Listen to this Post
GitHub has taken a major step forward in code security with the release of CodeQL 2.23.7 and 2.23.8, introducing new security-focused queries for Go and Rust. CodeQL, the static analysis engine powering GitHub’s Code Scanning and Code Quality tools, helps developers detect and remediate vulnerabilities before they reach production. These updates not only expand language-specific security coverage but also improve overall analysis accuracy and framework support across multiple languages, making it easier for teams to maintain secure and reliable codebases.
Key Updates in Go
The latest release introduces several new queries for Go developers:
go/cookie-secure-not-set: Identifies cookies that lack the Secure flag, which could expose sensitive information.
go/weak-crypto-algorithm: Detects the use of outdated or weak cryptographic algorithms that could compromise data security.
go/weak-sensitive-data-hashing: Flags weak hash algorithms used on sensitive data.
go/cookie-http-only-not-set: Promoted from experimental, this query detects cookies missing the HttpOnly flag, mitigating potential cross-site scripting (XSS) vulnerabilities. This contribution came from GitHub user @edvraa.
Key Updates in Rust
For Rust developers, CodeQL now includes:
rust/xss: Detects cross-site scripting vulnerabilities.
rust/disabled-certificate-check: Flags disabled TLS certificate checks, which could undermine secure connections.
Example queries: Three new examples (empty-if, simple-sql-injection, simple-constant-password) help developers learn to write effective Rust queries.
Expanded Language and Framework Support
Java/Kotlin
Maven builds now respect the project’s compiler settings instead of forcing –source and –target flags, improving compatibility.
Short string operations (≤7 characters) are now treated as sanitizers for the java/sensitive-log query.
JavaScript/TypeScript
Fixed a Next.js bug that previously missed server-side taint sources in the app/pages folder.
Rust
Improved the rust/access-invalid-pointer query with new flow sources and barriers.
C
Compilation errors are now captured in debug logs during buildless analysis.
Added a custom dependency directory option for buildless mode using -O buildless_dependency_dir=
Python
Fixed an import handling bug that raised KeyError in the Python extractor when a module wasn’t found, contributed by GitHub user @akoeplinger.
These updates ensure that every new CodeQL version is automatically deployed to GitHub Code Scanning and GitHub Code Quality users and will be included in GitHub Enterprise Server (GHES) 3.20. Older GHES versions can manually upgrade to benefit from these enhancements.
What Undercode Say:
The 2.23.7 and 2.23.8 releases of CodeQL highlight GitHub’s growing focus on preemptive security for developers, particularly in languages like Go and Rust, which are increasingly used in high-performance, security-sensitive applications. The addition of queries targeting cookies, cryptography, and hashing underscores the importance of addressing vulnerabilities at the application level rather than relying solely on infrastructure defenses. By detecting weak cryptographic algorithms and improper cookie flags, CodeQL ensures that sensitive user data remains protected against common attack vectors such as XSS and data interception.
Rust’s inclusion of certificate validation checks is particularly significant for environments that rely heavily on HTTPS and secure communications. Disabled TLS verification is a subtle but critical risk, and detecting this automatically can prevent a range of man-in-the-middle attacks. Moreover, the introduction of learning-focused example queries in Rust shows GitHub’s intention not just to secure codebases but also to educate developers on writing effective CodeQL queries. This has long-term implications for the developer community, fostering a culture of security-first programming.
The improvements in language-specific tooling, such as Maven compatibility for Java/Kotlin and Next.js fixes in JavaScript/TypeScript, reduce friction for developers integrating CodeQL into existing projects. This approach demonstrates GitHub’s commitment to seamless adoption of security tools rather than imposing strict configurations that could hinder productivity.
The Python extractor fix addresses a subtle source of runtime errors during static analysis. Even minor bugs in analysis tools can erode trust and reduce adoption, so community contributions, like those from @akoeplinger, play a vital role in improving reliability. Similarly, C buildless enhancements reflect GitHub’s awareness of varied development environments and the need for flexible, scalable analysis solutions.
Overall, these updates reflect a balance between proactive vulnerability detection, educational support for developers, and practical improvements in analysis accuracy. The layered security approach—covering application logic, cryptography, and secure communications—reinforces CodeQL as a critical tool for enterprise-grade code security.
Fact Checker Results:
✅ CodeQL 2.23.7 and 2.23.8 add multiple new security queries for Go and Rust.
✅ Updates improve analysis accuracy and framework support across several languages.
❌ No known issues have been reported with the new releases as of now.
Prediction:
With the addition of Go and Rust-specific security queries, we can expect wider adoption of CodeQL in high-security projects, particularly in fintech, healthcare, and cloud infrastructure. 🚀 Developers will increasingly rely on automated static analysis to catch subtle vulnerabilities early, reducing incident response costs. Future updates may expand this trend to more languages and frameworks, with GitHub likely focusing on AI-assisted query suggestions and smarter vulnerability prioritization. 🔐
🕵️📝✔️Let’s dive deep and fact‑check.
References:
Reported By: github.blog
Extra Source Hub (Possible Sources for article):
https://www.medium.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
Bing
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon
