github / codeql Public

Dataflow: Add default taint sanitizer guard

Java: A few perf fixes for getASupertype*().

Java: Add Spring and Apache Common Langs taint flow steps

JS: DB reads as taint sources

C#: Narrow string interpolation expressions to a specific single file in testcase.

JS/PY/RB: support a limited number of ranges for ReDoS analysis

… in testcase.

Update CSV framework coverage reports

JS: Bump ATM pack versions to 0.0.4

…ameter

C++: Smaller join in `reachesRefParameter`

This was done manually, as these files are not synced by sync-files.py.

Done automatically using sync-files.py

This allows languages to specify A sanitizer guard in all
global taint flow configurations but not in local taint.

…-opt

ATM: Optimize body tokens by pushing in size restriction

Java: Fix toString on field declarations with single field

Add models for AbstractStringBuilder.substring,subsequence,getChars

Update CSV framework coverage reports

C#: Record types are allowed to seal ToString (test only).

Move upgrades into standard library packs

C++: Use an IPA type rather than negative indexes for argument/parameter matching in data flow

Java: Promote Log Injection from experimental