hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-27 17:41:24 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
158c81c06d05efd0e7f01bbcd79592a6846c820a
codeql/java/ql/lib/ext
History
Jack Nørskov Jørgensen 3119ef6c1a Add MaDs for Apache Avro
2026-05-19 09:27:32 +02:00
..
experimental
Java: Move non-experimental models out of the experimental folder.
2024-11-11 10:08:45 +01:00
generated
Add MaDs for Apache Avro
2026-05-19 09:27:32 +02:00
android.app.model.yml
…
android.content.model.yml
…
android.database.model.yml
…
android.database.sqlite.model.yml
…
android.net.model.yml
…
android.os.model.yml
…
android.support.v4.app.model.yml
…
android.util.model.yml
…
android.webkit.model.yml
…
android.widget.model.yml
…
androidx.core.app.model.yml
…
androidx.fragment.app.model.yml
…
androidx.slice.builders.model.yml
…
androidx.slice.model.yml
…
ch.ethz.ssh2.model.yml
…
cn.hutool.core.codec.model.yml
…
com.alibaba.com.caucho.hessian.io.model.yml
Use MaD models for unsafe deserialization sinks when possible
2025-07-16 14:42:07 +01:00
com.alibaba.druid.sql.model.yml
…
com.alibaba.druid.sql.repository.model.yml
…
com.alibaba.fastjson2.model.yml
…
com.amazonaws.auth.model.yml
…
com.auth0.jwt.algorithms.model.yml
…
com.azure.identity.model.yml
…
com.caucho.burlap.io.model.yml
Use MaD models for unsafe deserialization sinks when possible
2025-07-16 14:42:07 +01:00
com.caucho.hessian.io.model.yml
Use MaD models for unsafe deserialization sinks when possible
2025-07-16 14:42:07 +01:00
com.cedarsoftware.util.io.model.yml
Use MaD models for unsafe deserialization sinks when possible
2025-07-16 14:42:07 +01:00
com.couchbase.client.core.env.model.yml
Improved models for Supplier arguments
2026-01-14 12:32:42 +01:00
com.couchbase.client.java.model.yml
Improve model for CWE-089
2026-01-13 21:48:43 +01:00
com.esotericsoftware.kryo5.io.model.yml
…
com.esotericsoftware.kryo.io.model.yml
…
com.esotericsoftware.yamlbeans.model.yml
Use MaD models for unsafe deserialization sinks when possible
2025-07-16 14:42:07 +01:00
com.fasterxml.jackson.core.model.yml
…
com.fasterxml.jackson.databind.model.yml
…
com.google.common.base.model.yml
…
com.google.common.cache.model.yml
…
com.google.common.collect.model.yml
…
com.google.common.flogger.model.yml
…
com.google.common.io.model.yml
Java: split read-only path sinks into path-injection[read]
2026-04-21 09:17:36 +10:00
com.google.gson.model.yml
…
com.hubspot.jinjava.model.yml
…
com.jcraft.jsch.model.yml
…
com.microsoft.sqlserver.jdbc.model.yml
…
com.mitchellbosecke.pebble.model.yml
…
com.mongodb.model.yml
…
com.opensymphony.xwork2.ognl.model.yml
…
com.rabbitmq.client.impl.model.yml
…
com.rabbitmq.client.model.yml
…
com.sshtools.j2ssh.authentication.model.yml
…
com.sun.crypto.provider.model.yml
…
com.sun.jndi.ldap.model.yml
…
com.sun.net.httpserver.model.yml
…
com.sun.net.ssl.model.yml
…
com.sun.rowset.model.yml
…
com.sun.security.auth.module.model.yml
…
com.sun.security.ntlm.model.yml
…
com.sun.security.sasl.digest.model.yml
…
com.thoughtworks.xstream.model.yml
Java: split read-only path sinks into path-injection[read]
2026-04-21 09:17:36 +10:00
com.trilead.ssh2.model.yml
…
com.unboundid.ldap.sdk.model.yml
…
com.zaxxer.hikari.model.yml
…
empty.model.yml
Java: Add empty extensible data.
