Commit 3af408e
File tree
- .devcontainer/swift
- .github
- workflows
- actions
- extractor/tools
- ql
- lib
- change-notes
- released
- codeql/actions
- config
- controlflow/internal
- ext/config
- src
- Security
- CWE-077
- CWE-275
- CWE-312
- CWE-829
- change-notes
- released
- codeql-suites
- experimental/Security
- CWE-074
- CWE-078
- CWE-088
- CWE-200
- CWE-284
- CWE-829
- CWE-918
- test
- library-tests
- .github/workflows
- query-tests
- Security
- CWE-074
- CWE-078
- CWE-088
- CWE-094
- .github/workflows
- CWE-1395
- .github/workflows
- CWE-200
- CWE-284
- CWE-829
- .github/workflows
- CWE-918
- Violations Of Best Practice/CodeQL/.github/workflows
- cpp
- downgrades
- 1aa71a4a687fc93f807d4dfeeef70feceeced242
- 59cb96ca699929b63941e81905f9b8de7eed59a6
- e594389175c098d7225683d0fd8cefcc47d84bc1
- ql
- lib
- change-notes
- released
- experimental/cryptography/modules
- semmle/code/cpp
- commons
- controlflow
- internal
- exprs
- headers
- ir
- dataflow/internal
- implementation/raw/internal
- models/implementations
- stmts
- valuenumbering
- upgrades
- 1aa71a4a687fc93f807d4dfeeef70feceeced242
- 59cb96ca699929b63941e81905f9b8de7eed59a6
- a01d8f91b8d49259e509b574962dec90719f69a6
- src
- Architecture/Refactoring Opportunities
- Critical
- Likely Bugs/Format
- Security/CWE
- CWE-190
- CWE-843
- change-notes
- released
- codeql-suites
- test
- experimental
- library-tests/rangeanalysis/signanalysis
- query-tests/Security/CWE/CWE-409/DecompressionBombs
- library-tests
- blocks
- capture
- cpp
- c
- consteval_if
- controlflow
- guards-ir
- guards
- dataflow
- dataflow-tests
- models-as-data
- taint-tests
- headers/preprocBlock
- ir/ir
- preprocessor/preprocessor
- syntax-zoo
- query-tests
- Likely Bugs/Format/WrongTypeFormatArguments/Buildless
- Security/CWE/CWE-119
- SAMATE
- semmle/tests
- jsf/4.13 Functions/AV Rule 114
- csharp
- .vscode
- autobuilder/Semmle.Autobuild.CSharp
- documentation/library-coverage
- extractor
- Semmle.Extraction.CSharp.DependencyFetching
- Semmle.Extraction.CSharp
- CodeAnalysisExtensions
- Entities
- Expressions
- Semmle.Extraction.Tests
- ql
- campaigns/Solorigate
- lib
- change-notes/released
- src
- change-notes/released
- examples/snippets
- integration-tests
- all-platforms
- autobuild
- blazor_build_mode_none
- BlazorTest
- Components
- Layout
- Pages
- Properties
- wwwroot
- bootstrap
- linux/standalone_dotnet3
- lib
- change-notes
- released
- ext
- semmle/code/csharp
- commons
- controlflow
- internal
- dataflow
- internal
- dispatch
- exprs
- frameworks
- microsoft/aspnetcore
- system/runtime
- security/dataflow/flowsources
- src
- Bad Practices
- Likely Bugs
- Dynamic
- Telemetry
- change-notes/released
- codeql-suites
- experimental
- CWE-099
- CWE-918
- Security Features
- CWE-1004
- CWE-327/Azure
- CWE-614
- CWE-759
- JsonWebTokenHandler
- Serialization
- backdoor
- dataflow/flowsources
- utils/modelgenerator/internal
- test
- experimental
- CWE-918
- Security Features
- CWE-759
- backdoor
- library-tests
- async
- attributes
- controlflow/graph
- dataflow
- collections
