- The recently added flow-state versions of
isBarrierIn
,isBarrierOut
,isSanitizerIn
, andisSanitizerOut
in the data flow and taint tracking libraries have been removed.
- Queries importing a data-flow configuration from
semmle.python.security.dataflow
should ensure that the imported file ends withQuery
, and only import its top-level module. For example, a query that usedCommandInjection::Configuration
fromsemmle.python.security.dataflow.CommandInjection
should from now useConfiguration
fromsemmle.python.security.dataflow.CommandInjectionQuery
instead.
- Added data-flow for Django ORM models that are saved in a database (no
models.ForeignKey
support).
- Improved modeling of Flask
Response
objects, so passing a response body with the keyword argumentresponse
is now recognized.