codeql

codeql copied to clipboard

This should be a simple semantics-preserving refactor to eliminate references to `TNormalCall`.

aschackmull

CodeQL 2.19.1 does not work with Java 23 projects

12

After upgrading to CodeQL 2.19.1 to get Java 23 support (see issue #17564), the Java 23 project is still not analyzed successfully by CodeQL. Example project here: https://github.com/danishnawab/codeql-java23/tree/master ## Java...

danishnawab

tamasvajk

C#: Azure Function HttpTrigger SQL Injection is not being detected

3

**Description of the issue** CodeQL scan is not picking up SQL Injection vulnerability in the following Azure Function trigger: ```csharp using System.Net; using Microsoft.Azure.Functions.Worker; using Microsoft.Azure.Functions.Worker.Http; using Microsoft.Data.Sqlite; using Microsoft.Extensions.Logging;...

DavidJFowler

CodeQL version 2.18.2 doubles the amount of time spent compiling CodeQL databases

11

Hi there, I'm a committer for the Chromium project & we've been experimenting with building CodeQL databases of Chromium. Recently, we upgraded the version of CodeQL we were using to...

flowerhack

C# Dataflow limited heavily by lack of support for ServiceProvider and Dependency Injection tracking

3

**Description of the issue** Dependency injection and service provider building are some of the core concepts of .net / C# architecture that really define the characteristics of the platform. In...

ShiningMassXAcc

Bumps the npm_and_yarn group with 1 update in the /javascript/ql/test/library-tests/frameworks/Next directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss directory: [next](https://github.com/vercel/next.js). Updates `next` from 10.2.3 to 14.2.15...

dependabot[bot]

Go: Add Tainted Path sanitizers

1

Add [gorilla mux.Vars](https://pkg.go.dev/github.com/gorilla/mux#Vars) sanitizer

Kwstubbs

explicit java Function<X,Y> implementation is not tainted?

3

I hit on an issue while implementing a taint tracking use case. So I've prepared a minimal example that showcases the issue: Here is the java code: ```java import java.util.Optional;...

odipar

Overhaul of try/catch to support differentiating SEH vs C++ exception handling in IR generation.

bdrodes