Sunbelt Computer Software

PL/B Language Development and Support

Issues · github/codeql · GitHub

Labels Milestones New issue

[Java] Proposal: Add a CodeQL query for missing secure TransformerFactory hardening against external DTD and stylesheet access

#21757

· invoke1442 opened

on Apr 25, 2026

[Java] Proposal: Add a dedicated CodeQL query for XMLInputFactory configurations that explicitly enable external entities or DTD support

#21756

· invoke1442 opened

on Apr 25, 2026

False negative: py/ldap-injection misses taint flow for ldap3 `extend.standard.paged_search`

#21738

· 9iang22 opened

on Apr 20, 2026

False negative: missing os.exec* APIs with `sh -c` as sink in py/code-injection.

#21735

· 9iang22 opened

on Apr 19, 2026

GHAS-managed workflows reference mutable action versions, incompatible with required SHA-pinning policies

#21732

· kyleburnsdev opened

on Apr 17, 2026

[feat] comments that enable/disable LSP formatting

#21730

· k4lizen opened

on Apr 17, 2026

False negative: unzip using subprocess or `shutil.unpack_archive` is not covered in py/tarslip

#21712

· 9iang22 opened

on Apr 15, 2026

[question?] counterintuitive class method behaviour

#21670

· k4lizen opened

on Apr 8, 2026

False nagative: InsecureTemporaryFile misses source pattern `tempfile.NamedTemporaryFile(delete=False)` path exposure

#21669

· sarr424 opened

on Apr 8, 2026

py/insecure-protocol missing urllib3 ssl_version tracking & false positive on secure defaults

#21666

· 9iang22 opened

on Apr 8, 2026

False positive: "Missing cross-site request forgery token validation" in C# API for endpoint with no cookie/session tokens

#21665

· joepvtl opened

on Apr 8, 2026

Can the location of the disk cache be customised, and does CodeQL gracefully handle missing cache?

#21663

· gsutherland-trailofbits opened

on Apr 7, 2026