Search results

Consider testing CodeQL also against Kotlin EA versions

questionFurther information is requestedFurther information is requested

Status: Open.

#22219 In github/codeql;

· scordio opened on Jul 21, 2026

[java-kotlin] Autobuild sets unnecessary maven.test.skip.exec parameter

Status: Open.

#22218 In github/codeql;

· scordio opened on Jul 21, 2026

False positive: "Missing cross-site request forgery token validation" should not apply to Web API Controller Actions sharing a project with Browser-based actions

false-positive

Status: Open.

#22215 In github/codeql;

· daiplusplus opened on Jul 21, 2026

Go: Why is DotDotCheck modeled as a complete path-injection barrier?

questionFurther information is requestedFurther information is requested

Status: Open.

#22214 In github/codeql;

· wildoranges opened on Jul 20, 2026

[actions] Alternate actions/checkout paths suppress untrusted-checkout alerts

Status: Open.

#22213 In github/codeql;

· 1sgtpepper opened on Jul 19, 2026

False positive Java. SpringBoot CSRF

false-positive

Java

Status: Open.

#22199 In github/codeql;

· rcollette opened on Jul 15, 2026

[C#] False positive in cs/simplifiable-boolean-expression for operator != implementation

C#

false-positive

Status: Open.

#22190 In github/codeql;

· christiannagel opened on Jul 14, 2026

Go: filepath.Clean with a prepended path separator is modeled as a path-injection sanitizer and causes false negatives

questionFurther information is requestedFurther information is requested

Status: Open.

#22185 In github/codeql;

· wildoranges opened on Jul 14, 2026

Go: DotDotReplaceAll ignores the replacement value and causes false-negative path-injection alerts

questionFurther information is requestedFurther information is requested

Status: Open.

#22184 In github/codeql;

· wildoranges opened on Jul 14, 2026

[C#] Improve "isExponentialRegex" detection logic in ReDoSQuery.qll to prevent false negatives

questionFurther information is requestedFurther information is requested

Status: Open.

#22183 In github/codeql;

· gravitydeepimpact7463 opened on Jul 13, 2026

java.io.File.getName() (Java) modeled as path-injection barrier causes false-negative path-traversal alerts

Status: Open.

#22144 In github/codeql;

· wildoranges opened on Jul 9, 2026

Swift build-mode: manual — xcodebuild "Resolve Package Graph" hangs ~12 min under the build tracer (local path packages, nothing to fetch)

awaiting-responseThe CodeQL team is awaiting further input or clarification from the original reporter of this issue.The CodeQL team is awaiting further input or clarification from the original reporter of this issue.

Status: Open.

#22121 In github/codeql;

· ax-jkikta opened on Jul 4, 2026