CodeQL 2.27.1 adds new queries for C/C++ and C#, support for Kotlin 2.4.20, and query-accuracy improvements. CodeQL is the static analysis engine behind GitHub code scanning, whic…
CodeQL 2.27.1 adds new queries for C/C++ and C#, support for Kotlin 2.4.20, and query-accuracy improvements. CodeQL is the static analysis engine behind GitHub code scanning, which helps you find and remediate security issues in your code.
Language and framework support
C/C++
We’ve added taint flow models for boost::asio::ip::basic_resolver::resolve, flow summaries for Bloomberg Development Environment’s BloombergLP::bdlbb::Blob segmented byte buffer, and flow summaries for the Protocol Buffers google::protobuf::MessageLite C++ API.
Go
We’ve added or improved data flow models for Go 1.27 standard-library APIs, including bytes.CutLast, database/sql.ConvertAssign, database/sql/driver.RowsColumnScanner.ScanColumn, net/url.URL.Clone, net/url.Values.Clone, strings.CutLast, and the new encoding/json/jsontext package.
We’ve expanded data flow models for the strings package, including Clone, Cut, CutPrefix, CutSuffix, Fields, FieldsFunc, Join, Builder, Reader, and Replacer APIs.
Java/Kotlin
CodeQL now supports Kotlin 2.4.20.
We’ve fixed extraction of Foo::class.java arguments when using the Kotlin K2 compiler. This reduces false positives in queries such as java/android/implicit-pendingintents.
JavaScript/TypeScript
CodeQL now recognizes Fastify servers configured through chainable methods such as fastify().withTypeProvider() and fastify().setValidatorCompiler(...). This improves route attribution, which may add results for queries such as js/missing-rate-limiting and remove false positives when globally registered plugins protect routes.
Rust
We’ve fixed path resolution for m::{self} paths when m is a trait.
We’ve added data flow models for core::fmt::Write, improving detection of vulnerabilities where tainted data is written to formatted output buffers.
The Rust extractor now uses rust-analyzer version 0.0.347. This updates the Rust library AST with new node types and accessor APIs. See the CodeQL 2.27.1 changelog for migration details.
Query changes
C/C++
We’ve added the cpp/ambiguous-assignment-of-comparison query to detect potentially ambiguous expressions that assign a comparison result to a variable and use the assignment as a truth value.
C#
We’ve added the cs/linq/missed-firstordefault query, which identifies foreach loops that can be expressed more clearly with LINQ’s FirstOrDefault method.
The cs/linq/missed-* queries no longer suggest lambda rewrites that capture in, out, or ref parameters, preventing suggestions that wouldn’t compile.
The cs/web/missing-token-validation query now recognizes ASP.NET Core’s AutoValidateAntiforgeryTokenAttribute when you register it as a global MVC filter through AddControllersWithViews and related methods. This reduces false positives for protected actions.
GitHub Actions
The actions/unpinned-tag query no longer reports actions pinned by a structurally valid .github/workflows/actions.lock entry for the enclosing workflow.
The actions/unpinned-tag query no longer reports $/ self-repository references, such as uses: $/path/to/action, because they resolve to the same repository at the running commit and are inherently pinned.
Other improvements
C#
Private NuGet registries with the Replaces base option enabled in the organization-level private registry configuration now replace default NuGet feeds whenever CodeQL downloads dependencies, including when a project explicitly configures default feeds.
For full details, see the CodeQL 2.27.1 changelog. GitHub automatically deploys every new CodeQL version to users of GitHub code scanning on github.com. GitHub Enterprise Server (GHES) 3.24 will include the new functionality in CodeQL 2.27.1. If you use an older version of GHES, you can manually upgrade your CodeQL version.
The post CodeQL 2.27.1 adds C and C++ query and Kotlin 2.4.20 support appeared first on The GitHub Blog.