Insights: github/codeql
Overview
Could not load contribution data
Please try again later
65 Pull requests merged by 27 people
-
Generate changelogs for 2.16.2
#15644 merged
Feb 16, 2024 -
Kotlin 2: Accept changes in library-tests/controlflow/dominance
#15641 merged
Feb 16, 2024 -
Kotlin 2: Accept changes in library-tests/controlflow/basic
#15640 merged
Feb 16, 2024 -
Kotlin 2: Accept changes in library-tests/stmts
#15639 merged
Feb 16, 2024 -
C++: Fix joins in `controlsBlock`
#15637 merged
Feb 16, 2024 -
Fix change note on 2.16.2 release branch
#15635 merged
Feb 16, 2024 -
Add `security-events: write` permission in `ql-for-ql-build.yml`
#15631 merged
Feb 16, 2024 -
Move the JS java tests to be a proper `java_test` target.
#15627 merged
Feb 16, 2024 -
C#: update the QHelp for `cs/web/unvalidated-url-redirection`
#15623 merged
Feb 16, 2024 -
Extend permissions in `csv-coverage-update.yml`
#15630 merged
Feb 16, 2024 -
C++: Don't strip specifiers away in `TFinalParameterUse`
#15626 merged
Feb 16, 2024 -
Automodel: Improve handling of varargs and overriding in extraction queries
#15554 merged
Feb 16, 2024 -
Kotlin 2: Accept more location changes
#15616 merged
Feb 15, 2024 -
C++: Support `constexpr if` in the IR
#15612 merged
Feb 15, 2024 -
Automodel: Make description of some negative characteristics more explicit.
#15592 merged
Feb 15, 2024 -
Add new libraries we cover to frameworks.csv
#15624 merged
Feb 15, 2024 -
C#: Add a few more sanitizers to `cs/web/unvalidated-url-redirection`
#15596 merged
Feb 15, 2024 -
Declare permissions
#15493 merged
Feb 15, 2024 -
Java: Expand ExactPathSanitizer to work on the argument of 'equals' too
#15622 merged
Feb 15, 2024 -
C#: Code quality improvements (fixed log message, removed unused interface)
#15621 merged
Feb 15, 2024 -
Python: Decompression Bombs
#13557 merged
Feb 15, 2024 -
Ruby: Recognise raw Erb output as XSS sink
#15520 merged
Feb 15, 2024 -
Ruby: add docs for customizing library models with data extensions
#15488 merged
Feb 15, 2024 -
C# Only remove temp files for MVC view generation if needed
#15614 merged
Feb 15, 2024 -
Fix typo in NettyRequestSplitting.java
#15618 merged
Feb 14, 2024 -
Go: Use less confusing name for hardcoded credentials tests
#15615 merged
Feb 14, 2024 -
Go: Promote `go/hardcoded-key` from experimental
#15527 merged
Feb 14, 2024 -
C++: For unnamed local variable declaration entries consider the name of the variable
#15611 merged
Feb 14, 2024 -
Kotlin: Fix build with latest 2.0.255 snapshots
#15606 merged
Feb 14, 2024 -
Limit xl runner jobs to github org
#15584 merged
Feb 14, 2024 -
JS: Fix flow through &&
#15602 merged
Feb 14, 2024 -
C++: Output the declaration entries used in range-based for-loops
#15609 merged
Feb 14, 2024 -
JS: Add library for naming endpoints
#15380 merged
Feb 14, 2024 -
Data flow: Cache `viableCallableExt`
#15582 merged
Feb 14, 2024 -
C# 12: Primary constructors.
#15474 merged
Feb 14, 2024 -
Java: Document which assignment type is covered by which class
#15451 merged
Feb 14, 2024 -
Swift: Trivial changes to swift/unsafe-unpacking
#15607 merged
Feb 13, 2024 -
Go: Fix file info extraction for dummy files
#15603 merged
Feb 13, 2024 -
C++: Update test results of `constexpr if` destructors
#15597 merged
Feb 13, 2024 -
Swift: Add Unsafe Unpacking Query (CWE-022)
#14888 merged
Feb 13, 2024 -
Bump the extractor-dependencies group in /go/extractor with 1 update
#15590 merged
Feb 13, 2024 -
C++: Revert #15528
#15601 merged
Feb 13, 2024 -
Kotlin 2: Accept more test changes
#15561 merged
Feb 13, 2024 -
C++: Fix `memset` model
#15587 merged
Feb 13, 2024 -
C++: Add additional IR tests for destructors
#15594 merged
Feb 13, 2024 -
Use `!cancelled` in qhelp-pr-preview workflow
#15589 merged
Feb 13, 2024 -
Python: Update BUILD.bazel files.
