Skip to content
Navigation Menu
Sign in
Appearance settings
Platform
AI CODE CREATION
GitHub Copilot
Write better code with AI
GitHub Copilot app
Direct agents from issue to merge
MCP Registry
Integrate external tools
DEVELOPER WORKFLOWS
Actions
Automate any workflow
Codespaces
Instant dev environments
Issues
Plan and track work
Code Review
Manage code changes
Code Quality
Enforce quality at merge
APPLICATION SECURITY
GitHub Advanced Security
Find and fix vulnerabilities
Code security
Secure your code as you build
Secret protection
Stop leaks before they start
EXPLORE
Why GitHub
Documentation
Blog
Changelog
Marketplace
View all features
Solutions
BY COMPANY SIZE
Enterprises
Small and medium teams
Startups
Nonprofits
BY USE CASE
App Modernization
DevSecOps
DevOps
CI/CD
View all use cases
BY INDUSTRY
Healthcare
Financial services
Manufacturing
Government
View all industries
View all solutions
Resources
EXPLORE BY TOPIC
AI
Software Development
DevOps
Security
View all topics
EXPLORE BY TYPE
Customer stories
Events & webinars
Ebooks & reports
Business insights
GitHub Skills
SUPPORT & SERVICES
Documentation
Customer support
Community forum
Trust center
Partners
View all resources
Open Source
COMMUNITY
GitHub Sponsors
Fund open source developers
PROGRAMS
Security Lab
Maintainer Community
Accelerator
GitHub Stars
Archive Program
REPOSITORIES
Topics
Trending
Collections
Enterprise
ENTERPRISE SOLUTIONS
Enterprise platform
AI-powered developer platform
AVAILABLE ADD-ONS
GitHub Advanced Security
Enterprise-grade security features
Copilot for Business
Enterprise-grade AI features
Premium Support
Enterprise-grade 24/7 support
Pricing
Search
/
Sign in
Sign up
Appearance settings
You signed in with another tab or window.
Reload
to refresh your session.
You signed out in another tab or window.
Reload
to refresh your session.
You switched accounts on another tab or window.
Reload
to refresh your session.
Dismiss alert
{{ message }}
Uh oh!
There was an error while loading.
Please reload this page
.
github
/
codeql
Public
Notifications
You must be signed in to change notification settings
Fork
2.1k
Star
9.9k
Code
Issues
995
Pull requests
448
Discussions
Actions
Projects
Security and quality
0
Insights
Additional navigation options
Code
Issues
Pull requests
Discussions
Actions
Projects
Security and quality
Insights
Commits
Breadcrumbs
History for
codeql
java
ql
test
query-tests
on
codeql-cli/v2.26.2
User selector
All users
All time
Commit history
Commits on Jul 11, 2026
Fix path sanitizer
owen-mc
committed
6057b4b
View commit details
Copy full SHA for 6057b4b
View code at this point
Browse repository at this point
Commits on Jul 8, 2026
Merge pull request #22119 from owen-mc/java/fix-tainted-path-pattern-sanitization
Show description for 134e302
owen-mc
authored
134e302
View commit details
Copy full SHA for 134e302
View code at this point
Browse repository at this point
Commits on Jul 7, 2026
Java: Model Spring reactive `WebClient.uri` as a request forgery sink
joshimar
committed
1db3132
View commit details
Copy full SHA for 1db3132
View code at this point
Browse repository at this point
Commits on Jul 3, 2026
Fix @Pattern sanitizer for TaintedPath
owen-mc
committed
76b4f4f
View commit details
Copy full SHA for 76b4f4f
View code at this point
Browse repository at this point
Add failing TaintedPath test for @Pattern sanitizer
owen-mc
committed
077b531
View commit details
Copy full SHA for 077b531
View code at this point
Browse repository at this point
Commits on Jun 12, 2026
Remove confusing comments
owen-mc
committed
4bc083f
View commit details
Copy full SHA for 4bc083f
View code at this point
Browse repository at this point
Add SPURIOUS and MISSING alerts based on existing comments
owen-mc
committed
89c1d66
View commit details
Copy full SHA for 89c1d66
View code at this point
Browse repository at this point
Commits on Jun 10, 2026
Second pass
owen-mc
committed
3693185
View commit details
Copy full SHA for 3693185
View code at this point
Browse repository at this point
First pass converting qlref tests to inline expectation with postprocess
owen-mc
committed
1c1d264
View commit details
Copy full SHA for 1c1d264
View code at this point
Browse repository at this point
Commits on Jun 3, 2026
Merge pull request #21804 from github/copilot/add-tests-for-models
Show description for 52f2a58
owen-mc
authored
52f2a58
View commit details
Copy full SHA for 52f2a58
View code at this point
Browse repository at this point
Commits on May 28, 2026
Build `RequestBuilder` more realistically
owen-mc
committed
d95d998
View commit details
Copy full SHA for d95d998
View code at this point
Browse repository at this point
Improve how `org.apache.http.client.HttpClient` is created in test
owen-mc
committed
37589dd
View commit details
Copy full SHA for 37589dd
View code at this point
Browse repository at this point
Change variable name in test
owen-mc
committed
a159dc1
View commit details
