50 Pull requests merged by 26 people

• C++: Rewrite `cpp/cgi-xss` to not use default taint tracking

  #14424 merged Oct 13, 2023

• Swift: Add more sinks to `swift/cleartext-logging`

  #14485 merged Oct 13, 2023

• Swift: Add sinks for sqlite3 and SQLite.swift to swift/hardcoded-key

  #14394 merged Oct 13, 2023

• Ruby: Restrict GraphQL remote flow sources

  #14216 merged Oct 13, 2023

• Java: Flow taint through arithmetic expressions for java/thread-resource-abuse experimental query

  #14399 merged Oct 13, 2023

• ReDoS: use the new codePointAt and codePointCount methods instead of regex hacks

  #14481 merged Oct 13, 2023

• Fix typo in link

  #14489 merged Oct 12, 2023

• Kotlin: Improve support for TRAP compression options

  #14390 merged Oct 12, 2023

• Swift: Additional test cases for `swift\string-length-conflation`

  #14488 merged Oct 12, 2023

• Swift: skip declarations marked as unavailable

  #14437 merged Oct 12, 2023

• C++: Remove unnecessary `FlowState` from `cpp/overrun-write`

  #14486 merged Oct 12, 2023

• use a bigger compilation cache in the compile-queries workflow

  #14410 merged Oct 12, 2023

• Swift: Improve models for Numeric, RangeReplaceableCollection

  #14354 merged Oct 12, 2023

• Bump golang.org/x/tools from 0.13.0 to 0.14.0 in /go/extractor

  #14441 merged Oct 12, 2023

• Fix module name

  #14442 merged Oct 11, 2023

• Post-release preparation for codeql-cli-2.15.0

  #14443 merged Oct 11, 2023

• C#: Include the `void` type in value types

  #14436 merged Oct 11, 2023

• JS/Ruby: desync two queries and port the Ruby version to ConfigSig-style

  #14435 merged Oct 11, 2023

• Go: Move `go.mod` into `extractor` subdirectory

  #14439 merged Oct 11, 2023

• Automodel: Fix automodel extraction queries

  #14438 merged Oct 11, 2023

• Go: New File System Access Sinks

  #14064 merged Oct 11, 2023

• Go: Improved JWT query, JWT decoding without verification

  #14075 merged Oct 11, 2023

• C++: Use fully converted instructions as the target of modelled functions

  #14432 merged Oct 11, 2023

• C#: Remove `keyset` from `metadata_handle` relation

  #14429 merged Oct 11, 2023

• JS: recognize tagged template literals as `DataFlow::CallNode`

  #14405 merged Oct 11, 2023

• C#: Add autobuilder test with global.json

  #14421 merged Oct 11, 2023

• Python: Better allow `import *` to work with API graphs

  #14430 merged Oct 11, 2023

• JS: delete an .expected file outside the test directories

  #14433 merged Oct 11, 2023

• C#: Make conflicting assembly selection deterministic in standalone

  #14428 merged Oct 11, 2023

• Python: Add missing flow for `AssignmentExpr` nodes

  #14417 merged Oct 10, 2023

• Add dependabot configuration for Go dependencies

  #14415 merged Oct 10, 2023

• C#: Only download nuget.exe if there are packages.config files

  #14425 merged Oct 10, 2023

• Python: Add unsafe deserialization sinks (CWE-502)

  #13781 merged Oct 10, 2023

• Go: Change MaxValueState API to get architecture bit size

  #14414 merged Oct 10, 2023

• Java: Enable threat models for most Java queries.

  #14370 merged Oct 10, 2023

• Bump regex from 1.9.6 to 1.10.0 in /ql

  #14420 merged Oct 10, 2023

• All: delete outdated deprecations

  #14403 merged Oct 9, 2023

• Revert "C++: Rewrite `cpp/cgi-xss` to not use default taint tracking"

  #14416 merged Oct 9, 2023

• Swift: extract `nextCall` from `ForEachStmt`

  #14023 merged Oct 9, 2023

• Swift: dataflow for `for-in` loops

  #13909 merged Oct 9, 2023

• Go: Fix version detection and test for `newer-go-version-needed`

  #14391 merged Oct 9, 2023

• JS/PY/RB/Java: escape unicode chars in overly-large-range

  #14339 merged Oct 9, 2023

• Swift: defaultImplicitTaintRead performance improvement

  #14386 merged Oct 9, 2023

• Swift: Add sinks for the GRDB database library to swift/hardcoded-key

  #14407 merged Oct 9, 2023

• Java: Add predicate `MemberRefExpr::getReceiverExpr`

  #14402 merged Oct 9, 2023

• Java: Adjust `ClassInstanceExpr` type argument predicates docs

  #14401 merged Oct 9, 2023

• Update about-telemetry-in-codeql-for-visual-studio-code.rst to mention telemtry.telemetryLevel

  #14408 merged Oct 9, 2023

• C++: Rewrite `cpp/cgi-xss` to not use default taint tracking

  #11716 merged Oct 9, 2023

• CPP: Improve performance of IR debugging

  #14385 merged Oct 9, 2023

• Update CSV framework coverage reports

  #14379 merged Oct 9, 2023

57 Pull requests opened by 23 people

• Python: New FileSystem Access

  #14406 opened Oct 8, 2023

• C#: Inspect project.assets.json to find dependencies.

