René's URL Explorer Experiment


Title: Python: fix 3 queries to use sources for the active threat model by owen-mc · Pull Request #22822 · github/codeql · GitHub

Open Graph Title: Python: fix 3 queries to use sources for the active threat model by owen-mc · Pull Request #22822 · github/codeql

X Title: Python: fix 3 queries to use sources for the active threat model by owen-mc · Pull Request #22822 · github/codeql

Description: Updated the py/xxe, py/xml-bomb, and py/nosql-injection queries to respect the configured threat model when selecting untrusted data sources. The default behavior remains unchanged and uses remote flow sources. As a side effect, these queries now correctly include sources modeled using data extensions. This was prompted by #22750.

Open Graph Description: Updated the py/xxe, py/xml-bomb, and py/nosql-injection queries to respect the configured threat model when selecting untrusted data sources. The default behavior remains unchanged and uses remote ...

X Description: Updated the py/xxe, py/xml-bomb, and py/nosql-injection queries to respect the configured threat model when selecting untrusted data sources. The default behavior remains unchanged and uses remote ...

Opengraph URL: https://github.com/github/codeql/pull/22822

X: @github

direct link

Domain: github.com

react-profiling0
react-import-mapreact,react-dom,react-dom/client,react-dom/profiling,react-is,react-reconciler,react/compiler-runtime,react/jsx-dev-runtime,react/jsx-runtime,scheduler@d5750093facf
route-pattern/:user_id/:repository/pull/:id/files(.:format)
route-controllerpull_requests
route-actionfiles
fetch-noncev2:2a6819ed-482c-5226-6ec3-591556e76cca
current-catalog-service-hashae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b
request-id9786:79AE7:BCEE3C:F6AAFF:6AF9917D
html-safe-nonce297360a6176446aa695d1785a0e4cadbd03c6dc376fd61b35f351a4ec99dc790
visitor-payloadeyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiI5Nzg2Ojc5QUU3OkJDRUUzQzpGNkFBRkY6NkFGOTkxN0QiLCJ2aXNpdG9yX2lkIjoiNjA5NTY2NTU1MzkxOTgwNzg2OSIsInJlZ2lvbl9lZGdlIjoiaWFkIiwicmVnaW9uX3JlbmRlciI6ImlhZCJ9
visitor-hmac48155c0c4e83456b7bb6e739cdf317488d126c719c3c4aee55987bbe6e27ce1b
hovercard-subject-tagpull_request:4860424176
github-keyboard-shortcutsrepository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot
google-site-verificationApib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I
octolytics-urlhttps://collector.github.com/github/collect
analytics-location///pull_requests/show/files
fb:app_id1401488693436528
apple-itunes-appapp-id=1477376905, app-argument=https://github.com/github/codeql/pull/22822/files
twitter:imagehttps://avatars.githubusercontent.com/u/62447351?s=400&v=4
twitter:cardsummary_large_image
og:imagehttps://avatars.githubusercontent.com/u/62447351?s=400&v=4
og:image:altUpdated the py/xxe, py/xml-bomb, and py/nosql-injection queries to respect the configured threat model when selecting untrusted data sources. The default behavior remains unchanged and uses remote ...
og:site_nameGitHub
og:typeobject
hostnamegithub.com
expected-hostnamegithub.com
None612d3e6ffd693e7ea8d9fcf452370995872baef31d825b1fedef704cd3d24ac7
turbo-cache-controlno-preview
diff-viewunified
go-importgithub.com/github/codeql git https://github.com/github/codeql.git
octolytics-dimension-user_id9919
octolytics-dimension-user_logingithub
octolytics-dimension-repository_id143040428
octolytics-dimension-repository_nwogithub/codeql
octolytics-dimension-repository_publictrue
octolytics-dimension-repository_is_forkfalse
octolytics-dimension-repository_network_root_id143040428
octolytics-dimension-repository_network_root_nwogithub/codeql
turbo-body-classeslogged-out env-production page-responsive full-width
disable-turbotrue
browser-stats-urlhttps://api.github.com/_private/browser/stats
browser-errors-urlhttps://api.github.com/_private/browser/errors
release072e34035c13c31543fba9f025cbbbda4210dae4
ui-targetfull
theme-color#1e2327
color-schemelight dark

Links:

