Commits

Commit history

1. Commits on Oct 26, 2026

   • Merge pull request #22880 from geoffw0/deadlink2

     Show description for ee9ff23
     geoffw0

     authored
     ee9ff23View commit details

     Copy full SHA for ee9ff23

     View code at this pointBrowse repository at this point
2. Commits on Oct 23, 2026

   • Replace dead link in many qhelp files.

     geoffw0

     committed
     e0654e0View commit details

     Copy full SHA for e0654e0

     View code at this pointBrowse repository at this point
3. Commits on Oct 21, 2026

   • Remove prohibited CWE-730 tag from queries

     Show description for bd80295
     

     jketema

     and

     Copilot

     committed
     bd80295View commit details

     Copy full SHA for bd80295

     View code at this pointBrowse repository at this point
4. Commits on Aug 22, 2026

   • Use HTTPS for Wikimedia query-help links

     miachillgood

     committed
     c8afb1dView commit details

     Copy full SHA for c8afb1d

     View code at this pointBrowse repository at this point
5. Commits on Jun 17, 2026

   • Fix prompt injection severity

     BazookaMusic

     committed
     b9025a5View commit details

     Copy full SHA for b9025a5

     View code at this pointBrowse repository at this point
6. Commits on Jun 16, 2026

   • Grammar

     Show description for 8f965a9
     

     BazookaMusic

     and

     Copilot

     authored
     8f965a9View commit details

     Copy full SHA for 8f965a9

     View code at this pointBrowse repository at this point

   • Fix system prompt injection description and title

     Show description for d72372c
     

     BazookaMusic

     and

     Copilot

     authored
     d72372cView commit details

     Copy full SHA for d72372c

     View code at this pointBrowse repository at this point
7. Commits on Jun 11, 2026

   • Refine SystemPromptInjection alert message and move test to stable

     Show description for 7bd5abf
     BazookaMusic

     committed
     7bd5abfView commit details

     Copy full SHA for 7bd5abf

     View code at this pointBrowse repository at this point

   • Promote user prompt injection query to stable security

     Show description for e612db2
     BazookaMusic

     committed
     e612db2View commit details

     Copy full SHA for e612db2

     View code at this pointBrowse repository at this point
8. Commits on Jun 8, 2026

   • Better document the new queries

     BazookaMusic

     committed
     da05992View commit details

     Copy full SHA for da05992

     View code at this pointBrowse repository at this point
9. Commits on May 20, 2026

   • move system prompt injection to non-experimental

     BazookaMusic

     committed
     6c5c8e1View commit details

     Copy full SHA for 6c5c8e1

     View code at this pointBrowse repository at this point
10. Commits on Oct 22, 2025

    • CWE-020: Lower security-severity for OverlyLargeRange queries to 4.0

      Napalys

      committed
      fa47174View commit details

      Copy full SHA for fa47174

      View code at this pointBrowse repository at this point

    • JS: Align DOM XSS query severity with other XSS queries

      Napalys

      committed
      7b6720cView commit details

      Copy full SHA for 7b6720c

      View code at this pointBrowse repository at this point
11. Commits on Oct 8, 2025

    • Improve qhelp for broken crypto algo queries

      Show description for 0bcdb91
      owen-mc

      committed
      0bcdb91View commit details

      Copy full SHA for 0bcdb91

      View code at this pointBrowse repository at this point
12. Commits on Sep 15, 2025

    • javascript: Fix spelling error in documentation

      Show description for d0091e1
      igfoo

      committed
      d0091e1View commit details

      Copy full SHA for d0091e1

      View code at this pointBrowse repository at this point
13. Commits on Sep 4, 2025

    • Updated query description and added a sanitizer

      Napalys

      committed
      d3d608fView commit details

      Copy full SHA for d3d608f

      View code at this pointBrowse repository at this point
14. Commits on Jul 31, 2025

    • Updated qhelp for cors permissive configuration

      Napalys

      committed
      791a7e2View commit details

      Copy full SHA for 791a7e2

      View code at this pointBrowse repository at this point
15. Commits on Jul 30, 2025

