code scanning

README.md

NeoMutt CodeQL Code Scanning

Last update: 2026-01-14

• Commit https://github.com/neomutt/neomutt/commit/3d550cb02fd93113817b81cc8f9c10373b23f72f

• Issues: https://github.com/neomutt/neomutt/security/code-scanning

• How to use gh api: https://docs.github.com/en/rest/code-scanning/code-scanning?apiVersion=2022-11-28#list-code-scanning-alerts-for-a-repository

Download 2 pages of 100 issues

gh api -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" "/repos/neomutt/neomutt/code-scanning/alerts?state=open&per_page=100&page=1" | json_reformat > s1.json
gh api -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" "/repos/neomutt/neomutt/code-scanning/alerts?state=open&per_page=100&page=2" | json_reformat > s2.json

Export some fields

jq '.[] | .most_recent_instance.location.path,.most_recent_instance.location.start_line,.most_recent_instance.location.start_column,.number,.rule.description' s1.json > l1
jq '.[] | .most_recent_instance.location.path,.most_recent_instance.location.start_line,.most_recent_instance.location.start_column,.number,.rule.description' s2.json > l2

Tidy the results

In Vim, edit l1, l2, then :source tidy.vim

vim quickfix list

qf.txt

132 Issues

• 30 For loop variable changed in body
• 26 Poorly documented large function
• 24 Uncontrolled data used in path expression
• 21 Local variable address stored in non-local memory
• 9 Year field changed using an arithmetic operation without checking for leap year
• 8 Long switch case
• 3 Nested loops with same variable
• 3 Futile conditional
• 2 Time-of-check time-of-use filesystem race condition
• 2 File created without restricting permissions
• 2 Cleartext transmission of sensitive information
• 1 Uncontrolled process operation
• 1 Unbounded write

qf.txt

ncrypt/smime.c:743:11:           2    Cleartext transmission of sensitive information
ncrypt/smime.c:778:13:           3    Cleartext transmission of sensitive information

maildir/message.c:566:10:        1103 File created without restricting permissions
mh/shared.c:86:10:               691  File created without restricting permissions

compose/functions.c:660:9:       187  For loop variable changed in body
compose/functions.c:672:9:       188  For loop variable changed in body
docs/makedoc.c:572:17:           1256 For loop variable changed in body
docs/makedoc.c:973:7:            1259 For loop variable changed in body
docs/makedoc.c:986:9:            1260 For loop variable changed in body
email/header.c:333:13:           1282 For loop variable changed in body
email/parse.c:227:17:            507  For loop variable changed in body
email/parse.c:640:5:             208  For loop variable changed in body
email/parse.c:645:5:             209  For loop variable changed in body
email/rfc2047.c:385:9:           1063 For loop variable changed in body
email/rfc2231.c:118:7:           571  For loop variable changed in body
email/url.c:205:9:               572  For loop variable changed in body
imap/utf7.c:119:7:               213  For loop variable changed in body
imap/utf7.c:129:27:              214  For loop variable changed in body
imap/util.c:726:11:              1183 For loop variable changed in body
mutt/buffer.c:446:20:            932  For loop variable changed in body
mutt/file.c:1382:28:             508  For loop variable changed in body
mutt/file.c:1387:11:             509  For loop variable changed in body
mutt/path.c:80:13:               217  For loop variable changed in body
mutt/slist.c:201:7:              218  For loop variable changed in body
ncrypt/gnupgparse.c:280:13:      223  For loop variable changed in body
ncrypt/gnupgparse.c:286:13:      224  For loop variable changed in body
ncrypt/gnupgparse.c:292:13:      225  For loop variable changed in body
ncrypt/gnupgparse.c:359:20:      226  For loop variable changed in body
ncrypt/gpgme_functions.c:199:7:  1109 For loop variable changed in body
ncrypt/gpgme_functions.c:216:9:  228  For loop variable changed in body
ncrypt/gpgme_functions.c:224:11: 573  For loop variable changed in body
ncrypt/smime.c:299:20:           231  For loop variable changed in body
nntp/complete.c:66:9:            230  For loop variable changed in body
pattern/pattern.c:115:7:         483  For loop variable changed in body

