owasp-top-10.qls

# -----------------------------------------------------------
# Query suite documentation can be found at:
# https://codeql.github.com/docs/codeql-cli/creating-codeql-query-suites/
# -----------------------------------------------------------
#
#
# -----------------------------------------------------------
# A complete list of CWE's covered and their Query ID's here:
# https://codeql.github.com/codeql-query-help/full-cwe/
# -----------------------------------------------------------
#
#
# -----------------------------------------------------------
# Uncomment If you want to also use existing CodeQL Query Packs
#- import: codeql-suites/java-security-extended.qls
#- import: codeql-suites/javascript-security-extended.qls
#- import: codeql-suites/python-security-extended.qls
#- import: codeql-suites/csharp-security-extended.qls
#- import: custom-queries/lower-csrf-protection-disabled.ql
# -----------------------------------------------------------
#
#
# -----------------------------------------------------------
# OWASP Top 10 - Queries for All Languages (sorted alphabetically)
# 
# PLEASE NOTE: Problem Severity and Precision are currently
# commented out starting on line 30. Uncomment to limit your
# scans further with these parameters.
# -----------------------------------------------------------
#- include:
    #problem.severity:
    #- medium
    #- high
    #- very-high
    #- critical
    #precision:
    #- high
    #- very-high
- include:
    id:
    - cpp/access-memory-location-after-end-buffer-strlen
    - cpp/alloca-in-loop
    - cpp/allocation-too-small
    - cpp/ambiguously-signed-bit-field
    - cpp/bad-addition-overflow-check
    - cpp/bad-strncpy-size
    - cpp/badly-bounded-write
    - cpp/certificate-not-checked
    - cpp/certificate-result-conflation
    - cpp/cgi-xss
    - cpp/cleartext-storage-buffer
    - cpp/cleartext-storage-database
    - cpp/cleartext-storage-file
    - cpp/cleartext-transmission
    - cpp/command-line-injection
    - cpp/comparison-with-wider-type
    - cpp/dangerous-use-of-exception-blocks
    - cpp/dangerous-use-of-transformation-after-operation
    - cpp/double-free
    - cpp/drop-linux-privileges-outoforder
    - cpp/external-entity-expansion
    - cpp/insecure-generation-of-filename
    - cpp/insufficient-key-size
    - cpp/integer-multiplication-cast-to-long
    - cpp/late-check-of-function-argument
    - cpp/linux-kernel-no-check-before-unsafe-put-user
    - cpp/memory-unsafe-function-scan
    - cpp/memset-may-be-deleted
    - cpp/multiplication-overflow-in-alloc
    - cpp/no-space-for-terminator
    - cpp/non-constant-format
    - cpp/non-https-url
    - cpp/offset-use-before-range-check
    - cpp/open-call-with-mode-argument
    - cpp/openssl-heartbleed
    - cpp/overflowing-snprintf
    - cpp/overrunning-write
    - cpp/overrunning-write-with-float
    - cpp/pam-auth-bypass
    - cpp/path-injection
    - cpp/potential-system-data-exposure
    - cpp/private-cleartext-write
    - cpp/return-stack-allocated-memory
    - cpp/sign-conversion-pointer-arithmetic
    - cpp/signed-overflow-check
    - cpp/sql-injection
    - cpp/static-buffer-overflow
    - cpp/suspicious-allocation-size
    - cpp/system-data-exposure
    - cpp/tainted-format-string
    - cpp/tainted-format-string-through-global
    - cpp/tainted-permissions-check
    - cpp/unbounded-write
    - cpp/uncontrolled-allocation-size
    - cpp/uncontrolled-arithmetic
    - cpp/uncontrolled-process-operation
    - cpp/unsafe-create-process-call
    - cpp/unsafe-dacl-security-descriptor
    - cpp/unsafe-strcat
    - cpp/unsafe-strncat
    - cpp/unterminated-variadic-call
    - cpp/upcast-array-pointer-arithmetic
    - cpp/user-controlled-bypass
    - cpp/using-expired-stack-address
    - cpp/very-likely-overrunning-write
    - cpp/weak-cryptographic-algorithm
    - cpp/work-with-file-without-permissions-rights
    - cpp/world-writable-file-creation
    - cpp/wrong-use-of-the-umask
    - cs/assembly-path-injection
    - cs/cleartext-storage-of-sensitive-information
    - cs/code-injection
    - cs/command-line-injection
    - cs/deserialized-delegate