2025-12-11 16:24:26 +01:00
flexjson.model.yml
…
freemarker.cache.model.yml
…
freemarker.template.model.yml
…
groovy.lang.model.yml
…
groovy.util.model.yml
…
hudson.cli.model.yml
…
hudson.console.model.yml
…
hudson.lifecycle.model.yml
…
hudson.model.model.yml
Java: split read-only path sinks into path-injection[read]
2026-04-21 09:17:36 +10:00
hudson.model.yml
Java: split read-only path sinks into path-injection[read]
2026-04-21 09:17:36 +10:00
hudson.os.model.yml
…
hudson.remoting.model.yml
…
hudson.scm.model.yml
Java: split read-only path sinks into path-injection[read]
2026-04-21 09:17:36 +10:00
hudson.util.io.model.yml
…
hudson.util.jna.model.yml
Java: split read-only path sinks into path-injection[read]
2026-04-21 09:17:36 +10:00
hudson.util.model.yml
Java: split read-only path sinks into path-injection[read]
2026-04-21 09:17:36 +10:00
io.jsonwebtoken.model.yml
…
io.netty.bootstrap.model.yml
…
io.netty.buffer.model.yml
…
io.netty.channel.model.yml
…
io.netty.handler.codec.base64.model.yml
…
io.netty.handler.codec.http2.model.yml
…
io.netty.handler.codec.http.cookie.model.yml
…
io.netty.handler.codec.http.model.yml
…
io.netty.handler.codec.http.multipart.model.yml
Java: split read-only path sinks into path-injection[read]
2026-04-21 09:17:36 +10:00
io.netty.handler.codec.http.websocketx.model.yml
…
io.netty.handler.codec.model.yml
…
io.netty.handler.ssl.model.yml
Java: split read-only path sinks into path-injection[read]
2026-04-21 09:17:36 +10:00
io.netty.handler.stream.model.yml
Java: split read-only path sinks into path-injection[read]
2026-04-21 09:17:36 +10:00
io.netty.resolver.model.yml
…
io.netty.util.internal.model.yml
…
io.netty.util.model.yml
…
io.undertow.server.handlers.resource.model.yml
…
jakarta.activation.model.yml
…
jakarta.faces.context.model.yml
…
jakarta.json.model.yml
…
jakarta.json.stream.model.yml
…
jakarta.persistence.criteria.model.yml
…
jakarta.persistence.model.yml
…
jakarta.servlet.http.model.yml
Apply suggestions from code review
2025-11-12 15:02:42 +00:00
jakarta.servlet.model.yml
add extensions for remote sources
2025-08-14 16:10:49 -04:00
jakarta.ws.rs.client.model.yml
…
jakarta.ws.rs.container.model.yml
…
jakarta.ws.rs.core.model.yml
…
jakarta.xml.bind.attachment.model.yml
…
java.awt.model.yml
…
java.beans.model.yml
Use MaD models for unsafe deserialization sinks when possible
2025-07-16 14:42:07 +01:00
java.io.model.yml
Java: move File inspection methods to path-injection[read]
2026-05-01 16:04:29 +08:00
java.lang.invoke.model.yml
…
java.lang.model.yml
Java: split read-only path sinks into path-injection[read]
2026-04-21 09:17:36 +10:00
java.lang.module.model.yml
…
java.lang.reflect.model.yml
…
java.lang.scoped.model.yml
Java: Address review comment. Fix dataflow model
2025-09-08 12:55:19 +02:00
java.math.model.yml
…
java.net.http.model.yml
…
java.net.model.yml
Fix incorrect constructor summary models
2026-03-05 12:03:21 +00:00
java.nio.channels.model.yml
…
java.nio.charset.model.yml
…
java.nio.file.model.yml
Update java/ql/lib/ext/java.nio.file.model.yml
2026-05-03 14:08:31 +08:00
java.nio.file.spi.model.yml
…
java.nio.model.yml
Java: Move non-experimental models out of the experimental folder.
2024-11-11 10:08:45 +01:00
java.security.cert.model.yml
Java: Promote some generated models and add some manual neutrals.
2024-08-27 13:28:05 +02:00
java.security.model.yml
Java: Promote some generated models and add some manual neutrals.
