github · jketema · Nov 26, 2025 · Nov 26, 2025 · Nov 26, 2025
@@ -1,5 +1,5 @@
 /**
- * @name Artifact Poisoning (Path Traversal).
+ * @name Artifact Poisoning (Path Traversal)
  * @description An attacker may be able to poison the workflow's artifacts and influence on consequent steps.
  * @kind problem
  * @problem.severity error

@@ -1,5 +1,5 @@
 /**
- * @name Dangerous use convert function.
+ * @name Dangerous use convert function
  * @description Using convert function with an invalid length argument can result in an out-of-bounds access error or unexpected result.
  * @kind problem
  * @id cpp/dangerous-use-convert-function

@@ -1,5 +1,5 @@
 /**
- * @name Dangerous use of transformation after operation.
+ * @name Dangerous use of transformation after operation
  * @description By using the transformation after the operation, you are doing a pointless and dangerous action.
  * @kind problem
  * @id cpp/dangerous-use-of-transformation-after-operation

@@ -1,5 +1,5 @@
 /**
- * @name Writing to a file without setting permissions.
+ * @name Writing to a file without setting permissions
  * @description Lack of restriction on file access rights can be unsafe.
  * @kind problem
  * @id cpp/work-with-file-without-permissions-rights

@@ -1,5 +1,5 @@
 /**
- * @name Find work with changing working directories, with security errors.
+ * @name Find work with changing working directories, with security errors
  * @description Not validating the return value or pinning the directory can be unsafe.
  * @kind problem
  * @id cpp/work-with-changing-working-directories

@@ -1,5 +1,5 @@
 /**
- * @name Find the wrong use of the umask function.
+ * @name Find the wrong use of the umask function
  * @description Incorrectly evaluated argument to the umask function may have security implications.
  * @kind problem
  * @id cpp/wrong-use-of-the-umask

@@ -1,5 +1,5 @@
 /**
- * @name Insecure generation of filenames.
+ * @name Insecure generation of filenames
  * @description Using a predictable filename when creating a temporary file can lead to an attacker-controlled input.
  * @kind problem
  * @id cpp/insecure-generation-of-filename

@@ -1,5 +1,5 @@
 /**
- * @name Dangerous use of exception blocks.
+ * @name Dangerous use of exception blocks
  * @description When clearing the data in the catch block, you must be sure that the memory was allocated before the exception.
  * @kind problem
  * @id cpp/dangerous-use-of-exception-blocks

@@ -1,5 +1,5 @@
 /**
- * @name Dangerous use SSL_shutdown.
+ * @name Dangerous use SSL_shutdown
  * @description Incorrect closing of the connection leads to the creation of different states for the server and client, which can be exploited by an attacker.
  * @kind problem
  * @id cpp/dangerous-use-of-ssl-shutdown

@@ -1,5 +1,5 @@
 /**
- * @name Capture content based summary models.
+ * @name Capture content based summary models
  * @description Finds applicable content based summary models to be used by other queries.
  * @kind diagnostic
  * @id cpp/utils/modelgenerator/contentbased-summary-models

@@ -1,5 +1,5 @@
 /**
- * @name Capture neutral models.
+ * @name Capture neutral models
  * @description Finds neutral models to be used by other queries.
  * @kind diagnostic
  * @id cpp/utils/modelgenerator/neutral-models

@@ -1,5 +1,5 @@
 /**
- * @name Capture sink models.
+ * @name Capture sink models
  * @description Finds public methods that act as sinks as they flow into a known sink.
  * @kind diagnostic
  * @id cpp/utils/modelgenerator/sink-models

@@ -1,5 +1,5 @@
 /**
- * @name Capture source models.
+ * @name Capture source models
  * @description Finds APIs that act as sources as they expose already known sources.
  * @kind diagnostic
  * @id cpp/utils/modelgenerator/source-models

@@ -1,5 +1,5 @@
 /**
- * @name Capture summary models.
+ * @name Capture summary models
  * @description Finds applicable summary models to be used by other queries.
  * @kind diagnostic
  * @id cpp/utils/modelgenerator/summary-models

