| cs/cleartext-storage-of-sensitive-information | |
| cs/code-injection | |
| cs/command-line-injection | |
| cs/hardcoded-credentials | |
| cs/hash-without-salt | |
| cs/json-webtoken-handler/delegated-security-validations-always-return-true | |
| cs/json-webtoken-handler/security-validations-disabled | - Fix JWT validation in C# and ASP.NET CoreFrom the query and JsonWebTokenHandlerLib.qll: reports ValidateIssuer, ValidateAudience, ValidateLifetime, RequireExpirationTime or RequireAudience set to false, so it should flag VulnerableTokenValidation.cs and…
|
| cs/path-injection | |
| cs/redos | - Fix ReDoS in C# and ASP.NET CoreExpected to flag vulnerable and wrong. cs/redos ("Denial of Service from comparison of user input against expensive regex") detects a regex with super-linear/exponential backtracking matched against data; the nested…
|
| cs/request-forgery | - Fix SSRF in C# and ASP.NET CoreAn experimental query: the default and security-extended code-scanning suites exclude experimental/ (misc/suite-helpers), so run it by path.
|
| cs/session-reuse | |
| cs/sql-injection | - Fix SQL injection in C# and ASP.NET CoreAssignments to any CommandText that implements IDbCommand.CommandText are SQL sinks (semmle/code/csharp/frameworks/Sql.qll), which covers SqliteCommand, and MapGet handler parameters are remote flow sources…
|
| cs/unsafe-deserialization | |
| cs/web/cookie-httponly-not-set | |
| cs/web/cookie-secure-not-set | |
| cs/web/file-upload | |
| cs/web/insecure-direct-object-reference | |
| cs/web/missing-function-level-access-control | |
| cs/web/missing-token-validation | - Fix CSRF in C# and ASP.NET CoreNot expected to report anything on this card: the query checks [HttpPost] actions on ASP.NET MVC and ASP.NET Core controllers for ValidateAntiForgeryToken, a global AutoValidateAntiforgeryTokenAttribute or…
|
| cs/web/unvalidated-url-redirection | |
| cs/web/xss | - Fix cross-site scripting in C# and ASP.NET CoreExpected to flag this card: semmle/code/csharp/security/dataflow/XSSSinks.qll defines MicrosoftAspNetCoreMvcHtmlHelperRawSink as the 'Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method', so…
|
| cs/xml/insecure-dtd-handling | |
| cs/xml/xpath-injection | |
| go-security-extended | |
| go/bad-redirect-check | |
| go/command-injection | |
| go/disabled-certificate-check | |
| go/html-template-escaping-bypass-xss | |
| go/insecure-randomness | |
| go/insecure-tls | |
| go/missing-jwt-signature-check | |
| go/path-injection | |
| go/reflected-xss | |
| go/request-forgery | - Fix SSRF in Go and net/httpThree results, one per implementation: the request in impl/vulnerable.go, impl/wrong.go and impl/fixed.go, each traced from r.URL in app.go through the Fetcher interface.
|
| go/sql-injection | - Fix SQL injection in Go and net/httpFour results: the two QueryContext calls in impl/vulnerable.go and the two in impl/wrong.go, each traced from r.URL in app.go's queryParam through the Repository interface.
|
| go/uncontrolled-allocation-size | |
| go/unvalidated-url-redirection | |
| go/weak-sensitive-data-hashing | - Fix weak password hashing in Go and net/httpFive results, each a value named password reaching sha256.Sum256, which the query calls "not a computationally expensive hash function": Hash in impl/vulnerable.go, Hash and both Verify branches in impl/wrong.go, and…
|
| java/command-line-injection | |
| java/concatenated-sql-query | - Fix SQL injection in Java and Spring BootMedium-precision companion query: reports SQL built by concatenating strings that are not compile-time constants, where java/sql-injection has not already found a tainted path.