    - cs/ecb-encryption
    - cs/empty-password-in-configuration
    - cs/exposure-of-sensitive-information
    - cs/hardcoded-connection-string-credentials
    - cs/hardcoded-credentials
    - cs/inadequate-rsa-padding
    - cs/information-exposure-through-exception
    - cs/insecure-randomness
    - cs/insecure-sql-connection
    - cs/insufficient-key-size
    - cs/ldap-injection
    - cs/log-forging
    - cs/loss-of-precision
    - cs/password-in-configuration
    - cs/path-injection
    - cs/request-forgery
    - cs/resource-injection
    - cs/second-order-sql-injection
    - cs/sensitive-data-transmission
    - cs/serialization-check-bypass
    - cs/session-reuse
    - cs/sql-injection
    - cs/stored-command-line-injection
    - cs/stored-ldap-injection
    - cs/uncontrolled-format-string
    - cs/unsafe-deserialization-untrusted-input
    - cs/unvalidated-local-pointer-arithmetic
    - cs/user-controlled-bypass
    - cs/weak-encryption
    - cs/web/broad-cookie-domain
    - cs/web/broad-cookie-path
    - cs/web/cookie-httponly-not-set
    - cs/web/cookie-secure-not-set
    - cs/web/debug-binary
    - cs/web/directory-browse-enabled
    - cs/web/disabled-header-checking
    - cs/web/file-upload
    - cs/web/missing-global-error-handler
    - cs/web/missing-token-validation
    - cs/web/missing-x-frame-options
    - cs/web/persistent-cookie
    - cs/web/requiressl-not-set
    - cs/web/stored-xss
    - cs/web/unvalidated-url-redirection
    - cs/web/xss
    - cs/webclient-path-injection
    - cs/xml-injection
    - cs/xml/insecure-dtd-handling
    - cs/xml/missing-validation
    - cs/xml/stored-xpath-injection
    - cs/xml/xpath-injection
    - cs/zipslip
    - go/allocation-size-overflow
    - go/bad-redirect-check
    - go/clear-text-logging
    - go/command-injection
    - go/constant-oauth2-state
    - go/cookie-httponly-not-set
    - go/cors-misconfiguration
    - go/disabled-certificate-check
    - go/email-injection
    - go/hardcoded-credentials
    - go/html-template-escaping-passthrough
    - go/incomplete-hostname-regexp
    - go/incomplete-url-scheme-check
    - go/incorrect-integer-conversion
    - go/insecure-randomness
    - go/insecure-tls
    - go/ldap-injection
    - go/log-injection
    - go/path-injection
    - go/reflected-xss
    - go/regex/missing-regexp-anchor
    - go/request-forgery
    - go/sensitive-condition-bypass
    - go/sql-injection
    - go/ssrf
    - go/stack-trace-exposure
    - go/suspicious-character-in-regex
    - go/unsafe-quoting
    - go/unsafe-unzip-symlink
    - go/unvalidated-url-redirection
    - go/user-controlled-bypass
    - go/weak-crypto-algorithm
    - go/weak-crypto-key
    - go/wrong-usage-of-unsafe
    - go/xml/xpath-injection
    - go/zipslip
    - java/android-insecure-dex-loading
    - java/android/cleartext-storage-database
    - java/android/cleartext-storage-filesystem
    - java/android/cleartext-storage-shared-prefs
    - java/android/fragment-injection
    - java/android/fragment-injection-preference-activity
    - java/android/implicit-pendingintents
    - java/android/intent-redirection
    - java/android/intent-uri-permission-manipulation
    - java/android/sensitive-communication
    - java/android/unsafe-android-webview-fetch
    - java/beanshell-injection
    - java/cleartext-storage-in-cookie
    - java/cleartext-storage-in-properties
    - java/command-line-injection
    - java/command-line-injection-experimental
    - java/comparison-with-wider-type
    - java/concatenated-command-line
    - java/concatenated-sql-query
    - java/credentials-in-properties
    - java/disabled-certificate-revocation-checking
    - java/groovy-injection
    - java/hardcoded-credential-api-call
    - java/hardcoded-jwt-key
    - java/hash-without-salt
    - java/http-response-splitting
    - java/ignored-hostname-verification
    - java/implicit-cast-in-compound-assignment
    - java/improper-validation-of-array-construction
    - java/improper-validation-of-array-index
    - java/incorrect-url-verification
    - java/insecure-basic-auth
    - java/insecure-bean-validation
    - java/insecure-cookie
    - java/insecure-ldap-auth
