codeql
codeql copied to clipboard
github
CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security
- **JS: Use question-mark variant in all overlay annotations** - **Revert changes in synced files** - **Release preparation for version 2.23.8** - **Post-release preparation for codeql-cli-2.23.8**
**Description** CodeQL security scan did not recognise the CWE-116 (Improper Encoding or Escaping of Output) in a Sitemap.xml.ts file when unescaped values are embedded into XML output. **Example** A sitemap...
**Description** CodeQL currently does not detect CWE-208 (Observable Timing Discrepancy) in JavaScript/TypeScript, while this weakness is covered in Java/Kotlin, Python and Ruby. This appears to be a language coverage gap...
When a field is assigned a safe type in a constructor, that field is not exposed.
Fix some common false positive results for the `rust/unused-variable` and `rust/unused-value` queries. Typically these results look something like this: ``` match foo { MY_CONSTANT => { ... } ... }...
Makes API graphs incremental. The high-level overview is that we run the underlying data flow analysis in two global stages, where each stage is configured with a set of "roots"...
The example shows how to build a barrier guard from a MaD row. Clearly, this should be done in a convenience predicate.