|
| java/csrf-unprotected-request-type | - Fix CSRF in Java and Spring BootExpected to flag updateEmail in VulnerableSecurity and WrongSecurity: the query treats @RequestMapping without a method, and @GetMapping, as unprotected, and reports such handlers when they reach a database update or…
|
| java/hardcoded-credential-api-call | |
| java/hash-without-salt | |
| java/http-response-splitting | |
| java/insecure-cookie | |
| java/insecure-randomness | |
| java/insecure-trustmanager | |
| java/ldap-injection | - Fix LDAP filter injection in Java and Spring BootExpected to flag the vulnerable implementation and clear the fixed one. semmle/code/java/security/LdapInjection.qll models Spring LDAP (LdapTemplate searches and LdapQueryBuilder.filter/base) and UnboundID…
|
| java/log-injection | |
| java/missing-jwt-signature-check | |
| java/partial-path-traversal-from-remote | |
| java/path-injection | - Fix path traversal in Java and Spring BootFrom the models: @RequestParam parameters are remote sources (FlowSources.qll), Path.resolve and toRealPath carry taint, and Files.readAllBytes(Path) is a path-injection sink (ext/java.nio.file.model.yml).
- Fix unrestricted file upload in Java and Spring BootFrom ext/org.springframework.web.multipart.model.yml: getOriginalFilename() and getContentType() are remote sources, and Path.resolve() carries taint (ext/java.nio.file.model.yml).
|
| java/predictable-seed | |
| java/redos | - Fix ReDoS in Java and Spring Bootjava/redos ("Inefficient regular expression") detects super-linear/exponential ambiguity in a pattern, and java/polynomial-redos needs a dataflow path from an untrusted source (@RequestParam) into the match.
|
| java/sensitive-cookie-not-httponly | |
| java/sensitive-log | - Fix hard-coded secrets in Java and Spring BootNot expected to report the vulnerable log line: SensitiveLoggingQuery.qll takes reads of sensitively named variables as sources but excludes compile-time constants, and FORECAST_API_KEY is a static final String constant.
|
| java/server-side-template-injection | |
| java/spel-expression-injection | - Fix code injection in Java and Spring BootModels an expression parsed by SpelExpressionParser and evaluated against a StandardEvaluationContext as a SpEL-injection sink, with @RequestBody as a remote source, so it is expected to flag the vulnerable and wrong…
- Fix server-side template (SpEL) injection in Java and Spring BootModels an expression parsed by SpelExpressionParser and evaluated against a StandardEvaluationContext as a SpEL-injection sink, with @RequestParam as a remote source, so this query is expected to flag the vulnerable…
|
| java/spring-disabled-csrf-protection | - Fix CSRF in Java and Spring BootExpected to flag VulnerableSecurity and WrongSecurity: java/ql/lib/semmle/code/java/security/SpringCsrfProtection.qll matches disable() called on CsrfConfigurer<HttpSecurity>, which covers the lambda form, and…
|
| java/sql-injection | |
| java/ssrf | |
| java/unsafe-deserialization | |
| java/unsafe-hostname-verification | - Fix TLS certificate validation in Java and Spring BootThe CWE-297 query looks for HostnameVerifier implementations that accept every host, as used by HttpsURLConnection and Apache HttpClient. java.net.http.HttpClient has no HostnameVerifier, so it does not apply to this…
|
| java/unvalidated-cors-origin-set | |
| java/unvalidated-url-redirection | - Fix open redirects in Java and Spring BootFrom the query source: sinks are HttpServletResponse.sendRedirect, Location headers set with setHeader or addHeader, Apache HttpComponents Location headers and modelled sinks; none of the Spring model files marks…
|
| java/xml/xpath-injection | - Fix XPath injection in Java and Spring BootModels a string built from remote input and passed to XPath.compile/evaluate as an XPath-injection sink, with @RequestBody/@RequestParam as sources, so it is expected to flag the vulnerable concatenation and the…
|
| java/xss | - Fix cross-site scripting in Java and Spring BootLikely to miss this card too. semmle/code/java/security/XSS.qll models sinks that write to a servlet, JSP or JSF response and treats HtmlUtils.htmlEscape as a sanitizer, but it does not model Thymeleaf th:utext, so a…
|
| java/xxe | |
| js/clear-text-cookie | |
| js/clear-text-logging | |
| js/client-exposed-cookie | |
| js/code-injection | - Fix code injection in Node.js and ExpressModels eval, the Function constructor and the node:vm functions (runInContext/runInNewContext/runInThisContext) as code-execution sinks and HTTP request data as a source, so it is expected to flag the vulnerable new…
- Fix server-side template injection in Node.js and ExpressCodeQL's JavaScript library models EJS as a template engine (EjsStyleSyntax, package 'ejs', in semmle/javascript/frameworks/Templating.qll) and treats a template compiled from untrusted input as a code-injection…
|
| js/command-line-injection | |
| js/cors-misconfiguration-for-credentials | - Fix CORS misconfiguration in Node.js and ExpressNot expected to report anything on this card: it tracks remote input or a null value into an Access-Control-Allow-Origin header that a route handler sets explicitly next to Access-Control-Allow-Credentials: true, and…
|
| js/cors-permissive-configuration | - Fix CORS misconfiguration in Node.js and ExpressFrom the query source and javascript/ql/lib/ext/cors.model.yml: the origin option of cors() is a sink, and true, null, "*" or remote input reaching it is reported unless the same options set credentials: false.
