Merge pull request #15720 from RasmusWL/nosql-precision

Python: Add precision to NoSQL query
github · Mar 4, 2024 · 00e77a3 · 00e77a3
2 parents 569bb99 + fbf6727
commit 00e77a3
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 0 deletions.
diff --git a/python/ql/src/Security/CWE-943/NoSqlInjection.ql b/python/ql/src/Security/CWE-943/NoSqlInjection.ql
@@ -3,6 +3,7 @@
  * @description Building a NoSQL query from user-controlled sources is vulnerable to insertion of
  *              malicious NoSQL code by the user.
  * @kind path-problem
+ * @precision high
  * @problem.severity error
  * @security-severity 8.8
  * @id py/nosql-injection

diff --git a/python/ql/src/change-notes/2024-03-04-nosql-injection.md b/python/ql/src/change-notes/2024-03-04-nosql-injection.md
@@ -0,0 +1,4 @@
+---
+category: newQuery
+---
+* The query `py/nosql-injection` for finding NoSQL injection vulnerabilities is now part of the default security suite.