2024-08-27 13:28:05 +02:00
java.security.spec.model.yml
…
java.sql.model.yml
…
java.text.model.yml
…
java.time.chrono.model.yml
…
java.time.format.model.yml
…
java.time.model.yml
…
java.time.temporal.model.yml
…
java.time.zone.model.yml
…
java.util.concurrent.atomic.model.yml
…
java.util.concurrent.locks.model.yml
…
java.util.concurrent.model.yml
…
java.util.function.model.yml
…
java.util.logging.model.yml
Java: Update the Byte- and CharBuffer models and add models for set- and getParameters on LogRecord.
2024-08-28 16:15:09 +02:00
java.util.model.yml
Java: Adapt to changes in FlowSummaryImpl
2026-01-26 12:40:15 +01:00
java.util.prefs.model.yml
…
java.util.regex.model.yml
Convert regex injection barrier to MaD
2025-12-11 16:24:29 +01:00
java.util.stream.model.yml
Java: Add manual models for various mapToObj methods.
2024-10-23 09:29:15 +02:00
java.util.zip.model.yml
Fix incorrect constructor summary models
2026-03-05 12:03:21 +00:00
javafx.scene.web.model.yml
…
javax.activation.model.yml
…
javax.crypto.model.yml
Java: Address review comment. Fix dataflow model
2025-09-08 13:17:51 +02:00
javax.crypto.spec.model.yml
Java: Add model for thenExpand and accept new results
2025-09-08 13:17:53 +02:00
javax.faces.context.model.yml
…
javax.imageio.stream.model.yml
…
javax.jms.model.yml
…
javax.json.model.yml
…
javax.json.stream.model.yml
…
javax.management.model.yml
Java: Promote some generated models and add some manual neutrals.
2024-08-27 13:28:05 +02:00
javax.management.remote.model.yml
…
javax.naming.directory.model.yml
Java: Add some less precise models for BasicAttributes to get the models to work with search sink and re-generate SDK models.
2024-10-21 15:19:34 +02:00
javax.naming.model.yml
…
javax.net.ssl.model.yml
…
javax.portlet.model.yml
…
javax.print.attribute.standard.model.yml
…
javax.script.model.yml
…
javax.security.auth.callback.model.yml
…
javax.security.auth.kerberos.model.yml
…
javax.servlet.http.model.yml
Apply suggestions from code review
2025-11-12 15:02:42 +00:00
javax.servlet.model.yml
Update java/ql/lib/ext/javax.servlet.model.yml
2026-05-03 14:14:15 +08:00
javax.sql.model.yml
…
javax.validation.model.yml
…
javax.ws.rs.client.model.yml
…
javax.ws.rs.container.model.yml
…
javax.ws.rs.core.model.yml
…
javax.xml.bind.attachment.model.yml
…
javax.xml.transform.model.yml
…
javax.xml.transform.sax.model.yml
…
javax.xml.transform.stream.model.yml
…
javax.xml.xpath.model.yml
…
jodd.json.model.yml
…
kotlin.collections.model.yml
…
kotlin.io.model.yml
Java: split read-only path sinks into path-injection[read]
2026-04-21 09:17:36 +10:00
kotlin.jvm.internal.model.yml
…
kotlin.model.yml
…
liquibase.database.jvm.model.yml
…
liquibase.statement.core.model.yml
…
net.lingala.zip4j.model.yml
Java: Move non-experimental models out of the experimental folder.
