Skip to content
Navigation Menu
Sign in
Appearance settings
Platform
AI CODE CREATION
GitHub Copilot
Write better code with AI
GitHub Copilot app
Direct agents from issue to merge
MCP Registry
Integrate external tools
DEVELOPER WORKFLOWS
Actions
Automate any workflow
Codespaces
Instant dev environments
Issues
Plan and track work
Code Review
Manage code changes
Code Quality
Enforce quality at merge
APPLICATION SECURITY
GitHub Advanced Security
Find and fix vulnerabilities
Code security
Secure your code as you build
Secret protection
Stop leaks before they start
EXPLORE
Why GitHub
Documentation
Blog
Changelog
Marketplace
View all features
Solutions
BY COMPANY SIZE
Enterprises
Small and medium teams
Startups
Nonprofits
BY USE CASE
App Modernization
DevSecOps
DevOps
CI/CD
View all use cases
BY INDUSTRY
Healthcare
Financial services
Manufacturing
Government
View all industries
View all solutions
Resources
EXPLORE BY TOPIC
AI
Software Development
DevOps
Security
View all topics
EXPLORE BY TYPE
Customer stories
Events & webinars
Ebooks & reports
Business insights
GitHub Skills
SUPPORT & SERVICES
Documentation
Customer support
Community forum
Trust center
Partners
View all resources
Open Source
COMMUNITY
GitHub Sponsors
Fund open source developers
PROGRAMS
Security Lab
Maintainer Community
Accelerator
GitHub Stars
Archive Program
REPOSITORIES
Topics
Trending
Collections
Enterprise
ENTERPRISE SOLUTIONS
Enterprise platform
AI-powered developer platform
AVAILABLE ADD-ONS
GitHub Advanced Security
Enterprise-grade security features
Copilot for Business
Enterprise-grade AI features
Premium Support
Enterprise-grade 24/7 support
Pricing
Search
/
Sign in
Sign up
Appearance settings
You signed in with another tab or window.
Reload
to refresh your session.
You signed out in another tab or window.
Reload
to refresh your session.
You switched accounts on another tab or window.
Reload
to refresh your session.
Dismiss alert
{{ message }}
Uh oh!
There was an error while loading.
Please reload this page
.
github
/
codeql
Public
Notifications
You must be signed in to change notification settings
Fork
2.1k
Star
9.9k
Code
Issues
995
Pull requests
446
Discussions
Actions
Projects
Security and quality
0
Insights
Additional navigation options
Code
Issues
Pull requests
Discussions
Actions
Projects
Security and quality
Insights
Commits
Breadcrumbs
History for
codeql
javascript
ql
src
Security
on
refs/heads/codeql-cli-2.23.7
User selector
All users
All time
Commit history
Commits on Oct 22, 2025
CWE-020: Lower security-severity for OverlyLargeRange queries to 4.0
Napalys
committed
fa47174
View commit details
Copy full SHA for fa47174
View code at this point
Browse repository at this point
JS: Align DOM XSS query severity with other XSS queries
Napalys
committed
7b6720c
View commit details
Copy full SHA for 7b6720c
View code at this point
Browse repository at this point
Commits on Oct 8, 2025
Improve qhelp for broken crypto algo queries
Show description for 0bcdb91
owen-mc
committed
0bcdb91
View commit details
Copy full SHA for 0bcdb91
View code at this point
Browse repository at this point
Commits on Sep 15, 2025
javascript: Fix spelling error in documentation
Show description for d0091e1
igfoo
committed
d0091e1
View commit details
Copy full SHA for d0091e1
View code at this point
Browse repository at this point
Commits on Sep 4, 2025
Updated query description and added a sanitizer
Napalys
committed
d3d608f
View commit details
Copy full SHA for d3d608f
View code at this point
Browse repository at this point
Commits on Jul 31, 2025
Updated qhelp for cors permissive configuration
Napalys
committed
791a7e2
View commit details
Copy full SHA for 791a7e2
View code at this point
Browse repository at this point
Commits on Jul 30, 2025
Move CORS misconfiguration query from experimental to Security
Napalys
committed
358617f
View commit details
Copy full SHA for 358617f
View code at this point
Browse repository at this point
Commits on Jun 23, 2025
JS: Remove js/actions/command-injection
Show description for 76b7228
asgerf
committed
76b7228
View commit details
Copy full SHA for 76b7228
View code at this point
Browse repository at this point
JS: Remove js/actions/actions-artifact-leak
Show description for 9dcb61e
asgerf
committed
9dcb61e
View commit details
Copy full SHA for 9dcb61e
View code at this point
Browse repository at this point
Commits on May 19, 2025
Lower the precision of a range of harcoded password queries to remove them from query suites.
michaelnebel
committed
03ecd24
View commit details
Copy full SHA for 03ecd24
View code at this point
Browse repository at this point
Commits on May 2, 2025
Merge pull request #19422 from Napalys/js/shelljs
Show description for d1e769b
Napalys
authored
d1e769b
View commit details
Copy full SHA for d1e769b
View code at this point
Browse repository at this point
Commits on May 1, 2025
Refactor process.env handling in CleartextLogging and IndirectCommandInjection modules to use ThreatModelSource
Napalys
committed
d4b5ef6
View commit details
Copy full SHA for d4b5ef6
View code at this point
Browse repository at this point
Commits on Apr 30, 2025
Fix cwe tags to include leading zero
owen-mc
committed
cf614a5
View commit details
Copy full SHA for cf614a5
View code at this point
Browse repository at this point
Commits on Apr 4, 2025
Updated `SocketClass` to use API Graphs.
