CodeQL 2.26.1 improves analysis accuracy and framework coverage

CodeQL is the static analysis engine behind GitHub code scanning, which finds and remediates security issues in your code. We’ve recently released CodeQL 2.26.1, which improves framework coverage for Go, Java/Kotlin, and JavaScript/TypeScript, and reduces false positives in Rust analysis.

Language and framework support

C/C++

• Models-as-data flow summaries now use fully qualified field names, such as MyNamespace::MyStruct::myField. Unqualified field names remain supported but will be removed in 12 months.

Go

• We’ve improved modeling for the log/slog package, including slog.Logger methods, With, WithGroup, Attr, and Value. This expands coverage for applications using structured logging.

Java/Kotlin

• We’ve added source, sink, and flow summary models for org.apache.poi.

JavaScript/TypeScript

• We’ve added support for Angular’s @HostListener('window:message', ...) and @HostListener('document:message', ...) decorators. CodeQL now recognizes the decorated method’s event parameter as a client-side remote flow source.

Query changes

Go

• The improved log/slog modeling expands coverage for the go/log-injection and go/clear-text-logging queries.

Java/Kotlin

• The java/path-injection query now recognizes input validated with @javax.validation.constraints.Pattern as sanitized, reducing false positives.
• The java/ssrf query now treats the first argument of Spring WebFlux’s WebClient.UriSpec.uri method as a request forgery sink, which may produce additional valid alerts.

JavaScript/TypeScript

• The js/missing-origin-check query now analyzes Angular message event handlers declared with @HostListener.

Rust

• The rust/hard-coded-cryptographic-value query now treats arithmetic, bitwise, and string append operations as barriers. This reduces false positives when code combines hard-coded constants with nonconstant data, such as when incrementing a nonce or appending variable data to a constant prefix.

For a full list of changes, please refer to the complete changelog for version 2.26.1. Every new version of CodeQL is automatically deployed to users of GitHub code scanning on github.com. The new functionality in CodeQL 2.26.1 will also be included in a future GitHub Enterprise Server (GHES) release. If you use an older version of GHES, you can manually upgrade your CodeQL version.

The post CodeQL 2.26.1 improves analysis accuracy and framework coverage appeared first on The GitHub Blog.