Contents
This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the code scanning section on the GitHub blog, relevant GitHub Changelog updates, changes in the CodeQL extension for Visual Studio Code, and the CodeQL Action changelog.
CodeQL 2.8.0 runs a total of 298 security queries when configured with the Default suite (covering 136 CWE). The Extended suite enables an additional 93 queries (covering 30 more CWE). 14 security queries have been added with this release.
The CodeQL Action versions up to and including version 1.0.22 are not compatible with the CodeQL CLI 2.8.0 and later. The CLI will emit an error if it detects that it is being used by an incompatible version of the codeql-action.
Fixed a bug where codeql resolve upgrades ignores the --target-dbscheme option.
A new extractor option has been added to the Java extractor. The flag --extractor-option exclude='<glob>' allows specifying a glob that describes which paths need to be excluded from extraction but still need to be compiled. This is useful when some files are necessary for a successful build but are uninteresting for analysis.
See also: https://codeql.github.com/docs/codeql-cli/extractor-options/
Summary metrics can now associate messages with their results, for instance to report the name and number of uses of a particular API endpoint within a repository. To associate messages with summary metrics, define a query with @kind metric and @tags summary metadata and use either the location, message, value or the message, value results pattern.
User names and other account information is no longer considered to be sensitive data for the queries py/clear-text-logging-sensitive-data and py/clear-text-storage-sensitive-data, since this lead to many false positives.
Fix an issue with the cpp/declaration-hides-variable query where it would report variables that are unnamed in a database.
The cpp/cleartext-storage-file query has been upgraded with non-local taint flow and has been converted to a path-problem query.
The cpp/return-stack-allocated-memory query has been improved to produce fewer false positives. The query has also been converted to a path-problem query.
The “Cleartext transmission of sensitive information” (cpp/cleartext-transmission) query has been improved in several ways to reduce false positive results.
The “Potential improper null termination” (cpp/improper-null-termination) query now produces fewer false positive results around control flow branches and loops.
Added exception for GLib’s gboolean to cpp/ambiguously-signed-bit-field. This change reduces the number of false positives in the query.
The query rb/csrf-protection-disabled has been extended to find calls to the Rails method protect_from_forgery that may weaken CSRF protection.
The security tag has been added to the cpp/return-stack-allocated-memory query. As a result, its results will now appear by default.
The “Uncontrolled data in arithmetic expression” (cpp/uncontrolled-arithmetic) query has been enhanced to reduce false positive results and its @precision increased to high.
A new cpp/very-likely-overrunning-write query has been added to the default query suite for C/C++. The query reports some results that were formerly flagged by cpp/overrunning-write.
A new query “Use of implicit PendingIntents” (java/android/pending-intents) has been added. This query finds implicit and mutable PendingIntents sent to an unspecified third party component, which may provide an attacker with access to internal components of the application or cause other unintended effects.
Two new queries, “Android fragment injection” (java/android/fragment-injection) and “Android fragment injection in PreferenceActivity” (java/android/fragment-injection-preference-activity) have been added. These queries find exported Android activities that instantiate and host fragments created from user-provided data. Such activities are vulnerable to access control bypass and expose the Android application to unintended effects.
The query “TrustManager that accepts all certificates” (java/insecure-trustmanager) has been promoted from experimental to the main query pack. Its results will now appear by default. This query was originally submitted as an experimental query by @intrigus-lgtm.
The query “Log Injection” (java/log-injection) has been promoted from experimental to the main query pack. Its results will now appear by default. The query was originally submitted as an experimental query by @porcupineyhairs and @dellalibera.
A new query “Intent URI permission manipulation” (java/android/intent-uri-permission-manipulation) has been added. This query finds Android components that return unmodified, received Intents to the calling applications, which can provide unintended access to internal content providers of the victim application.
A new query “Cleartext storage of sensitive information in the Android filesystem” (java/android/cleartext-storage-filesystem) has been added. This query finds instances of sensitive data being stored in local files without encryption, which may expose it to attackers or malicious applications.
The query “Cleartext storage of sensitive information using SharedPreferences on Android” (java/android/cleartext-storage-shared-prefs) has been promoted from experimental to the main query pack. Its results will now appear by default. This query was originally submitted as an experimental query by @luchua-bc.
The query “Unsafe certificate trust” (java/unsafe-cert-trust) has been promoted from experimental to the main query pack. Its results will now appear by default. This query was originally submitted as an experimental query by @luchua-bc.
A new query js/samesite-none-cookie has been added. The query detects when the SameSite attribute is set to None on a sensitive cookie.
A new query js/empty-password-in-configuration-file has been added. The query detects empty passwords in configuration files. The query is not run by default.
Added a new query, rb/weak-cookie-configuration. The query finds cases where cookie configuration options are set to values that may make an application more vulnerable to certain attacks.
The “Random used only once” (java/random-used-once) query no longer has a security-severity score. This has been causing some tools to categorise it as a security query, when it is more useful as a code-quality query.
Added support for the following C# 10 features.
Improvements of structure types.
Instance parameterless constructor in a structure type.
Enhance WithExpr in QL to support structs and anonymous classes.
FormatLiteral::getMaxConvertedLength now uses range analysis to provide a more accurate length for integers formatted with %x
The query cs/local-shadows-member no longer highlights parameters of record types.
The codeql/cpp-upgrades CodeQL pack has been removed. All upgrades scripts have been merged into the codeql/cpp-all CodeQL pack.
The codeql/csharp-upgrades CodeQL pack has been removed. All upgrades scripts have been merged into the codeql/csharp-all CodeQL pack.
The codeql/java-upgrades CodeQL pack has been removed. All upgrades scripts have been merged into the codeql/java-all CodeQL pack.
The codeql/javascript-upgrades CodeQL pack has been removed. All upgrades scripts have been merged into the codeql/javascript-all CodeQL pack.
Moved the files defining regex injection configuration and customization, instead of import semmle.python.security.injection.RegexInjection please use import semmle.python.security.dataflow.RegexInjection (the same for RegexInjectionCustomizations).
The codeql/python-upgrades CodeQL pack has been removed. All upgrades scripts have been merged into the codeql/python-all CodeQL pack.