@@ -1,5 +1,5 @@
 /**
- * @name Container size compared to zero.
+ * @name Container size compared to zero
  * @description Comparing the size of a container to zero with this operator will always return the same value.
  * @kind problem
  * @problem.severity warning

@@ -1,5 +1,5 @@
 /**
- * @name Do not add certificates to the system root store.
+ * @name Do not add certificates to the system root store
  * @description Application- or user-specific certificates placed in the system root store could
  *              weaken security for other processing running on the same system.
  * @kind path-problem

@@ -1,5 +1,5 @@
 /**
- * @name Unsafe usage of v1 version of Azure Storage client-side encryption (CVE-2022-30187).
+ * @name Unsafe usage of v1 version of Azure Storage client-side encryption (CVE-2022-30187)
  * @description Unsafe usage of v1 version of Azure Storage client-side encryption, please refer to http://aka.ms/azstorageclientencryptionblog
  * @kind problem
  * @tags security

@@ -1,5 +1,5 @@
 /**
- * @name Extract MaD neutral model rows.
+ * @name Extract MaD neutral model rows
  * @description This extracts the Models as data neutral model rows.
  * @id cs/utils/modelconverter/generate-data-extensions-neutral
  */

@@ -1,5 +1,5 @@
 /**
- * @name Extract MaD sink model rows.
+ * @name Extract MaD sink model rows
  * @description This extracts the Models as data sink model rows.
  * @id cs/utils/modelconverter/generate-data-extensions-sink
  */

@@ -1,5 +1,5 @@
 /**
- * @name Extract MaD source model rows.
+ * @name Extract MaD source model rows
  * @description This extracts the Models as data source model rows.
  * @id cs/utils/modelconverter/generate-data-extensions-source
  */

@@ -1,5 +1,5 @@
 /**
- * @name Extract MaD summary model rows.
+ * @name Extract MaD summary model rows
  * @description This extracts the Models as data summary model rows.
  * @id cs/utils/modelconverter/generate-data-extensions-summary
  */

@@ -1,5 +1,5 @@
 /**
- * @name Capture content based summary models.
+ * @name Capture content based summary models
  * @description Finds applicable content based summary models to be used by other queries.
  * @kind diagnostic
  * @id cs/utils/modelgenerator/contentbased-summary-models

@@ -1,5 +1,5 @@
 /**
- * @name Capture neutral models.
+ * @name Capture neutral models
  * @description Finds neutral models to be used by other queries.
  * @kind diagnostic
  * @id cs/utils/modelgenerator/neutral-models

@@ -1,5 +1,5 @@
 /**
- * @name Capture sink models.
+ * @name Capture sink models
  * @description Finds public methods that act as sinks as they flow into a known sink.
  * @kind diagnostic
  * @id cs/utils/modelgenerator/sink-models

@@ -1,5 +1,5 @@
 /**
- * @name Capture source models.
+ * @name Capture source models
  * @description Finds APIs that act as sources as they expose already known sources.
  * @kind diagnostic
  * @id cs/utils/modelgenerator/source-models

@@ -1,5 +1,5 @@
 /**
- * @name Capture summary models.
+ * @name Capture summary models
  * @description Finds applicable summary models to be used by other queries.
  * @kind diagnostic
  * @id cs/utils/modelgenerator/summary-models

@@ -1,5 +1,5 @@
 /**
- * @name Capture typed based summary models.
+ * @name Capture typed based summary models
  * @description Finds applicable summary models to be used by other queries.
  * @kind diagnostic
  * @id cs/utils/modelgenerator/summary-models-typed-based

@@ -1,5 +1,5 @@
 /**
- * @name Tests call graph.
+ * @name Tests call graph
  */
 
 import csharp

@@ -1,5 +1,5 @@
 /**
- * @name Test the implicit switch field isn't populated.
+ * @name Test the implicit switch field isn't populated
  */
 
 import csharp

@@ -1,5 +1,5 @@
 /**
- * @name Unsafe usage of v1 version of Azure Storage client-side encryption (CVE-2022-30187).
+ * @name Unsafe usage of v1 version of Azure Storage client-side encryption (CVE-2022-30187)
  * @description Unsafe usage of v1 version of Azure Storage client-side encryption, please refer to http://aka.ms/azstorageclientencryptionblog
  * @kind problem
  * @tags security

@@ -1,5 +1,5 @@
 /**
- * @name Unsafe deserialization in a remotely callable method.
+ * @name Unsafe deserialization in a remotely callable method
  * @description If a registered remote object has a method that accepts a complex object,
  *              an attacker can take advantage of the unsafe deserialization mechanism
  *              which is used to pass parameters in RMI.

