{"meta":{"title":"Запросы Java и Kotlin для анализа CodeQL","intro":"Изучите запросы, которые CodeQL используются для анализа кода, написанного на Java или Kotlin при выборе default или security-extended наборе запросов.","product":"Безопасность и качество кода","breadcrumbs":[{"href":"/ru/code-security","title":"Безопасность и качество кода"},{"href":"/ru/code-security/reference","title":"Reference"},{"href":"/ru/code-security/reference/code-scanning","title":"Проверка кода"},{"href":"/ru/code-security/reference/code-scanning/codeql","title":"CodeQL"},{"href":"/ru/code-security/reference/code-scanning/codeql/codeql-queries","title":"Встроенные запросы CodeQL"},{"href":"/ru/code-security/reference/code-scanning/codeql/codeql-queries/java-kotlin-built-in-queries","title":"Запросы к Java и Kotlin"}],"documentType":"article"},"body":"# Запросы Java и Kotlin для анализа CodeQL\n\nИзучите запросы, которые CodeQL используются для анализа кода, написанного на Java или Kotlin при выборе default или security-extended наборе запросов.\n\n\nCodeQL includes many queries for analyzing Java and Kotlin code. All queries in the `default` query suite are run by default. If you choose to use the `security-extended` query suite, additional queries are run. For more information, see [CodeQL query suites](/en/code-security/code-scanning/managing-your-code-scanning-configuration/built-in-codeql-query-suites).\n\n## Built-in queries for Java and Kotlin analysis\n\nThis table lists the queries available with the latest release of the CodeQL action and CodeQL CLI. For more information, see [CodeQL change logs](https://codeql.github.com/docs/codeql-overview/codeql-changelog/) in the CodeQL documentation site.\n\n

\n\n| Query name | Related CWEs | Default | Extended | Copilot Autofix |\n| -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| [`TrustManager` that accepts all certificates](https://codeql.github.com/codeql-query-help/java/java-insecure-trustmanager/) | 295 | | | |\n| [Android `WebView` that accepts all certificates](https://codeql.github.com/codeql-query-help/java/java-improper-webview-certificate-validation/) | 295 | | | |\n| [Android debuggable attribute enabled](https://codeql.github.com/codeql-query-help/java/java-android-debuggable-attribute-enabled/) | 489 | | | |\n| [Android fragment injection](https://codeql.github.com/codeql-query-help/java/java-android-fragment-injection/) | 470 | | | |\n| [Android fragment injection in PreferenceActivity](https://codeql.github.com/codeql-query-help/java/java-android-fragment-injection-preference-activity/) | 470 | | | |\n| [Android Intent redirection](https://codeql.github.com/codeql-query-help/java/java-android-intent-redirection/) | 926, 940 | | | |\n| [Android Webview debugging enabled](https://codeql.github.com/codeql-query-help/java/java-android-webview-debugging-enabled/) | 489 | | | |\n| [Arbitrary file access during archive extraction (\"Zip Slip\")](https://codeql.github.com/codeql-query-help/java/java-zipslip/) | 022 | | | |\n| [Cleartext storage of sensitive information in cookie](https://codeql.github.com/codeql-query-help/java/java-cleartext-storage-in-cookie/) | 315 | | | |\n| [Cross-site scripting](https://codeql.github.com/codeql-query-help/java/java-xss/) | 079 | | | |\n| [Depending upon JCenter/Bintray as an artifact repository](https://codeql.github.com/codeql-query-help/java/java-maven-dependency-upon-bintray/) | 1104 | | | |\n| [Deserialization of user-controlled data](https://codeql.github.com/codeql-query-help/java/java-unsafe-deserialization/) | 502 | | | |\n| [Detect JHipster Generator Vulnerability CVE-2019-16303](https://codeql.github.com/codeql-query-help/java/java-jhipster-prng/) | 338 | | | |\n| [Disabled Netty HTTP header validation](https://codeql.github.com/codeql-query-help/java/java-netty-http-request-or-response-splitting/) | 093, 113 | | | |\n| [Disabled Spring CSRF protection](https://codeql.github.com/codeql-query-help/java/java-spring-disabled-csrf-protection/) | 352 | | | |\n| [Exposed Spring Boot actuators](https://codeql.github.com/codeql-query-help/java/java-spring-boot-exposed-actuators/) | 200 | | | |\n| [Exposed Spring Boot actuators in configuration file](https://codeql.github.com/codeql-query-help/java/java-spring-boot-exposed-actuators-config/) | 200 | | | |\n| [Expression language injection (JEXL)](https://codeql.github.com/codeql-query-help/java/java-jexl-expression-injection/) | 094 | | | |\n| [Expression language