codeql
codeql copied to clipboard
github
CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security
I created a sample SQL Server injection attack, and CodeQL is not recognizing the vulnerability. If I do the same thing for a PostgreSQL database, it recognizes the vulnerability. No...
The following pull request explicitly marks `Sinon`’s package `match` calls as non-RegExp in order to avoid false positives.
I picked this commit out of #17846 because it doesn't rely on any of the controversial API changes that are holding back that PR. It appears there are no tests...
**Description of the issue** The [Oracle Call Interface (OCI)](https://www.oracle.com/ca-en/database/technologies/appdev/oci.html) is the main low-level C API for Oracle databases. CodeQL lacks coverage for it, particularly for SQL injection sinks. While I...
Example prior work: https://github.com/github/codeql/pull/18848
New query `rust/access-after-lifetime-ended`, for detecting pointer dereferences after the lifetime of the pointed-to object has ended. Makes use of some existing tests that were created for `rust/access-invalid-pointer` (before I realized...
This is on top of https://github.com/github/codeql/pull/19524