- delegates
- fields
- flowsources/stored/database/dapper
- functionpointers
- global
- implicittostring
- indexers
- library
- ssa
- threat-models
- dispatch
- frameworks
- Aws
- EntityFramework
- NHibernate
- ServiceStack
- microsoft/aspnetcore/blazor
- sql
- system/data/entity
- implements
- implicittostring
- index
- iterators
- partial
- security/dataflow/flowsources
- query-tests
- API Abuse/DisposeNotCalledOnException
- Bad Practices/VirtualCallInConstructorOrDestructor
- Nullness
- Security Features
- CWE-078
- CWE-079/StoredXSS
- CWE-089
- CWE-090
- CWE-099
- CWE-201/ExposureInTransmittedData
- CWE-327/InsecureSQLConnection
- CWE-643
- CWE-798
- CWE-838
- Useless Code/RedundantToStringCall
- resources/stubs
- Amazon.Lambda.APIGatewayEvents/2.7.1
- Amazon.Lambda.Core/2.5.0
- Dapper/2.1.35
- EntityFramework/6.5.1
- Microsoft.Extensions.Configuration.Abstractions/8.0.0
- Microsoft.Extensions.Configuration.Binder/8.0.0
- Microsoft.Extensions.Configuration/8.0.0
- Microsoft.Extensions.DependencyInjection.Abstractions/8.0.0
- Microsoft.Extensions.DependencyInjection/8.0.0
- Microsoft.Extensions.Diagnostics.Abstractions/8.0.0
- Microsoft.Extensions.Diagnostics/8.0.0
- Microsoft.Extensions.Http/8.0.0
- Microsoft.Extensions.Logging.Abstractions/8.0.0
- Microsoft.Extensions.Logging/8.0.0
- Microsoft.Extensions.Options.ConfigurationExtensions/8.0.0
- Microsoft.Extensions.Options/8.0.0
- Microsoft.Extensions.Primitives/8.0.0
- Microsoft.Win32.Primitives/4.3.0
- Microsoft.Win32.SystemEvents/9.0.1
- NETStandard.Library/1.6.1
- NHibernate/5.5.2
- ServiceStack.Client/8.5.2
- ServiceStack.Common/8.5.2
- ServiceStack.Interfaces/8.5.2
- ServiceStack.OrmLite.SqlServer/8.5.2
- ServiceStack.OrmLite/8.5.2
- ServiceStack.Text/8.5.2
- ServiceStack/8.5.2
- Stub.System.Data.SQLite.Core.NetStandard/1.0.119
- System.CodeDom/6.0.0
- System.Collections/4.3.0
- System.Configuration.ConfigurationManager
- 6.0.0
- 9.0.1
- System.Console/4.3.0
- System.Data.OleDb/9.0.1
- System.Data.SQLite.Core/1.0.119
- System.Data.SQLite.EF6/1.0.119
- System.Data.SQLite/1.0.119
- System.Data.SqlClient
- 4.8.5
- 4.9.0
- System.Diagnostics.Debug/4.3.0
- System.Diagnostics.DiagnosticSource/8.0.0
- System.Diagnostics.EventLog/9.0.1
- System.Diagnostics.PerformanceCounter/9.0.1
- System.Diagnostics.Tools/4.3.0
- System.Diagnostics.Tracing/4.3.0
- System.Drawing.Common/9.0.1
- System.Globalization.Calendars/4.3.0
- System.Globalization.Extensions/4.3.0
- System.Globalization/4.3.0
- System.IO.Compression/4.3.0
- System.IO.FileSystem/4.3.0
- System.IO/4.3.0
- System.Memory/4.6.0
- System.Net.Http/4.3.0
- System.Net.Primitives/4.3.0
- System.Net.Sockets/4.3.0
- System.Reflection.Extensions/4.3.0
- System.Reflection.Primitives/4.3.0
- System.Reflection/4.3.0
- System.Resources.ResourceManager/4.3.0
- System.Runtime.Extensions/4.3.0
- System.Runtime.Handles/4.3.0
- System.Runtime.InteropServices/4.3.0
- System.Runtime/4.3.0
- System.Security.AccessControl/4.7.0
- System.Security.Cryptography.Algorithms/4.3.0
- System.Security.Cryptography.Cng/4.3.0