    - java/insecure-ldaps-endpoint
    - java/insecure-smtp-ssl
    - java/insecure-spring-actuator-config
    - java/insecure-trustmanager
    - java/insecure-webview-resource-response
    - java/insufficient-key-size
    - java/integer-multiplication-cast-to-long
    - java/ip-address-spoofing
    - java/javaee-expression-injection
    - java/jexl-expression-injection
    - java/jhipster-prng
    - java/jndi-injection
    - java/jshell-injection
    - java/jsonp-injection
    - java/jxbrowser/disabled-certificate-validation
    - java/jython-injection
    - java/ldap-injection
    - java/local-temp-file-or-directory-information-disclosure
    - java/log-injection
    - java/log4j-injection
    - java/maven/dependency-upon-bintray
    - java/maven/non-https-url
    - java/missing-jwt-signature-check
    - java/mvel-expression-injection
    - java/mybatis-annotation-sql-injection
    - java/mybatis-xml-sql-injection
    - java/netty-http-request-or-response-splitting
    - java/ognl-injection
    - java/openstream-called-on-tainted-url
    - java/password-in-configuration
    - java/path-injection
    - java/possible-timing-attack-against-signature
    - java/potentially-weak-cryptographic-algorithm
    - java/predictable-seed
    - java/random-used-once
    - java/relative-path-command
    - java/sensitive-android-file-leak
    - java/sensitive-cookie-not-httponly
    - java/sensitive-log
    - java/sensitive-query-with-get
    - java/server-directory-listing
    - java/server-side-template-injection
    - java/socket-auth-race-condition
    - java/spel-expression-injection
    - java/spring-boot-exposed-actuators
    - java/spring-disabled-csrf-protection
    - java/spring-unvalidated-url-redirection
    - java/spring-view-manipulation
    - java/spring-view-manipulation-implicit
    - java/sql-injection
    - java/ssrf
    - java/stack-trace-exposure
    - java/static-initialization-vector
    - java/tainted-arithmetic
    - java/tainted-format-string
    - java/tainted-permissions-check
    - java/timing-attack-against-headers-value
    - java/timing-attack-against-signature
    - java/tomcat-disabled-httponly
    - java/uncontrolled-arithmetic
    - java/unsafe-cert-trust
    - java/unsafe-deserialization
    - java/unsafe-deserialization-rmi
    - java/unsafe-deserialization-spring-exporter-in-configuration-class
    - java/unsafe-deserialization-spring-exporter-in-xml-configuration
    - java/unsafe-eval
    - java/unsafe-hostname-verification
    - java/unsafe-reflection
    - java/unsafe-tls-version
    - java/unvalidated-cors-origin-set
    - java/unvalidated-url-redirection
    - java/user-controlled-bypass
    - java/weak-cryptographic-algorithm
    - java/world-writable-file-read
    - java/xml/xpath-injection
    - java/xquery-injection
    - java/xslt-injection
    - java/xss
    - java/xxe
    - java/xxe-local-experimental-sinks
    - java/xxe-with-experimental-sinks
    - java/zipslip
    - javascript/ssrf
    - js/actions/command-injection
    - js/actions/pull-request-target
    - js/angular/disabling-sce
    - js/angular/insecure-url-whitelist
    - js/bad-code-sanitization
    - js/bad-tag-filter
    - js/biased-cryptographic-random
    - js/build-artifact-leak
    - js/clear-text-cookie
    - js/clear-text-logging
    - js/clear-text-storage-of-sensitive-data
    - js/client-exposed-cookie
    - js/client-side-request-forgery
    - js/client-side-unvalidated-url-redirection
    - js/code-injection
    - js/command-line-injection
    - js/cors-misconfiguration-for-credentials
    - js/cross-window-information-leak
    - js/disabling-certificate-validation
    - js/disabling-electron-websecurity
    - js/double-escaping
    - js/empty-password-in-configuration-file
    - js/enabling-electron-insecure-content
    - js/exposure-of-private-files
    - js/file-access-to-http
    - js/functionality-from-untrusted-source
    - js/hardcoded-credentials
    - js/host-header-forgery-in-email-generation
    - js/html-constructed-from-input
    - js/http-to-file-access
    - js/identity-replacement
    - js/incomplete-hostname-regexp
    - js/incomplete-html-attribute-sanitization
