Contents
This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the code scanning section on the GitHub blog, relevant GitHub Changelog updates, changes in the CodeQL extension for Visual Studio Code, and the CodeQL Action changelog.
CodeQL 2.25.3 runs a total of 496 security queries when configured with the Default suite (covering 169 CWE). The Extended suite enables an additional 131 queries (covering 32 more CWE).
The codeql database finalize command now accepts the --working-dir flag. When specified, any extractor pre-finalize scripts will be run in that directory. If the flag is not used, the scripts will run in the source root directory (maintaining existing behavior). The flag will also be automatically passed through when running the higher-level codeql database create command.
Fixed alert messages in actions/artifact-poisoning/critical and actions/artifact-poisoning/medium as they previously included a redundant placeholder in the alert message that would on occasion contain a long block of yml that makes the alert difficult to understand. Also improved the wording to make it clearer that it is not the artifact that is being poisoned, but instead a potentially untrusted artifact that is consumed. Finally, changed the alert location to be the source, to align more with other queries reporting an artifact (e.g. zipslip) which is more useful.
Added AllocationFunction models for aligned_alloc, std::aligned_alloc, and bsl::aligned_alloc.
The “Comparison of narrow type with wide type in loop condition” (cpp/comparison-with-wider-type) query has been upgraded to high precision. This query will now run in the default code scanning suite.
The “Multiplication result converted to larger type” (cpp/integer-multiplication-cast-to-long) query has been upgraded to high precision. This query will now run in the default code scanning suite.
The “Suspicious add with sizeof” (cpp/suspicious-add-sizeof) query has been upgraded to high precision. This query will now run in the default code scanning suite.
The “Wrong type of arguments to formatting function” (cpp/wrong-type-format-argument) query has been upgraded to high precision. This query will now run in the default code scanning suite.
The “Implicit function declaration” (cpp/implicit-function-declaration) query has been upgraded to high precision. However, for build-mode: none databases, it no longer produces any results. The results in this mode were found to be very noisy and fundamentally imprecise.
The query cs/useless-tostring-call has been updated to avoid false positive results in calls to StringBuilder.AppendLine and calls of the form base.ToString(). Moreover, the alert message has been made more precise.
The query js/missing-rate-limiting now takes Fastify per-route rate limiting into account.
The py/bind-socket-all-network-interfaces query now uses the global data-flow library, leading to better precision and more results. Also, wrappers of socket.socket in the eventlet and gevent libraries are now also recognized as socket binding operations.
The query actions/missing-workflow-permissions no longer produces false positive results on reusable workflows where all callers set permissions.
The deprecated NonThrowingFunction class has been removed, use NonCppThrowingFunction instead.
The deprecated ThrowingFunction class has been removed, use AlwaysSehThrowingFunction instead.
Upgraded to allow analysis of Swift 6.3.
The queries “Resolving XML external entity in user-controlled data” (java/xxe) and “Resolving XML external entity in user-controlled data from local source” (java/xxe-local) now recognize sinks in the Woodstox StAX library when com.ctc.wstx.stax.WstxInputFactory or org.codehaus.stax2.XMLInputFactory2 are used directly.
The Python extractor now supports the new lazy import ... and lazy from ... import ... (as defined in PEP-810) that will be part of Python 3.15.
Removed false positive injection sink models for the context input of docker/build-push-action and the allowed-endpoints input of step-security/harden-runner.
The predicates get[L|R]Value in the class Assignment have been deprecated. Use get[Left|Right]Operand instead.
Added a subclass AutoconfConfigureTestFile of ConfigurationTestFile that represents files created by GNU autoconf configure scripts to test the build configuration.