advanced-security / codeql-extractor-iac

CodeQL Extractor, Library, and Queries for Infrastructure as Code

MIT License

40 stars 5 forks source link

feat(iac): Update Dependencies and add better Semver support #159

Closed GeekMasher closed 2 months ago

GeekMasher commented 2 months ago

Improvements to Dependency and SemanticVersion classes:

ql/lib/codeql/iac/Dependencies.qll: Modified the Dependency class to use getSemanticVersion().getPretty() for fetching version information and added methods to retrieve raw and semantic versions. Enhanced the SemanticVersion class with new properties and predicates for better version comparison and normalization.

Updates to test files:

ql/test/library-tests/hcl/terraform/Dependencies.expected: Added new entries to test the semantic versioning of dependencies.
ql/test/library-tests/hcl/terraform/Dependencies.ql: Introduced a new query predicate semver to validate the semantic versioning functionality.

github-actions[bot] commented 2 months ago

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details

Scanned Manifest Files