{{ message }}
Repository navigation
Commit 62a7d94
File tree
- actions/ql
- integration-tests/query-suite
- lib
- change-notes/released
- codeql/actions
- dataflow
- security
- ext/config
- src
- Security
- CWE-077
- CWE-349
- CWE-829
- change-notes/released
- experimental/Security
- CWE-074
- CWE-284
- test
- library-tests/reusable-workflow-callers
- .github/workflows
- query-tests/Security
- CWE-074
- .github/workflows
- CWE-077
- .github/workflows
- CWE-094
- .github/workflows
- CWE-284
- .github/workflows
- CWE-349
- .github/workflows
- CWE-367
- CWE-829
- cpp/ql
- lib
- change-notes/released
- ext
- semmle/code/cpp
- dataflow
- internal
- ir/dataflow/internal
- security
- src
- Critical
- Security/CWE/CWE-114
- change-notes/released
- test
- examples/BadLocking
- experimental/query-tests/Security/CWE
- CWE-020
- NoCheckBeforeUnsafePutUser
- semmle/tests
- CWE-078
- CWE-1041/semmle/tests
- CWE-1126/semmle/tests
- CWE-1240
- CWE-125/semmle/tests
- CWE-190
- AllocMultiplicationOverflow
- DangerousUseOfTransformationAfterOperation
- IfStatementAdditionOverflow
- CWE-193
- array-access
- constant-size
- CWE-200
- test1
- test2
- test3
- CWE-243/semmle/tests
- CWE-266/semmle/tests
- CWE-285
- CWE-295
- CWE-359/semmle/tests
- CWE-369/semmle/tests
- CWE-377/semmle/tests
- CWE-401/semmle/tests
- CWE-409/DecompressionBombs
- CWE-415/semmle/tests
- CWE-476/semmle/tests
- CWE-561/semmle/tests
- CWE-670/semmle/tests
- CWE-675/semmle/tests
- CWE-691/semmle/tests
- CWE-703/semmle/tests
- CWE-754/semmle/tests
- CWE-758/semmle/tests
- CWE-783/semmle/tests
- CWE-788/semmle/tests
- CWE-805/semmle/tests
- semmle/tests
- library-tests
- dataflow
- external-models
- models-as-data
- ir
- ir
- ssa
- lossy_pointer_cast
- syntax-zoo
- query-tests
- Architecture
- FeatureEnvy
- Refactoring Opportunities
- ClassesWithManyFields
- ComplexFunctions
- Best Practices
- GuardedFree
- Hiding
- DeclarationHidesParameter
- DeclarationHidesVariable
- LocalVariableHidesGlobalVariable
- Likely Errors
- CommaBeforeMisleadingIndentation
- OffsetUseBeforeRangeCheck
- Slicing
- Magic Constants
- Japanese Era
- MagicConstantsNumbers
- MagicConstantsString
- RuleOfTwo
- SloppyGlobal
- Unused Entities
- UnusedIncludes
- UnusedLocals
- UnusedStaticFunctions
- UnusedStaticVariables
- Critical
- DeadCodeFunction
- DeadCodeGoto
- FileClosed
- GlobalUseBeforeInit
- InitialisationNotRun
- LargeParameter
- MemoryFreed
- MissingCheckScanf
- MissingNullTest
- NewFree
- NotInitialised
- OverflowCalculated
- OverflowStatic
- ReturnValueIgnored
- SizeCheck
- UnsafeUseOfThis
- Documentation/DocumentApi
- Header Cleanup/Cleanup-DuplicateIncludeGuard
- subfolder
- JPL_C
- LOC-3
- Rule 13
- LimitedScopeFile
- LimitedScopeFunction
- Rule 17
- LOC-4
- Rule 29/NonConstFunctionPointer
- Rule 30/FunctionPointerConversions
- Likely Bugs
- AmbiguouslySignedBitField
- Arithmetic
- BadAdditionOverflowCheck
- BadCheckOdd
- BitwiseSignCheck
- ComparisonPrecedence
- FloatComparison
- IntMultToLong
- PointlessComparison
- UnsignedGEZero
- ContinueInFalseLoop
