42 Pull requests merged by 26 people

• Go: Add Go frameworks for automated coverage reports

  #14536 merged Oct 20, 2023

• C++: Fix ImplicitThisFieldAccess

  #14495 merged Oct 20, 2023

• fix typo ('Configration' to ‘Configuration’)

  #14539 merged Oct 20, 2023

• Swift: add children to `UnspecifiedElement`

  #14538 merged Oct 20, 2023

• Bump to Go 1.21 in supported compilers docs

  #14550 merged Oct 20, 2023

• Improve change note checking

  #14542 merged Oct 20, 2023

• Kotlin: Don't convert back and forth between ClassId and FqName

  #14529 merged Oct 20, 2023

• Post-release preparation for codeql-cli-2.15.1

  #14531 merged Oct 19, 2023

• move the documentation of codePointAt and codePointCount to the string type instead of the int type

  #14543 merged Oct 19, 2023

• C++: Update for changes in frontend.

  #14135 merged Oct 19, 2023

• C++: Add more documentation about dataflow through indirections

  #14524 merged Oct 19, 2023

• Update CSV framework coverage reports

  #14533 merged Oct 19, 2023

• Bump tracing from 0.1.39 to 0.1.40 in /ql

  #14540 merged Oct 19, 2023

• Java: Improve java/spring-disabled-csrf-protection

  #14515 merged Oct 18, 2023

• Go: Add Dependabot config for `go/ql/test` which ignores all dependencies

  #14535 merged Oct 18, 2023

• Swift: SingleValueStmtExpr migration scripts

  #14525 merged Oct 18, 2023

• Java: Adapt tests to JDK21

  #14503 merged Oct 17, 2023

• Java: Refactor `java/static-initialization-vector` to use Models as Data

  #14491 merged Oct 17, 2023

• Swift: Model StringProtocol.appendingformat and String.decodecstring

  #14523 merged Oct 17, 2023

• Swift: add CFG for normal autoclosures

  #14398 merged Oct 17, 2023

• C++: Add an abstract class that can be used to extend `viableCallable`

  #14482 merged Oct 17, 2023

• Docs: add a note on db migration scripts debugging

  #14528 merged Oct 17, 2023

• Python: Improve `yield` modeling

  #14513 merged Oct 17, 2023

• Java: Update MaD Declarations after Triage

  #13444 merged Oct 17, 2023

• Swift: Add data flow tests for member initialization.

  #14496 merged Oct 17, 2023

• Swift: Add CollectionContent to defaultImplicitTaintRead

  #14521 merged Oct 17, 2023

• Bump regex from 1.10.0 to 1.10.2 in /ql

  #14520 merged Oct 16, 2023

• Release preparation for version 2.15.1

  #14519 merged Oct 16, 2023

• Fix invalid `dependabot.yml`

  #14516 merged Oct 16, 2023

• C++: Fix size deduction in `cpp/invalid-pointer-deref`

  #14512 merged Oct 16, 2023

• Ruby: JWT Security Queries (CWE-347)

  #14061 merged Oct 16, 2023

• Java: Synchronize `*Local` versions of queries with their remote counterpart

  #14472 merged Oct 16, 2023

• Go: Improve Dependabot configuration

  #14483 merged Oct 16, 2023

• C++: Mark `cpp/redundant-null-check-simple` as a security query

  #14509 merged Oct 16, 2023

• C#: Fix FP in Missing Function Level Access Control and Insecure Direct Object Reference

  #14498 merged Oct 16, 2023

• JS: Support import attributes

  #14484 merged Oct 16, 2023

• JS: add support for extracting `.jsp` files

  #14497 merged Oct 16, 2023

• Bump tracing from 0.1.38 to 0.1.39 in /ql

  #14506 merged Oct 16, 2023

• Java/C/C#: Remove library annotations

  #14494 merged Oct 16, 2023

• C#: Choose between .NET framework or core DLLs in standalone

  #14368 merged Oct 16, 2023

• Go: automated mad coverage report

  #14445 merged Oct 15, 2023

• Go: Enable GoKit module into the default list

  #14276 merged Oct 15, 2023

14 Pull requests opened by 13 people

• JS: update typescript extractor to use 5.3 .