    - js/incomplete-multi-character-sanitization
    - js/incomplete-sanitization
    - js/incomplete-url-scheme-check
    - js/incomplete-url-substring-sanitization
    - js/incorrect-suffix-check
    - js/indirect-command-line-injection
    - js/insecure-dependency
    - js/insecure-download
    - js/insecure-randomness
    - js/insecure-temporary-file
    - js/insufficient-key-size
    - js/insufficient-password-hash
    - js/jwt-missing-verification
    - js/log-injection
    - js/missing-origin-check
    - js/missing-rate-limiting
    - js/missing-token-validation
    - js/ml-powered/nosql-injection
    - js/ml-powered/path-injection
    - js/ml-powered/sql-injection
    - js/ml-powered/xss
    - js/password-in-configuration-file
    - js/path-injection
    - js/prototype-polluting-assignment
    - js/prototype-pollution
    - js/prototype-pollution-utility
    - js/reflected-xss
    - js/regex/missing-regexp-anchor
    - js/remote-property-injection
    - js/request-forgery
    - js/resource-exhaustion
    - js/samesite-none-cookie
    - js/sensitive-get-query
    - js/server-side-unvalidated-url-redirection
    - js/session-fixation
    - js/shell-command-constructed-from-input
    - js/shell-command-injection-from-environment
    - js/sql-injection
    - js/stack-trace-exposure
    - js/stored-xss
    - js/tainted-format-string
    - js/template-object-injection
    - js/unnecessary-use-of-cat
    - js/unsafe-code-construction
    - js/unsafe-deserialization
    - js/unsafe-dynamic-method-access
    - js/unsafe-external-link
    - js/unsafe-html-expansion
    - js/unsafe-jquery-plugin
    - js/useless-regexp-character-escape
    - js/user-controlled-bypass
    - js/weak-cryptographic-algorithm
    - js/xml-bomb
    - js/xpath-injection
    - js/xss
    - js/xss-through-dom
    - js/xss-through-exception
    - js/xxe
    - js/zipslip
    - py/bad-tag-filter
    - py/bind-socket-all-network-interfaces
    - py/clear-text-logging-sensitive-data
    - py/clear-text-storage-sensitive-data
    - py/code-injection
    - py/command-line-injection
    - py/cookie-injection
    - py/csrf-protection-disabled
    - py/flask-debug
    - py/full-ssrf
    - py/hardcoded-credentials
    - py/header-injection
    - py/improper-ldap-auth
    - py/incomplete-hostname-regexp
    - py/incomplete-url-substring-sanitization
    - py/insecure-cookie
    - py/insecure-default-protocol
    - py/insecure-ldap-auth
    - py/insecure-protocol
    - py/insecure-randomness
    - py/insecure-temporary-file
    - py/ip-address-spoofing
    - py/jinja2/autoescape-false
    - py/jwt-missing-verification
    - py/ldap-injection
    - py/log-injection
    - py/nosql-injection
    - py/overly-permissive-file
    - py/pam-auth-bypass
    - py/paramiko-missing-host-key-validation
    - py/partial-ssrf
    - py/path-injection
    - py/reflective-xss
    - py/request-without-cert-validation
    - py/simple-xml-rpc-server-dos
    - py/sql-injection
    - py/stack-trace-exposure
    - py/tarslip
    - py/template-injection
    - py/unsafe-deserialization
    - py/url-redirection
    - py/weak-crypto-key
    - py/weak-cryptographic-algorithm
    - py/weak-sensitive-data-hashing
    - py/xml-bomb
    - py/xpath-injection
    - py/xslt-injection
    - py/xxe
    - py/zipslip
    - rb/bad-tag-filter
    - rb/clear-text-logging-sensitive-data
    - rb/clear-text-storage-sensitive-data
    - rb/code-injection
    - rb/command-line-injection
    - rb/csrf-protection-disabled
    - rb/hardcoded-credentials
    - rb/http-to-file-access
    - rb/incomplete-hostname-regexp
    - rb/incomplete-sanitization
    - rb/incomplete-url-substring-sanitization
    - rb/insecure-dependency
    - rb/insecure-download
    - rb/kernel-open
    - rb/path-injection
    - rb/reflected-xss
    - rb/regex/missing-regexp-anchor
    - rb/request-forgery
    - rb/request-without-cert-validation
    - rb/sql-injection
    - rb/stored-xss
    - rb/tainted-format-string
    - rb/unsafe-deserialization
    - rb/url-redirection
    - rb/user-controlled-bypass
    - rb/weak-cookie-configuration
    - rb/weak-cryptographic-algorithm
    - rb/xxe