Skip to contenthttps://github.com/github/codeql/pull/22822/files#start-of-content
https://github.com/
Sign inhttps://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fgithub%2Fcodeql%2Fpull%2F22822%2Ffiles
GitHubRepository hosting, code review, and collaborationhttps://github.com/platform
CopilotAI coding agent for tasks, projects, and automated workhttps://github.com/features/copilot
ActionsCI/CD and automationhttps://github.com/features/actions
Code QualityQuality analysis, fixes, and enforcementhttps://github.com/features/code-quality
CodespacesCloud development environmentshttps://github.com/features/codespaces
Code SecurityVulnerability detection and remediationhttps://github.com/security/advanced-security/code-security
Secret ProtectionSecret scanning and leak preventionhttps://github.com/security/advanced-security/secret-protection
All Featureshttps://github.com/features
Documentationhttps://docs.github.com/en
Traininghttps://learn.github.com/skills
Certificationshttps://learn.github.com/credentials
Build with Copilothttps://github.com/features/ai
Customize Copilothttps://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/customize-copilot-overview
Integrationshttps://github.com/marketplace
Trending reposhttps://github.com/trending
GitHub Sponsorshttps://github.com/open-source/sponsors
Developer articleshttps://github.com/resources/articles
ChangelogYour source for the latest features, improvements, and fixes across GitHub products, all in one place.https://github.blog/changelog/
Enterpriseshttps://github.com/enterprise
Teamhttps://github.com/team
Startupshttps://github.com/enterprise/startups
Nonprofitshttps://github.com/solutions/industry/nonprofits
Healthcarehttps://github.com/solutions/industry/healthcare
Financial serviceshttps://github.com/solutions/industry/financial-services
Manufacturinghttps://github.com/solutions/industry/manufacturing
Governmenthttps://github.com/solutions/industry/government
See all industrieshttps://github.com/solutions/industry
Why GitHubhttps://github.com/why-github
Customer Storieshttps://github.com/customer-stories
Business insightshttps://github.com/solutions/executive-insights
Trust Centerhttps://github.com/trust-center
GitHub Advanced SecurityEnterprise-grade code securityhttps://github.com/security/advanced-security
Copilot for businessEnterprise-grade AI featureshttps://github.com/features/copilot/copilot-business
Premium SupportEnterprise-grade 24/7 supporthttps://github.com/enterprise/premium-support
Documentationhttps://docs.github.com/en
Resource centerhttps://github.com/resources
Bloghttps://github.blog/
Events & webinarshttps://github.com/resources/events
Community Forumhttps://github.com/orgs/community/discussions
Customer Storieshttps://github.com/customer-stories
Integrationshttps://github.com/marketplace
Customer supporthttps://help.github.com/
Traininghttps://learn.github.com/skills
GitHub Statushttps://www.githubstatus.com/
Abouthttps://github.com/about
Partnershttps://github.com/partners
Changeloghttps://github.blog/changelog/
GitHub UniverseThe event for developers, by developers — talks, workshops, and what’s next for GitHub.https://githubuniverse.com/
Pricinghttps://github.com/pricing
Sign inhttps://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fgithub%2Fcodeql%2Fpull%2F22822%2Ffiles
Sign uphttps://github.com/signup?ref_cta=Sign+up&ref_loc=header+logged+out&ref_page=%2F%3Cuser-name%3E%2F%3Crepo-name%3E%2Fpull_requests%2Fshow%2Ffiles&source=header-repo&source_repo=github%2Fcodeql
Reloadhttps://github.com/github/codeql/pull/22822/files
Reloadhttps://github.com/github/codeql/pull/22822/files
Reloadhttps://github.com/github/codeql/pull/22822/files
githubhttps://github.com/github
codeqlhttps://github.com/github/codeql
Codehttps://github.com/github/codeql
Issues1k (1k)https://github.com/github/codeql/issues
Pull requests516 (516)https://github.com/github/codeql/pulls
Discussionshttps://github.com/github/codeql/discussions
Actionshttps://github.com/github/codeql/actions
Projectshttps://github.com/github/codeql/projects
Security and qualityhttps://github.com/github/codeql/security
Insightshttps://github.com/github/codeql/pulse
Sign up for GitHub https://github.com/signup?return_to=%2Fgithub%2Fcodeql%2Fissues%2Fnew%2Fchoose
terms of servicehttps://docs.github.com/terms
privacy statementhttps://docs.github.com/privacy
Sign inhttps://github.com/login?return_to=%2Fgithub%2Fcodeql%2Fissues%2Fnew%2Fchoose
owen-mchttps://github.com/owen-mc
