CodeQL documentation
CodeQL resources
CodeQL overview
CodeQL guides
Writing CodeQL queries
CodeQL language guides
Reference docs
QL language reference
CodeQL standard-libraries
CodeQL query help
Source files
CodeQL repository
Academic
QL publications
CodeQL query help for C and C++
CodeQL query help for C#
CodeQL query help for GitHub Actions
CodeQL query help for Go
CodeQL query help for Java and Kotlin
CodeQL query help for JavaScript and TypeScript
CodeQL query help for Python
CodeQL query help for Ruby
Bad HTML filtering regexp
Badly anchored regular expression
CSRF protection not enabled
CSRF protection weakened or disabled
Clear-text logging of sensitive information
Clear-text storage of sensitive information
Code injection
Database query in a loop
Dependency download using unencrypted communication channel
Deserialization of user-controlled data
Download of sensitive file through insecure connection
Hard-coded credentials
Hard-coded data interpreted as code
Incomplete URL substring sanitization
Incomplete multi-character sanitization
Incomplete regular expression for hostnames
Incomplete string escaping or encoding
Inefficient regular expression
Information exposure through an exception
Insecure Mass Assignment
Log injection
Missing regular expression anchor
Network data written to file
Overly permissive regular expression range
Polynomial regular expression used on uncontrolled data
Method call on
nil
Reflected server-side cross-site scripting
Regular expression injection
Request without certificate validation
SQL query built from user-controlled sources
Sensitive data read from GET request
Server-side request forgery
Stored cross-site scripting
URL redirection from remote source
Uncontrolled command line
Uncontrolled data used in path expression
Unsafe HTML constructed from library input
Unsafe code constructed from library input
Unsafe shell command constructed from library input
Use of
Kernel.open
or
IO.read
or similar sinks with a non-constant value
Use of
Kernel.open
,
IO.read
or similar sinks with user-controlled input
Use of a broken or weak cryptographic algorithm
Use of a broken or weak cryptographic hashing algorithm on sensitive data
Use of externally-controlled format string
Useless assignment to local variable
Weak cookie configuration
XML external entity expansion
CodeQL query help for Swift
CodeQL CWE coverage
CodeQL query help documentation
»
CodeQL query help for Ruby
»
Hard-coded credentials