  #14510 opened Oct 16, 2023

• Swift: Model Substring

  #14511 opened Oct 16, 2023

• CI: Update framework coverage difference commenter

  #14517 opened Oct 16, 2023

• Kotlin: Log when we start and finish writing to TRAP files

  #14518 opened Oct 16, 2023

• Go: Add JWT Algorithm Confusion Query

  #14534 opened Oct 18, 2023

• Swift: remove outdated CLI argument

  #14537 opened Oct 18, 2023

• fix CWE number

  #14541 opened Oct 19, 2023

• Ruby: additional unsafe deserialization sinks for ox and one for oj

  #14544 opened Oct 19, 2023

• C#: Handle `netstandard` references in standalone extraction

  #14545 opened Oct 19, 2023

• Go: enable data flow consistency checks (and fix some)

  #14547 opened Oct 19, 2023

• Implement threat models as extension packs

  #14548 opened Oct 19, 2023

• Java/Kotlin: Reshuffle our LoC queries

  #14551 opened Oct 20, 2023

• Javascript extractor: Bazel-based build

  #14552 opened Oct 20, 2023

• Java: Automodel Framework Mode Extraction Bug

  #14553 opened Oct 20, 2023

4 Issues closed by 4 people

• Extract JavaScript from <script> tags within JSP files

  #14490 closed Oct 17, 2023

• Language identifier java-kotlin can not be found

  #14514 closed Oct 16, 2023

• False positive: Incomplete multi-character sanitization

  #14504 closed Oct 16, 2023

• False positive : Missing function level access control (cs/web/missing-function-level-access-control)

  #14478 closed Oct 16, 2023

3 Issues opened by 3 people

• java code scanning failed

  #14549 opened Oct 20, 2023

• False positive - Ruby on Rails: SQL query built from user-controlled sources

  #14546 opened Oct 19, 2023

• gradle: False positives from generated code from the version catalog feature

  #14530 opened Oct 17, 2023

52 Unresolved conversations

Sometimes conversations happen on old items that aren’t yet closed. Here is a list of all the Issues and Pull Requests with unresolved conversations.

• JS: Add Permissive CORS query (CWE-942)

  #14342 commented on Oct 16, 2023 • 9 new comments

• Shared: Add library for filepath normalization

  #14500 commented on Oct 17, 2023 • 9 new comments

• CodeQL CLI v2.15.0 returns `HTTP/1.1 302 Found` error on `codeql github upload-results`

  #14501 commented on Oct 17, 2023 • 8 new comments

• Go: Decompression Bombs

  #13553 commented on Oct 18, 2023 • 8 new comments

• Go: fasthttp

  #14123 commented on Oct 17, 2023 • 8 new comments

• Java: Convert `SensitiveApi.qll` to use Models-as-Data

  #13978 commented on Oct 18, 2023 • 5 new comments

• Swift: Flow through OpenExistentialExpr

  #14113 commented on Oct 17, 2023 • 4 new comments

• Go: Add Improper LDAP Authentication query (CWE-287)