github:mainhttps://github.com/github/codeql/tree/main
owen-mc:python/fix-query-active-sourceshttps://github.com/owen-mc/codeql/tree/python/fix-query-active-sources
Conversation 5 https://github.com/github/codeql/pull/22822
Commits 3 https://github.com/github/codeql/pull/22822/commits
Checks 10 https://github.com/github/codeql/pull/22822/checks
Findings https://github.com/github/codeql/pull/22822/findings
Files changed https://github.com/github/codeql/pull/22822/files
Please reload this pagehttps://github.com/github/codeql/pull/22822/files
Python: fix 3 queries to use sources for the active threat model https://github.com/github/codeql/pull/22822/files#top
Show all changes 3 commits https://github.com/github/codeql/pull/22822/files
55705d4 Use instanceof for threat model sources owen-mc Oct 14, 2026 https://github.com/github/codeql/pull/22822/commits/55705d4f1b35d2bca0f760d19274ac985db5fd52
9b363ee Make queries use ActiveThreatModelSource, not RemoteFlowSource owen-mc Oct 14, 2026 https://github.com/github/codeql/pull/22822/commits/9b363ee9cd5bdd040dafcb94db07ef4f27989473
ce648b3 Add change note owen-mc Oct 14, 2026 https://github.com/github/codeql/pull/22822/commits/ce648b38876f4bcecb3541972eb4e99d8e697ce7
Clear filters https://github.com/github/codeql/pull/22822/files
Please reload this pagehttps://github.com/github/codeql/pull/22822/files
Please reload this pagehttps://github.com/github/codeql/pull/22822/files
2026-10-14-active-threat-model-sources.md https://github.com/github/codeql/pull/22822/files#diff-d830a8786b7309981cfe8f39e7e53117f70e08274fb97d627fb46de0fbd43655
CodeInjectionCustomizations.qll https://github.com/github/codeql/pull/22822/files#diff-a9ee22e998be6b89d58b685faaa0bc5774c6b716d27b7f4388fd73fb075d7a05
CommandInjectionCustomizations.qll https://github.com/github/codeql/pull/22822/files#diff-8c4df4d7cdbb199a023f1973b1964f9a590dcc75267038f00d8626fa95fb7edf
CookieInjectionCustomizations.qll https://github.com/github/codeql/pull/22822/files#diff-6e96d8c00053a0238187e57799fc10eca8f4ff50a3f38b7ca9e762ad55f8cb38
HttpHeaderInjectionCustomizations.qll https://github.com/github/codeql/pull/22822/files#diff-82e9aa8effcbccd4942f257aa2b7ee4411d113a82841f594aafe11edaf393c48
LdapInjectionCustomizations.qll https://github.com/github/codeql/pull/22822/files#diff-688dc371050b28692607c1c16caa97652bca174d13efa418c1c623a9be965e2a
LogInjectionCustomizations.qll https://github.com/github/codeql/pull/22822/files#diff-e421849c515f43869677eb30ace3e3d08ea2077bab640e5e15988465e56c095d
NoSqlInjectionCustomizations.qll https://github.com/github/codeql/pull/22822/files#diff-79cb3c5022e1355a588032e9ba86b97158c7b826ab470a9e5eb68e6ebe18831e
PamAuthorizationCustomizations.qll https://github.com/github/codeql/pull/22822/files#diff-0caca2b6388edf1512a7d6dae37145292a57ba36d3302655e88bd4fdeefd5d23
PathInjectionCustomizations.qll https://github.com/github/codeql/pull/22822/files#diff-aa75193c123b48f82894161ca9295278af0f832f2d5b2a98378dea73a5177566
PolynomialReDoSCustomizations.qll https://github.com/github/codeql/pull/22822/files#diff-77aa7a30805cd2a5610c32e6468917058efa06033bc5203e4f6a5ea4dca0cf3e
ReflectedXSSCustomizations.qll https://github.com/github/codeql/pull/22822/files#diff-a300fa1f125456e6b25bc41b9785ca6edf0901c38aeaee4446ec0b222a7aad83
RegexInjectionCustomizations.qll https://github.com/github/codeql/pull/22822/files#diff-7dd0baf00dd5da3ab2ef1cda3d496267a413988eb24d953a79069654142a3abd
ServerSideRequestForgeryCustomizations.qll https://github.com/github/codeql/pull/22822/files#diff-502cb70dbb74ee46cda83c2b3c626120ae120bcd444e146be09bc46599cf981e
SqlInjectionCustomizations.qll https://github.com/github/codeql/pull/22822/files#diff-96893ac0f2e8780c984b886f3e6d95a26a81b1e6dd565c13f0992a5b170e42d0
TemplateInjectionCustomizations.qll https://github.com/github/codeql/pull/22822/files#diff-a2e81a02eba0bcabb7b84d3d74920fe3b25ebd3d8cb081c675dc5c8782b5562b
UnsafeDeserializationCustomizations.qll https://github.com/github/codeql/pull/22822/files#diff-b0be51abeb1e3f7c02043ca5b52e74ae34daa5313122a07b18c038b8292c839a
UrlRedirectCustomizations.qll https://github.com/github/codeql/pull/22822/files#diff-7051f0c44102cd6e626bd40851221c8ef9deac343799e885b6b689c9b1d54d50
XmlBombCustomizations.qll https://github.com/github/codeql/pull/22822/files#diff-bce4d3d7bd7256580a760d4be6eb2251d14dba1866a9acdb5d256ea88df93b20
XpathInjectionCustomizations.qll https://github.com/github/codeql/pull/22822/files#diff-48e6578a5dfbcb84652dfb3f3df4edd4d291aa07859d19ad7892e52ad5c08f60