  #14411 opened Oct 9, 2023

• [Feature branch] JS: Migrate to shared dataflow library

  #14412 opened Oct 9, 2023

• C++: Fix modulus analysis.

  #14413 opened Oct 9, 2023

• JavaScript: Adjust XSS and log injection query severities

  #14419 opened Oct 9, 2023

• C#: Disable CIL extraction for testing purposes.

  #14422 opened Oct 10, 2023

• Ruby: Track flow into ActiveRecord scopes

  #14426 opened Oct 10, 2023

• JS: Support import attributes

  #14431 opened Oct 10, 2023

• JS: Add JSON Stringify Sanitizer

  #14434 opened Oct 10, 2023

• CPP: Add some range analysis cases

  #14444 opened Oct 11, 2023

• Go: automated mad coverage report

  #14445 opened Oct 11, 2023

• Python: exclude loops from `varBlockStep`

  #14446 opened Oct 11, 2023

• Bump golang.org/x/net from 0.0.0-20200421231249-e086a090c8fd to 0.17.0 in /go/ql/test/query-tests/Security/CWE-918

  #14447 opened Oct 11, 2023

• Bump golang.org/x/net from 0.0.0-20200505041828-1ed23360d12c to 0.17.0 in /go/ql/integration-tests/all-platforms/go/two-go-mods-nested-none-in-root/subdir0/subdir1

  #14448 opened Oct 11, 2023

• Bump golang.org/x/net from 0.0.0-20200505041828-1ed23360d12c to 0.17.0 in /go/ql/integration-tests/all-platforms/go/bazel-sample-1

  #14449 opened Oct 11, 2023

• Bump golang.org/x/net from 0.0.0-20200505041828-1ed23360d12c to 0.17.0 in /go/ql/integration-tests/all-platforms/go/two-go-mods-nested-one-in-root

  #14450 opened Oct 11, 2023

• Bump golang.org/x/net from 0.0.0-20200505041828-1ed23360d12c to 0.17.0 in /go/ql/integration-tests/all-platforms/go/bazel-sample-2

  #14451 opened Oct 11, 2023

• Bump golang.org/x/net from 0.0.0-20200505041828-1ed23360d12c to 0.17.0 in /go/ql/integration-tests/all-platforms/go/go-mod-sample

  #14452 opened Oct 11, 2023

• Bump golang.org/x/net from 0.0.0-20200505041828-1ed23360d12c to 0.17.0 in /go/ql/integration-tests/all-platforms/go/single-go-work-not-in-root/modules/subdir2

  #14453 opened Oct 11, 2023

• Bump golang.org/x/net from 0.0.0-20200505041828-1ed23360d12c to 0.17.0 in /go/ql/integration-tests/all-platforms/go/ninja-sample

  #14454 opened Oct 11, 2023

• Bump golang.org/x/net from 0.0.0-20200505041828-1ed23360d12c to 0.17.0 in /go/ql/integration-tests/all-platforms/go/single-go-work-not-in-root/modules/subdir1

  #14455 opened Oct 11, 2023

• Bump golang.org/x/net from 0.0.0-20200505041828-1ed23360d12c to 0.17.0 in /go/ql/test/library-tests/semmle/go/frameworks/WebSocket

  #14456 opened Oct 11, 2023

• Bump golang.org/x/net from 0.0.0-20200505041828-1ed23360d12c to 0.17.0 in /go/ql/integration-tests/all-platforms/go/two-go-mods-not-nested/subdir1

  #14457 opened Oct 11, 2023

• Bump golang.org/x/net from 0.0.0-20200505041828-1ed23360d12c to 0.17.0 in /go/ql/integration-tests/all-platforms/go/single-go-mod-not-in-root/subdir

  #14458 opened Oct 11, 2023

• Bump golang.org/x/net from 0.0.0-20200505041828-1ed23360d12c to 0.17.0 in /go/ql/integration-tests/all-platforms/go/two-go-mods-nested-one-in-root/subdir1

  #14459 opened Oct 11, 2023

• Bump golang.org/x/net from 0.0.0-20200505041828-1ed23360d12c to 0.17.0 in /go/ql/integration-tests/all-platforms/go/make-sample