- Conversion
- ArrayArgSizeMismatch
- CastArrayPointerArithmetic
- ImplicitDowncastFromBitfield
- LossyFunctionResultCast
- Format
- NonConstantFormat
- SnprintfOverflow
- WrongNumberOfFormatArguments
- WrongTypeFormatArguments
- Buildless
- Builtin
- Linux_mixed_byte_wprintf
- Linux_mixed_word_size
- Linux_signed_chars
- Linux_two_byte_wprintf
- Linux_unsigned_chars
- Microsoft_no_wchar
- Microsoft
- InconsistentCheckReturnNull
- Leap Year
- Adding365DaysPerYear
- UncheckedLeapYearAfterYearModification
- UnsafeArrayForDaysOfYear
- Likely Typos
- AssignWhereCompareMeant
- CompareWhereAssignMeant
- DubiousNullCheck
- ExprHasNoEffect
- CMakeFiles/CMakeScratch/TryCompile-abcdef
- autoconf
- meson-private/tmp_abc
- IncorrectNotOperatorUsage
- ShortCircuitBitMask
- UsingStrcpyAsBoolean
- inconsistentLoopDirection
- Memory Management
- AllocaInLoop
- ImproperNullTermination
- NtohlArrayNoBound
- Padding
- More64BitWaste
- NonPortablePrintf
- Suboptimal64BitType
- PointerOverflow
- ReturnCstrOfLocalStdString
- ReturnStackAllocatedMemory
- StackAddressEscapes
- StrncpyFlippedArgs
- SuspiciousCallToMemset
- SuspiciousCallToStrncat
- SuspiciousSizeof
- UnsafeUseOfStrcat
- UsingExpiredStackAddress
- OO
- IncorrectConstructorDelegation
- NonVirtualDestructorInBaseClass
- ThrowInDestructor
- Protocols
- RedundantNullCheckSimple
- ReturnConstTypeMember
- ReturnConstType
- ShortLoopVarName
- Underspecified Functions
- UseInOwnInitializer
- Power of 10/Rule 2
- Security/CWE
- CWE-014
- CWE-022/SAMATE/TaintedPath
- CWE-078
- SAMATE/ExecTainted
- semmle/ExecTainted
- CWE-079/semmle/CgiXss
- CWE-114
- SAMATE/UncontrolledProcessOperation
- semmle/UncontrolledProcessOperation
- CWE-119
- SAMATE
- semmle/tests
- CWE-120/semmle
- UnsafeUseOfStrcat
- tests
- CWE-121/semmle/tests
- CWE-129
- SAMATE/ImproperArrayIndexValidation
- semmle/ImproperArrayIndexValidation
- CWE-131/NoSpaceForZeroTerminator
- CWE-134
- SAMATE
- semmle
- argv
- consts
- funcs
- globalVars
- ifs
- CWE-190
- SAMATE
- semmle
- ArithmeticUncontrolled
- ArithmeticWithExtremeValues
- ComparisonWithWiderType
- TaintedAllocationSize
- tainted
- CWE-191/UnsignedDifferenceExpressionComparedZero
- CWE-193
- CWE-197/SAMATE/IntegerOverflowTainted
- CWE-242/semmle/tests
- CWE-253
- CWE-290/semmle/AuthenticationBypass
- CWE-295
- CWE-311/semmle/tests
- CWE-319/UseOfHttp
- CWE-326
- CWE-327
- CWE-367/semmle
- CWE-416/semmle/tests
- IteratorToExpiredContainer
- UseAfterFree
- UseOfStringAfterLifetimeEnds
- UseOfUniquePtrAfterLifetimeEnds
- CWE-428
- CWE-457/semmle
- ConditionallyUninitializedVariable
- tests
- CWE-468/semmle
- IncorrectPointerScaling
- SuspiciousAddWithSizeof
- CWE-497
- SAMATE
- semmle/tests
- CWE-570
- CWE-611
- CWE-676
- SAMATE/DangerousUseOfCin
- semmle
- DangerousUseOfCin
- PotentiallyDangerousFunction
- CWE-732
- CWE-764/semmle/tests
- CWE-772
- SAMATE
- semmle
- tests-file
- tests-memory
- CWE-807/semmle/TaintedCondition
- CWE-835/semmle/InfiniteLoopWithUnsatisfiableExitCondition
- CWE-843
- jsf
- 3.02 Code Size and Complexity/AV Rule 1
