chore: bump pinned CodeQL CLI to v2.25.6 and release v0.6.0

.codeqlversion

@@ -1 +1 @@
-2.24.3
+2.25.6

.release.yml

@@ -1,6 +1,6 @@
 name: "CodeQL Community Packs"
 repository: "githubsecuritylab/codeql-community-packs"
-version: "0.5.1"
+version: "0.6.0"
 prerelease: false
 
 ecosystem: CodeQL

cpp/lib/codeql-pack.lock.yml

@@ -2,27 +2,27 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/controlflow:
-    version: 2.0.27
+    version: 2.0.35
   codeql/cpp-all:
-    version: 8.0.0
+    version: 10.2.0
   codeql/dataflow:
-    version: 2.0.27
+    version: 2.1.7
   codeql/mad:
-    version: 1.0.43
+    version: 1.0.51
   codeql/quantum:
-    version: 0.0.21
+    version: 0.0.29
   codeql/rangeanalysis:
-    version: 1.0.43
+    version: 1.0.51
   codeql/ssa:
-    version: 2.0.19
+    version: 2.0.27
   codeql/tutorial:
-    version: 1.0.43
+    version: 1.0.51
   codeql/typeflow:
-    version: 1.0.43
+    version: 1.0.51
   codeql/typetracking:
-    version: 2.0.27
+    version: 2.0.35
   codeql/util:
-    version: 2.0.30
+    version: 2.0.38
   codeql/xml:
-    version: 1.0.43
+    version: 1.0.51
 compiled: false

cpp/lib/qlpack.yml

@@ -1,5 +1,5 @@
 library: true 
 name: githubsecuritylab/codeql-cpp-libs
-version: 0.5.1
+version: 0.6.0
 dependencies:
-  codeql/cpp-all: '8.0.0'
+  codeql/cpp-all: '10.2.0'

cpp/src/codeql-pack.lock.yml

@@ -2,31 +2,31 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/controlflow:
-    version: 2.0.27
+    version: 2.0.35
   codeql/cpp-all:
-    version: 8.0.0
+    version: 10.2.0
   codeql/cpp-queries:
-    version: 1.5.12
+    version: 1.6.4
   codeql/dataflow:
-    version: 2.0.27
+    version: 2.1.7
   codeql/mad:
-    version: 1.0.43
+    version: 1.0.51
   codeql/quantum:
-    version: 0.0.21
+    version: 0.0.29
   codeql/rangeanalysis:
-    version: 1.0.43
+    version: 1.0.51
   codeql/ssa:
-    version: 2.0.19
+    version: 2.0.27
   codeql/suite-helpers:
-    version: 1.0.43
+    version: 1.0.51
   codeql/tutorial:
-    version: 1.0.43
+    version: 1.0.51
   codeql/typeflow:
-    version: 1.0.43
+    version: 1.0.51
   codeql/typetracking:
-    version: 2.0.27
+    version: 2.0.35
   codeql/util:
-    version: 2.0.30
+    version: 2.0.38
   codeql/xml:
-    version: 1.0.43
+    version: 1.0.51
 compiled: false

cpp/src/qlpack.yml

@@ -1,9 +1,9 @@
 library: false
 name: githubsecuritylab/codeql-cpp-queries
-version: 0.5.1
+version: 0.6.0
 suites: suites
 defaultSuiteFile: suites/cpp.qls
 dependencies:
-  codeql/cpp-all: '8.0.0'
-  codeql/cpp-queries: '1.5.12'
+  codeql/cpp-all: '10.2.0'
+  codeql/cpp-queries: '1.6.4'
   githubsecuritylab/codeql-cpp-libs: '*'

