docs/data/reusables/code-scanning/codeql-query-tables/python.md

{% rowheaders %}

Query name	Related CWEs	Default	Extended	{% data variables.copilot.copilot_autofix_short %}
'input' function used in Python 2	094, 095	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Accepting unknown SSH host keys when using Paramiko	295	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Bad HTML filtering regexp	116, 020, 185, 186	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Binding a socket to all network interfaces	200	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Clear-text logging of sensitive information	312, 359, 532	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Clear-text storage of sensitive information	312, 315, 359	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Code injection	094, 095, 116	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Construction of a cookie using user-supplied input	020	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
CSRF protection weakened or disabled	352	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Default version of SSL/TLS may be insecure	327	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Deserialization of user-controlled data	502	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Failure to use secure cookies	614	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Flask app is run in debug mode	215, 489	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Full server-side request forgery	918	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
HTTP Response Splitting	113, 079	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Incomplete regular expression for hostnames	020	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Incomplete URL substring sanitization	020	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Inefficient regular expression	1333, 730, 400	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "x" aria-label="Not included" %}
Information exposure through an exception	209, 497	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Insecure temporary file	377	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "x" aria-label="Not included" %}
LDAP query built from user-controlled sources	090	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
NoSQL Injection	943	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Overly permissive regular expression range	020	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "x" aria-label="Not included" %}
PAM authorization bypass due to incorrect usage	285	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Polynomial regular expression used on uncontrolled data	1333, 730, 400	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "x" aria-label="Not included" %}
Reflected server-side cross-site scripting	079, 116	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Regular expression injection	730, 400	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Sensitive cookie missing HttpOnly attribute	1004	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "x" aria-label="Not included" %}
Sensitive cookie with SameSite attribute set to None	1275	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "x" aria-label="Not included" %}
Server Side Template Injection	074	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
SQL query built from user-controlled sources	089	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Uncontrolled command line	078, 088	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Uncontrolled data used in path expression	022, 023, 036, 073, 099	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
URL redirection from remote source	601	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Use of a broken or weak cryptographic algorithm	327	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Use of a broken or weak cryptographic hashing algorithm on sensitive data	327, 328, 916	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Use of insecure SSL/TLS version	327	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Use of weak cryptographic key	326	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
XML external entity expansion	611, 827	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
XML internal entity expansion	776, 400	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
XPath query built from user-controlled sources	643	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Arbitrary file write during tarfile extraction	022	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Jinja2 templating with autoescape=False	079	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Log Injection	117	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Overly permissive file permissions	732	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Partial server-side request forgery	918	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Request without certificate validation	295	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Unsafe shell command constructed from library input	078, 088, 073	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}

{% endrowheaders %}