- 4.04 Environment/AV Rule 13
- 4.06 Pre-Processing Directives/AV Rule 32
- 4.09 Style/AV Rule 53 54
- 4.10 Classes
- AV Rule 73
- AV Rule 76
- AV Rule 77.1
- AV Rule 78
- AV Rule 79
- AV Rule 82
- AV Rule 85
- AV Rule 97
- 4.13 Functions
- AV Rule 107
- AV Rule 114
- 4.16 Initialization/AV Rule 145
- 4.21 Operators
- AV Rule 157
- AV Rule 164
- AV Rule 165
- AV Rule 166
- 4.22 Pointers and References/AV Rule 176
- 4.24 Control Flow Structures
- AV Rule 186
- AV Rule 193
- AV Rule 196
- AV Rule 201
- 4.28 Portable Code/AV Rule 210
- csharp
- extractor/Semmle.Extraction.CSharp.DependencyFetching
- ql
- campaigns/Solorigate
- lib
- change-notes/released
- src
- change-notes/released
- test/Solorigate
- integration-tests
- all-platforms
- blazor_net_8
- BlazorTest/Components
- Pages
- blazor
- BlazorTest/Components
- Pages
- standalone_buildless_option
- standalone
- posix/query-suite
- windows/subst
- code
- lib
- change-notes/released
- ext
- semmle/code/csharp
- dataflow/internal
- security/dataflow
- utils/test/internal
- src
- Security Features
- CWE-020
- CWE-114
- change-notes/released
- codeql-suites
- test
- experimental
- CWE-918
- Security Features
- CWE-759
- JsonWebTokenHandler
- Serialization
- backdoor
- library-tests
- arguments
- assignments
- attributes
- comments
- compilations
- constructors
- conversion/operator
- csharp11
- csharp6
- csharp7.1
- csharp7.2
- csharp7.3
- csharp7
- csharp8
- csharp9
- dataflow
- implicittostring
- tuples
- definitions
- delegates
- diagnostics
- dynamic
- enums
- events
- exceptions
- expressions
- extension
- fields
- filters/ClassifyFiles
- frameworks/microsoft/aspnetcore/blazor
- generics
- goto
- indexers
- initializers
- linq
- members
- methods
- nameof
- namespaces
- nestedtypes
- operators
- partial
- properties
- statements
- stringinterpolation
- types
- unsafe
- query-tests
- API Abuse
- CallToGCCollect
- CallToObsoleteMethod
- ClassDoesNotImplementEquals
- ClassImplementsICloneable
- DisposeNotCalledOnException
- InconsistentEqualsGetHashCode
- IncorrectCompareToSignature
- IncorrectEqualsSignature
- MissingDisposeCall
- MissingDisposeMethod
- NonOverridingMethod
- NullArgumentToEquals
- UncheckedReturnValue
- ASP
- BlockCodeResponseWrite
- ComplexInlineCode
- NonInternationalizedText
- SplitControlStructure
- AlertSuppression
- Architecture
- Dependencies/MutualDependency
- Refactoring Opportunities
- FeatureEnvy
- InappropriateIntimacy
- Bad Practices
- Declarations
- EmptyInterface
- LocalScopeVariableShadowsMember
- NoConstantsOnly
- TooManyRefParameters
- EmptyCatchBlock
- Implementation Hiding
- AbstractToConcreteCollection
- ExposeRepresentation
- StaticArray
- Naming Conventions
- ConfusingMethodNames
- VariableNameTooShort
- Path Combine
- VirtualCallInConstructorOrDestructor
- CSI/CompareIdenticalValues
- Concurrency
- FutileSyncOnField
- LockOrder
- LockThis
- LockedWait
- SynchSetUnsynchGet
- UnsafeLazyInitialization
- UnsynchronizedStaticAccess
- Configuration/PasswordInConfigurationFile
- Dead Code