@@ -1,5 +1,5 @@
 /**
- * @name Unsafe deserialization with Spring's remote service exporters.
+ * @name Unsafe deserialization with Spring's remote service exporters
  * @description A Spring bean, which is based on RemoteInvocationSerializingExporter,
  *              initializes an endpoint that uses ObjectInputStream to deserialize
  *              incoming data. In the worst case, that may lead to remote code execution.

@@ -1,5 +1,5 @@
 /**
- * @name Unsafe deserialization with Spring's remote service exporters.
+ * @name Unsafe deserialization with Spring's remote service exporters
  * @description A Spring bean, which is based on RemoteInvocationSerializingExporter,
  *              initializes an endpoint that uses ObjectInputStream to deserialize
  *              incoming data. In the worst case, that may lead to remote code execution.

@@ -1,5 +1,5 @@
 /**
- * @name Extract MaD neutral model rows.
+ * @name Extract MaD neutral model rows
  * @description This extracts the Models as data neutral model rows.
  * @id java/utils/modelconverter/generate-data-extensions-neutral
  */

@@ -1,5 +1,5 @@
 /**
- * @name Extract MaD sink model rows.
+ * @name Extract MaD sink model rows
  * @description This extracts the Models as data sink model rows.
  * @id java/utils/modelconverter/generate-data-extensions-sink
  */

@@ -1,5 +1,5 @@
 /**
- * @name Extract MaD source model rows.
+ * @name Extract MaD source model rows
  * @description This extracts the Models as data source model rows.
  * @id java/utils/modelconverter/generate-data-extensions-source
  */

@@ -1,5 +1,5 @@
 /**
- * @name Extract MaD summary model rows.
+ * @name Extract MaD summary model rows
  * @description This extracts the Models as data summary model rows.
  * @id java/utils/modelconverter/generate-data-extensions-summary
  */

@@ -1,5 +1,5 @@
 /**
- * @name Capture content based summary models.
+ * @name Capture content based summary models
  * @description Finds applicable content based summary models to be used by other queries.
  * @kind diagnostic
  * @id java/utils/modelgenerator/contentbased-summary-models

@@ -1,5 +1,5 @@
 /**
- * @name Capture neutral models.
+ * @name Capture neutral models
  * @description Finds neutral models to be used by other queries.
  * @kind diagnostic
  * @id java/utils/modelgenerator/neutral-models

@@ -1,5 +1,5 @@
 /**
- * @name Capture sink models.
+ * @name Capture sink models
  * @description Finds public methods that act as sinks as they flow into a known sink.
  * @kind diagnostic
  * @id java/utils/modelgenerator/sink-models

@@ -1,5 +1,5 @@
 /**
- * @name Capture source models.
+ * @name Capture source models
  * @description Finds APIs that act as sources as they expose already known sources.
  * @kind diagnostic
  * @id java/utils/modelgenerator/source-models

@@ -1,5 +1,5 @@
 /**
- * @name Capture summary models.
+ * @name Capture summary models
  * @description Finds applicable summary models to be used by other queries.
  * @kind diagnostic
  * @id java/utils/modelgenerator/summary-models

@@ -1,5 +1,5 @@
 /**
- * @name Capture typed based summary models.
+ * @name Capture typed based summary models
  * @description Finds applicable summary models to be used by other queries.
  * @kind diagnostic
  * @id java/utils/modelgenerator/summary-models-typed-based

@@ -1,5 +1,5 @@
 /**
- * @name Mutation of descriptor in `__get__` or `__set__` method.
+ * @name Mutation of descriptor in `__get__` or `__set__` method
  * @description Descriptor objects can be shared across many instances. Mutating them can cause strange side effects or race conditions.
  * @kind problem
  * @tags quality

