Contents
This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the code scanning section on the GitHub blog, relevant GitHub Changelog updates, changes in the CodeQL extension for Visual Studio Code, and the CodeQL Action changelog.
CodeQL 2.22.2 runs a total of 474 security queries when configured with the Default suite (covering 166 CWE). The Extended suite enables an additional 130 queries (covering 32 more CWE).
Fixes a bug in query suites where the version property of an import instruction was ignored. Previously, the following query suite would not resolve to v1.0.19 of codeql/csharp-queries. Instead it would resolve to the latest version. This is now fixed and the resolve pack version would be v1.0.19.
web.config and web.release.config files are now recognized regardless of case. This means queries cs/web/debug-binary and cs/web/missing-x-frame-options may produce more results than before.
The Type and Symbol classes have been deprecated and will be empty in newly extracted databases, since the TypeScript extractor no longer populates them. This is a breaking change for custom queries that explicitly relied on these classes. Such queries will still compile, but with deprecation warnings, and may have different query results due to type information no longer being available. We expect most custom queries will not be affected, however. If a custom query has no deprecation warnings, it should not be affected by this change. Uses of getType() should be rewritten to use the new getTypeBinding() or getNameBinding() APIs instead. If the new API is not sufficient, please consider opening an issue in github/codeql describing your use-case.
The TypeScript extractor no longer relies on the TypeScript compiler for extracting type information. Instead, the information we need from types is now derived by an algorithm written in QL. This results in more robust extraction with faster extraction times, in some cases significantly faster.
Taint is now tracked through the React use function.
Parameters of React server functions, marked with the "use server" directive, are now seen as taint sources.
Due to changes in the FunctionWithWrappers library (semmle.code.cpp.security.FunctionWithWrappers) the primary alert location generated by the queries cpp/path-injection, cpp/sql-injection, cpp/tainted-format-string, and cpp/command-line-injection may have changed.
Added flow models for the Win32 API functions CreateThread, CreateRemoteThread, and CreateRemoteThreadEx.
Improved support for dataflow through function objects and lambda expressions.
Added flow models for pthread_create and std::thread.
The cpp/incorrect-string-type-conversion query no longer alerts on incorrect type conversions that occur in unreachable code.
Added flow models for the GNU C Library.
Fixed a number of false positives and false negatives in cpp/global-use-before-init. Note that this query is not part of any of the default query suites.
The query cpp/sql-injection now can be extended using the sql-injection Models as Data (MaD) sink kind.
Explicitly added summary models for all overloads of System.Xml.XmlDictionaryReader.CreateBinaryReader. Added models for some of the methods and properties in System.Runtime.Serialization.SerializationInfo and System.Runtime.Serialization.SerializationInfoEnumerator. Updated models for System.Text.Encoding.GetBytes, System.Text.Encoding.GetChars and the constructor for System.IO.MemoryStream. This generally improves the library modelling and thus reduces the number of false negatives.
Added explicit SQL injection Models as Data models for Microsoft.Data.SqlClient.SqlCommand and Microsoft.Data.SqlClient.SqlDataAdapter. This reduces false negatives for the query cs/sql-injection.
filepath.IsLocal is now recognized as a sanitizer against path-traversal and related vulnerabilities.
Java analysis of guards has been switched to use the new and improved shared guards library. This improves precision of a number of queries, in particular java/dereferenced-value-may-be-null, which now has fewer false positives, and java/useless-null-check and java/constant-comparison, which gain additional true positives.
Removed three queries from the JS qlpack, which have been superseded by newer queries that are part of the Actions qlpack:
js/actions/pull-request-target has been superseded by actions/untrusted-checkout/{medium,high,critical}
js/actions/actions-artifact-leak has been superseded by actions/secrets-in-artifacts
js/actions/command-injection has been superseded by actions/command-injection/{medium,critical}
Added a new query, rust/access-after-lifetime-ended, for detecting pointer dereferences after the lifetime of the pointed-to object has ended.
The JavaScript extractor no longer ignores source files specified in the tsconfig.json compiler options outDir if doing so would result in excluding all source code.