- NonAssignedFields
- Tests
- Documentation
- EmptyBlock
- Language Abuse
- CatchOfGenericException
- ChainedIs
- DubiousTypeTestOfThis
- ForeachCapture
- MissedTernaryOpportunity
- NestedIf
- RethrowException
- SimplifyBoolExpr
- UselessCastToSelf
- UselessIsBeforeAs
- UselessNullCoalescingExpression
- UselessUpcast
- Likely Bugs
- BadCheckOdd
- Collections
- ContainerLengthCmpOffByOne
- ContainerSizeCmpZero
- DangerousNonShortCircuitLogic
- Dynamic
- EqualsArray
- EqualsUsesAs
- EqualsUsesIs
- IncomparableEquals
- InconsistentCompareTo
- MishandlingJapaneseEra
- NestedLoopsSameVariable
- ObjectComparison
- PossibleLossOfPrecision
- RandomUsedOnce
- RecursiveEquals
- SelfAssignment
- StaticFieldWrittenByInstance
- StringBuilderCharInit
- ThreadUnsafeICryptoTransformLambda
- ThreadUnsafeICryptoTransform
- UncheckedCastInEquals
- UnsafeYearConstruction
- Linq
- MissedCastOpportunity
- MissedWhereOpportunity
- MagicConstants
- Metrics
- Files/FLinesOfCommentedCode
- RefTypes/TNumberOfFields
- Summaries
- Performance
- StringBuilderInLoop
- StringConcatenationInLoop
- UseTryGetValue
- ReadOnlyContainer
- Security Features
- CWE-011
- bad1
- bad2
- CWE-016
- ASPNetMaxRequestLength
- bad
- ASPNetPagesValidateRequest
- ASPNetRequestValidationMode
- CWE-020
- CWE-022
- TaintedPath
- ZipSlip
- CWE-078
- CWE-079
- StoredXSS
- XSSAsp
- XSSRazorPages
- Areas/TestArea/Views
- Test4
- Controllers
- Generated
- MyAreas/Test4
- Views
- Custom2
- Custom/Test3
- Other
- Test2
- Test4
- Test
- CWE-090
- CWE-091/XMLInjection
- CWE-094
- CWE-099
- CWE-112
- CWE-114/AssemblyPathInjection
- CWE-119
- CWE-201/ExposureInTransmittedData
- CWE-209
- CWE-248/MissingASPNETGlobalErrorHandler
- WebConfigOffButGlobal
- WebConfigOff
- CWE-285/MissingAccessControl/WebFormsTests
- Test1
- Test3/B
- CWE-312
- CWE-321/HardcodedSymmetricEncryptionKey
- CWE-327
- DontInstallRootCert
- InsecureSQLConnection
- InsufficientKeySize
- CWE-338
- CWE-352
- global
- missing-aspnetcore
- missing
- CWE-359
- CWE-384
- CWE-451/MissingXFrameOptions
- CodeAddedHeader
- WebConfigAddedHeaderInLocation
- WebConfigAddedHeader
- CWE-539/PersistentCookie
- CWE-548
- CWE-601/UrlRedirect
- CWE-611
- CWE-614/RequireSSL
- AddedInCode
- AddedInForms
- HttpCookiesCorrect
- RequireSSLMissing
- CWE-639
- MVCTests
- WebFormsTests
- CWE-643
- CWE-730
- ReDoSGlobalTimeout
- ReDoS
- RegexInjection
- CWE-798
- CWE-807
- CWE-838
- Telemetry
- LibraryUsage
- SupportedExternalApis
- SupportedExternalSinks
- SupportedExternalSources
- UnusedPropertyValue
- UseBraces
- Useless Code/PointlessForwardingMethod
- WriteOnlyContainer
- standalone/Likely Bugs
- IncomparableEquals
- ObjectComparison
- utils/modeleditor
- docs/codeql
- codeql-language-guides
- codeql-overview/codeql-changelog
- reusables
- go
- actions/test
- documentation/library-coverage
- downgrades/5ff5325d274ae4f86defa195577bc7c1370b72fa
- extractor
- dbscheme
- trap
- util
- ql
- consistency-queries
- change-notes/released
- integration-tests/subst
- code
- lib
- change-notes/released
- ext