    • Move CORS misconfiguration query from experimental to Security

      Napalys

      committed
      358617fView commit details

      Copy full SHA for 358617f

      View code at this pointBrowse repository at this point
16. Commits on Jun 23, 2025

    • JS: Remove js/actions/command-injection

      Show description for 76b7228
      asgerf

      committed
      76b7228View commit details

      Copy full SHA for 76b7228

      View code at this pointBrowse repository at this point

    • JS: Remove js/actions/actions-artifact-leak

      Show description for 9dcb61e
      asgerf

      committed
      9dcb61eView commit details

      Copy full SHA for 9dcb61e

      View code at this pointBrowse repository at this point
17. Commits on May 19, 2025

    • Lower the precision of a range of harcoded password queries to remove them from query suites.

      michaelnebel

      committed
      03ecd24View commit details

      Copy full SHA for 03ecd24

      View code at this pointBrowse repository at this point
18. Commits on May 2, 2025

    • Merge pull request #19422 from Napalys/js/shelljs

      Show description for d1e769b
      Napalys

      authored
      d1e769bView commit details

      Copy full SHA for d1e769b

      View code at this pointBrowse repository at this point
19. Commits on May 1, 2025

    • Refactor process.env handling in CleartextLogging and IndirectCommandInjection modules to use ThreatModelSource

      Napalys

      committed
      d4b5ef6View commit details

      Copy full SHA for d4b5ef6

      View code at this pointBrowse repository at this point
20. Commits on Apr 30, 2025

    • Fix cwe tags to include leading zero

      owen-mc

      committed
      cf614a5View commit details

      Copy full SHA for cf614a5

      View code at this pointBrowse repository at this point
21. Commits on Apr 4, 2025

    • Updated `SocketClass` to use API Graphs.

      Napalys

      committed
      e16a20eView commit details

      Copy full SHA for e16a20e

      View code at this pointBrowse repository at this point
22. Commits on Apr 2, 2025

    • JS: Protect against bad join in BadRandomness

      Show description for 78b2538
      asgerf

      committed
      78b2538View commit details

      Copy full SHA for 78b2538

      View code at this pointBrowse repository at this point
23. Commits on Feb 4, 2025

    • JS: Simplify config in PrototypePollutingFunction.ql.

      aschackmull

      committed
      db1ed67View commit details

      Copy full SHA for db1ed67

      View code at this pointBrowse repository at this point
24. Commits on Jan 29, 2025

    • Merge pull request #18397 from aegilops/angular-sources-sinks

      Show description for f8694a3
      asgerf

      authored
      f8694a3View commit details

      Copy full SHA for f8694a3

      View code at this pointBrowse repository at this point
25. Commits on Jan 27, 2025

    • fix example in clear-text-logging qhelp to actually be bad

      erik-krogh

      committed
      37a1727View commit details

      Copy full SHA for 37a1727

      View code at this pointBrowse repository at this point
26. Commits on Jan 24, 2025

    • Updated expected test result files using HEAD version of codeql

      aegilops

      committed
      d248551View commit details

      Copy full SHA for d248551

      View code at this pointBrowse repository at this point
27. Commits on Jan 23, 2025

    • Merge

      aegilops

      committed
      522f3d1View commit details

      Copy full SHA for 522f3d1

      View code at this pointBrowse repository at this point
28. Commits on Jan 21, 2025

    • remove redundant cast

      erik-krogh

      committed
      2f1bd75View commit details

      Copy full SHA for 2f1bd75

      View code at this pointBrowse repository at this point

    • support that two `indexOf()` calls use the same string-concatenation in `getAnEquivalentIndexOfCall()`

      erik-krogh

      committed
      17afab7View commit details

      Copy full SHA for 17afab7

      View code at this pointBrowse repository at this point

    • ensure an `indexOf` call is equivalent with itself. (`getAUse()` is used later to find matching `indexOf` calls)

      erik-krogh

      committed
      d5529e3View commit details

      Copy full SHA for d5529e3

      View code at this pointBrowse repository at this point
29. Commits on Jan 20, 2025

    • JS: Update PrototypePollutingFunction.ql

      asgerf

      committed
      8fe622fView commit details

      Copy full SHA for 8fe622f

      View code at this pointBrowse repository at this point