- System.Security.Cryptography.Csp/4.3.0
- System.Security.Cryptography.Encoding/4.3.0
- System.Security.Cryptography.ProtectedData
- 8.0.0
- 9.0.1
- System.Security.Cryptography.X509Certificates/4.3.0
- System.Security.Permissions
- 6.0.0
- 9.0.1
- System.Text.Encoding.Extensions/4.3.0
- System.Text.Encoding/4.3.0
- System.Threading.Tasks/4.3.0
- System.Threading.Timer/4.3.0
- System.Windows.Extensions
- 6.0.0
- 9.0.1
- System.Xml.XmlDocument/4.3.0
- _frameworks
- Microsoft.AspNetCore.App
- Microsoft.NETCore.App
- runtime.native.System.Data.SqlClient.sni/4.4.0
- runtime.native.System.IO.Compression/4.3.0
- runtime.native.System.Net.Http/4.3.0
- runtime.native.System/4.3.0
- scripts/stubs
- docs/codeql
- codeql-language-guides
- codeql-overview/codeql-changelog
- ql-language-reference
- reusables
- writing-codeql-queries
- go
- docs/language/learn-ql/go
- documentation/library-coverage
- extractor
- ql
- consistency-queries
- change-notes/released
- lib
- change-notes
- released
- ext
- semmle/go
- dataflow/internal
- frameworks
- stdlib
- security
- src
- change-notes/released
- codeql-suites
- experimental/CWE-942
- test
- experimental/CWE-942
- vendor
- github.com/rs/cors
- library-tests/semmle/go
- dataflow
- ExternalTaintFlow
- ExternalValueFlow
- frameworks/serialization
- javascript
- extractor
- src/com/semmle/js
- extractor
- parser
- tests
- cfg/output/trap
- es2015/output/trap
- es2016/output/trap
- es2017/output/trap
- esnext/output/trap
- flow/output/trap
- generatedcode/output/trap
- jsx
- input
- output/trap
- mozilla/output/trap
- stmts/output/trap
- strictmode/output/trap
- ts/output/trap
- variables/output/trap
- test/com/semmle/js/extractor/test
- ql
- examples/queries/dataflow
- BackendIdor
- DecodingAfterSanitization
- EvalTaint
- InformationDisclosure
- StoredXss
- TemplateInjection
- lib
- change-notes/released
- semmle/javascript
- dataflow
- internal
- explore
- filters
- frameworks
- data/internal
- internal
- flow_summaries
- security
- dataflow
- internal
- regexp
- utils/test
- src
- Performance
- Security
- CWE-020
- CWE-022
- CWE-073
- CWE-078
- CWE-079
- CWE-089
- CWE-094
- CWE-116
- CWE-117
- CWE-134
- CWE-200
- CWE-201
- CWE-209
- CWE-312
- examples
- CWE-327
- CWE-338
- CWE-346
- CWE-377
- CWE-400
- CWE-502
- CWE-506
- CWE-601
- CWE-611
- CWE-640
- CWE-643
- CWE-730
- CWE-754
- CWE-770
- CWE-776
- CWE-798
- CWE-807
- CWE-829
- CWE-834
- CWE-843
- CWE-912
- CWE-915
- CWE-916
- CWE-918
- change-notes
- released
- codeql-suites
- experimental
- Security
- CWE-094-dataURL
- CWE-099
- CWE-340
- CWE-347
- CWE-522-DecompressionBombs
- CWE-918
- CWE-942
- heuristics/ql/src/Security
- CWE-020
- CWE-078
- CWE-079
- CWE-089
- CWE-094
- CWE-117
- CWE-134
- CWE-346
- CWE-400
- CWE-502
- CWE-611
- CWE-643
- CWE-730
- CWE-770
- CWE-776
- CWE-807
- CWE-915
- poi
- meta
- alerts
- analysis-quality
- internal
- test
- experimental
- FormParsers
- PoI
- Security
- CWE-094-dataURL
- CWE-099
- EnvValueAndKeyInjection
- EnvValueInjection
- CWE-347
- localsource
- remotesource
- CWE-918
- CWE-942
- library-tests
