• The extractor has been changed to run after the traced compiler call. This allows inspecting compiler generated files, such as the output of source generators. With this change, .cshtml files and their generated .cshtml.g.cs counterparts are extracted on dotnet 6 and above.

• C#: Analysis of the dotnet test command supplied with a dll or exe file as argument no longer fails due to the addition of an erroneous -p:SharedCompilation=false argument.
• Deleted the deprecated WebConfigXML, ConfigurationXMLElement, LocationXMLElement, SystemWebXMLElement, SystemWebServerXMLElement, CustomErrorsXMLElement, and HttpRuntimeXMLElement classes from WebConfig.qll. The non-deprecated names with PascalCased Xml suffixes should be used instead.
• Deleted the deprecated Record class from both Types.qll and Type.qll.
• Deleted the deprecated StructuralComparisonConfiguration class from StructuralComparison.qll, use sameGvn instead.
• Deleted the deprecated isParameterOf predicate from the ParameterNode class.
• Deleted the deprecated SafeExternalAPICallable, ExternalAPIDataNode, UntrustedDataToExternalAPIConfig, UntrustedExternalAPIDataNode, and ExternalAPIUsedWithUntrustedData classes from ExternalAPIsQuery.qll. The non-deprecated names with PascalCased Api suffixes should be used instead.
• Updated the following C# sink kind names. Any custom data extensions that use these sink kinds will need to be updated accordingly in order to continue working.
  • code to code-injection
  • sql to sql-injection
  • html to html-injection
  • xss to js-injection
  • remote to file-content-store

• The cs/log-forging, cs/cleartext-storage, and cs/exposure-of-sensitive-information queries now correctly handle unsanitized arguments to ILogger extension methods.
• Updated the neutralModel extensible predicate to include a kind column.

No user-facing changes.

• The recently introduced new data flow and taint tracking APIs have had a number of module and predicate renamings. The old APIs remain in place for now.

• Fixed some accidental predicate visibility in the backwards-compatible wrapper for data flow configurations. In particular DataFlow::hasFlowPath, DataFlow::hasFlow, DataFlow::hasFlowTo, and DataFlow::hasFlowToExpr were accidentally exposed in a single version.

No user-facing changes.

• Added support for merging two PathGraphs via disjoint union to allow results from multiple data flow computations in a single path-problem query.

• The main data flow and taint tracking APIs have been changed. The old APIs remain in place for now and translate to the new through a backwards-compatible wrapper. If multiple configurations are in scope simultaneously, then this may affect results slightly. The new API is quite similar to the old, but makes use of a configuration module instead of a configuration class.

• Deleted the deprecated getPath and getFolder predicates from the XmlFile class.
• Deleted the deprecated getAssertionIndex, and getAssertedParameter predicates from the AssertMethod class.
• Deleted the deprecated OverridableMethod and OverridableAccessor classes.
• The unsafe predicate for Modifiable has been extended to cover delegate return types and identify pointer-like types at any nest level. This is relevant for unsafe declarations extracted from assemblies.

• The query cs/static-field-written-by-instance is updated to handle properties.
• C# 11: Support for explicit interface member implementation of operators.
• The extraction of member modifiers has been generalized, which could lead to the extraction of more modifiers.
• C# 11: Added extractor and library support for file scoped types.
• C# 11: Added extractor support for required fields and properties.
• C# 11: Added library support for checked operators.

• C# 11: Added extractor support for the scoped modifier annotation on parameters and local variables.

• Add extractor and library support for UTF-8 encoded strings.
• The StringLiteral class includes UTF-8 encoded strings.
• In the DB Scheme @string_literal_expr is renamed to @utf16_string_literal_expr.

• C# 11: Added extractor support for ref fields in ref struct declarations.

• Added library support for generic attributes (also for CIL extracted attributes).
• cil.ConstructedType::getName was changed to include printing of the type arguments.