#15586 merged
Feb 13, 2024 -
C#: Improve the `cs/path-injection` QHelp
#15519 merged
Feb 13, 2024 -
C# - Add default nuget feed if there's none
#15577 merged
Feb 13, 2024 -
Shared: fix a bug in stateful outbarriers
#15507 merged
Feb 12, 2024 -
Python: Model the `psycopg` package
#15457 merged
Feb 12, 2024 -
Ruby: Fix ActionController path regex
#15566 merged
Feb 12, 2024 -
Ruby: Recognise more ActiveRecord connections
#15521 merged
Feb 12, 2024 -
Reduce severity of `java/relative-path-command`
#15533 merged
Feb 12, 2024 -
Java: Add query for insecure local authentication
#15481 merged
Feb 12, 2024 -
Java: Add extension point and default sanitizer to Open Redirect query
#15565 merged
Feb 12, 2024 -
Kotlin 2: Accept loc changes in library-tests/parameter-defaults/defaults.expected
#15573 merged
Feb 12, 2024 -
Kotlin 2: Accept more location changes
#15569 merged
Feb 12, 2024 -
JS: exclude tagged template literals from `js/superfluous-trailing-arguments`
#15523 merged
Feb 12, 2024 -
Tree-sitter extractors: use fresh IDs for locations
#15496 merged
Feb 12, 2024 -
Update CSV framework coverage reports
#15578 merged
Feb 12, 2024 -
C#: Actually cache module `Cached`
#15567 merged
Feb 12, 2024 -
C#: Additional tracking of lambdas through fields and properties
#15489 merged
Feb 12, 2024 -
Bump chrono from 0.4.33 to 0.4.34 in /ql
#15579 merged
Feb 12, 2024 -
Capture flow: Take overwrites in nested scopes into account
#15540 merged
Feb 10, 2024
19 Pull requests opened by 14 people
-
Bazel: use bzlmod
#15583 opened
Feb 12, 2024 -
Go: Promote `go/missing-jwt-signature-check` from experimental
#15585 opened
Feb 12, 2024 -
Swift: update swift prebuilt package
#15593 opened
Feb 13, 2024 -
Dataflow: wip test of fieldflowbranchlimit adjustment
#15599 opened
Feb 13, 2024 -
C# Change desktop dotnet assembly lookup to fall back to nuget reference assemblies
#15600 opened
Feb 13, 2024 -
Ruby: add additional sources on the request object of Rails
#15604 opened
Feb 13, 2024 -
C#: Add more `environment` and `commandargs` sources for the C# Standard Library
#15605 opened
Feb 13, 2024 -
Golang: fix flow from a map value via a range statement
#15613 opened
Feb 14, 2024 -
Ruby: Add additional sql sinks for ActiveRecord connection methods
#15619 opened
Feb 14, 2024 -
C# 12: Primary constructor inititalizers.
#15625 opened
Feb 15, 2024 -
Cpp non constant format as path query
#15628 opened
Feb 15, 2024 -
C#: Remove `Stored` variants of queries
#15629 opened
Feb 15, 2024 -
Dataflow: Fix flow-feature bug for parameterless static functions
#15632 opened
Feb 16, 2024 -
C++: Assume modelled functions always override buffers by default
#15633 opened
Feb 16, 2024 -
Dataflow: Bugfix for field reads in SimpleGlobal.
