CodeQL fails to detect rust/insecure-cookie in Rust code

Open
#3,915 6 comments 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
48/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Quiet
Tech stack
rust
Domain
security

Research direction

Reproduce the issue with the minimal Rust project and the documented code example, then run the shown codeql database create and codeql database analyze commands. Inspect codeql.sarif and compare its results with the expected rust/insecure-cookie finding; done means the finding is emitted.

Written by the indexing model from the issue text.

Description

Steps to reproduce

  • Download latest CodeQL bundle (v2.25.4 at the moment).
  • Have a minimal Rust project with rust/insecure-cookie in it (take the code example from the official documentation).
  • Run the following command in the directory with the Rust project:
codeql database create --build-mode=none --language=rust .codeql-db
codeql database analyze --format=sarifv2.1.0 --output=codeql.sarif .codeql-db
  • Look at the produced codeql.sarif

Expected behavior

results field should have 1 finding with rust/insecure-cookie id.

Actual behavior

results field is empty

Notes

The same codeql version with the same Rust code worked as expected on May 18, 2026, 2:31 PM GMT+9.

Dominant language
TypeScript
Stars
1.6k
Forks
493
Avg merge
1d 13h
Merged PRs (30d)
44

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github/codeql-action

All issues in github/codeql-action

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.