[go: nahoru, domu]
CodeQL documentation
CodeQL resources

CodeQL 2.4.4 (2021-02-12)

This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the code scanning section on the GitHub blog, relevant GitHub Changelog updates, changes in the CodeQL extension for Visual Studio Code, and the CodeQL Action changelog.

Security Coverage

CodeQL 2.4.4 runs a total of 235 security queries when configured with the Default suite (covering 106 CWE). The Extended suite enables an additional 79 queries (covering 26 more CWE). 3 security queries have been added with this release.

CodeQL CLI

Potentially Breaking Changes

  • The name property in qlpack.yml must now meet the following requirements:
    • Only lowercase ASCII letters, ASCII digits, and hyphens (-) are allowed.
    • A hyphen is not allowed as the first or last character of the name.
    • The name must be at least one character long, and no longer than 128 characters.

Bug Fixes

  • The default value of the --working-dir options for the index-files and trace-command subcommands of codeql database has been fixed to match the documentation; previously, it would erroneously use the process’ current working directory rather than the database source root.
  • codeql test run will not crash if database extraction in a test directory fails. Instead only the tests in that directory will be marked as failing, and tests in other directories will continue executing.

New Features

  • Alert and path queries can now give a score to each alert they produce. You can incorporate alert scores in an alert or path query by first adding the @scored property to the query metadata. You can then introduce a new numeric column at the end of the select statement structure to represent the score of each alert. Alert scores are exposed in the SARIF output of commands like codeql database analyze as the score property in the property bags of result objects.