The Python parser is now able to correctly parse expressions such as match[1] and match() where match is not used as a keyword.
The actions/artifact-poisoning/critical and actions/artifact-poisoning/medium queries now exclude artifacts downloaded to $[{ runner.temp }} in addition to /tmp.
Most classes and predicates in the AST, SSA, and control-flow-graph libraries are now annotated with overlay[local], in preparation for incremental analysis. This could result in compiler errors for custom queries if they extend these classes. To mitigate such errors, look for ways to restructure custom QL code so it doesn’t depend on changing the behavior of standard-library classes.
The FunctionWithWrappers library (semmle.code.cpp.security.FunctionWithWrappers) no longer considers calls through function pointers as wrapper functions.
The analysis of C/C++ code targeting 64-bit Arm platforms has been improved. This includes support for the Arm-specific builtin functions, support for the arm_neon.h header and Neon vector types, and support for the fp8 scalar type. The arm_sve.h header and scalable vectors are only partially supported at this point.
Added support for __fp16 _Complex and __bf16 _Complex types
Added sql-injection sink models for the Oracle Call Interface (OCI) database library functions OCIStmtPrepare and OCIStmtPrepare2.
Added models for the Head function and the Client.Head method, from the net/http package, to the Http::ClientRequest class. This means that they will be recognized as sinks for the query go/request-forgery and the experimental query go/ssrf.
Previously, DefinedType.getBaseType gave the underlying type. It now gives the right hand side of the type declaration, as the documentation indicated that it should.
The qualifiers of a calls to readObject on any classes that implement java.io.ObjectInput are now recognised as sinks for java/unsafe-deserialization. Previously this was only the case for classes which extend java.io.ObjectInputStream.
Enhanced modeling for the execa library, adding support for command execution methods execaCommand, execaCommandSync, $, and $.sync, as well as file system operations through inputFile, pipeStdout, pipeAll, and pipeStderr.
Type annotations such as foo : Bar are now treated by the call graph as an indication that foo may be an instance of Bar.
Type inference has been extended to support pattern matching.
Call resolution for calls to associated functions has been improved, so it now disambiguates the targets based on type information at the call sites (either type information about the arguments or about the expected return types).
Type inference has been improved for for loops and range expressions, which improves call resolution and may ultimately lead to more query results.
Implemented support for data flow through trait functions. For the purpose of data flow, calls to trait functions dispatch to all possible implementations.
AssocItem and ExternItem are now proper subclasses of Item.
Added type inference for for loops and array expressions.
The UnknownDefaultLocation, UnknownExprLocation, and UnknownStmtLocation classes have been deprecated. Use UnknownLocation instead.
The class BuiltinType is now deprecated. Use the new replacement BuiltinTypeEntity instead.
The class DeclaredType is now deprecated. Use the new replacement DeclaredTypeEntity instead.
The module semmle.code.java.frameworks.Castor has been deprecated and will be removed in a future release.
The module semmle.code.java.frameworks.JYaml has been deprecated and will be removed in a future release.
The classes UnsafeHessianInputReadObjectMethod and BurlapInputReadObjectMethod in the module semmle.code.java.frameworks.HessianBurlap have been deprecated and will be removed in a future release.
The class YamlBeansReaderReadMethod in the module semmle.code.java.frameworks.YamlBeans has been deprecated and will be removed in a future release.
The class MethodApacheSerializationUtilsDeserialize in the module semmle.code.java.frameworks.apache.Lang has been deprecated and will be removed in a future release.
Added a isFinalValueOfParameter predicate to DataFlow::Node which holds when a dataflow node represents the final value of an output parameter of a function.
Added a new predicate, getASuperType(), to get a direct supertype of this type.
You can now add sinks for the query “Deserialization of user-controlled data” (java/unsafe-deserialization) using data extensions by extending sinkModel and using the kind “unsafe-deserialization”. The existing sinks that do not require extra logic to determine if they are unsafe are now defined in this way.
Initial release. Moves the shared concepts library into its own qlpack.