Python queries for CodeQL analysis

Explore the queries that CodeQL uses to analyze code written in Python when you select the default or the security-extended query suite.

CodeQL includes many queries for analyzing Python code. All queries in the default query suite are run by default. If you choose to use the security-extended query suite, additional queries are run. For more information, see CodeQL query suites.

Built-in queries for Python analysis

This table lists the queries available with the latest release of the CodeQL action and CodeQL CLI. For more information, see CodeQL change logs in the CodeQL documentation site.

Query name Related CWEs Default Extended Copilot Autofix
'input' function used in Python 2 094, 095
Accepting unknown SSH host keys when using Paramiko 295
Bad HTML filtering regexp 116, 020, 185, 186
Binding a socket to all network interfaces 200
Clear-text logging of sensitive information 312, 359, 532
Clear-text storage of sensitive information 312, 315, 359
Code injection 094, 095, 116
Construction of a cookie using user-supplied input 020
CSRF protection weakened or disabled 352
Default version of SSL/TLS may be insecure 327
Deserialization of user-controlled data 502
Failure to use secure cookies 614
Flask app is run in debug mode 215, 489
Full server-side request forgery 918
HTTP Response Splitting 113, 079
Incomplete regular expression for hostnames 020
Incomplete URL substring sanitization 020
Inefficient regular expression 1333, 730, 400
Information exposure through an exception 209, 497
Insecure temporary file 377
LDAP query built from user-controlled sources 090
NoSQL Injection 943
Overly permissive regular expression range 020
PAM authorization bypass due to incorrect usage 285
Polynomial regular expression used on uncontrolled data 1333, 730, 400
Reflected server-side cross-site scripting 079, 116
Regular expression injection 730, 400
Sensitive cookie missing HttpOnly attribute 1004
Sensitive cookie with SameSite attribute set to None 1275
Server Side Template Injection 074
SQL query built from user-controlled sources 089
Uncontrolled command line 078, 088
Uncontrolled data used in path expression 022, 023, 036, 073, 099
URL redirection from remote source 601
Use of a broken or weak cryptographic algorithm 327
Use of a broken or weak cryptographic hashing algorithm on sensitive data 327, 328, 916
Use of insecure SSL/TLS version 327
Use of weak cryptographic key 326
XML external entity expansion 611, 827
XML internal entity expansion 776, 400
XPath query built from user-controlled sources 643
Arbitrary file write during tarfile extraction 022
Jinja2 templating with autoescape=False 079
Log Injection 117
Overly permissive file permissions 732
Partial server-side request forgery 918
Request without certificate validation 295
Unsafe shell command constructed from library input 078, 088, 073