|
| js/decode-jwt-without-verification | - Fix JWT validation in Node.js and ExpressFrom the query and its JWT.qll: it reports remote input that reaches jose's decodeJwt() (or jsonwebtoken's decode(), jwt-decode, jwt-simple without verification) and never reaches a verifying call.
- Fix JWT validation in TypeScript and Next.jsReports remote input that reaches jose's decodeJwt() and never a verifying call, but it is experimental (not in the default or security-extended suites).
|
| js/disabling-certificate-validation | |
| js/hardcoded-credentials | |
| js/http-to-file-access | |
| js/insecure-randomness | |
| js/insufficient-password-hash | |
| js/jwt-missing-verification | |
| js/log-injection | |
| js/missing-token-validation | - Fix CSRF in Node.js and ExpressFrom the query source: it reports handlers registered for a specific unsafe method (app.post, app.put and so on, not app.all) that read req.session or req.cookies behind cookie middleware such as express-session, and…
|
| js/path-injection | - Fix path traversal in Node.js and ExpressFrom TaintedPathCustomizations.qll and NodeJSLib.qll: node:-prefixed and fs/promises imports are modelled, path.resolve and the callback and sync forms of fs.realpath count as normalisation, and a startsWith(dir)…
- Fix path traversal in TypeScript and Next.jsNext.qll models request.url of a GET exported from app/**/route.ts as a remote source; here GET is the return value of a factory in lib/files-handler.ts, and whether the analysis follows it was not tested.
- Fix unrestricted file upload in Node.js and ExpressFrom Express.qll: req.file and req.files are modelled as request input, but the file object multer passes to the diskStorage filename callback is not, and the vulnerable code has no file-system call of its own for…
|
| js/prototype-polluting-assignment | |
| js/prototype-pollution | |
| js/redos | - Fix ReDoS in Node.js and ExpressExpected to flag vulnerable.js and wrong.js. js/redos ("Inefficient regular expression") statically analyses the pattern for a sub-expression with exponential or super-linear ambiguity; the nested quantifier…
|
| js/reflected-xss | - Fix cross-site scripting in Node.js and ExpressExpected to model this card: semmle/javascript/frameworks/Templating.qll understands EJS delimiters and which interpolation escapes (getEscapingInterpolationRegexp), so a request value reaching a <%- %> placeholder…
|
| js/request-forgery | |
| js/second-order-command-line-injection | |
| js/server-side-unvalidated-url-redirection | |
| js/session-fixation | |
| js/shell-command-injection-from-environment | |
| js/sql-injection | |
| js/unsafe-deserialization | |
| js/xss | |
| py/clear-text-logging-sensitive-data | |
| py/client-exposed-cookie | |
| py/code-injection | - Fix code injection in Python and FlaskCodeInjectionCustomizations.qll treats the code argument of any modelled code execution (eval) as a sink, and Flask.qll makes the request body a remote source, so the vulnerable and wrong eval(expression, ...) should…
- Fix code injection in Python and FastAPICodeInjectionCustomizations.qll treats the code argument of any modelled code execution (eval) as a sink, and FastApi.qll makes the request body a remote source, so the vulnerable and wrong eval(expression, ...)…
- Fix server-side template injection in Python and FlaskCompanion CWE-094 query for code built from untrusted input (eval/exec and template construction); listed for coverage alongside py/template-injection.
|
| py/command-line-injection | |
| py/cors-bypass | |
| py/cors-misconfiguration-with-credentials | |
| py/csrf-protection-disabled | - Fix CSRF in Python and FlaskNot expected to report anything on this card: the only CSRF settings the Python library models are Django's MIDDLEWARE list and its csrf decorators (semmle/python/frameworks/Django.qll); Flask and Flask-WTF are not…
- Fix CSRF in Python and DjangoNot expected to flag this card.