  #14460 opened Oct 11, 2023

• Bump golang.org/x/net from 0.0.0-20200505041828-1ed23360d12c to 0.17.0 in /go/ql/test/query-tests/Security/CWE-079

  #14461 opened Oct 11, 2023

• Bump golang.org/x/net from 0.0.0-20200505041828-1ed23360d12c to 0.17.0 in /go/ql/integration-tests/all-platforms/go/single-go-mod-in-root

  #14462 opened Oct 11, 2023

• Bump golang.org/x/net from 0.0.0-20200505041828-1ed23360d12c to 0.17.0 in /go/ql/integration-tests/all-platforms/go/two-go-mods-nested-none-in-root/subdir0

  #14463 opened Oct 11, 2023

• Bump golang.org/x/net from 0.0.0-20200505041828-1ed23360d12c to 0.17.0 in /go/ql/integration-tests/all-platforms/go/single-go-mod-and-go-files-not-under-it/subdir

  #14464 opened Oct 11, 2023

• Bump golang.org/x/net from 0.0.0-20200505041828-1ed23360d12c to 0.17.0 in /go/ql/integration-tests/all-platforms/go/two-go-mods-not-nested/subdir2

  #14465 opened Oct 11, 2023

• Bump golang.org/x/net from 0.0.0-20201010224723-4f7140c49acb to 0.17.0 in /go/ql/test/library-tests/semmle/go/frameworks/StdlibTaintFlow

  #14466 opened Oct 11, 2023

• Bump golang.org/x/net from 0.0.0-20201010224723-4f7140c49acb to 0.17.0 in /go/ql/test/library-tests/semmle/go/frameworks/XNetHtml

  #14467 opened Oct 11, 2023

• Bump golang.org/x/net from 0.0.0-20201207224615-747e23833adb to 0.17.0 in /go/ql/test/library-tests/semmle/go/frameworks/K8sIoClientGo

  #14468 opened Oct 11, 2023

• Bump golang.org/x/net from 0.0.0-20201224014010-6772e930b67b to 0.17.0 in /go/ql/test/library-tests/semmle/go/frameworks/CouchbaseV1

  #14469 opened Oct 11, 2023

• Bump golang.org/x/net from 0.0.0-20210405180319-a5a99cb37ef4 to 0.17.0 in /go/ql/test/experimental/CWE-918

  #14470 opened Oct 11, 2023

• Bump golang.org/x/net from 0.0.0-20210520170846-37e1c6afe023 to 0.17.0 in /go/ql/test/library-tests/semmle/go/frameworks/SQL/gogf

  #14471 opened Oct 11, 2023

• Java: Synchronize `*Local` versions of queries with their remote counterpart

  #14472 opened Oct 11, 2023

• Bump golang.org/x/net from 0.10.0 to 0.17.0 in /go/ql/test/experimental/CWE-321-V2

  #14473 opened Oct 11, 2023

• Bump golang.org/x/net from 0.10.0 to 0.17.0 in /go/ql/test/experimental/CWE-347

  #14474 opened Oct 11, 2023

• Bump golang.org/x/net from 0.14.0 to 0.17.0 in /go/ql/test/library-tests/semmle/go/frameworks/Afero

  #14475 opened Oct 11, 2023

• Bump golang.org/x/net from 0.14.0 to 0.17.0 in /go/ql/test/library-tests/semmle/go/frameworks/Iris

  #14476 opened Oct 11, 2023

• Bump golang.org/x/net from 0.8.0 to 0.17.0 in /go/ql/test/experimental/CWE-321

  #14477 opened Oct 11, 2023

• C++: Add an abstract class that can be used to extend `viableCallable`

  #14482 opened Oct 12, 2023

• Go: Improve Dependabot configuration

  #14483 opened Oct 12, 2023

• JS: Support import attributes

  #14484 opened Oct 12, 2023

• Java: basic version of automodel extraction query docs

  #14487 opened Oct 12, 2023

• Java: Refactor `java/static-initialization-vector` to use Models as Data

  #14491 opened Oct 13, 2023

• C#: Fix params attribute argument extraction

  #14493 opened Oct 13, 2023

• Java/C/C#: Remove library annotations

  #14494 opened Oct 13, 2023

• C++: Fix ImplicitThisFieldAccess

  #14495 opened Oct 13, 2023

• Swift: Add data flow tests for member initialization.

