All pull requests

Pull requests

• [UPDATE QUERY] Python: cover XPath, str.format and LLM prompt injection gaps; argparse injection already covered (CWE-643, CWE-1336, CWE-1427, CWE-78)

  #370·felickz with CopilotAI opened Oct 31, 2026·8 tasks done·

  ·
  1

  10

  

• [NEW DATA EXTENSION] Python: regression tests showing AWS Lambda event injection needs no model

  #369·felickz with CopilotAI opened Oct 31, 2026·6 of 12 tasks·

  ·
  1

  7

  

• [NEW QUERY] js/proxy-disabled-certificate-validation: flag secure: false on http-proxy, http-proxy-middleware and Vite proxies

  #368·felickz with CopilotAI opened Oct 31, 2026·8 of 9 tasks·

  ·
  1

  3

  

• [UPDATE QUERY] JavaScript: track req.session across calls in js/session-fixation, add js/rate-limit-spoofable-key (CWE-384, CWE-307)

  #367·felickz with CopilotAI opened Oct 31, 2026·8 tasks done·

  ·
  1

  25

  

• [UPDATE QUERY] java/log-injection: model Log4j 2 ThreadContext as log-injection sinks

  #366·felickz with CopilotAI opened Oct 31, 2026·7 of 8 tasks·

  ·
  1

  1

  

• Add js/missing-subresource-integrity query for third-party scripts without SRI (CWE-829)

  #365·felickz with CopilotAI opened Oct 31, 2026·8 of 9 tasks·

  ·
  1

  7

  

• [UPDATE QUERY] C#: triage CWE-91/CWE-74 gap; regression test for cs/xml-injection, new cs/json-injection query

  #364·felickz with CopilotAI opened Oct 31, 2026·8 tasks done·

  ·
  1

  25

  

• [UPDATE QUERY] C#: add log4net ILog log-injection sinks for cs/log-forging (CWE-117)

  #363·felickz with CopilotAI opened Oct 31, 2026·

  ·
  1

  2

  

• [NEW QUERY] C/C++: insecure temporary file opened without exclusive creation (CWE-377)

  #362·felickz with CopilotAI opened Oct 31, 2026·8 of 9 tasks·

  ·
  1

  7

  

• [NEW QUERY] Swift: credential and sensitive data exposure (swift/credential-and-data-exposure)

  #352·felickz with CopilotAI opened Oct 31, 2026·8 of 9 tasks·

  ·
  1

  9

  

• [UPDATE QUERY] Swift: report nil, CommonCrypto and default-parameter IVs that swift/static-initialization-vector misses

  #351·felickz with CopilotAI opened Oct 31, 2026·7 of 8 tasks·

  ·
  1

  5

  

• [NEW QUERY] Swift CWE-20: unvalidated custom URL scheme parameters and unchecked substring ranges

  #350·felickz with CopilotAI opened Oct 31, 2026·8 of 9 tasks·

  ·
  1

  7

  

• [NEW QUERY] Java: JDBC connection string injection (CWE-99)

  #349·felickz with CopilotAI opened Oct 31, 2026·8 of 9 tasks·

  ·
  1

  4

  

• [NEW QUERY] Ruby CWE-470: add regression test showing rb/code-injection already covers reflection via try/send

  #348·felickz with CopilotAI opened Oct 31, 2026·7 of 9 tasks·

  ·
  1

  7

  

• [NEW QUERY] JavaScript: cross-origin user data exposure via JSONP and postMessage "*" (CWE-346, CWE-942)

  #347·felickz with CopilotAI opened Oct 31, 2026·8 of 9 tasks·

  ·
  1

  5

  

• [NEW QUERY] js/orm-user-controlled-object: user-controlled objects in Mongoose/Sequelize models and where clauses (CWE-915)

  #346·felickz with CopilotAI opened Oct 31, 2026·9 tasks done·

  ·
  1

  10

  

• [UPDATE QUERY] Go: Report wildcard CORS origins with credentials or PUT/PATCH/DELETE (go/cors-misconfiguration-extended, CWE-942)

  #345·felickz with CopilotAI opened Oct 31, 2026·8 tasks done·

  ·
  1

  7

  

• [NEW DATA EXTENSION] C/C++: LDAP injection (CWE-90) sinks for Win32 Wldap32 / OpenLDAP, plus cpp/ldap-injection query

  #344·felickz with CopilotAI opened Oct 31, 2026·9 of 12 tasks·

  ·
  1

  3

  

• [NEW QUERY] C/C++: signal handler safety (CWE-479, CWE-364)

  #343·felickz with CopilotAI opened Oct 31, 2026·8 of 9 tasks·

  ·
  1

  7

  

• [NEW DATA EXTENSION] C/C++: model-driven queries for unchecked impersonation (CWE-273) and named-pipe squatting (CWE-284)

  #342·felickz with CopilotAI opened Oct 31, 2026·11 of 12 tasks·

  ·
  1

  1

  

• [NEW QUERY] C#: cs/unsafe-reflection (CWE-470) and cs/untrusted-search-path (CWE-426)

  #341·felickz with CopilotAI opened Oct 31, 2026·8 of 9 tasks·

  ·
  1

  5

  

• [NEW QUERY] Ruby: flag mass assignment of user-controlled ownership/privilege fields (CWE-639)

  #340·felickz with CopilotAI opened Oct 31, 2026·9 tasks done·

  ·
  1

  8

  

• [NEW QUERY] Ruby: Rails production config does not enforce SSL (CWE-319)

  #339·felickz with CopilotAI opened Oct 31, 2026·8 of 9 tasks·

  ·
  1

  10

  

• [UPDATE QUERY] No change needed: js/insufficient-password-hash already flags juice-shop MD5 password hashing

  #338·felickz with CopilotAI opened Oct 31, 2026·2 of 8 tasks·

  ·
  1

  

• [NEW QUERY] Go: cleartext storage of sensitive data in a database, and database error message exposure

  #337·felickz with CopilotAI opened Oct 31, 2026·8 of 9 tasks·

  ·
  1

  11