injection (MVEL)](https://codeql.github.com/codeql-query-help/java/java-mvel-expression-injection/) | 094 | | | |\n| [Expression language injection (Spring)](https://codeql.github.com/codeql-query-help/java/java-spel-expression-injection/) | 094 | | | |\n| [Failure to use HTTPS or SFTP URL in Maven artifact upload/download](https://codeql.github.com/codeql-query-help/java/java-maven-non-https-url/) | 300, 319, 494, 829 | | | |\n| [Failure to use secure cookies](https://codeql.github.com/codeql-query-help/java/java-insecure-cookie/) | 614 | | | |\n| [Groovy Language injection](https://codeql.github.com/codeql-query-help/java/java-groovy-injection/) | 094 | | | |\n| [HTTP response splitting](https://codeql.github.com/codeql-query-help/java/java-http-response-splitting/) | 113 | | | |\n| [Implicit narrowing conversion in compound assignment](https://codeql.github.com/codeql-query-help/java/java-implicit-cast-in-compound-assignment/) | 190, 192, 197, 681 | | | |\n| [Implicitly exported Android component](https://codeql.github.com/codeql-query-help/java/java-android-implicitly-exported-component/) | 926 | | | |\n| [Improper verification of intent by broadcast receiver](https://codeql.github.com/codeql-query-help/java/java-improper-intent-verification/) | 925 | | | |\n| [Inefficient regular expression](https://codeql.github.com/codeql-query-help/java/java-redos/) | 1333, 730, 400 | | | |\n| [Information exposure through a stack trace](https://codeql.github.com/codeql-query-help/java/java-stack-trace-exposure/) | 209, 497 | | | |\n| [Information exposure through an error message](https://codeql.github.com/codeql-query-help/java/java-error-message-exposure/) | 209 | | | |\n| [Insecure Bean Validation](https://codeql.github.com/codeql-query-help/java/java-insecure-bean-validation/) | 094 | | | |\n| [Insecure LDAP authentication](https://codeql.github.com/codeql-query-help/java/java-insecure-ldap-auth/) | 522, 319 | | | |\n| [Insecure local authentication](https://codeql.github.com/codeql-query-help/java/java-android-insecure-local-authentication/) | 287 | | | |\n| [Insecure randomness](https://codeql.github.com/codeql-query-help/java/java-insecure-randomness/) | 330, 338 | | | |\n| [Intent URI permission manipulation](https://codeql.github.com/codeql-query-help/java/java-android-intent-uri-permission-manipulation/) | 266, 926 | | | |\n| [JNDI lookup with user-controlled name](https://codeql.github.com/codeql-query-help/java/java-jndi-injection/) | 074 | | | |\n| [LDAP query built from user-controlled sources](https://codeql.github.com/codeql-query-help/java/java-ldap-injection/) | 090 | | | |\n| [Missing JWT signature check](https://codeql.github.com/codeql-query-help/java/java-missing-jwt-signature-check/) | 347 | | | |\n| [OGNL Expression Language statement with user-controlled input](https://codeql.github.com/codeql-query-help/java/java-ognl-injection/) | 917 | | | |\n| [Overly permissive regular expression range](https://codeql.github.com/codeql-query-help/java/java-overly-large-range/) | 020 | | | |\n| [Partial path traversal vulnerability from remote](https://codeql.github.com/codeql-query-help/java/java-partial-path-traversal-from-remote/) | 023 | | | |\n| [Polynomial regular expression used on uncontrolled data](https://codeql.github.com/codeql-query-help/java/java-polynomial-redos/) | 1333, 730, 400 | | | |\n| [Query built from user-controlled sources](https://codeql.github.com/codeql-query-help/java/java-sql-injection/) | 089, 564 | | | |\n| [Reading from a world writable file](https://codeql.github.com/codeql-query-help/java/java-world-writable-file-read/) | 732 | | | |\n| [Regular expression injection](https://codeql.github.com/codeql-query-help/java/java-regex-injection/) | 730, 400 | | | |\n| [Resolving XML external entity in user-controlled data](https://codeql.github.com/codeql-query-help/java/java-xxe/) | 611, 776, 827 | | | |\n| [Sensitive cookies without the HttpOnly response header set](https://codeql.github.com/codeql-query-help/java/java-sensitive-cookie-not-httponly/) | 1004 | | | |\n| [Server-side request forgery](https://codeql.github.com/codeql-query-help/java/java-ssrf/) | 918 | | | |\n| [Server-side template injection](https://codeql.github.com/codeql-query-help/java/java-server-side-template-injection/) | 1336, 094 | | | |\n| [Uncontrolled command line](https://codeql.github.com/codeql-query-help/java/java-command-line-injection/) | 078, 088 | | | |\n| [Uncontrolled data used