CodeQL query help for Java¶
Visit the articles below to see the documentation for the queries included in the following query suites:
code-scanning: queries run by default in CodeQL code scanning on GitHub.security-extended: queries fromcode-scanning, plus extra security queries with slightly lower precision and severity.security-and-quality: queries fromcode-scanning,security-extended, plus extra maintainability and reliability queries.
For shorter queries that you can use as building blocks when writing your own queries, see the example queries in the CodeQL repository.
- Access to unsupported JDK-internal API
- AnnotationPresent check
- Arbitrary file write during archive extraction (”Zip Slip”)
- Array index out of bounds
- Bad implementation of an event Adapter
- Bad suite method
- Boxed variable is never null
- Building a command line with string concatenation
- Call to Iterator.remove may fail
- Cast from abstract to concrete collection
- Chain of ‘instanceof’ tests
- Character passed to StringBuffer or StringBuilder constructor
- Class has same name as super class
- Cleartext storage of sensitive information in cookie
- Cleartext storage of sensitive information using ‘Properties’ class
- Comparison of identical values
- Comparison of narrow type with wide type in loop condition
- Confusing method names because of capitalization
- Confusing non-overriding of package-private method
- Confusing overloading of methods
- Constant interface anti-pattern
- Constant loop condition
- Container contents are never accessed
- Container contents are never initialized
- Container size compared to zero
- Continue statement that does not continue
- Contradictory type checks
- Creates empty ZIP file entry
- Cross-site scripting
- Dangerous non-short-circuit logic
- Dangerous runFinalizersOnExit
- Depending upon JCenter/Bintray as an artifact repository
- Deprecated method or constructor invocation
- Dereferenced expression may be null
- Dereferenced variable is always null
- Dereferenced variable may be null
- Deserialization of user-controlled data
- Detect JHipster Generator Vulnerability CVE-2019-16303
- Direct call to a run() method
- Disabled Netty HTTP header validation
- Disabled Spring CSRF protection
- Double-checked locking is not thread-safe
- Equals method does not inspect argument type
- Equals on incomparable types
- Equals or hashCode on arrays
- Executing a command with a relative path
- Exposing internal representation
- Expression always evaluates to the same value
- Expression language injection (JEXL)
- Externalizable but no public no-argument constructor
- Failure to use HTTPS or SFTP URL in Maven artifact upload/download
- Failure to use secure cookies
- Field masks field in super class
- Finalizer inconsistency
- Futile synchronization on field
- HTTP response splitting
- Hard-coded credential in API call
- Hashed value without hashCode definition
- Ignored error status of call
- Implicit conversion from array to string
- Implicit narrowing conversion in compound assignment
- Improper validation of user-provided array index
- Improper validation of user-provided size used for array construction
- Inconsistent compareTo
- Inconsistent equals and hashCode
- Inconsistent synchronization for writeObject()
- Inconsistent synchronization of getter and setter
- Incorrect absolute value of random number
- Incorrect serialVersionUID field
- Inefficient String constructor
- Inefficient empty string test
- Inefficient output stream
- Inefficient primitive constructor
- Inefficient use of key set iterator
- Information exposure through a stack trace
- Inner class could be static
- Insecure Bean Validation
- Interface cannot be implemented
- Iterable wrapping an iterator
- Iterator implementing Iterable
- Javadoc has impossible ‘throws’ tag
- LDAP query built from user-controlled sources
- Left shift by more than the type width
- Lines of code in files
- Lines of commented-out code in files
- Lines of comments in files
- Loop with unreachable exit condition
- Misleading indentation
- Missing Override annotation
- Missing catch of NumberFormatException
- Missing enum case in switch
- Missing format argument
- Missing space in string literal
- Missing super clone
- Multiplication of remainder
- Next in hasNext implementation
- No clone method
- Non-final method invocation in constructor
- Non-synchronized override of synchronized method
- Number of tests
- Overloaded compareTo
- Overloaded equals
- Possible confusion of local and field
- Potential database resource leak
- Potential input resource leak
- Potential output resource leak
- Query built from user-controlled sources
- Query built without neutralizing special characters
- Race condition in double-checked locking object initialization
- Race condition in socket authentication
- Random used only once
- ReadResolve must have Object return type, not void
- Reading from a world writable file
- Reference equality test of boxed types
- Reference equality test on strings
- Resolving XML external entity in user-controlled data
- Result of multiplication cast to wider type
- Self assignment
- Serializable but no void constructor
- Serializable inner class of non-serializable class
- Serialization methods do not match required signature
- Server-side request forgery
- Sleep with lock held
- Spin on field
- Spurious Javadoc @param tags
- Start of thread in constructor
- Subtle call to inherited method
- Suspicious date format
- Synchronization on boxed types or strings
- Thread-unsafe use of DateFormat
- Time-of-check time-of-use race condition
- Type bound extends a final class
- Type mismatch on container access
- Type mismatch on container modification
- Type variable hides another type
- Typo in equals
- Typo in hashCode
- Typo in toString
- URL redirection from remote source
- Uncontrolled command line
- Uncontrolled data in arithmetic expression
- Uncontrolled data used in path expression
- Underscore used as identifier
- Unreachable catch clause
- Unread local variable
- Unreleased lock
- Unsafe hostname verification
- Unsafe use of getResource
- Unused classes and interfaces
- Unused format argument
- Unused label
- Use of a broken or risky cryptographic algorithm
- Use of a potentially broken or risky cryptographic algorithm
- Use of a potentially dangerous function
- Use of a predictable seed in a secure random number generator
- Use of default toString()
- Use of externally-controlled format string
- Useless comparison test
- Useless null check
- Useless parameter
- Useless toString on String
- Useless type test
- User-controlled bypass of sensitive method
- User-controlled data in arithmetic expression
- User-controlled data in numeric cast
- User-controlled data used in permissions check
- Wait on condition
- Whitespace contradicts operator precedence
- Wrong NaN comparison
- XPath injection
- notify instead of notifyAll