7f9b2389..0d4f485312f7 100644
--- a/shared/regex/qlpack.yml
+++ b/shared/regex/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/regex
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
dependencies:
diff --git a/shared/ssa/CHANGELOG.md b/shared/ssa/CHANGELOG.md
index 01acfae01489..a9161ff578b0 100644
--- a/shared/ssa/CHANGELOG.md
+++ b/shared/ssa/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/ssa/change-notes/released/0.2.10.md b/shared/ssa/change-notes/released/0.2.10.md
new file mode 100644
index 000000000000..81c9722b19fe
--- /dev/null
+++ b/shared/ssa/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/ssa/codeql-pack.release.yml b/shared/ssa/codeql-pack.release.yml
index d021cf0a6bed..a71167814cb7 100644
--- a/shared/ssa/codeql-pack.release.yml
+++ b/shared/ssa/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/ssa/qlpack.yml b/shared/ssa/qlpack.yml
index 19304ad107f1..2ad254711a50 100644
--- a/shared/ssa/qlpack.yml
+++ b/shared/ssa/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ssa
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
dependencies:
diff --git a/shared/threat-models/CHANGELOG.md b/shared/threat-models/CHANGELOG.md
index fba2a8703562..a59e560c4155 100644
--- a/shared/threat-models/CHANGELOG.md
+++ b/shared/threat-models/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.0.9
+
+No user-facing changes.
+
## 0.0.8
No user-facing changes.
diff --git a/shared/threat-models/change-notes/released/0.0.9.md b/shared/threat-models/change-notes/released/0.0.9.md
new file mode 100644
index 000000000000..c9e17c6d6cf2
--- /dev/null
+++ b/shared/threat-models/change-notes/released/0.0.9.md
@@ -0,0 +1,3 @@
+## 0.0.9
+
+No user-facing changes.
diff --git a/shared/threat-models/codeql-pack.release.yml b/shared/threat-models/codeql-pack.release.yml
index 58fdc6b45deb..ecdd64fbab86 100644
--- a/shared/threat-models/codeql-pack.release.yml
+++ b/shared/threat-models/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.8
+lastReleaseVersion: 0.0.9
diff --git a/shared/threat-models/qlpack.yml b/shared/threat-models/qlpack.yml
index d0ed9a913b21..60cbbc56fcb3 100644
--- a/shared/threat-models/qlpack.yml
+++ b/shared/threat-models/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/threat-models
-version: 0.0.9-dev
+version: 0.0.9
library: true
groups: shared
dataExtensions:
diff --git a/shared/tutorial/CHANGELOG.md b/shared/tutorial/CHANGELOG.md
index 1db3a01af0b1..560ad058d5b3 100644
--- a/shared/tutorial/CHANGELOG.md
+++ b/shared/tutorial/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/tutorial/change-notes/released/0.2.10.md b/shared/tutorial/change-notes/released/0.2.10.md
new file mode 100644
index 000000000000..81c9722b19fe
--- /dev/null
+++ b/shared/tutorial/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/tutorial/codeql-pack.release.yml b/shared/tutorial/codeql-pack.release.yml
index d021cf0a6bed..a71167814cb7 100644
--- a/shared/tutorial/codeql-pack.release.yml
+++ b/shared/tutorial/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/tutorial/qlpack.yml b/shared/tutorial/qlpack.yml
index b595ae9ee70a..69116705c1bf 100644
--- a/shared/tutorial/qlpack.yml
+++ b/shared/tutorial/qlpack.yml
@@ -1,7 +1,7 @@
name: codeql/tutorial
description: Library for the CodeQL detective tutorials, helping new users learn to
write CodeQL queries.
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/typetracking/CHANGELOG.md b/shared/typetracking/CHANGELOG.md
index afc857bc6bce..350f9ecbeae0 100644
--- a/shared/typetracking/CHANGELOG.md
+++ b/shared/typetracking/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/typetracking/change-notes/released/0.2.10.md b/shared/typetracking/change-notes/released/0.2.10.md
new file mode 100644
index 000000000000..81c9722b19fe
--- /dev/null
+++ b/shared/typetracking/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/typetracking/codeql-pack.release.yml b/shared/typetracking/codeql-pack.release.yml
index d021cf0a6bed..a71167814cb7 100644
--- a/shared/typetracking/codeql-pack.release.yml
+++ b/shared/typetracking/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/typetracking/qlpack.yml b/shared/typetracking/qlpack.yml
index b55927f59bb7..fbbdcf5162a1 100644
--- a/shared/typetracking/qlpack.yml
+++ b/shared/typetracking/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typetracking
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
dependencies:
diff --git a/shared/typos/CHANGELOG.md b/shared/typos/CHANGELOG.md
index 66c5871d9821..54b1eaa4d589 100644
--- a/shared/typos/CHANGELOG.md
+++ b/shared/typos/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/typos/change-notes/released/0.2.10.md b/shared/typos/change-notes/released/0.2.10.md
new file mode 100644
index 000000000000..81c9722b19fe
--- /dev/null
+++ b/shared/typos/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/typos/codeql-pack.release.yml b/shared/typos/codeql-pack.release.yml
index d021cf0a6bed..a71167814cb7 100644
--- a/shared/typos/codeql-pack.release.yml
+++ b/shared/typos/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/typos/qlpack.yml b/shared/typos/qlpack.yml
index 644bfe11bff7..4d59d9b3c342 100644
--- a/shared/typos/qlpack.yml
+++ b/shared/typos/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typos
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/util/CHANGELOG.md b/shared/util/CHANGELOG.md
index 63832e927fa5..1ca1f71bcbc2 100644
--- a/shared/util/CHANGELOG.md
+++ b/shared/util/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/util/change-notes/released/0.2.10.md b/shared/util/change-notes/released/0.2.10.md
new file mode 100644
index 000000000000..81c9722b19fe
--- /dev/null
+++ b/shared/util/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/util/codeql-pack.release.yml b/shared/util/codeql-pack.release.yml
index d021cf0a6bed..a71167814cb7 100644
--- a/shared/util/codeql-pack.release.yml
+++ b/shared/util/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/util/qlpack.yml b/shared/util/qlpack.yml
index ca1a866a53d4..28ed738a93dd 100644
--- a/shared/util/qlpack.yml
+++ b/shared/util/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/util
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
dependencies: null
diff --git a/shared/yaml/CHANGELOG.md b/shared/yaml/CHANGELOG.md
index e5495abcd503..9fd5ebc26ab2 100644
--- a/shared/yaml/CHANGELOG.md
+++ b/shared/yaml/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/yaml/change-notes/released/0.2.10.md b/shared/yaml/change-notes/released/0.2.10.md
new file mode 100644
index 000000000000..81c9722b19fe
--- /dev/null
+++ b/shared/yaml/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/yaml/codeql-pack.release.yml b/shared/yaml/codeql-pack.release.yml
index d021cf0a6bed..a71167814cb7 100644
--- a/shared/yaml/codeql-pack.release.yml
+++ b/shared/yaml/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/yaml/qlpack.yml b/shared/yaml/qlpack.yml
index de5b47e120ae..9643ffcec66b 100644
--- a/shared/yaml/qlpack.yml
+++ b/shared/yaml/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/yaml
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/swift/ql/lib/CHANGELOG.md b/swift/ql/lib/CHANGELOG.md
index e88cd0259ccf..8f14bfcedc9c 100644
--- a/swift/ql/lib/CHANGELOG.md
+++ b/swift/ql/lib/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 0.3.10
+
+### Bug Fixes
+
+* Fixed an issue where `TypeDecl.getFullName` would get stuck in an loop and fail when minor database inconsistencies are present.
+
## 0.3.9
### Minor Analysis Improvements
diff --git a/swift/ql/lib/change-notes/2024-02-22-extension-patch.md b/swift/ql/lib/change-notes/released/0.3.10.md
similarity index 83%
rename from swift/ql/lib/change-notes/2024-02-22-extension-patch.md
rename to swift/ql/lib/change-notes/released/0.3.10.md
index 7bd78f3b785c..9d6286ff58a7 100644
--- a/swift/ql/lib/change-notes/2024-02-22-extension-patch.md
+++ b/swift/ql/lib/change-notes/released/0.3.10.md
@@ -1,4 +1,5 @@
----
-category: fix
----
+## 0.3.10
+
+### Bug Fixes
+
* Fixed an issue where `TypeDecl.getFullName` would get stuck in an loop and fail when minor database inconsistencies are present.
diff --git a/swift/ql/lib/codeql-pack.release.yml b/swift/ql/lib/codeql-pack.release.yml
index 3fa5180bcb49..76ca0ac8ba76 100644
--- a/swift/ql/lib/codeql-pack.release.yml
+++ b/swift/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.3.9
+lastReleaseVersion: 0.3.10
diff --git a/swift/ql/lib/qlpack.yml b/swift/ql/lib/qlpack.yml
index a37a4cb3d580..70ec4798ea85 100644
--- a/swift/ql/lib/qlpack.yml
+++ b/swift/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-all
-version: 0.3.10-dev
+version: 0.3.10
groups: swift
extractor: swift
dbscheme: swift.dbscheme
diff --git a/swift/ql/src/CHANGELOG.md b/swift/ql/src/CHANGELOG.md
index 96615d069729..bda9834c9bca 100644
--- a/swift/ql/src/CHANGELOG.md
+++ b/swift/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.3.10
+
+No user-facing changes.
+
## 0.3.9
### New Queries
diff --git a/swift/ql/src/change-notes/released/0.3.10.md b/swift/ql/src/change-notes/released/0.3.10.md
new file mode 100644
index 000000000000..925a48fc52e0
--- /dev/null
+++ b/swift/ql/src/change-notes/released/0.3.10.md
@@ -0,0 +1,3 @@
+## 0.3.10
+
+No user-facing changes.
diff --git a/swift/ql/src/codeql-pack.release.yml b/swift/ql/src/codeql-pack.release.yml
index 3fa5180bcb49..76ca0ac8ba76 100644
--- a/swift/ql/src/codeql-pack.release.yml
+++ b/swift/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.3.9
+lastReleaseVersion: 0.3.10
diff --git a/swift/ql/src/qlpack.yml b/swift/ql/src/qlpack.yml
index e3ead42c98bf..ba66b065529b 100644
--- a/swift/ql/src/qlpack.yml
+++ b/swift/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-queries
-version: 0.3.10-dev
+version: 0.3.10
groups:
- swift
- queries
From ce31f8641a4c4f83c8665bdf48de524862aa15c7 Mon Sep 17 00:00:00 2001
From: Angela P Wen
Date: Wed, 6 Mar 2024 12:07:33 -0800
Subject: [PATCH 068/731] Revert "Release preparation for version 2.16.4"
---
cpp/ql/lib/CHANGELOG.md | 6 ------
....12.7.md => 2024-02-26-ir-named-destructors.md} | 9 ++++-----
cpp/ql/lib/codeql-pack.release.yml | 2 +-
cpp/ql/lib/qlpack.yml | 2 +-
cpp/ql/src/CHANGELOG.md | 7 -------
...=> 2024-02-16-modelled-functions-block-flow.md} | 8 +++-----
.../2024-02-29-non-constant-format-path-query.md | 4 ++++
cpp/ql/src/codeql-pack.release.yml | 2 +-
cpp/ql/src/qlpack.yml | 2 +-
csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md | 4 ----
.../Solorigate/lib/change-notes/released/1.7.10.md | 3 ---
.../Solorigate/lib/codeql-pack.release.yml | 2 +-
csharp/ql/campaigns/Solorigate/lib/qlpack.yml | 2 +-
csharp/ql/campaigns/Solorigate/src/CHANGELOG.md | 4 ----
.../Solorigate/src/change-notes/released/1.7.10.md | 3 ---
.../Solorigate/src/codeql-pack.release.yml | 2 +-
csharp/ql/campaigns/Solorigate/src/qlpack.yml | 2 +-
csharp/ql/lib/CHANGELOG.md | 14 --------------
.../change-notes/2024-02-21-getonly-properties.md | 4 ++++
.../ql/lib/change-notes/2024-02-22-no-db-stats.md | 4 ++++
.../change-notes/2024-02-23-compiler-generated.md | 4 ++++
.../2024-02-26-variable-capture-flow.md | 4 ++++
.../2024-02-28-experimental-attribute.md | 4 ++++
.../2024-02-28-refreadonly-parameter.md | 4 ++++
csharp/ql/lib/change-notes/released/0.8.10.md | 13 -------------
csharp/ql/lib/codeql-pack.release.yml | 2 +-
csharp/ql/lib/qlpack.yml | 2 +-
csharp/ql/src/CHANGELOG.md | 6 ------
.../0.8.10.md => 2024-02-06-threat-models.md} | 9 ++++-----
csharp/ql/src/codeql-pack.release.yml | 2 +-
csharp/ql/src/qlpack.yml | 2 +-
go/ql/consistency-queries/CHANGELOG.md | 4 ----
.../change-notes/released/0.0.9.md | 3 ---
go/ql/consistency-queries/codeql-pack.release.yml | 2 +-
go/ql/consistency-queries/qlpack.yml | 2 +-
go/ql/lib/CHANGELOG.md | 11 -----------
.../lib/change-notes/2024-02-14-range-map-read.md | 4 ++++
...0.7.10.md => 2024-03-04-autobuilder-changes.md} | 11 +++--------
go/ql/lib/codeql-pack.release.yml | 2 +-
go/ql/lib/qlpack.yml | 2 +-
go/ql/src/CHANGELOG.md | 4 ----
go/ql/src/change-notes/released/0.7.10.md | 3 ---
go/ql/src/codeql-pack.release.yml | 2 +-
go/ql/src/qlpack.yml | 2 +-
java/ql/automodel/src/CHANGELOG.md | 4 ----
.../automodel/src/change-notes/released/0.0.17.md | 3 ---
java/ql/automodel/src/codeql-pack.release.yml | 2 +-
java/ql/automodel/src/qlpack.yml | 2 +-
java/ql/lib/CHANGELOG.md | 11 -----------
.../change-notes/2024-02-23-widget-flowsteps.md | 4 ++++
java/ql/lib/change-notes/2024-02-27-error-types.md | 4 ++++
.../lib/change-notes/2024-02-27-mvnw-versions.md | 4 ++++
java/ql/lib/change-notes/released/0.8.10.md | 10 ----------
java/ql/lib/codeql-pack.release.yml | 2 +-
java/ql/lib/qlpack.yml | 2 +-
java/ql/src/CHANGELOG.md | 10 ----------
.../2024-02-12-android-insecure-keys.md | 4 ++++
...3-04-sensitive-log-remove-null-from-sources.md} | 11 +++--------
java/ql/src/codeql-pack.release.yml | 2 +-
java/ql/src/qlpack.yml | 2 +-
javascript/ql/lib/CHANGELOG.md | 4 ----
javascript/ql/lib/change-notes/released/0.8.10.md | 3 ---
javascript/ql/lib/codeql-pack.release.yml | 2 +-
javascript/ql/lib/qlpack.yml | 2 +-
javascript/ql/src/CHANGELOG.md | 4 ----
javascript/ql/src/change-notes/released/0.8.10.md | 3 ---
javascript/ql/src/codeql-pack.release.yml | 2 +-
javascript/ql/src/qlpack.yml | 2 +-
misc/suite-helpers/CHANGELOG.md | 4 ----
misc/suite-helpers/change-notes/released/0.7.10.md | 3 ---
misc/suite-helpers/codeql-pack.release.yml | 2 +-
misc/suite-helpers/qlpack.yml | 2 +-
python/ql/lib/CHANGELOG.md | 7 -------
.../2024-02-28-iterable-unpacking-module-scope.md | 4 ++++
....11.10.md => 2024-03-01-dict-update-content.md} | 8 +++-----
python/ql/lib/codeql-pack.release.yml | 2 +-
python/ql/lib/qlpack.yml | 2 +-
python/ql/src/CHANGELOG.md | 6 ------
.../0.9.10.md => 2024-03-04-nosql-injection.md} | 7 +++----
python/ql/src/codeql-pack.release.yml | 2 +-
python/ql/src/qlpack.yml | 2 +-
ruby/ql/lib/CHANGELOG.md | 9 ---------
...2024-02-15-activerecord_connection_sql_sinks.md | 4 ++++
.../2024-02-20-activerecord-sql-sink-arguments.md | 4 ++++
.../lib/change-notes/2024-02-26-arel-sqlliteral.md | 4 ++++
.../lib/change-notes/2024-02-29-i18n-translate.md | 4 ++++
ruby/ql/lib/change-notes/released/0.8.10.md | 8 --------
ruby/ql/lib/codeql-pack.release.yml | 2 +-
ruby/ql/lib/qlpack.yml | 2 +-
ruby/ql/src/CHANGELOG.md | 7 -------
.../2024-02-13-rails-more-request-sources.md | 4 ++++
...d => 2024-03-01-method-code-injection-sinks.md} | 10 ++++------
ruby/ql/src/codeql-pack.release.yml | 2 +-
ruby/ql/src/qlpack.yml | 2 +-
shared/controlflow/CHANGELOG.md | 4 ----
shared/controlflow/change-notes/released/0.1.10.md | 3 ---
shared/controlflow/codeql-pack.release.yml | 2 +-
shared/controlflow/qlpack.yml | 2 +-
shared/dataflow/CHANGELOG.md | 4 ----
shared/dataflow/change-notes/released/0.2.1.md | 3 ---
shared/dataflow/codeql-pack.release.yml | 2 +-
shared/dataflow/qlpack.yml | 2 +-
shared/mad/CHANGELOG.md | 4 ----
shared/mad/change-notes/released/0.2.10.md | 3 ---
shared/mad/codeql-pack.release.yml | 2 +-
shared/mad/qlpack.yml | 2 +-
shared/rangeanalysis/CHANGELOG.md | 4 ----
.../rangeanalysis/change-notes/released/0.0.9.md | 3 ---
shared/rangeanalysis/codeql-pack.release.yml | 2 +-
shared/rangeanalysis/qlpack.yml | 2 +-
shared/regex/CHANGELOG.md | 4 ----
shared/regex/change-notes/released/0.2.10.md | 3 ---
shared/regex/codeql-pack.release.yml | 2 +-
shared/regex/qlpack.yml | 2 +-
shared/ssa/CHANGELOG.md | 4 ----
shared/ssa/change-notes/released/0.2.10.md | 3 ---
shared/ssa/codeql-pack.release.yml | 2 +-
shared/ssa/qlpack.yml | 2 +-
shared/threat-models/CHANGELOG.md | 4 ----
.../threat-models/change-notes/released/0.0.9.md | 3 ---
shared/threat-models/codeql-pack.release.yml | 2 +-
shared/threat-models/qlpack.yml | 2 +-
shared/tutorial/CHANGELOG.md | 4 ----
shared/tutorial/change-notes/released/0.2.10.md | 3 ---
shared/tutorial/codeql-pack.release.yml | 2 +-
shared/tutorial/qlpack.yml | 2 +-
shared/typetracking/CHANGELOG.md | 4 ----
.../typetracking/change-notes/released/0.2.10.md | 3 ---
shared/typetracking/codeql-pack.release.yml | 2 +-
shared/typetracking/qlpack.yml | 2 +-
shared/typos/CHANGELOG.md | 4 ----
shared/typos/change-notes/released/0.2.10.md | 3 ---
shared/typos/codeql-pack.release.yml | 2 +-
shared/typos/qlpack.yml | 2 +-
shared/util/CHANGELOG.md | 4 ----
shared/util/change-notes/released/0.2.10.md | 3 ---
shared/util/codeql-pack.release.yml | 2 +-
shared/util/qlpack.yml | 2 +-
shared/yaml/CHANGELOG.md | 4 ----
shared/yaml/change-notes/released/0.2.10.md | 3 ---
shared/yaml/codeql-pack.release.yml | 2 +-
shared/yaml/qlpack.yml | 2 +-
swift/ql/lib/CHANGELOG.md | 6 ------
.../0.3.10.md => 2024-02-22-extension-patch.md} | 7 +++----
swift/ql/lib/codeql-pack.release.yml | 2 +-
swift/ql/lib/qlpack.yml | 2 +-
swift/ql/src/CHANGELOG.md | 4 ----
swift/ql/src/change-notes/released/0.3.10.md | 3 ---
swift/ql/src/codeql-pack.release.yml | 2 +-
swift/ql/src/qlpack.yml | 2 +-
150 files changed, 168 insertions(+), 394 deletions(-)
rename cpp/ql/lib/change-notes/{released/0.12.7.md => 2024-02-26-ir-named-destructors.md} (54%)
rename cpp/ql/src/change-notes/{released/0.9.6.md => 2024-02-16-modelled-functions-block-flow.md} (77%)
create mode 100644 cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md
delete mode 100644 csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md
delete mode 100644 csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md
create mode 100644 csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md
create mode 100644 csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md
create mode 100644 csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md
create mode 100644 csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md
create mode 100644 csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md
create mode 100644 csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md
delete mode 100644 csharp/ql/lib/change-notes/released/0.8.10.md
rename csharp/ql/src/change-notes/{released/0.8.10.md => 2024-02-06-threat-models.md} (88%)
delete mode 100644 go/ql/consistency-queries/change-notes/released/0.0.9.md
create mode 100644 go/ql/lib/change-notes/2024-02-14-range-map-read.md
rename go/ql/lib/change-notes/{released/0.7.10.md => 2024-03-04-autobuilder-changes.md} (68%)
delete mode 100644 go/ql/src/change-notes/released/0.7.10.md
delete mode 100644 java/ql/automodel/src/change-notes/released/0.0.17.md
create mode 100644 java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md
create mode 100644 java/ql/lib/change-notes/2024-02-27-error-types.md
create mode 100644 java/ql/lib/change-notes/2024-02-27-mvnw-versions.md
delete mode 100644 java/ql/lib/change-notes/released/0.8.10.md
create mode 100644 java/ql/src/change-notes/2024-02-12-android-insecure-keys.md
rename java/ql/src/change-notes/{released/0.8.10.md => 2024-03-04-sensitive-log-remove-null-from-sources.md} (54%)
delete mode 100644 javascript/ql/lib/change-notes/released/0.8.10.md
delete mode 100644 javascript/ql/src/change-notes/released/0.8.10.md
delete mode 100644 misc/suite-helpers/change-notes/released/0.7.10.md
create mode 100644 python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md
rename python/ql/lib/change-notes/{released/0.11.10.md => 2024-03-01-dict-update-content.md} (52%)
rename python/ql/src/change-notes/{released/0.9.10.md => 2024-03-04-nosql-injection.md} (81%)
create mode 100644 ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md
create mode 100644 ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md
create mode 100644 ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
create mode 100644 ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
delete mode 100644 ruby/ql/lib/change-notes/released/0.8.10.md
create mode 100644 ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md
rename ruby/ql/src/change-notes/{released/0.8.10.md => 2024-03-01-method-code-injection-sinks.md} (51%)
delete mode 100644 shared/controlflow/change-notes/released/0.1.10.md
delete mode 100644 shared/dataflow/change-notes/released/0.2.1.md
delete mode 100644 shared/mad/change-notes/released/0.2.10.md
delete mode 100644 shared/rangeanalysis/change-notes/released/0.0.9.md
delete mode 100644 shared/regex/change-notes/released/0.2.10.md
delete mode 100644 shared/ssa/change-notes/released/0.2.10.md
delete mode 100644 shared/threat-models/change-notes/released/0.0.9.md
delete mode 100644 shared/tutorial/change-notes/released/0.2.10.md
delete mode 100644 shared/typetracking/change-notes/released/0.2.10.md
delete mode 100644 shared/typos/change-notes/released/0.2.10.md
delete mode 100644 shared/util/change-notes/released/0.2.10.md
delete mode 100644 shared/yaml/change-notes/released/0.2.10.md
rename swift/ql/lib/change-notes/{released/0.3.10.md => 2024-02-22-extension-patch.md} (83%)
delete mode 100644 swift/ql/src/change-notes/released/0.3.10.md
diff --git a/cpp/ql/lib/CHANGELOG.md b/cpp/ql/lib/CHANGELOG.md
index e1c0dfbecd9a..b3091ec37d8f 100644
--- a/cpp/ql/lib/CHANGELOG.md
+++ b/cpp/ql/lib/CHANGELOG.md
@@ -1,9 +1,3 @@
-## 0.12.7
-
-### Minor Analysis Improvements
-
-* Added destructors for named objects to the intermediate representation.
-
## 0.12.6
### New Features
diff --git a/cpp/ql/lib/change-notes/released/0.12.7.md b/cpp/ql/lib/change-notes/2024-02-26-ir-named-destructors.md
similarity index 54%
rename from cpp/ql/lib/change-notes/released/0.12.7.md
rename to cpp/ql/lib/change-notes/2024-02-26-ir-named-destructors.md
index 856a8b665c74..4e35decaf8ed 100644
--- a/cpp/ql/lib/change-notes/released/0.12.7.md
+++ b/cpp/ql/lib/change-notes/2024-02-26-ir-named-destructors.md
@@ -1,5 +1,4 @@
-## 0.12.7
-
-### Minor Analysis Improvements
-
-* Added destructors for named objects to the intermediate representation.
+---
+category: minorAnalysis
+---
+* Added destructors for named objects to the intermediate representation.
\ No newline at end of file
diff --git a/cpp/ql/lib/codeql-pack.release.yml b/cpp/ql/lib/codeql-pack.release.yml
index 20419e9c6100..170a312c1047 100644
--- a/cpp/ql/lib/codeql-pack.release.yml
+++ b/cpp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.12.7
+lastReleaseVersion: 0.12.6
diff --git a/cpp/ql/lib/qlpack.yml b/cpp/ql/lib/qlpack.yml
index 3bb9229bf94d..8e201fff5943 100644
--- a/cpp/ql/lib/qlpack.yml
+++ b/cpp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-all
-version: 0.12.7
+version: 0.12.7-dev
groups: cpp
dbscheme: semmlecode.cpp.dbscheme
extractor: cpp
diff --git a/cpp/ql/src/CHANGELOG.md b/cpp/ql/src/CHANGELOG.md
index f6acd424bb05..ffcd73ff5d72 100644
--- a/cpp/ql/src/CHANGELOG.md
+++ b/cpp/ql/src/CHANGELOG.md
@@ -1,10 +1,3 @@
-## 0.9.6
-
-### Minor Analysis Improvements
-
-* The "non-constant format string" query (`cpp/non-constant-format`) has been converted to a `path-problem` query.
-* The new C/C++ dataflow and taint-tracking libraries (`semmle.code.cpp.dataflow.new.DataFlow` and `semmle.code.cpp.dataflow.new.TaintTracking`) now implicitly assume that dataflow and taint modelled via `DataFlowFunction` and `TaintFunction` always fully overwrite their buffers and thus act as flow barriers. As a result, many dataflow and taint-tracking queries now produce fewer false positives. To remove this assumption and go back to the previous behavior for a given model, one can override the new `isPartialWrite` predicate.
-
## 0.9.5
### Minor Analysis Improvements
diff --git a/cpp/ql/src/change-notes/released/0.9.6.md b/cpp/ql/src/change-notes/2024-02-16-modelled-functions-block-flow.md
similarity index 77%
rename from cpp/ql/src/change-notes/released/0.9.6.md
rename to cpp/ql/src/change-notes/2024-02-16-modelled-functions-block-flow.md
index 0c85f3f9f0f0..d6ef3c3e0569 100644
--- a/cpp/ql/src/change-notes/released/0.9.6.md
+++ b/cpp/ql/src/change-notes/2024-02-16-modelled-functions-block-flow.md
@@ -1,6 +1,4 @@
-## 0.9.6
-
-### Minor Analysis Improvements
-
-* The "non-constant format string" query (`cpp/non-constant-format`) has been converted to a `path-problem` query.
+---
+category: minorAnalysis
+---
* The new C/C++ dataflow and taint-tracking libraries (`semmle.code.cpp.dataflow.new.DataFlow` and `semmle.code.cpp.dataflow.new.TaintTracking`) now implicitly assume that dataflow and taint modelled via `DataFlowFunction` and `TaintFunction` always fully overwrite their buffers and thus act as flow barriers. As a result, many dataflow and taint-tracking queries now produce fewer false positives. To remove this assumption and go back to the previous behavior for a given model, one can override the new `isPartialWrite` predicate.
diff --git a/cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md b/cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md
new file mode 100644
index 000000000000..2e5933a61e86
--- /dev/null
+++ b/cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The "non-constant format string" query (`cpp/non-constant-format`) has been converted to a `path-problem` query.
\ No newline at end of file
diff --git a/cpp/ql/src/codeql-pack.release.yml b/cpp/ql/src/codeql-pack.release.yml
index 19139c132b2d..460240feafff 100644
--- a/cpp/ql/src/codeql-pack.release.yml
+++ b/cpp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.9.6
+lastReleaseVersion: 0.9.5
diff --git a/cpp/ql/src/qlpack.yml b/cpp/ql/src/qlpack.yml
index 4052647bb97f..31bd20166b2b 100644
--- a/cpp/ql/src/qlpack.yml
+++ b/cpp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-queries
-version: 0.9.6
+version: 0.9.6-dev
groups:
- cpp
- queries
diff --git a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
index 82eacfc84f70..190b83b0f25a 100644
--- a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
+++ b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 1.7.10
-
-No user-facing changes.
-
## 1.7.9
No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md
deleted file mode 100644
index 8e8007d8475f..000000000000
--- a/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 1.7.10
-
-No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
index 31c7fe07020b..678da6bc37e9 100644
--- a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.7.10
+lastReleaseVersion: 1.7.9
diff --git a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
index ee993bed0c91..7e643b0fac33 100644
--- a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-all
-version: 1.7.10
+version: 1.7.10-dev
groups:
- csharp
- solorigate
diff --git a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
index 82eacfc84f70..190b83b0f25a 100644
--- a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
+++ b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 1.7.10
-
-No user-facing changes.
-
## 1.7.9
No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md
deleted file mode 100644
index 8e8007d8475f..000000000000
--- a/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 1.7.10
-
-No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
index 31c7fe07020b..678da6bc37e9 100644
--- a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
+++ b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.7.10
+lastReleaseVersion: 1.7.9
diff --git a/csharp/ql/campaigns/Solorigate/src/qlpack.yml b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
index 1f421754fc82..8654bbfd0312 100644
--- a/csharp/ql/campaigns/Solorigate/src/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-queries
-version: 1.7.10
+version: 1.7.10-dev
groups:
- csharp
- solorigate
diff --git a/csharp/ql/lib/CHANGELOG.md b/csharp/ql/lib/CHANGELOG.md
index 16cc14259e19..95fd64c52704 100644
--- a/csharp/ql/lib/CHANGELOG.md
+++ b/csharp/ql/lib/CHANGELOG.md
@@ -1,17 +1,3 @@
-## 0.8.10
-
-### Major Analysis Improvements
-
-* Improved support for flow through captured variables that properly adheres to inter-procedural control flow.
-* We no longer make use of CodeQL database stats, which may affect join-orders in custom queries. It is therefore recommended to test performance of custom queries after upgrading to this version.
-
-### Minor Analysis Improvements
-
-* C# 12: Add QL library support (`ExperimentalAttribute`) for the experimental attribute.
-* C# 12: Add extractor and QL library support for `ref readonly` parameters.
-* C#: The table `expr_compiler_generated` has been deleted and its content has been added to `compiler_generated`.
-* Data flow via get only properties like `public object Obj { get; }` is now captured by the data flow library.
-
## 0.8.9
### Minor Analysis Improvements
diff --git a/csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md b/csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md
new file mode 100644
index 000000000000..6bb8e99c71ef
--- /dev/null
+++ b/csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Data flow via get only properties like `public object Obj { get; }` is now captured by the data flow library.
diff --git a/csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md b/csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md
new file mode 100644
index 000000000000..d6ffbd523ac6
--- /dev/null
+++ b/csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md
@@ -0,0 +1,4 @@
+---
+category: majorAnalysis
+---
+* We no longer make use of CodeQL database stats, which may affect join-orders in custom queries. It is therefore recommended to test performance of custom queries after upgrading to this version.
diff --git a/csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md b/csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md
new file mode 100644
index 000000000000..9b1739b9b6da
--- /dev/null
+++ b/csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* C#: The table `expr_compiler_generated` has been deleted and its content has been added to `compiler_generated`.
diff --git a/csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md b/csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md
new file mode 100644
index 000000000000..66ab65083dc3
--- /dev/null
+++ b/csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md
@@ -0,0 +1,4 @@
+---
+category: majorAnalysis
+---
+* Improved support for flow through captured variables that properly adheres to inter-procedural control flow.
\ No newline at end of file
diff --git a/csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md b/csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md
new file mode 100644
index 000000000000..8749c790954e
--- /dev/null
+++ b/csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* C# 12: Add QL library support (`ExperimentalAttribute`) for the experimental attribute.
diff --git a/csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md b/csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md
new file mode 100644
index 000000000000..586b5341d293
--- /dev/null
+++ b/csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* C# 12: Add extractor and QL library support for `ref readonly` parameters.
diff --git a/csharp/ql/lib/change-notes/released/0.8.10.md b/csharp/ql/lib/change-notes/released/0.8.10.md
deleted file mode 100644
index f591ddc5b21a..000000000000
--- a/csharp/ql/lib/change-notes/released/0.8.10.md
+++ /dev/null
@@ -1,13 +0,0 @@
-## 0.8.10
-
-### Major Analysis Improvements
-
-* Improved support for flow through captured variables that properly adheres to inter-procedural control flow.