in content resolution](https://codeql.github.com/codeql-query-help/java/java-android-unsafe-content-uri-resolution/) | 441, 610 | | | |\n| [Uncontrolled data used in path expression](https://codeql.github.com/codeql-query-help/java/java-path-injection/) | 022, 023, 036, 073 | | | |\n| [Unsafe hostname verification](https://codeql.github.com/codeql-query-help/java/java-unsafe-hostname-verification/) | 297 | | | |\n| [URL forward from a remote source](https://codeql.github.com/codeql-query-help/java/java-unvalidated-url-forward/) | 552 | | | |\n| [URL redirection from remote source](https://codeql.github.com/codeql-query-help/java/java-unvalidated-url-redirection/) | 601 | | | |\n| [Use of a broken or risky cryptographic algorithm](https://codeql.github.com/codeql-query-help/java/java-weak-cryptographic-algorithm/) | 327, 328 | | | |\n| [Use of a cryptographic algorithm with insufficient key size](https://codeql.github.com/codeql-query-help/java/java-insufficient-key-size/) | 326 | | | |\n| [Use of a predictable seed in a secure random number generator](https://codeql.github.com/codeql-query-help/java/java-predictable-seed/) | 335, 337 | | | |\n| [Use of externally-controlled format string](https://codeql.github.com/codeql-query-help/java/java-tainted-format-string/) | 134 | | | |\n| [Use of implicit PendingIntents](https://codeql.github.com/codeql-query-help/java/java-android-implicit-pendingintents/) | 927 | | | |\n| [Use of RSA algorithm without OAEP](https://codeql.github.com/codeql-query-help/java/java-rsa-without-oaep/) | 780 | | | |\n| [User-controlled data in numeric cast](https://codeql.github.com/codeql-query-help/java/java-tainted-numeric-cast/) | 197, 681 | | | |\n| [User-controlled data used in permissions check](https://codeql.github.com/codeql-query-help/java/java-tainted-permissions-check/) | 807, 290 | | | |\n| [Using a static initialization vector for encryption](https://codeql.github.com/codeql-query-help/java/java-static-initialization-vector/) | 329, 1204 | | | |\n| [XPath injection](https://codeql.github.com/codeql-query-help/java/java-xml-xpath-injection/) | 643 | | | |\n| [XSLT transformation with user-controlled stylesheet](https://codeql.github.com/codeql-query-help/java/java-xslt-injection/) | 074 | | | |\n| [Access Java object methods through JavaScript exposure](https://codeql.github.com/codeql-query-help/java/java-android-webview-addjavascriptinterface/) | 079 | | | |\n| [Android APK installation](https://codeql.github.com/codeql-query-help/java/java-android-arbitrary-apk-installation/) | 094 | | | |\n| [Android missing certificate pinning](https://codeql.github.com/codeql-query-help/java/java-android-missing-certificate-pinning/) | 295 | | | |\n| [Android sensitive keyboard cache](https://codeql.github.com/codeql-query-help/java/java-android-sensitive-keyboard-cache/) | 524 | | | |\n| [Android WebSettings file access](https://codeql.github.com/codeql-query-help/java/java-android-websettings-file-access/) | 200 | | | |\n| [Android WebView JavaScript settings](https://codeql.github.com/codeql-query-help/java/java-android-websettings-javascript-enabled/) | 079 | | | |\n| [Android WebView settings allows access to content links](https://codeql.github.com/codeql-query-help/java/java-android-websettings-allow-content-access/) | 200 | | | |\n| [Application backup allowed](https://codeql.github.com/codeql-query-help/java/java-android-backup-enabled/) | 312 | | | |\n| [Building a command line with string concatenation](https://codeql.github.com/codeql-query-help/java/java-concatenated-command-line/) | 078, 088 | | | |\n| [Building a command with an injected environment variable](https://codeql.github.com/codeql-query-help/java/java-exec-tainted-environment/) | 078, 088, 454 | | | |\n| [Cleartext storage of sensitive information in the Android filesystem](https://codeql.github.com/codeql-query-help/java/java-android-cleartext-storage-filesystem/) | 312 | | | |\n| [Cleartext storage of sensitive information using 'Properties' class](https://codeql.github.com/codeql-query-help/java/java-cleartext-storage-in-properties/) | 313 | | | |\n| [Cleartext storage of sensitive information using `SharedPreferences` on Android](https://codeql.github.com/codeql-query-help/java/java-android-cleartext-storage-shared-prefs/) | 312 | | | |\n| [Cleartext storage of sensitive information using a local database on Android](https://codeql.github.com/codeql-query-help/java/java-android-cleartext-storage-database/) | 