- semmle/go
- dataflow/internal
- security
- upgrades/b1341734d6870b105e5c9d168ce7dec25d7f72d0
- src
- change-notes/released
- test
- library-tests/semmle/go
- Function
- concepts/LoggerCall
- frameworks/Slog
- CONSISTENCY
- query-tests/Security
- CWE-022
- CWE-079
- iac
- downgrades
- 6b6bd681890e727cb8941c05a0ff08cb033b7026
- initial
- ql
- lib
- upgrades
- e360faddae54136c353230e45afebcb36bb80a1c
- initial
- src
- scripts
- tools
- javascript/ql
- integration-tests/subst
- code
- lib
- change-notes/released
- ext
- semmle/javascript
- dataflow/internal
- frameworks
- data/internal
- security/dataflow
- src
- change-notes/released
- test
- experimental
- Security
- CWE-094-dataURL
- CWE-099
- EnvValueAndKeyInjection
- EnvValueInjection
- CWE-347
- localsource
- remotesource
- CWE-918
- SsrfIpv6TransitionIncompleteGuard
- StandardLibrary/MultipleArgumentsToSetConstructor
- library-tests/frameworks
- HTTP-heuristics
- src
- Sails
- src
- api
- controllers/attachments
- helpers
- lib
- Templating
- views
- Vue
- data
- foo/bar
- query-tests
- AngularJS/MissingExplicitInjection
- Security
- CWE-020/MissingOriginCheck
- CWE-022/TaintedPath
- api/controllers/attachments
- CWE-079/DomBasedXssWithResponseThreat
- CWE-770/MissingRateLimit
- java
- documentation/library-coverage
- kotlin-extractor
- dev
- src/main/java/com/semmle/util/files
- ql
- integration-tests
- java
- android-8-sample
- android-sample-kotlin-build-script-no-wrapper
- android-sample-kotlin-build-script
- android-sample-no-wrapper
- android-sample-old-style-kotlin-build-script-no-wrapper
- android-sample-old-style-kotlin-build-script
- android-sample-old-style-no-wrapper
- android-sample-old-style
- android-sample
- .gradle
- 9.2.0
- checksums
- fileChanges
- fileHashes
- buildOutputCleanup
- vcs-1
- build/reports/problems
- buildless-gradle-boms
- buildless-gradle-classifiers
- buildless-gradle-timeout
- buildless-gradle
- buildless-proxy-gradle
- buildless-sibling-projects
- gradle-sample2
- gradle-sample
- diagnostics
- android-gradle-incompatibility
- java-version-too-old
- no-gradle-wrapper
- gradle-sample-kotlin-script/app
- gradle-sample-without-wrapper-or-gradle-buildless
- gradle-sample
- partial-gradle-sample-without-gradle
- partial-gradle-sample
- .gradle
- 6.6.1
- fileChanges
- fileHashes
- signature-verification
- checksums
- configuration-cache
- vcs-1
- spring-boot-sample
- .gradle
- 9.2.0
- checksums
- fileChanges
- fileHashes
- buildOutputCleanup
- vcs-1
- subst
- code
- kotlin/all-platforms
- compiler_arguments
- .gradle
- 9.2.0
- checksums
- fileChanges
- fileHashes
- buildOutputCleanup
- vcs-1
- app
- diagnostics/kotlin-version-too-new
- gradle_groovy_app
- .gradle
- 9.2.0
- checksums
- fileChanges
- fileHashes
- buildOutputCleanup
- vcs-1
- app
- gradle_kotlinx_serialization
- .gradle
- 9.2.0
- checksums
- fileChanges
- fileHashes
- buildOutputCleanup
- vcs-1
- app
- kotlin_kfunction
- .gradle
- 9.2.0
- checksums
- fileChanges
- fileHashes
- buildOutputCleanup
- vcs-1
- app
- lib
- change-notes/released
