Запросы go для анализа CodeQL

Изучите запросы, которые CodeQL используются для анализа кода, написанного в Go (Golang) при выборе default security-extended или наборе запросов.

Кто эту функцию можно использовать?

Code scanning доступен для всех общедоступных репозиториев на GitHub.com. Code scanning также доступен для частных репозиториев, принадлежащих организациям, использующей GitHub Enterprise Cloud и имеющих лицензию на GitHub Advanced Security. Дополнительные сведения см. в разделе Сведения о GitHub Advanced Security.

CodeQL includes many queries for analyzing Go code. All queries in the default query suite are run by default. If you choose to use the security-extended query suite, additional queries are run. For more information, see "CodeQL query suites."

Built-in queries for Go analysis

This table lists the queries available with the latest release of the CodeQL action and CodeQL CLI. For more information, see CodeQL change logs in the CodeQL documentation site.

Note: GitHub autofix for code scanning is in beta. Functionality and documentation are subject to change. During this phase, the feature is restricted to JavaScript, TypeScript, Python, and Java alerts identified by CodeQL. If you have an enterprise account and use GitHub Advanced Security, your enterprise has access to the beta.

Query nameRelated CWEsDefaultExtended
Arbitrary file access during archive extraction ("Zip Slip")022
Arbitrary file write extracting an archive containing symbolic links022
Bad redirect check601
Clear-text logging of sensitive information312, 315, 359
Command built from user-controlled sources078
Database query built from user-controlled sources089
Disabled TLS certificate check295
Email content injection640
Incomplete regular expression for hostnames20
Incomplete URL scheme check020
Incorrect conversion between integer types190, 681
Information exposure through a stack trace209, 497
Insecure TLS configuration327
Missing JWT signature check347
Missing regular expression anchor20
Open URL redirect601
Potentially unsafe quoting078, 089, 094
Reflected cross-site scripting079, 116
Size computation for allocation may overflow190
Slice memory allocation with excessive size value770
Suspicious characters in a regular expression20
Uncontrolled data used in network request918
Uncontrolled data used in path expression022, 023, 036, 073, 099
Use of a weak cryptographic key326
Use of constant state value in OAuth 2.0 URL352
Use of insecure HostKeyCallback implementation322
Use of insufficient randomness as the key of a cryptographic algorithm338
XPath injection643
Hard-coded credentials259, 321, 798
Log entries created from user input117