codeql

codeql copied to clipboard

CodeQL fails to extract info of certain source files when compiling chromium v8

7

CodeQL CLI version: 2.16.4 OS: Ubuntu Target Project: chromium [v8](https://chromium.googlesource.com/v8/v8.git), latest Description: When trying to create CodeQL database when compiling chromium V8, sometimes I see certain source files are missing...

fullwaywang

codeql stuck for 30+ minutes during FindHDF5.cmake execution

3

On a Ubuntu 20.04 host with the following CMakeLists.txt: ``` cmake_minimum_required(VERSION 3.16) project(gdal LANGUAGES C CXX) find_package(HDF5 COMPONENTS C CXX) ``` and package libhdf5-dev installed running "cmake .." takes more...

rouault

Python: open redirect protection example is still vulnerable

2

The open redirect protection for this example is still vulnerable https://github.com/github/codeql/blob/dea922958b954416edb3505026133a9f24c37e6e/python/ql/src/Security/CWE-601/examples/redirect_good2.py#L8-L12 A target like `https:/example.com` (notice the single `/`) will be parsed as having no netloc, but browsers will redirect...

stsewd

Codeql database create fails when building mozilla

7

I'm trying to build mozilla from [this repo](https://github.com/mozilla/gecko-dev) and create a cpp codeql database. In order to that, I first run `./mach configure` and after it's done, I run the...

mies47

cant find taint flow in a LocalVariable statement

8

hi, i try to perform a taint analysis with following statment: ``` protected void handleSimReady(int phoneId) { ·········· String iccId = (uiccSlot != null) ? IccUtils.stripTrailingFs(uiccSlot.getIccId()) : null; ············ ```...

HeouDonkey

[cpp] for C code, query variable does not extract all variables (mostly const variable and not ram variable)

3

I have a database biuld with gcc or clang. In my C code which compiles I want to extract all variables defined in my project. I get all const variable...

totocaca123

Bumps [pymongo](https://github.com/mongodb/mongo-python-driver) from 3.9 to 4.6.3. Release notes Sourced from pymongo's releases. PyMongo 4.6.2 Release notes: https://www.mongodb.com/community/forums/t/pymongo-4-6-2-released/267404 PyMongo 4.6.1 Release notes: https://www.mongodb.com/community/forums/t/pymongo-4-6-1-released/255752 PyMongo 4.6.0 Release notes: https://www.mongodb.com/community/forums/t/pymongo-4-6-0-released/251866 PyMongo 4.5.0 Release...

dependabot[bot]

erik-krogh

See https://guides.rubyonrails.org/v2.3/active_record_querying.html#conditions We previously assumed a string argument - but array arguments are only vulnerable if the first element is tainted.

alexrford

Codeql using open-api generator does not take into consideration .openapi-generator-ignore

7

We are using codeql in our Jenkins environment for a java library for a product. The library contains a submodule which uses the openapi-generator maven plugin to generate classes from...

mihaileb