XxeCustomizations.qll https://github.com/github/codeql/pull/22822/files#diff-fa1bd857227fa7b6cc29784eb3412e053a54701792bc8250cc426e05c93936fc
ExternalAPIs.qll https://github.com/github/codeql/pull/22822/files#diff-5907bc2dbcba73c524f6807f806c29616b4c6886854567a60e7fad92ff25323b
XsltInjectionCustomizations.qll https://github.com/github/codeql/pull/22822/files#diff-1cd68b4e1b5ed9b5f9c26212ad7cd42c52dd4e247b65873f3fe51ff36a2af68c
UnicodeBypassValidationQuery.qll https://github.com/github/codeql/pull/22822/files#diff-7b38a86b97c4d4502177fce708853c88bdfc17f49fd03bd69c37edbe90a763b0
CorsBypass.ql https://github.com/github/codeql/pull/22822/files#diff-b58c950186eb7af102d44873c2e0bdffe0db6b4b86dc372c546747d75bc42345
UnicodeDoS.ql https://github.com/github/codeql/pull/22822/files#diff-96731569734d459663a9a464109097c22dc8b6a4e0e51eedabee9d707406abee
UnsafeUnpackQuery.qll https://github.com/github/codeql/pull/22822/files#diff-455025a732010d6e89182d501c0009698e1b2d4e152f6841aed8f6fe644688b1
DecompressionBomb.qll https://github.com/github/codeql/pull/22822/files#diff-ff530e0f74ecdfd875327443cdc4ead83a8f198bff5eb2134c23a4ef92f9c1e9
LdapInsecureAuth.qll https://github.com/github/codeql/pull/22822/files#diff-451582617a17983c567c329c44a909664842bd5c9e7d61f4ae80d6c4010a1238
RemoteCommandExecution.qll https://github.com/github/codeql/pull/22822/files#diff-2cdfa451d1cb9b7d16894b853e39f29bd998228521d06d73ee1954998432c228
TimingAttack.qll https://github.com/github/codeql/pull/22822/files#diff-7cc1d19b23f53446b3379b4734f2da7af4289337d29e480bbb4b518ac5f5d125
EmailXss.qll https://github.com/github/codeql/pull/22822/files#diff-02e3725182a1c1602f69ca1336fade1f1d078f0860a8f7b5184c7f6ab9d70748
PromptInjectionCustomizations.qll https://github.com/github/codeql/pull/22822/files#diff-1470a68e0f40e8159ce57072168202af21b60e32a7c3317a03d2096c6b91ab88
CsvInjection.qll https://github.com/github/codeql/pull/22822/files#diff-aa5fda7c2de3bb64828904af34d3875cf81ec31a764aa18e415ed1be2ce110e2
https://github.com/github/codeql/blob/main/CODEOWNERS#L18
python/ql/lib/change-notes/2026-10-14-active-threat-model-sources.mdhttps://github.com/github/codeql/pull/22822/files#diff-d830a8786b7309981cfe8f39e7e53117f70e08274fb97d627fb46de0fbd43655
View file https://github.com/owen-mc/codeql/blob/ce648b38876f4bcecb3541972eb4e99d8e697ce7/python/ql/lib/change-notes/2026-10-14-active-threat-model-sources.md
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/22822/{{ revealButtonHref }}
https://github.com/github/codeql/blob/main/CODEOWNERS#L18
python/ql/lib/semmle/python/security/dataflow/CodeInjectionCustomizations.qllhttps://github.com/github/codeql/pull/22822/files#diff-a9ee22e998be6b89d58b685faaa0bc5774c6b716d27b7f4388fd73fb075d7a05
View file https://github.com/owen-mc/codeql/blob/ce648b38876f4bcecb3541972eb4e99d8e697ce7/python/ql/lib/semmle/python/security/dataflow/CodeInjectionCustomizations.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/22822/{{ revealButtonHref }}
https://github.com/github/codeql/pull/22822/files#diff-a9ee22e998be6b89d58b685faaa0bc5774c6b716d27b7f4388fd73fb075d7a05
https://github.com/github/codeql/pull/22822/files#diff-a9ee22e998be6b89d58b685faaa0bc5774c6b716d27b7f4388fd73fb075d7a05
https://github.com/github/codeql/blob/main/CODEOWNERS#L18
python/ql/lib/semmle/python/security/dataflow/CommandInjectionCustomizations.qllhttps://github.com/github/codeql/pull/22822/files#diff-8c4df4d7cdbb199a023f1973b1964f9a590dcc75267038f00d8626fa95fb7edf
View file https://github.com/owen-mc/codeql/blob/ce648b38876f4bcecb3541972eb4e99d8e697ce7/python/ql/lib/semmle/python/security/dataflow/CommandInjectionCustomizations.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/22822/{{ revealButtonHref }}
https://github.com/github/codeql/pull/22822/files#diff-8c4df4d7cdbb199a023f1973b1964f9a590dcc75267038f00d8626fa95fb7edf
https://github.com/github/codeql/pull/22822/files#diff-8c4df4d7cdbb199a023f1973b1964f9a590dcc75267038f00d8626fa95fb7edf
https://github.com/github/codeql/blob/main/CODEOWNERS#L18
python/ql/lib/semmle/python/security/dataflow/CookieInjectionCustomizations.qllhttps://github.com/github/codeql/pull/22822/files#diff-6e96d8c00053a0238187e57799fc10eca8f4ff50a3f38b7ca9e762ad55f8cb38
View file https://github.com/owen-mc/codeql/blob/ce648b38876f4bcecb3541972eb4e99d8e697ce7/python/ql/lib/semmle/python/security/dataflow/CookieInjectionCustomizations.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/22822/{{ revealButtonHref }}
