30 Pull requests merged by 22 people

• Note AWS Lambda support

  #15378 merged Jan 19, 2024

• Go: Add flow sources for AWS Lambda function handlers

  #15373 merged Jan 19, 2024

• C#: Add flow steps from a PageModel to cshtml page.

  #15039 merged Jan 19, 2024

• Regenerate 2.16.0 changelog with fixed changenote

  #15376 merged Jan 19, 2024

• C# 12: Inline array support.

  #15328 merged Jan 19, 2024

• C#: Consider nullable simple types as sanitizers.

  #15367 merged Jan 19, 2024

• Remove outdated CodeQL CLI docs

  #15349 merged Jan 18, 2024

• Fix change note category for clarity

  #15375 merged Jan 18, 2024

• Ruby: update supported version to 3.3

  #15372 merged Jan 18, 2024

• C#: Report any extracted file as successfully extracted

  #15360 merged Jan 18, 2024

• Bump rayon from 1.8.0 to 1.8.1 in /ql

  #15364 merged Jan 18, 2024

• Go: Improve robustness of integration tests

  #15355 merged Jan 17, 2024

• Js/Py/Rb: Report any extracted file as successfully extracted

  #15256 merged Jan 17, 2024

• Automodel: Apply negative characteristics only to endpoints of the right kind.

  #15326 merged Jan 17, 2024

• C++/Swift: Create shared library and share Diagnostics

  #15354 merged Jan 17, 2024

• JS/PY/JAVA/RB: mark the range [0-?] as good in the overly-large-range query

  #15351 merged Jan 17, 2024

• C++: update tests to pick up destructor changes

  #15329 merged Jan 17, 2024

• Swift: Add `nomagic` to `Pattern.getMatchingExpr`

  #15348 merged Jan 17, 2024

• Go: Exclude all FlowSummaryNodes from test results

  #15341 merged Jan 17, 2024

• Swift: switch to shared, parameterized CFG library

  #15219 merged Jan 16, 2024

• Generate Changelogs for 2.15.5 & 2.16.0

  #15279 merged Jan 16, 2024

• Add note about telemetry for CodeQL extension settings

  #15333 merged Jan 16, 2024

• Post-release preparation for codeql-cli-2.16.0

  #15254 merged Jan 16, 2024

• Swift extractor: Generalise SwiftDiagnostics

  #15322 merged Jan 16, 2024

• Swift: upgrade to 5.9.2

  #15259 merged Jan 16, 2024

• C#: Respect order of `LGTM_INDEX_FILTERS` in buildless extraction

  #15325 merged Jan 16, 2024

• Java: Improve Regex flag parsing

  #15244 merged Jan 16, 2024

• Go: Better handle pre-release versions

  #15327 merged Jan 15, 2024

• Go: add fasthttp to frameworks for coverage

  #15324 merged Jan 15, 2024

• Go: fasthttp

  #14123 merged Jan 14, 2024

17 Pull requests opened by 12 people

• Generalization of FlowAfterFree

  #15343 opened Jan 16, 2024

• Bump org.apache.shiro:shiro-core from 1.8.0 to 1.13.0 in /java/ql/test/utils/flowtestcasegenerator

  #15344 opened Jan 16, 2024

• Python: Improve Regex flag parsing

  #15345 opened Jan 17, 2024

• Automodel: Switch tests to inline expectations

  #15356 opened Jan 17, 2024

• C#: Threat Modeling - Introduce `ThreatModelFlowSource`

  #15359 opened Jan 17, 2024

• Go: Update autobuilder to deal with the upcoming deprecation of the legacy GOPATH mode

  #15361 opened Jan 17, 2024

• Go: Add `go.work` file

  #15362 opened Jan 17, 2024

• Bump actions/cache from 3 to 4

  #15363 opened Jan 18, 2024

• Tree sitter extractor: Proper handling of `LGTM_INDEX_FILTERS`

  #15365 opened Jan 18, 2024

• Ruby: Model flow through `ViewComponent` render methods

  #15370 opened Jan 18, 2024

• C++: Implement models-as-data

  #15371 opened Jan 18, 2024

• C#: Merge `cs/exposure-of-private-information` into `cs/cleartext-storage-of-sensitive-information`,