-* We no longer make use of CodeQL database stats, which may affect join-orders in custom queries. It is therefore recommended to test performance of custom queries after upgrading to this version.
-
-### Minor Analysis Improvements
-
-* C# 12: Add QL library support (`ExperimentalAttribute`) for the experimental attribute.
-* C# 12: Add extractor and QL library support for `ref readonly` parameters.
-* C#: The table `expr_compiler_generated` has been deleted and its content has been added to `compiler_generated`.
-* Data flow via get only properties like `public object Obj { get; }` is now captured by the data flow library.
diff --git a/csharp/ql/lib/codeql-pack.release.yml b/csharp/ql/lib/codeql-pack.release.yml
index 0521f0f75fad..5290c29b7fe7 100644
--- a/csharp/ql/lib/codeql-pack.release.yml
+++ b/csharp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.10
+lastReleaseVersion: 0.8.9
diff --git a/csharp/ql/lib/qlpack.yml b/csharp/ql/lib/qlpack.yml
index 93c5c1120a24..d75ea3c63207 100644
--- a/csharp/ql/lib/qlpack.yml
+++ b/csharp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-all
-version: 0.8.10
+version: 0.8.10-dev
groups: csharp
dbscheme: semmlecode.csharp.dbscheme
extractor: csharp
diff --git a/csharp/ql/src/CHANGELOG.md b/csharp/ql/src/CHANGELOG.md
index 46c939e5cee1..9fe1609363fc 100644
--- a/csharp/ql/src/CHANGELOG.md
+++ b/csharp/ql/src/CHANGELOG.md
@@ -1,9 +1,3 @@
-## 0.8.10
-
-### Minor Analysis Improvements
-
-* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. The changed queries are `cs/code-injection`, `cs/command-line-injection`, `cs/user-controlled-bypass`, `cs/count-untrusted-data-external-api`, `cs/untrusted-data-to-external-api`, `cs/ldap-injection`, `cs/log-forging`, `cs/xml/missing-validation`, `cs/redos`, `cs/regex-injection`, `cs/resource-injection`, `cs/sql-injection`, `cs/path-injection`, `cs/unsafe-deserialization-untrusted-input`, `cs/web/unvalidated-url-redirection`, `cs/xml/insecure-dtd-handling`, `cs/xml/xpath-injection`, `cs/web/xss`, and `cs/uncontrolled-format-string`.
-
## 0.8.9
### Minor Analysis Improvements
diff --git a/csharp/ql/src/change-notes/released/0.8.10.md b/csharp/ql/src/change-notes/2024-02-06-threat-models.md
similarity index 88%
rename from csharp/ql/src/change-notes/released/0.8.10.md
rename to csharp/ql/src/change-notes/2024-02-06-threat-models.md
index 702161c3d28f..69ac4e4dc17a 100644
--- a/csharp/ql/src/change-notes/released/0.8.10.md
+++ b/csharp/ql/src/change-notes/2024-02-06-threat-models.md
@@ -1,5 +1,4 @@
-## 0.8.10
-
-### Minor Analysis Improvements
-
-* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. The changed queries are `cs/code-injection`, `cs/command-line-injection`, `cs/user-controlled-bypass`, `cs/count-untrusted-data-external-api`, `cs/untrusted-data-to-external-api`, `cs/ldap-injection`, `cs/log-forging`, `cs/xml/missing-validation`, `cs/redos`, `cs/regex-injection`, `cs/resource-injection`, `cs/sql-injection`, `cs/path-injection`, `cs/unsafe-deserialization-untrusted-input`, `cs/web/unvalidated-url-redirection`, `cs/xml/insecure-dtd-handling`, `cs/xml/xpath-injection`, `cs/web/xss`, and `cs/uncontrolled-format-string`.
+---
+category: minorAnalysis
+---
+* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. The changed queries are `cs/code-injection`, `cs/command-line-injection`, `cs/user-controlled-bypass`, `cs/count-untrusted-data-external-api`, `cs/untrusted-data-to-external-api`, `cs/ldap-injection`, `cs/log-forging`, `cs/xml/missing-validation`, `cs/redos`, `cs/regex-injection`, `cs/resource-injection`, `cs/sql-injection`, `cs/path-injection`, `cs/unsafe-deserialization-untrusted-input`, `cs/web/unvalidated-url-redirection`, `cs/xml/insecure-dtd-handling`, `cs/xml/xpath-injection`, `cs/web/xss`, and `cs/uncontrolled-format-string`.
\ No newline at end of file
diff --git a/csharp/ql/src/codeql-pack.release.yml b/csharp/ql/src/codeql-pack.release.yml
index 0521f0f75fad..5290c29b7fe7 100644
--- a/csharp/ql/src/codeql-pack.release.yml
+++ b/csharp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.10
+lastReleaseVersion: 0.8.9
diff --git a/csharp/ql/src/qlpack.yml b/csharp/ql/src/qlpack.yml
index 46384094b19e..9ee23cc73078 100644
--- a/csharp/ql/src/qlpack.yml
+++ b/csharp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-queries
-version: 0.8.10
+version: 0.8.10-dev
groups:
- csharp
- queries
diff --git a/go/ql/consistency-queries/CHANGELOG.md b/go/ql/consistency-queries/CHANGELOG.md
index a59e560c4155..fba2a8703562 100644
--- a/go/ql/consistency-queries/CHANGELOG.md
+++ b/go/ql/consistency-queries/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.0.9
-
-No user-facing changes.
-
## 0.0.8
No user-facing changes.
diff --git a/go/ql/consistency-queries/change-notes/released/0.0.9.md b/go/ql/consistency-queries/change-notes/released/0.0.9.md
deleted file mode 100644
index c9e17c6d6cf2..000000000000
--- a/go/ql/consistency-queries/change-notes/released/0.0.9.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.0.9
-
-No user-facing changes.
diff --git a/go/ql/consistency-queries/codeql-pack.release.yml b/go/ql/consistency-queries/codeql-pack.release.yml
index ecdd64fbab86..58fdc6b45deb 100644
--- a/go/ql/consistency-queries/codeql-pack.release.yml
+++ b/go/ql/consistency-queries/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.9
+lastReleaseVersion: 0.0.8
diff --git a/go/ql/consistency-queries/qlpack.yml b/go/ql/consistency-queries/qlpack.yml
index d5a2fbee5f19..b574796b9954 100644
--- a/go/ql/consistency-queries/qlpack.yml
+++ b/go/ql/consistency-queries/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql-go-consistency-queries
-version: 0.0.9
+version: 0.0.9-dev
groups:
- go
- queries
diff --git a/go/ql/lib/CHANGELOG.md b/go/ql/lib/CHANGELOG.md
index fee5fd37a267..65a2376217b1 100644
--- a/go/ql/lib/CHANGELOG.md
+++ b/go/ql/lib/CHANGELOG.md
@@ -1,14 +1,3 @@
-## 0.7.10
-
-### Major Analysis Improvements
-
-* We have significantly improved the Go autobuilder to understand a greater range of project layouts, which allows Go source files to be analysed that could previously not be processed.
-* Go 1.22 has been included in the range of supported Go versions.
-
-### Bug Fixes
-
-* Fixed dataflow out of a `map` using a `range` statement.
-
## 0.7.9
No user-facing changes.
diff --git a/go/ql/lib/change-notes/2024-02-14-range-map-read.md b/go/ql/lib/change-notes/2024-02-14-range-map-read.md
new file mode 100644
index 000000000000..ea45737a72ea
--- /dev/null
+++ b/go/ql/lib/change-notes/2024-02-14-range-map-read.md
@@ -0,0 +1,4 @@
+---
+category: fix
+---
+* Fixed dataflow out of a `map` using a `range` statement.
diff --git a/go/ql/lib/change-notes/released/0.7.10.md b/go/ql/lib/change-notes/2024-03-04-autobuilder-changes.md
similarity index 68%
rename from go/ql/lib/change-notes/released/0.7.10.md
rename to go/ql/lib/change-notes/2024-03-04-autobuilder-changes.md
index 55954f8a3945..0442a571029f 100644
--- a/go/ql/lib/change-notes/released/0.7.10.md
+++ b/go/ql/lib/change-notes/2024-03-04-autobuilder-changes.md
@@ -1,10 +1,5 @@
-## 0.7.10
-
-### Major Analysis Improvements
-
+---
+category: majorAnalysis
+---
* We have significantly improved the Go autobuilder to understand a greater range of project layouts, which allows Go source files to be analysed that could previously not be processed.
* Go 1.22 has been included in the range of supported Go versions.
-
-### Bug Fixes
-
-* Fixed dataflow out of a `map` using a `range` statement.
diff --git a/go/ql/lib/codeql-pack.release.yml b/go/ql/lib/codeql-pack.release.yml
index 675185672974..576395f3405e 100644
--- a/go/ql/lib/codeql-pack.release.yml
+++ b/go/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.7.10
+lastReleaseVersion: 0.7.9
diff --git a/go/ql/lib/qlpack.yml b/go/ql/lib/qlpack.yml
index 8cc190fa880a..f21e478efa68 100644
--- a/go/ql/lib/qlpack.yml
+++ b/go/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-all
-version: 0.7.10
+version: 0.7.10-dev
groups: go
dbscheme: go.dbscheme
extractor: go
diff --git a/go/ql/src/CHANGELOG.md b/go/ql/src/CHANGELOG.md
index 24e38b9890e1..d95165a3a34e 100644
--- a/go/ql/src/CHANGELOG.md
+++ b/go/ql/src/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.7.10
-
-No user-facing changes.
-
## 0.7.9
### New Queries
diff --git a/go/ql/src/change-notes/released/0.7.10.md b/go/ql/src/change-notes/released/0.7.10.md
deleted file mode 100644
index 989c5b8f6823..000000000000
--- a/go/ql/src/change-notes/released/0.7.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.7.10
-
-No user-facing changes.
diff --git a/go/ql/src/codeql-pack.release.yml b/go/ql/src/codeql-pack.release.yml
index 675185672974..576395f3405e 100644
--- a/go/ql/src/codeql-pack.release.yml
+++ b/go/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.7.10
+lastReleaseVersion: 0.7.9
diff --git a/go/ql/src/qlpack.yml b/go/ql/src/qlpack.yml
index 4ded3a52f63e..d91cab596127 100644
--- a/go/ql/src/qlpack.yml
+++ b/go/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-queries
-version: 0.7.10
+version: 0.7.10-dev
groups:
- go
- queries
diff --git a/java/ql/automodel/src/CHANGELOG.md b/java/ql/automodel/src/CHANGELOG.md
index c3282c773a9d..4a3c54adb385 100644
--- a/java/ql/automodel/src/CHANGELOG.md
+++ b/java/ql/automodel/src/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.0.17
-
-No user-facing changes.
-
## 0.0.16
No user-facing changes.
diff --git a/java/ql/automodel/src/change-notes/released/0.0.17.md b/java/ql/automodel/src/change-notes/released/0.0.17.md
deleted file mode 100644
index 62cc89030a62..000000000000
--- a/java/ql/automodel/src/change-notes/released/0.0.17.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.0.17
-
-No user-facing changes.
diff --git a/java/ql/automodel/src/codeql-pack.release.yml b/java/ql/automodel/src/codeql-pack.release.yml
index cbc3d3cd4934..a49f7be4cff3 100644
--- a/java/ql/automodel/src/codeql-pack.release.yml
+++ b/java/ql/automodel/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.17
+lastReleaseVersion: 0.0.16
diff --git a/java/ql/automodel/src/qlpack.yml b/java/ql/automodel/src/qlpack.yml
index 59fab0cdcc53..898239be0989 100644
--- a/java/ql/automodel/src/qlpack.yml
+++ b/java/ql/automodel/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-automodel-queries
-version: 0.0.17
+version: 0.0.17-dev
groups:
- java
- automodel
diff --git a/java/ql/lib/CHANGELOG.md b/java/ql/lib/CHANGELOG.md
index 2a02ccee6abb..d369cbdc9318 100644
--- a/java/ql/lib/CHANGELOG.md
+++ b/java/ql/lib/CHANGELOG.md
@@ -1,14 +1,3 @@
-## 0.8.10
-
-### Minor Analysis Improvements
-
-* Java expressions with erroneous types (e.g. the result of a call whose callee couldn't be resolved during extraction) are now given a CodeQL `ErrorType` more often.
-
-### Bug Fixes
-
-* Fixed the Java autobuilder overriding the version of Maven used by a project when the Maven wrapper `mvnw` is in use and the `maven-wrapper.jar` file is not present in the repository.
-* Some flow steps related to `android.text.Editable.toString` that were accidentally disabled have been re-enabled.
-
## 0.8.9
### Deprecated APIs
diff --git a/java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md b/java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md
new file mode 100644
index 000000000000..eb560fba07da
--- /dev/null
+++ b/java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md
@@ -0,0 +1,4 @@
+---
+category: fix
+---
+* Some flow steps related to `android.text.Editable.toString` that were accidentally disabled have been re-enabled.
diff --git a/java/ql/lib/change-notes/2024-02-27-error-types.md b/java/ql/lib/change-notes/2024-02-27-error-types.md
new file mode 100644
index 000000000000..cdc6d7620aa8
--- /dev/null
+++ b/java/ql/lib/change-notes/2024-02-27-error-types.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Java expressions with erroneous types (e.g. the result of a call whose callee couldn't be resolved during extraction) are now given a CodeQL `ErrorType` more often.
diff --git a/java/ql/lib/change-notes/2024-02-27-mvnw-versions.md b/java/ql/lib/change-notes/2024-02-27-mvnw-versions.md
new file mode 100644
index 000000000000..a0227088ae97
--- /dev/null
+++ b/java/ql/lib/change-notes/2024-02-27-mvnw-versions.md
@@ -0,0 +1,4 @@
+---
+category: fix
+---
+* Fixed the Java autobuilder overriding the version of Maven used by a project when the Maven wrapper `mvnw` is in use and the `maven-wrapper.jar` file is not present in the repository.
diff --git a/java/ql/lib/change-notes/released/0.8.10.md b/java/ql/lib/change-notes/released/0.8.10.md
deleted file mode 100644
index b45f14bf347a..000000000000
--- a/java/ql/lib/change-notes/released/0.8.10.md
+++ /dev/null
@@ -1,10 +0,0 @@
-## 0.8.10
-
-### Minor Analysis Improvements
-
-* Java expressions with erroneous types (e.g. the result of a call whose callee couldn't be resolved during extraction) are now given a CodeQL `ErrorType` more often.
-
-### Bug Fixes
-
-* Fixed the Java autobuilder overriding the version of Maven used by a project when the Maven wrapper `mvnw` is in use and the `maven-wrapper.jar` file is not present in the repository.
-* Some flow steps related to `android.text.Editable.toString` that were accidentally disabled have been re-enabled.
diff --git a/java/ql/lib/codeql-pack.release.yml b/java/ql/lib/codeql-pack.release.yml
index 0521f0f75fad..5290c29b7fe7 100644
--- a/java/ql/lib/codeql-pack.release.yml
+++ b/java/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.10
+lastReleaseVersion: 0.8.9
diff --git a/java/ql/lib/qlpack.yml b/java/ql/lib/qlpack.yml
index 428eedc75e3d..15b4982d41eb 100644
--- a/java/ql/lib/qlpack.yml
+++ b/java/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-all
-version: 0.8.10
+version: 0.8.10-dev
groups: java
dbscheme: config/semmlecode.dbscheme
extractor: java
diff --git a/java/ql/src/CHANGELOG.md b/java/ql/src/CHANGELOG.md
index c61275f5ed84..5d8353514538 100644
--- a/java/ql/src/CHANGELOG.md
+++ b/java/ql/src/CHANGELOG.md
@@ -1,13 +1,3 @@
-## 0.8.10
-
-### New Queries
-
-* Added a new query `java/android/insecure-local-key-gen` for finding instances of keys generated for biometric authentication in an insecure way.
-
-### Minor Analysis Improvements
-
-* To reduce the number of false positives in the query "Insertion of sensitive information into log files" (`java/sensitive-log`), variables with names that contain "null" (case-insensitively) are no longer considered sources of sensitive information.
-
## 0.8.9
### New Queries
diff --git a/java/ql/src/change-notes/2024-02-12-android-insecure-keys.md b/java/ql/src/change-notes/2024-02-12-android-insecure-keys.md
new file mode 100644
index 000000000000..1de077277962
--- /dev/null
+++ b/java/ql/src/change-notes/2024-02-12-android-insecure-keys.md
@@ -0,0 +1,4 @@
+---
+category: newQuery
+---
+* Added a new query `java/android/insecure-local-key-gen` for finding instances of keys generated for biometric authentication in an insecure way.
\ No newline at end of file
diff --git a/java/ql/src/change-notes/released/0.8.10.md b/java/ql/src/change-notes/2024-03-04-sensitive-log-remove-null-from-sources.md
similarity index 54%
rename from java/ql/src/change-notes/released/0.8.10.md
rename to java/ql/src/change-notes/2024-03-04-sensitive-log-remove-null-from-sources.md
index c5d18ae33794..0bb4f18f2bd9 100644
--- a/java/ql/src/change-notes/released/0.8.10.md
+++ b/java/ql/src/change-notes/2024-03-04-sensitive-log-remove-null-from-sources.md
@@ -1,9 +1,4 @@
-## 0.8.10
-
-### New Queries
-
-* Added a new query `java/android/insecure-local-key-gen` for finding instances of keys generated for biometric authentication in an insecure way.
-
-### Minor Analysis Improvements
-
+---
+category: minorAnalysis
+---
* To reduce the number of false positives in the query "Insertion of sensitive information into log files" (`java/sensitive-log`), variables with names that contain "null" (case-insensitively) are no longer considered sources of sensitive information.
diff --git a/java/ql/src/codeql-pack.release.yml b/java/ql/src/codeql-pack.release.yml
index 0521f0f75fad..5290c29b7fe7 100644
--- a/java/ql/src/codeql-pack.release.yml
+++ b/java/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.10
+lastReleaseVersion: 0.8.9
diff --git a/java/ql/src/qlpack.yml b/java/ql/src/qlpack.yml
index ebbdbeee3b2c..8f4de528e213 100644
--- a/java/ql/src/qlpack.yml
+++ b/java/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-queries
-version: 0.8.10
+version: 0.8.10-dev
groups:
- java
- queries
diff --git a/javascript/ql/lib/CHANGELOG.md b/javascript/ql/lib/CHANGELOG.md
index d5edcc005131..5b97ebbb22b3 100644
--- a/javascript/ql/lib/CHANGELOG.md
+++ b/javascript/ql/lib/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.8.10
-
-No user-facing changes.
-
## 0.8.9
### Minor Analysis Improvements
diff --git a/javascript/ql/lib/change-notes/released/0.8.10.md b/javascript/ql/lib/change-notes/released/0.8.10.md
deleted file mode 100644
index 777bbd2fdede..000000000000
--- a/javascript/ql/lib/change-notes/released/0.8.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.8.10
-
-No user-facing changes.
diff --git a/javascript/ql/lib/codeql-pack.release.yml b/javascript/ql/lib/codeql-pack.release.yml
index 0521f0f75fad..5290c29b7fe7 100644
--- a/javascript/ql/lib/codeql-pack.release.yml
+++ b/javascript/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.10
+lastReleaseVersion: 0.8.9
diff --git a/javascript/ql/lib/qlpack.yml b/javascript/ql/lib/qlpack.yml
index da16493a21c9..ef3ca7521aca 100644
--- a/javascript/ql/lib/qlpack.yml
+++ b/javascript/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-all
-version: 0.8.10
+version: 0.8.10-dev
groups: javascript
dbscheme: semmlecode.javascript.dbscheme
extractor: javascript
diff --git a/javascript/ql/src/CHANGELOG.md b/javascript/ql/src/CHANGELOG.md
index b9627cac5eee..85516e3625d1 100644
--- a/javascript/ql/src/CHANGELOG.md
+++ b/javascript/ql/src/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.8.10
-
-No user-facing changes.
-
## 0.8.9
### Bug Fixes
diff --git a/javascript/ql/src/change-notes/released/0.8.10.md b/javascript/ql/src/change-notes/released/0.8.10.md
deleted file mode 100644
index 777bbd2fdede..000000000000
--- a/javascript/ql/src/change-notes/released/0.8.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.8.10
-
-No user-facing changes.
diff --git a/javascript/ql/src/codeql-pack.release.yml b/javascript/ql/src/codeql-pack.release.yml
index 0521f0f75fad..5290c29b7fe7 100644
--- a/javascript/ql/src/codeql-pack.release.yml
+++ b/javascript/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.10
+lastReleaseVersion: 0.8.9
diff --git a/javascript/ql/src/qlpack.yml b/javascript/ql/src/qlpack.yml
index d224952c5641..b6181aa30e99 100644
--- a/javascript/ql/src/qlpack.yml
+++ b/javascript/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-queries
-version: 0.8.10
+version: 0.8.10-dev
groups:
- javascript
- queries
diff --git a/misc/suite-helpers/CHANGELOG.md b/misc/suite-helpers/CHANGELOG.md
index 1c4455b66c43..3c06dd69b0f5 100644
--- a/misc/suite-helpers/CHANGELOG.md
+++ b/misc/suite-helpers/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.7.10
-
-No user-facing changes.
-
## 0.7.9
No user-facing changes.
diff --git a/misc/suite-helpers/change-notes/released/0.7.10.md b/misc/suite-helpers/change-notes/released/0.7.10.md
deleted file mode 100644
index 989c5b8f6823..000000000000
--- a/misc/suite-helpers/change-notes/released/0.7.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.7.10
-
-No user-facing changes.
diff --git a/misc/suite-helpers/codeql-pack.release.yml b/misc/suite-helpers/codeql-pack.release.yml
index 675185672974..576395f3405e 100644
--- a/misc/suite-helpers/codeql-pack.release.yml
+++ b/misc/suite-helpers/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.7.10
+lastReleaseVersion: 0.7.9
diff --git a/misc/suite-helpers/qlpack.yml b/misc/suite-helpers/qlpack.yml
index 54d978d5efe7..49b7a6bda4c2 100644
--- a/misc/suite-helpers/qlpack.yml
+++ b/misc/suite-helpers/qlpack.yml
@@ -1,4 +1,4 @@
name: codeql/suite-helpers
-version: 0.7.10
+version: 0.7.10-dev
groups: shared
warnOnImplicitThis: true
diff --git a/python/ql/lib/CHANGELOG.md b/python/ql/lib/CHANGELOG.md
index f095607ca1bf..e6f318c51ea8 100644
--- a/python/ql/lib/CHANGELOG.md
+++ b/python/ql/lib/CHANGELOG.md
@@ -1,10 +1,3 @@
-## 0.11.10
-
-### Minor Analysis Improvements
-
-* Fixed missing flow for dictionary updates (`d[] = ...`) when `` is a string constant not used in dictionary literals or as name of keyword-argument.
-* Fixed flow for iterable unpacking (`a,b = my_tuple`) when it occurs on top-level (module) scope.
-
## 0.11.9
### Minor Analysis Improvements
diff --git a/python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md b/python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md
new file mode 100644
index 000000000000..3c47c6ba866a
--- /dev/null
+++ b/python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Fixed flow for iterable unpacking (`a,b = my_tuple`) when it occurs on top-level (module) scope.
diff --git a/python/ql/lib/change-notes/released/0.11.10.md b/python/ql/lib/change-notes/2024-03-01-dict-update-content.md
similarity index 52%
rename from python/ql/lib/change-notes/released/0.11.10.md
rename to python/ql/lib/change-notes/2024-03-01-dict-update-content.md
index ed873724e4f2..dfb8d247fffa 100644
--- a/python/ql/lib/change-notes/released/0.11.10.md
+++ b/python/ql/lib/change-notes/2024-03-01-dict-update-content.md
@@ -1,6 +1,4 @@
-## 0.11.10
-
-### Minor Analysis Improvements
-
+---
+category: minorAnalysis
+---
* Fixed missing flow for dictionary updates (`d[] = ...`) when `` is a string constant not used in dictionary literals or as name of keyword-argument.
-* Fixed flow for iterable unpacking (`a,b = my_tuple`) when it occurs on top-level (module) scope.
diff --git a/python/ql/lib/codeql-pack.release.yml b/python/ql/lib/codeql-pack.release.yml
index ddddcbe9193d..b064d1778a10 100644
--- a/python/ql/lib/codeql-pack.release.yml
+++ b/python/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.11.10
+lastReleaseVersion: 0.11.9
diff --git a/python/ql/lib/qlpack.yml b/python/ql/lib/qlpack.yml
index 59a8b4c96d17..e9f66e205f24 100644
--- a/python/ql/lib/qlpack.yml
+++ b/python/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-all
-version: 0.11.10
+version: 0.11.10-dev
groups: python
dbscheme: semmlecode.python.dbscheme
extractor: python
diff --git a/python/ql/src/CHANGELOG.md b/python/ql/src/CHANGELOG.md
index d4245aba7a62..50762bcbf34e 100644
--- a/python/ql/src/CHANGELOG.md
+++ b/python/ql/src/CHANGELOG.md
@@ -1,9 +1,3 @@
-## 0.9.10
-
-### New Queries
-
-* The query `py/nosql-injection` for finding NoSQL injection vulnerabilities is now part of the default security suite.
-
## 0.9.9
No user-facing changes.
diff --git a/python/ql/src/change-notes/released/0.9.10.md b/python/ql/src/change-notes/2024-03-04-nosql-injection.md
similarity index 81%
rename from python/ql/src/change-notes/released/0.9.10.md
rename to python/ql/src/change-notes/2024-03-04-nosql-injection.md
index 4cbb221b789f..6e98540c757c 100644
--- a/python/ql/src/change-notes/released/0.9.10.md
+++ b/python/ql/src/change-notes/2024-03-04-nosql-injection.md
@@ -1,5 +1,4 @@
-## 0.9.10
-
-### New Queries
-
+---
+category: newQuery
+---
* The query `py/nosql-injection` for finding NoSQL injection vulnerabilities is now part of the default security suite.
diff --git a/python/ql/src/codeql-pack.release.yml b/python/ql/src/codeql-pack.release.yml
index d086ed69541d..aabed7c396b7 100644
--- a/python/ql/src/codeql-pack.release.yml
+++ b/python/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.9.10
+lastReleaseVersion: 0.9.9
diff --git a/python/ql/src/qlpack.yml b/python/ql/src/qlpack.yml
index c920f667836b..aa18f2d87074 100644
--- a/python/ql/src/qlpack.yml
+++ b/python/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-queries
-version: 0.9.10
+version: 0.9.10-dev
groups:
- python
- queries
diff --git a/ruby/ql/lib/CHANGELOG.md b/ruby/ql/lib/CHANGELOG.md
index c61a12e0f4ad..a623a151e891 100644
--- a/ruby/ql/lib/CHANGELOG.md
+++ b/ruby/ql/lib/CHANGELOG.md
@@ -1,12 +1,3 @@
-## 0.8.10
-
-### Minor Analysis Improvements
-
-* Calls to `I18n.translate` as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
-* Calls to `Arel::Nodes::SqlLiteral.new` are now modeled as instances of the `SqlConstruction` concept, as well as propagating taint from their argument.
-* Additional arguments beyond the first of calls to the `ActiveRecord` methods `select`, `reselect`, `order`, `reorder`, `joins`, `group`, and `pluck` are now recognized as sql injection sinks.
-* Calls to several methods of `ActiveRecord::Connection`, such as `ActiveRecord::Connection#exec_query`, are now recognized as SQL executions, including those via subclasses.
-
## 0.8.9
### Minor Analysis Improvements
diff --git a/ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md b/ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md
new file mode 100644
index 000000000000..c2276f284a84
--- /dev/null
+++ b/ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Calls to several methods of `ActiveRecord::Connection`, such as `ActiveRecord::Connection#exec_query`, are now recognized as SQL executions, including those via subclasses.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md b/ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md
new file mode 100644
index 000000000000..1486c7a472d1
--- /dev/null
+++ b/ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Additional arguments beyond the first of calls to the `ActiveRecord` methods `select`, `reselect`, `order`, `reorder`, `joins`, `group`, and `pluck` are now recognized as sql injection sinks.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md b/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
new file mode 100644
index 000000000000..6f3a90768bab
--- /dev/null
+++ b/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Calls to `Arel::Nodes::SqlLiteral.new` are now modeled as instances of the `SqlConstruction` concept, as well as propagating taint from their argument.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md b/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
new file mode 100644
index 000000000000..350e049b5bfc
--- /dev/null
+++ b/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Calls to `I18n.translate` as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/released/0.8.10.md b/ruby/ql/lib/change-notes/released/0.8.10.md
deleted file mode 100644
index 666e28f840e7..000000000000
--- a/ruby/ql/lib/change-notes/released/0.8.10.md
+++ /dev/null
@@ -1,8 +0,0 @@
-## 0.8.10
-
-### Minor Analysis Improvements
-
-* Calls to `I18n.translate` as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
-* Calls to `Arel::Nodes::SqlLiteral.new` are now modeled as instances of the `SqlConstruction` concept, as well as propagating taint from their argument.
-* Additional arguments beyond the first of calls to the `ActiveRecord` methods `select`, `reselect`, `order`, `reorder`, `joins`, `group`, and `pluck` are now recognized as sql injection sinks.
-* Calls to several methods of `ActiveRecord::Connection`, such as `ActiveRecord::Connection#exec_query`, are now recognized as SQL executions, including those via subclasses.
diff --git a/ruby/ql/lib/codeql-pack.release.yml b/ruby/ql/lib/codeql-pack.release.yml
index 0521f0f75fad..5290c29b7fe7 100644
--- a/ruby/ql/lib/codeql-pack.release.yml
+++ b/ruby/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.10
+lastReleaseVersion: 0.8.9
diff --git a/ruby/ql/lib/qlpack.yml b/ruby/ql/lib/qlpack.yml
index de5b41999fe1..7d409b83adbd 100644
--- a/ruby/ql/lib/qlpack.yml
+++ b/ruby/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-all
-version: 0.8.10
+version: 0.8.10-dev
groups: ruby
extractor: ruby
dbscheme: ruby.dbscheme
diff --git a/ruby/ql/src/CHANGELOG.md b/ruby/ql/src/CHANGELOG.md
index f875b6d16ad4..4149c728effa 100644
--- a/ruby/ql/src/CHANGELOG.md
+++ b/ruby/ql/src/CHANGELOG.md
@@ -1,10 +1,3 @@
-## 0.8.10
-
-### Minor Analysis Improvements
-
-* Calls to `Object#method`, `Object#public_method` and `Object#singleton_method` with untrusted data are now recognised as sinks for code injection.
-* Added additional request sources for Ruby on Rails.
-
## 0.8.9
No user-facing changes.
diff --git a/ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md b/ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md
new file mode 100644
index 000000000000..84ea696dfef4
--- /dev/null
+++ b/ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added additional request sources for Ruby on Rails.
\ No newline at end of file
diff --git a/ruby/ql/src/change-notes/released/0.8.10.md b/ruby/ql/src/change-notes/2024-03-01-method-code-injection-sinks.md
similarity index 51%
rename from ruby/ql/src/change-notes/released/0.8.10.md
rename to ruby/ql/src/change-notes/2024-03-01-method-code-injection-sinks.md
index 985cdf8d22e0..43e40d3fd536 100644
--- a/ruby/ql/src/change-notes/released/0.8.10.md
+++ b/ruby/ql/src/change-notes/2024-03-01-method-code-injection-sinks.md
@@ -1,6 +1,4 @@
-## 0.8.10
-
-### Minor Analysis Improvements
-
-* Calls to `Object#method`, `Object#public_method` and `Object#singleton_method` with untrusted data are now recognised as sinks for code injection.
-* Added additional request sources for Ruby on Rails.
+---
+category: minorAnalysis
+---
+* Calls to `Object#method`, `Object#public_method` and `Object#singleton_method` with untrusted data are now recognised as sinks for code injection.
\ No newline at end of file
diff --git a/ruby/ql/src/codeql-pack.release.yml b/ruby/ql/src/codeql-pack.release.yml
index 0521f0f75fad..5290c29b7fe7 100644
--- a/ruby/ql/src/codeql-pack.release.yml
+++ b/ruby/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.10
+lastReleaseVersion: 0.8.9
diff --git a/ruby/ql/src/qlpack.yml b/ruby/ql/src/qlpack.yml
index 5e3792682346..8af7f9fd7976 100644
--- a/ruby/ql/src/qlpack.yml
+++ b/ruby/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-queries
-version: 0.8.10
+version: 0.8.10-dev
groups:
- ruby
- queries
diff --git a/shared/controlflow/CHANGELOG.md b/shared/controlflow/CHANGELOG.md
index 75f2ca53f987..dbfa6ef4512d 100644
--- a/shared/controlflow/CHANGELOG.md
+++ b/shared/controlflow/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.1.10
-
-No user-facing changes.
