codeql

data

Replace branch with acceptingValue

2026-03-27 22:39:10 +00:00

internal

Python: Fix bad join in function resolution

2024-07-01 14:04:01 +00:00

Stdlib

Properly share ConceptsShared.qll

2025-07-14 16:30:45 +02:00

agent.model.yml

python: Add query for prompt injection

2026-01-29 23:47:52 +01:00

Aioch.qll

…

Aiofile.qll

…

Aiofiles.qll

…

Aiohttp.qll

Properly share ConceptsShared.qll

2025-07-14 16:30:45 +02:00

Aiomysql.qll

…

Aiopg.qll

…

Aiosqlite.qll

…

Airspeed.qll

Fix qldoc, formatting, and redundant import warnings

2024-12-09 19:55:21 +00:00

anthropic.model.yml

Improve prompt inject for Python

2026-04-28 18:24:16 +01:00

AntiSSRF.model.yml

Python: convert barrier guard to MaD

2026-02-26 13:12:34 +01:00

Anyio.qll

…

Asyncpg.model.yml

Python: No longer use models-as-data CSV interface

2024-04-12 13:40:15 +02:00

Asyncpg.qll

Python: No longer use models-as-data CSV interface

2024-04-12 13:40:15 +02:00

Azure.Keyvault.model.yml

Python: Altering SSRF MaD to use 'request-forgery' tag. Update to test cases expected results, off by one line. Changed to using ModelOutput::sinkNode.

2026-02-04 09:04:22 -05:00

Azure.Storage.model.yml

Python: Altering SSRF MaD to use 'request-forgery' tag. Update to test cases expected results, off by one line. Changed to using ModelOutput::sinkNode.