mutt/signal.c:84:3:              1190 Futile conditional
mutt/signal.c:98:5:              1189 Futile conditional
mutt/signal.c:117:3:             1188 Futile conditional

alias/dlg_alias.c:240:3:         325  Local variable address stored in non-local memory
alias/dlg_query.c:317:3:         326  Local variable address stored in non-local memory
browser/dlg_browser.c:856:3:     1130 Local variable address stored in non-local memory
browser/dlg_browser.c:857:3:     1131 Local variable address stored in non-local memory
conn/dlg_verifycert.c:173:3:     331  Local variable address stored in non-local memory
editor/window.c:297:3:           1187 Local variable address stored in non-local memory
email/parse.c:258:9:             334  Local variable address stored in non-local memory
email/rfc2231.c:233:5:           336  Local variable address stored in non-local memory
email/thread.c:112:3:            527  Local variable address stored in non-local memory
gui/thread.c:1062:5:             1298 Local variable address stored in non-local memory
history/dlg_history.c:132:3:     1132 Local variable address stored in non-local memory
imap/browse.c:165:3:             341  Local variable address stored in non-local memory
imap/browse.c:277:5:             1100 Local variable address stored in non-local memory
imap/command.c:703:3:            343  Local variable address stored in non-local memory
imap/imap.c:1418:3:              344  Local variable address stored in non-local memory
mutt/notify.c:210:3:             1110 Local variable address stored in non-local memory
ncrypt/dlg_gpgme.c:233:3:        1135 Local variable address stored in non-local memory
ncrypt/dlg_pgp.c:233:3:          1133 Local variable address stored in non-local memory
ncrypt/dlg_smime.c:210:3:        1134 Local variable address stored in non-local memory
pager/dlg_pager.c:351:3:         353  Local variable address stored in non-local memory
postpone/dlg_postpone.c:222:3:   1136 Local variable address stored in non-local memory

email/parse.c:687:3:             521  Long switch case
flags.c:69:3:                    575  Long switch case
muttlib.c:137:5:                 1193 Long switch case
ncrypt/gnupgparse.c:172:5:       19   Long switch case
ncrypt/smime.c:2048:5:           20   Long switch case
notmuch/notmuch.c:1381:3:        21   Long switch case
pattern/compile.c:370:5:         23   Long switch case
pattern/compile.c:932:5:         692  Long switch case

postpone/postpone.c:222:24:      356  Nested loops with same variable
postpone/postpone.c:257:22:      357  Nested loops with same variable
postpone/postpone.c:294:16:      358  Nested loops with same variable

address/address.c:480:5:         577  Poorly documented large function
attach/recvattach.c:426:6:       693  Poorly documented large function
attach/recvcmd.c:945:6:          1299 Poorly documented large function
convert/content_info.c:49:6:     285  Poorly documented large function
email/enriched.c:120:13:         1300 Poorly documented large function
email/handler.c:1135:12:         1301 Poorly documented large function
envelope/window.c:502:12:        427  Poorly documented large function
gui/thread.c:232:13:             1302 Poorly documented large function
history/history.c:203:13:        1115 Poorly documented large function
index/functions.c:1352:12:       292  Poorly documented large function
index/functions.c:1470:12:       291  Poorly documented large function
mbox/mbox.c:180:27:              293  Poorly documented large function
mutt/filter.c:62:7:              659  Poorly documented large function
ncrypt/crypt.c:1117:5:           1104 Poorly documented large function
ncrypt/crypt.c:1241:5:           695  Poorly documented large function
ncrypt/crypt_gpgme.c:3532:14:    296  Poorly documented large function
ncrypt/pgp.c:1462:7:             295  Poorly documented large function
notmuch/notmuch.c:2245:22:       298  Poorly documented large function
pager/pager.c:133:12:            526  Poorly documented large function
pattern/exec.c:843:13:           299  Poorly documented large function
pattern/pattern.c:186:5:         1128 Poorly documented large function
pop/auth.c:524:5:                300  Poorly documented large function
send/send.c:228:12:              301  Poorly documented large function
send/send.c:1148:12:             574  Poorly documented large function
send/sendlib.c:453:14:           284  Poorly documented large function
send/smtp.c:622:12:              303  Poorly documented large function