  #14496 opened Oct 13, 2023

• JS: add support for extracting `.jsp` files

  #14497 opened Oct 13, 2023

• C#: Fix FP in Missing Function Level Access Control and Insecure Direct Object Reference

  #14498 opened Oct 13, 2023

• Shared: Add library for filepath normalization

  #14500 opened Oct 13, 2023

• Swift: Model RawRepresentable

  #14502 opened Oct 13, 2023

• Java: Adapt tests to JDK21

  #14503 opened Oct 13, 2023

3 Issues closed by 3 people

• Query help files should be identified and processed when executing codeql pack create

  #13609 closed Oct 12, 2023

• Incorrect Integer Conversion Query appears to fail to capture integer parsing

  #9295 closed Oct 10, 2023

• General issue

  #14409 closed Oct 9, 2023

6 Issues opened by 6 people

• CodeQL CLI v2.15.0 returns `HTTP/1.1 302 Found` error on `codeql github upload-results`

  #14501 opened Oct 13, 2023

• Error downloading/installing codeql cpp-queries package

  #14492 opened Oct 13, 2023

• Extract JavaScript from <script> tags within JSP files

  #14490 opened Oct 12, 2023

• Does C++ extractor support to process code with unity build?

  #14479 opened Oct 12, 2023

• False positive : Missing function level access control (cs/web/missing-function-level-access-control)

  #14478 opened Oct 12, 2023

• Failed to create database on Android

  #14404 opened Oct 8, 2023

31 Unresolved conversations

Sometimes conversations happen on old items that aren’t yet closed. Here is a list of all the Issues and Pull Requests with unresolved conversations.

• C#: Choose between .NET framework or core DLLs in standalone

  #14368 commented on Oct 13, 2023 • 26 new comments

• Java: Convert `SensitiveApi.qll` to use Models-as-Data

  #13978 commented on Oct 13, 2023 • 14 new comments

• Go: Decompression Bombs

  #13553 commented on Oct 12, 2023 • 13 new comments

• Go: fasthttp

  #14123 commented on Oct 12, 2023 • 11 new comments

• JS: provide command execution sinks for execa package

  #14294 commented on Oct 12, 2023 • 8 new comments

• JS: Decompression Bombs

  #13554 commented on Oct 10, 2023 • 7 new comments

• Swift: add CFG for normal autoclosures

  #14398 commented on Oct 13, 2023 • 7 new comments

• Go: Add Improper LDAP Authentication query (CWE-287)

  #13366 commented on Oct 11, 2023 • 6 new comments

• Ruby: Port `UrlConcatenation.qll` from JS

  #14180 commented on Oct 13, 2023 • 3 new comments

• JS: Add Permissive CORS query (CWE-942)

  #14342 commented on Oct 11, 2023 • 3 new comments

• Shared: Add DataFlow::DeduplicatePathGraph

  #14350 commented on Oct 13, 2023 • 3 new comments

• Error downloading packs with corporate certificate in chain

  #13132 commented on Oct 13, 2023 • 2 new comments

• Go: Add and Modify Sanitizers For TaintedPath

  #11703 commented on Oct 9, 2023 • 2 new comments

• Swift: Risky or Broken Cryptographic Algorithm Query

  #13649 commented on Oct 13, 2023 • 1 new comment

• Ruby: JWT Security Queries (CWE-347)

  #14061 commented on Oct 11, 2023 • 1 new comment

• JS: Dynamic import as code injection sink

  #14293 commented on Oct 8, 2023 • 1 new comment

• Ruby: Add a query for CSRF protection not enabled

  #14308 commented on Oct 13, 2023 • 1 new comment

• CPP: Add reverse bounds in range analysis for InvalidPointerDeref

  #14335 commented on Oct 12, 2023 • 1 new comment

• C#: Sunset QL based stub generator.

  #14363 commented on Oct 13, 2023 • 1 new comment

• Ruby: Decompression Bombs

  #13556 commented on Oct 11, 2023 • 0 new comments

• Python: Decompression Bombs

  #13557 commented on Oct 9, 2023 • 0 new comments

• Java: Add Weak Randomness Query (CWE-330/338)

  #13608 commented on Oct 11, 2023 • 0 new comments

• JS: [WIP] Add `dot.js` support

  #13624 commented on Oct 10, 2023 • 0 new comments

• Mention needed imports at top of "Analyzing data flow in Java"

  #13692 commented on Oct 7, 2023 • 0 new comments

• Java: Weak Cryptographic Algorithm from `.properties` files

  #14040 commented on Oct 11, 2023 • 0 new comments

• Python: Allow namespace packages

  #14114 commented on Oct 11, 2023 • 0 new comments

• C++: Update for changes in frontend.

  #14135 commented on Oct 12, 2023 • 0 new comments

• Swift: upgrade to 5.9

  #14261 commented on Oct 12, 2023 • 0 new comments

• JS: extend DatabaseAccess by `TypeORM` and `sqlite` packages

  #14302 commented on Oct 10, 2023 • 0 new comments

• C++: use in/out barriers with flow state

  #14331 commented on Oct 13, 2023 • 0 new comments

• [Draft] C#: Add XSS flow steps for View calls refering to Razor pages

  #14343 commented on Oct 9, 2023 • 0 new comments