cpp/test/codeql-pack.lock.yml

@@ -2,31 +2,31 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/controlflow:
-    version: 2.0.27
+    version: 2.0.35
   codeql/cpp-all:
-    version: 8.0.0
+    version: 10.2.0
   codeql/cpp-queries:
-    version: 1.5.12
+    version: 1.6.4
   codeql/dataflow:
-    version: 2.0.27
+    version: 2.1.7
   codeql/mad:
-    version: 1.0.43
+    version: 1.0.51
   codeql/quantum:
-    version: 0.0.21
+    version: 0.0.29
   codeql/rangeanalysis:
-    version: 1.0.43
+    version: 1.0.51
   codeql/ssa:
-    version: 2.0.19
+    version: 2.0.27
   codeql/suite-helpers:
-    version: 1.0.43
+    version: 1.0.51
   codeql/tutorial:
-    version: 1.0.43
+    version: 1.0.51
   codeql/typeflow:
-    version: 1.0.43
+    version: 1.0.51
   codeql/typetracking:
-    version: 2.0.27
+    version: 2.0.35
   codeql/util:
-    version: 2.0.30
+    version: 2.0.38
   codeql/xml:
-    version: 1.0.43
+    version: 1.0.51
 compiled: false

cpp/test/qlpack.yml

@@ -1,8 +1,8 @@
 name: githubsecurtylab/codeql-cpp-tests
 groups: [cpp, test]
 dependencies:
-    codeql/cpp-all: '8.0.0'
-    codeql/cpp-queries: '1.5.12'
+    codeql/cpp-all: '10.2.0'
+    codeql/cpp-queries: '1.6.4'
     githubsecuritylab/codeql-cpp-queries: '*'
     githubsecuritylab/codeql-cpp-libs: '*'
 extractor: cpp

csharp/ext-library-sources/qlpack.yml

@@ -1,8 +1,8 @@
 library: true
 name: githubsecuritylab/codeql-csharp-library-sources
-version: 0.5.1
+version: 0.6.0
 extensionTargets:
-  codeql/csharp-all: '5.4.8'
+  codeql/csharp-all: '6.0.2'
 dataExtensions:
   - 'manual/*.yml'
   - 'manual/**/*.yml'

csharp/ext/qlpack.yml

@@ -1,8 +1,8 @@
 library: true
 name: githubsecuritylab/codeql-csharp-extensions
-version: 0.5.1
+version: 0.6.0
 extensionTargets:
-  codeql/csharp-all: '5.4.8'
+  codeql/csharp-all: '6.0.2'
 dataExtensions:
   - 'manual/*.yml'
   - 'manual/**/*.yml'

csharp/lib/codeql-pack.lock.yml

@@ -2,23 +2,23 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/controlflow:
-    version: 2.0.27
+    version: 2.0.35
   codeql/csharp-all:
-    version: 5.4.8
+    version: 6.0.2
   codeql/dataflow:
-    version: 2.0.27
+    version: 2.1.7
   codeql/mad:
-    version: 1.0.43
+    version: 1.0.51
   codeql/ssa:
-    version: 2.0.19
+    version: 2.0.27
   codeql/threat-models:
-    version: 1.0.43
+    version: 1.0.51
   codeql/tutorial:
-    version: 1.0.43
+    version: 1.0.51
   codeql/typetracking:
-    version: 2.0.27
+    version: 2.0.35
   codeql/util:
-    version: 2.0.30
+    version: 2.0.38
   codeql/xml:
-    version: 1.0.43
+    version: 1.0.51
 compiled: false

csharp/lib/qlpack.yml

@@ -1,5 +1,5 @@
 library: true 
 name: githubsecuritylab/codeql-csharp-libs
-version: 0.5.1
+version: 0.6.0
 dependencies:
-  codeql/csharp-all: "5.4.8"
+  codeql/csharp-all: "6.0.2"

