|
5 | 5 | * Added a new query, `java/summary/generated-vs-manual-coverage`, to expose metrics for the number of API endpoints covered by generated versus manual MaD models. |
6 | 6 | * Added a new query, `java/telemetry/supported-external-api`, to detect supported 3rd party APIs used in a codebase. |
7 | 7 | * Added a new query, `java/android/missing-certificate-pinning`, to find network calls where certificate pinning is not implemented. |
8 | | -* Added a new query `java/android-webview-addjavascriptinterface` to detect the use of `addJavascriptInterface`, which can lead to cross-site scripting. |
9 | | -* Added a new query `java/android-websettings-file-access` to detect configurations that enable file system access in Android WebViews. |
| 8 | +* Added a new query, `java/android-webview-addjavascriptinterface`, to detect the use of `addJavascriptInterface`, which can lead to cross-site scripting. |
| 9 | +* Added a new query, `java/android-websettings-file-access`, to detect configurations that enable file system access in Android WebViews. |
10 | 10 | * Added a new query, `java/android-websettings-javascript-enabled`, to detect if JavaScript execution is enabled in an Android WebView. |
11 | | -* The query, `java/regex-injection`, has been promoted from experimental to the main query pack. Its results will now appear by default. This query was originally [submitted as an experimental query by @edvraa](https://github.com/github/codeql/pull/5704). |
| 11 | +* The query `java/regex-injection` has been promoted from experimental to the main query pack. Its results will now appear by default. This query was originally [submitted as an experimental query by @edvraa](https://github.com/github/codeql/pull/5704). |
12 | 12 |
|
13 | 13 | ### Minor Analysis Improvements |
14 | 14 |
|
15 | | -* The `AlertSuppression.ql` query has been updated to support the new `// codeql[query-id]` supression comments. These comments can be used to suppress an alert and must be placed on a blank line before the alert. In addition the legacy `// lgtm` and `// lgtm[query-id]` comments can now also be place on the line before an alert. |
16 | | -* The extensible predicates for Models as Data have been renamed (the `ext` prefix has been removed). As an example `extSummaryModel` has been renamed to `summaryModel`. |
| 15 | +* The `AlertSuppression.ql` query has been updated to support the new `// codeql[query-id]` supression comments. These comments can be used to suppress an alert and must be placed on a blank line before the alert. In addition the legacy `// lgtm` and `// lgtm[query-id]` comments can now also be placed on the line before an alert. |
| 16 | +* The extensible predicates for Models as Data have been renamed (the `ext` prefix has been removed). As an example, `extSummaryModel` has been renamed to `summaryModel`. |
17 | 17 | * The query `java/misnamed-type` is now enabled for Kotlin. |
18 | 18 | * The query `java/non-serializable-field` is now enabled for Kotlin. |
19 | 19 | * Fixed an issue in the query `java/android/implicit-pendingintents` by which an implicit Pending Intent marked as immutable was not correctly recognized as such. |
|
0 commit comments