github / codeql Public

12 Pull requests merged by 10 people

• C++: relax ambiguously-signed-bit-field by allowing GLib's gboolean

  #7493 merged Jan 4, 2022

• Python: Fix another change note typo

  #7508 merged Jan 4, 2022

• QL: add "modelling/modeling" to `ql/non-us-spelling`

  #7458 merged Jan 4, 2022

• Propagate taint through AbstractStringBuilder.reverse()

  #7500 merged Jan 4, 2022

• CPP: Add query for CWE-266 Incorrect Privilege Assignment

  #6949 merged Jan 4, 2022

• Python: Fix typo in change note

  #7506 merged Jan 4, 2022

• Ruby: Flow through arrays/enumerables

  #7198 merged Jan 4, 2022

• JS/Py/Ruby: Add more CWEs to bad-tag-filter queries

  #7369 merged Jan 4, 2022

• C#: Re-factor the ForEachCapture query to use MaD flow summaries.

  #7468 merged Jan 4, 2022

• Move change notes to correct location

  #7503 merged Jan 4, 2022

• Post-release preparation for codeql-cli-2.7.4

  #7407 merged Jan 3, 2022

• QL: Support trailing comma in set literals

  #7502 merged Jan 3, 2022

6 Pull requests opened by 5 people

• Fix example in JavaScript query

  #7489 opened Dec 29, 2021

• Update clap requirement from 2.33 to 3.0 in /ruby/generator

  #7498 opened Jan 3, 2022

• Update clap requirement from 2.33 to 3.0 in /ruby/extractor

  #7499 opened Jan 3, 2022

• C#: Refactor and cleanup in LibraryTypeDataFlow

  #7507 opened Jan 4, 2022

• C#: Treat QL test stubs as not from source

  #7509 opened Jan 4, 2022

• Release preparation for version 2.7.5

  #7510 opened Jan 4, 2022

5 Issues closed by 4 people

• LGTM.com - false positive - cpp/ambiguously-signed-bit-field with glib

  #7491 closed Jan 4, 2022

• java/ql/src/Security/CWE/CWE-020/ExternalAPIsUsedWithUntrustedData.ql. Error was: Unknown kind "Table" when converting to analysis model. [UNSUPPORTED_KIND]

  #7494 closed Jan 1, 2022

• dataflow can't flow from one project to another in java query

  #7492 closed Dec 31, 2021

• Broken link to query in documentation

  #7484 closed Dec 29, 2021

• General issue

  #7487 closed Dec 29, 2021

5 Issues opened by 4 people

• LGTM.com - false positive

  #7497 opened Jan 3, 2022

• LGTM.com - TypeScript unused import false positive

  #7490 opened Dec 29, 2021

• JavaScript type confusion documentation example mistake

  #7488 opened Dec 29, 2021

• [Feature Request] support add constraint on typeVariable while perform virtual dispatch in java query

  #7486 opened Dec 29, 2021

• Unsafe Jquery Plugin - Potential False Negative

  #7485 opened Dec 28, 2021

9 Unresolved conversations

Sometimes conversations happen on old items that aren’t yet closed. Here is a list of all the Issues and Pull Requests with unresolved conversations.

• JS: DB reads as taint sources

  #7474 commented on Jan 4, 2022 • 5 new comments

• C++: split `cpp/overrunning-write` into two

  #7386 commented on Dec 28, 2021 • 3 new comments

• Ruby: Add `rb/weak-cookie-configuration` query

  #7313 commented on Jan 4, 2022 • 2 new comments

• QL: Add query detecting suspiciously missing parameters from the QLDoc of a predicate

  #7450 commented on Jan 4, 2022 • 2 new comments

• C#: Introduce flow summaries for StringValues.

  #7465 commented on Jan 4, 2022 • 2 new comments

• Python: Port and extend XXE modeling

  #6112 commented on Jan 4, 2022 • 1 new comment

• Python: Add shutil module sinks for path injection query

  #7455 commented on Jan 4, 2022 • 1 new comment

• C#: Promote existing ad-hoc consistency checks to consistency queries

  #7469 commented on Jan 4, 2022 • 1 new comment

• JS: Improve performance of ATM queries on large databases

  #7475 commented on Dec 29, 2021 • 0 new comments