csharp/src/codeql-pack.lock.yml

@@ -2,27 +2,27 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/controlflow:
-    version: 2.0.27
+    version: 2.0.35
   codeql/csharp-all:
-    version: 5.4.8
+    version: 6.0.2
   codeql/csharp-queries:
-    version: 1.6.3
+    version: 1.7.4
   codeql/dataflow:
-    version: 2.0.27
+    version: 2.1.7
   codeql/mad:
-    version: 1.0.43
+    version: 1.0.51
   codeql/ssa:
-    version: 2.0.19
+    version: 2.0.27
   codeql/suite-helpers:
-    version: 1.0.43
+    version: 1.0.51
   codeql/threat-models:
-    version: 1.0.43
+    version: 1.0.51
   codeql/tutorial:
-    version: 1.0.43
+    version: 1.0.51
   codeql/typetracking:
-    version: 2.0.27
+    version: 2.0.35
   codeql/util:
-    version: 2.0.30
+    version: 2.0.38
   codeql/xml:
-    version: 1.0.43
+    version: 1.0.51
 compiled: false

csharp/src/qlpack.yml

@@ -1,9 +1,9 @@
 library: false
 name: githubsecuritylab/codeql-csharp-queries
-version: 0.5.1
+version: 0.6.0
 suites: suites
 defaultSuiteFile: suites/csharp.qls
 dependencies:
-  codeql/csharp-all: "5.4.8"
-  codeql/csharp-queries: "1.6.3" # Required for Dependencies.ql
+  codeql/csharp-all: "6.0.2"
+  codeql/csharp-queries: "1.7.4" # Required for Dependencies.ql
   githubsecuritylab/codeql-csharp-libs: "*"

csharp/src/security/CWE-1004/CookieWithoutHttpOnly.ql

@@ -21,7 +21,7 @@ import security.dataflow.flowsources.AuthCookie
 from Expr httpOnlySink
 where
   exists(Assignment a, Expr val |
-    httpOnlySink = a.getRValue() and
+    httpOnlySink = a.getRightOperand() and
     val.getValue() = "false" and
     (
       exists(ObjectCreation oc |
@@ -53,8 +53,8 @@ where
             MicrosoftAspNetCoreAuthenticationCookiesCookieAuthenticationOptions
         ) and
         pw.getProperty().getName() = "HttpOnly" and
-        a.getLValue() = pw and
-        DataFlow::localExprFlow(val, a.getRValue())
+        a.getLeftOperand() = pw and
+        DataFlow::localExprFlow(val, a.getRightOperand())
       )
     )
   )

csharp/src/security/CWE-614/CookieWithoutSecure.ql

@@ -69,7 +69,7 @@ where
   )
   or
   exists(Assignment a, Expr val |
-    secureSink = a.getRValue() and
+    secureSink = a.getRightOperand() and
     (
       exists(ObjectCreation oc |
         getAValueForProp(oc, a, "Secure") = val and
@@ -95,8 +95,8 @@ where
             MicrosoftAspNetCoreAuthenticationCookiesCookieAuthenticationOptions
         ) and
         pw.getProperty().getName() = "SecurePolicy" and
-        a.getLValue() = pw and
-        DataFlow::localExprFlow(val, a.getRValue()) and
+        a.getLeftOperand() = pw and
+        DataFlow::localExprFlow(val, a.getRightOperand()) and
         val.getValue() = "2" // None
       )
     )

csharp/src/security/CWE-759/HashWithoutSalt.ql

@@ -180,10 +180,10 @@ module HashWithoutSaltConfig implements DataFlow::ConfigSig {
     or
     // a salt or key is included in subclasses of `KeyedHashAlgorithm`
     exists(MethodCall mc, Assignment a, ObjectCreation oc |
-      a.getRValue() = oc and
+      a.getRightOperand() = oc and
       oc.getObjectType().getABaseType+() instanceof KeyedHashAlgorithm and
       mc.getTarget() instanceof HashMethod and
-      a.getLValue() = mc.getQualifier().(VariableAccess).getTarget().getAnAccess() and
+      a.getLeftOperand() = mc.getQualifier().(VariableAccess).getTarget().getAnAccess() and
       mc.getArgument(0) = node.asExpr()
     )
   }