2024-11-11 10:08:45 +01:00
net.schmizz.sshj.model.yml
…
net.sf.saxon.s9api.model.yml
…
ognl.enhance.model.yml
…
ognl.model.yml
…
okhttp3.model.yml
…
org.antlr.runtime.model.yml
…
org.apache.commons.codec.model.yml
…
org.apache.commons.collections4.bag.model.yml
…
org.apache.commons.collections4.bidimap.model.yml
…
org.apache.commons.collections4.collection.model.yml
…
org.apache.commons.collections4.iterators.model.yml
…
org.apache.commons.collections4.keyvalue.model.yml
…
org.apache.commons.collections4.list.model.yml
…
org.apache.commons.collections4.map.model.yml
Java: Adapt to changes in FlowSummaryImpl
2026-01-26 12:40:15 +01:00
org.apache.commons.collections4.model.yml
Java: Adapt to changes in FlowSummaryImpl
2026-01-26 12:40:15 +01:00
org.apache.commons.collections4.multimap.model.yml
…
org.apache.commons.collections4.multiset.model.yml
…
org.apache.commons.collections4.properties.model.yml
…
org.apache.commons.collections4.queue.model.yml
…
org.apache.commons.collections4.set.model.yml
Java: Adapt to changes in FlowSummaryImpl
2026-01-26 12:40:15 +01:00
org.apache.commons.collections4.splitmap.model.yml
…
org.apache.commons.collections4.trie.model.yml
…
org.apache.commons.collections.bag.model.yml
…
org.apache.commons.collections.bidimap.model.yml
…
org.apache.commons.collections.collection.model.yml
…
org.apache.commons.collections.iterators.model.yml
…
org.apache.commons.collections.keyvalue.model.yml
…
org.apache.commons.collections.list.model.yml
…
org.apache.commons.collections.map.model.yml
…
org.apache.commons.collections.model.yml
…
org.apache.commons.collections.multimap.model.yml
…
org.apache.commons.collections.multiset.model.yml
…
org.apache.commons.collections.properties.model.yml
…
org.apache.commons.collections.queue.model.yml
…
org.apache.commons.collections.set.model.yml
…
org.apache.commons.collections.splitmap.model.yml
…
org.apache.commons.collections.trie.model.yml
…
org.apache.commons.compress.archivers.tar.model.yml
…
org.apache.commons.exec.environment.model.yml
…
org.apache.commons.exec.launcher.model.yml
…
org.apache.commons.exec.model.yml
…
org.apache.commons.fileupload.model.yml
Sort models and tests alphabetically
2025-11-12 15:10:29 +00:00
org.apache.commons.fileupload.util.model.yml
Sort models and tests alphabetically
2025-11-12 15:10:29 +00:00
org.apache.commons.httpclient.util.model.yml
…
org.apache.commons.io.model.yml
Fix yaml formatting
2026-05-07 11:06:43 +01:00
org.apache.commons.jelly.model.yml
…
org.apache.commons.jexl2.model.yml
…
org.apache.commons.jexl3.model.yml
…
org.apache.commons.lang3.builder.model.yml
…
org.apache.commons.lang3.model.yml
Use MaD models for unsafe deserialization sinks when possible
2025-07-16 14:42:07 +01:00
org.apache.commons.lang3.mutable.model.yml
…
org.apache.commons.lang3.text.model.yml
…
org.apache.commons.lang3.tuple.model.yml
…
org.apache.commons.lang.model.yml
Use MaD models for unsafe deserialization sinks when possible
2025-07-16 14:42:07 +01:00
org.apache.commons.logging.model.yml
…
org.apache.commons.net.ftp.model.yml
…
org.apache.commons.net.model.yml
Java: split read-only path sinks into path-injection[read]
2026-04-21 09:17:36 +10:00
org.apache.commons.ognl.enhance.model.yml
…
org.apache.commons.ognl.model.yml
…
org.apache.commons.text.lookup.model.yml
…
org.apache.commons.text.model.yml
…
org.apache.cxf.catalog.model.yml
…
org.apache.cxf.common.classloader.model.yml
…
org.apache.cxf.common.jaxb.model.yml
…
org.apache.cxf.common.logging.model.yml
…
org.apache.cxf.configuration.jsse.model.yml
…
org.apache.cxf.feature.transform.model.yml
…
org.apache.cxf.helpers.model.yml
…