-
## 0.1.9
No user-facing changes.
diff --git a/shared/controlflow/change-notes/released/0.1.10.md b/shared/controlflow/change-notes/released/0.1.10.md
deleted file mode 100644
index 47358eeee934..000000000000
--- a/shared/controlflow/change-notes/released/0.1.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.1.10
-
-No user-facing changes.
diff --git a/shared/controlflow/codeql-pack.release.yml b/shared/controlflow/codeql-pack.release.yml
index 30f5ca88be0e..1425c0edf7f8 100644
--- a/shared/controlflow/codeql-pack.release.yml
+++ b/shared/controlflow/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.1.10
+lastReleaseVersion: 0.1.9
diff --git a/shared/controlflow/qlpack.yml b/shared/controlflow/qlpack.yml
index 1d43802be421..9d35a6782761 100644
--- a/shared/controlflow/qlpack.yml
+++ b/shared/controlflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/controlflow
-version: 0.1.10
+version: 0.1.10-dev
groups: shared
library: true
dependencies:
diff --git a/shared/dataflow/CHANGELOG.md b/shared/dataflow/CHANGELOG.md
index ef80788bded6..67a5bf589f4f 100644
--- a/shared/dataflow/CHANGELOG.md
+++ b/shared/dataflow/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.1
-
-No user-facing changes.
-
## 0.2.0
### Breaking Changes
diff --git a/shared/dataflow/change-notes/released/0.2.1.md b/shared/dataflow/change-notes/released/0.2.1.md
deleted file mode 100644
index 3dbfc85fe11d..000000000000
--- a/shared/dataflow/change-notes/released/0.2.1.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.1
-
-No user-facing changes.
diff --git a/shared/dataflow/codeql-pack.release.yml b/shared/dataflow/codeql-pack.release.yml
index df29a726bccc..5274e27ed522 100644
--- a/shared/dataflow/codeql-pack.release.yml
+++ b/shared/dataflow/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.1
+lastReleaseVersion: 0.2.0
diff --git a/shared/dataflow/qlpack.yml b/shared/dataflow/qlpack.yml
index ee422e02ea9a..1e7becf71c4f 100644
--- a/shared/dataflow/qlpack.yml
+++ b/shared/dataflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/dataflow
-version: 0.2.1
+version: 0.2.1-dev
groups: shared
library: true
dependencies:
diff --git a/shared/mad/CHANGELOG.md b/shared/mad/CHANGELOG.md
index 4730366775ea..4d09057118ce 100644
--- a/shared/mad/CHANGELOG.md
+++ b/shared/mad/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.10
-
-No user-facing changes.
-
## 0.2.9
No user-facing changes.
diff --git a/shared/mad/change-notes/released/0.2.10.md b/shared/mad/change-notes/released/0.2.10.md
deleted file mode 100644
index 81c9722b19fe..000000000000
--- a/shared/mad/change-notes/released/0.2.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.10
-
-No user-facing changes.
diff --git a/shared/mad/codeql-pack.release.yml b/shared/mad/codeql-pack.release.yml
index a71167814cb7..d021cf0a6bed 100644
--- a/shared/mad/codeql-pack.release.yml
+++ b/shared/mad/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.10
+lastReleaseVersion: 0.2.9
diff --git a/shared/mad/qlpack.yml b/shared/mad/qlpack.yml
index 6d7269ef3da8..22c8f271ccc6 100644
--- a/shared/mad/qlpack.yml
+++ b/shared/mad/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/mad
-version: 0.2.10
+version: 0.2.10-dev
groups: shared
library: true
dependencies: null
diff --git a/shared/rangeanalysis/CHANGELOG.md b/shared/rangeanalysis/CHANGELOG.md
index 9943dcb79727..5b8dbcfab22c 100644
--- a/shared/rangeanalysis/CHANGELOG.md
+++ b/shared/rangeanalysis/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.0.9
-
-No user-facing changes.
-
## 0.0.8
No user-facing changes.
diff --git a/shared/rangeanalysis/change-notes/released/0.0.9.md b/shared/rangeanalysis/change-notes/released/0.0.9.md
deleted file mode 100644
index c9e17c6d6cf2..000000000000
--- a/shared/rangeanalysis/change-notes/released/0.0.9.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.0.9
-
-No user-facing changes.
diff --git a/shared/rangeanalysis/codeql-pack.release.yml b/shared/rangeanalysis/codeql-pack.release.yml
index ecdd64fbab86..58fdc6b45deb 100644
--- a/shared/rangeanalysis/codeql-pack.release.yml
+++ b/shared/rangeanalysis/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.9
+lastReleaseVersion: 0.0.8
diff --git a/shared/rangeanalysis/qlpack.yml b/shared/rangeanalysis/qlpack.yml
index 01db5d5734d0..836fe51ee344 100644
--- a/shared/rangeanalysis/qlpack.yml
+++ b/shared/rangeanalysis/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/rangeanalysis
-version: 0.0.9
+version: 0.0.9-dev
groups: shared
library: true
dependencies:
diff --git a/shared/regex/CHANGELOG.md b/shared/regex/CHANGELOG.md
index c05869c153d3..cd5f91f71ec1 100644
--- a/shared/regex/CHANGELOG.md
+++ b/shared/regex/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.10
-
-No user-facing changes.
-
## 0.2.9
No user-facing changes.
diff --git a/shared/regex/change-notes/released/0.2.10.md b/shared/regex/change-notes/released/0.2.10.md
deleted file mode 100644
index 81c9722b19fe..000000000000
--- a/shared/regex/change-notes/released/0.2.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.10
-
-No user-facing changes.
diff --git a/shared/regex/codeql-pack.release.yml b/shared/regex/codeql-pack.release.yml
index a71167814cb7..d021cf0a6bed 100644
--- a/shared/regex/codeql-pack.release.yml
+++ b/shared/regex/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.10
+lastReleaseVersion: 0.2.9
diff --git a/shared/regex/qlpack.yml b/shared/regex/qlpack.yml
index 0d4f485312f7..ea3f7f9b2389 100644
--- a/shared/regex/qlpack.yml
+++ b/shared/regex/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/regex
-version: 0.2.10
+version: 0.2.10-dev
groups: shared
library: true
dependencies:
diff --git a/shared/ssa/CHANGELOG.md b/shared/ssa/CHANGELOG.md
index a9161ff578b0..01acfae01489 100644
--- a/shared/ssa/CHANGELOG.md
+++ b/shared/ssa/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.10
-
-No user-facing changes.
-
## 0.2.9
No user-facing changes.
diff --git a/shared/ssa/change-notes/released/0.2.10.md b/shared/ssa/change-notes/released/0.2.10.md
deleted file mode 100644
index 81c9722b19fe..000000000000
--- a/shared/ssa/change-notes/released/0.2.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.10
-
-No user-facing changes.
diff --git a/shared/ssa/codeql-pack.release.yml b/shared/ssa/codeql-pack.release.yml
index a71167814cb7..d021cf0a6bed 100644
--- a/shared/ssa/codeql-pack.release.yml
+++ b/shared/ssa/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.10
+lastReleaseVersion: 0.2.9
diff --git a/shared/ssa/qlpack.yml b/shared/ssa/qlpack.yml
index 2ad254711a50..19304ad107f1 100644
--- a/shared/ssa/qlpack.yml
+++ b/shared/ssa/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ssa
-version: 0.2.10
+version: 0.2.10-dev
groups: shared
library: true
dependencies:
diff --git a/shared/threat-models/CHANGELOG.md b/shared/threat-models/CHANGELOG.md
index a59e560c4155..fba2a8703562 100644
--- a/shared/threat-models/CHANGELOG.md
+++ b/shared/threat-models/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.0.9
-
-No user-facing changes.
-
## 0.0.8
No user-facing changes.
diff --git a/shared/threat-models/change-notes/released/0.0.9.md b/shared/threat-models/change-notes/released/0.0.9.md
deleted file mode 100644
index c9e17c6d6cf2..000000000000
--- a/shared/threat-models/change-notes/released/0.0.9.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.0.9
-
-No user-facing changes.
diff --git a/shared/threat-models/codeql-pack.release.yml b/shared/threat-models/codeql-pack.release.yml
index ecdd64fbab86..58fdc6b45deb 100644
--- a/shared/threat-models/codeql-pack.release.yml
+++ b/shared/threat-models/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.9
+lastReleaseVersion: 0.0.8
diff --git a/shared/threat-models/qlpack.yml b/shared/threat-models/qlpack.yml
index 60cbbc56fcb3..d0ed9a913b21 100644
--- a/shared/threat-models/qlpack.yml
+++ b/shared/threat-models/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/threat-models
-version: 0.0.9
+version: 0.0.9-dev
library: true
groups: shared
dataExtensions:
diff --git a/shared/tutorial/CHANGELOG.md b/shared/tutorial/CHANGELOG.md
index 560ad058d5b3..1db3a01af0b1 100644
--- a/shared/tutorial/CHANGELOG.md
+++ b/shared/tutorial/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.10
-
-No user-facing changes.
-
## 0.2.9
No user-facing changes.
diff --git a/shared/tutorial/change-notes/released/0.2.10.md b/shared/tutorial/change-notes/released/0.2.10.md
deleted file mode 100644
index 81c9722b19fe..000000000000
--- a/shared/tutorial/change-notes/released/0.2.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.10
-
-No user-facing changes.
diff --git a/shared/tutorial/codeql-pack.release.yml b/shared/tutorial/codeql-pack.release.yml
index a71167814cb7..d021cf0a6bed 100644
--- a/shared/tutorial/codeql-pack.release.yml
+++ b/shared/tutorial/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.10
+lastReleaseVersion: 0.2.9
diff --git a/shared/tutorial/qlpack.yml b/shared/tutorial/qlpack.yml
index 69116705c1bf..b595ae9ee70a 100644
--- a/shared/tutorial/qlpack.yml
+++ b/shared/tutorial/qlpack.yml
@@ -1,7 +1,7 @@
name: codeql/tutorial
description: Library for the CodeQL detective tutorials, helping new users learn to
write CodeQL queries.
-version: 0.2.10
+version: 0.2.10-dev
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/typetracking/CHANGELOG.md b/shared/typetracking/CHANGELOG.md
index 350f9ecbeae0..afc857bc6bce 100644
--- a/shared/typetracking/CHANGELOG.md
+++ b/shared/typetracking/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.10
-
-No user-facing changes.
-
## 0.2.9
No user-facing changes.
diff --git a/shared/typetracking/change-notes/released/0.2.10.md b/shared/typetracking/change-notes/released/0.2.10.md
deleted file mode 100644
index 81c9722b19fe..000000000000
--- a/shared/typetracking/change-notes/released/0.2.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.10
-
-No user-facing changes.
diff --git a/shared/typetracking/codeql-pack.release.yml b/shared/typetracking/codeql-pack.release.yml
index a71167814cb7..d021cf0a6bed 100644
--- a/shared/typetracking/codeql-pack.release.yml
+++ b/shared/typetracking/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.10
+lastReleaseVersion: 0.2.9
diff --git a/shared/typetracking/qlpack.yml b/shared/typetracking/qlpack.yml
index fbbdcf5162a1..b55927f59bb7 100644
--- a/shared/typetracking/qlpack.yml
+++ b/shared/typetracking/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typetracking
-version: 0.2.10
+version: 0.2.10-dev
groups: shared
library: true
dependencies:
diff --git a/shared/typos/CHANGELOG.md b/shared/typos/CHANGELOG.md
index 54b1eaa4d589..66c5871d9821 100644
--- a/shared/typos/CHANGELOG.md
+++ b/shared/typos/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.10
-
-No user-facing changes.
-
## 0.2.9
No user-facing changes.
diff --git a/shared/typos/change-notes/released/0.2.10.md b/shared/typos/change-notes/released/0.2.10.md
deleted file mode 100644
index 81c9722b19fe..000000000000
--- a/shared/typos/change-notes/released/0.2.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.10
-
-No user-facing changes.
diff --git a/shared/typos/codeql-pack.release.yml b/shared/typos/codeql-pack.release.yml
index a71167814cb7..d021cf0a6bed 100644
--- a/shared/typos/codeql-pack.release.yml
+++ b/shared/typos/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.10
+lastReleaseVersion: 0.2.9
diff --git a/shared/typos/qlpack.yml b/shared/typos/qlpack.yml
index 4d59d9b3c342..644bfe11bff7 100644
--- a/shared/typos/qlpack.yml
+++ b/shared/typos/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typos
-version: 0.2.10
+version: 0.2.10-dev
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/util/CHANGELOG.md b/shared/util/CHANGELOG.md
index 1ca1f71bcbc2..63832e927fa5 100644
--- a/shared/util/CHANGELOG.md
+++ b/shared/util/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.10
-
-No user-facing changes.
-
## 0.2.9
No user-facing changes.
diff --git a/shared/util/change-notes/released/0.2.10.md b/shared/util/change-notes/released/0.2.10.md
deleted file mode 100644
index 81c9722b19fe..000000000000
--- a/shared/util/change-notes/released/0.2.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.10
-
-No user-facing changes.
diff --git a/shared/util/codeql-pack.release.yml b/shared/util/codeql-pack.release.yml
index a71167814cb7..d021cf0a6bed 100644
--- a/shared/util/codeql-pack.release.yml
+++ b/shared/util/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.10
+lastReleaseVersion: 0.2.9
diff --git a/shared/util/qlpack.yml b/shared/util/qlpack.yml
index 28ed738a93dd..ca1a866a53d4 100644
--- a/shared/util/qlpack.yml
+++ b/shared/util/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/util
-version: 0.2.10
+version: 0.2.10-dev
groups: shared
library: true
dependencies: null
diff --git a/shared/yaml/CHANGELOG.md b/shared/yaml/CHANGELOG.md
index 9fd5ebc26ab2..e5495abcd503 100644
--- a/shared/yaml/CHANGELOG.md
+++ b/shared/yaml/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.2.10
-
-No user-facing changes.
-
## 0.2.9
No user-facing changes.
diff --git a/shared/yaml/change-notes/released/0.2.10.md b/shared/yaml/change-notes/released/0.2.10.md
deleted file mode 100644
index 81c9722b19fe..000000000000
--- a/shared/yaml/change-notes/released/0.2.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.2.10
-
-No user-facing changes.
diff --git a/shared/yaml/codeql-pack.release.yml b/shared/yaml/codeql-pack.release.yml
index a71167814cb7..d021cf0a6bed 100644
--- a/shared/yaml/codeql-pack.release.yml
+++ b/shared/yaml/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.10
+lastReleaseVersion: 0.2.9
diff --git a/shared/yaml/qlpack.yml b/shared/yaml/qlpack.yml
index 9643ffcec66b..de5b47e120ae 100644
--- a/shared/yaml/qlpack.yml
+++ b/shared/yaml/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/yaml
-version: 0.2.10
+version: 0.2.10-dev
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/swift/ql/lib/CHANGELOG.md b/swift/ql/lib/CHANGELOG.md
index 8f14bfcedc9c..e88cd0259ccf 100644
--- a/swift/ql/lib/CHANGELOG.md
+++ b/swift/ql/lib/CHANGELOG.md
@@ -1,9 +1,3 @@
-## 0.3.10
-
-### Bug Fixes
-
-* Fixed an issue where `TypeDecl.getFullName` would get stuck in an loop and fail when minor database inconsistencies are present.
-
## 0.3.9
### Minor Analysis Improvements
diff --git a/swift/ql/lib/change-notes/released/0.3.10.md b/swift/ql/lib/change-notes/2024-02-22-extension-patch.md
similarity index 83%
rename from swift/ql/lib/change-notes/released/0.3.10.md
rename to swift/ql/lib/change-notes/2024-02-22-extension-patch.md
index 9d6286ff58a7..7bd78f3b785c 100644
--- a/swift/ql/lib/change-notes/released/0.3.10.md
+++ b/swift/ql/lib/change-notes/2024-02-22-extension-patch.md
@@ -1,5 +1,4 @@
-## 0.3.10
-
-### Bug Fixes
-
+---
+category: fix
+---
* Fixed an issue where `TypeDecl.getFullName` would get stuck in an loop and fail when minor database inconsistencies are present.
diff --git a/swift/ql/lib/codeql-pack.release.yml b/swift/ql/lib/codeql-pack.release.yml
index 76ca0ac8ba76..3fa5180bcb49 100644
--- a/swift/ql/lib/codeql-pack.release.yml
+++ b/swift/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.3.10
+lastReleaseVersion: 0.3.9
diff --git a/swift/ql/lib/qlpack.yml b/swift/ql/lib/qlpack.yml
index 70ec4798ea85..a37a4cb3d580 100644
--- a/swift/ql/lib/qlpack.yml
+++ b/swift/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-all
-version: 0.3.10
+version: 0.3.10-dev
groups: swift
extractor: swift
dbscheme: swift.dbscheme
diff --git a/swift/ql/src/CHANGELOG.md b/swift/ql/src/CHANGELOG.md
index bda9834c9bca..96615d069729 100644
--- a/swift/ql/src/CHANGELOG.md
+++ b/swift/ql/src/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.3.10
-
-No user-facing changes.
-
## 0.3.9
### New Queries
diff --git a/swift/ql/src/change-notes/released/0.3.10.md b/swift/ql/src/change-notes/released/0.3.10.md
deleted file mode 100644
index 925a48fc52e0..000000000000
--- a/swift/ql/src/change-notes/released/0.3.10.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## 0.3.10
-
-No user-facing changes.
diff --git a/swift/ql/src/codeql-pack.release.yml b/swift/ql/src/codeql-pack.release.yml
index 76ca0ac8ba76..3fa5180bcb49 100644
--- a/swift/ql/src/codeql-pack.release.yml
+++ b/swift/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.3.10
+lastReleaseVersion: 0.3.9
diff --git a/swift/ql/src/qlpack.yml b/swift/ql/src/qlpack.yml
index ba66b065529b..e3ead42c98bf 100644
--- a/swift/ql/src/qlpack.yml
+++ b/swift/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-queries
-version: 0.3.10
+version: 0.3.10-dev
groups:
- swift
- queries
From 2f058ffb4d0bc7486717a95744c240b9eef87fe6 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
Date: Wed, 6 Mar 2024 20:56:51 +0000
Subject: [PATCH 069/731] Release preparation for version 2.16.4
---
cpp/ql/lib/CHANGELOG.md | 6 ++++++
.../0.12.7.md} | 9 +++++----
cpp/ql/lib/codeql-pack.release.yml | 2 +-
cpp/ql/lib/qlpack.yml | 2 +-
cpp/ql/src/CHANGELOG.md | 7 +++++++
.../2024-02-29-non-constant-format-path-query.md | 4 ----
.../0.9.6.md} | 8 +++++---
cpp/ql/src/codeql-pack.release.yml | 2 +-
cpp/ql/src/qlpack.yml | 2 +-
csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md | 4 ++++
.../Solorigate/lib/change-notes/released/1.7.10.md | 3 +++
.../Solorigate/lib/codeql-pack.release.yml | 2 +-
csharp/ql/campaigns/Solorigate/lib/qlpack.yml | 2 +-
csharp/ql/campaigns/Solorigate/src/CHANGELOG.md | 4 ++++
.../Solorigate/src/change-notes/released/1.7.10.md | 3 +++
.../Solorigate/src/codeql-pack.release.yml | 2 +-
csharp/ql/campaigns/Solorigate/src/qlpack.yml | 2 +-
csharp/ql/lib/CHANGELOG.md | 14 ++++++++++++++
.../change-notes/2024-02-21-getonly-properties.md | 4 ----
.../ql/lib/change-notes/2024-02-22-no-db-stats.md | 4 ----
.../change-notes/2024-02-23-compiler-generated.md | 4 ----
.../2024-02-26-variable-capture-flow.md | 4 ----
.../2024-02-28-experimental-attribute.md | 4 ----
.../2024-02-28-refreadonly-parameter.md | 4 ----
csharp/ql/lib/change-notes/released/0.8.10.md | 13 +++++++++++++
csharp/ql/lib/codeql-pack.release.yml | 2 +-
csharp/ql/lib/qlpack.yml | 2 +-
csharp/ql/src/CHANGELOG.md | 6 ++++++
.../0.8.10.md} | 9 +++++----
csharp/ql/src/codeql-pack.release.yml | 2 +-
csharp/ql/src/qlpack.yml | 2 +-
go/ql/consistency-queries/CHANGELOG.md | 4 ++++
.../change-notes/released/0.0.9.md | 3 +++
go/ql/consistency-queries/codeql-pack.release.yml | 2 +-
go/ql/consistency-queries/qlpack.yml | 2 +-
go/ql/lib/CHANGELOG.md | 11 +++++++++++
.../lib/change-notes/2024-02-14-range-map-read.md | 4 ----
.../0.7.10.md} | 11 ++++++++---
go/ql/lib/codeql-pack.release.yml | 2 +-
go/ql/lib/qlpack.yml | 2 +-
go/ql/src/CHANGELOG.md | 4 ++++
go/ql/src/change-notes/released/0.7.10.md | 3 +++
go/ql/src/codeql-pack.release.yml | 2 +-
go/ql/src/qlpack.yml | 2 +-
java/ql/automodel/src/CHANGELOG.md | 4 ++++
.../automodel/src/change-notes/released/0.0.17.md | 3 +++
java/ql/automodel/src/codeql-pack.release.yml | 2 +-
java/ql/automodel/src/qlpack.yml | 2 +-
java/ql/lib/CHANGELOG.md | 11 +++++++++++
.../change-notes/2024-02-23-widget-flowsteps.md | 4 ----
java/ql/lib/change-notes/2024-02-27-error-types.md | 4 ----
.../lib/change-notes/2024-02-27-mvnw-versions.md | 4 ----
java/ql/lib/change-notes/released/0.8.10.md | 10 ++++++++++
java/ql/lib/codeql-pack.release.yml | 2 +-
java/ql/lib/qlpack.yml | 2 +-
java/ql/src/CHANGELOG.md | 10 ++++++++++
.../2024-02-12-android-insecure-keys.md | 4 ----
.../0.8.10.md} | 11 ++++++++---
java/ql/src/codeql-pack.release.yml | 2 +-
java/ql/src/qlpack.yml | 2 +-
javascript/ql/lib/CHANGELOG.md | 4 ++++
javascript/ql/lib/change-notes/released/0.8.10.md | 3 +++
javascript/ql/lib/codeql-pack.release.yml | 2 +-
javascript/ql/lib/qlpack.yml | 2 +-
javascript/ql/src/CHANGELOG.md | 4 ++++
javascript/ql/src/change-notes/released/0.8.10.md | 3 +++
javascript/ql/src/codeql-pack.release.yml | 2 +-
javascript/ql/src/qlpack.yml | 2 +-
misc/suite-helpers/CHANGELOG.md | 4 ++++
misc/suite-helpers/change-notes/released/0.7.10.md | 3 +++
misc/suite-helpers/codeql-pack.release.yml | 2 +-
misc/suite-helpers/qlpack.yml | 2 +-
python/ql/lib/CHANGELOG.md | 7 +++++++
.../2024-02-28-iterable-unpacking-module-scope.md | 4 ----
.../0.11.10.md} | 8 +++++---
python/ql/lib/codeql-pack.release.yml | 2 +-
python/ql/lib/qlpack.yml | 2 +-
python/ql/src/CHANGELOG.md | 6 ++++++
.../0.9.10.md} | 7 ++++---
python/ql/src/codeql-pack.release.yml | 2 +-
python/ql/src/qlpack.yml | 2 +-
ruby/ql/lib/CHANGELOG.md | 9 +++++++++
...2024-02-15-activerecord_connection_sql_sinks.md | 4 ----
.../2024-02-20-activerecord-sql-sink-arguments.md | 4 ----
.../lib/change-notes/2024-02-26-arel-sqlliteral.md | 4 ----
.../lib/change-notes/2024-02-29-i18n-translate.md | 4 ----
ruby/ql/lib/change-notes/released/0.8.10.md | 8 ++++++++
ruby/ql/lib/codeql-pack.release.yml | 2 +-
ruby/ql/lib/qlpack.yml | 2 +-
ruby/ql/src/CHANGELOG.md | 7 +++++++
.../2024-02-13-rails-more-request-sources.md | 4 ----
.../0.8.10.md} | 10 ++++++----
ruby/ql/src/codeql-pack.release.yml | 2 +-
ruby/ql/src/qlpack.yml | 2 +-
shared/controlflow/CHANGELOG.md | 4 ++++
shared/controlflow/change-notes/released/0.1.10.md | 3 +++
shared/controlflow/codeql-pack.release.yml | 2 +-
shared/controlflow/qlpack.yml | 2 +-
shared/dataflow/CHANGELOG.md | 4 ++++
shared/dataflow/change-notes/released/0.2.1.md | 3 +++
shared/dataflow/codeql-pack.release.yml | 2 +-
shared/dataflow/qlpack.yml | 2 +-
shared/mad/CHANGELOG.md | 4 ++++
shared/mad/change-notes/released/0.2.10.md | 3 +++
shared/mad/codeql-pack.release.yml | 2 +-
shared/mad/qlpack.yml | 2 +-
shared/rangeanalysis/CHANGELOG.md | 4 ++++
.../rangeanalysis/change-notes/released/0.0.9.md | 3 +++
shared/rangeanalysis/codeql-pack.release.yml | 2 +-
shared/rangeanalysis/qlpack.yml | 2 +-
shared/regex/CHANGELOG.md | 4 ++++
shared/regex/change-notes/released/0.2.10.md | 3 +++
shared/regex/codeql-pack.release.yml | 2 +-
shared/regex/qlpack.yml | 2 +-
shared/ssa/CHANGELOG.md | 4 ++++
shared/ssa/change-notes/released/0.2.10.md | 3 +++
shared/ssa/codeql-pack.release.yml | 2 +-
shared/ssa/qlpack.yml | 2 +-
shared/threat-models/CHANGELOG.md | 4 ++++
.../threat-models/change-notes/released/0.0.9.md | 3 +++
shared/threat-models/codeql-pack.release.yml | 2 +-
shared/threat-models/qlpack.yml | 2 +-
shared/tutorial/CHANGELOG.md | 4 ++++
shared/tutorial/change-notes/released/0.2.10.md | 3 +++
shared/tutorial/codeql-pack.release.yml | 2 +-
shared/tutorial/qlpack.yml | 2 +-
shared/typetracking/CHANGELOG.md | 4 ++++
.../typetracking/change-notes/released/0.2.10.md | 3 +++
shared/typetracking/codeql-pack.release.yml | 2 +-
shared/typetracking/qlpack.yml | 2 +-
shared/typos/CHANGELOG.md | 4 ++++
shared/typos/change-notes/released/0.2.10.md | 3 +++
shared/typos/codeql-pack.release.yml | 2 +-
shared/typos/qlpack.yml | 2 +-
shared/util/CHANGELOG.md | 4 ++++
shared/util/change-notes/released/0.2.10.md | 3 +++
shared/util/codeql-pack.release.yml | 2 +-
shared/util/qlpack.yml | 2 +-
shared/yaml/CHANGELOG.md | 4 ++++
shared/yaml/change-notes/released/0.2.10.md | 3 +++
shared/yaml/codeql-pack.release.yml | 2 +-
shared/yaml/qlpack.yml | 2 +-
swift/ql/lib/CHANGELOG.md | 6 ++++++
.../0.3.10.md} | 7 ++++---
swift/ql/lib/codeql-pack.release.yml | 2 +-
swift/ql/lib/qlpack.yml | 2 +-
swift/ql/src/CHANGELOG.md | 4 ++++
swift/ql/src/change-notes/released/0.3.10.md | 3 +++
swift/ql/src/codeql-pack.release.yml | 2 +-
swift/ql/src/qlpack.yml | 2 +-
150 files changed, 394 insertions(+), 168 deletions(-)
rename cpp/ql/lib/change-notes/{2024-02-26-ir-named-destructors.md => released/0.12.7.md} (54%)
delete mode 100644 cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md
rename cpp/ql/src/change-notes/{2024-02-16-modelled-functions-block-flow.md => released/0.9.6.md} (77%)
create mode 100644 csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md
create mode 100644 csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md
delete mode 100644 csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md
create mode 100644 csharp/ql/lib/change-notes/released/0.8.10.md
rename csharp/ql/src/change-notes/{2024-02-06-threat-models.md => released/0.8.10.md} (88%)
create mode 100644 go/ql/consistency-queries/change-notes/released/0.0.9.md
delete mode 100644 go/ql/lib/change-notes/2024-02-14-range-map-read.md
rename go/ql/lib/change-notes/{2024-03-04-autobuilder-changes.md => released/0.7.10.md} (68%)
create mode 100644 go/ql/src/change-notes/released/0.7.10.md
create mode 100644 java/ql/automodel/src/change-notes/released/0.0.17.md
delete mode 100644 java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md
delete mode 100644 java/ql/lib/change-notes/2024-02-27-error-types.md
delete mode 100644 java/ql/lib/change-notes/2024-02-27-mvnw-versions.md
create mode 100644 java/ql/lib/change-notes/released/0.8.10.md
delete mode 100644 java/ql/src/change-notes/2024-02-12-android-insecure-keys.md
rename java/ql/src/change-notes/{2024-03-04-sensitive-log-remove-null-from-sources.md => released/0.8.10.md} (54%)
create mode 100644 javascript/ql/lib/change-notes/released/0.8.10.md
create mode 100644 javascript/ql/src/change-notes/released/0.8.10.md
create mode 100644 misc/suite-helpers/change-notes/released/0.7.10.md
delete mode 100644 python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md
rename python/ql/lib/change-notes/{2024-03-01-dict-update-content.md => released/0.11.10.md} (52%)
rename python/ql/src/change-notes/{2024-03-04-nosql-injection.md => released/0.9.10.md} (81%)
delete mode 100644 ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md
delete mode 100644 ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md
delete mode 100644 ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
delete mode 100644 ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
create mode 100644 ruby/ql/lib/change-notes/released/0.8.10.md
delete mode 100644 ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md
rename ruby/ql/src/change-notes/{2024-03-01-method-code-injection-sinks.md => released/0.8.10.md} (51%)
create mode 100644 shared/controlflow/change-notes/released/0.1.10.md
create mode 100644 shared/dataflow/change-notes/released/0.2.1.md
create mode 100644 shared/mad/change-notes/released/0.2.10.md
create mode 100644 shared/rangeanalysis/change-notes/released/0.0.9.md
create mode 100644 shared/regex/change-notes/released/0.2.10.md
create mode 100644 shared/ssa/change-notes/released/0.2.10.md
create mode 100644 shared/threat-models/change-notes/released/0.0.9.md
create mode 100644 shared/tutorial/change-notes/released/0.2.10.md
create mode 100644 shared/typetracking/change-notes/released/0.2.10.md
create mode 100644 shared/typos/change-notes/released/0.2.10.md
create mode 100644 shared/util/change-notes/released/0.2.10.md
create mode 100644 shared/yaml/change-notes/released/0.2.10.md
rename swift/ql/lib/change-notes/{2024-02-22-extension-patch.md => released/0.3.10.md} (83%)
create mode 100644 swift/ql/src/change-notes/released/0.3.10.md
diff --git a/cpp/ql/lib/CHANGELOG.md b/cpp/ql/lib/CHANGELOG.md
index b3091ec37d8f..e1c0dfbecd9a 100644
--- a/cpp/ql/lib/CHANGELOG.md
+++ b/cpp/ql/lib/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 0.12.7
+
+### Minor Analysis Improvements
+
+* Added destructors for named objects to the intermediate representation.
+
## 0.12.6
### New Features
diff --git a/cpp/ql/lib/change-notes/2024-02-26-ir-named-destructors.md b/cpp/ql/lib/change-notes/released/0.12.7.md
similarity index 54%
rename from cpp/ql/lib/change-notes/2024-02-26-ir-named-destructors.md
rename to cpp/ql/lib/change-notes/released/0.12.7.md
index 4e35decaf8ed..856a8b665c74 100644
--- a/cpp/ql/lib/change-notes/2024-02-26-ir-named-destructors.md
+++ b/cpp/ql/lib/change-notes/released/0.12.7.md
@@ -1,4 +1,5 @@
----
-category: minorAnalysis
----
-* Added destructors for named objects to the intermediate representation.
\ No newline at end of file
+## 0.12.7
+
+### Minor Analysis Improvements
+
+* Added destructors for named objects to the intermediate representation.
diff --git a/cpp/ql/lib/codeql-pack.release.yml b/cpp/ql/lib/codeql-pack.release.yml
index 170a312c1047..20419e9c6100 100644
--- a/cpp/ql/lib/codeql-pack.release.yml
+++ b/cpp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.12.6
+lastReleaseVersion: 0.12.7
diff --git a/cpp/ql/lib/qlpack.yml b/cpp/ql/lib/qlpack.yml
index 8e201fff5943..3bb9229bf94d 100644
--- a/cpp/ql/lib/qlpack.yml
+++ b/cpp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-all
-version: 0.12.7-dev
+version: 0.12.7
groups: cpp
dbscheme: semmlecode.cpp.dbscheme
extractor: cpp
diff --git a/cpp/ql/src/CHANGELOG.md b/cpp/ql/src/CHANGELOG.md
index ffcd73ff5d72..f6acd424bb05 100644
--- a/cpp/ql/src/CHANGELOG.md
+++ b/cpp/ql/src/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 0.9.6
+
+### Minor Analysis Improvements
+
+* The "non-constant format string" query (`cpp/non-constant-format`) has been converted to a `path-problem` query.
+* The new C/C++ dataflow and taint-tracking libraries (`semmle.code.cpp.dataflow.new.DataFlow` and `semmle.code.cpp.dataflow.new.TaintTracking`) now implicitly assume that dataflow and taint modelled via `DataFlowFunction` and `TaintFunction` always fully overwrite their buffers and thus act as flow barriers. As a result, many dataflow and taint-tracking queries now produce fewer false positives. To remove this assumption and go back to the previous behavior for a given model, one can override the new `isPartialWrite` predicate.