https://github.com/github/codeql/pull/22822/files#diff-6e96d8c00053a0238187e57799fc10eca8f4ff50a3f38b7ca9e762ad55f8cb38
https://github.com/github/codeql/pull/22822/files#diff-6e96d8c00053a0238187e57799fc10eca8f4ff50a3f38b7ca9e762ad55f8cb38
https://github.com/github/codeql/blob/main/CODEOWNERS#L18
python/ql/lib/semmle/python/security/dataflow/HttpHeaderInjectionCustomizations.qllhttps://github.com/github/codeql/pull/22822/files#diff-82e9aa8effcbccd4942f257aa2b7ee4411d113a82841f594aafe11edaf393c48
View file https://github.com/owen-mc/codeql/blob/ce648b38876f4bcecb3541972eb4e99d8e697ce7/python/ql/lib/semmle/python/security/dataflow/HttpHeaderInjectionCustomizations.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/22822/{{ revealButtonHref }}
https://github.com/github/codeql/pull/22822/files#diff-82e9aa8effcbccd4942f257aa2b7ee4411d113a82841f594aafe11edaf393c48
https://github.com/github/codeql/pull/22822/files#diff-82e9aa8effcbccd4942f257aa2b7ee4411d113a82841f594aafe11edaf393c48
https://github.com/github/codeql/blob/main/CODEOWNERS#L18
python/ql/lib/semmle/python/security/dataflow/LdapInjectionCustomizations.qllhttps://github.com/github/codeql/pull/22822/files#diff-688dc371050b28692607c1c16caa97652bca174d13efa418c1c623a9be965e2a
View file https://github.com/owen-mc/codeql/blob/ce648b38876f4bcecb3541972eb4e99d8e697ce7/python/ql/lib/semmle/python/security/dataflow/LdapInjectionCustomizations.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/22822/{{ revealButtonHref }}
https://github.com/github/codeql/pull/22822/files#diff-688dc371050b28692607c1c16caa97652bca174d13efa418c1c623a9be965e2a
https://github.com/github/codeql/pull/22822/files#diff-688dc371050b28692607c1c16caa97652bca174d13efa418c1c623a9be965e2a
https://github.com/github/codeql/blob/main/CODEOWNERS#L18
python/ql/lib/semmle/python/security/dataflow/LogInjectionCustomizations.qllhttps://github.com/github/codeql/pull/22822/files#diff-e421849c515f43869677eb30ace3e3d08ea2077bab640e5e15988465e56c095d
View file https://github.com/owen-mc/codeql/blob/ce648b38876f4bcecb3541972eb4e99d8e697ce7/python/ql/lib/semmle/python/security/dataflow/LogInjectionCustomizations.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/22822/{{ revealButtonHref }}
https://github.com/github/codeql/pull/22822/files#diff-e421849c515f43869677eb30ace3e3d08ea2077bab640e5e15988465e56c095d
https://github.com/github/codeql/pull/22822/files#diff-e421849c515f43869677eb30ace3e3d08ea2077bab640e5e15988465e56c095d
https://github.com/github/codeql/blob/main/CODEOWNERS#L18
python/ql/lib/semmle/python/security/dataflow/NoSqlInjectionCustomizations.qllhttps://github.com/github/codeql/pull/22822/files#diff-79cb3c5022e1355a588032e9ba86b97158c7b826ab470a9e5eb68e6ebe18831e
View file https://github.com/owen-mc/codeql/blob/ce648b38876f4bcecb3541972eb4e99d8e697ce7/python/ql/lib/semmle/python/security/dataflow/NoSqlInjectionCustomizations.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/22822/{{ revealButtonHref }}
https://github.com/github/codeql/pull/22822/files#diff-79cb3c5022e1355a588032e9ba86b97158c7b826ab470a9e5eb68e6ebe18831e
https://github.com/github/codeql/pull/22822/files#diff-79cb3c5022e1355a588032e9ba86b97158c7b826ab470a9e5eb68e6ebe18831e
https://github.com/github/codeql/pull/22822/files#diff-79cb3c5022e1355a588032e9ba86b97158c7b826ab470a9e5eb68e6ebe18831e
https://github.com/github/codeql/pull/22822/files#diff-79cb3c5022e1355a588032e9ba86b97158c7b826ab470a9e5eb68e6ebe18831e
https://github.com/github/codeql/blob/main/CODEOWNERS#L18
python/ql/lib/semmle/python/security/dataflow/PamAuthorizationCustomizations.qllhttps://github.com/github/codeql/pull/22822/files#diff-0caca2b6388edf1512a7d6dae37145292a57ba36d3302655e88bd4fdeefd5d23
View file https://github.com/owen-mc/codeql/blob/ce648b38876f4bcecb3541972eb4e99d8e697ce7/python/ql/lib/semmle/python/security/dataflow/PamAuthorizationCustomizations.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/22822/{{ revealButtonHref }}
https://github.com/github/codeql/pull/22822/files#diff-0caca2b6388edf1512a7d6dae37145292a57ba36d3302655e88bd4fdeefd5d23
https://github.com/github/codeql/pull/22822/files#diff-0caca2b6388edf1512a7d6dae37145292a57ba36d3302655e88bd4fdeefd5d23
https://github.com/github/codeql/blob/main/CODEOWNERS#L18
python/ql/lib/semmle/python/security/dataflow/PathInjectionCustomizations.qllhttps://github.com/github/codeql/pull/22822/files#diff-aa75193c123b48f82894161ca9295278af0f832f2d5b2a98378dea73a5177566
