Skip to content

Java: Add deprecation notice to change notes. #677

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
semmle-qlci merged 1 commit into from
Dec 12, 2018
Merged

Java: Add deprecation notice to change notes. #677

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions change-notes/1.19/analysis-java.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,11 @@ to run queries and explore the data flow in results.

## Changes to QL libraries

* The class `ControlFlowNode` (and by extension `BasicBlock`) has until now
been directly equatable to `Expr` and `Stmt`. Exploiting these equalities,
for example by using casts, is now deprecated, and the conversions
`Expr.getControlFlowNode()` and `Stmt.getControlFlowNode()` should be used
instead.
Copy link
Contributor

@felicitymay felicitymay Dec 12, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it worth including an example of before and after, or is this obvious to users?

Copy link
Contributor Author

@aschackmull aschackmull Dec 12, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is mostly a warning about a breaking change we've agreed to put in 1.20, which we've convinced ourselves hopefully won't affect too many. The easiest is to just ignore the 1.19 deprecation and fix any compile errors when upgrading to 1.20, so we'll add more information in the 1.20 change notes.

Copy link
Contributor

@felicitymay felicitymay Dec 12, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Okay - makes sense. I've raised https://jira.semmle.com/browse/SD-2920 for the changes required to publish this change for 1.19.

* The default set of taint sources in the `FlowSources` library is extended to
cover parameters annotated with Spring framework annotations indicating
remote user input from servlets. This affects all security queries, which
Expand Down