+
## 0.9.5
### Minor Analysis Improvements
diff --git a/cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md b/cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md
deleted file mode 100644
index 2e5933a61e86..000000000000
--- a/cpp/ql/src/change-notes/2024-02-29-non-constant-format-path-query.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The "non-constant format string" query (`cpp/non-constant-format`) has been converted to a `path-problem` query.
\ No newline at end of file
diff --git a/cpp/ql/src/change-notes/2024-02-16-modelled-functions-block-flow.md b/cpp/ql/src/change-notes/released/0.9.6.md
similarity index 77%
rename from cpp/ql/src/change-notes/2024-02-16-modelled-functions-block-flow.md
rename to cpp/ql/src/change-notes/released/0.9.6.md
index d6ef3c3e0569..0c85f3f9f0f0 100644
--- a/cpp/ql/src/change-notes/2024-02-16-modelled-functions-block-flow.md
+++ b/cpp/ql/src/change-notes/released/0.9.6.md
@@ -1,4 +1,6 @@
----
-category: minorAnalysis
----
+## 0.9.6
+
+### Minor Analysis Improvements
+
+* The "non-constant format string" query (`cpp/non-constant-format`) has been converted to a `path-problem` query.
* The new C/C++ dataflow and taint-tracking libraries (`semmle.code.cpp.dataflow.new.DataFlow` and `semmle.code.cpp.dataflow.new.TaintTracking`) now implicitly assume that dataflow and taint modelled via `DataFlowFunction` and `TaintFunction` always fully overwrite their buffers and thus act as flow barriers. As a result, many dataflow and taint-tracking queries now produce fewer false positives. To remove this assumption and go back to the previous behavior for a given model, one can override the new `isPartialWrite` predicate.
diff --git a/cpp/ql/src/codeql-pack.release.yml b/cpp/ql/src/codeql-pack.release.yml
index 460240feafff..19139c132b2d 100644
--- a/cpp/ql/src/codeql-pack.release.yml
+++ b/cpp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.9.5
+lastReleaseVersion: 0.9.6
diff --git a/cpp/ql/src/qlpack.yml b/cpp/ql/src/qlpack.yml
index 31bd20166b2b..4052647bb97f 100644
--- a/cpp/ql/src/qlpack.yml
+++ b/cpp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-queries
-version: 0.9.6-dev
+version: 0.9.6
groups:
- cpp
- queries
diff --git a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
index 190b83b0f25a..82eacfc84f70 100644
--- a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
+++ b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.7.10
+
+No user-facing changes.
+
## 1.7.9
No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md
new file mode 100644
index 000000000000..8e8007d8475f
--- /dev/null
+++ b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.10.md
@@ -0,0 +1,3 @@
+## 1.7.10
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
index 678da6bc37e9..31c7fe07020b 100644
--- a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.7.9
+lastReleaseVersion: 1.7.10
diff --git a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
index 7e643b0fac33..ee993bed0c91 100644
--- a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-all
-version: 1.7.10-dev
+version: 1.7.10
groups:
- csharp
- solorigate
diff --git a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
index 190b83b0f25a..82eacfc84f70 100644
--- a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
+++ b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.7.10
+
+No user-facing changes.
+
## 1.7.9
No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md
new file mode 100644
index 000000000000..8e8007d8475f
--- /dev/null
+++ b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.10.md
@@ -0,0 +1,3 @@
+## 1.7.10
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
index 678da6bc37e9..31c7fe07020b 100644
--- a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
+++ b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.7.9
+lastReleaseVersion: 1.7.10
diff --git a/csharp/ql/campaigns/Solorigate/src/qlpack.yml b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
index 8654bbfd0312..1f421754fc82 100644
--- a/csharp/ql/campaigns/Solorigate/src/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-queries
-version: 1.7.10-dev
+version: 1.7.10
groups:
- csharp
- solorigate
diff --git a/csharp/ql/lib/CHANGELOG.md b/csharp/ql/lib/CHANGELOG.md
index 95fd64c52704..16cc14259e19 100644
--- a/csharp/ql/lib/CHANGELOG.md
+++ b/csharp/ql/lib/CHANGELOG.md
@@ -1,3 +1,17 @@
+## 0.8.10
+
+### Major Analysis Improvements
+
+* Improved support for flow through captured variables that properly adheres to inter-procedural control flow.
+* We no longer make use of CodeQL database stats, which may affect join-orders in custom queries. It is therefore recommended to test performance of custom queries after upgrading to this version.
+
+### Minor Analysis Improvements
+
+* C# 12: Add QL library support (`ExperimentalAttribute`) for the experimental attribute.
+* C# 12: Add extractor and QL library support for `ref readonly` parameters.
+* C#: The table `expr_compiler_generated` has been deleted and its content has been added to `compiler_generated`.
+* Data flow via get only properties like `public object Obj { get; }` is now captured by the data flow library.
+
## 0.8.9
### Minor Analysis Improvements
diff --git a/csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md b/csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md
deleted file mode 100644
index 6bb8e99c71ef..000000000000
--- a/csharp/ql/lib/change-notes/2024-02-21-getonly-properties.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Data flow via get only properties like `public object Obj { get; }` is now captured by the data flow library.
diff --git a/csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md b/csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md
deleted file mode 100644
index d6ffbd523ac6..000000000000
--- a/csharp/ql/lib/change-notes/2024-02-22-no-db-stats.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: majorAnalysis
----
-* We no longer make use of CodeQL database stats, which may affect join-orders in custom queries. It is therefore recommended to test performance of custom queries after upgrading to this version.
diff --git a/csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md b/csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md
deleted file mode 100644
index 9b1739b9b6da..000000000000
--- a/csharp/ql/lib/change-notes/2024-02-23-compiler-generated.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* C#: The table `expr_compiler_generated` has been deleted and its content has been added to `compiler_generated`.
diff --git a/csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md b/csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md
deleted file mode 100644
index 66ab65083dc3..000000000000
--- a/csharp/ql/lib/change-notes/2024-02-26-variable-capture-flow.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: majorAnalysis
----
-* Improved support for flow through captured variables that properly adheres to inter-procedural control flow.
\ No newline at end of file
diff --git a/csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md b/csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md
deleted file mode 100644
index 8749c790954e..000000000000
--- a/csharp/ql/lib/change-notes/2024-02-28-experimental-attribute.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* C# 12: Add QL library support (`ExperimentalAttribute`) for the experimental attribute.
diff --git a/csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md b/csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md
deleted file mode 100644
index 586b5341d293..000000000000
--- a/csharp/ql/lib/change-notes/2024-02-28-refreadonly-parameter.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* C# 12: Add extractor and QL library support for `ref readonly` parameters.
diff --git a/csharp/ql/lib/change-notes/released/0.8.10.md b/csharp/ql/lib/change-notes/released/0.8.10.md
new file mode 100644
index 000000000000..f591ddc5b21a
--- /dev/null
+++ b/csharp/ql/lib/change-notes/released/0.8.10.md
@@ -0,0 +1,13 @@
+## 0.8.10
+
+### Major Analysis Improvements
+
+* Improved support for flow through captured variables that properly adheres to inter-procedural control flow.
+* We no longer make use of CodeQL database stats, which may affect join-orders in custom queries. It is therefore recommended to test performance of custom queries after upgrading to this version.
+
+### Minor Analysis Improvements
+
+* C# 12: Add QL library support (`ExperimentalAttribute`) for the experimental attribute.
+* C# 12: Add extractor and QL library support for `ref readonly` parameters.
+* C#: The table `expr_compiler_generated` has been deleted and its content has been added to `compiler_generated`.
+* Data flow via get only properties like `public object Obj { get; }` is now captured by the data flow library.
diff --git a/csharp/ql/lib/codeql-pack.release.yml b/csharp/ql/lib/codeql-pack.release.yml
index 5290c29b7fe7..0521f0f75fad 100644
--- a/csharp/ql/lib/codeql-pack.release.yml
+++ b/csharp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/csharp/ql/lib/qlpack.yml b/csharp/ql/lib/qlpack.yml
index d75ea3c63207..93c5c1120a24 100644
--- a/csharp/ql/lib/qlpack.yml
+++ b/csharp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-all
-version: 0.8.10-dev
+version: 0.8.10
groups: csharp
dbscheme: semmlecode.csharp.dbscheme
extractor: csharp
diff --git a/csharp/ql/src/CHANGELOG.md b/csharp/ql/src/CHANGELOG.md
index 9fe1609363fc..46c939e5cee1 100644
--- a/csharp/ql/src/CHANGELOG.md
+++ b/csharp/ql/src/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. The changed queries are `cs/code-injection`, `cs/command-line-injection`, `cs/user-controlled-bypass`, `cs/count-untrusted-data-external-api`, `cs/untrusted-data-to-external-api`, `cs/ldap-injection`, `cs/log-forging`, `cs/xml/missing-validation`, `cs/redos`, `cs/regex-injection`, `cs/resource-injection`, `cs/sql-injection`, `cs/path-injection`, `cs/unsafe-deserialization-untrusted-input`, `cs/web/unvalidated-url-redirection`, `cs/xml/insecure-dtd-handling`, `cs/xml/xpath-injection`, `cs/web/xss`, and `cs/uncontrolled-format-string`.
+
## 0.8.9
### Minor Analysis Improvements
diff --git a/csharp/ql/src/change-notes/2024-02-06-threat-models.md b/csharp/ql/src/change-notes/released/0.8.10.md
similarity index 88%
rename from csharp/ql/src/change-notes/2024-02-06-threat-models.md
rename to csharp/ql/src/change-notes/released/0.8.10.md
index 69ac4e4dc17a..702161c3d28f 100644
--- a/csharp/ql/src/change-notes/2024-02-06-threat-models.md
+++ b/csharp/ql/src/change-notes/released/0.8.10.md
@@ -1,4 +1,5 @@
----
-category: minorAnalysis
----
-* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. The changed queries are `cs/code-injection`, `cs/command-line-injection`, `cs/user-controlled-bypass`, `cs/count-untrusted-data-external-api`, `cs/untrusted-data-to-external-api`, `cs/ldap-injection`, `cs/log-forging`, `cs/xml/missing-validation`, `cs/redos`, `cs/regex-injection`, `cs/resource-injection`, `cs/sql-injection`, `cs/path-injection`, `cs/unsafe-deserialization-untrusted-input`, `cs/web/unvalidated-url-redirection`, `cs/xml/insecure-dtd-handling`, `cs/xml/xpath-injection`, `cs/web/xss`, and `cs/uncontrolled-format-string`.
\ No newline at end of file
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Most data flow queries that track flow from *remote* flow sources now use the current *threat model* configuration instead. This doesn't lead to any changes in the produced alerts (as the default configuration is *remote* flow sources) unless the threat model configuration is changed. The changed queries are `cs/code-injection`, `cs/command-line-injection`, `cs/user-controlled-bypass`, `cs/count-untrusted-data-external-api`, `cs/untrusted-data-to-external-api`, `cs/ldap-injection`, `cs/log-forging`, `cs/xml/missing-validation`, `cs/redos`, `cs/regex-injection`, `cs/resource-injection`, `cs/sql-injection`, `cs/path-injection`, `cs/unsafe-deserialization-untrusted-input`, `cs/web/unvalidated-url-redirection`, `cs/xml/insecure-dtd-handling`, `cs/xml/xpath-injection`, `cs/web/xss`, and `cs/uncontrolled-format-string`.
diff --git a/csharp/ql/src/codeql-pack.release.yml b/csharp/ql/src/codeql-pack.release.yml
index 5290c29b7fe7..0521f0f75fad 100644
--- a/csharp/ql/src/codeql-pack.release.yml
+++ b/csharp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/csharp/ql/src/qlpack.yml b/csharp/ql/src/qlpack.yml
index 9ee23cc73078..46384094b19e 100644
--- a/csharp/ql/src/qlpack.yml
+++ b/csharp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-queries
-version: 0.8.10-dev
+version: 0.8.10
groups:
- csharp
- queries
diff --git a/go/ql/consistency-queries/CHANGELOG.md b/go/ql/consistency-queries/CHANGELOG.md
index fba2a8703562..a59e560c4155 100644
--- a/go/ql/consistency-queries/CHANGELOG.md
+++ b/go/ql/consistency-queries/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.0.9
+
+No user-facing changes.
+
## 0.0.8
No user-facing changes.
diff --git a/go/ql/consistency-queries/change-notes/released/0.0.9.md b/go/ql/consistency-queries/change-notes/released/0.0.9.md
new file mode 100644
index 000000000000..c9e17c6d6cf2
--- /dev/null
+++ b/go/ql/consistency-queries/change-notes/released/0.0.9.md
@@ -0,0 +1,3 @@
+## 0.0.9
+
+No user-facing changes.
diff --git a/go/ql/consistency-queries/codeql-pack.release.yml b/go/ql/consistency-queries/codeql-pack.release.yml
index 58fdc6b45deb..ecdd64fbab86 100644
--- a/go/ql/consistency-queries/codeql-pack.release.yml
+++ b/go/ql/consistency-queries/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.8
+lastReleaseVersion: 0.0.9
diff --git a/go/ql/consistency-queries/qlpack.yml b/go/ql/consistency-queries/qlpack.yml
index b574796b9954..d5a2fbee5f19 100644
--- a/go/ql/consistency-queries/qlpack.yml
+++ b/go/ql/consistency-queries/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql-go-consistency-queries
-version: 0.0.9-dev
+version: 0.0.9
groups:
- go
- queries
diff --git a/go/ql/lib/CHANGELOG.md b/go/ql/lib/CHANGELOG.md
index 65a2376217b1..fee5fd37a267 100644
--- a/go/ql/lib/CHANGELOG.md
+++ b/go/ql/lib/CHANGELOG.md
@@ -1,3 +1,14 @@
+## 0.7.10
+
+### Major Analysis Improvements
+
+* We have significantly improved the Go autobuilder to understand a greater range of project layouts, which allows Go source files to be analysed that could previously not be processed.
+* Go 1.22 has been included in the range of supported Go versions.
+
+### Bug Fixes
+
+* Fixed dataflow out of a `map` using a `range` statement.
+
## 0.7.9
No user-facing changes.
diff --git a/go/ql/lib/change-notes/2024-02-14-range-map-read.md b/go/ql/lib/change-notes/2024-02-14-range-map-read.md
deleted file mode 100644
index ea45737a72ea..000000000000
--- a/go/ql/lib/change-notes/2024-02-14-range-map-read.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: fix
----
-* Fixed dataflow out of a `map` using a `range` statement.
diff --git a/go/ql/lib/change-notes/2024-03-04-autobuilder-changes.md b/go/ql/lib/change-notes/released/0.7.10.md
similarity index 68%
rename from go/ql/lib/change-notes/2024-03-04-autobuilder-changes.md
rename to go/ql/lib/change-notes/released/0.7.10.md
index 0442a571029f..55954f8a3945 100644
--- a/go/ql/lib/change-notes/2024-03-04-autobuilder-changes.md
+++ b/go/ql/lib/change-notes/released/0.7.10.md
@@ -1,5 +1,10 @@
----
-category: majorAnalysis
----
+## 0.7.10
+
+### Major Analysis Improvements
+
* We have significantly improved the Go autobuilder to understand a greater range of project layouts, which allows Go source files to be analysed that could previously not be processed.
* Go 1.22 has been included in the range of supported Go versions.
+
+### Bug Fixes
+
+* Fixed dataflow out of a `map` using a `range` statement.
diff --git a/go/ql/lib/codeql-pack.release.yml b/go/ql/lib/codeql-pack.release.yml
index 576395f3405e..675185672974 100644
--- a/go/ql/lib/codeql-pack.release.yml
+++ b/go/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.7.9
+lastReleaseVersion: 0.7.10
diff --git a/go/ql/lib/qlpack.yml b/go/ql/lib/qlpack.yml
index f21e478efa68..8cc190fa880a 100644
--- a/go/ql/lib/qlpack.yml
+++ b/go/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-all
-version: 0.7.10-dev
+version: 0.7.10
groups: go
dbscheme: go.dbscheme
extractor: go
diff --git a/go/ql/src/CHANGELOG.md b/go/ql/src/CHANGELOG.md
index d95165a3a34e..24e38b9890e1 100644
--- a/go/ql/src/CHANGELOG.md
+++ b/go/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.7.10
+
+No user-facing changes.
+
## 0.7.9
### New Queries
diff --git a/go/ql/src/change-notes/released/0.7.10.md b/go/ql/src/change-notes/released/0.7.10.md
new file mode 100644
index 000000000000..989c5b8f6823
--- /dev/null
+++ b/go/ql/src/change-notes/released/0.7.10.md
@@ -0,0 +1,3 @@
+## 0.7.10
+
+No user-facing changes.
diff --git a/go/ql/src/codeql-pack.release.yml b/go/ql/src/codeql-pack.release.yml
index 576395f3405e..675185672974 100644
--- a/go/ql/src/codeql-pack.release.yml
+++ b/go/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.7.9
+lastReleaseVersion: 0.7.10
diff --git a/go/ql/src/qlpack.yml b/go/ql/src/qlpack.yml
index d91cab596127..4ded3a52f63e 100644
--- a/go/ql/src/qlpack.yml
+++ b/go/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-queries
-version: 0.7.10-dev
+version: 0.7.10
groups:
- go
- queries
diff --git a/java/ql/automodel/src/CHANGELOG.md b/java/ql/automodel/src/CHANGELOG.md
index 4a3c54adb385..c3282c773a9d 100644
--- a/java/ql/automodel/src/CHANGELOG.md
+++ b/java/ql/automodel/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.0.17
+
+No user-facing changes.
+
## 0.0.16
No user-facing changes.
diff --git a/java/ql/automodel/src/change-notes/released/0.0.17.md b/java/ql/automodel/src/change-notes/released/0.0.17.md
new file mode 100644
index 000000000000..62cc89030a62
--- /dev/null
+++ b/java/ql/automodel/src/change-notes/released/0.0.17.md
@@ -0,0 +1,3 @@
+## 0.0.17
+
+No user-facing changes.
diff --git a/java/ql/automodel/src/codeql-pack.release.yml b/java/ql/automodel/src/codeql-pack.release.yml
index a49f7be4cff3..cbc3d3cd4934 100644
--- a/java/ql/automodel/src/codeql-pack.release.yml
+++ b/java/ql/automodel/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.16
+lastReleaseVersion: 0.0.17
diff --git a/java/ql/automodel/src/qlpack.yml b/java/ql/automodel/src/qlpack.yml
index 898239be0989..59fab0cdcc53 100644
--- a/java/ql/automodel/src/qlpack.yml
+++ b/java/ql/automodel/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-automodel-queries
-version: 0.0.17-dev
+version: 0.0.17
groups:
- java
- automodel
diff --git a/java/ql/lib/CHANGELOG.md b/java/ql/lib/CHANGELOG.md
index d369cbdc9318..2a02ccee6abb 100644
--- a/java/ql/lib/CHANGELOG.md
+++ b/java/ql/lib/CHANGELOG.md
@@ -1,3 +1,14 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Java expressions with erroneous types (e.g. the result of a call whose callee couldn't be resolved during extraction) are now given a CodeQL `ErrorType` more often.
+
+### Bug Fixes
+
+* Fixed the Java autobuilder overriding the version of Maven used by a project when the Maven wrapper `mvnw` is in use and the `maven-wrapper.jar` file is not present in the repository.
+* Some flow steps related to `android.text.Editable.toString` that were accidentally disabled have been re-enabled.
+
## 0.8.9
### Deprecated APIs
diff --git a/java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md b/java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md
deleted file mode 100644
index eb560fba07da..000000000000
--- a/java/ql/lib/change-notes/2024-02-23-widget-flowsteps.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: fix
----
-* Some flow steps related to `android.text.Editable.toString` that were accidentally disabled have been re-enabled.
diff --git a/java/ql/lib/change-notes/2024-02-27-error-types.md b/java/ql/lib/change-notes/2024-02-27-error-types.md
deleted file mode 100644
index cdc6d7620aa8..000000000000
--- a/java/ql/lib/change-notes/2024-02-27-error-types.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Java expressions with erroneous types (e.g. the result of a call whose callee couldn't be resolved during extraction) are now given a CodeQL `ErrorType` more often.
diff --git a/java/ql/lib/change-notes/2024-02-27-mvnw-versions.md b/java/ql/lib/change-notes/2024-02-27-mvnw-versions.md
deleted file mode 100644
index a0227088ae97..000000000000
--- a/java/ql/lib/change-notes/2024-02-27-mvnw-versions.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: fix
----
-* Fixed the Java autobuilder overriding the version of Maven used by a project when the Maven wrapper `mvnw` is in use and the `maven-wrapper.jar` file is not present in the repository.
diff --git a/java/ql/lib/change-notes/released/0.8.10.md b/java/ql/lib/change-notes/released/0.8.10.md
new file mode 100644
index 000000000000..b45f14bf347a
--- /dev/null
+++ b/java/ql/lib/change-notes/released/0.8.10.md
@@ -0,0 +1,10 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Java expressions with erroneous types (e.g. the result of a call whose callee couldn't be resolved during extraction) are now given a CodeQL `ErrorType` more often.
+
+### Bug Fixes
+
+* Fixed the Java autobuilder overriding the version of Maven used by a project when the Maven wrapper `mvnw` is in use and the `maven-wrapper.jar` file is not present in the repository.
+* Some flow steps related to `android.text.Editable.toString` that were accidentally disabled have been re-enabled.
diff --git a/java/ql/lib/codeql-pack.release.yml b/java/ql/lib/codeql-pack.release.yml
index 5290c29b7fe7..0521f0f75fad 100644
--- a/java/ql/lib/codeql-pack.release.yml
+++ b/java/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/java/ql/lib/qlpack.yml b/java/ql/lib/qlpack.yml
index 15b4982d41eb..428eedc75e3d 100644
--- a/java/ql/lib/qlpack.yml
+++ b/java/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-all
-version: 0.8.10-dev
+version: 0.8.10
groups: java
dbscheme: config/semmlecode.dbscheme
extractor: java
diff --git a/java/ql/src/CHANGELOG.md b/java/ql/src/CHANGELOG.md
index 5d8353514538..c61275f5ed84 100644
--- a/java/ql/src/CHANGELOG.md
+++ b/java/ql/src/CHANGELOG.md
@@ -1,3 +1,13 @@
+## 0.8.10
+
+### New Queries
+
+* Added a new query `java/android/insecure-local-key-gen` for finding instances of keys generated for biometric authentication in an insecure way.
+
+### Minor Analysis Improvements
+
+* To reduce the number of false positives in the query "Insertion of sensitive information into log files" (`java/sensitive-log`), variables with names that contain "null" (case-insensitively) are no longer considered sources of sensitive information.
+
## 0.8.9
### New Queries
diff --git a/java/ql/src/change-notes/2024-02-12-android-insecure-keys.md b/java/ql/src/change-notes/2024-02-12-android-insecure-keys.md
deleted file mode 100644
index 1de077277962..000000000000
--- a/java/ql/src/change-notes/2024-02-12-android-insecure-keys.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: newQuery
----
-* Added a new query `java/android/insecure-local-key-gen` for finding instances of keys generated for biometric authentication in an insecure way.
\ No newline at end of file
diff --git a/java/ql/src/change-notes/2024-03-04-sensitive-log-remove-null-from-sources.md b/java/ql/src/change-notes/released/0.8.10.md
similarity index 54%
rename from java/ql/src/change-notes/2024-03-04-sensitive-log-remove-null-from-sources.md
rename to java/ql/src/change-notes/released/0.8.10.md
index 0bb4f18f2bd9..c5d18ae33794 100644
--- a/java/ql/src/change-notes/2024-03-04-sensitive-log-remove-null-from-sources.md
+++ b/java/ql/src/change-notes/released/0.8.10.md
@@ -1,4 +1,9 @@
----
-category: minorAnalysis
----
+## 0.8.10
+
+### New Queries
+
+* Added a new query `java/android/insecure-local-key-gen` for finding instances of keys generated for biometric authentication in an insecure way.
+
+### Minor Analysis Improvements
+
* To reduce the number of false positives in the query "Insertion of sensitive information into log files" (`java/sensitive-log`), variables with names that contain "null" (case-insensitively) are no longer considered sources of sensitive information.
diff --git a/java/ql/src/codeql-pack.release.yml b/java/ql/src/codeql-pack.release.yml
index 5290c29b7fe7..0521f0f75fad 100644
--- a/java/ql/src/codeql-pack.release.yml
+++ b/java/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/java/ql/src/qlpack.yml b/java/ql/src/qlpack.yml
index 8f4de528e213..ebbdbeee3b2c 100644
--- a/java/ql/src/qlpack.yml
+++ b/java/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-queries
-version: 0.8.10-dev
+version: 0.8.10
groups:
- java
- queries
diff --git a/javascript/ql/lib/CHANGELOG.md b/javascript/ql/lib/CHANGELOG.md
index 5b97ebbb22b3..d5edcc005131 100644
--- a/javascript/ql/lib/CHANGELOG.md
+++ b/javascript/ql/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.8.10
+
+No user-facing changes.
+
## 0.8.9
### Minor Analysis Improvements
diff --git a/javascript/ql/lib/change-notes/released/0.8.10.md b/javascript/ql/lib/change-notes/released/0.8.10.md
new file mode 100644
index 000000000000..777bbd2fdede
--- /dev/null
+++ b/javascript/ql/lib/change-notes/released/0.8.10.md
@@ -0,0 +1,3 @@
+## 0.8.10
+
+No user-facing changes.
diff --git a/javascript/ql/lib/codeql-pack.release.yml b/javascript/ql/lib/codeql-pack.release.yml
index 5290c29b7fe7..0521f0f75fad 100644
--- a/javascript/ql/lib/codeql-pack.release.yml
+++ b/javascript/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/javascript/ql/lib/qlpack.yml b/javascript/ql/lib/qlpack.yml
index ef3ca7521aca..da16493a21c9 100644
--- a/javascript/ql/lib/qlpack.yml
+++ b/javascript/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-all
-version: 0.8.10-dev
+version: 0.8.10
groups: javascript
dbscheme: semmlecode.javascript.dbscheme
extractor: javascript
diff --git a/javascript/ql/src/CHANGELOG.md b/javascript/ql/src/CHANGELOG.md
index 85516e3625d1..b9627cac5eee 100644
--- a/javascript/ql/src/CHANGELOG.md
+++ b/javascript/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.8.10
+
+No user-facing changes.
+
## 0.8.9
### Bug Fixes
diff --git a/javascript/ql/src/change-notes/released/0.8.10.md b/javascript/ql/src/change-notes/released/0.8.10.md
new file mode 100644
index 000000000000..777bbd2fdede
--- /dev/null
+++ b/javascript/ql/src/change-notes/released/0.8.10.md
@@ -0,0 +1,3 @@
+## 0.8.10
+
+No user-facing changes.
diff --git a/javascript/ql/src/codeql-pack.release.yml b/javascript/ql/src/codeql-pack.release.yml
index 5290c29b7fe7..0521f0f75fad 100644
--- a/javascript/ql/src/codeql-pack.release.yml
+++ b/javascript/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/javascript/ql/src/qlpack.yml b/javascript/ql/src/qlpack.yml
index b6181aa30e99..d224952c5641 100644
--- a/javascript/ql/src/qlpack.yml
+++ b/javascript/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-queries
-version: 0.8.10-dev
+version: 0.8.10
groups:
- javascript
- queries
diff --git a/misc/suite-helpers/CHANGELOG.md b/misc/suite-helpers/CHANGELOG.md
index 3c06dd69b0f5..1c4455b66c43 100644
--- a/misc/suite-helpers/CHANGELOG.md
+++ b/misc/suite-helpers/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.7.10
+
+No user-facing changes.
+
## 0.7.9
No user-facing changes.
diff --git a/misc/suite-helpers/change-notes/released/0.7.10.md b/misc/suite-helpers/change-notes/released/0.7.10.md
new file mode 100644
index 000000000000..989c5b8f6823
--- /dev/null
+++ b/misc/suite-helpers/change-notes/released/0.7.10.md
@@ -0,0 +1,3 @@
+## 0.7.10
+
+No user-facing changes.
diff --git a/misc/suite-helpers/codeql-pack.release.yml b/misc/suite-helpers/codeql-pack.release.yml
index 576395f3405e..675185672974 100644
--- a/misc/suite-helpers/codeql-pack.release.yml
+++ b/misc/suite-helpers/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.7.9
+lastReleaseVersion: 0.7.10
diff --git a/misc/suite-helpers/qlpack.yml b/misc/suite-helpers/qlpack.yml
index 49b7a6bda4c2..54d978d5efe7 100644
--- a/misc/suite-helpers/qlpack.yml
+++ b/misc/suite-helpers/qlpack.yml
@@ -1,4 +1,4 @@
name: codeql/suite-helpers
-version: 0.7.10-dev
+version: 0.7.10
groups: shared
warnOnImplicitThis: true
diff --git a/python/ql/lib/CHANGELOG.md b/python/ql/lib/CHANGELOG.md
index e6f318c51ea8..f095607ca1bf 100644
--- a/python/ql/lib/CHANGELOG.md
+++ b/python/ql/lib/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 0.11.10
+
+### Minor Analysis Improvements
+
+* Fixed missing flow for dictionary updates (`d[] = ...`) when `` is a string constant not used in dictionary literals or as name of keyword-argument.
+* Fixed flow for iterable unpacking (`a,b = my_tuple`) when it occurs on top-level (module) scope.
+
## 0.11.9
### Minor Analysis Improvements
diff --git a/python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md b/python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md
deleted file mode 100644
index 3c47c6ba866a..000000000000
--- a/python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Fixed flow for iterable unpacking (`a,b = my_tuple`) when it occurs on top-level (module) scope.
diff --git a/python/ql/lib/change-notes/2024-03-01-dict-update-content.md b/python/ql/lib/change-notes/released/0.11.10.md
similarity index 52%
rename from python/ql/lib/change-notes/2024-03-01-dict-update-content.md
rename to python/ql/lib/change-notes/released/0.11.10.md
index dfb8d247fffa..ed873724e4f2 100644
--- a/python/ql/lib/change-notes/2024-03-01-dict-update-content.md
+++ b/python/ql/lib/change-notes/released/0.11.10.md
@@ -1,4 +1,6 @@
----
-category: minorAnalysis
----
+## 0.11.10
+
+### Minor Analysis Improvements
+
* Fixed missing flow for dictionary updates (`d[] = ...`) when `` is a string constant not used in dictionary literals or as name of keyword-argument.
+* Fixed flow for iterable unpacking (`a,b = my_tuple`) when it occurs on top-level (module) scope.
diff --git a/python/ql/lib/codeql-pack.release.yml b/python/ql/lib/codeql-pack.release.yml
index b064d1778a10..ddddcbe9193d 100644
--- a/python/ql/lib/codeql-pack.release.yml
+++ b/python/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.11.9
+lastReleaseVersion: 0.11.10
diff --git a/python/ql/lib/qlpack.yml b/python/ql/lib/qlpack.yml
index e9f66e205f24..59a8b4c96d17 100644
--- a/python/ql/lib/qlpack.yml
+++ b/python/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-all
-version: 0.11.10-dev
+version: 0.11.10
groups: python
dbscheme: semmlecode.python.dbscheme
extractor: python
diff --git a/python/ql/src/CHANGELOG.md b/python/ql/src/CHANGELOG.md
index 50762bcbf34e..d4245aba7a62 100644
--- a/python/ql/src/CHANGELOG.md
+++ b/python/ql/src/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 0.9.10
+
+### New Queries
+
+* The query `py/nosql-injection` for finding NoSQL injection vulnerabilities is now part of the default security suite.
+
## 0.9.9
No user-facing changes.
diff --git a/python/ql/src/change-notes/2024-03-04-nosql-injection.md b/python/ql/src/change-notes/released/0.9.10.md
similarity index 81%
rename from python/ql/src/change-notes/2024-03-04-nosql-injection.md
rename to python/ql/src/change-notes/released/0.9.10.md
index 6e98540c757c..4cbb221b789f 100644
--- a/python/ql/src/change-notes/2024-03-04-nosql-injection.md
+++ b/python/ql/src/change-notes/released/0.9.10.md
@@ -1,4 +1,5 @@
----
-category: newQuery
----
+## 0.9.10
+
+### New Queries
+
* The query `py/nosql-injection` for finding NoSQL injection vulnerabilities is now part of the default security suite.
diff --git a/python/ql/src/codeql-pack.release.yml b/python/ql/src/codeql-pack.release.yml
index aabed7c396b7..d086ed69541d 100644
--- a/python/ql/src/codeql-pack.release.yml
+++ b/python/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.9.9
+lastReleaseVersion: 0.9.10
diff --git a/python/ql/src/qlpack.yml b/python/ql/src/qlpack.yml
index aa18f2d87074..c920f667836b 100644
--- a/python/ql/src/qlpack.yml
+++ b/python/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-queries
-version: 0.9.10-dev
+version: 0.9.10
groups:
- python
- queries
diff --git a/ruby/ql/lib/CHANGELOG.md b/ruby/ql/lib/CHANGELOG.md
index a623a151e891..c61a12e0f4ad 100644
--- a/ruby/ql/lib/CHANGELOG.md
+++ b/ruby/ql/lib/CHANGELOG.md
@@ -1,3 +1,12 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Calls to `I18n.translate` as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
+* Calls to `Arel::Nodes::SqlLiteral.new` are now modeled as instances of the `SqlConstruction` concept, as well as propagating taint from their argument.
