GitLab Advanced SAST CWE coverage

Tier: Ultimate
Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated

GitLab Advanced SAST finds many types of potential security vulnerabilities in code written in supported languages.

GitLab assigns a matching Common Weakness Enumeration (CWE) identifier to each potential vulnerability. CWE identifiers are an industry-standard way to identify security weaknesses, but it's important to know:

CWEs are arranged in a tree structure. For example, CWE-22: Path Traversal is a parent of CWE-23: Relative Path Traversal. A scanner that specifically detects relative path traversal weaknesses (CWE-23) by definition also detects a portion of the more general path traversal category (CWE-22).
For clarity, this table identifies the exact CWE identifiers that are assigned to GitLab Advanced SAST rules. It doesn't report parent identifiers.

To learn more about the rules used in GitLab Advanced SAST, see SAST rules.

CWE coverage by language

GitLab Advanced SAST finds the following types of weaknesses in each programming language:

CWE	CWE Description	C	C++	C#	Go	Java	JavaScript, TypeScript	PHP	Python	Ruby
CWE-15	External Control of System or Configuration Setting	no	no	no	no	yes	no	no	no	no
CWE-22	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')	no	no	yes	yes	yes	yes	yes	yes	yes
CWE-23	Relative Path Traversal	no	no	no	no	no	yes	no	yes	no
CWE-73	External Control of File Name or Path	no	no	no	no	yes	no	no	no	yes
CWE-76	Improper Neutralization of Equivalent Special Elements	no	no	no	no	no	no	no	no	yes
CWE-77	Improper Neutralization of Special Elements used in a Command ('Command Injection')	no	no	no	no	yes	no	no	no	no
CWE-78	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')	yes	no	yes	yes	yes	yes	yes	yes	yes
CWE-79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	no	no	yes	yes	yes	yes	yes	yes	yes
CWE-80	Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)	no	no	no	no	no	yes	no	no	no
CWE-88	Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')	no	no	no	no	yes	no	no	no	no
CWE-89	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	no	no	yes	yes	yes	yes	yes	yes	yes
CWE-90	Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')	no	no	yes	no	yes	no	no	yes	no
CWE-91	XML Injection (aka Blind XPath Injection)	no	no	no	no	yes	no	no	no	no
CWE-94	Improper Control of Generation of Code ('Code Injection')	no	no	no	yes	yes	yes	yes	yes	yes
CWE-95	Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')	no	no	no	no	yes	yes	no	yes	yes
CWE-113	Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')	no	no	no	no	yes	yes	no	yes	no
CWE-116	Improper Encoding or Escaping of Output	no	no	no	no	no	yes	no	yes	no
CWE-117	Improper Output Neutralization for Logs	no	no	no	no	yes	no	no	no	no
CWE-118	Incorrect Access of Indexable Resource ('Range Error')	no	no	no	yes	no	no	no	no	no
CWE-125	Out-of-bounds Read	yes	yes	no	no	no	yes	no	no	no
CWE-131	Incorrect Calculation of Buffer Size	yes	yes	no	no	no	no	no	no	no
CWE-155	Improper Neutralization of Wildcards or Matching Symbols	no	no	no	no	no	no	no	yes	no
CWE-180	Incorrect Behavior Order: Validate Before Canonicalize	no	no	no	no	yes	no	no	no	no
CWE-182	Collapse of Data into Unsafe Value	no	no	no	no	yes	no	no	no	no
CWE-185	Incorrect Regular Expression	no	no	no	no	no	yes	no	no	yes
CWE-190	Integer Overflow or Wraparound	yes	yes	no	yes	yes	no	no	no	no
CWE-191	Integer Underflow (Wrap or Wraparound)	no	no	no	no	yes	no	no	no	no
CWE-208	Observable Timing Discrepancy	no	no	no	no	no	yes	no	no	no
