hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

Downgrade precision of java/concatenated-sql-query

Browse Source
This commit is contained in:
Chris Smowton
2021-08-24 10:46:01 +01:00
parent ca341bde08
commit 7f73efe3e1
2 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
java/change-notes/2021-08-24-downgrade-sql-unescaped.md Normal file
View File

@@ -0,0 +1,2 @@
lgtm,codescanning
* Query `java/concatenated-sql-query` has been downgraded to medium precision in view of its heuristic nature, which is inherently prone to false positives. This means its alerts will not be visible by default on lgtm.com. Code Scanning will also no longer run the query by default.

2
java/ql/src/Security/CWE/CWE-089/SqlUnescaped.ql
View File

@@ -5,7 +5,7 @@
* @kind problem
* @problem.severity error
* @security-severity 8.8
* @precision high
* @precision medium
* @id java/concatenated-sql-query
* @tags security
* external/cwe/cwe-089