|
| py/full-ssrf | |
| py/hardcoded-credentials | - Fix hard-coded secrets in Python and FlaskNot expected to report anything: its sinks are keyword arguments and comparisons with names that look like a password, user name or certificate, plus credentials-* models, of which the Python library has none for…
|
| py/http-response-splitting | - Fix CRLF and log injection in Python and FlaskNot expected to flag this card: its sinks are header writes whose value can carry a newline, and the Flask and Werkzeug models declare valueAllowsNewline() as none, matching Werkzeug's ValueError.
|
| py/insecure-cookie | |
| py/jwt-missing-verification | - Fix JWT validation in Python and FlaskFrom the query and its PyJWT model (python/ql/src/experimental/semmle/python/libraries/PyJWT.qll): it reports a jwt.decode() call whose verify argument is False or whose options dict literal has any key containing…
- Fix JWT validation in Python and FastAPIFrom the query and its PyJWT model (python/ql/src/experimental/semmle/python/libraries/PyJWT.qll): it reports a jwt.decode() call whose verify argument is False or whose options dict literal has any key containing…
|
| py/ldap-injection | - Fix LDAP filter injection in Python and FlaskExpected to flag the vulnerable and wrong implementations and clear the fixed one. semmle/python/frameworks/Ldap3.qll models ldap3 Connection.search as the LDAP filter sink, escape_filter_chars as the filter…
|
| py/log-injection | - Fix CRLF and log injection in Python and FlaskFrom the source: the sink is any input of a logging call, the msg argument, the format arguments and extra=; the sanitizer is a .replace() whose first argument is the literal "\n" or "\r\n", with a comment that it…
|
| py/nosql-injection | - Fix NoSQL operator injection in Python and FlaskThe query's PyMongo model (semmle/python/frameworks/PyMongo.qll) treats the filter of the find methods (find, find_one, find_one_and_update and others) and aggregate on collections reached from pymongo.MongoClient…
|
| py/path-injection | - Fix path traversal in Python and FlaskFrom PathInjectionQuery.qll and frameworks/Stdlib.qll: the model treats a path as checked after a normalisation (os.path.normpath, abspath or realpath) followed by a str.startswith test. pathlib's / operator and…
- Fix path traversal in Python and FastAPIFastApi.qll models FileResponse's path argument as file-system access and the path query parameter as a remote source.
- Fix path traversal in Python and DjangoFrom PathInjectionQuery.qll and frameworks/Stdlib.qll: the model treats a path as checked after a normalisation (os.path.normpath, abspath or realpath) followed by a str.startswith test. pathlib's / operator and…
- Fix unrestricted file upload in Python and FlaskFrom Flask.qll and Werkzeug.qll: request.files.get() returns a modelled FileStorage, its filename attribute carries taint, and FileStorage.save() is a file-system access whose first argument is a path sink, so the…
- Fix unrestricted file upload in Python and FastAPIFastApi.qll treats path-operation parameters as remote sources; whether UploadFile.filename carries taint into the vulnerable open(os.path.join(uploads, avatar.filename)) depends on Starlette's UploadFile model…
- Fix unrestricted file upload in Python and DjangoDjango.qll makes request.FILES a remote source, so the vulnerable open(os.path.join(uploads, file.name)) may be reported although Django has already stripped the path.
|
| py/redos | - Fix ReDoS in Python and FlaskExpected to flag vulnerable.py and wrong.py. py/redos ("Inefficient regular expression") statically detects a sub-expression with super-linear/exponential ambiguity; the nested quantifier ([a-zA-Z0-9._%+-]+)+ is that…
|
| py/reflective-xss | - Fix cross-site scripting in Python and FlaskModels Flask: semmle/python/frameworks/Flask.qll treats request data as a source and render_template / render_template_string as template sinks. py/jinja2/autoescape-false is the companion that flags Jinja…
- Fix XSS in Python and DjangoNot expected to flag this card: CodeQL does not read Django template files, so |safe and striptags are invisible to it.
|
| py/request-without-cert-validation | |
| py/sql-injection | - Fix SQL injection in Python and FlaskThe Python library models sqlite3 as a PEP 249 database module (semmle/python/frameworks/Stdlib.qll), so execute() calls on its connections are SQL sinks.
