Contents
This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the code scanning section on the GitHub blog, relevant GitHub Changelog updates, changes in the CodeQL extension for Visual Studio Code, and the CodeQL Action changelog.
CodeQL 2.10.0 runs a total of 339 security queries when configured with the Default suite (covering 142 CWE). The Extended suite enables an additional 104 queries (covering 30 more CWE). 4 security queries have been added with this release.
The --format=stats option of codeql generate log-summary has been renamed to --format=overall. It now produces a richer JSON object that, in addition to the previous statistics about the run (which can be found in the stats property) also records the most expensive predicates in the evaluation run.
The codeql resolve ml-model command now requires one or more query specifications as command line arguments in order to determine the set of starting packs from which to initiate the resolution process. The command will locate all ML models in any qlpack that is a transitive dependency of any of the starting packs. Also, the output of the command has been expanded to include for each model the containing package’s name, version, and path.
The buildMetadata inside of compiled CodeQL packs no longer contains a creationTime property. This was removed in order to ensure that the content of a CodeQL pack is identical when it is re-compiled.
The codeql pack download command, when used with the --dir option, now downloads requested packs in directories corresponding to their version numbers. Previously, codeql pack download --dir ./somewhere codeql/java-queries@0.1.2 would download the pack into the ./somewhere/codeql/java-queries directory. Now, it will download the pack into the ./somewhere/codeql/java-queries/0.1.2 directory. This allows you to download multiple versions of the same pack using a single command.
Fixed a bug where codeql pack download, when used with the --dir option, would not download a pack that is in the global package cache.
Fixed a bug where some versions of a CodeQL package could not be downloaded if there are more than 100 versions of this package in the package registry.
Fixed a bug where the --also-match option for codeql resolve files and codeql database index-files does not work with relative paths.
Fixed a bug that caused codeql query decompile to ignore the --output option when producing bytecode output (--kind=bytecode), writing only to stdout.
You can now include diagnostic messages in the summary produced by the --print-diagnostics-summary option of the codeql database interpret-results and codeql database analyze commands by running these commands at high verbosity levels.
Improved library modeling for the query “Request without certificate validation” (py/request-without-cert-validation), so it now also covers httpx, aiohttp.client, and urllib3.
The syntax of the (source|sink|summary)model CSV format has been changed slightly for Java and C#. A new column called provenance has been introduced, where the allowed values are manual and generated. The value used to indicate whether a model as been written by hand (manual) or create by the CSV model generator (generated).
All auto implemented public properties with public getters and setters on ASP.NET Core remote flow sources are now also considered to be tainted.
The query java/log-injection now reports problems at the source (user-controlled data) instead of at the ultimate logging call. This was changed because user functions that wrap the ultimate logging call could result in most alerts being reported in an uninformative location.
The js/resource-exhaustion query no longer treats the 3-argument version of Buffer.from as a sink, since it does not allocate a new buffer.
The query “Use of a broken or weak cryptographic algorithm” (py/weak-cryptographic-algorithm) now reports if a cryptographic operation is potentially insecure due to use of a weak block mode.
The query “Use of a broken or weak cryptographic algorithm” (rb/weak-cryptographic-algorithm) now reports if a cryptographic operation is potentially insecure due to use of a weak block mode.
Added a new query, rb/improper-memoization. The query finds cases where the parameter of a memoization method is not used in the memoization key.
The kind query metadata was changed to diagnostic on cs/compilation-error, cs/compilation-message, cs/extraction-error, and cs/extraction-message.
UserType.getADeclarationEntry() now yields all forward declarations when the user type is a class, struct, or union.
Added support for TypeScript 4.7.
Added a flow step for String.valueOf calls on tainted android.text.Editable objects.
All new ECMAScript 2022 features are now supported.
The BarrierGuard class has been deprecated. Such barriers and sanitizers can now instead be created using the new BarrierGuard parameterized module.
The BarrierGuard class has been deprecated. Such barriers and sanitizers can now instead be created using the new BarrierGuard parameterized module.
The BarrierGuard class has been deprecated. Such barriers and sanitizers can now instead be created using the new BarrierGuard parameterized module.
The BarrierGuard class has been deprecated. Such barriers and sanitizers can now instead be created using the new BarrierGuard parameterized module.
The BarrierGuard class has been deprecated. Such barriers and sanitizers can now instead be created using the new BarrierGuard parameterized module.
The BarrierGuard class has been deprecated. Such barriers and sanitizers can now instead be created using the new BarrierGuard parameterized module.