View file https://github.com/owen-mc/codeql/blob/ce648b38876f4bcecb3541972eb4e99d8e697ce7/python/ql/lib/semmle/python/security/dataflow/PathInjectionCustomizations.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/22822/{{ revealButtonHref }}
https://github.com/github/codeql/pull/22822/files#diff-aa75193c123b48f82894161ca9295278af0f832f2d5b2a98378dea73a5177566
https://github.com/github/codeql/pull/22822/files#diff-aa75193c123b48f82894161ca9295278af0f832f2d5b2a98378dea73a5177566
https://github.com/github/codeql/blob/main/CODEOWNERS#L18
python/ql/lib/semmle/python/security/dataflow/PolynomialReDoSCustomizations.qllhttps://github.com/github/codeql/pull/22822/files#diff-77aa7a30805cd2a5610c32e6468917058efa06033bc5203e4f6a5ea4dca0cf3e
View file https://github.com/owen-mc/codeql/blob/ce648b38876f4bcecb3541972eb4e99d8e697ce7/python/ql/lib/semmle/python/security/dataflow/PolynomialReDoSCustomizations.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/22822/{{ revealButtonHref }}
https://github.com/github/codeql/pull/22822/files#diff-77aa7a30805cd2a5610c32e6468917058efa06033bc5203e4f6a5ea4dca0cf3e
https://github.com/github/codeql/pull/22822/files#diff-77aa7a30805cd2a5610c32e6468917058efa06033bc5203e4f6a5ea4dca0cf3e
https://github.com/github/codeql/blob/main/CODEOWNERS#L18
python/ql/lib/semmle/python/security/dataflow/ReflectedXSSCustomizations.qllhttps://github.com/github/codeql/pull/22822/files#diff-a300fa1f125456e6b25bc41b9785ca6edf0901c38aeaee4446ec0b222a7aad83
View file https://github.com/owen-mc/codeql/blob/ce648b38876f4bcecb3541972eb4e99d8e697ce7/python/ql/lib/semmle/python/security/dataflow/ReflectedXSSCustomizations.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/22822/{{ revealButtonHref }}
https://github.com/github/codeql/pull/22822/files#diff-a300fa1f125456e6b25bc41b9785ca6edf0901c38aeaee4446ec0b222a7aad83
https://github.com/github/codeql/pull/22822/files#diff-a300fa1f125456e6b25bc41b9785ca6edf0901c38aeaee4446ec0b222a7aad83
https://github.com/github/codeql/blob/main/CODEOWNERS#L18
python/ql/lib/semmle/python/security/dataflow/RegexInjectionCustomizations.qllhttps://github.com/github/codeql/pull/22822/files#diff-7dd0baf00dd5da3ab2ef1cda3d496267a413988eb24d953a79069654142a3abd
View file https://github.com/owen-mc/codeql/blob/ce648b38876f4bcecb3541972eb4e99d8e697ce7/python/ql/lib/semmle/python/security/dataflow/RegexInjectionCustomizations.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/22822/{{ revealButtonHref }}
https://github.com/github/codeql/pull/22822/files#diff-7dd0baf00dd5da3ab2ef1cda3d496267a413988eb24d953a79069654142a3abd
https://github.com/github/codeql/pull/22822/files#diff-7dd0baf00dd5da3ab2ef1cda3d496267a413988eb24d953a79069654142a3abd
https://github.com/github/codeql/blob/main/CODEOWNERS#L18
python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryCustomizations.qllhttps://github.com/github/codeql/pull/22822/files#diff-502cb70dbb74ee46cda83c2b3c626120ae120bcd444e146be09bc46599cf981e
View file https://github.com/owen-mc/codeql/blob/ce648b38876f4bcecb3541972eb4e99d8e697ce7/python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryCustomizations.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/22822/{{ revealButtonHref }}
https://github.com/github/codeql/pull/22822/files#diff-502cb70dbb74ee46cda83c2b3c626120ae120bcd444e146be09bc46599cf981e
https://github.com/github/codeql/pull/22822/files#diff-502cb70dbb74ee46cda83c2b3c626120ae120bcd444e146be09bc46599cf981e
https://github.com/github/codeql/blob/main/CODEOWNERS#L18
python/ql/lib/semmle/python/security/dataflow/SqlInjectionCustomizations.qllhttps://github.com/github/codeql/pull/22822/files#diff-96893ac0f2e8780c984b886f3e6d95a26a81b1e6dd565c13f0992a5b170e42d0
View file https://github.com/owen-mc/codeql/blob/ce648b38876f4bcecb3541972eb4e99d8e697ce7/python/ql/lib/semmle/python/security/dataflow/SqlInjectionCustomizations.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/22822/{{ revealButtonHref }}
https://github.com/github/codeql/pull/22822/files#diff-96893ac0f2e8780c984b886f3e6d95a26a81b1e6dd565c13f0992a5b170e42d0
https://github.com/github/codeql/pull/22822/files#diff-96893ac0f2e8780c984b886f3e6d95a26a81b1e6dd565c13f0992a5b170e42d0
https://github.com/github/codeql/blob/main/CODEOWNERS#L18
python/ql/lib/semmle/python/security/dataflow/TemplateInjectionCustomizations.qllhttps://github.com/github/codeql/pull/22822/files#diff-a2e81a02eba0bcabb7b84d3d74920fe3b25ebd3d8cb081c675dc5c8782b5562b
