Java: Add change note about local query removal.

github · May 1, 2024 · 42653b5 · 42653b5
1 parent 58bbfe6
commit 42653b5
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/java/ql/src/change-notes/2024-05-01-remove-local-query-variants.md b/java/ql/src/change-notes/2024-05-01-remove-local-query-variants.md
@@ -0,0 +1,4 @@
+---
+category: majorAnalysis
+---
+* Removed `local` query variants. The results pertaining to local sources can be found using the non-local counterpart query. As an example, the results previously found by `java/unvalidated-url-redirection-local` can be found by `java/unvalidated-url-redirection`, if the `local` threat model is added. The removed queries are `java/path-injection-local`, `java/command-line-injection-local`, `java/xss-local`, `java/sql-injection-local`, `java/http-response-splitting-local`, `java/improper-validation-of-array-construction-local`, `java/improper-validation-of-array-index-local`, `java/tainted-format-string-local`, `java/tainted-arithmetic-local`, `java/unvalidated-url-redirection-local`, `java/xxe-local` and `java/tainted-numeric-cast-local`.