FilesExpand file tree

 codeql-cli/latest

/

1.1.2.md

Copy path

BlameMore file actions

BlameMore file actions

Latest commit

 

History

History

History

8 lines (6 loc) · 945 Bytes

 codeql-cli/latest

/

1.1.2.md

Top

File metadata and controls

• Preview
• Code
• Blame

8 lines (6 loc) · 945 Bytes

Raw

Copy raw file

Download raw file

Outline

Edit and raw actions

1.1.2

Minor Analysis Improvements

• Variables names containing the string "tokenizer" (case-insensitively) are no longer sources for the java/sensitive-log query. They normally relate to things like java.util.StringTokenizer, which are not sensitive information. This should fix some false positive alerts.
• The query "Unused classes and interfaces" (java/unused-reference-type) now recognizes that if a method of a class has an annotation then it may be accessed reflectively. This should remove false positive alerts, especially for JUnit 4-style tests annotated with @test.
• Alerts about exposing exception.getMessage() in servlet responses are now split out of java/stack-trace-exposure into its own query java/error-message-exposure.
• Added the extensible abstract class SensitiveLoggerSource. Now this class can be extended to add more sources to the java/sensitive-log query or for customizations overrides.