+* Additional arguments beyond the first of calls to the `ActiveRecord` methods `select`, `reselect`, `order`, `reorder`, `joins`, `group`, and `pluck` are now recognized as sql injection sinks.
+* Calls to several methods of `ActiveRecord::Connection`, such as `ActiveRecord::Connection#exec_query`, are now recognized as SQL executions, including those via subclasses.
+
## 0.8.9
### Minor Analysis Improvements
diff --git a/ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md b/ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md
deleted file mode 100644
index c2276f284a84..000000000000
--- a/ruby/ql/lib/change-notes/2024-02-15-activerecord_connection_sql_sinks.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Calls to several methods of `ActiveRecord::Connection`, such as `ActiveRecord::Connection#exec_query`, are now recognized as SQL executions, including those via subclasses.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md b/ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md
deleted file mode 100644
index 1486c7a472d1..000000000000
--- a/ruby/ql/lib/change-notes/2024-02-20-activerecord-sql-sink-arguments.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Additional arguments beyond the first of calls to the `ActiveRecord` methods `select`, `reselect`, `order`, `reorder`, `joins`, `group`, and `pluck` are now recognized as sql injection sinks.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md b/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
deleted file mode 100644
index 6f3a90768bab..000000000000
--- a/ruby/ql/lib/change-notes/2024-02-26-arel-sqlliteral.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Calls to `Arel::Nodes::SqlLiteral.new` are now modeled as instances of the `SqlConstruction` concept, as well as propagating taint from their argument.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md b/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
deleted file mode 100644
index 350e049b5bfc..000000000000
--- a/ruby/ql/lib/change-notes/2024-02-29-i18n-translate.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Calls to `I18n.translate` as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
\ No newline at end of file
diff --git a/ruby/ql/lib/change-notes/released/0.8.10.md b/ruby/ql/lib/change-notes/released/0.8.10.md
new file mode 100644
index 000000000000..666e28f840e7
--- /dev/null
+++ b/ruby/ql/lib/change-notes/released/0.8.10.md
@@ -0,0 +1,8 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Calls to `I18n.translate` as well as Rails helper translate methods now propagate taint from their keyword arguments. The Rails translate methods are also recognized as XSS sanitizers when using keys marked as html safe.
+* Calls to `Arel::Nodes::SqlLiteral.new` are now modeled as instances of the `SqlConstruction` concept, as well as propagating taint from their argument.
+* Additional arguments beyond the first of calls to the `ActiveRecord` methods `select`, `reselect`, `order`, `reorder`, `joins`, `group`, and `pluck` are now recognized as sql injection sinks.
+* Calls to several methods of `ActiveRecord::Connection`, such as `ActiveRecord::Connection#exec_query`, are now recognized as SQL executions, including those via subclasses.
diff --git a/ruby/ql/lib/codeql-pack.release.yml b/ruby/ql/lib/codeql-pack.release.yml
index 5290c29b7fe7..0521f0f75fad 100644
--- a/ruby/ql/lib/codeql-pack.release.yml
+++ b/ruby/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/ruby/ql/lib/qlpack.yml b/ruby/ql/lib/qlpack.yml
index 7d409b83adbd..de5b41999fe1 100644
--- a/ruby/ql/lib/qlpack.yml
+++ b/ruby/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-all
-version: 0.8.10-dev
+version: 0.8.10
groups: ruby
extractor: ruby
dbscheme: ruby.dbscheme
diff --git a/ruby/ql/src/CHANGELOG.md b/ruby/ql/src/CHANGELOG.md
index 4149c728effa..f875b6d16ad4 100644
--- a/ruby/ql/src/CHANGELOG.md
+++ b/ruby/ql/src/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Calls to `Object#method`, `Object#public_method` and `Object#singleton_method` with untrusted data are now recognised as sinks for code injection.
+* Added additional request sources for Ruby on Rails.
+
## 0.8.9
No user-facing changes.
diff --git a/ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md b/ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md
deleted file mode 100644
index 84ea696dfef4..000000000000
--- a/ruby/ql/src/change-notes/2024-02-13-rails-more-request-sources.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Added additional request sources for Ruby on Rails.
\ No newline at end of file
diff --git a/ruby/ql/src/change-notes/2024-03-01-method-code-injection-sinks.md b/ruby/ql/src/change-notes/released/0.8.10.md
similarity index 51%
rename from ruby/ql/src/change-notes/2024-03-01-method-code-injection-sinks.md
rename to ruby/ql/src/change-notes/released/0.8.10.md
index 43e40d3fd536..985cdf8d22e0 100644
--- a/ruby/ql/src/change-notes/2024-03-01-method-code-injection-sinks.md
+++ b/ruby/ql/src/change-notes/released/0.8.10.md
@@ -1,4 +1,6 @@
----
-category: minorAnalysis
----
-* Calls to `Object#method`, `Object#public_method` and `Object#singleton_method` with untrusted data are now recognised as sinks for code injection.
\ No newline at end of file
+## 0.8.10
+
+### Minor Analysis Improvements
+
+* Calls to `Object#method`, `Object#public_method` and `Object#singleton_method` with untrusted data are now recognised as sinks for code injection.
+* Added additional request sources for Ruby on Rails.
diff --git a/ruby/ql/src/codeql-pack.release.yml b/ruby/ql/src/codeql-pack.release.yml
index 5290c29b7fe7..0521f0f75fad 100644
--- a/ruby/ql/src/codeql-pack.release.yml
+++ b/ruby/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.8.9
+lastReleaseVersion: 0.8.10
diff --git a/ruby/ql/src/qlpack.yml b/ruby/ql/src/qlpack.yml
index 8af7f9fd7976..5e3792682346 100644
--- a/ruby/ql/src/qlpack.yml
+++ b/ruby/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-queries
-version: 0.8.10-dev
+version: 0.8.10
groups:
- ruby
- queries
diff --git a/shared/controlflow/CHANGELOG.md b/shared/controlflow/CHANGELOG.md
index dbfa6ef4512d..75f2ca53f987 100644
--- a/shared/controlflow/CHANGELOG.md
+++ b/shared/controlflow/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.1.10
+
+No user-facing changes.
+
## 0.1.9
No user-facing changes.
diff --git a/shared/controlflow/change-notes/released/0.1.10.md b/shared/controlflow/change-notes/released/0.1.10.md
new file mode 100644
index 000000000000..47358eeee934
--- /dev/null
+++ b/shared/controlflow/change-notes/released/0.1.10.md
@@ -0,0 +1,3 @@
+## 0.1.10
+
+No user-facing changes.
diff --git a/shared/controlflow/codeql-pack.release.yml b/shared/controlflow/codeql-pack.release.yml
index 1425c0edf7f8..30f5ca88be0e 100644
--- a/shared/controlflow/codeql-pack.release.yml
+++ b/shared/controlflow/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.1.9
+lastReleaseVersion: 0.1.10
diff --git a/shared/controlflow/qlpack.yml b/shared/controlflow/qlpack.yml
index 9d35a6782761..1d43802be421 100644
--- a/shared/controlflow/qlpack.yml
+++ b/shared/controlflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/controlflow
-version: 0.1.10-dev
+version: 0.1.10
groups: shared
library: true
dependencies:
diff --git a/shared/dataflow/CHANGELOG.md b/shared/dataflow/CHANGELOG.md
index 67a5bf589f4f..ef80788bded6 100644
--- a/shared/dataflow/CHANGELOG.md
+++ b/shared/dataflow/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.1
+
+No user-facing changes.
+
## 0.2.0
### Breaking Changes
diff --git a/shared/dataflow/change-notes/released/0.2.1.md b/shared/dataflow/change-notes/released/0.2.1.md
new file mode 100644
index 000000000000..3dbfc85fe11d
--- /dev/null
+++ b/shared/dataflow/change-notes/released/0.2.1.md
@@ -0,0 +1,3 @@
+## 0.2.1
+
+No user-facing changes.
diff --git a/shared/dataflow/codeql-pack.release.yml b/shared/dataflow/codeql-pack.release.yml
index 5274e27ed522..df29a726bccc 100644
--- a/shared/dataflow/codeql-pack.release.yml
+++ b/shared/dataflow/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.0
+lastReleaseVersion: 0.2.1
diff --git a/shared/dataflow/qlpack.yml b/shared/dataflow/qlpack.yml
index 1e7becf71c4f..ee422e02ea9a 100644
--- a/shared/dataflow/qlpack.yml
+++ b/shared/dataflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/dataflow
-version: 0.2.1-dev
+version: 0.2.1
groups: shared
library: true
dependencies:
diff --git a/shared/mad/CHANGELOG.md b/shared/mad/CHANGELOG.md
index 4d09057118ce..4730366775ea 100644
--- a/shared/mad/CHANGELOG.md
+++ b/shared/mad/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/mad/change-notes/released/0.2.10.md b/shared/mad/change-notes/released/0.2.10.md
new file mode 100644
index 000000000000..81c9722b19fe
--- /dev/null
+++ b/shared/mad/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/mad/codeql-pack.release.yml b/shared/mad/codeql-pack.release.yml
index d021cf0a6bed..a71167814cb7 100644
--- a/shared/mad/codeql-pack.release.yml
+++ b/shared/mad/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/mad/qlpack.yml b/shared/mad/qlpack.yml
index 22c8f271ccc6..6d7269ef3da8 100644
--- a/shared/mad/qlpack.yml
+++ b/shared/mad/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/mad
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
dependencies: null
diff --git a/shared/rangeanalysis/CHANGELOG.md b/shared/rangeanalysis/CHANGELOG.md
index 5b8dbcfab22c..9943dcb79727 100644
--- a/shared/rangeanalysis/CHANGELOG.md
+++ b/shared/rangeanalysis/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.0.9
+
+No user-facing changes.
+
## 0.0.8
No user-facing changes.
diff --git a/shared/rangeanalysis/change-notes/released/0.0.9.md b/shared/rangeanalysis/change-notes/released/0.0.9.md
new file mode 100644
index 000000000000..c9e17c6d6cf2
--- /dev/null
+++ b/shared/rangeanalysis/change-notes/released/0.0.9.md
@@ -0,0 +1,3 @@
+## 0.0.9
+
+No user-facing changes.
diff --git a/shared/rangeanalysis/codeql-pack.release.yml b/shared/rangeanalysis/codeql-pack.release.yml
index 58fdc6b45deb..ecdd64fbab86 100644
--- a/shared/rangeanalysis/codeql-pack.release.yml
+++ b/shared/rangeanalysis/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.8
+lastReleaseVersion: 0.0.9
diff --git a/shared/rangeanalysis/qlpack.yml b/shared/rangeanalysis/qlpack.yml
index 836fe51ee344..01db5d5734d0 100644
--- a/shared/rangeanalysis/qlpack.yml
+++ b/shared/rangeanalysis/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/rangeanalysis
-version: 0.0.9-dev
+version: 0.0.9
groups: shared
library: true
dependencies:
diff --git a/shared/regex/CHANGELOG.md b/shared/regex/CHANGELOG.md
index cd5f91f71ec1..c05869c153d3 100644
--- a/shared/regex/CHANGELOG.md
+++ b/shared/regex/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/regex/change-notes/released/0.2.10.md b/shared/regex/change-notes/released/0.2.10.md
new file mode 100644
index 000000000000..81c9722b19fe
--- /dev/null
+++ b/shared/regex/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/regex/codeql-pack.release.yml b/shared/regex/codeql-pack.release.yml
index d021cf0a6bed..a71167814cb7 100644
--- a/shared/regex/codeql-pack.release.yml
+++ b/shared/regex/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/regex/qlpack.yml b/shared/regex/qlpack.yml
index ea3f7f9b2389..0d4f485312f7 100644
--- a/shared/regex/qlpack.yml
+++ b/shared/regex/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/regex
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
dependencies:
diff --git a/shared/ssa/CHANGELOG.md b/shared/ssa/CHANGELOG.md
index 01acfae01489..a9161ff578b0 100644
--- a/shared/ssa/CHANGELOG.md
+++ b/shared/ssa/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/ssa/change-notes/released/0.2.10.md b/shared/ssa/change-notes/released/0.2.10.md
new file mode 100644
index 000000000000..81c9722b19fe
--- /dev/null
+++ b/shared/ssa/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/ssa/codeql-pack.release.yml b/shared/ssa/codeql-pack.release.yml
index d021cf0a6bed..a71167814cb7 100644
--- a/shared/ssa/codeql-pack.release.yml
+++ b/shared/ssa/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/ssa/qlpack.yml b/shared/ssa/qlpack.yml
index 19304ad107f1..2ad254711a50 100644
--- a/shared/ssa/qlpack.yml
+++ b/shared/ssa/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ssa
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
dependencies:
diff --git a/shared/threat-models/CHANGELOG.md b/shared/threat-models/CHANGELOG.md
index fba2a8703562..a59e560c4155 100644
--- a/shared/threat-models/CHANGELOG.md
+++ b/shared/threat-models/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.0.9
+
+No user-facing changes.
+
## 0.0.8
No user-facing changes.
diff --git a/shared/threat-models/change-notes/released/0.0.9.md b/shared/threat-models/change-notes/released/0.0.9.md
new file mode 100644
index 000000000000..c9e17c6d6cf2
--- /dev/null
+++ b/shared/threat-models/change-notes/released/0.0.9.md
@@ -0,0 +1,3 @@
+## 0.0.9
+
+No user-facing changes.
diff --git a/shared/threat-models/codeql-pack.release.yml b/shared/threat-models/codeql-pack.release.yml
index 58fdc6b45deb..ecdd64fbab86 100644
--- a/shared/threat-models/codeql-pack.release.yml
+++ b/shared/threat-models/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.8
+lastReleaseVersion: 0.0.9
diff --git a/shared/threat-models/qlpack.yml b/shared/threat-models/qlpack.yml
index d0ed9a913b21..60cbbc56fcb3 100644
--- a/shared/threat-models/qlpack.yml
+++ b/shared/threat-models/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/threat-models
-version: 0.0.9-dev
+version: 0.0.9
library: true
groups: shared
dataExtensions:
diff --git a/shared/tutorial/CHANGELOG.md b/shared/tutorial/CHANGELOG.md
index 1db3a01af0b1..560ad058d5b3 100644
--- a/shared/tutorial/CHANGELOG.md
+++ b/shared/tutorial/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/tutorial/change-notes/released/0.2.10.md b/shared/tutorial/change-notes/released/0.2.10.md
new file mode 100644
index 000000000000..81c9722b19fe
--- /dev/null
+++ b/shared/tutorial/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/tutorial/codeql-pack.release.yml b/shared/tutorial/codeql-pack.release.yml
index d021cf0a6bed..a71167814cb7 100644
--- a/shared/tutorial/codeql-pack.release.yml
+++ b/shared/tutorial/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/tutorial/qlpack.yml b/shared/tutorial/qlpack.yml
index b595ae9ee70a..69116705c1bf 100644
--- a/shared/tutorial/qlpack.yml
+++ b/shared/tutorial/qlpack.yml
@@ -1,7 +1,7 @@
name: codeql/tutorial
description: Library for the CodeQL detective tutorials, helping new users learn to
write CodeQL queries.
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/typetracking/CHANGELOG.md b/shared/typetracking/CHANGELOG.md
index afc857bc6bce..350f9ecbeae0 100644
--- a/shared/typetracking/CHANGELOG.md
+++ b/shared/typetracking/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/typetracking/change-notes/released/0.2.10.md b/shared/typetracking/change-notes/released/0.2.10.md
new file mode 100644
index 000000000000..81c9722b19fe
--- /dev/null
+++ b/shared/typetracking/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/typetracking/codeql-pack.release.yml b/shared/typetracking/codeql-pack.release.yml
index d021cf0a6bed..a71167814cb7 100644
--- a/shared/typetracking/codeql-pack.release.yml
+++ b/shared/typetracking/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/typetracking/qlpack.yml b/shared/typetracking/qlpack.yml
index b55927f59bb7..fbbdcf5162a1 100644
--- a/shared/typetracking/qlpack.yml
+++ b/shared/typetracking/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typetracking
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
dependencies:
diff --git a/shared/typos/CHANGELOG.md b/shared/typos/CHANGELOG.md
index 66c5871d9821..54b1eaa4d589 100644
--- a/shared/typos/CHANGELOG.md
+++ b/shared/typos/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/typos/change-notes/released/0.2.10.md b/shared/typos/change-notes/released/0.2.10.md
new file mode 100644
index 000000000000..81c9722b19fe
--- /dev/null
+++ b/shared/typos/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/typos/codeql-pack.release.yml b/shared/typos/codeql-pack.release.yml
index d021cf0a6bed..a71167814cb7 100644
--- a/shared/typos/codeql-pack.release.yml
+++ b/shared/typos/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/typos/qlpack.yml b/shared/typos/qlpack.yml
index 644bfe11bff7..4d59d9b3c342 100644
--- a/shared/typos/qlpack.yml
+++ b/shared/typos/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typos
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/util/CHANGELOG.md b/shared/util/CHANGELOG.md
index 63832e927fa5..1ca1f71bcbc2 100644
--- a/shared/util/CHANGELOG.md
+++ b/shared/util/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/util/change-notes/released/0.2.10.md b/shared/util/change-notes/released/0.2.10.md
new file mode 100644
index 000000000000..81c9722b19fe
--- /dev/null
+++ b/shared/util/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/util/codeql-pack.release.yml b/shared/util/codeql-pack.release.yml
index d021cf0a6bed..a71167814cb7 100644
--- a/shared/util/codeql-pack.release.yml
+++ b/shared/util/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/util/qlpack.yml b/shared/util/qlpack.yml
index ca1a866a53d4..28ed738a93dd 100644
--- a/shared/util/qlpack.yml
+++ b/shared/util/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/util
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
dependencies: null
diff --git a/shared/yaml/CHANGELOG.md b/shared/yaml/CHANGELOG.md
index e5495abcd503..9fd5ebc26ab2 100644
--- a/shared/yaml/CHANGELOG.md
+++ b/shared/yaml/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.10
+
+No user-facing changes.
+
## 0.2.9
No user-facing changes.
diff --git a/shared/yaml/change-notes/released/0.2.10.md b/shared/yaml/change-notes/released/0.2.10.md
new file mode 100644
index 000000000000..81c9722b19fe
--- /dev/null
+++ b/shared/yaml/change-notes/released/0.2.10.md
@@ -0,0 +1,3 @@
+## 0.2.10
+
+No user-facing changes.
diff --git a/shared/yaml/codeql-pack.release.yml b/shared/yaml/codeql-pack.release.yml
index d021cf0a6bed..a71167814cb7 100644
--- a/shared/yaml/codeql-pack.release.yml
+++ b/shared/yaml/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.9
+lastReleaseVersion: 0.2.10
diff --git a/shared/yaml/qlpack.yml b/shared/yaml/qlpack.yml
index de5b47e120ae..9643ffcec66b 100644
--- a/shared/yaml/qlpack.yml
+++ b/shared/yaml/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/yaml
-version: 0.2.10-dev
+version: 0.2.10
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/swift/ql/lib/CHANGELOG.md b/swift/ql/lib/CHANGELOG.md
index e88cd0259ccf..8f14bfcedc9c 100644
--- a/swift/ql/lib/CHANGELOG.md
+++ b/swift/ql/lib/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 0.3.10
+
+### Bug Fixes
+
+* Fixed an issue where `TypeDecl.getFullName` would get stuck in an loop and fail when minor database inconsistencies are present.
+
## 0.3.9
### Minor Analysis Improvements
diff --git a/swift/ql/lib/change-notes/2024-02-22-extension-patch.md b/swift/ql/lib/change-notes/released/0.3.10.md
similarity index 83%
rename from swift/ql/lib/change-notes/2024-02-22-extension-patch.md
rename to swift/ql/lib/change-notes/released/0.3.10.md
index 7bd78f3b785c..9d6286ff58a7 100644
--- a/swift/ql/lib/change-notes/2024-02-22-extension-patch.md
+++ b/swift/ql/lib/change-notes/released/0.3.10.md
@@ -1,4 +1,5 @@
----
-category: fix
----
+## 0.3.10
+
+### Bug Fixes
+
* Fixed an issue where `TypeDecl.getFullName` would get stuck in an loop and fail when minor database inconsistencies are present.
diff --git a/swift/ql/lib/codeql-pack.release.yml b/swift/ql/lib/codeql-pack.release.yml
index 3fa5180bcb49..76ca0ac8ba76 100644
--- a/swift/ql/lib/codeql-pack.release.yml
+++ b/swift/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.3.9
+lastReleaseVersion: 0.3.10
diff --git a/swift/ql/lib/qlpack.yml b/swift/ql/lib/qlpack.yml
index a37a4cb3d580..70ec4798ea85 100644
--- a/swift/ql/lib/qlpack.yml
+++ b/swift/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-all
-version: 0.3.10-dev
+version: 0.3.10
groups: swift
extractor: swift
dbscheme: swift.dbscheme
diff --git a/swift/ql/src/CHANGELOG.md b/swift/ql/src/CHANGELOG.md
index 96615d069729..bda9834c9bca 100644
--- a/swift/ql/src/CHANGELOG.md
+++ b/swift/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.3.10
+
+No user-facing changes.
+
## 0.3.9
### New Queries
diff --git a/swift/ql/src/change-notes/released/0.3.10.md b/swift/ql/src/change-notes/released/0.3.10.md
new file mode 100644
index 000000000000..925a48fc52e0
--- /dev/null
+++ b/swift/ql/src/change-notes/released/0.3.10.md
@@ -0,0 +1,3 @@
+## 0.3.10
+
+No user-facing changes.
diff --git a/swift/ql/src/codeql-pack.release.yml b/swift/ql/src/codeql-pack.release.yml
index 3fa5180bcb49..76ca0ac8ba76 100644
--- a/swift/ql/src/codeql-pack.release.yml
+++ b/swift/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.3.9
+lastReleaseVersion: 0.3.10
diff --git a/swift/ql/src/qlpack.yml b/swift/ql/src/qlpack.yml
index e3ead42c98bf..ba66b065529b 100644
--- a/swift/ql/src/qlpack.yml
+++ b/swift/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-queries
-version: 0.3.10-dev
+version: 0.3.10
groups:
- swift
- queries
From dc9092c9ec2cdda8188e9e44d8d51d2a0c6b6cc9 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
Date: Wed, 6 Mar 2024 22:19:33 +0000
Subject: [PATCH 070/731] Post-release preparation for codeql-cli-2.16.4
---
cpp/ql/lib/qlpack.yml | 2 +-
cpp/ql/src/qlpack.yml | 2 +-
csharp/ql/campaigns/Solorigate/lib/qlpack.yml | 2 +-
csharp/ql/campaigns/Solorigate/src/qlpack.yml | 2 +-
csharp/ql/lib/qlpack.yml | 2 +-
csharp/ql/src/qlpack.yml | 2 +-
go/ql/consistency-queries/qlpack.yml | 2 +-
go/ql/lib/qlpack.yml | 2 +-
go/ql/src/qlpack.yml | 2 +-
java/ql/automodel/src/qlpack.yml | 2 +-
java/ql/lib/qlpack.yml | 2 +-
java/ql/src/qlpack.yml | 2 +-
javascript/ql/lib/qlpack.yml | 2 +-
javascript/ql/src/qlpack.yml | 2 +-
misc/suite-helpers/qlpack.yml | 2 +-
python/ql/lib/qlpack.yml | 2 +-
python/ql/src/qlpack.yml | 2 +-
ruby/ql/lib/qlpack.yml | 2 +-
ruby/ql/src/qlpack.yml | 2 +-
shared/controlflow/qlpack.yml | 2 +-
shared/dataflow/qlpack.yml | 2 +-
shared/mad/qlpack.yml | 2 +-
shared/rangeanalysis/qlpack.yml | 2 +-
shared/regex/qlpack.yml | 2 +-
shared/ssa/qlpack.yml | 2 +-
shared/threat-models/qlpack.yml | 2 +-
shared/tutorial/qlpack.yml | 2 +-
shared/typetracking/qlpack.yml | 2 +-
shared/typos/qlpack.yml | 2 +-
shared/util/qlpack.yml | 2 +-
shared/yaml/qlpack.yml | 2 +-
swift/ql/lib/qlpack.yml | 2 +-
swift/ql/src/qlpack.yml | 2 +-
33 files changed, 33 insertions(+), 33 deletions(-)
diff --git a/cpp/ql/lib/qlpack.yml b/cpp/ql/lib/qlpack.yml
index 3bb9229bf94d..8b17a050d82a 100644
--- a/cpp/ql/lib/qlpack.yml
+++ b/cpp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-all
-version: 0.12.7
+version: 0.12.8-dev
groups: cpp
dbscheme: semmlecode.cpp.dbscheme
extractor: cpp
diff --git a/cpp/ql/src/qlpack.yml b/cpp/ql/src/qlpack.yml
index 4052647bb97f..49eb255cc8f7 100644
--- a/cpp/ql/src/qlpack.yml
+++ b/cpp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-queries
-version: 0.9.6
+version: 0.9.7-dev
groups:
- cpp
- queries
diff --git a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
index ee993bed0c91..3e8792bce0ec 100644
--- a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-all
-version: 1.7.10
+version: 1.7.11-dev
groups:
- csharp
- solorigate
diff --git a/csharp/ql/campaigns/Solorigate/src/qlpack.yml b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
index 1f421754fc82..c67ab9130a0e 100644
--- a/csharp/ql/campaigns/Solorigate/src/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-queries
-version: 1.7.10
+version: 1.7.11-dev
groups:
- csharp
- solorigate
diff --git a/csharp/ql/lib/qlpack.yml b/csharp/ql/lib/qlpack.yml
index 93c5c1120a24..a67b40f744f1 100644
--- a/csharp/ql/lib/qlpack.yml
+++ b/csharp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-all
-version: 0.8.10
+version: 0.8.11-dev
groups: csharp
dbscheme: semmlecode.csharp.dbscheme
extractor: csharp
diff --git a/csharp/ql/src/qlpack.yml b/csharp/ql/src/qlpack.yml
index 46384094b19e..a2148a361570 100644
--- a/csharp/ql/src/qlpack.yml
+++ b/csharp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-queries
-version: 0.8.10
+version: 0.8.11-dev
groups:
- csharp
- queries
diff --git a/go/ql/consistency-queries/qlpack.yml b/go/ql/consistency-queries/qlpack.yml
index d5a2fbee5f19..e82c98f52cb3 100644
--- a/go/ql/consistency-queries/qlpack.yml
+++ b/go/ql/consistency-queries/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql-go-consistency-queries
-version: 0.0.9
+version: 0.0.10-dev
groups:
- go
- queries
diff --git a/go/ql/lib/qlpack.yml b/go/ql/lib/qlpack.yml
index 8cc190fa880a..54b284e7ee58 100644
--- a/go/ql/lib/qlpack.yml
+++ b/go/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-all
-version: 0.7.10
+version: 0.7.11-dev
groups: go
dbscheme: go.dbscheme
extractor: go
diff --git a/go/ql/src/qlpack.yml b/go/ql/src/qlpack.yml
index 4ded3a52f63e..c89aacb8aa22 100644
--- a/go/ql/src/qlpack.yml
+++ b/go/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-queries
-version: 0.7.10
+version: 0.7.11-dev
groups:
- go
- queries
diff --git a/java/ql/automodel/src/qlpack.yml b/java/ql/automodel/src/qlpack.yml
index 59fab0cdcc53..8064163f5ccc 100644
--- a/java/ql/automodel/src/qlpack.yml
+++ b/java/ql/automodel/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-automodel-queries
-version: 0.0.17
+version: 0.0.18-dev
groups:
- java
- automodel
diff --git a/java/ql/lib/qlpack.yml b/java/ql/lib/qlpack.yml
index 428eedc75e3d..ed83a620d20a 100644
--- a/java/ql/lib/qlpack.yml
+++ b/java/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-all
-version: 0.8.10
+version: 0.8.11-dev
groups: java
dbscheme: config/semmlecode.dbscheme
extractor: java
diff --git a/java/ql/src/qlpack.yml b/java/ql/src/qlpack.yml
index ebbdbeee3b2c..d7612d9da676 100644
--- a/java/ql/src/qlpack.yml
+++ b/java/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-queries
-version: 0.8.10
+version: 0.8.11-dev
groups:
- java
- queries
diff --git a/javascript/ql/lib/qlpack.yml b/javascript/ql/lib/qlpack.yml
index da16493a21c9..30fa7de41986 100644
--- a/javascript/ql/lib/qlpack.yml
+++ b/javascript/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-all
-version: 0.8.10
+version: 0.8.11-dev
groups: javascript
dbscheme: semmlecode.javascript.dbscheme
extractor: javascript
diff --git a/javascript/ql/src/qlpack.yml b/javascript/ql/src/qlpack.yml
index d224952c5641..01a3e8a0841d 100644
--- a/javascript/ql/src/qlpack.yml
+++ b/javascript/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-queries
-version: 0.8.10
+version: 0.8.11-dev
groups:
- javascript
- queries
diff --git a/misc/suite-helpers/qlpack.yml b/misc/suite-helpers/qlpack.yml
index 54d978d5efe7..5d8225b2e0b6 100644
--- a/misc/suite-helpers/qlpack.yml
+++ b/misc/suite-helpers/qlpack.yml
@@ -1,4 +1,4 @@
name: codeql/suite-helpers
-version: 0.7.10
+version: 0.7.11-dev
groups: shared
warnOnImplicitThis: true
diff --git a/python/ql/lib/qlpack.yml b/python/ql/lib/qlpack.yml
index 59a8b4c96d17..daab6a412065 100644
--- a/python/ql/lib/qlpack.yml
+++ b/python/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-all
-version: 0.11.10
+version: 0.11.11-dev
groups: python
dbscheme: semmlecode.python.dbscheme
extractor: python
diff --git a/python/ql/src/qlpack.yml b/python/ql/src/qlpack.yml
index c920f667836b..5b641a329cb2 100644
--- a/python/ql/src/qlpack.yml
+++ b/python/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-queries
-version: 0.9.10
+version: 0.9.11-dev
groups:
- python
- queries
diff --git a/ruby/ql/lib/qlpack.yml b/ruby/ql/lib/qlpack.yml
index de5b41999fe1..81695d545ec2 100644
--- a/ruby/ql/lib/qlpack.yml
+++ b/ruby/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-all
-version: 0.8.10
+version: 0.8.11-dev
groups: ruby
extractor: ruby
dbscheme: ruby.dbscheme
diff --git a/ruby/ql/src/qlpack.yml b/ruby/ql/src/qlpack.yml
index 5e3792682346..65e81bf2ba28 100644
--- a/ruby/ql/src/qlpack.yml
+++ b/ruby/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-queries
-version: 0.8.10
+version: 0.8.11-dev
groups:
- ruby
- queries
diff --git a/shared/controlflow/qlpack.yml b/shared/controlflow/qlpack.yml
index 1d43802be421..19c95747294b 100644
--- a/shared/controlflow/qlpack.yml
+++ b/shared/controlflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/controlflow
-version: 0.1.10
+version: 0.1.11-dev
groups: shared
library: true
dependencies:
diff --git a/shared/dataflow/qlpack.yml b/shared/dataflow/qlpack.yml
index ee422e02ea9a..4e896e9ae020 100644
--- a/shared/dataflow/qlpack.yml
+++ b/shared/dataflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/dataflow
-version: 0.2.1
+version: 0.2.2-dev
groups: shared
library: true
dependencies:
diff --git a/shared/mad/qlpack.yml b/shared/mad/qlpack.yml
index 6d7269ef3da8..e3d2ccaf7483 100644
--- a/shared/mad/qlpack.yml
+++ b/shared/mad/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/mad
-version: 0.2.10
+version: 0.2.11-dev
groups: shared
library: true
dependencies: null
diff --git a/shared/rangeanalysis/qlpack.yml b/shared/rangeanalysis/qlpack.yml
index 01db5d5734d0..6a528c17637e 100644
--- a/shared/rangeanalysis/qlpack.yml
+++ b/shared/rangeanalysis/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/rangeanalysis
-version: 0.0.9
+version: 0.0.10-dev
groups: shared
library: true
dependencies:
diff --git a/shared/regex/qlpack.yml b/shared/regex/qlpack.yml
index 0d4f485312f7..8717c5b8a730 100644
--- a/shared/regex/qlpack.yml
+++ b/shared/regex/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/regex
-version: 0.2.10
+version: 0.2.11-dev
groups: shared
library: true
dependencies:
diff --git a/shared/ssa/qlpack.yml b/shared/ssa/qlpack.yml
index 2ad254711a50..656662e9061e 100644
--- a/shared/ssa/qlpack.yml
+++ b/shared/ssa/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ssa
-version: 0.2.10
+version: 0.2.11-dev
groups: shared
library: true
dependencies:
diff --git a/shared/threat-models/qlpack.yml b/shared/threat-models/qlpack.yml
index 60cbbc56fcb3..ece8f74f701c 100644
--- a/shared/threat-models/qlpack.yml
+++ b/shared/threat-models/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/threat-models
-version: 0.0.9
+version: 0.0.10-dev
library: true
groups: shared
dataExtensions:
diff --git a/shared/tutorial/qlpack.yml b/shared/tutorial/qlpack.yml
index 69116705c1bf..b1f2b729a851 100644
--- a/shared/tutorial/qlpack.yml
+++ b/shared/tutorial/qlpack.yml
@@ -1,7 +1,7 @@
name: codeql/tutorial
description: Library for the CodeQL detective tutorials, helping new users learn to
write CodeQL queries.