View file https://github.com/owen-mc/codeql/blob/ce648b38876f4bcecb3541972eb4e99d8e697ce7/python/ql/lib/semmle/python/security/dataflow/TemplateInjectionCustomizations.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/22822/{{ revealButtonHref }}
https://github.com/github/codeql/pull/22822/files#diff-a2e81a02eba0bcabb7b84d3d74920fe3b25ebd3d8cb081c675dc5c8782b5562b
https://github.com/github/codeql/pull/22822/files#diff-a2e81a02eba0bcabb7b84d3d74920fe3b25ebd3d8cb081c675dc5c8782b5562b
https://github.com/github/codeql/blob/main/CODEOWNERS#L18
python/ql/lib/semmle/python/security/dataflow/UnsafeDeserializationCustomizations.qllhttps://github.com/github/codeql/pull/22822/files#diff-b0be51abeb1e3f7c02043ca5b52e74ae34daa5313122a07b18c038b8292c839a
View file https://github.com/owen-mc/codeql/blob/ce648b38876f4bcecb3541972eb4e99d8e697ce7/python/ql/lib/semmle/python/security/dataflow/UnsafeDeserializationCustomizations.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/22822/{{ revealButtonHref }}
https://github.com/github/codeql/pull/22822/files#diff-b0be51abeb1e3f7c02043ca5b52e74ae34daa5313122a07b18c038b8292c839a
https://github.com/github/codeql/pull/22822/files#diff-b0be51abeb1e3f7c02043ca5b52e74ae34daa5313122a07b18c038b8292c839a
https://github.com/github/codeql/blob/main/CODEOWNERS#L18
python/ql/lib/semmle/python/security/dataflow/UrlRedirectCustomizations.qllhttps://github.com/github/codeql/pull/22822/files#diff-7051f0c44102cd6e626bd40851221c8ef9deac343799e885b6b689c9b1d54d50
View file https://github.com/owen-mc/codeql/blob/ce648b38876f4bcecb3541972eb4e99d8e697ce7/python/ql/lib/semmle/python/security/dataflow/UrlRedirectCustomizations.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/22822/{{ revealButtonHref }}
https://github.com/github/codeql/pull/22822/files#diff-7051f0c44102cd6e626bd40851221c8ef9deac343799e885b6b689c9b1d54d50
https://github.com/github/codeql/pull/22822/files#diff-7051f0c44102cd6e626bd40851221c8ef9deac343799e885b6b689c9b1d54d50
https://github.com/github/codeql/blob/main/CODEOWNERS#L18
python/ql/lib/semmle/python/security/dataflow/XmlBombCustomizations.qllhttps://github.com/github/codeql/pull/22822/files#diff-bce4d3d7bd7256580a760d4be6eb2251d14dba1866a9acdb5d256ea88df93b20
View file https://github.com/owen-mc/codeql/blob/ce648b38876f4bcecb3541972eb4e99d8e697ce7/python/ql/lib/semmle/python/security/dataflow/XmlBombCustomizations.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/22822/{{ revealButtonHref }}
https://github.com/github/codeql/pull/22822/files#diff-bce4d3d7bd7256580a760d4be6eb2251d14dba1866a9acdb5d256ea88df93b20
https://github.com/github/codeql/pull/22822/files#diff-bce4d3d7bd7256580a760d4be6eb2251d14dba1866a9acdb5d256ea88df93b20
https://github.com/github/codeql/pull/22822/files#diff-bce4d3d7bd7256580a760d4be6eb2251d14dba1866a9acdb5d256ea88df93b20
https://github.com/github/codeql/blob/main/CODEOWNERS#L18
python/ql/lib/semmle/python/security/dataflow/XpathInjectionCustomizations.qllhttps://github.com/github/codeql/pull/22822/files#diff-48e6578a5dfbcb84652dfb3f3df4edd4d291aa07859d19ad7892e52ad5c08f60
View file https://github.com/owen-mc/codeql/blob/ce648b38876f4bcecb3541972eb4e99d8e697ce7/python/ql/lib/semmle/python/security/dataflow/XpathInjectionCustomizations.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/22822/{{ revealButtonHref }}
https://github.com/github/codeql/pull/22822/files#diff-48e6578a5dfbcb84652dfb3f3df4edd4d291aa07859d19ad7892e52ad5c08f60
https://github.com/github/codeql/pull/22822/files#diff-48e6578a5dfbcb84652dfb3f3df4edd4d291aa07859d19ad7892e52ad5c08f60
https://github.com/github/codeql/blob/main/CODEOWNERS#L18
python/ql/lib/semmle/python/security/dataflow/XxeCustomizations.qllhttps://github.com/github/codeql/pull/22822/files#diff-fa1bd857227fa7b6cc29784eb3412e053a54701792bc8250cc426e05c93936fc
View file https://github.com/owen-mc/codeql/blob/ce648b38876f4bcecb3541972eb4e99d8e697ce7/python/ql/lib/semmle/python/security/dataflow/XxeCustomizations.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/22822/{{ revealButtonHref }}
https://github.com/github/codeql/pull/22822/files#diff-fa1bd857227fa7b6cc29784eb3412e053a54701792bc8250cc426e05c93936fc
https://github.com/github/codeql/pull/22822/files#diff-fa1bd857227fa7b6cc29784eb3412e053a54701792bc8250cc426e05c93936fc
owen-mchttps://github.com/owen-mc
Oct 14, 2026https://github.com/github/codeql/pull/22822/files#r4273109971
Learn morehttps://docs.github.com/articles/managing-disruptive-comments/#hiding-a-comment