  #13366 commented on Oct 17, 2023 • 3 new comments

• Ruby: Port `UrlConcatenation.qll` from JS

  #14180 commented on Oct 16, 2023 • 3 new comments

• Python - Add RestFramework handler kwargs

  #14353 commented on Oct 20, 2023 • 3 new comments

• Use Specific Python Virtual Environment Dependency

  #14187 commented on Oct 16, 2023 • 2 new comments

• LGTM.com - false positive "Statement has no effect" for Python await

  #11235 commented on Oct 14, 2023 • 1 new comment

• [CSharp] AWS Lambda Modelling

  #13110 commented on Oct 18, 2023 • 1 new comment

• Ruby: Decompression Bombs

  #13556 commented on Oct 18, 2023 • 1 new comment

• JS: JWT constant key, no Verification issues

  #14088 commented on Oct 19, 2023 • 1 new comment

• JavaScript: Adjust XSS and log injection query severities

  #14419 commented on Oct 20, 2023 • 1 new comment

• JS: Add JSON Stringify Sanitizer

  #14434 commented on Oct 16, 2023 • 1 new comment

• CPP: Add some range analysis cases

  #14444 commented on Oct 16, 2023 • 1 new comment

• Certain syntaxes in ruby cause extraction errors

  #14279 commented on Oct 19, 2023 • 0 new comments

• Ruby parse error on valid Ruby code

  #7005 commented on Oct 19, 2023 • 0 new comments

• False positive for IncompleteHostnameRegExp in Ruby

  #13749 commented on Oct 19, 2023 • 0 new comments

• "CodeQL library search" language filter does not work for Ruby

  #11840 commented on Oct 19, 2023 • 0 new comments

• Ruby: Traditional if-else not detected as `StringConstArrayInclusionCallBarrier` compared to conditional assignment.

  #11558 commented on Oct 19, 2023 • 0 new comments

• Javascript cannot query specific getAMemberCall

  #13401 commented on Oct 19, 2023 • 0 new comments

• [JavaScript] - Incomplete string escaping or encoding

  #9450 commented on Oct 19, 2023 • 0 new comments

• JavaScript Webpack Vulnerability

  #3963 commented on Oct 19, 2023 • 0 new comments

• Javascript Sqlite database opening

  #7597 commented on Oct 19, 2023 • 0 new comments

• javascript: Property access on null or undefined

  #12722 commented on Oct 19, 2023 • 0 new comments

• ERROR: Could not resolve module javascript.

  #4280 commented on Oct 19, 2023 • 0 new comments

• JavaScript: Restricting `isSource` predicate leads to more alerts

  #7790 commented on Oct 19, 2023 • 0 new comments

• Unable to parse Module of certain type for JavaScript

  #5697 commented on Oct 19, 2023 • 0 new comments

• Javascript: How can I filter some dataflow results?

  #6920 commented on Oct 19, 2023 • 0 new comments

• XML in javascript hasn't been written?[QUESTION][XML]

  #3949 commented on Oct 19, 2023 • 0 new comments

• JavaScript: RemoteFlowSource does not seem to pick up data fetched from path

  #9760 commented on Oct 19, 2023 • 0 new comments

• Javascript: How to define an own type and mark its attributes and types

  #12524 commented on Oct 19, 2023 • 0 new comments

• False positive - DOMParser().parseFromString is treated as XSS sink

  #12882 commented on Oct 19, 2023 • 0 new comments

• JS: How to mark the value of a property

  #5969 commented on Oct 19, 2023 • 0 new comments

• The TypeScript parser wrapper crashed with exit code 1

  #13656 commented on Oct 19, 2023 • 0 new comments

• False positive - when json.Marshal output is used - cant result in "Potentially unsafe quoting"

  #14159 commented on Oct 19, 2023 • 0 new comments

• Java: Decompression Bombs

  #13555 commented on Oct 14, 2023 • 0 new comments

• Python: Decompression Bombs

  #13557 commented on Oct 17, 2023 • 0 new comments

• C#: Decompression Bombs

  #13558 commented on Oct 17, 2023 • 0 new comments

• Ruby: query to automatically extract type definitions from library code

  #13750 commented on Oct 16, 2023 • 0 new comments

• Java: Weak Cryptographic Algorithm from `.properties` files

  #14040 commented on Oct 18, 2023 • 0 new comments

• Swift: upgrade to 5.9

  #14261 commented on Oct 18, 2023 • 0 new comments

• JS: extend DatabaseAccess by `TypeORM` and `sqlite` packages

  #14302 commented on Oct 18, 2023 • 0 new comments

• Ruby: Add a query for CSRF protection not enabled

  #14308 commented on Oct 17, 2023 • 0 new comments

• Temporarily run the standalone extractor instead of autobuilding

  #14324 commented on Oct 16, 2023 • 0 new comments

• Kotlin: Remove 1.4 compatibility

  #14393 commented on Oct 16, 2023 • 0 new comments

• Python: exclude loops from `varBlockStep`

  #14446 commented on Oct 15, 2023 • 0 new comments

• C#: Fix params attribute argument extraction

  #14493 commented on Oct 16, 2023 • 0 new comments

• Swift: Model RawRepresentable

  #14502 commented on Oct 16, 2023 • 0 new comments