-version: 0.2.10
+version: 0.2.11-dev
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/typetracking/qlpack.yml b/shared/typetracking/qlpack.yml
index fbbdcf5162a1..efca17020697 100644
--- a/shared/typetracking/qlpack.yml
+++ b/shared/typetracking/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typetracking
-version: 0.2.10
+version: 0.2.11-dev
groups: shared
library: true
dependencies:
diff --git a/shared/typos/qlpack.yml b/shared/typos/qlpack.yml
index 4d59d9b3c342..76434dcb21cd 100644
--- a/shared/typos/qlpack.yml
+++ b/shared/typos/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typos
-version: 0.2.10
+version: 0.2.11-dev
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/util/qlpack.yml b/shared/util/qlpack.yml
index 28ed738a93dd..f4d51c896ce6 100644
--- a/shared/util/qlpack.yml
+++ b/shared/util/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/util
-version: 0.2.10
+version: 0.2.11-dev
groups: shared
library: true
dependencies: null
diff --git a/shared/yaml/qlpack.yml b/shared/yaml/qlpack.yml
index 9643ffcec66b..41f2bc851fd8 100644
--- a/shared/yaml/qlpack.yml
+++ b/shared/yaml/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/yaml
-version: 0.2.10
+version: 0.2.11-dev
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/swift/ql/lib/qlpack.yml b/swift/ql/lib/qlpack.yml
index 70ec4798ea85..673004b5172b 100644
--- a/swift/ql/lib/qlpack.yml
+++ b/swift/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-all
-version: 0.3.10
+version: 0.3.11-dev
groups: swift
extractor: swift
dbscheme: swift.dbscheme
diff --git a/swift/ql/src/qlpack.yml b/swift/ql/src/qlpack.yml
index ba66b065529b..11192f11d8b8 100644
--- a/swift/ql/src/qlpack.yml
+++ b/swift/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-queries
-version: 0.3.10
+version: 0.3.11-dev
groups:
- swift
- queries
From a60afef9233bb7e993be3915b2e2c7823036e689 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Wed, 6 Mar 2024 16:37:04 -0800
Subject: [PATCH 071/731] C++: Add a local flow test file for IR dataflow.
---
.../dataflow-tests/localFlow-ir.expected | 160 ++++++++++++++++++
.../dataflow/dataflow-tests/localFlow-ir.ql | 8 +
2 files changed, 168 insertions(+)
create mode 100644 cpp/ql/test/library-tests/dataflow/dataflow-tests/localFlow-ir.expected
create mode 100644 cpp/ql/test/library-tests/dataflow/dataflow-tests/localFlow-ir.ql
diff --git a/cpp/ql/test/library-tests/dataflow/dataflow-tests/localFlow-ir.expected b/cpp/ql/test/library-tests/dataflow/dataflow-tests/localFlow-ir.expected
new file mode 100644
index 000000000000..1fa924a11ce2
--- /dev/null
+++ b/cpp/ql/test/library-tests/dataflow/dataflow-tests/localFlow-ir.expected
@@ -0,0 +1,160 @@
+| example.c:15:37:15:37 | **b | example.c:15:37:15:37 | **b |
+| example.c:15:37:15:37 | **b | example.c:15:37:15:37 | **b |
+| example.c:15:37:15:37 | **b | example.c:15:37:15:37 | *b |
+| example.c:15:37:15:37 | **b | example.c:19:6:19:6 | *b |
+| example.c:15:37:15:37 | *b | example.c:15:37:15:37 | **b |
+| example.c:15:37:15:37 | *b | example.c:15:37:15:37 | *b |
+| example.c:15:37:15:37 | *b | example.c:15:37:15:37 | *b |
+| example.c:15:37:15:37 | *b | example.c:15:37:15:37 | b |
+| example.c:15:37:15:37 | *b | example.c:19:6:19:6 | b |
+| example.c:15:37:15:37 | b | example.c:15:37:15:37 | *b |
+| example.c:15:37:15:37 | b | example.c:15:37:15:37 | b |
+| example.c:15:37:15:37 | b | example.c:15:37:15:37 | b |
+| example.c:15:44:15:46 | pos | example.c:24:24:24:26 | pos |
+| example.c:17:11:17:16 | *definition of coords | example.c:17:11:17:16 | *definition of coords |
+| example.c:17:11:17:16 | *definition of coords | example.c:17:11:17:16 | *definition of coords |
+| example.c:17:11:17:16 | *definition of coords | example.c:17:11:17:16 | *definition of coords |
+| example.c:17:11:17:16 | *definition of coords | example.c:17:11:17:16 | *definition of coords |
+| example.c:17:11:17:16 | *definition of coords | example.c:24:13:24:18 | *coords |
+| example.c:17:11:17:16 | *definition of coords [post update] | example.c:17:11:17:16 | *definition of coords |
+| example.c:17:11:17:16 | *definition of coords [post update] | example.c:24:13:24:18 | *coords |
+| example.c:17:11:17:16 | definition of coords | example.c:17:11:17:16 | *definition of coords |
+| example.c:17:11:17:16 | definition of coords | example.c:17:11:17:16 | definition of coords |
+| example.c:17:11:17:16 | definition of coords | example.c:17:11:17:16 | definition of coords |
+| example.c:17:11:17:16 | definition of coords | example.c:17:11:17:16 | definition of coords |
+| example.c:17:19:17:22 | {...} | example.c:17:19:17:22 | {...} |
+| example.c:17:21:17:21 | 0 | example.c:17:21:17:21 | 0 |
+| example.c:19:6:19:6 | *b | example.c:15:37:15:37 | *b |
+| example.c:19:6:19:6 | *b [post update] | example.c:15:37:15:37 | *b |
+| example.c:19:6:19:6 | *b [post update] | example.c:19:6:19:6 | *b |
+| example.c:19:6:19:6 | b [post update] | example.c:19:6:19:6 | b |
+| example.c:24:2:24:7 | *coords | example.c:26:18:26:24 | *& ... |
+| example.c:24:2:24:7 | *coords [post update] | example.c:26:18:26:24 | *& ... |
+| example.c:24:13:24:18 | *coords | example.c:24:2:24:7 | *coords |
+| example.c:24:13:24:18 | *coords [post update] | example.c:24:2:24:7 | *coords |
+| example.c:24:13:24:30 | ... = ... | example.c:24:2:24:30 | ... = ... |
+| example.c:24:20:24:20 | *y | example.c:24:20:24:20 | *y |
+| example.c:24:20:24:20 | y | example.c:24:20:24:20 | y |
+| example.c:24:20:24:20 | y | example.c:24:20:24:20 | y |
+| example.c:24:24:24:26 | pos | example.c:28:14:28:25 | *& ... |
+| example.c:24:24:24:30 | ... + ... | example.c:24:13:24:30 | ... = ... |
+| example.c:26:13:26:16 | call to getX | example.c:26:2:26:25 | ... = ... |
+| example.c:26:18:26:24 | *& ... | example.c:26:2:26:7 | *coords |
+| example.c:26:18:26:24 | getX output argument | example.c:26:2:26:7 | *coords |
+| example.c:26:19:26:24 | *coords | example.c:26:18:26:24 | *& ... |
+| example.c:26:19:26:24 | coords | example.c:26:18:26:24 | & ... |
+| example.c:28:22:28:25 | & ... | example.c:28:14:28:25 | & ... |
+| example.c:28:22:28:25 | *& ... | example.c:28:14:28:25 | *& ... |
+| example.c:28:23:28:25 | *pos | example.c:28:22:28:25 | *& ... |
+| example.c:28:23:28:25 | pos | example.c:28:22:28:25 | & ... |
+| test.cpp:6:12:6:17 | call to source | test.cpp:6:12:6:17 | call to source |
+| test.cpp:6:12:6:17 | call to source | test.cpp:7:8:7:9 | t1 |
+| test.cpp:7:8:7:9 | t1 | test.cpp:8:8:8:9 | t1 |
+| test.cpp:8:3:8:9 | ... = ... | test.cpp:10:8:10:9 | t2 |
+| test.cpp:8:8:8:9 | t1 | test.cpp:8:3:8:9 | ... = ... |
+| test.cpp:8:8:8:9 | t1 | test.cpp:9:8:9:9 | t1 |
+| test.cpp:9:8:9:9 | t1 | test.cpp:11:7:11:8 | t1 |
+| test.cpp:10:8:10:9 | t2 | test.cpp:15:3:15:6 | Phi |
+| test.cpp:12:5:12:10 | ... = ... | test.cpp:13:10:13:11 | t2 |
+| test.cpp:12:10:12:10 | 0 | test.cpp:12:5:12:10 | ... = ... |
+| test.cpp:13:10:13:11 | t2 | test.cpp:15:3:15:6 | Phi |
+| test.cpp:15:3:15:6 | Phi | test.cpp:15:8:15:9 | t2 |
+| test.cpp:15:3:15:6 | Phi | test.cpp:15:8:15:9 | t2 |
+| test.cpp:15:8:15:9 | t2 | test.cpp:23:19:23:19 | Phi |
+| test.cpp:15:8:15:9 | t2 | test.cpp:23:19:23:19 | Phi |
+| test.cpp:17:3:17:8 | ... = ... | test.cpp:21:8:21:9 | t1 |
+| test.cpp:17:8:17:8 | 0 | test.cpp:17:3:17:8 | ... = ... |
+| test.cpp:21:8:21:9 | t1 | test.cpp:23:19:23:19 | Phi |
+| test.cpp:23:15:23:16 | 0 | test.cpp:23:15:23:16 | 0 |
+| test.cpp:23:15:23:16 | 0 | test.cpp:23:19:23:19 | Phi |
+| test.cpp:23:19:23:19 | Phi | test.cpp:23:19:23:19 | i |
+| test.cpp:23:19:23:19 | Phi | test.cpp:23:19:23:19 | i |
+| test.cpp:23:19:23:19 | Phi | test.cpp:23:23:23:24 | t1 |
+| test.cpp:23:19:23:19 | Phi | test.cpp:23:23:23:24 | t1 |
+| test.cpp:23:19:23:19 | Phi | test.cpp:24:10:24:11 | t2 |
+| test.cpp:23:19:23:19 | Phi | test.cpp:24:10:24:11 | t2 |
+| test.cpp:23:19:23:19 | i | test.cpp:23:27:23:27 | i |
+| test.cpp:23:19:23:19 | i | test.cpp:23:27:23:27 | i |
+| test.cpp:23:23:23:24 | t1 | test.cpp:23:19:23:19 | Phi |
+| test.cpp:23:23:23:24 | t1 | test.cpp:26:8:26:9 | t1 |
+| test.cpp:23:23:23:24 | t1 | test.cpp:26:8:26:9 | t1 |
+| test.cpp:23:27:23:27 | *i | test.cpp:23:27:23:27 | *i |
+| test.cpp:23:27:23:27 | *i | test.cpp:23:27:23:27 | i |
+| test.cpp:23:27:23:27 | i | test.cpp:23:19:23:19 | Phi |
+| test.cpp:23:27:23:27 | i | test.cpp:23:27:23:27 | i |
+| test.cpp:23:27:23:27 | i | test.cpp:23:27:23:27 | i |
+| test.cpp:23:27:23:29 | ... ++ | test.cpp:23:19:23:19 | Phi |
+| test.cpp:23:27:23:29 | ... ++ | test.cpp:23:27:23:29 | ... ++ |
+| test.cpp:24:5:24:11 | ... = ... | test.cpp:23:19:23:19 | Phi |
+| test.cpp:24:10:24:11 | t2 | test.cpp:23:19:23:19 | Phi |
+| test.cpp:24:10:24:11 | t2 | test.cpp:23:19:23:19 | Phi |
+| test.cpp:24:10:24:11 | t2 | test.cpp:24:5:24:11 | ... = ... |
+| test.cpp:382:48:382:54 | source1 | test.cpp:384:16:384:23 | *& ... |
+| test.cpp:383:12:383:13 | 0 | test.cpp:383:12:383:13 | 0 |
+| test.cpp:383:12:383:13 | 0 | test.cpp:384:10:384:13 | *& ... |
+| test.cpp:384:10:384:13 | & ... | test.cpp:384:3:384:8 | call to memcpy |
+| test.cpp:384:10:384:13 | & ... | test.cpp:384:10:384:13 | & ... |
+| test.cpp:384:10:384:13 | *& ... | test.cpp:384:10:384:13 | *& ... |
+| test.cpp:384:10:384:13 | memcpy output argument | test.cpp:385:8:385:10 | tmp |
+| test.cpp:384:11:384:13 | *tmp | test.cpp:384:10:384:13 | *& ... |
+| test.cpp:384:11:384:13 | tmp | test.cpp:384:10:384:13 | & ... |
+| test.cpp:384:16:384:23 | & ... | test.cpp:384:16:384:23 | & ... |
+| test.cpp:384:16:384:23 | *& ... | test.cpp:384:3:384:8 | **call to memcpy |
+| test.cpp:384:16:384:23 | *& ... | test.cpp:384:3:384:8 | *call to memcpy |
+| test.cpp:384:16:384:23 | *& ... | test.cpp:384:10:384:13 | memcpy output argument |
+| test.cpp:384:16:384:23 | *& ... | test.cpp:384:16:384:23 | *& ... |
+| test.cpp:384:16:384:23 | **(const void *)... | test.cpp:384:3:384:8 | **call to memcpy |
+| test.cpp:384:16:384:23 | **(const void *)... | test.cpp:384:10:384:13 | memcpy output argument |
+| test.cpp:384:17:384:23 | *source1 | test.cpp:384:16:384:23 | *& ... |
+| test.cpp:384:17:384:23 | source1 | test.cpp:384:16:384:23 | & ... |
+| test.cpp:388:53:388:59 | source1 | test.cpp:391:16:391:23 | *& ... |
+| test.cpp:388:66:388:66 | b | test.cpp:393:7:393:7 | b |
+| test.cpp:389:12:389:13 | 0 | test.cpp:389:12:389:13 | 0 |
+| test.cpp:389:12:389:13 | 0 | test.cpp:390:18:390:21 | *& ... |
+| test.cpp:390:18:390:21 | & ... | test.cpp:390:18:390:21 | & ... |
+| test.cpp:390:18:390:21 | *& ... | test.cpp:390:18:390:21 | *& ... |
+| test.cpp:390:18:390:21 | *& ... | test.cpp:391:10:391:13 | *& ... |
+| test.cpp:390:19:390:21 | *tmp | test.cpp:390:18:390:21 | *& ... |
+| test.cpp:390:19:390:21 | tmp | test.cpp:390:18:390:21 | & ... |
+| test.cpp:391:10:391:13 | & ... | test.cpp:391:3:391:8 | call to memcpy |
+| test.cpp:391:10:391:13 | & ... | test.cpp:391:10:391:13 | & ... |
+| test.cpp:391:10:391:13 | *& ... | test.cpp:391:10:391:13 | *& ... |
+| test.cpp:391:10:391:13 | memcpy output argument | test.cpp:392:8:392:10 | tmp |
+| test.cpp:391:11:391:13 | *tmp | test.cpp:391:10:391:13 | *& ... |
+| test.cpp:391:11:391:13 | tmp | test.cpp:391:10:391:13 | & ... |
+| test.cpp:391:16:391:23 | & ... | test.cpp:391:16:391:23 | & ... |
+| test.cpp:391:16:391:23 | *& ... | test.cpp:391:3:391:8 | **call to memcpy |
+| test.cpp:391:16:391:23 | *& ... | test.cpp:391:3:391:8 | *call to memcpy |
+| test.cpp:391:16:391:23 | *& ... | test.cpp:391:10:391:13 | memcpy output argument |
+| test.cpp:391:16:391:23 | *& ... | test.cpp:391:16:391:23 | *& ... |
+| test.cpp:391:16:391:23 | **(const void *)... | test.cpp:391:3:391:8 | **call to memcpy |
+| test.cpp:391:16:391:23 | **(const void *)... | test.cpp:391:10:391:13 | memcpy output argument |
+| test.cpp:391:17:391:23 | *source1 | test.cpp:391:16:391:23 | *& ... |
+| test.cpp:391:17:391:23 | source1 | test.cpp:391:16:391:23 | & ... |
+| test.cpp:392:8:392:10 | tmp | test.cpp:394:10:394:12 | tmp |
+| test.cpp:487:67:487:67 | **s | test.cpp:487:67:487:67 | **s |
+| test.cpp:487:67:487:67 | **s | test.cpp:487:67:487:67 | **s |
+| test.cpp:487:67:487:67 | **s | test.cpp:487:67:487:67 | *s |
+| test.cpp:487:67:487:67 | **s | test.cpp:488:21:488:21 | *s |
+| test.cpp:487:67:487:67 | *s | test.cpp:487:67:487:67 | **s |
+| test.cpp:487:67:487:67 | *s | test.cpp:487:67:487:67 | *s |
+| test.cpp:487:67:487:67 | *s | test.cpp:487:67:487:67 | *s |
+| test.cpp:487:67:487:67 | *s | test.cpp:487:67:487:67 | s |
+| test.cpp:487:67:487:67 | *s | test.cpp:488:21:488:21 | s |
+| test.cpp:487:67:487:67 | s | test.cpp:487:67:487:67 | *s |
+| test.cpp:487:67:487:67 | s | test.cpp:487:67:487:67 | s |
+| test.cpp:487:67:487:67 | s | test.cpp:487:67:487:67 | s |
+| test.cpp:488:21:488:21 | *s | test.cpp:489:20:489:20 | *s |
+| test.cpp:488:21:488:21 | *s [post update] | test.cpp:489:20:489:20 | *s |
+| test.cpp:488:21:488:21 | s | test.cpp:489:20:489:20 | s |
+| test.cpp:488:21:488:21 | s [post update] | test.cpp:489:20:489:20 | s |
+| test.cpp:488:24:488:30 | *content | test.cpp:488:21:488:30 | *content |
+| test.cpp:488:24:488:30 | content | test.cpp:488:21:488:30 | content |
+| test.cpp:489:20:489:20 | *s | test.cpp:487:67:487:67 | *s |
+| test.cpp:489:20:489:20 | *s [post update] | test.cpp:487:67:487:67 | *s |
+| test.cpp:489:20:489:20 | *s [post update] | test.cpp:489:20:489:20 | *s |
+| test.cpp:489:20:489:20 | s [post update] | test.cpp:489:20:489:20 | s |
+| test.cpp:489:23:489:29 | *content | test.cpp:489:23:489:29 | *content |
+| test.cpp:489:23:489:29 | *content | test.cpp:490:8:490:17 | * ... |
+| test.cpp:489:23:489:29 | content | test.cpp:489:23:489:29 | content |
+| test.cpp:489:23:489:29 | content | test.cpp:490:9:490:17 | p_content |
diff --git a/cpp/ql/test/library-tests/dataflow/dataflow-tests/localFlow-ir.ql b/cpp/ql/test/library-tests/dataflow/dataflow-tests/localFlow-ir.ql
new file mode 100644
index 000000000000..7a908a6e3f23
--- /dev/null
+++ b/cpp/ql/test/library-tests/dataflow/dataflow-tests/localFlow-ir.ql
@@ -0,0 +1,8 @@
+import cpp
+import semmle.code.cpp.dataflow.new.DataFlow
+
+from DataFlow::Node nodeFrom, DataFlow::Node nodeTo
+where
+ DataFlow::localFlowStep(nodeFrom, nodeTo) and
+ nodeFrom.getFunction().getName().matches("%\\_with\\_local\\_flow")
+select nodeFrom, nodeTo
From cc754858c6f8a4420cd31715d19563b6d4bdf5da Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Wed, 6 Mar 2024 18:12:58 -0800
Subject: [PATCH 072/731] C++: Add a testcase with missing flow out of the
address of 'a' and to the argument of 'sink'.
---
.../dataflow/dataflow-tests/dataflow-consistency.expected | 2 ++
.../dataflow/dataflow-tests/localFlow-ir.expected | 7 +++++++
.../dataflow/dataflow-tests/localFlow.expected | 7 +++++++
.../dataflow/dataflow-tests/test-source-sink.expected | 1 +
cpp/ql/test/library-tests/dataflow/dataflow-tests/test.cpp | 6 ++++++
.../dataflow/dataflow-tests/uninitialized.expected | 2 ++
6 files changed, 25 insertions(+)
diff --git a/cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-consistency.expected b/cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-consistency.expected
index 8b2b371a4e26..fa6958d92ea3 100644
--- a/cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-consistency.expected
+++ b/cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-consistency.expected
@@ -166,6 +166,8 @@ postWithInFlow
| test.cpp:932:5:932:19 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
| test.cpp:932:6:932:19 | global_pointer [inner post update] | PostUpdateNode should not be the target of local flow. |
| test.cpp:1045:9:1045:11 | ref arg buf | PostUpdateNode should not be the target of local flow. |
+| test.cpp:1051:5:1051:11 | content [post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:1052:9:1052:9 | a [inner post update] | PostUpdateNode should not be the target of local flow. |
viableImplInCallContextTooLarge
uniqueParameterNodeAtPosition
uniqueParameterNodePosition
diff --git a/cpp/ql/test/library-tests/dataflow/dataflow-tests/localFlow-ir.expected b/cpp/ql/test/library-tests/dataflow/dataflow-tests/localFlow-ir.expected
index 1fa924a11ce2..c8377f43d593 100644
--- a/cpp/ql/test/library-tests/dataflow/dataflow-tests/localFlow-ir.expected
+++ b/cpp/ql/test/library-tests/dataflow/dataflow-tests/localFlow-ir.expected
@@ -158,3 +158,10 @@
| test.cpp:489:23:489:29 | *content | test.cpp:490:8:490:17 | * ... |
| test.cpp:489:23:489:29 | content | test.cpp:489:23:489:29 | content |
| test.cpp:489:23:489:29 | content | test.cpp:490:9:490:17 | p_content |
+| test.cpp:1050:12:1050:12 | definition of a | test.cpp:1051:3:1051:3 | *a |
+| test.cpp:1051:3:1051:3 | *a | test.cpp:1052:8:1052:9 | *& ... |
+| test.cpp:1051:3:1051:3 | *a [post update] | test.cpp:1052:8:1052:9 | *& ... |
+| test.cpp:1051:15:1051:21 | 0 | test.cpp:1051:3:1051:21 | ... = ... |
+| test.cpp:1051:15:1051:21 | *0 | test.cpp:1051:3:1051:21 | *... = ... |
+| test.cpp:1052:9:1052:9 | *a | test.cpp:1052:8:1052:9 | *& ... |
+| test.cpp:1052:9:1052:9 | a | test.cpp:1052:8:1052:9 | & ... |
diff --git a/cpp/ql/test/library-tests/dataflow/dataflow-tests/localFlow.expected b/cpp/ql/test/library-tests/dataflow/dataflow-tests/localFlow.expected
index 525e6b22da54..2f4c618a1308 100644
--- a/cpp/ql/test/library-tests/dataflow/dataflow-tests/localFlow.expected
+++ b/cpp/ql/test/library-tests/dataflow/dataflow-tests/localFlow.expected
@@ -81,3 +81,10 @@ WARNING: Module DataFlow has been deprecated and may be removed in future (local
| test.cpp:488:21:488:21 | s [post update] | test.cpp:489:20:489:20 | s |
| test.cpp:488:24:488:30 | ref arg content | test.cpp:489:23:489:29 | content |
| test.cpp:489:23:489:29 | content | test.cpp:490:9:490:17 | p_content |
+| test.cpp:1050:12:1050:12 | a | test.cpp:1051:3:1051:3 | a |
+| test.cpp:1050:12:1050:12 | a | test.cpp:1052:9:1052:9 | a |
+| test.cpp:1051:3:1051:3 | a [post update] | test.cpp:1052:9:1052:9 | a |
+| test.cpp:1051:3:1051:21 | ... = ... | test.cpp:1051:5:1051:11 | content [post update] |
+| test.cpp:1051:15:1051:21 | 0 | test.cpp:1051:3:1051:21 | ... = ... |
+| test.cpp:1052:8:1052:9 | ref arg & ... | test.cpp:1052:9:1052:9 | a [inner post update] |
+| test.cpp:1052:9:1052:9 | a | test.cpp:1052:8:1052:9 | & ... |
diff --git a/cpp/ql/test/library-tests/dataflow/dataflow-tests/test-source-sink.expected b/cpp/ql/test/library-tests/dataflow/dataflow-tests/test-source-sink.expected
index c9f90a60b6e4..e03ee68b8a35 100644
--- a/cpp/ql/test/library-tests/dataflow/dataflow-tests/test-source-sink.expected
+++ b/cpp/ql/test/library-tests/dataflow/dataflow-tests/test-source-sink.expected
@@ -123,6 +123,7 @@ astFlow
| test.cpp:842:11:842:16 | call to source | test.cpp:844:8:844:8 | y |
| test.cpp:846:13:846:27 | call to indirect_source | test.cpp:848:23:848:25 | rpx |
| test.cpp:860:54:860:59 | call to source | test.cpp:861:10:861:37 | static_local_pointer_dynamic |
+| test.cpp:1050:12:1050:12 | a | test.cpp:1052:8:1052:9 | & ... |
| true_upon_entry.cpp:17:11:17:16 | call to source | true_upon_entry.cpp:21:8:21:8 | x |
| true_upon_entry.cpp:27:9:27:14 | call to source | true_upon_entry.cpp:29:8:29:8 | x |
| true_upon_entry.cpp:33:11:33:16 | call to source | true_upon_entry.cpp:39:8:39:8 | x |
diff --git a/cpp/ql/test/library-tests/dataflow/dataflow-tests/test.cpp b/cpp/ql/test/library-tests/dataflow/dataflow-tests/test.cpp
index b36c289aaf1d..b2bff6327c56 100644
--- a/cpp/ql/test/library-tests/dataflow/dataflow-tests/test.cpp
+++ b/cpp/ql/test/library-tests/dataflow/dataflow-tests/test.cpp
@@ -1044,4 +1044,10 @@ void* memset(void*, int, size_t);
void memset_test(char* buf) { // $ ast-def=buf ir-def=*buf
memset(buf, source(), 10);
sink(*buf); // $ ir MISSING: ast
+}
+
+void flow_out_of_address_with_local_flow() {
+ MyStruct a;
+ a.content = nullptr;
+ sink(&a); // $ SPURIOUS: ast
}
\ No newline at end of file
diff --git a/cpp/ql/test/library-tests/dataflow/dataflow-tests/uninitialized.expected b/cpp/ql/test/library-tests/dataflow/dataflow-tests/uninitialized.expected
index 39fb882940d6..fc230b0ed20d 100644
--- a/cpp/ql/test/library-tests/dataflow/dataflow-tests/uninitialized.expected
+++ b/cpp/ql/test/library-tests/dataflow/dataflow-tests/uninitialized.expected
@@ -54,3 +54,5 @@
| test.cpp:796:12:796:12 | a | test.cpp:797:20:797:20 | a |
| test.cpp:796:12:796:12 | a | test.cpp:797:31:797:31 | a |
| test.cpp:796:12:796:12 | a | test.cpp:798:17:798:17 | a |
+| test.cpp:1050:12:1050:12 | a | test.cpp:1051:3:1051:3 | a |
+| test.cpp:1050:12:1050:12 | a | test.cpp:1052:9:1052:9 | a |
From 84797b90918d82f21c8011ea88aa35781fa63918 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Wed, 6 Mar 2024 16:25:36 -0800
Subject: [PATCH 073/731] C++: Refactor the address out of 'DefImpl' and into a
new abstract class 'OperandBasedDef'.
---
.../cpp/ir/dataflow/internal/SsaInternals.qll | 24 ++++++++++++-------
1 file changed, 15 insertions(+), 9 deletions(-)
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll
index 5f254ee12b76..7304a70dcf2d 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll
@@ -256,23 +256,29 @@ private predicate sourceVariableHasBaseAndIndex(SourceVariable v, BaseSourceVari
}
abstract class DefImpl extends DefOrUseImpl {
- Operand address;
int ind;
bindingset[ind]
DefImpl() { any() }
- abstract int getIndirection();
+ override int getIndirectionIndex() { result = ind }
- abstract Node0Impl getValue();
+ override string toString() { result = "Def of " + this.getSourceVariable() }
+
+ abstract int getIndirection();
abstract predicate isCertain();
- Operand getAddressOperand() { result = address }
+ abstract Node0Impl getValue();
+}
- override int getIndirectionIndex() { result = ind }
+abstract class OperandBasedDef extends DefImpl {
+ Operand address;
- override string toString() { result = "Def of " + this.getSourceVariable() }
+ bindingset[ind]
+ OperandBasedDef() { any() }
+
+ Operand getAddressOperand() { result = address }
override Cpp::Location getLocation() { result = this.getAddressOperand().getUse().getLocation() }
@@ -281,7 +287,7 @@ abstract class DefImpl extends DefOrUseImpl {
}
}
-private class DirectDef extends DefImpl, TDefImpl {
+private class DirectDef extends OperandBasedDef, TDefImpl {
BaseSourceVariableInstruction base;
DirectDef() { this = TDefImpl(base, address, ind) }
@@ -295,7 +301,7 @@ private class DirectDef extends DefImpl, TDefImpl {
override predicate isCertain() { isDef(true, _, address, base, _, ind) }
}
-private class IteratorDef extends DefImpl, TIteratorDef {
+private class IteratorDef extends OperandBasedDef, TIteratorDef {
BaseSourceVariableInstruction container;
IteratorDef() { this = TIteratorDef(address, container, ind) }
@@ -1178,7 +1184,7 @@ class UseOrPhi extends SsaDefOrUse {
class Def extends DefOrUse {
override DefImpl defOrUse;
- Operand getAddressOperand() { result = defOrUse.getAddressOperand() }
+ Operand getAddressOperand() { result = defOrUse.(OperandBasedDef).getAddressOperand() }
Instruction getAddress() { result = this.getAddressOperand().getDef() }
From cf162aa41240ccb9bd7ae39c2c6c068a4b3644eb Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Wed, 6 Mar 2024 16:26:11 -0800
Subject: [PATCH 074/731] C++: Add an explicit definition of the address of an
IRVariable.
---
.../cpp/ir/dataflow/internal/SsaInternals.qll | 37 ++++++++++++++++++-
1 file changed, 36 insertions(+), 1 deletion(-)
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll
index 7304a70dcf2d..c036343544c4 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll
@@ -103,6 +103,7 @@ predicate hasRawIndirectInstruction(Instruction instr, int indirectionIndex) {
cached
private newtype TDefOrUseImpl =
+ TDefAddressImpl(BaseIRVariable v) or
TDefImpl(BaseSourceVariableInstruction base, Operand address, int indirectionIndex) {
isDef(_, _, address, base, _, indirectionIndex)
} or
@@ -272,7 +273,41 @@ abstract class DefImpl extends DefOrUseImpl {
abstract Node0Impl getValue();
}
-abstract class OperandBasedDef extends DefImpl {
+/** An initial definition of an `IRVariable`'s address. */
+private class DefAddressImpl extends DefImpl, TDefAddressImpl {
+ BaseIRVariable v;
+
+ DefAddressImpl() {
+ this = TDefAddressImpl(v) and
+ ind = 0
+ }
+
+ final override int getIndirection() { result = 0 }
+
+ final override predicate isCertain() { any() }
+
+ final override Node0Impl getValue() { none() }
+
+ final override predicate hasIndexInBlock(IRBlock block, int index) {
+ block = v.getIRVariable().getEnclosingIRFunction().getEntryBlock() and
+ index = 0
+ }
+
+ override Cpp::Location getLocation() { result = v.getIRVariable().getLocation() }
+
+ final override SourceVariable getSourceVariable() {
+ result.getBaseVariable() = v and
+ result.getIndirection() = 0
+ }
+
+ final override BaseSourceVariableInstruction getBase() { none() }
+}
+
+/**
+ * An SSA definition that has an associated `Operand` representing the address
+ * that is being written to.
+ */
+abstract private class OperandBasedDef extends DefImpl {
Operand address;
bindingset[ind]
From 4c9876b008015f682ad3a94b93c244b46950fc3f Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Wed, 6 Mar 2024 18:15:04 -0800
Subject: [PATCH 075/731] C++: Accept test changes.
