CodeQL 2.26.1 提升分析准确性与框架覆盖

详细说明

Back to changelog

-

Language and framework support

-

Query changes

CodeQL is the static analysis engine behind GitHub code scanning , which finds and remediates security issues in your code. We’ve recently released CodeQL 2.26.1 , which improves framework coverage for Go, Java/Kotlin, and JavaScript/TypeScript, and reduces false positives in Rust analysis.

Language and framework support

C/C++

Go

Java/Kotlin

JavaScript/TypeScript

• Models-as-data flow summaries now use fully qualified field names, such as MyNamespace::MyStruct::myField . Unqualified field names remain supported but will be removed in 12 months.
• We’ve improved modeling for the log/slog package, including slog.Logger methods, With , WithGroup , Attr , and Value . This expands coverage for applications using structured logging.
• We’ve added source, sink, and flow summary models for org.apache.poi .
• We’ve added support for Angular’s @HostListener('window:message', ...) and @HostListener('document:message', ...) decorators. CodeQL now recognizes the decorated method’s event parameter as a client-side remote flow source.

Query changes

Go

Java/Kotlin

JavaScript/TypeScript

Rust

For a full list of changes, please refer to the complete changelog for version 2.26.1 . Every new version of CodeQL is automatically deployed to users of GitHub code scanning on github.com. The new functionality in CodeQL 2.26.1 will also be included in a future GitHub Enterprise Server (GHES) release. If you use an older version of GHES, you can manually upgrade your CodeQL version .

-

Language and framework support

-

Query changes

Share

Copied

Shared

Back to changelog

• The improved log/slog modeling expands coverage for the go/log-injection and go/clear-text-logging queries.
• The java/path-injection query now recognizes input validated with @javax.validation.constraints.Pattern as sanitized, reducing false positives.
• The java/ssrf query now treats the first argument of Spring WebFlux’s WebClient.UriSpec.uri method as a request forgery sink, which may produce additional valid alerts.
• The js/missing-origin-check query now analyzes Angular message event handlers declared with @HostListener .
• The rust/hard-coded-cryptographic-value query now treats arithmetic, bitwise, and string append operations as barriers. This reduces false positives when code combines hard-coded constants with nonconstant data, such as when incrementing a nonce or appending variable data to a constant prefix.