CodeQL 2.27.4 improves accuracy and query metadata

CodeQL is the static analysis engine behind GitHub code scanning, which finds and remediates security issues in your code. We’ve recently released CodeQL 2.27.4 with query accuracy improvements across several languages, stronger security checks when you bundle or publish a pack, and corrections to query metadata.

Query changes

Java/Kotlin

• The java/log-injection query now recognizes additional sanitizers and sanitizer guards from the JDK, Apache Commons Lang and Text, Guava, OWASP Java Encoder, and Spring Framework.
• Path-injection queries now recognize additional substring guards and string replacement and removal operations from Apache Commons Lang and Guava.

Rust

• We have reduced false positives in the rust/uncontrolled-allocation-size, rust/log-injection, and rust/cleartext-logging queries.

C/C++

• The cpp/suspicious-pointer-scaling query no longer reports intentional pointer arithmetic on std::byte* buffers.
• The cpp/unused-local-variable and cpp/unused-static-variable queries no longer report variables marked with [[maybe_unused]].

CWE metadata changes

CodeQL no longer applies the CWE-730 tag to the following queries:

• C#: cs/redos and cs/regex-injection.
• Java/Kotlin: java/redos, java/polynomial-redos, and java/regex-injection.
• JavaScript/TypeScript: js/redos, js/polynomial-redos, js/regex-injection, js/regex-injection-more-sources, js/server-crash, and js/loop-bound-injection.
• Python: py/redos, py/polynomial-redos, and py/regex-injection.
• Ruby: rb/redos, rb/polynomial-redos, and rb/regexp-injection.
• Swift: swift/redos and swift/regex-injection.

This was initially reported in CodeQL issue #22318; thank you to @wiggin15 for the feedback.

CodeQL CLI

• The CLI now writes Java virtual machine warnings and initialization errors to standard error, so they won’t interfere with JSON or other machine-readable output.
• When you bundle or publish a pack, the CLI checks whether each file remains inside the pack root after resolving symbolic links. It omits files that resolve outside the root and displays a warning.

For full details, see the CodeQL 2.27.4 changelog. GitHub automatically deploys every new CodeQL version to users of GitHub code scanning on github.com. The new functionality in CodeQL 2.27.4 will also be included in the GitHub Enterprise Server (GHES) 3.24 release. If you use an older version of GHES, you can manually upgrade your CodeQL version.