- Arrays
- Barriers
- CallGraphs/AnnotatedTest
- Classes
- CustomLoadStoreSteps
- DataFlow
- DefUse
- FlowLabels
- FlowSummary
- Generators
- InterProceduralFlow
- LabelledBarrierGuards
- Promises
- PropWrite
- Routing
- Security/heuristics
- TaintBarriers
- TaintTracking
- TaintedUrlSuffix
- TripleDot
- TypeScript
- ImportEquals
- RegressionTests/EmbeddedTypeScriptNoTSConfig
- TSConfigReferences
- src
- TypeTracking2
- frameworks
- Angular2
- AsyncPackage
- Collections
- ComposedFunctions
- Immutable
- Nest
- global
- Next
- PropertyProjection
- ReactJS
- Redux
- Restify2
- Spife
- Templating
- Vuex
- Vue
- data
- threat-models/sources
- query-tests
- Security
- CWE-020
- IncompleteHostnameRegExp
- IncompleteUrlSchemeCheck
- IncompleteUrlSubstringSanitization
- IncorrectSuffixCheck
- UntrustedDataToExternalAPI
- CWE-022
- TaintedPath
- ZipSlip
- CWE-073
- CWE-078
- CommandInjection
- IndirectCommandInjection
- SecondOrderCommandInjection
- ShellCommandInjectionFromEnvironment
- UnsafeShellCommandConstruction
- lib
- CWE-079
- DomBasedXss
- ExceptionXss
- ReflectedXss
- StoredXss
- UnsafeHtmlConstruction
- UnsafeJQueryPlugin
- XssThroughDom
- CWE-089
- local-threat-source
- typed
- untyped
- CWE-094
- CodeInjection
- UnsafeDynamicMethodAccess
- CWE-116/IncompleteSanitization
- CWE-117
- CWE-134
- CWE-200
- CWE-201
- CWE-209
- CWE-312
- CWE-327
- CWE-338
- CWE-346
- CWE-377
- CWE-400
- DeepObjectResourceExhaustion
- ReDoS
- RemovePropertyInjection
- CWE-502
- CWE-506
- CWE-522-DecompressionBombs
- CWE-601
- ClientSideUrlRedirect
- ServerSideUrlRedirect
- CWE-611
- CWE-640
- CWE-643
- CWE-730
- CWE-754
- CWE-770/ResourceExhaustion
- CWE-776
- CWE-798
- CWE-807
- CWE-829
- CWE-834
- CWE-843
- CWE-912
- CWE-915
- PrototypePollutingAssignment
- PrototypePollutingFunction
- PrototypePollutingMergeCall
- CWE-916
- CWE-918
- filters/ClassifyFiles
- tutorials
- Analyzing data flow in JavaScript/Global data flow
- Introducing the JavaScript libraries
- java
- downgrades/38d02c063878000356a3e5db49d5a6a8f38efe24
- kotlin-extractor
- deps
- src/main/kotlin
- utils
- versions
- v_1_5_0
- v_1_6_0
- v_2_0_0-RC1
- v_2_1_20-Beta1
- ql
- integration-tests
- java
- android-8-sample
- android-sample-kotlin-build-script-no-wrapper
- android-sample-kotlin-build-script
- android-sample-no-wrapper
- android-sample-old-style-kotlin-build-script-no-wrapper
- android-sample-old-style-kotlin-build-script
- android-sample-old-style-no-wrapper
- android-sample-old-style
- android-sample
- buildless-erroneous
- buildless-gradle-classifiers
- buildless-gradle-timeout
- buildless-gradle
- buildless-maven-executable-war
- buildless-maven-existing-settings-xml
- buildless-maven-multimodule
- buildless-maven-timeout
- buildless-maven
- buildless-proxy-gradle
- buildless-proxy-maven
- buildless-sibling-projects
- buildless
- ecj-sample-noexit
- ecj-sample
- gradle-sample-kotlin-script
- gradle-sample
- maven-enforcer
- maven-sample-extract-properties
- maven-sample-large-xml-files
- maven-sample-small-xml-files
- maven-sample-xml-mode-all
- maven-sample-xml-mode-byname