@@ -1,5 +1,5 @@
 /**
- * @name Sensitive cookie missing `HttpOnly` attribute.
+ * @name Sensitive cookie missing `HttpOnly` attribute
  * @description Cookies without the `HttpOnly` attribute set can be accessed by JS scripts, making them more vulnerable to XSS attacks.
  * @kind problem
  * @problem.severity warning

@@ -1,5 +1,5 @@
 /**
- * @name Sensitive cookie with `SameSite` attribute set to `None`.
+ * @name Sensitive cookie with `SameSite` attribute set to `None`
  * @description Cookies with `SameSite` set to `None` can allow for Cross-Site Request Forgery (CSRF) attacks.
  * @kind problem
  * @problem.severity warning

@@ -1,5 +1,5 @@
 /**
- * @name Use of the 'global' statement.
+ * @name Use of the 'global' statement
  * @description Use of the 'global' statement may indicate poor modularity.
  * @kind problem
  * @problem.severity recommendation

@@ -1,5 +1,5 @@
 /**
- * @name Key points-to fails for expression.
+ * @name Key points-to fails for expression
  * @description Expression does not "point-to" an object which prevents further points-to analysis.
  * @kind problem
  * @problem.severity info

@@ -1,5 +1,5 @@
 /**
- * @name points-to fails for expression.
+ * @name points-to fails for expression
  * @description Expression does not "point-to" an object which prevents type inference.
  * @kind problem
  * @id py/points-to-failure

@@ -1,5 +1,5 @@
 /**
- * @name JavaScript code execution.
+ * @name JavaScript code execution
  * @description Passing user supplied arguments to a Javascript to Python translation engine such as Js2Py can lead to remote code execution.
  * @problem.severity error
  * @security-severity 9.3

@@ -1,5 +1,5 @@
 /**
- * @name Unsafe usage of v1 version of Azure Storage client-side encryption.
+ * @name Unsafe usage of v1 version of Azure Storage client-side encryption
  * @description Using version v1 of Azure Storage client-side encryption is insecure, and may enable an attacker to decrypt encrypted data
  * @kind path-problem
  * @tags security

@@ -1,5 +1,5 @@
 /**
- * @name Weak KDF algorithm.
+ * @name Weak KDF algorithm
  * @description Approved KDF algorithms must one of the following
  *  ["PBKDF2" , "PBKDF2HMAC", "KBKDF", "KBKDFHMAC", "CONCATKDF", "CONCATKDFHASH"]
  * @assumption The value being used to derive a key (either a key or a password) is correct for the algorithm (i.e., a key is used for KBKDF and a password for PBKDF).

@@ -1,5 +1,5 @@
 /**
- * @name Small KDF derived key length.
+ * @name Small KDF derived key length
  * @description KDF derived keys should be a minimum of 128 bits (16 bytes).
  * @assumption If the key length is not explicitly provided (e.g., it is None or otherwise not specified) assumes the length is derived from the hash length.
  * @kind problem

@@ -1,5 +1,5 @@
 /**
- * @name Weak KDF salt generation.
+ * @name Weak KDF salt generation
  * @description KDF salts must be generated by an approved random number generator (os.urandom)
  * @kind problem
  * @id py/kdf-weak-salt-gen

@@ -1,5 +1,5 @@
 /**
- * @name Small KDF salt length.
+ * @name Small KDF salt length
  * @description KDF salts should be a minimum of 128 bits (16 bytes).
  *
  * This alerts if a constant traces to to a salt length sink less than 128-bits or

@@ -1,5 +1,5 @@
 /**
- * @name Don't use getAQlClass.
+ * @name Don't use getAQlClass
  * @description Any use of getAQlClass causes both compile-time and runtime to be significantly slower.
  * @kind problem
  * @problem.severity warning

@@ -1,5 +1,5 @@
 /**
- * @name Var only used in one side of disjunct.
+ * @name Var only used in one side of disjunct
  * @description Only using a variable on one side of a disjunction can cause a cartesian product.
  * @kind problem
  * @problem.severity warning