mutt/file.c:172:18:              1207 Time-of-check time-of-use filesystem race condition
mutt/file.c:184:3:               6    Time-of-check time-of-use filesystem race condition

attach/commands.c:352:5:         1269 Unbounded write

attach/recvcmd.c:506:34:         1288 Uncontrolled data used in path expression
attach/recvcmd.c:625:43:         1289 Uncontrolled data used in path expression
attach/recvcmd.c:636:22:         1290 Uncontrolled data used in path expression
attach/recvcmd.c:697:30:         1286 Uncontrolled data used in path expression
attach/recvcmd.c:771:35:         1287 Uncontrolled data used in path expression
attach/recvcmd.c:1008:28:        1283 Uncontrolled data used in path expression
attach/recvcmd.c:1100:39:        1284 Uncontrolled data used in path expression
attach/recvcmd.c:1110:22:        1285 Uncontrolled data used in path expression
commands/parse.c:138:34:         1272 Uncontrolled data used in path expression
commands/setenv.c:88:36:         1273 Uncontrolled data used in path expression
commands/source.c:112:29:        1274 Uncontrolled data used in path expression
email/copy_body.c:70:39:         1291 Uncontrolled data used in path expression
email/handler.c:574:29:          1295 Uncontrolled data used in path expression
email/handler.c:668:24:          1296 Uncontrolled data used in path expression
email/handler.c:1380:39:         1292 Uncontrolled data used in path expression
email/handler.c:1435:38:         1293 Uncontrolled data used in path expression
email/mailcap.c:524:38:          1294 Uncontrolled data used in path expression
email/rfc3676.c:495:34:          1297 Uncontrolled data used in path expression
help.c:179:30:                   1191 Uncontrolled data used in path expression
hooks/dump.c:245:30:             1275 Uncontrolled data used in path expression
mutt/logging.c:132:31:           1205 Uncontrolled data used in path expression
ncrypt/smime.c:1446:20:          1206 Uncontrolled data used in path expression
parse/dump.c:59:34:              1276 Uncontrolled data used in path expression
send/sendlib.c:113:26:           913  Uncontrolled data used in path expression

send/sendmail.c:172:14:          384  Uncontrolled process operation

expando/node_conddate.c:88:10:   1099 Year field changed using an arithmetic operation without checking for leap year
mutt/date.c:355:9:               319  Year field changed using an arithmetic operation without checking for leap year
mutt/date.c:360:9:               486  Year field changed using an arithmetic operation without checking for leap year
mutt/date.c:371:11:              321  Year field changed using an arithmetic operation without checking for leap year
mutt/date.c:385:11:              322  Year field changed using an arithmetic operation without checking for leap year
mutt/date.c:593:8:               522  Year field changed using an arithmetic operation without checking for leap year
mutt/date.c:758:8:               1114 Year field changed using an arithmetic operation without checking for leap year
pattern/compile.c:231:11:        324  Year field changed using an arithmetic operation without checking for leap year
pattern/compile.c:345:8:         323  Year field changed using an arithmetic operation without checking for leap year

tidy.vim

%s/"//e
0
g/\.c$/norm Jr:Jr:A:Jr	Jr	
%!sort -t'	' -k3,3 -k1,1