- maven-sample-xml-mode-disabled
- maven-sample-xml-mode-smart
- maven-sample
- maven-wrapper-script-only
- maven-wrapper-source-only
- maven-wrapper
- multi-release-jar-java11
- multi-release-jar-java17
- partial-gradle-sample-without-gradle
- partial-gradle-sample
- spring-boot-sample
- kotlin/all-platforms/diagnostics/kotlin-version-too-new
- lib
- change-notes
- released
- config
- semmle/code/java
- dataflow
- internal
- deadcode
- frameworks
- spring
- security
- regexp
- upgrades/1fd1afa7862b82955785edd29820054ab6c9ec81
- src
- Likely Bugs/Resource Leaks
- Telemetry
- Violations of Best Practice/Dead Code
- change-notes
- released
- codeql-suites
- experimental
- Security/CWE
- CWE-016
- CWE-020
- CWE-036
- CWE-073
- CWE-078
- CWE-089
- CWE-094
- CWE-1004
- CWE-200
- CWE-208
- CWE-295
- CWE-297
- CWE-299
- CWE-327
- Azure
- CWE-346
- CWE-347
- CWE-348
- CWE-352
- CWE-400
- CWE-470
- CWE-489
- CWE-502
- CWE-522-DecompressionBombs
- CWE-548
- CWE-555
- CWE-598
- CWE-600
- CWE-601
- CWE-625
- CWE-652
- CWE-665
- CWE-755
- CWE-759
- CWE-939
- semmle/code
- java
- frameworks
- security
- xml
- semmle/code/xml
- utils/modelgenerator/internal
- test
- experimental/query-tests/security
- CWE-020
- CWE-073
- CWE-078
- CWE-089/src/main
- CWE-094
- CWE-1004
- CWE-200
- CWE-208
- NotConstantTimeCheckOnSignature
- TimingAttackAgainstHeader
- TimingAttackAgainstSignagure
- CWE-299
- CWE-327
- CWE-346
- CWE-347
- CWE-348
- CWE-352
- CWE-400
- CWE-470
- CWE-502
- CWE-522-DecompressionBombs
- CWE-555
- CWE-598
- CWE-600
- CWE-601
- CWE-625
- CWE-652
- CWE-755
- CWE-759
- library-tests
- dataflow
- capture
- null
- partial
- switchexpr
- taint-ioutils
- this-flow
- frameworks/JaxWs
- pattern-switch/dfg
- ssa
- query-tests/security/CWE-297
- misc
- bazel/3rdparty
- py_deps
- tree_sitter_extractors_deps
- codegen
- lib
- templates
- scripts
- suite-helpers
- change-notes/released
- python
- extractor
- semmle/python
- parser
- passes
- tests/parser
- tsg-python
- tsp
- src
- ql
- lib
- change-notes
- released
- semmle/python
- dataflow/new
- internal
- frameworks
- security
- dataflow
- internal
- src
- Security
- CWE-020-ExternalAPIs
- CWE-327
- CWE-730
- CWE-798
- change-notes/released
- codeql-suites
- experimental
- Security
- CWE-022bis
- CWE-091
- CWE-094
- CWE-176
- CWE-208
- TimingAttackAgainstHeaderValue
- TimingAttackAgainstSensitiveInfo
- CWE-287-ConstantSecretKey
- CWE-327/Azure
- CWE-340
- CWE-346
- CWE-348
- CWE-770
- semmle/python
- libraries
- security
- dataflow
- injection
- semmle/python/functions
- test
- extractor-tests/syntax_error
- library-tests/dataflow
- coverage
- variable-capture
- query-tests
- Functions/return_values
- Statements/unreachable
- ruby/ql
- lib
- change-notes
- released
- codeql/ruby
- controlflow
- internal
- dataflow
- internal
- experimental
- frameworks
- http_clients
- stdlib
- security
- internal
- regexp
- typetracking
- src
- change-notes/released
- codeql-suites
- experimental
- CWE-522-DecompressionBombs
- decompression-api
- manually-check-http-verb
- weak-params