  #15379 opened Jan 19, 2024

• JS: Add library for naming endpoints

  #15380 opened Jan 19, 2024

• C++: Report any extracted file as successfully extracted

  #15381 opened Jan 19, 2024

• Kotlin: Support Kotlin 2.0.0-Beta3

  #15384 opened Jan 19, 2024

• Swift: Report any extracted file as successfully extracted

  #15385 opened Jan 19, 2024

• JS: Add library for exporting graphs as type models

  #15386 opened Jan 19, 2024

6 Issues closed by 6 people

• val srcFileRelativePath = PathTransformer.std().fileAsDatabaseString(File(srcFilePath)) val dbSrcFilePath = FileUtil.appendAbsolutePath(dbSrcDir, srcFileRelativePath).toPath() val dbSrcDirPath = dbSrcFilePath.parent Files.createDirectories(dbSrcDirPath) val srcTmpFile = File.createTempFile(dbSrcFilePath.fileName.toString() + ".", ".src.tmp", dbSrcDirPath.toFile()) srcTmpFile.outputStream().use { Files.copy(Paths.get(srcFilePath), it) } srcTmpFile.renameTo(dbSrcFilePath.toFile())General issue

  #15387 closed Jan 20, 2024

• csharp Error: No code found during the build

  #15377 closed Jan 20, 2024

• Surprising predicate dispatch when extending a class, but not providing a charpred

  #15374 closed Jan 18, 2024

• codeql for vscode cant jump to location while click the results

  #15368 closed Jan 18, 2024

• The QL query should not have multiple results?

  #15274 closed Jan 17, 2024

• General issue

  #15334 closed Jan 16, 2024

8 Issues opened by 8 people

• False positive: cs/web/unvalidated-url-redirection does not recognize sanitization using string interpolation or string.Format

  #15383 opened Jan 19, 2024

• Kotlin Extractor does not respect SEMMLE_PATH_TRANSFORMER for Source Files

  #15382 opened Jan 19, 2024

• Some CPP source files do not contain headers

  #15366 opened Jan 18, 2024

• Dataflow break when using a switch statement with type assertions in golang?

  #15350 opened Jan 17, 2024

• Unique IDs for C++ Functions

  #15342 opened Jan 16, 2024

• Python extractor failure when Python 3.6 is used

  #15337 opened Jan 16, 2024

• CWE-434 "Unrestricted Upload of File with Dangerous Type" related rules absence

  #15335 opened Jan 16, 2024

• Java: Taint flows backwards for array element

  #15321 opened Jan 15, 2024

21 Unresolved conversations

Sometimes conversations happen on old items that aren’t yet closed. Here is a list of all the Issues and Pull Requests with unresolved conversations.

• Go: Decompression Bombs

  #13553 commented on Jan 17, 2024 • 7 new comments

• C++: First-class destructors in AST and IR

  #15318 commented on Jan 19, 2024 • 4 new comments

• Java: Introduce a common sanitizer type for types which cannot realistically carry taint.

  #15291 commented on Jan 19, 2024 • 4 new comments

• Python: remove assignments handled by capture library

  #15255 commented on Jan 19, 2024 • 3 new comments

• Add test for erb flow

  #15223 commented on Jan 17, 2024 • 3 new comments

• Python: add new Pandas sinks

  #15314 commented on Jan 18, 2024 • 2 new comments

• IRGuardCondition failure to detect NULL condition

  #15186 commented on Jan 17, 2024 • 2 new comments

• C# WIP: Change pre-finalize to run standalone extraction

  #15298 commented on Jan 19, 2024 • 1 new comment

• Java: Add query for exposure of sensitive information to android notifiactions

  #15281 commented on Jan 16, 2024 • 1 new comment

• C#: Extract and use ambiguous type information for call target resolution

  #14891 commented on Jan 18, 2024 • 1 new comment

• Create database failed with "diagnostic.trap.gz, 22593: java.io.EOFException: Unexpected end of ZLIB input stream"

  #11829 commented on Jan 19, 2024 • 1 new comment

• False positive: Modification of parameter with default for Python copy.deepcopy

  #15317 commented on Jan 17, 2024 • 1 new comment

• General issue - CodeQL exiting with exit code 2

  #14866 commented on Jan 14, 2024 • 1 new comment

• Ruby: Track types in data flow

  #15118 commented on Jan 16, 2024 • 0 new comments

• Go: Support Go 1.22

  #15202 commented on Jan 17, 2024 • 0 new comments

• C++: Accept test changes after frontend upgrade

  #15213 commented on Jan 19, 2024 • 0 new comments

• Go: extract entities for type parameters

  #15216 commented on Jan 16, 2024 • 0 new comments

• Java: openjdk model autogeneration

  #14919 commented on Jan 17, 2024 • 0 new comments

• add security-severity score to code scanning query list

  #12557 commented on Jan 17, 2024 • 0 new comments

• Java: Add `java.util.UUID` and `java.util.Date` to the `SimpleScalarSanitizer` class

  #15292 commented on Jan 16, 2024 • 0 new comments

• A security issue that codeql cannot detect

  #12473 commented on Jan 16, 2024 • 0 new comments