32 Pull requests merged by 21 people

• Ruby: Add query for access paths in model editor

  #15503 merged Feb 6, 2024

• False positive in SensitiveDataHeuristics - exclude certification from maybeCertificate() regex

  #15480 merged Feb 6, 2024

• Java: Add query for sensitive data exposed in text fields

  #15396 merged Feb 5, 2024

• Update CSV framework coverage reports

  #15517 merged Feb 5, 2024

• Kotlin: Add path transformer support

  #15477 merged Feb 2, 2024

• C++: Add PreprocBlock.qll library

  #15476 merged Feb 2, 2024

• Automodel: Do not consider `@FunctionalInterface`-typed expressions as candidates.

  #15499 merged Feb 2, 2024

• C++: Block summary flow through `strdup` and friends

  #15504 merged Feb 2, 2024

• Java: Remove two redundant models implied by CharSequence models.

  #15511 merged Feb 2, 2024

• C#: Inter-procedural dataflow for `ref` structs when used as arguments.

  #15502 merged Feb 2, 2024

• C#: Disable msbuild node reuse in dependency fetcher

  #15509 merged Feb 2, 2024

• C++: Ensure that only one Function exists for every function - take 2

  #15421 merged Feb 2, 2024

• C#: Improve messages in buildless extraction logs

  #15505 merged Feb 2, 2024

• Go: Include versions in newer Go version needed diagnostic

  #15492 merged Feb 1, 2024

• Ruby: Add another dataflow test

  #15498 merged Feb 1, 2024

• Updated dotnet version to 8.0.101

  #15475 merged Feb 1, 2024

• C#: Fix extraction of qualified delegate calls

  #15484 merged Feb 1, 2024

• Ruby: Model constructors in endpoint query on new instead of initialize

  #15490 merged Feb 1, 2024

• C#: Disable msbuild node reuse in autobuild

  #15491 merged Feb 1, 2024

• Ruby: Add Insecure Randomness Query

  #14554 merged Jan 31, 2024

• Ruby: Model flow through `ViewComponent` render methods

  #15370 merged Jan 31, 2024

• Ruby: Only model relevant files for type models

  #15485 merged Jan 31, 2024

• C#: Extract expanded compiler arguments

  #15472 merged Jan 31, 2024

• False positive fix for cpp/uninitialized-local

  #15463 merged Jan 31, 2024

• Ruby: Only generate models for public methods

  #15473 merged Jan 31, 2024

• C++: Support function calls throwing exceptions in the IR

  #15461 merged Jan 31, 2024

• Ruby: Rework `mayBenefitFromCallContext`

  #15468 merged Jan 30, 2024

• Ruby: additional unsafe deserialization sinks for ox and one for oj

  #14544 merged Jan 30, 2024

• JS/TS/Python/Ruby: Renames diagnostic query files and tests

  #15465 merged Jan 30, 2024

• Python: Add `html.escape` as HTML sanitizer

  #15398 merged Jan 30, 2024

• Ruby: Correctly report supported status of summary and neutral models

  #15470 merged Jan 30, 2024

• Ruby: Block flow from LHS of && expressions

  #15467 merged Jan 30, 2024

26 Pull requests opened by 17 people

• Check for large runners

  #15471 opened Jan 30, 2024

• C# 12: Primary constructors.

  #15474 opened Jan 30, 2024

• Revert "Ruby: additional unsafe deserialization sinks for ox and one for oj"

  #15479 opened Jan 30, 2024

• Java: Add query for insecure local authentication

  #15481 opened Jan 31, 2024

• Ruby: Block flow into flow sources

  #15483 opened Jan 31, 2024

• Java: Update MaD Declarations after Triage

  #15486 opened Jan 31, 2024

• Ruby: add docs for customizing library models with data extensions

  #15488 opened Jan 31, 2024

• C#: Additional tracking of lambdas through fields and properties

  #15489 opened Jan 31, 2024

• Declare permissions

  #15493 opened Jan 31, 2024

• Tree-sitter extractors: use fresh IDs for locations

  #15496 opened Jan 31, 2024

• Python: Support integer subscripts in the API graph

  #15497 opened Jan 31, 2024

• DO NOT MERGE. Bump automodel query pack version for release kaspersv/automodel-pack-publisher-7739955510-dryrun

  #15500 opened Feb 1, 2024

• Dataflow/Java: Support alert provenance

  #15501 opened Feb 1, 2024

• C++: Add implicit destructors for named variables to the IR

  #15506 opened Feb 1, 2024

• Shared: fix a bug in stateful outbarriers

  #15507 opened Feb 1, 2024

• JS: Add support for TS 5.4-beta

  #15510 opened Feb 2, 2024

• Added model for gettext variants.

