github-actions[bot]
353cd31ce6
update codeql documentation
2026-02-06 18:09:49 +00:00
Henry Mercer
fedb9464af
Merge pull request #21248 from github/henrymercer/fix-mysql-typo
...
Fix capitalization of MySQL
2026-02-02 05:33:39 -08:00
Henry Mercer
1a6b2b9b82
Fix capitalization of MySQL
2026-02-02 12:37:32 +00:00
Henry Mercer
57c2208f7a
Merge pull request #21246 from github/henrymercer/kotlin/version-range-formatting
...
Fix formatting of Kotlin version ranges
2026-02-02 04:30:52 -08:00
Henry Mercer
5f1fd57f84
Fix formatting of Kotlin version ranges
2026-02-02 12:22:50 +00:00
Henry Mercer
6b78313701
Merge pull request #21245 from github/release-prep/2.24.1
...
Release preparation for version 2.24.1
2026-02-02 04:12:14 -08:00
Henry Mercer
38fcc61817
Fix formatting in Kotlin changelog
2026-02-02 12:10:15 +00:00
github-actions[bot]
0db542e9f0
Release preparation for version 2.24.1
2026-02-02 12:09:09 +00:00
Tom Hvitved
4a04f7b66f
Merge pull request #21243 from hvitved/csharp/insecure-object-tests
...
C#: Add more tests for `InsecureDirectObjectReference.ql`
2026-02-02 13:03:23 +01:00
Tom Hvitved
fe0634574d
C#: Add more tests for InsecureDirectObjectReference.ql
2026-02-02 11:09:26 +01:00
Michael B. Gale
9a00c75460
Merge pull request #21236 from github/mbg/csharp/fix-registry-feeds
...
C#: Make sure `allFeeds` contains at least `explicitFeeds`
2026-02-02 07:49:33 +00:00
Owen Mansel-Chan
5204255615
Merge pull request #21234 from owen-mc/python/convert-sanitizers-to-mad
...
Python: Allow models-as-data sanitizers
2026-01-30 14:28:39 +00:00
Owen Mansel-Chan
0222159df5
Specify vulnerable args instead of safe ones
2026-01-30 14:10:03 +00:00
Michael B. Gale
454d13b485
Remove element check
2026-01-30 14:03:43 +00:00
Mathias Vorreiter Pedersen
16670511de
Merge pull request #21239 from MathiasVP/logical-binary-fix-guards-cpp
...
C++: Ensure that there are AST `GuardCondition`s for `||` and `&&`
2026-01-30 13:50:55 +00:00
Michael B. Gale
ad2aa6d4f8
Accept expected diagnostic output
2026-01-30 13:38:50 +00:00
Michael B. Gale
3e0719609f
Fix missing negation
2026-01-30 13:30:47 +00:00
Michael B. Gale
1aba0b20cd
Add integration test
2026-01-30 13:19:47 +00:00
Michael B. Gale
1b5ed129ac
Log and emit diagnostic if incorrectly named files are found
2026-01-30 13:19:46 +00:00
Mathias Vorreiter Pedersen
5f079c1d51
C++: Add change note.
2026-01-30 12:19:28 +00:00
Michael B. Gale
5ba3b679dd
Move into if statement
2026-01-30 12:18:56 +00:00
yoff
8c0baefd3b
Merge pull request #21141 from mbaluda/prompt-injection
...
Python: Prompt injection in OpenAI clients
2026-01-30 12:55:56 +01:00
Anders Peter Fugmann
78495035a6
Merge pull request #20965 from github/andersfugmann/kotlin_2.3.0-beta2
...
Kotlin: Support Kotlin 2.3.0
2026-01-30 11:37:19 +01:00
Owen Mansel-Chan
a3885cd8b2
Replace sanitizer by exclusion from sink definition
2026-01-30 09:28:02 +00:00
Owen Mansel-Chan
b4cb2c3f13
Make qldoc slightly more specific
2026-01-30 09:28:01 +00:00
Owen Mansel-Chan
ef6332c581
Allow MaD sanitizers for queries with MaD sinks
2026-01-30 09:27:59 +00:00
Owen Mansel-Chan
ad6f800022
Pretty print model numbers in tests
2026-01-30 09:21:24 +00:00
Owen Mansel-Chan
e5f52f086c
Merge pull request #21235 from owen-mc/shared/docs/provenance-path-graph
...
