add which commands are flagged in the change-note

erik-krogh · erik-krogh · commit 5e5160d4fc45 · 2022-10-31T21:42:59.000+01:00
diff --git a/javascript/ql/src/change-notes/2022-09-05-second-order-command-injection.md b/javascript/ql/src/change-notes/2022-09-05-second-order-command-injection.md
@@ -4,3 +4,4 @@ category: newQuery
 * Added a new query, `js/second-order-command-line-injection`, to detect shell
   commands that may execute arbitrary code when the user has control over 
   the arguments to a command-line program.
+  This currently flags up unsafe invocations of git and hg.
