CodeQL 2.10.0 (2022-06-27)¶
This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the code scanning section on the GitHub blog, relevant GitHub Changelog updates, changes in the CodeQL extension for Visual Studio Code, and the CodeQL Action changelog.
Security Coverage¶
CodeQL 2.10.0 runs a total of 339 security queries when configured with the Default suite (covering 142 CWE). The Extended suite enables an additional 104 queries (covering 30 more CWE). 4 security queries have been added with this release.
CodeQL CLI¶
Breaking Changes¶
- The
--format=stats
option ofcodeql generate log-summary
has been renamed to--format=overall
. It now produces a richer JSON object that, in addition to the previous statistics about the run (which can be found in thestats
property) also records the most expensive predicates in the evaluation run.
Potentially Breaking Changes¶
- The
codeql resolve ml-model
command now requires one or more query specifications as command line arguments in order to determine the set of starting packs from which to initiate the resolution process. The command will locate all ML models in any qlpack that is a transitive dependency of any of the starting packs. Also, the output of the command has been expanded to include for each model the containing package’s name, version, and path. - The
buildMetadata
inside of compiled CodeQL packs no longer contains acreationTime
property. This was removed in order to ensure that the content of a CodeQL pack is identical when it is re-compiled. - The
codeql pack download
command, when used with the--dir
option, now downloads requested packs in directories corresponding to their version numbers. Previously,codeql pack download --dir ./somewhere codeql/java-queries@0.1.2
would download the pack into the./somewhere/codeql/java-queries
directory. Now, it will download the pack into the./somewhere/codeql/java-queries/0.1.2
directory. This allows you to download multiple versions of the same pack using a single command.
Bug Fixes¶
- Fixed a bug where
codeql pack download
, when used with the--dir
option, would not download a pack that is in the global package cache. - Fixed a bug where some versions of a CodeQL package could not be downloaded if there are more than 100 versions of this package in the package registry.
- Fixed a bug where the
--also-match
option forcodeql resolve files
andcodeql database index-files
does not work with relative paths. - Fixed a bug that caused
codeql query decompile
to ignore the--output
option when producing bytecode output (--kind=bytecode
), writing only tostdout
.
New Features¶
- You can now include diagnostic messages in the summary produced by the
--print-diagnostics-summary
option of thecodeql database interpret-results
andcodeql database analyze
commands by running these commands at high verbosity levels.
Query Packs¶
Major Analysis Improvements¶
Python¶
- Improved library modeling for the query “Request without certificate validation” (
py/request-without-cert-validation
), so it now also covershttpx
,aiohttp.client
, andurllib3
.
Minor Analysis Improvements¶
C#¶
- The syntax of the (source|sink|summary)model CSV format has been changed slightly for Java and C#. A new column called
provenance
has been introduced, where the allowed values aremanual
andgenerated
. The value used to indicate whether a model as been written by hand (manual
) or create by the CSV model generator (generated
). - All auto implemented public properties with public getters and setters on ASP.NET Core remote flow sources are now also considered to be tainted.
Java/Kotlin¶
- The query
java/log-injection
now reports problems at the source (user-controlled data) instead of at the ultimate logging call. This was changed because user functions that wrap the ultimate logging call could result in most alerts being reported in an uninformative location.
JavaScript/TypeScript¶
- The
js/resource-exhaustion
query no longer treats the 3-argument version ofBuffer.from
as a sink, since it does not allocate a new buffer.
Python¶
- The query “Use of a broken or weak cryptographic algorithm” (
py/weak-cryptographic-algorithm
) now reports if a cryptographic operation is potentially insecure due to use of a weak block mode.
Ruby¶
- The query “Use of a broken or weak cryptographic algorithm” (
rb/weak-cryptographic-algorithm
) now reports if a cryptographic operation is potentially insecure due to use of a weak block mode.
Language Libraries¶
Bug Fixes¶
C/C++¶
UserType.getADeclarationEntry()
now yields all forward declarations when the user type is aclass
,struct
, orunion
.
Minor Analysis Improvements¶
Java/Kotlin¶
- Added a flow step for
String.valueOf
calls on taintedandroid.text.Editable
objects.
JavaScript/TypeScript¶
- All new ECMAScript 2022 features are now supported.
Deprecated APIs¶
C/C++¶
- The
BarrierGuard
class has been deprecated. Such barriers and sanitizers can now instead be created using the newBarrierGuard
parameterized module.
C#¶
- The
BarrierGuard
class has been deprecated. Such barriers and sanitizers can now instead be created using the newBarrierGuard
parameterized module.
Golang¶
- The
BarrierGuard
class has been deprecated. Such barriers and sanitizers can now instead be created using the newBarrierGuard
parameterized module.
Java/Kotlin¶
- The
BarrierGuard
class has been deprecated. Such barriers and sanitizers can now instead be created using the newBarrierGuard
parameterized module.
Python¶
- The
BarrierGuard
class has been deprecated. Such barriers and sanitizers can now instead be created using the newBarrierGuard
parameterized module.
Ruby¶
- The
BarrierGuard
class has been deprecated. Such barriers and sanitizers can now instead be created using the newBarrierGuard
parameterized module.