Skip to content

6.0.0.md

Latest commit

 

History

History
38 lines (28 loc) · 2.29 KB

6.0.0.md

File metadata and controls

38 lines (28 loc) · 2.29 KB

6.0.0

Breaking Changes

  • The C# control flow graph (CFG) implementation has been completely rewritten. The CFG now includes additional nodes to more accurately represent certain constructs. This also means that any existing code that implicitly relies on very specific details about the CFG may need to be updated. The CFG no longer uses splitting, which means that AST nodes now have a unique CFG node representation. Additionally, the following breaking changes have been made:
    • ControlFlow::Node has been renamed to ControlFlowNode.
    • ControlFlow::Nodes has been renamed to ControlFlowNodes.
    • BasicBlock.getCallable has been renamed to BasicBlock.getEnclosingCallable.
    • BasicBlocks.qll has been deleted.
    • ControlFlowNode.getAstNode has changed its meaning. The AST-to-CFG mapping remains one-to-many, but now for a different reason. It used to be because of splitting, but now it's because of additional "helper" CFG nodes. To get the (now canonical) CFG node for a given AST node, use ControlFlowNode.asExpr() or ControlFlowNode.asStmt() or ControlFlowElement.getControlFlowNode() instead.

Deprecated APIs

  • The QL classes in the C# SSA library have been renamed to improve consistency between languages. Any custom QL code that makes use of SSA needs to be updated. The old classes have been deprecated and include more detailed migration instructions in their qldoc.

New Features

Major Analysis Improvements

  • When resolving dependencies in build-mode: none, dotnet restore now explicitly receives reachable NuGet feeds configured in nuget.config when feed responsiveness checking is enabled (the default), and any private registries directly, improving reliability when default feeds are unavailable or restricted.

Minor Analysis Improvements

  • Expanded ASP and ASP.NET remote source modeling to cover additional sources, including fields of tainted parameters as well as properties and fields that become tainted transitively.
  • C# 14: Added support for user-defined compound assignment operators.