---
.../dataflow-tests/localFlow-ir.expected | 30 +++++++++++++++++++
1 file changed, 30 insertions(+)
diff --git a/cpp/ql/test/library-tests/dataflow/dataflow-tests/localFlow-ir.expected b/cpp/ql/test/library-tests/dataflow/dataflow-tests/localFlow-ir.expected
index c8377f43d593..0e33430cde79 100644
--- a/cpp/ql/test/library-tests/dataflow/dataflow-tests/localFlow-ir.expected
+++ b/cpp/ql/test/library-tests/dataflow/dataflow-tests/localFlow-ir.expected
@@ -10,6 +10,7 @@
| example.c:15:37:15:37 | b | example.c:15:37:15:37 | *b |
| example.c:15:37:15:37 | b | example.c:15:37:15:37 | b |
| example.c:15:37:15:37 | b | example.c:15:37:15:37 | b |
+| example.c:15:37:15:37 | b | example.c:19:6:19:6 | b |
| example.c:15:44:15:46 | pos | example.c:24:24:24:26 | pos |
| example.c:17:11:17:16 | *definition of coords | example.c:17:11:17:16 | *definition of coords |
| example.c:17:11:17:16 | *definition of coords | example.c:17:11:17:16 | *definition of coords |
@@ -22,6 +23,10 @@
| example.c:17:11:17:16 | definition of coords | example.c:17:11:17:16 | definition of coords |
| example.c:17:11:17:16 | definition of coords | example.c:17:11:17:16 | definition of coords |
| example.c:17:11:17:16 | definition of coords | example.c:17:11:17:16 | definition of coords |
+| example.c:17:11:17:16 | definition of coords | example.c:17:11:17:16 | definition of coords |
+| example.c:17:11:17:16 | definition of coords | example.c:24:13:24:18 | coords |
+| example.c:17:11:17:16 | definition of coords [post update] | example.c:17:11:17:16 | definition of coords |
+| example.c:17:11:17:16 | definition of coords [post update] | example.c:24:13:24:18 | coords |
| example.c:17:19:17:22 | {...} | example.c:17:19:17:22 | {...} |
| example.c:17:21:17:21 | 0 | example.c:17:21:17:21 | 0 |
| example.c:19:6:19:6 | *b | example.c:15:37:15:37 | *b |
@@ -30,17 +35,24 @@
| example.c:19:6:19:6 | b [post update] | example.c:19:6:19:6 | b |
| example.c:24:2:24:7 | *coords | example.c:26:18:26:24 | *& ... |
| example.c:24:2:24:7 | *coords [post update] | example.c:26:18:26:24 | *& ... |
+| example.c:24:2:24:7 | coords | example.c:26:18:26:24 | & ... |
+| example.c:24:2:24:7 | coords [post update] | example.c:26:18:26:24 | & ... |
| example.c:24:13:24:18 | *coords | example.c:24:2:24:7 | *coords |
| example.c:24:13:24:18 | *coords [post update] | example.c:24:2:24:7 | *coords |
+| example.c:24:13:24:18 | coords | example.c:24:2:24:7 | coords |
+| example.c:24:13:24:18 | coords [post update] | example.c:24:2:24:7 | coords |
| example.c:24:13:24:30 | ... = ... | example.c:24:2:24:30 | ... = ... |
| example.c:24:20:24:20 | *y | example.c:24:20:24:20 | *y |
| example.c:24:20:24:20 | y | example.c:24:20:24:20 | y |
| example.c:24:20:24:20 | y | example.c:24:20:24:20 | y |
+| example.c:24:24:24:26 | pos | example.c:28:14:28:25 | & ... |
| example.c:24:24:24:26 | pos | example.c:28:14:28:25 | *& ... |
| example.c:24:24:24:30 | ... + ... | example.c:24:13:24:30 | ... = ... |
| example.c:26:13:26:16 | call to getX | example.c:26:2:26:25 | ... = ... |
+| example.c:26:18:26:24 | & ... | example.c:26:2:26:7 | coords |
| example.c:26:18:26:24 | *& ... | example.c:26:2:26:7 | *coords |
| example.c:26:18:26:24 | getX output argument | example.c:26:2:26:7 | *coords |
+| example.c:26:18:26:24 | pointer to getX output argument | example.c:26:2:26:7 | coords |
| example.c:26:19:26:24 | *coords | example.c:26:18:26:24 | *& ... |
| example.c:26:19:26:24 | coords | example.c:26:18:26:24 | & ... |
| example.c:28:22:28:25 | & ... | example.c:28:14:28:25 | & ... |
@@ -50,14 +62,21 @@
| test.cpp:6:12:6:17 | call to source | test.cpp:6:12:6:17 | call to source |
| test.cpp:6:12:6:17 | call to source | test.cpp:7:8:7:9 | t1 |
| test.cpp:7:8:7:9 | t1 | test.cpp:8:8:8:9 | t1 |
+| test.cpp:7:8:7:9 | t1 | test.cpp:8:8:8:9 | t1 |
| test.cpp:8:3:8:9 | ... = ... | test.cpp:10:8:10:9 | t2 |
| test.cpp:8:8:8:9 | t1 | test.cpp:8:3:8:9 | ... = ... |
| test.cpp:8:8:8:9 | t1 | test.cpp:9:8:9:9 | t1 |
+| test.cpp:8:8:8:9 | t1 | test.cpp:9:8:9:9 | t1 |
| test.cpp:9:8:9:9 | t1 | test.cpp:11:7:11:8 | t1 |
+| test.cpp:9:8:9:9 | t1 | test.cpp:11:7:11:8 | t1 |
+| test.cpp:10:8:10:9 | t2 | test.cpp:13:10:13:11 | t2 |
+| test.cpp:10:8:10:9 | t2 | test.cpp:15:3:15:6 | Phi |
| test.cpp:10:8:10:9 | t2 | test.cpp:15:3:15:6 | Phi |
+| test.cpp:11:7:11:8 | t1 | test.cpp:21:8:21:9 | t1 |
| test.cpp:12:5:12:10 | ... = ... | test.cpp:13:10:13:11 | t2 |
| test.cpp:12:10:12:10 | 0 | test.cpp:12:5:12:10 | ... = ... |
| test.cpp:13:10:13:11 | t2 | test.cpp:15:3:15:6 | Phi |
+| test.cpp:13:10:13:11 | t2 | test.cpp:15:3:15:6 | Phi |
| test.cpp:15:3:15:6 | Phi | test.cpp:15:8:15:9 | t2 |
| test.cpp:15:3:15:6 | Phi | test.cpp:15:8:15:9 | t2 |
| test.cpp:15:8:15:9 | t2 | test.cpp:23:19:23:19 | Phi |
@@ -65,6 +84,7 @@
| test.cpp:17:3:17:8 | ... = ... | test.cpp:21:8:21:9 | t1 |
| test.cpp:17:8:17:8 | 0 | test.cpp:17:3:17:8 | ... = ... |
| test.cpp:21:8:21:9 | t1 | test.cpp:23:19:23:19 | Phi |
+| test.cpp:21:8:21:9 | t1 | test.cpp:23:19:23:19 | Phi |
| test.cpp:23:15:23:16 | 0 | test.cpp:23:15:23:16 | 0 |
| test.cpp:23:15:23:16 | 0 | test.cpp:23:19:23:19 | Phi |
| test.cpp:23:19:23:19 | Phi | test.cpp:23:19:23:19 | i |
@@ -94,8 +114,10 @@
| test.cpp:383:12:383:13 | 0 | test.cpp:384:10:384:13 | *& ... |
| test.cpp:384:10:384:13 | & ... | test.cpp:384:3:384:8 | call to memcpy |
| test.cpp:384:10:384:13 | & ... | test.cpp:384:10:384:13 | & ... |
+| test.cpp:384:10:384:13 | & ... | test.cpp:385:8:385:10 | tmp |
| test.cpp:384:10:384:13 | *& ... | test.cpp:384:10:384:13 | *& ... |
| test.cpp:384:10:384:13 | memcpy output argument | test.cpp:385:8:385:10 | tmp |
+| test.cpp:384:10:384:13 | pointer to memcpy output argument | test.cpp:385:8:385:10 | tmp |
| test.cpp:384:11:384:13 | *tmp | test.cpp:384:10:384:13 | *& ... |
| test.cpp:384:11:384:13 | tmp | test.cpp:384:10:384:13 | & ... |
| test.cpp:384:16:384:23 | & ... | test.cpp:384:16:384:23 | & ... |
@@ -112,14 +134,17 @@
| test.cpp:389:12:389:13 | 0 | test.cpp:389:12:389:13 | 0 |
| test.cpp:389:12:389:13 | 0 | test.cpp:390:18:390:21 | *& ... |
| test.cpp:390:18:390:21 | & ... | test.cpp:390:18:390:21 | & ... |
+| test.cpp:390:18:390:21 | & ... | test.cpp:391:10:391:13 | & ... |
| test.cpp:390:18:390:21 | *& ... | test.cpp:390:18:390:21 | *& ... |
| test.cpp:390:18:390:21 | *& ... | test.cpp:391:10:391:13 | *& ... |
| test.cpp:390:19:390:21 | *tmp | test.cpp:390:18:390:21 | *& ... |
| test.cpp:390:19:390:21 | tmp | test.cpp:390:18:390:21 | & ... |
| test.cpp:391:10:391:13 | & ... | test.cpp:391:3:391:8 | call to memcpy |
| test.cpp:391:10:391:13 | & ... | test.cpp:391:10:391:13 | & ... |
+| test.cpp:391:10:391:13 | & ... | test.cpp:392:8:392:10 | tmp |
| test.cpp:391:10:391:13 | *& ... | test.cpp:391:10:391:13 | *& ... |
| test.cpp:391:10:391:13 | memcpy output argument | test.cpp:392:8:392:10 | tmp |
+| test.cpp:391:10:391:13 | pointer to memcpy output argument | test.cpp:392:8:392:10 | tmp |
| test.cpp:391:11:391:13 | *tmp | test.cpp:391:10:391:13 | *& ... |
| test.cpp:391:11:391:13 | tmp | test.cpp:391:10:391:13 | & ... |
| test.cpp:391:16:391:23 | & ... | test.cpp:391:16:391:23 | & ... |
@@ -132,6 +157,7 @@
| test.cpp:391:17:391:23 | *source1 | test.cpp:391:16:391:23 | *& ... |
| test.cpp:391:17:391:23 | source1 | test.cpp:391:16:391:23 | & ... |
| test.cpp:392:8:392:10 | tmp | test.cpp:394:10:394:12 | tmp |
+| test.cpp:392:8:392:10 | tmp | test.cpp:394:10:394:12 | tmp |
| test.cpp:487:67:487:67 | **s | test.cpp:487:67:487:67 | **s |
| test.cpp:487:67:487:67 | **s | test.cpp:487:67:487:67 | **s |
| test.cpp:487:67:487:67 | **s | test.cpp:487:67:487:67 | *s |
@@ -144,9 +170,11 @@
| test.cpp:487:67:487:67 | s | test.cpp:487:67:487:67 | *s |
| test.cpp:487:67:487:67 | s | test.cpp:487:67:487:67 | s |
| test.cpp:487:67:487:67 | s | test.cpp:487:67:487:67 | s |
+| test.cpp:487:67:487:67 | s | test.cpp:488:21:488:21 | s |
| test.cpp:488:21:488:21 | *s | test.cpp:489:20:489:20 | *s |
| test.cpp:488:21:488:21 | *s [post update] | test.cpp:489:20:489:20 | *s |
| test.cpp:488:21:488:21 | s | test.cpp:489:20:489:20 | s |
+| test.cpp:488:21:488:21 | s | test.cpp:489:20:489:20 | s |
| test.cpp:488:21:488:21 | s [post update] | test.cpp:489:20:489:20 | s |
| test.cpp:488:24:488:30 | *content | test.cpp:488:21:488:30 | *content |
| test.cpp:488:24:488:30 | content | test.cpp:488:21:488:30 | content |
@@ -161,6 +189,8 @@
| test.cpp:1050:12:1050:12 | definition of a | test.cpp:1051:3:1051:3 | *a |
| test.cpp:1051:3:1051:3 | *a | test.cpp:1052:8:1052:9 | *& ... |
| test.cpp:1051:3:1051:3 | *a [post update] | test.cpp:1052:8:1052:9 | *& ... |
+| test.cpp:1051:3:1051:3 | a | test.cpp:1052:8:1052:9 | & ... |
+| test.cpp:1051:3:1051:3 | a [post update] | test.cpp:1052:8:1052:9 | & ... |
| test.cpp:1051:15:1051:21 | 0 | test.cpp:1051:3:1051:21 | ... = ... |
| test.cpp:1051:15:1051:21 | *0 | test.cpp:1051:3:1051:21 | *... = ... |
| test.cpp:1052:9:1052:9 | *a | test.cpp:1052:8:1052:9 | *& ... |
From f0a5183a3f1901cd5027e05be847232721c3d97b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 7 Mar 2024 03:59:07 +0000
Subject: [PATCH 076/731] Bump chrono from 0.4.34 to 0.4.35 in /ql
Bumps [chrono](https://github.com/chronotope/chrono) from 0.4.34 to 0.4.35.
- [Release notes](https://github.com/chronotope/chrono/releases)
- [Changelog](https://github.com/chronotope/chrono/blob/main/CHANGELOG.md)
- [Commits](https://github.com/chronotope/chrono/compare/v0.4.34...v0.4.35)
---
updated-dependencies:
- dependency-name: chrono
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot]
---
ql/Cargo.lock | 4 ++--
ql/buramu/Cargo.toml | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/ql/Cargo.lock b/ql/Cargo.lock
index 3b8e78046888..557cf673d595 100644
--- a/ql/Cargo.lock
+++ b/ql/Cargo.lock
@@ -133,9 +133,9 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
[[package]]
name = "chrono"
-version = "0.4.34"
+version = "0.4.35"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5bc015644b92d5890fab7489e49d21f879d5c990186827d42ec511919404f38b"
+checksum = "8eaf5903dcbc0a39312feb77df2ff4c76387d591b9fc7b04a238dcf8bb62639a"
dependencies = [
"android-tzdata",
"iana-time-zone",
diff --git a/ql/buramu/Cargo.toml b/ql/buramu/Cargo.toml
index 328501a05faf..c072903b82a8 100644
--- a/ql/buramu/Cargo.toml
+++ b/ql/buramu/Cargo.toml
@@ -7,6 +7,6 @@ edition = "2018"
[dependencies]
lazy_static = "1.4.0"
-chrono = "0.4.34"
+chrono = "0.4.35"
rayon = "1.9.0"
regex = "1.10.3"
From 8ae6fa5366839cd1cde7a4eadfb25b30ad128fd8 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Tue, 5 Mar 2024 16:23:58 -0800
Subject: [PATCH 077/731] C++: Add a new query 'cpp/type-confusion' for
detecting type confusion vulnerabilities.
---
.../Security/CWE/CWE-843/TypeConfusion.qhelp | 47 ++++
.../src/Security/CWE/CWE-843/TypeConfusion.ql | 251 ++++++++++++++++++
.../Security/CWE/CWE-843/TypeConfusionBad.cpp | 7 +
.../CWE/CWE-843/TypeConfusionCommon.cpp | 25 ++
.../CWE/CWE-843/TypeConfusionGood.cpp | 11 +
.../CWE/CWE-843/TypeConfusion.expected | 27 ++
.../Security/CWE/CWE-843/TypeConfusion.qlref | 1 +
.../query-tests/Security/CWE/CWE-843/test.cpp | 146 ++++++++++
8 files changed, 515 insertions(+)
create mode 100644 cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.qhelp
create mode 100644 cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql
create mode 100644 cpp/ql/src/Security/CWE/CWE-843/TypeConfusionBad.cpp
create mode 100644 cpp/ql/src/Security/CWE/CWE-843/TypeConfusionCommon.cpp
create mode 100644 cpp/ql/src/Security/CWE/CWE-843/TypeConfusionGood.cpp
create mode 100644 cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected
create mode 100644 cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.qlref
create mode 100644 cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
diff --git a/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.qhelp b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.qhelp
new file mode 100644
index 000000000000..b1ad3a7d6ce0
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.qhelp
@@ -0,0 +1,47 @@
+
+
+
+
+
+Certain casts in C and C++ places no restrictions on the target type. For
+example, C style casts such as (MyClass*)p allows the programmer
+to cast any pointer p to an expression of type MyClass*.
+If the runtime type of p turns out to be a type that's incompatible
+with MyClass, this results in undefined behavior.
+
+
+
+
+
+If possible, use dynamic_cast to safely cast between polymorphic types.
+If dynamic_cast is not an option, use static_cast to restrict
+the kinds of conversions that the compiler is allowed to perform. If C++ style casts is
+not an option, carefully check that all casts are safe.
+
+
+
+
+
+Consider the following class hierachy where we define a base class Shape and two
+derived classes Circle and Square that are mutually incompatible:
+
+
+
+
+The following code demonstrates a type confusion vulnerability where the programmer
+assumes that the runtime type of p is always a Square.
+However, if p is a Circle, the cast will result in undefined behavior.
+
+
+
+
+The following code fixes the vulnerability by using dynamic_cast to
+safely cast between polymorphic types. If the cast fails, dynamic_cast
+returns a null pointer, which can be checked for and handled appropriately.
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql
new file mode 100644
index 000000000000..99f89106fb68
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql
@@ -0,0 +1,251 @@
+/**
+ * @name Type confusion
+ * @description Casting a value to an incompatible type can lead to undefined behavior.
+ * @kind path-problem
+ * @problem.severity warning
+ * @security-severity 9.3
+ * @precision medium
+ * @id cpp/type-confusion
+ * @tags security
+ * external/cwe/cwe-843
+ */
+
+import cpp
+import semmle.code.cpp.dataflow.new.DataFlow
+import BadFlow::PathGraph
+
+/**
+ * Holds if `f` is a field located at byte offset `offset` in `c`.
+ *
+ * Note that predicate is recursive, so that given the following:
+ * ```cpp
+ * struct S1 {
+ * int a;
+ * void* b;
+ * };
+ *
+ * struct S2 {
+ * S1 s1;
+ * char c;
+ * };
+ * ```
+ * both `hasAFieldWithOffset(S2, s1, 0)` and `hasAFieldWithOffset(S2, a, 0)`
+ * holds.
+ */
+predicate hasAFieldWithOffset(Class c, Field f, int offset) {
+ // Base case: `f` is a field in `c`.
+ f = c.getAField() and
+ offset = f.getByteOffset() and
+ not f.getUnspecifiedType().(Class).hasDefinition()
+ or
+ // Otherwise, we find the struct that is a field of `c` which then has
+ // the field `f` as a member.
+ exists(Field g |
+ g = c.getAField() and
+ // Find the field with the largest offset that's less than or equal to
+ // offset. That's the struct we need to search recursively.
+ g =
+ max(Field cand, int candOffset |
+ cand = c.getAField() and
+ candOffset = cand.getByteOffset() and
+ offset >= candOffset
+ |
+ cand order by candOffset
+ ) and
+ hasAFieldWithOffset(g.getUnspecifiedType(), f, offset - g.getByteOffset())
+ )
+}
+
+/** Holds if `f` is the last field of its declaring class. */
+predicate lastField(Field f) {
+ exists(Class c | c = f.getDeclaringType() |
+ f =
+ max(Field cand, int byteOffset |
+ cand.getDeclaringType() = c and byteOffset = f.getByteOffset()
+ |
+ cand order by byteOffset
+ )
+ )
+}
+
+/**
+ * Holds if there exists a field in `c2` at offset `offset` that's compatible
+ * with `f1`.
+ */
+bindingset[f1, offset, c2]
+pragma[inline_late]
+predicate hasCompatibleFieldAtOffset(Field f1, int offset, Class c2) {
+ exists(Field f2 | hasAFieldWithOffset(c2, f2, offset) |
+ // Let's not deal with bit-fields for now.
+ f2 instanceof BitField
+ or
+ f1.getUnspecifiedType().getSize() = f2.getUnspecifiedType().getSize()
+ or
+ lastField(f1) and
+ f1.getUnspecifiedType().getSize() <= f2.getUnspecifiedType().getSize()
+ )
+}
+
+/**
+ * Holds if `c1` is a prefix of `c2`.
+ */
+bindingset[c1, c2]
+pragma[inline_late]
+predicate prefix(Class c1, Class c2) {
+ not c1.isPolymorphic() and
+ not c2.isPolymorphic() and
+ if c1 instanceof Union
+ then
+ // If it's a union we just verify that one of it's variants is compatible with the other class
+ exists(Field f1, int offset |
+ // Let's not deal with bit-fields for now.
+ not f1 instanceof BitField and
+ hasAFieldWithOffset(c1, f1, offset)
+ |
+ hasCompatibleFieldAtOffset(f1, offset, c2)
+ )
+ else
+ forall(Field f1, int offset |
+ // Let's not deal with bit-fields for now.
+ not f1 instanceof BitField and
+ hasAFieldWithOffset(c1, f1, offset)
+ |
+ hasCompatibleFieldAtOffset(f1, offset, c2)
+ )
+}
+
+/**
+ * An unsafe cast is any explicit cast that is not
+ * a `dynamic_cast`.
+ */
+class UnsafeCast extends Cast {
+ private Class toType;
+
+ UnsafeCast() {
+ (
+ this instanceof CStyleCast
+ or
+ this instanceof StaticCast
+ or
+ this instanceof ReinterpretCast
+ ) and
+ toType = this.getExplicitlyConverted().getUnspecifiedType().stripType() and
+ not this.isImplicit() and
+ exists(TypeDeclarationEntry tde |
+ tde = toType.getDefinition() and
+ not tde.isFromUninstantiatedTemplate(_)
+ )
+ }
+
+ Class getConvertedType() { result = toType }
+
+ bindingset[this, t]
+ pragma[inline_late]
+ predicate compatibleWith(Type t) {
+ t.stripType() = this.getConvertedType()
+ or
+ prefix(this.getConvertedType(), t.stripType())
+ or
+ t.stripType().(Class).getABaseClass+() = this.getConvertedType()
+ or
+ t.stripType() = this.getConvertedType().getABaseClass+()
+ }
+}
+
+/**
+ * Holds if `source` is an allocation that allocates a value of type `state`.
+ */
+predicate isSourceImpl(DataFlow::Node source, Class state) {
+ state = source.asExpr().(AllocationExpr).getAllocatedElementType().stripType() and
+ exists(TypeDeclarationEntry tde |
+ tde = state.getDefinition() and
+ not tde.isFromUninstantiatedTemplate(_)
+ )
+}
+
+module RelevantStateConfig implements DataFlow::ConfigSig {
+ predicate isSource(DataFlow::Node source) { isSourceImpl(source, _) }
+
+ predicate isBarrier(DataFlow::Node node) {
+ // We disable flow through global variables to reduce FPs from infeasible paths
+ node instanceof DataFlow::VariableNode
+ or
+ exists(Class c | c = node.getType().stripType() |
+ not c.hasDefinition()
+ or
+ exists(TypeDeclarationEntry tde |
+ tde = c.getDefinition() and
+ tde.isFromUninstantiatedTemplate(_)
+ )
+ )
+ }
+
+ predicate isSink(DataFlow::Node sink) {
+ exists(UnsafeCast cast | sink.asExpr() = cast.getUnconverted())
+ }
+}
+
+module RelevantStateFlow = DataFlow::Global;
+
+predicate relevantState(DataFlow::Node sink, Class state) {
+ exists(DataFlow::Node source |
+ RelevantStateFlow::flow(source, sink) and
+ isSourceImpl(source, state)
+ )
+}
+
+predicate isSinkImpl(DataFlow::Node sink, Class state, Type convertedType, boolean compatible) {
+ exists(UnsafeCast cast |
+ relevantState(sink, state) and
+ sink.asExpr() = cast.getUnconverted() and
+ convertedType = cast.getConvertedType()
+ |
+ if cast.compatibleWith(state) then compatible = true else compatible = false
+ )
+}
+
+module BadConfig implements DataFlow::StateConfigSig {
+ class FlowState extends Class {
+ FlowState() { isSourceImpl(_, this) }
+ }
+
+ predicate isSource(DataFlow::Node source, FlowState state) { isSourceImpl(source, state) }
+
+ predicate isBarrier(DataFlow::Node node) { RelevantStateConfig::isBarrier(node) }
+
+ predicate isSink(DataFlow::Node sink, FlowState state) { isSinkImpl(sink, state, _, false) }
+
+ predicate isBarrierOut(DataFlow::Node sink, FlowState state) { isSink(sink, state) }
+}
+
+module BadFlow = DataFlow::GlobalWithState;
+
+module GoodConfig implements DataFlow::StateConfigSig {
+ class FlowState = BadConfig::FlowState;
+
+ predicate isSource(DataFlow::Node source, FlowState state) { BadConfig::isSource(source, state) }
+
+ predicate isBarrier(DataFlow::Node node) { BadConfig::isBarrier(node) }
+
+ predicate isSink(DataFlow::Node sink, FlowState state) {
+ isSinkImpl(sink, state, _, true) and
+ BadFlow::flowTo(sink)
+ }
+}
+
+module GoodFlow = DataFlow::GlobalWithState;
+
+from
+ BadFlow::PathNode source, BadFlow::PathNode sink, Type sourceType, Type sinkType,
+ DataFlow::Node sinkNode
+where
+ BadFlow::flowPath(source, sink) and
+ sinkNode = sink.getNode() and
+ // If there is any flow that would result in a valid cast then we don't
+ // report an alert here. This reduces the number of FPs from infeasible paths
+ // significantly.
+ not GoodFlow::flowTo(sinkNode) and
+ isSourceImpl(source.getNode(), sourceType) and
+ isSinkImpl(sinkNode, _, sinkType, false)
+select sinkNode, source, sink, "Conversion from $@ to $@ is invalid.", sourceType,
+ sourceType.toString(), sinkType, sinkType.toString()
diff --git a/cpp/ql/src/Security/CWE/CWE-843/TypeConfusionBad.cpp b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusionBad.cpp
new file mode 100644
index 000000000000..1ef9bfd3e318
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusionBad.cpp
@@ -0,0 +1,7 @@
+void allocate_and_draw_bad() {
+ Shape* shape = new Circle;
+ // ...
+ // BAD: Assumes that shape is always a Square
+ Square* square = static_cast(shape);
+ int length = square->getLength();
+}
\ No newline at end of file
diff --git a/cpp/ql/src/Security/CWE/CWE-843/TypeConfusionCommon.cpp b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusionCommon.cpp
new file mode 100644
index 000000000000..7bdee0195886
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusionCommon.cpp
@@ -0,0 +1,25 @@
+struct Shape {
+ virtual ~Shape();
+
+ virtual void draw() = 0;
+};
+
+struct Circle : public Shape {
+ Circle();
+
+ void draw() override {
+ /* ... */
+ }
+
+ int getRadius();
+};
+
+struct Square : public Shape {
+ Square();
+
+ void draw() override {
+ /* ... */
+ }
+
+ int getLength();
+};
diff --git a/cpp/ql/src/Security/CWE/CWE-843/TypeConfusionGood.cpp b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusionGood.cpp
new file mode 100644
index 000000000000..f56a00a5e108
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusionGood.cpp
@@ -0,0 +1,11 @@
+void allocate_and_draw_good() {
+ Shape* shape = new Circle;
+ // ...
+ // GOOD: Dynamically checks if shape is a Square
+ Square* square = dynamic_cast(shape);
+ if(square) {
+ int length = square->getLength();
+ } else {
+ // handle error
+ }
+}
\ No newline at end of file
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected
new file mode 100644
index 000000000000..2bf82dec9847
--- /dev/null
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected
@@ -0,0 +1,27 @@
+edges
+| test.cpp:27:13:27:18 | new | test.cpp:28:25:28:55 | p | provenance | |
+| test.cpp:32:13:32:30 | new | test.cpp:33:12:33:30 | p | provenance | |
+| test.cpp:66:15:66:21 | new | test.cpp:67:12:67:31 | a | provenance | |
+| test.cpp:85:9:85:15 | new | test.cpp:88:14:88:33 | a | provenance | |
+| test.cpp:127:12:127:17 | new | test.cpp:128:24:128:59 | s2 | provenance | |
+| test.cpp:143:14:143:19 | new | test.cpp:145:28:145:68 | s1_2 | provenance | |
+nodes
+| test.cpp:27:13:27:18 | new | semmle.label | new |
+| test.cpp:28:25:28:55 | p | semmle.label | p |
+| test.cpp:32:13:32:30 | new | semmle.label | new |
+| test.cpp:33:12:33:30 | p | semmle.label | p |
+| test.cpp:66:15:66:21 | new | semmle.label | new |
+| test.cpp:67:12:67:31 | a | semmle.label | a |
+| test.cpp:85:9:85:15 | new | semmle.label | new |
+| test.cpp:88:14:88:33 | a | semmle.label | a |
+| test.cpp:127:12:127:17 | new | semmle.label | new |
+| test.cpp:128:24:128:59 | s2 | semmle.label | s2 |
+| test.cpp:143:14:143:19 | new | semmle.label | new |
+| test.cpp:145:28:145:68 | s1_2 | semmle.label | s1_2 |
+subpaths
+#select
+| test.cpp:28:25:28:55 | p | test.cpp:27:13:27:18 | new | test.cpp:28:25:28:55 | p | Conversion from $@ to $@ is invalid. | test.cpp:1:8:1:9 | S1 | S1 | test.cpp:11:8:11:21 | Not_S1_wrapper | Not_S1_wrapper |
+| test.cpp:33:12:33:30 | p | test.cpp:32:13:32:30 | new | test.cpp:33:12:33:30 | p | Conversion from $@ to $@ is invalid. | test.cpp:11:8:11:21 | Not_S1_wrapper | Not_S1_wrapper | test.cpp:1:8:1:9 | S1 | S1 |
+| test.cpp:67:12:67:31 | a | test.cpp:66:15:66:21 | new | test.cpp:67:12:67:31 | a | Conversion from $@ to $@ is invalid. | test.cpp:55:8:55:10 | Cat | Cat | test.cpp:60:8:60:10 | Dog | Dog |
+| test.cpp:128:24:128:59 | s2 | test.cpp:127:12:127:17 | new | test.cpp:128:24:128:59 | s2 | Conversion from $@ to $@ is invalid. | test.cpp:102:8:102:9 | S2 | S2 | test.cpp:119:8:119:20 | Not_S2_prefix | Not_S2_prefix |
+| test.cpp:145:28:145:68 | s1_2 | test.cpp:143:14:143:19 | new | test.cpp:145:28:145:68 | s1_2 | Conversion from $@ to $@ is invalid. | test.cpp:1:8:1:9 | S1 | S1 | test.cpp:131:8:131:23 | HasSomeBitFields | HasSomeBitFields |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.qlref
new file mode 100644
index 000000000000..53b17f1e1fda
--- /dev/null
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.qlref
@@ -0,0 +1 @@
+Security/CWE/CWE-843/TypeConfusion.ql
\ No newline at end of file
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
new file mode 100644
index 000000000000..90d8b47c8200
--- /dev/null
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
@@ -0,0 +1,146 @@
+struct S1 {
+ int a;
+ void* b;
+ unsigned char c;
+};
+
+struct S1_wrapper {
+ S1 s1;
+};
+
+struct Not_S1_wrapper {
+ unsigned char x;
+ S1 s1;
+};
+
+void test1() {
+ void* p = new S1;
+ S1_wrapper* s1w = static_cast(p); // GOOD
+}
+
+void test2() {
+ void* p = new S1_wrapper;
+ S1* s1 = static_cast(p); // GOOD
+}
+
+void test3() {
+ void* p = new S1;
+ Not_S1_wrapper* s1w = static_cast(p); // BAD
+}
+
+void test4() {
+ void* p = new Not_S1_wrapper;
+ S1* s1 = static_cast(p); // BAD
+}
+
+struct HasBitFields {
+ int x : 16;
+ int y : 16;
+ int z : 32;
+};
+
+struct BufferStruct {
+ unsigned char buffer[sizeof(HasBitFields)];
+};
+
+void test5() {
+ HasBitFields* p = new HasBitFields;
+ BufferStruct* bs = reinterpret_cast(p); // GOOD
+}
+
+struct Animal {
+ virtual ~Animal();
+};
+
+struct Cat : public Animal {
+ Cat();
+ ~Cat();
+};
+
+struct Dog : public Animal {
+ Dog();
+ ~Dog();
+};
+
+void test6() {
+ Animal* a = new Cat;
+ Dog* d = static_cast(a); // BAD
+}
+
+void test7() {
+ Animal* a = new Cat;
+ Dog* d = dynamic_cast(a); // GOOD
+}
+
+void test8() {
+ Animal* a = new Cat;
+ Cat* d = static_cast(a); // GOOD
+}
+
+void test9(bool b) {
+ Animal* a;
+ if(b) {
+ a = new Cat;
+ } else {
+ a = new Dog;
+ }
+ if(b) {
+ Cat* d = static_cast(a); // GOOD
+ }
+}
+
+/**
+ * The layout of S2 is:
+ * 0: int
+ * 8: void*
+ * 16: unsigned char
+ * 16 + pad: unsigned char
+ * 32 + pad: int
+ * 40 + pad: void*
+ * 48 + pad: unsigned char
+*/
+struct S2 {
+ S1 s1;
+ unsigned char buffer[16];
+ S1 s1_2;
+};
+
+struct S2_prefix {
+ int a;
+ void* p;
+ unsigned char c;
+};
+
+void test10() {
+ S2* s2 = new S2;
+ S2_prefix* s2p = reinterpret_cast(s2); // GOOD
+}
+
+struct Not_S2_prefix {
+ int a;
+ void* p;
+ void* p2;
+ unsigned char c;
+};
+
+void test11() {
+ S2* s2 = new S2;
+ Not_S2_prefix* s2p = reinterpret_cast(s2); // BAD
+}
+
+struct HasSomeBitFields {
+ int x : 16;
+ int y;
+ int z : 32;
+};
+
+void test12() {
+ // This has doesn't have any non-bitfield member, so we don't detect
+ // the problem here since the query currently ignores bitfields.