Shared: Add missing QLDocs
2026-01-30 09:02:48 +00:00
Jon Janego
18a2aca42f
Merge pull request #21237 from github/urllib-typo-fix
...
Urllib typo fix
2026-01-29 17:32:12 -06:00
yoff
e7a0fc7140
python: Add query for prompt injection
...
This pull request introduces a new CodeQL query for detecting prompt injection vulnerabilities in Python code targeting AI prompting APIs such as agents and openai. The changes includes a new experimental query, new taint flow and type models, a customizable dataflow configuration, documentation, and comprehensive test coverage.
2026-01-29 23:47:52 +01:00
Jon Janego
f14ccd8c81
Fix typo in taint flow model for urllib.parse
2026-01-29 16:21:14 -06:00
Jon Janego
e54d7c7c73
Update CHANGELOG.md
2026-01-29 16:20:25 -06:00
Jon Janego
813d4639ca
Fix typo in taint flow model for urllib.parse
2026-01-29 16:18:21 -06:00
Michael B. Gale
76fe3fa502
C#: Make sure allFeeds contains at least explicitFeeds
2026-01-29 21:43:44 +00:00
Owen Mansel-Chan
8b936c5dbe
Add missing QLDocs
2026-01-29 16:45:23 +00:00
Taus
34800d1519
Merge pull request #20945 from joefarebrother/python-websockets
...
Python: Model remote flow sources for the `websockets` library
2026-01-29 15:47:46 +01:00
Jon Janego
1644376cc9
Merge pull request #21222 from github/codeql-spark-run-21376405640
...
Update changelog documentation site
2026-01-29 08:44:11 -06:00
Mathias Vorreiter Pedersen
1b1c9c680c
Merge pull request #21227 from MathiasVP/postfix-fix
...
C++: Get rid of an ugly workaround in dataflow
2026-01-29 12:25:02 +00:00
Mathias Vorreiter Pedersen
61a53fadc0
C++: Fix spelling.
2026-01-29 11:50:44 +00:00
Mathias Vorreiter Pedersen
25647badbd
C++: Fix the AST wrapper for binary logical operators.
2026-01-28 14:06:10 +00:00
Mathias Vorreiter Pedersen
6445fd805d
C++: Fix IR -> AST mapping for basic blocks.
2026-01-28 14:01:34 +00:00
Owen Mansel-Chan
a35e7b27af
Merge pull request #21226 from owen-mc/java/update-qhelp-unrelease-lock
...
Java: Improve qhelp for `java/unreleased-lock` and add lock type exclusion
2026-01-28 09:46:31 +00:00
Anders Fugmann
ab495fa843
Kotlin: Inline cast
2026-01-28 10:11:22 +01:00
Anders Fugmann
2320d502db
Kotlin: Address detections from kotin internal queries
2026-01-28 10:11:21 +01:00
Anders Fugmann
31867a56fb
Kotlin: Accept test changes
...
Accept test changes from Kotlin 2.3.0 update
Updates expected test outputs for kotlin2 library tests to match
actual compiler output. Changes include:
- Location adjustments for properties/methods (now point to identifiers)
- CastExpr -> ImplicitCastExpr for implicit type casts
- Removed duplicate BlockStmt entries in loop ASTs
- Super constructor call location changes
Note that in Kotlin 2.3.0 super constructor calls now have locations spanning
entire class declarations instead of the actual super call site.
2026-01-28 10:11:21 +01:00
Anders Fugmann
86d9c349ec
Kotlin: Accept test changes
2026-01-28 10:11:21 +01:00
Anders Fugmann
59fa01e386
Kotlin: Add bitwise 'and' operation expected by Kotlin 2.3 compiler to exist in the stdlib
2026-01-28 10:11:20 +01:00
Anders Fugmann
a6f8af0de5
Kotlin: Accept column location changes in tests
2026-01-28 10:11:20 +01:00
Anders Fugmann
f6f5b7e1e9
Kotlin: Accept test changes after rebasing to include changes from https://github.com/github/codeql/pull/21216
2026-01-28 10:11:19 +01:00
Anders Fugmann
275724000b
Kotlin: Update kotlin serialization integration test to use Kotlin compiler 1.8.10 and accept test changes
2026-01-28 09:30:22 +01:00