2026-02-04 09:04:22 -05:00

Baize.qll

…

Bottle.qll

Promote template injection sinks for each framework covered

2024-12-09 19:55:17 +00:00

BSon.qll

…

builtins.model.yml

Use generator script directly

2025-08-21 14:12:26 +01:00

CassandraDriver.qll

…

Chameleon.qll

Fix qldoc, formatting, and redundant import warnings

2024-12-09 19:55:21 +00:00

Cherrypy.qll

…

Chevron.qll

Fix qldoc, formatting, and redundant import warnings

2024-12-09 19:55:21 +00:00

ClickhouseDriver.qll

…

Cryptodome.qll

Properly share ConceptsShared.qll

2025-07-14 16:30:45 +02:00

Cryptography.qll

Properly share ConceptsShared.qll

2025-07-14 16:30:45 +02:00

Cx_Oracle.qll

…

Dill.qll

…

Django.model.yml

python: add machinery for MaD barriers

2026-01-22 17:30:24 +01:00

Django.qll

python: remove barrier that can be expressed in MaD

2026-01-22 17:30:24 +01:00

Eventlet.model.yml

Python: Replace type tracking with global data-flow

2026-03-26 15:35:33 +00:00

Fabric.qll

Merge pull request #16789 from yoff/python/document-models-as-data

2024-06-25 15:46:28 +02:00

FastApi.qll

missed some

2024-09-13 00:21:33 -07:00

Flask.qll

Python: Simple dataflow annotations

2026-02-16 13:48:32 +00:00

FlaskAdmin.qll

…

FlaskSqlAlchemy.qll

…

Genshi.qll

Add concepts tests + some fixes

2024-12-09 19:55:42 +00:00

Gevent.model.yml

Python: Replace type tracking with global data-flow

2026-03-26 15:35:33 +00:00

Gradio.qll

Change classes to private

2024-05-15 15:08:27 +02:00

Hdbcli.qll

Added implementation hdbcli as part of PEP249::PEP249ModuleApiNode

2025-05-01 14:18:02 +02:00

Httpx.qll

Properly share ConceptsShared.qll

2025-07-14 16:30:45 +02:00

Idna.qll

…

Invoke.qll

…

Jinja2.qll

Add qldoc

2024-12-09 19:57:39 +00:00

Jmespath.qll

…

Joblib.qll

…

JsonPickle.qll

fix actions reviews

2024-05-10 08:32:45 +02:00

Ldap3.qll

…

Ldap.qll

…

Libtaxii.qll

Properly share ConceptsShared.qll

2025-07-14 16:30:45 +02:00

Libxml2.qll

…

lxml.model.yml

Add MaD models for lxml and xml etree.fromstringlist

2026-06-02 16:15:01 +01:00

Lxml.qll

Removed lxml.etree.XMLParser from xml bomb sinks

2025-07-15 13:43:00 +02:00

Mako.qll

Fix qldoc, formatting, and redundant import warnings

2024-12-09 19:55:21 +00:00

MarkupSafe.qll

…

Multidict.qll

…

Mysql.qll

…

MySQLdb.qll

…

Numpy.qll

…

openai.model.yml

Improve prompt inject for Python

2026-04-28 18:24:16 +01:00

Opml.qll

Add OPML models

2024-05-27 09:48:10 +00:00

Oracledb.qll

…

Pandas.qll

Fix formatting

2025-05-27 13:51:03 +02:00

Paramiko.qll

Paramiko.qll: improve docs

2024-05-29 15:42:29 +02:00

Peewee.qll

…

PEP249.qll

Python: Add basic support for database threat-model

2024-09-10 14:32:37 +02:00

Pexpect.qll

fix actions reviews

2024-05-10 08:32:45 +02:00

Phoenixdb.qll

…

Psycopg2.qll

Python: Add support for Psycopg2 database connection pools

2025-08-25 12:35:57 +00:00

Psycopg.qll

Python: Model the psycopg package

2024-01-29 14:30:20 +01:00

Pycurl.qll

Properly share ConceptsShared.qll

2025-07-14 16:30:45 +02:00

Pydantic.qll

…

PyMongo.qll

…

Pymssql.qll

…

PyMySQL.qll

…

Pyodbc.qll

…

Pyramid.qll

Factor each framework implementation of the cookie parameters to a common concept

2024-07-29 10:51:24 +01:00

Requests.qll

Python: Fix bad join in OutgoingRequestCall

2026-02-16 13:48:33 +00:00

RestFramework.qll

…

Rsa.qll

Properly share ConceptsShared.qll

2025-07-14 16:30:45 +02:00

RuamelYaml.qll

…

Sanic.qll

…

ServerLess.qll

Python: Switch to shared XML.qll implementation

2024-03-19 13:17:53 +01:00

Setuptools.qll

…

Simplejson.qll

…

Socketio.qll

qldoc fixes

2025-11-26 11:23:04 +00:00

SqlAlchemy.qll

Python: Apply suggestions from code review

2024-03-21 14:51:45 +01:00

Starlette.qll

Python: Model FastAPI requests

2024-12-18 15:58:51 +01:00

Stdlib.model.yml

Python: Replace type tracking with global data-flow

2026-03-26 15:35:33 +00:00

Stdlib.qll

Address review comments

2026-06-03 21:24:16 +01:00

Streamlit.qll

Fix typo

2024-07-31 13:22:27 +02:00

Toml.qll

…

Torch.qll

Torch.qll: use better alternative instead of exists

2024-05-29 15:43:41 +02:00

Tornado.qll

Fix qldoc and tests

2025-11-24 13:57:43 +00:00

TRender.qll

Fix qldoc, formatting, and redundant import warnings

2024-12-09 19:55:21 +00:00

Twisted.qll

Factor each framework implementation of the cookie parameters to a common concept

2024-07-29 10:51:24 +01:00

Ujson.qll

…

Urllib3.qll

Properly share ConceptsShared.qll

2025-07-14 16:30:45 +02:00

Websockets.qll

Update test and qldoc

2025-12-01 20:41:59 +00:00

Werkzeug.qll

Add more tests

2024-04-24 14:05:40 +01:00

xml.model.yml

Add MaD models for lxml and xml etree.fromstringlist

2026-06-02 16:15:01 +01:00

Xmltodict.qll

…

Yaml.qll

…

Yarl.qll

Python: Add support for more URL redirect sanitisers.

2024-01-22 13:24:18 +00:00