- ext
- generated/llmgenerator
- semmle/code/java
- dataflow/internal
- security
- src
- change-notes/released
- test-kotlin1/library-tests/dataflow/summaries
- test-kotlin2/library-tests/dataflow/summaries
- test
- experimental/query-tests/quantum/examples
- BadMacUse
- InsecureOrUnknownNonceSource
- WeakOrUnknownKDFIterationCount
- library-tests/dataflow/local-additional-taint
- query-tests/security
- CWE-022/semmle/tests
- CWE-918
- stubs/springframework-5.8.x/org/springframework/web/reactive/function/client
- misc
- bazel
- 3rdparty/tree_sitter_extractors_deps
- codegen
- ripunzip
- scripts
- suite-helpers
- change-notes/released
- powershell/ql
- lib/semmle/code/powershell/dataflow
- flowsources
- internal
- src/queries/security/cwe-327
- examples
- test
- library-tests/frameworks/system_net_sockets
- query-tests/security/cwe-327
- DontInstallRootCert
- WeakKDFConfiguration
- python/ql
- consistency-queries
- integration-tests/subst
- code
- lib
- change-notes/released
- ide-contextual-queries
- semmle/python
- controlflow/internal
- dataflow/new/internal
- frameworks
- src
- change-notes/released
- meta/ClassHierarchy
- test
- experimental/meta
- extractor-tests/syntax_error/CONSISTENCY
- library-tests
- ControlFlow
- bindings
- evaluation-order
- store-load
- frameworks/flask
- query-tests/Security/CWE-943-NoSqlInjection/PoC
- ql
- extractor/src
- ql/src/codeql_ql/ast/internal
- ruby
- extractor/src
- ql
- integration-tests/subst
- code
- lib
- change-notes/released
- codeql/ruby
- ast/internal
- dataflow/internal
- frameworks/core
- utils/test/internal
- src
- change-notes/released
- test
- library-tests
- dataflow
- implicit-return
- string-flow
- frameworks
- action_controller
- active_support
- sinatra
- views
- query-tests/experimental/improper-memoization
- rust/ql
- integration-tests/subst
- code
- lib
- change-notes/released
- codeql/rust
- dataflow/internal
- security
- src
- change-notes/released
- test
- library-tests
- dataflow/strings
- type-inference
- CONSISTENCY
- query-tests/security/CWE-798
- swift
- extractor/mangler
- ql
- integration-tests
- autobuilder
- failure
- xcode-fails-spm-works
- osx
- hello-ios
- hello-xcode
- lib
- change-notes/released
- codeql/swift/dataflow/internal
- src
- change-notes/released
- swift-autobuilder
- tests
- hello-autobuilder
- hello-targets-with-tests-suffix
- hello-tests
- hello-workspace
- third_party/resources
- unified
- extractor
- src
- languages
- swift
- tests
- corpus/swift
- closures
- collections
- control-flow
- desugar
- expressions
- functions
- literals
- loops
- operators
- optionals-and-errors
- types
- variables
- fixtures
- tree-sitter-swift
- bindings
- node
- rust
- queries
- src
- ql
- lib
- codeql
- unified
- internal
- dev
- ide-contextual-queries
- utils/test
- internal
- src
- codeql-suites
- test/library-tests
- BasicTest
- variables
- scripts
- swift-syntax-rs
- src
- swift
- Sources/SwiftSyntaxFFI
Some content is hidden
Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
0 commit comments