CodeQL 2.23.5 Enhances Swift 6.2 Support and Introduces New Java Security Queries

GitHub has announced the release of CodeQL 2.23.5, a significant update to its static analysis engine, which enhances support for Swift 6.2 and introduces several new Java security queries. This update aims to improve the accuracy of code scanning results, providing developers with robust tools for identifying security vulnerabilities in their code, according to GitHub.

Language and Framework Support

The latest release of CodeQL expands its capabilities with added support for Swift 6.2, allowing developers to analyze projects developed with this version. Additionally, the update includes enhanced support for the Rust language, particularly for the actix-web framework and the mysql and mysql_async libraries. C# users on macOS and Linux will benefit from improved tracing capabilities, supporting .NET 10 RC2.

Query Enhancements

CodeQL 2.23.5 introduces three new Java queries designed to detect concurrency issues in classes marked as @ThreadSafe. These include:

• java/escaping for detecting values escaping from thread-safe classes.
• java/not-threadsafe for identifying data races.
• java/safe-publication for spotting unsafe publication in thread-safe classes.

In addition to these, the java/sensitive-cookie-not-httponly query has been promoted from experimental to the main query pack, enhancing its reliability.

Improvements Across Other Languages

Significant improvements have been made to C# queries, including a complete rewrite of the cs/dereferenced-value-may-be-null query, which reduces false positives by changing it from a path-problem to a problem query. Python queries have been refined as well, with the py/insecure-cookie query being split into three distinct queries to better handle cookies containing sensitive data.

Availability and Deployment

The new features of CodeQL 2.23.5 are automatically available to GitHub code scanning users on github.com, and they will be part of the GitHub Enterprise Server (GHES) release 3.20. Users with older versions of GHES are advised to manually upgrade their CodeQL version to benefit from the latest enhancements.

Image source: Shutterstock