- The
DataFlow::StateConfigSig
signature module has gained default implementations forisBarrier/2
andisAdditionalFlowStep/4
. Hence it is no longer needed to providenone()
implementations of these predicates if they are not needed.
- Data flow configurations can now include a predicate
neverSkip(Node node)
in order to ensure inclusion of certain nodes in the path explanations. The predicate defaults to the end-points of the additional flow steps provided in the configuration, which means that such steps now always are visible by default in path explanations. - The regular expression library now understands mode flags specified by
Regex
methods and theNSRegularExpression
initializer. - The regular expression library now understands mode flags specified at the beginning of a regular expression (for example
(?is)
). - Added detail to the taint model for
URL
. - Added new heuristics to
SensitiveExprs.qll
, enhancing detection from the library.