Copy full SHA for a159dc1
View code at this point
Browse repository at this point
Commits on May 7, 2026
Update test output
owen-mc
committed
dd35bc0
View commit details
Copy full SHA for dd35bc0
View code at this point
Browse repository at this point
Commits on May 6, 2026
Replace fluent SSRF changes with Apache HttpClient execute model tests
Show description for 043ec85
Copilot
and
owen-mc
authored
043ec85
View commit details
Copy full SHA for 043ec85
View code at this point
Browse repository at this point
Add SSRF tests and stubs for Apache Http fluent Request models
Show description for f5b17b0
Copilot
and
owen-mc
authored
f5b17b0
View commit details
Copy full SHA for f5b17b0
View code at this point
Browse repository at this point
Commits on May 1, 2026
Merge branch 'main' into fix/path-injection-read-subkind
MarkLee131
authored
bafa892
View commit details
Copy full SHA for bafa892
View code at this point
Browse repository at this point
Java: move File inspection methods to path-injection[read]
Show description for 119994b
MarkLee131
committed
119994b
View commit details
Copy full SHA for 119994b
View code at this point
Browse repository at this point
Commits on Apr 30, 2026
Merge pull request #21654 from MarkLee131/fix/sensitive-log-hash-sanitizer
Show description for 87c35e6
owen-mc
authored
87c35e6
View commit details
Copy full SHA for 87c35e6
View code at this point
Browse repository at this point
Merge branch 'main' into fix/path-injection-read-subkind
MarkLee131
authored
90741b1
View commit details
Copy full SHA for 90741b1
View code at this point
Browse repository at this point
Commits on Apr 29, 2026
Merge remote-tracking branch 'origin/main' into fix/sensitive-log-hash-sanitizer
Show description for 28a6ff2
MarkLee131
committed
28a6ff2
View commit details
Copy full SHA for 28a6ff2
View code at this point
Browse repository at this point
Update java/ql/test/query-tests/security/CWE-532/Test.java
Show description for 75162bb
MarkLee131
and
owen-mc
authored
75162bb
View commit details
Copy full SHA for 75162bb
View code at this point
Browse repository at this point
Merge branch 'main' into fix/trust-boundary-regexp-barrier
MarkLee131
authored
49d014c
View commit details
Copy full SHA for 49d014c
View code at this point
Browse repository at this point
Commits on Apr 24, 2026
Merge pull request #21749 from github/copilot/add-hibernate-sql-injection-tests
Show description for 9fbe447
owen-mc
authored
9fbe447
View commit details
Copy full SHA for 9fbe447
View code at this point
Browse repository at this point
Commits on Apr 23, 2026
Model additional Hibernate query sinks
Show description for 25d232b
Copilot
and
owen-mc
authored
25d232b
View commit details
Copy full SHA for 25d232b
View code at this point
Browse repository at this point
Add Hibernate SQL injection sink tests
Show description for 081ad03
Copilot
and
owen-mc
authored
081ad03
View commit details
Copy full SHA for 081ad03
View code at this point
Browse repository at this point
Merge branch 'main' into fix/path-injection-torealpath
owen-mc
authored
9f19791
View commit details
Copy full SHA for 9f19791
View code at this point
Browse repository at this point
Commits on Apr 21, 2026
Merge branch 'main' into fix/trust-boundary-regexp-barrier
MarkLee131
authored
af794ed
View commit details
Copy full SHA for af794ed
View code at this point
Browse repository at this point
Merge branch 'github:main' into fix/path-injection-read-subkind
MarkLee131
authored
07e97e2
View commit details
Copy full SHA for 07e97e2
View code at this point
Browse repository at this point
Merge pull request #21650 from MarkLee131/fix/sensitive-log-fp-regex
Show description for c91b5b3
owen-mc
authored
c91b5b3
View commit details
Copy full SHA for c91b5b3
View code at this point
Browse repository at this point
Commits on Apr 20, 2026
Java: split read-only path sinks into path-injection[read]
Show description for c336a15
MarkLee131
committed
c336a15
View commit details
Copy full SHA for c336a15
View code at this point
Browse repository at this point
Merge pull request #21734 from owen-mc/java/fix-partial-path-traversal
Show description for 9f310c2
owen-mc
authored
9f310c2
View commit details
Copy full SHA for 9f310c2
View code at this point
Browse repository at this point
Commits on Apr 19, 2026
Fix bug so `+= File.separator` is recognized
owen-mc
committed
6d4a397
View commit details
Copy full SHA for 6d4a397
View code at this point
Browse repository at this point
Add SPURIOUS test for `+= File.separator`
owen-mc
committed
6099c5d
View commit details
Copy full SHA for 6099c5d
View code at this point
Browse repository at this point
Use inline expectations with second test
Show description for 63d20a5
owen-mc
and
Copilot
committed
63d20a5
View commit details
Copy full SHA for 63d20a5
View code at this point
Browse repository at this point
Previous
Next
You can’t perform that action at this time.
