diff --git a/javascript/ql/lib/semmle/javascript/dataflow/Configuration.qll b/javascript/ql/lib/semmle/javascript/dataflow/Configuration.qll index bb032596475e..f9eff85feb3a 100644 --- a/javascript/ql/lib/semmle/javascript/dataflow/Configuration.qll +++ b/javascript/ql/lib/semmle/javascript/dataflow/Configuration.qll @@ -6,10 +6,6 @@ * Additional data flow edges can be specified, and conversely certain nodes or * edges can be designated as _barriers_ that block flow. * - * NOTE: The API of this library is not stable yet and may change in - * the future. - * - * * # Technical overview * * This module implements a summarization-based inter-procedural data flow @@ -76,6 +72,15 @@ private import semmle.javascript.internal.CachedStages private import AdditionalFlowSteps /** + * DEPRECATED. + * Subclasses of this class should be replaced by a module implementing the new `ConfigSig` or `StateConfigSig` interface. + * See the [data flow guide](https://codeql.github.com/docs/codeql-language-guides/analyzing-data-flow-in-javascript-and-typescript/#using-global-data-flow) + * for details about how to use this new interface. + * + * Data flow configurations that used the `FlowLabel` class should be translated to use the `StateConfigSig` interface. + * See [guide on using flow state](https://codeql.github.com/docs/codeql-language-guides/using-flow-labels-for-precise-data-flow-analysis) for more details. + * + * #### Legacy documentation * A data flow tracking configuration for finding inter-procedural paths from * sources to sinks. * diff --git a/javascript/ql/lib/semmle/javascript/dataflow/TaintTracking.qll b/javascript/ql/lib/semmle/javascript/dataflow/TaintTracking.qll index 7f8094caa4b2..6609367ec491 100644 --- a/javascript/ql/lib/semmle/javascript/dataflow/TaintTracking.qll +++ b/javascript/ql/lib/semmle/javascript/dataflow/TaintTracking.qll @@ -8,9 +8,6 @@ * substrings. As for data flow configurations, additional flow edges can be * specified, and conversely certain nodes or edges can be designated as taint * _sanitizers_ that block flow. - * - * NOTE: The API of this library is not stable yet and may change in - * the future. */ import javascript @@ -27,6 +24,17 @@ module TaintTracking { import AdditionalTaintSteps /** + * DEPRECATED. + * Subclasses of this class should be replaced by a module implementing the new `ConfigSig` or `StateConfigSig` interface. + * See the [data flow guide](https://codeql.github.com/docs/codeql-language-guides/analyzing-data-flow-in-javascript-and-typescript/#using-global-taint-tracking) + * for details about how to use this new interface. + * + * When migrating a `TaintTracking::Configuration` to `DataFlow::ConfigSig`, use `TaintTracking::Global<...>` instead of `DataFlow::Global<...>`. + * + * Taint-tracking configurations that used the `FlowLabel` class should be translated to use the `StateConfigSig` interface. + * See [guide on using flow state](https://codeql.github.com/docs/codeql-language-guides/using-flow-labels-for-precise-data-flow-analysis) for more details. + * + * #### Legacy documentation * A data flow tracking configuration that considers taint propagation through * objects, arrays, promises and strings in addition to standard data flow. *