org.apache.cxf.resource.model.yml
…
org.apache.cxf.staxutils.model.yml
…
org.apache.cxf.tools.corba.utils.model.yml
…
org.apache.cxf.tools.util.model.yml
…
org.apache.directory.ldap.client.api.model.yml
…
org.apache.hadoop.fs.model.yml
…
org.apache.hadoop.fs.s3a.model.yml
…
org.apache.hadoop.hive.metastore.api.model.yml
…
org.apache.hadoop.hive.metastore.model.yml
…
org.apache.hadoop.hive.ql.exec.model.yml
…
org.apache.hadoop.hive.ql.metadata.model.yml
…
org.apache.hc.client5.http.async.methods.model.yml
…
org.apache.hc.client5.http.classic.methods.model.yml
…
org.apache.hc.client5.http.fluent.model.yml
…
org.apache.hc.client5.http.protocol.model.yml
…
org.apache.hc.client5.http.protocol.yml
…
org.apache.hc.client5.http.utils.yml
…
org.apache.hc.core5.benchmark.model.yml
…
org.apache.hc.core5.function.model.yml
…
org.apache.hc.core5.http.impl.bootstrap.model.yml
…
org.apache.hc.core5.http.io.entity.model.yml
Fix incorrect constructor summary models
2026-03-05 12:03:21 +00:00
org.apache.hc.core5.http.io.model.yml
…
org.apache.hc.core5.http.io.support.model.yml
…
org.apache.hc.core5.http.message.model.yml
…
org.apache.hc.core5.http.model.yml
…
org.apache.hc.core5.http.nio.support.model.yml
…
org.apache.hc.core5.http.support.model.yml
…
org.apache.hc.core5.net.model.yml
…
org.apache.hc.core5.util.model.yml
…
org.apache.hive.hcatalog.templeton.model.yml
…
org.apache.http.client.fluent.model.yml
…
org.apache.http.client.methods.model.yml
…
org.apache.http.client.model.yml
…
org.apache.http.client.utils.model.yml
…
org.apache.http.entity.model.yml
Fix incorrect constructor summary models
2026-03-05 12:03:21 +00:00
org.apache.http.impl.client.model.yml
…
org.apache.http.message.model.yml
…
org.apache.http.model.yml
…
org.apache.http.params.model.yml
…
org.apache.http.protocol.model.yml
…
org.apache.http.util.model.yml
…
org.apache.ibatis.jdbc.model.yml
…
org.apache.ibatis.mapping.model.yml
…
org.apache.log4j.model.yml
…
org.apache.logging.log4j.model.yml
…
org.apache.shiro.authc.model.yml
Java: Move non-experimental models out of the experimental folder.
2024-11-11 10:08:45 +01:00
org.apache.shiro.codec.model.yml
…
org.apache.shiro.jndi.model.yml
…
org.apache.shiro.mgt.model.yml
…
org.apache.sshd.client.session.model.yml
…
org.apache.struts2.dispatcher.model.yml
…
org.apache.struts2.interceptor.model.yml
…
org.apache.tools.ant.model.yml
Java: split read-only path sinks into path-injection[read]
2026-04-21 09:17:36 +10:00
org.apache.tools.ant.taskdefs.model.yml
Java: split read-only path sinks into path-injection[read]
2026-04-21 09:17:36 +10:00
org.apache.tools.zip.model.yml
…
org.apache.velocity.app.model.yml
…
org.apache.velocity.runtime.model.yml
…
org.apache.velocity.runtime.resource.util.model.yml
…
org.codehaus.cargo.container.installer.model.yml
…
org.codehaus.groovy.control.model.yml
…
org.dom4j.model.yml
…
org.dom4j.tree.model.yml
…
org.dom4j.util.model.yml
…
org.eclipse.jetty.client.model.yml
…
org.exolab.castor.xml.model.yml
Use MaD models for unsafe deserialization sinks when possible
2025-07-16 14:42:07 +01:00
org.fusesource.leveldbjni.model.yml
…
org.geogebra.web.full.main.model.yml
…
org.gradle.api.file.model.yml
…
org.hibernate.model.yml
…
org.hibernate.query.model.yml
Model additional Hibernate query sinks
2026-04-23 13:41:03 +00:00
org.ho.yaml.model.yml
Use MaD models for unsafe deserialization sinks when possible
2025-07-16 14:42:07 +01:00
org.influxdb.model.yml
…
org.jabsorb.model.yml
Use MaD models for unsafe deserialization sinks when possible
2025-07-16 14:42:07 +01:00
org.jboss.logging.model.yml
…
org.jboss.vfs.model.yml
…
org.jdbi.v3.core.model.yml
