|
| 1 | +.. _codeql-cli-2.23.7: |
| 2 | + |
| 3 | +========================== |
| 4 | +CodeQL 2.23.7 (2025-12-05) |
| 5 | +========================== |
| 6 | + |
| 7 | +.. contents:: Contents |
| 8 | + :depth: 2 |
| 9 | + :local: |
| 10 | + :backlinks: none |
| 11 | + |
| 12 | +This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the `code scanning section on the GitHub blog <https://github.blog/tag/code-scanning/>`__, `relevant GitHub Changelog updates <https://github.blog/changelog/label/application-security/>`__, `changes in the CodeQL extension for Visual Studio Code <https://marketplace.visualstudio.com/items/GitHub.vscode-codeql/changelog>`__, and the `CodeQL Action changelog <https://github.com/github/codeql-action/blob/main/CHANGELOG.md>`__. |
| 13 | + |
| 14 | +Security Coverage |
| 15 | +----------------- |
| 16 | + |
| 17 | +CodeQL 2.23.7 runs a total of 491 security queries when configured with the Default suite (covering 166 CWE). The Extended suite enables an additional 135 queries (covering 35 more CWE). 6 security queries have been added with this release. |
| 18 | + |
| 19 | +CodeQL CLI |
| 20 | +---------- |
| 21 | + |
| 22 | +Deprecations |
| 23 | +~~~~~~~~~~~~ |
| 24 | + |
| 25 | +* The :code:`--save-cache` flag to :code:`codeql database run-queries` and other commands that execute queries has been deprecated. This flag previously instructed the evaluator to aggressively write intermediate results to the disk cache, but now has no effect. |
| 26 | + |
| 27 | +Query Packs |
| 28 | +----------- |
| 29 | + |
| 30 | +Minor Analysis Improvements |
| 31 | +~~~~~~~~~~~~~~~~~~~~~~~~~~~ |
| 32 | + |
| 33 | +Java/Kotlin |
| 34 | +""""""""""" |
| 35 | + |
| 36 | +* Operations that extract only a fixed-length prefix or suffix of a string (for example, :code:`substring` in Java or :code:`take` in Kotlin), when limited to a length of at most 7 characters, are now treated as sanitizers for the :code:`java/sensitive-log` query. |
| 37 | + |
| 38 | +JavaScript/TypeScript |
| 39 | +""""""""""""""""""""" |
| 40 | + |
| 41 | +* Fixed a bug in the Next.js model that would cause the analysis to miss server-side taint sources in the :code:`app/pages` folder. |
| 42 | + |
| 43 | +Rust |
| 44 | +"""" |
| 45 | + |
| 46 | +* The :code:`rust/access-invalid-pointer` query has been improved with new flow sources and barriers. |
| 47 | + |
| 48 | +New Queries |
| 49 | +~~~~~~~~~~~ |
| 50 | + |
| 51 | +Golang |
| 52 | +"""""" |
| 53 | + |
| 54 | +* The :code:`go/cookie-http-only-not-set` query has been promoted from the experimental query pack. This query was originally contributed to the experimental query pack by @edvraa. |
| 55 | +* A new query :code:`go/cookie-secure-not-set` has been added to detect cookies without the :code:`Secure` flag set. |
| 56 | +* Added a new query, :code:`go/weak-crypto-algorithm`, to detect the use of a broken or weak cryptographic algorithm. A very simple version of this query was originally contributed as an `experimental query by @dilanbhalla <https://github.com/github/codeql-go/pull/284>`__. |
| 57 | +* Added a new query, :code:`go/weak-sensitive-data-hashing`, to detect the use of a broken or weak cryptographic hash algorithm on sensitive data. |
| 58 | + |
| 59 | +Rust |
| 60 | +"""" |
| 61 | + |
| 62 | +* Added a new query :code:`rust/xss`, to detect cross-site scripting security vulnerabilities. |
| 63 | +* Added a new query :code:`rust/disabled-certificate-check`, to detect disabled TLS certificate checks. |
| 64 | +* Added three example queries (:code:`rust/examples/empty-if`, :code:`rust/examples/simple-sql-injection` and :code:`rust/examples/simple-constant-password`) to help developers learn to write CodeQL queries for Rust. |
| 65 | + |
| 66 | +Language Libraries |
| 67 | +------------------ |
| 68 | + |
| 69 | +Bug Fixes |
| 70 | +~~~~~~~~~ |
| 71 | + |
| 72 | +Python |
| 73 | +"""""" |
| 74 | + |
| 75 | +* Fixed a bug in the Python extractor's import handling where failing to find an import in :code:`find_module` would cause a :code:`KeyError` to be raised. (Contributed by @akoeplinger.) |
| 76 | + |
| 77 | +Breaking Changes |
| 78 | +~~~~~~~~~~~~~~~~ |
| 79 | + |
| 80 | +Rust |
| 81 | +"""" |
| 82 | + |
| 83 | +* The type :code:`DataFlow::Node` is now based directly on the AST instead of the CFG, which means that predicates like :code:`asExpr()` return AST nodes instead of CFG nodes. |
| 84 | + |
| 85 | +Minor Analysis Improvements |
| 86 | +~~~~~~~~~~~~~~~~~~~~~~~~~~~ |
| 87 | + |
| 88 | +C/C++ |
| 89 | +""""" |
| 90 | + |
| 91 | +* The class :code:`DataFlow::FieldContent` now covers both :code:`union` and :code:`struct`\ /\ :code:`class` types. A new predicate :code:`FieldContent.getAField` has been added to access the union members associated with the :code:`FieldContent`. The old :code:`FieldContent` has been renamed to :code:`NonUnionFieldContent`. |
| 92 | + |
| 93 | +C# |
| 94 | +"" |
| 95 | + |
| 96 | +* Improved stability when downloading .NET versions by setting appropriate environment variables for :code:`dotnet` commands. The correct architecture-specific version of .NET is now downloaded on ARM runners. |
| 97 | +* Compilation errors are now included in the debug log when using build-mode none. |
| 98 | +* Added a new extractor option to specify a custom directory for dependency downloads in buildless mode. Use :code:`-O buildless_dependency_dir=<path>` to configure the target directory. |
| 99 | + |
| 100 | +JavaScript/TypeScript |
| 101 | +""""""""""""""""""""" |
| 102 | + |
| 103 | +* JavaScript :code:`DataFlow::globalVarRef` now recognizes :code:`document.defaultView` as an alias of :code:`window`, allowing flows such as :code:`document.defaultView.history.pushState(...)` to be modeled and found by queries relying on :code:`globalVarRef("history")`. |
| 104 | + |
| 105 | +Rust |
| 106 | +"""" |
| 107 | + |
| 108 | +* Added more detailed models for :code:`std::fs` and :code:`std::path`. |
| 109 | + |
| 110 | +Deprecated APIs |
| 111 | +~~~~~~~~~~~~~~~ |
| 112 | + |
| 113 | +Java/Kotlin |
| 114 | +""""""""""" |
| 115 | + |
| 116 | +* The SSA interface has been updated and all classes and several predicates have been renamed. See the qldoc for more specific migration information. |
0 commit comments