312 | | | |\n| [Comparison of narrow type with wide type in loop condition](https://codeql.github.com/codeql-query-help/java/java-comparison-with-wider-type/) | 190, 197 | | | |\n| [Executing a command with a relative path](https://codeql.github.com/codeql-query-help/java/java-relative-path-command/) | 078, 088 | | | |\n| [Exposure of sensitive information to notifications](https://codeql.github.com/codeql-query-help/java/java-android-sensitive-notification/) | 200 | | | |\n| [Exposure of sensitive information to UI text views](https://codeql.github.com/codeql-query-help/java/java-android-sensitive-text/) | 200 | | | |\n| [HTTP request type unprotected from CSRF](https://codeql.github.com/codeql-query-help/java/java-csrf-unprotected-request-type/) | 352 | | | |\n| [Improper validation of user-provided array index](https://codeql.github.com/codeql-query-help/java/java-improper-validation-of-array-index/) | 129 | | | |\n| [Improper validation of user-provided size used for array construction](https://codeql.github.com/codeql-query-help/java/java-improper-validation-of-array-construction/) | 129 | | | |\n| [Insecure basic authentication](https://codeql.github.com/codeql-query-help/java/java-insecure-basic-auth/) | 522, 319 | | | |\n| [Insecure JavaMail SSL Configuration](https://codeql.github.com/codeql-query-help/java/java-insecure-smtp-ssl/) | 297 | | | |\n| [Insecurely generated keys for local authentication](https://codeql.github.com/codeql-query-help/java/java-android-insecure-local-key-gen/) | 287 | | | |\n| [Insertion of sensitive information into log files](https://codeql.github.com/codeql-query-help/java/java-sensitive-log/) | 532 | | | |\n| [Leaking sensitive information through a ResultReceiver](https://codeql.github.com/codeql-query-help/java/java-android-sensitive-result-receiver/) | 927 | | | |\n| [Leaking sensitive information through an implicit Intent](https://codeql.github.com/codeql-query-help/java/java-android-sensitive-communication/) | 927 | | | |\n| [Local information disclosure in a temporary directory](https://codeql.github.com/codeql-query-help/java/java-local-temp-file-or-directory-information-disclosure/) | 200, 732 | | | |\n| [Log Injection](https://codeql.github.com/codeql-query-help/java/java-log-injection/) | 117 | | | |\n| [Loop with unreachable exit condition](https://codeql.github.com/codeql-query-help/java/java-unreachable-exit-in-loop/) | 835 | | | |\n| [Missing read or write permission in a content provider](https://codeql.github.com/codeql-query-help/java/java-android-incomplete-provider-permissions/) | 926 | | | |\n| [Partial path traversal vulnerability](https://codeql.github.com/codeql-query-help/java/java-partial-path-traversal/) | 023 | | | |\n| [Query built by concatenation with a possibly-untrusted string](https://codeql.github.com/codeql-query-help/java/java-concatenated-sql-query/) | 089, 564 | | | |\n| [Race condition in socket authentication](https://codeql.github.com/codeql-query-help/java/java-socket-auth-race-condition/) | 421 | | | |\n| [Time-of-check time-of-use race condition](https://codeql.github.com/codeql-query-help/java/java-toctou-race-condition/) | 367 | | | |\n| [Trust boundary violation](https://codeql.github.com/codeql-query-help/java/java-trust-boundary-violation/) | 501 | | | |\n| [Uncontrolled data in arithmetic expression](https://codeql.github.com/codeql-query-help/java/java-uncontrolled-arithmetic/) | 190, 191 | | | |\n| [Unreleased lock](https://codeql.github.com/codeql-query-help/java/java-unreleased-lock/) | 764, 833 | | | |\n| [Unsafe certificate trust](https://codeql.github.com/codeql-query-help/java/java-unsafe-cert-trust/) | 273 | | | |\n| [Unsafe resource fetching in Android WebView](https://codeql.github.com/codeql-query-help/java/java-android-unsafe-android-webview-fetch/) | 749, 079 | | | |\n| [Use of a potentially broken or risky cryptographic algorithm](https://codeql.github.com/codeql-query-help/java/java-potentially-weak-cryptographic-algorithm/) | 327, 328 | | | |\n| [Use of a potentially dangerous function](https://codeql.github.com/codeql-query-help/java/java-potentially-dangerous-function/) | 676 | | | |\n| [User-controlled bypass of sensitive method](https://codeql.github.com/codeql-query-help/java/java-user-controlled-bypass/) | 807, 290 | | | |\n| [User-controlled data in arithmetic expression](https://codeql.github.com/codeql-query-help/java/java-tainted-arithmetic/) | 190, 191 | | | |\n\n

"}