…
org.jooq.model.yml
…
org.json.model.yml
…
org.keycloak.models.map.storage.model.yml
…
org.kohsuke.stapler.bind.model.yml
…
org.kohsuke.stapler.framework.adjunct.model.yml
…
org.kohsuke.stapler.framework.io.model.yml
Java: split read-only path sinks into path-injection[read]
2026-04-21 09:17:36 +10:00
org.kohsuke.stapler.json.model.yml
…
org.kohsuke.stapler.model.yml
…
org.lastaflute.web.model.yml
Convert QL classes for Lastaflute to MaD
2024-07-18 17:41:06 -04:00
org.lastaflute.web.ruts.multipart.model.yml
…
org.mvel2.compiler.model.yml
…
org.mvel2.jsr223.model.yml
…
org.mvel2.model.yml
…
org.mvel2.templates.model.yml
…
org.openjdk.jmh.runner.options.model.yml
…
org.owasp.esapi.model.yml
Convert trust boundary violation barrier and barrier guard to MaD
2025-12-11 16:24:26 +01:00
org.pac4j.jwt.config.encryption.model.yml
…
org.pac4j.jwt.config.signature.model.yml
…
org.scijava.log.model.yml
…
org.slf4j.model.yml
…
org.slf4j.spi.model.yml
…
org.springframework.beans.model.yml
…
org.springframework.boot.jdbc.model.yml
…
org.springframework.cache.model.yml
…
org.springframework.context.model.yml
…
org.springframework.core.io.model.yml
Java: Move non-experimental models out of the experimental folder.
2024-11-11 10:08:45 +01:00
org.springframework.data.repository.model.yml
…
org.springframework.http.model.yml
…
org.springframework.jdbc.core.model.yml
…
org.springframework.jdbc.core.namedparam.model.yml
…
org.springframework.jdbc.datasource.model.yml
…
org.springframework.jdbc.object.model.yml
…
org.springframework.jndi.model.yml
…
org.springframework.ldap.core.model.yml
…
org.springframework.ldap.model.yml
…
org.springframework.security.core.userdetails.model.yml
…
org.springframework.security.web.savedrequest.model.yml
…
org.springframework.ui.model.yml
…
org.springframework.util.model.yml
Java: split read-only path sinks into path-injection[read]
2026-04-21 09:17:36 +10:00
org.springframework.validation.model.yml
…
org.springframework.web.client.model.yml
…
org.springframework.web.context.request.model.yml
…
org.springframework.web.multipart.model.yml
Remove duplicate summary for MultipartFile.getInputStream and update .expected file
2024-09-18 20:43:04 +02:00
org.springframework.web.portlet.model.yml
…
org.springframework.web.reactive.function.client.model.yml
…
org.springframework.web.servlet.model.yml
…
org.springframework.web.socket.model.yml
Add model for handlePongMessage and update test
2026-01-07 11:09:59 +00:00
org.springframework.web.util.model.yml
Java: Adapt to changes in FlowSummaryImpl
2026-01-26 12:40:15 +01:00
org.thymeleaf.model.yml
…
org.xml.sax.model.yml
…
org.xmlpull.v1.model.yml
…
org.yaml.snakeyaml.model.yml
…
play.libs.ws.model.yml
…
play.mvc.model.yml
…
ratpack.core.form.model.yml
…
ratpack.core.handling.model.yml
…
ratpack.core.http.model.yml
…
ratpack.exec.model.yml
…
ratpack.form.model.yml
…
ratpack.func.model.yml
…
ratpack.handling.model.yml
…
ratpack.http.model.yml
…
ratpack.util.model.yml
…
retrofit2.model.yml
…
software.amazon.awssdk.transfer.s3.model.model.yml
Java: Move non-experimental models out of the experimental folder.
2024-11-11 10:08:45 +01:00
struts2.model.yml
…
sun.jvmstat.perfdata.monitor.protocol.local.model.yml
…
sun.jvmstat.perfdata.monitor.protocol.rmi.model.yml
…
sun.misc.model.yml
…
sun.net.ftp.model.yml
…
sun.net.www.protocol.http.model.yml
…
sun.security.acl.model.yml
…
sun.security.jgss.krb5.model.yml
…
sun.security.krb5.model.yml
…
sun.security.pkcs11.model.yml
…
sun.security.pkcs.model.yml
…
sun.security.provider.model.yml
…
sun.security.ssl.model.yml
…
sun.security.x509.model.yml
…
sun.tools.jconsole.model.yml
…