- queries
- meta
- security
- cwe-611
- cwe-732
- cwe-798
- test/library-tests
- controlflow/graph
- dataflow
- barrier-guards
- call-sensitivity
- global
- frameworks
- Twirp
- active_record
- active_resource
- variables
- rust
- ast-generator/src
- extractor
- src
- generated
- translate
- ql
- integration-tests
- hello-project
- hello-workspace
- lib
- change-notes/released
- codeql/rust
- controlflow
- internal
- dataflow
- internal
- elements
- internal
- generated
- frameworks
- rustcrypto
- stdlib
- security
- internal
- utils/test
- src
- change-notes/released
- codeql-suites
- queries
- security
- CWE-312
- CWE-696
- summary
- telemetry
- utils/modelgenerator
- debug
- internal
- test
- extractor-tests/generated
- RecordPatField
- UseTree
- library-tests
- controlflow
- dataflow
- global
- local
- CONSISTENCY
- modeled
- models
- pointers
- sources
- taint
- frameworks/postgres
- path-resolution
- CONSISTENCY
- my2
- my
- sensitivedata
- variables
- query-tests
- diagnostics
- security
- CWE-089
- CWE-312
- CONSISTENCY
- CWE-696
- utils-tests/modelgenerator
- schema
- swift
- extractor
- translators
- ql
- integration-tests/osx
- hello-ios
- hello-ios.xcodeproj
- project.xcworkspace
- hello-ios
- Assets.xcassets
- AccentColor.colorset
- AppIcon.appiconset
- Preview Content/Preview Assets.xcassets
- hello-xcode
- lib
- change-notes
- released
- codeql/swift
- controlflow
- internal
- dataflow
- internal
- generated
- decl
- type
- regex
- security
- internal
- src
- change-notes/released
- codeql-suites
Some content is hidden
Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
2 | 2 | | |
3 | 3 | | |
4 | 4 | | |
| 5 | + | |
| 6 | + | |
| 7 | + | |
5 | 8 | | |
6 | 9 | | |
7 | 10 | | |
| |||
This file was deleted.
This file was deleted.
This file was deleted.
This file was deleted.
This file was deleted.
This file was deleted.
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
48 | 48 | | |
49 | 49 | | |
50 | 50 | | |
51 | | - | |
52 | | - | |
53 | | - | |
54 | | - | |
55 | | - | |
56 | | - | |
57 | 51 | | |
58 | 52 | | |
59 | 53 | | |
| |||
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
14 | 14 | | |
15 | 15 | | |
16 | 16 | | |
17 | | - | |
| 17 | + | |
18 | 18 | | |
19 | 19 | | |
20 | 20 | | |
| |||
28 | 28 | | |
29 | 29 | | |
30 | 30 | | |
31 | | - | |
| 31 | + | |
32 | 32 | | |
33 | 33 | | |
34 | 34 | | |
| |||
53 | 53 | | |
54 | 54 | | |
55 | 55 | | |
56 | | - | |
57 | | - | |
58 | | - | |
59 | | - | |
60 | | - | |
61 | | - | |
62 | | - | |
63 | | - | |
64 | | - | |
65 | 56 | | |
66 | 57 | | |
67 | 58 | | |
| |||
125 | 116 | | |
126 | 117 | | |
127 | 118 | | |
| 119 | + | |
128 | 120 | | |
129 | 121 | | |
130 | 122 | | |
| |||
217 | 209 | | |
218 | 210 | | |
219 | 211 | | |
| 212 | + | |
220 | 213 | | |
221 | 214 | | |
222 | 215 | | |
| |||
231 | 224 | | |
232 | 225 | | |
233 | 226 | | |
| 227 | + | |
234 | 228 | | |
235 | 229 | | |
236 | 230 | | |
| |||
245 | 239 | | |
246 | 240 | | |
247 | 241 | | |
| 242 | + | |
248 | 243 | | |
249 | 244 | | |
250 | 245 | | |
| |||
0 commit comments