#15634 opened
Feb 16, 2024 -
C++: Support C++20 range-based for initializers
#15638 opened
Feb 16, 2024 -
Java: Sensitive Logging: Simplify definition of source and improve QLDoc
#15643 opened
Feb 16, 2024 -
Kotlin 2: Accept changes in library-tests/methods
#15645 opened
Feb 16, 2024 -
Java: Add tests for Maven wrapper
#15646 opened
Feb 16, 2024
13 Issues closed by 10 people
-
Java: Add sinks for `sun.misc.Unsafe`
#15247 closed
Feb 15, 2024 -
False negative: NestJS TypeORM SQLInjection vulnerability not detected
#15299 closed
Feb 14, 2024 -
False positive - Incomplete string escaping or encoding
#15610 closed
Feb 14, 2024 -
Workflows get stuck on forks
#15464 closed
Feb 14, 2024 -
Java: VariableAssign (LocalVariableDeclExpr) is not an Assignment
#3266 closed
Feb 14, 2024 -
`.github/workflows/qhelp-pr-preview.yml` shouldn't upload-artifact if `cancelled()`
#15588 closed
Feb 13, 2024 -
Workflows are missing permissions requests
#15462 closed
Feb 12, 2024 -
PowerShell keeps open file handle to build-tracer.log when using indirect build tracing
#15572 closed
Feb 12, 2024 -
[Java][UrlRedirect] False positive when doing string concat
#15553 closed
Feb 12, 2024 -
False positive - "zx" npm package usage is mistakenly detected as jQuery usage
#15286 closed
Feb 12, 2024 -
False positive
#15581 closed
Feb 12, 2024 -
False positive
#15580 closed
Feb 12, 2024 -
Python code QL reports (invalid?) parse error
#14863 closed
Feb 11, 2024
2 Issues opened by 2 people
-
Autobuild uses very old maven and maven wrapper
#15636 opened
Feb 16, 2024 -
Yaml scripts appear to be non-executable
#15598 opened
Feb 13, 2024
26 Unresolved conversations
Sometimes conversations happen on old items that aren’t yet closed. Here is a list of all the Issues and Pull Requests with unresolved conversations.
-
C#: Models as Data Documentation
#15563 commented on
Feb 16, 2024 • 21 new comments -
C++: Add implicit destructors for named variables to the IR
#15506 commented on
Feb 16, 2024 • 19 new comments -
C++: Change sources in `NonConstantFormat.ql`
#15516 commented on
Feb 16, 2024 • 8 new comments -
Java: Cache interpretElement.
#15570 commented on
Feb 13, 2024 • 5 new comments -
JS: False negative - unsafe postMessage handler not detected
#15571 commented on
Feb 12, 2024 • 2 new comments -
False positive - LogInjection (CWE 117) is not mitigated via Log4j2 %{encodeCRLF) pattern
#15574 commented on
Feb 13, 2024 • 2 new comments -
Java: Add query for insecurely generated keys for local authentication.
#15548 commented on
Feb 16, 2024 • 2 new comments -
Ruby: Block flow into flow sources
#15483 commented on
Feb 13, 2024 • 2 new comments -
Ruby: Fix formatting in changelog
#15562 commented on
Feb 11, 2024 • 1 new comment -
Go: new query for detect DOS vulnerability
#15130 commented on
Feb 15, 2024 • 1 new comment -
Go: Update autobuilder to deal with the upcoming deprecation of the legacy GOPATH mode
#15361 commented on
Feb 16, 2024 • 1 new comment -
Java: Fix `ClassInstanceExpr::isDiamond` not working for anonymous classes
#15429 commented on
Feb 15, 2024 • 1 new comment -
Kotlin: Compile tests using the same jdk as the java tests.
#15568 commented on
Feb 15, 2024 • 0 new comments -
python: remove a use of points-to
#15550 commented on
Feb 11, 2024 • 0 new comments -
Java: test changes for making buildless' classpath ordering deterministic
#15445 commented on
Feb 16, 2024 • 0 new comments -
C#: Refactor C# queries to use `ThreatModelFlowSource` instead of `RemoteFlowSource`
#15419 commented on
Feb 15, 2024 • 0 new comments -
C#: Experiment with having no DB stats
#15406 commented on
Feb 12, 2024 • 0 new comments -
[Python] Add Unicode DoS (qhelp, tests and the query)
#15319 commented on
Feb 13, 2024 • 0 new comments -
Go: Support Go 1.22
#15202 commented on
Feb 16, 2024 • 0 new comments -
Data flow: prune context-sensitivity relations
#15140 commented on
Feb 12, 2024 • 0 new comments -
JS: Decompression Bombs
#13554 commented on
Feb 11, 2024 • 0 new comments -
Python codeql analysis hangs at `UnusedModuleVariable`
#15466 commented on
Feb 12, 2024 • 0 new comments -
SARIF produced in `csharp` scan contains `NaN` values
#15508 commented on
Feb 11, 2024 • 0 new comments -
Shadowing happens when overriding method
#15525 commented on
Feb 11, 2024 • 0 new comments -
cpp - compiler support
#15530 commented on
Feb 11, 2024 • 0 new comments -
Python : Unable to follow taint through indirect calls
#14842 commented on
Feb 11, 2024 • 0 new comments