Napalys
committed
e16a20e
View commit details
Copy full SHA for e16a20e
View code at this point
Browse repository at this point
Commits on Apr 2, 2025
JS: Protect against bad join in BadRandomness
Show description for 78b2538
asgerf
committed
78b2538
View commit details
Copy full SHA for 78b2538
View code at this point
Browse repository at this point
Commits on Feb 4, 2025
JS: Simplify config in PrototypePollutingFunction.ql.
aschackmull
committed
db1ed67
View commit details
Copy full SHA for db1ed67
View code at this point
Browse repository at this point
Commits on Jan 29, 2025
Merge pull request #18397 from aegilops/angular-sources-sinks
Show description for f8694a3
asgerf
authored
f8694a3
View commit details
Copy full SHA for f8694a3
View code at this point
Browse repository at this point
Commits on Jan 27, 2025
fix example in clear-text-logging qhelp to actually be bad
erik-krogh
committed
37a1727
View commit details
Copy full SHA for 37a1727
View code at this point
Browse repository at this point
Commits on Jan 24, 2025
Updated expected test result files using HEAD version of codeql
aegilops
committed
d248551
View commit details
Copy full SHA for d248551
View code at this point
Browse repository at this point
Commits on Jan 23, 2025
Merge
aegilops
committed
522f3d1
View commit details
Copy full SHA for 522f3d1
View code at this point
Browse repository at this point
Commits on Jan 21, 2025
remove redundant cast
erik-krogh
committed
2f1bd75
View commit details
Copy full SHA for 2f1bd75
View code at this point
Browse repository at this point
support that two `indexOf()` calls use the same string-concatenation in `getAnEquivalentIndexOfCall()`
erik-krogh
committed
17afab7
View commit details
Copy full SHA for 17afab7
View code at this point
Browse repository at this point
ensure an `indexOf` call is equivalent with itself. (`getAUse()` is used later to find matching `indexOf` calls)
erik-krogh
committed
d5529e3
View commit details
Copy full SHA for d5529e3
View code at this point
Browse repository at this point
Commits on Jan 20, 2025
JS: Update PrototypePollutingFunction.ql
asgerf
committed
8fe622f
View commit details
Copy full SHA for 8fe622f
View code at this point
Browse repository at this point
JS: Auto-patch diff informed queries
asgerf
committed
fd763a0
View commit details
Copy full SHA for fd763a0
View code at this point
Browse repository at this point
Commits on Jan 6, 2025
JS: Restrict AP length in prototype-polluting function
asgerf
committed
0cdda87
View commit details
Copy full SHA for 0cdda87
View code at this point
Browse repository at this point
Commits on Dec 19, 2024
Merge branch 'main' into js/shared-dataflow-merge-main
asgerf
committed
3acd481
View commit details
Copy full SHA for 3acd481
View code at this point
Browse repository at this point
Commits on Dec 16, 2024
JS: Migrate PrototypePollutingFunction
asgerf
committed
73af3f3
View commit details
Copy full SHA for 73af3f3
View code at this point
Browse repository at this point
Commits on Dec 13, 2024
JS: Follow naming convention in InsecureModuleFlow module
asgerf
committed
4e25036
View commit details
Copy full SHA for 4e25036
View code at this point
Browse repository at this point
Commits on Dec 3, 2024
JS: Update a reference to AdditionalSanitizerGuardNode
Show description for 04a3a67
asgerf
committed
04a3a67
View commit details
Copy full SHA for 04a3a67
View code at this point
Browse repository at this point
Commits on Nov 29, 2024
JS: follow proper code standards for get predicates
Show description for 9d4e737
Napalys
and
asgerf
committed
9d4e737
View commit details
Copy full SHA for 9d4e737
View code at this point
Browse repository at this point
JS: fixed bad alert messages when it came to incomplete sanitization for new RegExp objects
Napalys
committed
3171f38
View commit details
Copy full SHA for 3171f38
View code at this point
Browse repository at this point
Commits on Nov 28, 2024
JS: imcomplete sanization now handles properly maybe global
Napalys
committed
98fd977
View commit details
Copy full SHA for 98fd977
View code at this point
Browse repository at this point
JS: incomplete sanitization now also works with RegExp objects
Napalys
committed
1ae1748
View commit details
Copy full SHA for 1ae1748
View code at this point
Browse repository at this point
Commits on Nov 25, 2024
Update javascript/ql/src/Security/CWE-178/CaseSensitiveMiddlewarePath.ql
Show description for d6372ae
Napalys
and
erik-krogh
committed
d6372ae
View commit details
Copy full SHA for d6372ae
View code at this point
Browse repository at this point
Previous
Next
You can’t perform that action at this time.