+ S1* s1 = new S1;
+ HasBitFields* hbf = reinterpret_cast(s1); // BAD [NOT DETECTED]
+
+ S1* s1_2 = new S1;
+ // This one has a non-bitfield members. So we detect the problem
+ HasSomeBitFields* hbf2 = reinterpret_cast(s1_2); // BAD
+}
From 6dc0fa515d03d48de8bf572edf97bb6d14c3f162 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Tue, 5 Mar 2024 16:29:37 -0800
Subject: [PATCH 078/731] C++: Add change note.
---
cpp/ql/src/change-notes/2024-03-05-type-confusion-query.md | 4 ++++
1 file changed, 4 insertions(+)
create mode 100644 cpp/ql/src/change-notes/2024-03-05-type-confusion-query.md
diff --git a/cpp/ql/src/change-notes/2024-03-05-type-confusion-query.md b/cpp/ql/src/change-notes/2024-03-05-type-confusion-query.md
new file mode 100644
index 000000000000..f96a4684b769
--- /dev/null
+++ b/cpp/ql/src/change-notes/2024-03-05-type-confusion-query.md
@@ -0,0 +1,4 @@
+---
+category: newQuery
+---
+* Added a new query, `cpp/type-confusion`, to detect casts to invalid types.
\ No newline at end of file
From cf4c8eb517982d81f4194bbdde7828af980f3a9f Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Wed, 6 Mar 2024 13:56:27 -0800
Subject: [PATCH 079/731] C++: Add more tests.
---
cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp | 1 +
1 file changed, 1 insertion(+)
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
index 90d8b47c8200..879df4e23e6b 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
@@ -144,3 +144,4 @@ void test12() {
// This one has a non-bitfield members. So we detect the problem
HasSomeBitFields* hbf2 = reinterpret_cast(s1_2); // BAD
}
+
From cd57cd0d8ac83218ec4bc388a98298fe70872661 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Wed, 6 Mar 2024 13:56:37 -0800
Subject: [PATCH 080/731] C++: Add qhelp reference.
---
cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.qhelp | 3 +++
1 file changed, 3 insertions(+)
diff --git a/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.qhelp b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.qhelp
index b1ad3a7d6ce0..0f72a9922056 100644
--- a/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.qhelp
+++ b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.qhelp
@@ -43,5 +43,8 @@ returns a null pointer, which can be checked for and handled appropriately.
+
From c2db5f490e750b0e371f943376f59b8bbbae1355 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Wed, 6 Mar 2024 14:02:45 -0800
Subject: [PATCH 081/731] C++: Add more FNs and FPs to show examples of where
the 'successor typing' strategy fails.
---
.../CWE/CWE-843/TypeConfusion.expected | 7 +++++
.../query-tests/Security/CWE/CWE-843/test.cpp | 26 +++++++++++++++++++
2 files changed, 33 insertions(+)
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected
index 2bf82dec9847..07c37663db9c 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected
@@ -5,6 +5,8 @@ edges
| test.cpp:85:9:85:15 | new | test.cpp:88:14:88:33 | a | provenance | |
| test.cpp:127:12:127:17 | new | test.cpp:128:24:128:59 | s2 | provenance | |
| test.cpp:143:14:143:19 | new | test.cpp:145:28:145:68 | s1_2 | provenance | |
+| test.cpp:153:9:153:15 | new | test.cpp:159:14:159:33 | a | provenance | |
+| test.cpp:168:9:168:15 | new | test.cpp:171:14:171:33 | a | provenance | |
nodes
| test.cpp:27:13:27:18 | new | semmle.label | new |
| test.cpp:28:25:28:55 | p | semmle.label | p |
@@ -18,6 +20,10 @@ nodes
| test.cpp:128:24:128:59 | s2 | semmle.label | s2 |
| test.cpp:143:14:143:19 | new | semmle.label | new |
| test.cpp:145:28:145:68 | s1_2 | semmle.label | s1_2 |
+| test.cpp:153:9:153:15 | new | semmle.label | new |
+| test.cpp:159:14:159:33 | a | semmle.label | a |
+| test.cpp:168:9:168:15 | new | semmle.label | new |
+| test.cpp:171:14:171:33 | a | semmle.label | a |
subpaths
#select
| test.cpp:28:25:28:55 | p | test.cpp:27:13:27:18 | new | test.cpp:28:25:28:55 | p | Conversion from $@ to $@ is invalid. | test.cpp:1:8:1:9 | S1 | S1 | test.cpp:11:8:11:21 | Not_S1_wrapper | Not_S1_wrapper |
@@ -25,3 +31,4 @@ subpaths
| test.cpp:67:12:67:31 | a | test.cpp:66:15:66:21 | new | test.cpp:67:12:67:31 | a | Conversion from $@ to $@ is invalid. | test.cpp:55:8:55:10 | Cat | Cat | test.cpp:60:8:60:10 | Dog | Dog |
| test.cpp:128:24:128:59 | s2 | test.cpp:127:12:127:17 | new | test.cpp:128:24:128:59 | s2 | Conversion from $@ to $@ is invalid. | test.cpp:102:8:102:9 | S2 | S2 | test.cpp:119:8:119:20 | Not_S2_prefix | Not_S2_prefix |
| test.cpp:145:28:145:68 | s1_2 | test.cpp:143:14:143:19 | new | test.cpp:145:28:145:68 | s1_2 | Conversion from $@ to $@ is invalid. | test.cpp:1:8:1:9 | S1 | S1 | test.cpp:131:8:131:23 | HasSomeBitFields | HasSomeBitFields |
+| test.cpp:159:14:159:33 | a | test.cpp:153:9:153:15 | new | test.cpp:159:14:159:33 | a | Conversion from $@ to $@ is invalid. | test.cpp:60:8:60:10 | Dog | Dog | test.cpp:55:8:55:10 | Cat | Cat |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
index 879df4e23e6b..1ba1aa2062cf 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
@@ -145,3 +145,29 @@ void test12() {
HasSomeBitFields* hbf2 = reinterpret_cast(s1_2); // BAD
}
+void test13(bool b, Cat* c) {
+ Animal* a;
+ if(b) {
+ a = c;
+ } else {
+ a = new Dog;
+ }
+ // This FP happens despite the `not GoodFlow::flowTo(sinkNode)` condition in the query
+ // because we don't find a flow path from `a = c` to `static_cast(a)` because
+ // the "source" (i.e., `a = c`) doesn't have an allocation.
+ if(b) {
+ Cat* d = static_cast(a); // GOOD [FALSE POSITIVE]
+ }
+}
+
+void test14(bool b) {
+ Animal* a;
+ if(b) {
+ a = new Cat;
+ } else {
+ a = new Dog;
+ }
+ if(!b) {
+ Cat* d = static_cast(a); // BAD [NOT DETECTED]
+ }
+}
From fc9919a5b61f824f62f993ab0d30e3bb45bf7449 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Wed, 6 Mar 2024 14:20:15 -0800
Subject: [PATCH 082/731] C++: Add a test that exercise the 'last field' check.
---
.../CWE/CWE-843/TypeConfusion.expected | 4 ++++
.../query-tests/Security/CWE/CWE-843/test.cpp | 19 +++++++++++++++++++
2 files changed, 23 insertions(+)
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected
index 07c37663db9c..04e5462bf010 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected
@@ -7,6 +7,7 @@ edges
| test.cpp:143:14:143:19 | new | test.cpp:145:28:145:68 | s1_2 | provenance | |
| test.cpp:153:9:153:15 | new | test.cpp:159:14:159:33 | a | provenance | |
| test.cpp:168:9:168:15 | new | test.cpp:171:14:171:33 | a | provenance | |
+| test.cpp:187:15:187:24 | new | test.cpp:189:25:189:45 | u64 | provenance | |
nodes
| test.cpp:27:13:27:18 | new | semmle.label | new |
| test.cpp:28:25:28:55 | p | semmle.label | p |
@@ -24,6 +25,8 @@ nodes
| test.cpp:159:14:159:33 | a | semmle.label | a |
| test.cpp:168:9:168:15 | new | semmle.label | new |
| test.cpp:171:14:171:33 | a | semmle.label | a |
+| test.cpp:187:15:187:24 | new | semmle.label | new |
+| test.cpp:189:25:189:45 | u64 | semmle.label | u64 |
subpaths
#select
| test.cpp:28:25:28:55 | p | test.cpp:27:13:27:18 | new | test.cpp:28:25:28:55 | p | Conversion from $@ to $@ is invalid. | test.cpp:1:8:1:9 | S1 | S1 | test.cpp:11:8:11:21 | Not_S1_wrapper | Not_S1_wrapper |
@@ -32,3 +35,4 @@ subpaths
| test.cpp:128:24:128:59 | s2 | test.cpp:127:12:127:17 | new | test.cpp:128:24:128:59 | s2 | Conversion from $@ to $@ is invalid. | test.cpp:102:8:102:9 | S2 | S2 | test.cpp:119:8:119:20 | Not_S2_prefix | Not_S2_prefix |
| test.cpp:145:28:145:68 | s1_2 | test.cpp:143:14:143:19 | new | test.cpp:145:28:145:68 | s1_2 | Conversion from $@ to $@ is invalid. | test.cpp:1:8:1:9 | S1 | S1 | test.cpp:131:8:131:23 | HasSomeBitFields | HasSomeBitFields |
| test.cpp:159:14:159:33 | a | test.cpp:153:9:153:15 | new | test.cpp:159:14:159:33 | a | Conversion from $@ to $@ is invalid. | test.cpp:60:8:60:10 | Dog | Dog | test.cpp:55:8:55:10 | Cat | Cat |
+| test.cpp:189:25:189:45 | u64 | test.cpp:187:15:187:24 | new | test.cpp:189:25:189:45 | u64 | Conversion from $@ to $@ is invalid. | test.cpp:175:8:175:13 | UInt64 | UInt64 | test.cpp:184:8:184:22 | UInt8_with_more | UInt8_with_more |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
index 1ba1aa2062cf..6b5b5ccde375 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
@@ -171,3 +171,22 @@ void test14(bool b) {
Cat* d = static_cast(a); // BAD [NOT DETECTED]
}
}
+
+struct UInt64 { unsigned long u64; };
+struct UInt8 { unsigned char u8; };
+
+void test14() {
+ void* u64 = new UInt64;
+ // ...
+ UInt8* u8 = (UInt8*)u64; // GOOD
+}
+
+struct UInt8_with_more { UInt8 u8; void* p; };
+
+void test15() {
+ void* u64 = new UInt64;
+ // ...
+ UInt8_with_more* u8 = (UInt8_with_more*)u64; // BAD
+}
+
+// semmle-extractor-options: --gcc -std=c++11
From 3295d5cb9f03911a99831cf51fb70ce039559b1e Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Wed, 6 Mar 2024 14:36:18 -0800
Subject: [PATCH 083/731] C++: Add more QLDoc.
---
.../src/Security/CWE/CWE-843/TypeConfusion.ql | 54 ++++++++++++++++++-
1 file changed, 53 insertions(+), 1 deletion(-)
diff --git a/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql
index 99f89106fb68..6bfe9164a393 100644
--- a/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql
+++ b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql
@@ -163,6 +163,12 @@ predicate isSourceImpl(DataFlow::Node source, Class state) {
)
}
+/**
+ * The `RelevantStateConfig` configuration is used to find the set of
+ * states for the `BadConfig` and `GoodConfig`. The flow computed by
+ * `RelevantStateConfig` is used to implement the `relevantState` predicate
+ * which is used to avoid a cartesian product in `isSinkImpl`.
+ */
module RelevantStateConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { isSourceImpl(source, _) }
@@ -204,9 +210,16 @@ predicate isSinkImpl(DataFlow::Node sink, Class state, Type convertedType, boole
)
}
+/**
+ * The `BadConfig` configuration tracks flow from an allocation to an
+ * incompatible cast.
+ *
+ * We use `FlowState` to track the type of the source, and compare the
+ * flow state to the target of the cast in the `isSink` definition.
+ */
module BadConfig implements DataFlow::StateConfigSig {
class FlowState extends Class {
- FlowState() { isSourceImpl(_, this) }
+ FlowState() { relevantState(_, this) }
}
predicate isSource(DataFlow::Node source, FlowState state) { isSourceImpl(source, state) }
@@ -220,6 +233,45 @@ module BadConfig implements DataFlow::StateConfigSig {
module BadFlow = DataFlow::GlobalWithState;
+/**
+ * The `GoodConfig` configuration tracks flow from an allocation to a
+ * compatible cast.
+ *
+ * We use `GoodConfig` to reduce the number of FPs from infeasible paths.
+ * For example, consider the following example:
+ * ```cpp
+ * struct Animal { virtual ~Animal(); };
+ *
+ * struct Cat : public Animal {
+ * Cat();
+ * ~Cat();
+ * };
+ *
+ * struct Dog : public Animal {
+ * Dog();
+ * ~Dog();
+ * };
+ *
+ * void test9(bool b) {
+ * Animal* a;
+ * if(b) {
+ * a = new Cat;
+ * } else {
+ * a = new Dog;
+ * }
+ * if(b) {
+ * Cat* d = static_cast(a);
+ * }
+ * }
+ * ```
+ * Here, `BadConfig` finds a flow from `a = new Dog` to `static_cast(a)`.
+ * However, that path is never realized in an actual execution path. So in
+ * order to remove this result we exclude results where there exists an
+ * allocation of a type that's compatible with `static_cast(a)`.
+ *
+ * We use `FlowState` to track the type of the source, and compare the
+ * flow state to the target of the cast in the `isSink` definition.
+ */
module GoodConfig implements DataFlow::StateConfigSig {
class FlowState = BadConfig::FlowState;
From bf84f3a936c07ca822a8394984cb84ebbba7ece7 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Wed, 6 Mar 2024 15:53:16 -0800
Subject: [PATCH 084/731] C++: Add FN.
---
.../query-tests/Security/CWE/CWE-843/test.cpp | 22 ++++++++++++++++++-
1 file changed, 21 insertions(+), 1 deletion(-)
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
index 6b5b5ccde375..3fdafd9d02f2 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
@@ -189,4 +189,24 @@ void test15() {
UInt8_with_more* u8 = (UInt8_with_more*)u64; // BAD
}
-// semmle-extractor-options: --gcc -std=c++11
+struct SingleInt {
+ int i;
+} __attribute__((packed));;
+
+struct PairInts {
+ int x, y;
+} __attribute__((packed));;
+
+union MyUnion
+{
+ PairInts p;
+ unsigned long long foo;
+} __attribute__((packed));
+
+void test16() {
+ void* si = new SingleInt;
+ // ...
+ MyUnion* mu = (MyUnion*)si; // BAD [NOT DETECTED]
+}
+
+// semmle-extractor-options: --gcc -std=c++11
\ No newline at end of file
From 01fc7432cb79bc30857988401f8a4776c7b211e3 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Wed, 6 Mar 2024 22:17:33 -0800
Subject: [PATCH 085/731] C++: Add more tests.
---
.../CWE/CWE-843/TypeConfusion.expected | 8 ++++++++
.../query-tests/Security/CWE/CWE-843/test.cpp | 18 ++++++++++++++++++
2 files changed, 26 insertions(+)
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected
index 04e5462bf010..45355a86a48b 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected
@@ -8,6 +8,8 @@ edges
| test.cpp:153:9:153:15 | new | test.cpp:159:14:159:33 | a | provenance | |
| test.cpp:168:9:168:15 | new | test.cpp:171:14:171:33 | a | provenance | |
| test.cpp:187:15:187:24 | new | test.cpp:189:25:189:45 | u64 | provenance | |
+| test.cpp:217:13:217:18 | new | test.cpp:218:30:218:65 | p | provenance | |
+| test.cpp:226:13:226:18 | new | test.cpp:227:29:227:63 | p | provenance | |
nodes
| test.cpp:27:13:27:18 | new | semmle.label | new |
| test.cpp:28:25:28:55 | p | semmle.label | p |
@@ -27,6 +29,10 @@ nodes
| test.cpp:171:14:171:33 | a | semmle.label | a |
| test.cpp:187:15:187:24 | new | semmle.label | new |
| test.cpp:189:25:189:45 | u64 | semmle.label | u64 |
+| test.cpp:217:13:217:18 | new | semmle.label | new |
+| test.cpp:218:30:218:65 | p | semmle.label | p |
+| test.cpp:226:13:226:18 | new | semmle.label | new |
+| test.cpp:227:29:227:63 | p | semmle.label | p |
subpaths
#select
| test.cpp:28:25:28:55 | p | test.cpp:27:13:27:18 | new | test.cpp:28:25:28:55 | p | Conversion from $@ to $@ is invalid. | test.cpp:1:8:1:9 | S1 | S1 | test.cpp:11:8:11:21 | Not_S1_wrapper | Not_S1_wrapper |
@@ -36,3 +42,5 @@ subpaths
| test.cpp:145:28:145:68 | s1_2 | test.cpp:143:14:143:19 | new | test.cpp:145:28:145:68 | s1_2 | Conversion from $@ to $@ is invalid. | test.cpp:1:8:1:9 | S1 | S1 | test.cpp:131:8:131:23 | HasSomeBitFields | HasSomeBitFields |
| test.cpp:159:14:159:33 | a | test.cpp:153:9:153:15 | new | test.cpp:159:14:159:33 | a | Conversion from $@ to $@ is invalid. | test.cpp:60:8:60:10 | Dog | Dog | test.cpp:55:8:55:10 | Cat | Cat |
| test.cpp:189:25:189:45 | u64 | test.cpp:187:15:187:24 | new | test.cpp:189:25:189:45 | u64 | Conversion from $@ to $@ is invalid. | test.cpp:175:8:175:13 | UInt64 | UInt64 | test.cpp:184:8:184:22 | UInt8_with_more | UInt8_with_more |
+| test.cpp:218:30:218:65 | p | test.cpp:217:13:217:18 | new | test.cpp:218:30:218:65 | p | Conversion from $@ to $@ is invalid. | test.cpp:1:8:1:9 | S1 | S1 | test.cpp:212:8:212:26 | UnrelatedStructSize | UnrelatedStructSize |
+| test.cpp:227:29:227:63 | p | test.cpp:226:13:226:18 | new | test.cpp:227:29:227:63 | p | Conversion from $@ to $@ is invalid. | test.cpp:1:8:1:9 | S1 | S1 | test.cpp:221:8:221:25 | TooLargeBufferSize | TooLargeBufferSize |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
index 3fdafd9d02f2..982496218ffa 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
@@ -209,4 +209,22 @@ void test16() {
MyUnion* mu = (MyUnion*)si; // BAD [NOT DETECTED]
}
+struct UnrelatedStructSize {
+ unsigned char buffer[1024];
+};
+
+void test17() {
+ void* p = new S1;
+ UnrelatedStructSize* uss = static_cast(p); // BAD
+}
+
+struct TooLargeBufferSize {
+ unsigned char buffer[sizeof(S1) + 1];
+};
+
+void test18() {
+ void* p = new S1;
+ TooLargeBufferSize* uss = static_cast(p); // BAD
+}
+
// semmle-extractor-options: --gcc -std=c++11
\ No newline at end of file
From b876117eccf7b1e7c9db393ce0d6e2d1277a382a Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen
Date: Wed, 6 Mar 2024 22:25:04 -0800
Subject: [PATCH 086/731] C++: Add more QLDoc.
---
cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql
index 6bfe9164a393..d43e0145c99d 100644
--- a/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql
+++ b/cpp/ql/src/Security/CWE/CWE-843/TypeConfusion.ql
@@ -139,6 +139,20 @@ class UnsafeCast extends Cast {
Class getConvertedType() { result = toType }
+ /**
+ * Holds if the result of this cast can safely be interpreted as a value of
+ * type `t`.
+ *
+ * The compatibility rules are as follows:
+ *
+ * 1. the result of `(T)x` is compatible with the type `T` for any `T`
+ * 2. the result of `(T)x` is compatible with the type `U` for any `U` such
+ * that `U` is a subtype of `T`, or `T` is a subtype of `U`.
+ * 3. the result of `(T)x` is compatible with the type `U` if `U` the list
+ * of fields of `U` is a prefix of the list of fields of `T`.
+ * For example, if `T` is `struct { unsigned char x; int y; };`
+ * and `U` is `struct { unsigned char uc; };`.
+ */
bindingset[this, t]
pragma[inline_late]
predicate compatibleWith(Type t) {
From 4dd8f6e618e40d8f4181006e780992277e72fd69 Mon Sep 17 00:00:00 2001
From: Rasmus Wriedt Larsen
Date: Thu, 7 Mar 2024 14:25:55 +0100
Subject: [PATCH 087/731] Python: Add example of missing use-use flow
(see PR for more detailed description)
---
.../library-tests/essa/ssa-compute/test2.py | 29 +++++++++++++++++++
1 file changed, 29 insertions(+)
create mode 100644 python/ql/test/library-tests/essa/ssa-compute/test2.py
diff --git a/python/ql/test/library-tests/essa/ssa-compute/test2.py b/python/ql/test/library-tests/essa/ssa-compute/test2.py
new file mode 100644
index 000000000000..d117a6b53e66
--- /dev/null
+++ b/python/ql/test/library-tests/essa/ssa-compute/test2.py
@@ -0,0 +1,29 @@
+def func(x): # $ def=x
+ try:
+ with Thing() as y: # $ def=y
+ y.foo(x, 0) # $ def-use=x:1 def-use=y:3
+ while not x.attribute: # $ use-use=x:4 use-use=x:7
+ y.bar() # $ use-use=y:4 use-use=y:6
+ print(x) # $ use-use=x:5
+ finally:
+ pass
+
+def func(x): # $ def=x
+ try:
+ with Thing() as y: # $ def=y
+ y.foo(x, some_var) # $ def-use=x:11 def-use=y:13
+ while not x.attribute: # $ use-use=x:14 use-use=x:17
+ y.bar() # $ use-use=y:16 MISSING: use-use=y:14
+ print(x) # $ use-use=x:15
+ finally:
+ pass
+
+def func(x): # $ def=x
+ try:
+ with Thing() as y: # $ def=y
+ y.foo(x, some_var.some_attr) # $ def-use=x:21 def-use=y:23
+ while not x.attribute: # $ use-use=x:27 MISSING: use-use=x:24
+ y.bar() # $ use-use=y:26 MISSING: use-use=y:24
+ print(x) # $ use-use=x:25
+ finally:
+ pass
From 7d74125508aaf237af675369655dbce2a0ae1b3d Mon Sep 17 00:00:00 2001
From: Tony Torralba
Date: Thu, 7 Mar 2024 15:17:49 +0100
Subject: [PATCH 088/731] Go: Promote go/uncontrolled-allocation-size
---
.../security/UncontrolledAllocationSize.qll | 34 +++++++++++
...controlledAllocationSizeCustomizations.qll | 33 +++++++++++
.../CWE-770/UncontrolledAllocationSize.qhelp | 36 +++++++++++
.../CWE-770/UncontrolledAllocationSize.ql | 22 +++++++
.../CWE-770/UncontrolledAllocationSizeBad.go} | 0
.../UncontrolledAllocationSizeGood.go} | 0
...2024-03-07-uncontrolled-allocation-size.md | 4 ++
.../CWE-770/DenialOfService.qhelp | 32 ----------
.../experimental/CWE-770/DenialOfService.ql | 59 -------------------
.../CWE-770/DenialOfService.expected | 18 ------
.../CWE-770/DenialOfService.qlref | 1 -
.../UncontrolledAllocationSize.expected | 0
.../CWE-770/UncontrolledAllocationSize.ql | 4 ++
.../CWE-770/UncontrolledAllocationSizeBad.go} | 2 +-
.../UncontrolledAllocationSizeGood.go} | 0
15 files changed, 134 insertions(+), 111 deletions(-)
create mode 100644 go/ql/lib/semmle/go/security/UncontrolledAllocationSize.qll
create mode 100644 go/ql/lib/semmle/go/security/UncontrolledAllocationSizeCustomizations.qll
create mode 100644 go/ql/src/Security/CWE-770/UncontrolledAllocationSize.qhelp
create mode 100644 go/ql/src/Security/CWE-770/UncontrolledAllocationSize.ql
rename go/ql/src/{experimental/CWE-770/DenialOfServiceBad.go => Security/CWE-770/UncontrolledAllocationSizeBad.go} (100%)
rename go/ql/src/{experimental/CWE-770/DenialOfServiceGood.go => Security/CWE-770/UncontrolledAllocationSizeGood.go} (100%)
create mode 100644 go/ql/src/change-notes/2024-03-07-uncontrolled-allocation-size.md
delete mode 100644 go/ql/src/experimental/CWE-770/DenialOfService.qhelp
delete mode 100644 go/ql/src/experimental/CWE-770/DenialOfService.ql
delete mode 100644 go/ql/test/experimental/CWE-770/DenialOfService.expected
delete mode 100644 go/ql/test/experimental/CWE-770/DenialOfService.qlref
create mode 100644 go/ql/test/query-tests/Security/CWE-770/UncontrolledAllocationSize.expected
create mode 100644 go/ql/test/query-tests/Security/CWE-770/UncontrolledAllocationSize.ql
rename go/ql/test/{experimental/CWE-770/DenialOfServiceBad.go => query-tests/Security/CWE-770/UncontrolledAllocationSizeBad.go} (89%)
rename go/ql/test/{experimental/CWE-770/DenialOfServiceGood.go => query-tests/Security/CWE-770/UncontrolledAllocationSizeGood.go} (100%)
diff --git a/go/ql/lib/semmle/go/security/UncontrolledAllocationSize.qll b/go/ql/lib/semmle/go/security/UncontrolledAllocationSize.qll
new file mode 100644
index 000000000000..885aa7a7053c
--- /dev/null
+++ b/go/ql/lib/semmle/go/security/UncontrolledAllocationSize.qll
@@ -0,0 +1,34 @@
+/**
+ * Provides a taint-tracking configuration for reasoning about uncontrolled allocation size issues.
+ */
+
+import go
+
+/**
+ * Provides a taint-tracking flow for reasoning about uncontrolled allocation size issues.
+ */
+module UncontrolledAllocationSize {
+ private import UncontrolledAllocationSizeCustomizations::UncontrolledAllocationSize
+
+ /**
+ * Module for defining predicates and tracking taint flow related to uncontrolled allocation size issues.
+ */
+ module Config implements DataFlow::ConfigSig {
+ predicate isSource(DataFlow::Node source) { source instanceof Source }
+
+ predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
+
+ predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+
+ predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
+ exists(Function f, DataFlow::CallNode cn | cn = f.getACall() |
+ f.hasQualifiedName("strconv", ["Atoi", "ParseInt", "ParseUint", "ParseFloat"]) and
+ node1 = cn.getArgument(0) and
+ node2 = cn.getResult(0)
+ )
+ }
+ }
+
+ /** Tracks taint flow for reasoning about uncontrolled allocation size issues. */
+ module Flow = TaintTracking::Global;
+}
diff --git a/go/ql/lib/semmle/go/security/UncontrolledAllocationSizeCustomizations.qll b/go/ql/lib/semmle/go/security/UncontrolledAllocationSizeCustomizations.qll
new file mode 100644
index 000000000000..1237971dde17
--- /dev/null
+++ b/go/ql/lib/semmle/go/security/UncontrolledAllocationSizeCustomizations.qll
@@ -0,0 +1,33 @@
+/**
+ * Provides default sources, sinks, and sanitizers for reasoning about uncontrolled allocation size issues,
+ * as well as extension points for adding your own.
+ */
+
+import go
+private import semmle.go.security.AllocationSizeOverflow
+
+/**
+ * Provides extension points for customizing the taint-tracking configuration for reasoning
+ * about uncontrolled allocation size issues.
+ */
+module UncontrolledAllocationSize {
+ /** A data flow source for uncontrolled allocation size vulnerabilities. */
+ abstract class Source extends DataFlow::Node { }
+
+ /** A data flow sink for uncontrolled allocation size vulnerabilities. */
+ abstract class Sink extends DataFlow::Node { }
+
+ /** A sanitizer for uncontrolled allocation size vulnerabilities. */
+ abstract class Sanitizer extends DataFlow::Node { }
+
+ /** A source of untrusted data, considered as a taint source for uncontrolled size allocation vulnerabilities. */
+ private class UntrustedFlowAsSource extends Source instanceof UntrustedFlowSource { }
+
+ /** The size argument of a memory allocation function. */
+ private class AllocationSizeAsSink extends Sink instanceof AllocationSizeOverflow::AllocationSize {
+ }
+
+ /** A check that a value is below some upper limit. */
+ private class SizeCheckSanitizer extends Sanitizer instanceof AllocationSizeOverflow::AllocationSizeCheckBarrier
+ { }
+}
diff --git a/go/ql/src/Security/CWE-770/UncontrolledAllocationSize.qhelp b/go/ql/src/Security/CWE-770/UncontrolledAllocationSize.qhelp
new file mode 100644
index 000000000000..b4029e93e1ee
--- /dev/null
+++ b/go/ql/src/Security/CWE-770/UncontrolledAllocationSize.qhelp
@@ -0,0 +1,36 @@
+
+
+
+
+
Using untrusted input to allocate slices with the built-in make function could
+ lead to excessive memory allocation and potentially cause the program to crash due to running
+ out of memory. This vulnerability could be exploited to perform a denial-of-service attack by
+ consuming all available server resources.
+
+
+
+
Implement a maximum allowed value for size allocations with the built-in make
+ function to prevent excessively large allocations.
+
+
+
+
In the following example snippet, the n parameter is user-controlled.
+
If the external user provides an excessively large value, the application allocates a slice
+ of size n without further verification, potentially exhausting all the available
+ memory.
+
+
+
+
One way to prevent this vulnerability is by implementing a maximum allowed value for the
+ user-controlled input, as seen in the following example:
+
+
\ No newline at end of file
diff --git a/go/ql/src/Security/CWE-770/UncontrolledAllocationSize.ql b/go/ql/src/Security/CWE-770/UncontrolledAllocationSize.ql
new file mode 100644
index 000000000000..2be09c6901b3
--- /dev/null
+++ b/go/ql/src/Security/CWE-770/UncontrolledAllocationSize.ql
@@ -0,0 +1,22 @@
+/**
+ * @name Slice memory allocation with excessive size value
+ * @description Allocating memory for slices with the built-in make function from user-controlled sources
+ * can lead to a denial of service.
+ * @kind path-problem
+ * @problem.severity warning
+ * @security-severity 6.0
+ * @precision high
+ * @id go/uncontrolled-allocation-size
+ * @tags security
+ * external/cwe/cwe-770
+ */
+
+import go
+import semmle.go.security.UncontrolledAllocationSize
+import UncontrolledAllocationSize::Flow::PathGraph
+
+from
+ UncontrolledAllocationSize::Flow::PathNode source, UncontrolledAllocationSize::Flow::PathNode sink
+where UncontrolledAllocationSize::Flow::flowPath(source, sink)
+select sink, source, sink, "This memory allocation depends on a $@.", source.getNode(),
+ "user-provided value"
diff --git a/go/ql/src/experimental/CWE-770/DenialOfServiceBad.go b/go/ql/src/Security/CWE-770/UncontrolledAllocationSizeBad.go
similarity index 100%
rename from go/ql/src/experimental/CWE-770/DenialOfServiceBad.go
rename to go/ql/src/Security/CWE-770/UncontrolledAllocationSizeBad.go
diff --git a/go/ql/src/experimental/CWE-770/DenialOfServiceGood.go b/go/ql/src/Security/CWE-770/UncontrolledAllocationSizeGood.go
similarity index 100%
rename from go/ql/src/experimental/CWE-770/DenialOfServiceGood.go
rename to go/ql/src/Security/CWE-770/UncontrolledAllocationSizeGood.go
diff --git a/go/ql/src/change-notes/2024-03-07-uncontrolled-allocation-size.md b/go/ql/src/change-notes/2024-03-07-uncontrolled-allocation-size.md
new file mode 100644
index 000000000000..663932005eb1
--- /dev/null
+++ b/go/ql/src/change-notes/2024-03-07-uncontrolled-allocation-size.md
@@ -0,0 +1,4 @@
+---
+category: newQuery
+---
+* The query "Slice memory allocation with excessive size value" (`go/uncontrolled-allocation-size`) has been promoted from experimental to the main query pack. Its results will now appear by default. This query was originally [submitted as an experimental query by @Malayke](https://github.com/github/codeql/pull/15130).
diff --git a/go/ql/src/experimental/CWE-770/DenialOfService.qhelp b/go/ql/src/experimental/CWE-770/DenialOfService.qhelp
deleted file mode 100644
index b91f1f7e3b06..000000000000
--- a/go/ql/src/experimental/CWE-770/DenialOfService.qhelp
+++ /dev/null
@@ -1,32 +0,0 @@
-
-
-
-
-
Using untrusted input to created with the built-in make function
- could lead to excessive memory allocation and potentially cause the program to crash due
- to running out of memory. This vulnerability could be exploited to perform a DoS attack by consuming all available server resources.
-
-
-
-
Implement a maximum allowed value for creates a slice with the built-in make function to prevent excessively large allocations.
- For instance, you could restrict it to a reasonable upper limit.
-
-
-
-
In the following example snippet, the n field is user-controlled.
-
The server trusts that n has an acceptable value, however when using a maliciously large value,
- it allocates a slice of n of strings before filling the slice with data.
-
-
-
-
One way to prevent this vulnerability is by implementing a maximum allowed value for the user-controlled input: