29 Pull requests merged by 17 people

• Dataflow: Add empty provenance column to PathGraph.

  #15549 merged Feb 9, 2024

• Java: Update MaD Declarations after Triage

  #15486 merged Feb 9, 2024

• C++: Don't strip specifiers in `Node.getType`

  #15559 merged Feb 9, 2024

• Java: Refactor path injection sinks

  #12886 merged Feb 9, 2024

• C#: Try resolve relative paths in line mappings

  #15542 merged Feb 9, 2024

• Post-release preparation for codeql-cli-2.16.2

  #15560 merged Feb 8, 2024

• Release preparation for version 2.16.2

  #15557 merged Feb 8, 2024

• Ruby: Remove `ReturnValue` as access path for constructors

  #15541 merged Feb 8, 2024

• Revert "Merge pull request #15522 from github/release-prep/2.16.2"

  #15556 merged Feb 8, 2024

• Post-release preparation for codeql-cli-2.16.2

  #15531 merged Feb 8, 2024

• Kotlin 2: Some test fixes

  #15544 merged Feb 8, 2024

• C#: Simplify, getASuccessor is pruned now.

  #15547 merged Feb 8, 2024

• Update CSV framework coverage reports

  #15545 merged Feb 8, 2024

• C# Add missing Windows Forms implicit usings

  #15535 merged Feb 8, 2024

• Add supported build modes to extractor metadata

  #15532 merged Feb 7, 2024

• Added model for gettext variants.

  #15513 merged Feb 7, 2024

• C++: Fix IR generation when `ConditionDeclExpr` does not have an immediate `VariableAccess`

  #15539 merged Feb 7, 2024

• C++: Also clear the `0`'th argument of `swap`

  #15537 merged Feb 7, 2024

• C++: Add an interface for models to block flow

  #15528 merged Feb 7, 2024

• Bump the extractor-dependencies group in /go/extractor with 1 update

  #15534 merged Feb 7, 2024

• C#: Add summaries for Span<T> and ReadOnlySpan<T>.

  #15459 merged Feb 7, 2024

• C#: Extract dependency restore telemetry data

  #15518 merged Feb 7, 2024

• C++: Delete unused IR predicate

  #15529 merged Feb 6, 2024

• Java: fix typo in JndiInjection.qhelp

  #15526 merged Feb 6, 2024

• Release preparation for version 2.16.2

  #15522 merged Feb 6, 2024

• Ruby: Add query for access paths in model editor

  #15503 merged Feb 6, 2024

• False positive in SensitiveDataHeuristics - exclude certification from maybeCertificate() regex

  #15480 merged Feb 6, 2024

• Java: Add query for sensitive data exposed in text fields

  #15396 merged Feb 5, 2024

• Update CSV framework coverage reports

  #15517 merged Feb 5, 2024

28 Pull requests opened by 19 people

• Bump org.springframework:spring-context from 5.3.18 to 5.3.19 in /java/ql/test/utils/flowtestcasegenerator

  #15515 opened Feb 2, 2024

• C++: Change sources in `NonConstantFormat.ql`

  #15516 opened Feb 2, 2024

• C#: Improve the `cs/path-injection` QHelp

  #15519 opened Feb 5, 2024

• Ruby: Recognise raw Erb output as XSS sink

  #15520 opened Feb 5, 2024

• Ruby: Recognise more ActiveRecord connections

  #15521 opened Feb 5, 2024

• JS: exclude tagged template literals from `js/superfluous-trailing-arguments`

  #15523 opened Feb 6, 2024

• Ruby: Add some more command injection sinks

  #15524 opened Feb 6, 2024

• Go: Promote `go/hardcoded-key` from experimental

  #15527 opened Feb 6, 2024

• Reduce severity of `java/relative-path-command`

  #15533 opened Feb 6, 2024

• Bazel/CMake: auto detect all `cc_binary`/`cc_test` targets

  #15536 opened Feb 7, 2024

• Capture flow: Take overwrites in nested scopes into account

  #15540 opened Feb 7, 2024

• Java: Add query for insecurely generated keys for local authentication.

  #15548 opened Feb 8, 2024

• python: remove a use of points-to

  #15550 opened Feb 8, 2024

• python: Remove `TaintStepFromSummary`

  #15551 opened Feb 8, 2024

• Automodel: Improve handling of varargs and overriding in extraction queries

  #15554 opened Feb 8, 2024

• Ruby: Support erb flow for ActionController

  #15555 opened Feb 8, 2024

• Jb1/zipslip performance fix upstream

  #15558 opened Feb 8, 2024

• Kotlin 2: Accept more test changes

  #15561 opened Feb 8, 2024

• Ruby: Fix formatting in changelog

  #15562 opened Feb 8, 2024

• C#: Models as Data Documentation

  #15563 opened Feb 9, 2024

• Autotune memory

  #15564 opened Feb 9, 2024

• Java: Add extension point and default sanitizer to Open Redirect query

  #15565 opened Feb 9, 2024

• Ruby: Fix ActionController path regex

  #15566 opened Feb 9, 2024

• C#: Actually cache module `Cached`

  #15567 opened Feb 9, 2024

• Kotlin: Compile tests using the same jdk as the java tests.

  #15568 opened Feb 9, 2024

• Kotlin 2: Accept more location changes

  #15569 opened Feb 9, 2024

• Java: Cache interpretElement.

  #15570 opened Feb 9, 2024

• False negative: unsafe postMessage handler not detected

  #15571 opened Feb 9, 2024

6 Issues closed by 5 people

• eliminate GuardConditions that are part of Assertions in cpp

  #15512 closed Feb 7, 2024

• When I run database analyse for cpp, the exported sarif is empty while bqrs contains many warnings

  #15514 closed Feb 6, 2024

• Test extraction for maven project fails

  #15422 closed Feb 6, 2024

• False positive: Certification should not match maybeCertificate()

  #15478 closed Feb 6, 2024

• Python extractor failure when Python 3.6 is used

  #15337 closed Feb 5, 2024

• cpp query does not stop

  #15442 closed Feb 2, 2024

6 Issues opened by 5 people

• PowerShell keeps open file handle to build-tracer.log when using indirect build tracing

  #15572 opened Feb 9, 2024

• [Java][UrlRedirect] False positive when doing string concat

  #15553 opened Feb 8, 2024

• Advice in out-of-memory message can be misleading on Windows

  #15552 opened Feb 8, 2024

• General issue [cpp] Bug when using Macro in query

  #15538 opened Feb 7, 2024

• cpp - compiler support

  #15530 opened Feb 6, 2024

• Shadowing happens when overriding method

  #15525 opened Feb 6, 2024

26 Unresolved conversations

Sometimes conversations happen on old items that aren’t yet closed. Here is a list of all the Issues and Pull Requests with unresolved conversations.

• C++: Add implicit destructors for named variables to the IR

  #15506 commented on Feb 8, 2024 • 27 new comments

• Declare permissions

  #15493 commented on Feb 8, 2024 • 17 new comments

• Dataflow perf investigations

  #15444 commented on Feb 8, 2024 • 9 new comments

• Java: Add query for insecure local authentication

  #15481 commented on Feb 9, 2024 • 8 new comments

• Ruby: add docs for customizing library models with data extensions

  #15488 commented on Feb 7, 2024 • 7 new comments

• False positive - "zx" npm package usage is mistakenly detected as jQuery usage

  #15286 commented on Feb 6, 2024 • 4 new comments

• C++: Implement models-as-data

  #15371 commented on Feb 9, 2024 • 3 new comments

• Python: add models for `stdlib`

  #15306 commented on Feb 9, 2024 • 3 new comments

• Swift: Add Unsafe Unpacking Query (CWE-022)

  #14888 commented on Feb 8, 2024 • 3 new comments

• Java ExceptionInInitializerError - com.sun.tools.javac.code.TypeTags

  #7535 commented on Feb 8, 2024 • 2 new comments

• CodeQL adds redundant slash to upload sarif file endpoint

  #15020 commented on Feb 8, 2024 • 2 new comments

• Workflows are missing permissions requests

  #15462 commented on Feb 8, 2024 • 2 new comments

• C#: Refactor C# queries to use `ThreatModelFlowSource` instead of `RemoteFlowSource`

  #15419 commented on Feb 9, 2024 • 2 new comments

• General issue - CodeQL exiting with exit code 2

  #14866 commented on Feb 6, 2024 • 1 new comment

• Tree-sitter extractors: use fresh IDs for locations

  #15496 commented on Feb 9, 2024 • 1 new comment

• Wrong Pointer Size in Database for Chromium

  #14914 commented on Feb 7, 2024 • 1 new comment

• Java: QL Query to Detect Security Sensitive non-CSPRNG usage

  #2694 commented on Feb 6, 2024 • 1 new comment

• C#: Experiment with having no DB stats

  #15406 commented on Feb 9, 2024 • 0 new comments

• Check for large runners

  #15471 commented on Feb 7, 2024 • 0 new comments

• C# 12: Primary constructors.

  #15474 commented on Feb 9, 2024 • 0 new comments

• Ruby: Add type row for extends calls

  #15311 commented on Feb 5, 2024 • 0 new comments

• C#: Additional tracking of lambdas through fields and properties

  #15489 commented on Feb 9, 2024 • 0 new comments

• C#: Decompression Bombs

  #13558 commented on Feb 9, 2024 • 0 new comments

• C++: Accept test changes after frontend upgrade

  #15213 commented on Feb 7, 2024 • 0 new comments

• Dataflow: Support alert provenance

  #15501 commented on Feb 9, 2024 • 0 new comments

• Ruby: Add mysql2 model

  #14916 commented on Feb 5, 2024 • 0 new comments