- Fix SQL injection in Python and FastAPIBoth ends are modelled: FastApi.qll treats the parameters of a routed handler as remote sources, and SqlAlchemy.qll treats the first argument of sqlalchemy.text() as SQL.
- Fix SQL injection in Python and DjangoExpected to flag vulnerable.py and wrong.py: semmle/python/frameworks/Django.qll models request.GET as remote input and django.db.connection as a PEP 249 connection, so cursor.execute() is a SQL sink, and the query…
|
| py/template-injection | |
| py/unsafe-deserialization | |
| py/url-redirection | - Fix open redirects in Python and FlaskFrom the query source: sinks are HTTP redirect responses such as Flask's redirect().
- Fix open redirects in Python and FastAPIBoth ends are modelled: FastApi.qll treats routed handler parameters (Form fields included) as remote sources and the first argument of RedirectResponse as a redirect location.
- Fix open redirects in Python and DjangoFrom the sources: Django.qll models HttpResponseRedirect and redirect() as redirect sinks and request.POST as remote input, and Django.model.yml declares url_has_allowed_host_and_scheme() a barrier guard, so the…
|
| py/weak-sensitive-data-hashing | - Fix weak password hashing in Python and FlaskRead from the source, not run: a parameter named password is a sensitive source (SensitiveDataSources.qll), and for password data the input of any plain hashing call such as hashlib.sha256() is a sink, because only…
- Fix weak password hashing in Python and FastAPIRead from the source, not run: a parameter named password is a sensitive source (SensitiveDataSources.qll), and for password data the input of any plain hashing call such as hashlib.sha256() is a sink, because only…
- Fix weak password hashing in Python and DjangoRead from the source, not run: a parameter named password is a sensitive source, and for password data any plain hash such as hashlib.sha256() is a sink.
|
| py/xpath-injection | - Fix XPath injection in Python and FlaskLxml.qll models the first argument of an lxml .xpath() call (and etree.XPath/ETXPath) as an XPath sink, and Flask.qll makes request.args a remote source, so the %-formatted queries in the vulnerable and wrong code…
|
| py/xxe | |
| rb/csrf-protection-disabled | - Fix CSRF in Ruby on RailsExpected to flag skip_forgery_protection in vulnerable.rb and in wrong.rb: ActionController.qll matches the call by name, inside a concern's included block too, and ignores the if: condition.
|
| rb/csrf-protection-not-enabled | - Fix CSRF in Ruby on RailsNot expected to flag ApplicationController: the query accepts a config.load_defaults of 5.2 or later as protection being on (this card has 8.1); it does not read default_protect_from_forgery itself.
|
| rb/csv-injection | |
| rb/insecure-mass-assignment | - Fix mass assignment in Ruby on RailsNot expected to report anything on this card: besides the const_get dispatch, the taint on params does not survive except() in the model (its summary keeps only element content), so the permit! calls are never…
|
| rb/missing-token-validation | |
| rb/path-injection | - Fix path traversal in Ruby on RailsNot expected to report anything on this card as written (params.expect and const_get, as for the other cards).
- Fix unrestricted file upload in Ruby on RailsRack keeps only the last path segment of the client's file name, so the vulnerable handler's File.join cannot be steered out of the uploads folder, and CodeQL has no query for an uploaded file's type or size; it says…
|
| rb/reflected-xss | - Fix XSS in Ruby on RailsNot expected to report anything on this card: XSS.qll follows controller instance variables only into the action's default template (app/views/profiles/show.html.erb), and the card renders "profiles/#{impl}".
|
| rb/request-forgery | |
| rb/sensitive-get-query | |
| rb/sql-injection | - Fix SQL injection in Ruby on RailsNot expected to report anything on this card as written: the controllers read values with params.expect, which codeql/ruby/frameworks/ActionController.qll does not carry taint through, and OrderQueries.current…
|
| rb/unsafe-deserialization | |
| rb/url-redirection | - Fix open redirects in Ruby on RailsNot expected to report anything on this card: the redirect is in SessionsController#create, a POST action, which the query skips, and the implementation is a module included through const_get.
|
| rb/weak-cookie-configuration | - Fix session fixation and cookies in Ruby on RailsNot expected to report anything: the query (CWE-732, CWE-1275) checks only application-wide settings such as config.action_dispatch.cookies_same_site_protection set to :none, a weak encrypted_cookie_cipher or…
|