Please reload this pagehttps://github.com/github/codeql/pull/22822/files
https://github.com/github/codeql/pull/22822/files#diff-fa1bd857227fa7b6cc29784eb3412e053a54701792bc8250cc426e05c93936fc
https://github.com/github/codeql/blob/main/CODEOWNERS#L18
python/ql/src/Security/CWE-020-ExternalAPIs/ExternalAPIs.qllhttps://github.com/github/codeql/pull/22822/files#diff-5907bc2dbcba73c524f6807f806c29616b4c6886854567a60e7fad92ff25323b
View file https://github.com/owen-mc/codeql/blob/ce648b38876f4bcecb3541972eb4e99d8e697ce7/python/ql/src/Security/CWE-020-ExternalAPIs/ExternalAPIs.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/22822/{{ revealButtonHref }}
https://github.com/github/codeql/pull/22822/files#diff-5907bc2dbcba73c524f6807f806c29616b4c6886854567a60e7fad92ff25323b
https://github.com/github/codeql/pull/22822/files#diff-5907bc2dbcba73c524f6807f806c29616b4c6886854567a60e7fad92ff25323b
https://github.com/github/codeql/pull/22822/files#diff-5907bc2dbcba73c524f6807f806c29616b4c6886854567a60e7fad92ff25323b
https://github.com/github/codeql/pull/22822/files#diff-5907bc2dbcba73c524f6807f806c29616b4c6886854567a60e7fad92ff25323b
https://github.com/github/codeql/pull/22822/files#diff-5907bc2dbcba73c524f6807f806c29616b4c6886854567a60e7fad92ff25323b
https://github.com/github/codeql/blob/main/CODEOWNERS#L18
python/ql/src/experimental/Security/CWE-091/XsltInjectionCustomizations.qllhttps://github.com/github/codeql/pull/22822/files#diff-1cd68b4e1b5ed9b5f9c26212ad7cd42c52dd4e247b65873f3fe51ff36a2af68c
View file https://github.com/owen-mc/codeql/blob/ce648b38876f4bcecb3541972eb4e99d8e697ce7/python/ql/src/experimental/Security/CWE-091/XsltInjectionCustomizations.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/22822/{{ revealButtonHref }}
https://github.com/github/codeql/pull/22822/files#diff-1cd68b4e1b5ed9b5f9c26212ad7cd42c52dd4e247b65873f3fe51ff36a2af68c
https://github.com/github/codeql/pull/22822/files#diff-1cd68b4e1b5ed9b5f9c26212ad7cd42c52dd4e247b65873f3fe51ff36a2af68c
https://github.com/github/codeql/blob/main/CODEOWNERS#L18
python/ql/src/experimental/Security/CWE-176/UnicodeBypassValidationQuery.qllhttps://github.com/github/codeql/pull/22822/files#diff-7b38a86b97c4d4502177fce708853c88bdfc17f49fd03bd69c37edbe90a763b0
View file https://github.com/owen-mc/codeql/blob/ce648b38876f4bcecb3541972eb4e99d8e697ce7/python/ql/src/experimental/Security/CWE-176/UnicodeBypassValidationQuery.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/22822/{{ revealButtonHref }}
https://github.com/github/codeql/pull/22822/files#diff-7b38a86b97c4d4502177fce708853c88bdfc17f49fd03bd69c37edbe90a763b0
https://github.com/github/codeql/pull/22822/files#diff-7b38a86b97c4d4502177fce708853c88bdfc17f49fd03bd69c37edbe90a763b0
https://github.com/github/codeql/pull/22822/files#diff-7b38a86b97c4d4502177fce708853c88bdfc17f49fd03bd69c37edbe90a763b0
https://github.com/github/codeql/pull/22822/files#diff-7b38a86b97c4d4502177fce708853c88bdfc17f49fd03bd69c37edbe90a763b0
https://github.com/github/codeql/blob/main/CODEOWNERS#L18
python/ql/src/experimental/Security/CWE-346/CorsBypass.qlhttps://github.com/github/codeql/pull/22822/files#diff-b58c950186eb7af102d44873c2e0bdffe0db6b4b86dc372c546747d75bc42345
View file https://github.com/owen-mc/codeql/blob/ce648b38876f4bcecb3541972eb4e99d8e697ce7/python/ql/src/experimental/Security/CWE-346/CorsBypass.ql
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/22822/{{ revealButtonHref }}
https://github.com/github/codeql/pull/22822/files#diff-b58c950186eb7af102d44873c2e0bdffe0db6b4b86dc372c546747d75bc42345
https://github.com/github/codeql/pull/22822/files#diff-b58c950186eb7af102d44873c2e0bdffe0db6b4b86dc372c546747d75bc42345
https://github.com/github/codeql/pull/22822/files#diff-b58c950186eb7af102d44873c2e0bdffe0db6b4b86dc372c546747d75bc42345
https://github.com/github/codeql/pull/22822/files#diff-b58c950186eb7af102d44873c2e0bdffe0db6b4b86dc372c546747d75bc42345
Please reload this pagehttps://github.com/github/codeql/pull/22822/files
Please reload this pagehttps://github.com/github/codeql/pull/22822/files
https://github.com
Termshttps://docs.github.com/site-policy/github-terms/github-terms-of-service
Privacyhttps://docs.github.com/site-policy/privacy-policies/github-privacy-statement
Securityhttps://github.com/security
Statushttps://www.githubstatus.com/
Communityhttps://github.community/
Docshttps://docs.github.com/
Contacthttps://support.github.com?tags=dotcom-footer

Viewport: width=device-width

URLs of crawlers that visited me.