• Attributes on methods in CIL are now extracted (Bugfix).
• Support for static virtual and static abstract interface members.
• Support for operators in interface definitions.
• C# 11: Added support for the unsigned right shift >>> and unsigned right shift assignment >>>= operators.
• Query id's have been aligned such that they are prefixed with cs instead of csharp.

• C# 11: Added support for list- and slice patterns in the extractor.
• Deleted the deprecated getNameWithoutBrackets predicate from the ValueOrRefType class in Type.qll.
• Element::hasQualifiedName/1 has been deprecated. Use hasQualifiedName/2 or hasQualifiedName/3 instead.
• Added TCP/UDP sockets as taint sources.

No user-facing changes.

No user-facing changes.

• The [Summary|Sink|Source]ModelCsv classes have been deprecated and Models as Data models are defined as data extensions instead.

No user-facing changes.

No user-facing changes.

• DateTime expressions are now considered simple type sanitizers. This affects a wide range of security queries.
• ASP.NET Core controller definition has been made more precise. The amount of introduced taint sources or eliminated false positives should be low though, since the most common pattern is to derive all user defined ASP.NET Core controllers from the standard Controller class, which is not affected.

• Some classes/modules with upper-case acronyms in their name have been renamed to follow our style-guide. The old name still exists as a deprecated alias.

• Fixed an issue in the taint tracking analysis where implicit reads were not allowed by default in sinks or additional taint steps that used flow states.

• Many classes/predicates/modules with upper-case acronyms in their name have been renamed to follow our style-guide. The old name still exists as a deprecated alias.

• All deprecated predicates/classes/modules that have been deprecated for over a year have been deleted.

• The BarrierGuard class has been deprecated. Such barriers and sanitizers can now instead be created using the new BarrierGuard parameterized module.

• The signature of allowImplicitRead on DataFlow::Configuration and TaintTracking::Configuration has changed from allowImplicitRead(DataFlow::Node node, DataFlow::Content c) to allowImplicitRead(DataFlow::Node node, DataFlow::ContentSet c).

• The recently added flow-state versions of isBarrierIn, isBarrierOut, isSanitizerIn, and isSanitizerOut in the data flow and taint tracking libraries have been removed.

• The flow state variants of isBarrier and isAdditionalFlowStep are no longer exposed in the taint tracking library. The isSanitizer and isAdditionalTaintStep predicates should be used instead.

• Many classes/predicates/modules that had upper-case acronyms have been renamed to follow our style-guide. The old name still exists as a deprecated alias.

• The data flow and taint tracking libraries have been extended with versions of isBarrierIn, isBarrierOut, and isBarrierGuard, respectively isSanitizerIn, isSanitizerOut, and isSanitizerGuard, that support flow states.

• All deprecated predicates/classes/modules that have been deprecated for over a year have been deleted.

• The C# extractor no longer supports the following legacy environment variables:

ODASA_BUILD_ERROR_DIR
ODASA_CSHARP_LAYOUT
ODASA_SNAPSHOT
SEMMLE_DIST
SEMMLE_EXTRACTOR_OPTIONS
SEMMLE_PLATFORM_TOOLS
SEMMLE_PRESERVE_SYMLINKS
SOURCE_ARCHIVE
TRAP_FOLDER

• codeql test run now extracts source code recursively from sub folders. This may break existing tests that have other tests in nested sub folders, as those will now get the nested test code included.

• Added support for C# 10 lambda improvements
  • Explicit return types on lambda expressions.
  • Lambda expression can be tagged with method and return value attributes.
• Added support for C# 10 Extended property patterns.
• Return value attributes are extracted.
• The QL Attribute class now has subclasses for each kind of attribute.

• The codeql/csharp-upgrades CodeQL pack has been removed. All upgrades scripts have been merged into the codeql/csharp-all CodeQL pack.

Added support for the following C# 10 features.

• Record structs.
• Improvements of structure types.
  • Instance parameterless constructor in a structure type.
  • Enhance WithExpr in QL to support structs and anonymous classes.
• Global using directives.
• File-scoped namespace declaration.
• Enhanced #line pragma.

• The query cs/local-shadows-member no longer highlights parameters of record types.