  #15513 opened Feb 2, 2024

• Bump org.springframework:spring-context from 5.3.18 to 5.3.19 in /java/ql/test/utils/flowtestcasegenerator

  #15515 opened Feb 2, 2024

• C++: Change sources in `NonConstantFormat.ql`

  #15516 opened Feb 2, 2024

• C#: Extract dependency restore telemetry data

  #15518 opened Feb 5, 2024

• C#: Improve the `cs/path-injection` QHelp

  #15519 opened Feb 5, 2024

• Ruby: Recognise raw Erb output as XSS sink

  #15520 opened Feb 5, 2024

• Ruby: Recognise more ActiveRecord connections

  #15521 opened Feb 5, 2024

• Release preparation for version 2.16.2

  #15522 opened Feb 5, 2024

• JS: exclude tagged template literals from `js/superfluous-trailing-arguments`

  #15523 opened Feb 6, 2024

• Ruby: Add some more command injection sinks

  #15524 opened Feb 6, 2024

8 Issues closed by 7 people

• Test extraction for maven project fails

  #15422 closed Feb 6, 2024

• False positive: Certification should not match maybeCertificate()

  #15478 closed Feb 6, 2024

• Python extractor failure when Python 3.6 is used

  #15337 closed Feb 5, 2024

• cpp query does not stop

  #15442 closed Feb 2, 2024

• Kotlin Extractor does not respect SEMMLE_PATH_TRANSFORMER for Source Files

  #15382 closed Feb 2, 2024

• C++ Function Call to Undefined Function

  #9799 closed Feb 2, 2024

• How to show all the results from multiple queiries?

  #15482 closed Jan 31, 2024

• Failed to load semmle.go.controlflow: "Could not resolve module semmle.go.controlflow"

  #15469 closed Jan 31, 2024

5 Issues opened by 5 people

• Shadowing happens when overriding method

  #15525 opened Feb 6, 2024

• When I run database analyse for cpp, the exported sarif is empty while bqrs contains many warnings

  #15514 opened Feb 2, 2024

• eliminate GuardConditions that are part of Assertions in cpp

  #15512 opened Feb 2, 2024

• SARIF produced in `csharp` scan contains `NaN` values

  #15508 opened Feb 2, 2024

• explicit java Function<X,Y> implementation is not tainted?

  #15494 opened Jan 31, 2024

24 Unresolved conversations

Sometimes conversations happen on old items that aren’t yet closed. Here is a list of all the Issues and Pull Requests with unresolved conversations.

• C#: Add summaries for Span<T> and ReadOnlySpan<T>.

  #15459 commented on Feb 6, 2024 • 15 new comments

• JS: Add library for naming endpoints

  #15380 commented on Jan 31, 2024 • 15 new comments

• Workflows are missing permissions requests

  #15462 commented on Feb 1, 2024 • 10 new comments

• C#: Refactor C# queries to use `ThreatModelFlowSource` instead of `RemoteFlowSource`

  #15419 commented on Feb 5, 2024 • 6 new comments

• Go: Update autobuilder to deal with the upcoming deprecation of the legacy GOPATH mode

  #15361 commented on Feb 2, 2024 • 5 new comments

• Python: add models for `stdlib`

  #15306 commented on Feb 5, 2024 • 5 new comments

• C++: Implement models-as-data

  #15371 commented on Feb 1, 2024 • 4 new comments

• Workflows get stuck on forks

  #15464 commented on Jan 31, 2024 • 2 new comments

• Java: Extend JAXB.qll to cover Jakarta XML Binding

  #4840 commented on Feb 1, 2024 • 2 new comments

• Python codeql analysis hangs at `UnusedModuleVariable`

  #15466 commented on Feb 1, 2024 • 1 new comment

• False positive - "zx" npm package usage is mistakenly detected as jQuery usage

  #15286 commented on Feb 6, 2024 • 1 new comment

• General issue - CodeQL exiting with exit code 2

  #14866 commented on Feb 6, 2024 • 1 new comment

• Ruby: Add mysql2 model

  #14916 commented on Feb 5, 2024 • 0 new comments

• Javascript: Regex Global Flag in Test Function

  #15163 commented on Feb 1, 2024 • 0 new comments

• JS: Web Cache Deception Express

  #15180 commented on Feb 1, 2024 • 0 new comments

• C++: Accept test changes after frontend upgrade

  #15213 commented on Feb 1, 2024 • 0 new comments

• C# WIP: Change pre-finalize to run standalone extraction

  #15298 commented on Feb 1, 2024 • 0 new comments

• JS: Add Permissive CORS query (CWE-942)

  #14342 commented on Feb 1, 2024 • 0 new comments

• Ruby: Add type row for extends calls

  #15311 commented on Feb 5, 2024 • 0 new comments

• Dataflow break when using a switch statement with type assertions in golang?

  #15350 commented on Feb 1, 2024 • 0 new comments

• Tree sitter extractor: Proper handling of `LGTM_INDEX_FILTERS`

  #15365 commented on Jan 30, 2024 • 0 new comments

• Unique IDs for C++ Functions

  #15342 commented on Feb 1, 2024 • 0 new comments

• Ruby: Decompression Bombs

  #13556 commented on Feb 1, 2024 • 0 new comments

• Java: Refactor path injection sinks

  #12886 commented on Jan 30, 2024 • 0 new comments