CWE-209	Generation of Error Message Containing Sensitive Information	no	no	no	no	no	no	no	no	yes
CWE-242	Use of Inherently Dangerous Function	yes	yes	no	yes	no	no	no	no	no
CWE-243	Creation of chroot Jail Without Changing Working Directory	yes	yes	no	no	no	no	no	no	no
CWE-252	Unchecked Return Value	yes	yes	no	no	no	no	no	no	no
CWE-253	Incorrect Check of Function Return Value	yes	yes	no	no	no	no	no	no	no
CWE-256	Plaintext Storage of a Password	no	no	no	no	yes	no	no	no	no
CWE-271	Privilege Dropping / Lowering Errors	yes	yes	no	no	no	no	no	no	no
CWE-272	Least Privilege Violation	no	no	no	no	no	yes	no	no	no
CWE-276	Incorrect Default Permissions	no	no	no	yes	no	no	no	no	yes
CWE-295	Improper Certificate Validation	no	no	yes	no	yes	yes	yes	yes	yes
CWE-297	Improper Validation of Certificate with Host Mismatch	no	no	no	no	yes	no	no	no	no
CWE-306	Missing Authentication for Critical Function	no	no	no	no	yes	no	no	no	no
CWE-311	Missing Encryption of Sensitive Data	no	no	no	no	no	no	no	no	yes
CWE-319	Cleartext Transmission of Sensitive Information	no	no	no	no	yes	yes	yes	yes	no
CWE-322	Key Exchange without Entity Authentication	no	no	no	yes	no	no	no	yes	no
CWE-323	Reusing a Nonce, Key Pair in Encryption	no	no	no	no	yes	no	no	no	no
CWE-326	Inadequate Encryption Strength	no	no	no	yes	yes	no	no	yes	yes
CWE-327	Use of a Broken or Risky Cryptographic Algorithm	no	no	yes	yes	yes	yes	yes	yes	no
CWE-328	Use of Weak Hash	no	no	no	no	no	yes	yes	no	yes
CWE-338	Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)	yes	yes	yes	yes	yes	yes	yes	yes	no
CWE-346	Origin Validation Error	no	no	no	no	no	yes	no	no	no
CWE-347	Improper Verification of Cryptographic Signature	no	no	no	no	yes	no	no	yes	no
CWE-348	Use of Less Trusted Source	no	no	no	no	no	yes	no	no	no
CWE-352	Cross-Site Request Forgery (CSRF)	no	no	yes	no	yes	no	no	yes	yes
CWE-358	Improperly Implemented Security Check for Standard	no	no	no	no	no	yes	no	no	no
CWE-362	Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')	yes	yes	no	no	no	no	no	no	no
CWE-369	Divide By Zero	yes	yes	no	no	no	no	no	no	yes
CWE-377	Insecure Temporary File	yes	yes	no	yes	no	no	no	yes	no
CWE-398	Code Quality	yes	yes	no	no	no	no	no	no	no
CWE-400	Uncontrolled Resource Consumption	yes	yes	no	no	no	no	no	no	no
CWE-401	Missing Release of Memory after Effective Lifetime	yes	yes	no	no	no	no	no	no	no
CWE-404	Improper Resource Shutdown or Release	yes	yes	no	no	no	no	no	no	no
CWE-409	Improper Handling of Highly Compressed Data (Data Amplification)	no	no	no	yes	no	no	no	no	no
CWE-413	Improper Resource Locking	yes	yes	no	no	no	no	no	no	no
CWE-415	Double Free	yes	yes	no	no	no	no	no	no	no
CWE-416	Use After Free	yes	yes	no	no	no	no	no	no	no
CWE-448	Excessive Use of Hard-Coded Literals in Initialization	yes	yes	no	no	no	no	no	no	no
CWE-457	Use of Uninitialized Variable	yes	yes	no	no	no	no	no	no	no
CWE-459	Incomplete Cleanup	yes	yes	no	no	no	no	no	no	no
CWE-466	Return of Pointer Value Outside of Expected Range	yes	yes	no	no	no	no	no	no	no
CWE-467	Use of sizeof() on a Pointer Type	yes	yes	no	no	no	no	no	no	no
CWE-469	Use of Pointer Subtraction to Determine Size	yes	yes	no	no	no	no	no	no	no
CWE-470	Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')	no	no	no	no	yes	no	no	no	no
CWE-476	NULL Pointer Dereference	yes	yes	no	no	no	no	no	no	no
CWE-477	Use of Obsolete Function	yes	yes	no	no	no	no	no	no	no
CWE-489	Active Debug Code	no	no	no	yes	yes	no	no	yes	no
CWE-497	Exposure of Sensitive System Information to an Unauthorized Control Sphere	no	no	no	no	no	no	yes	yes	no
CWE-501	Trust Boundary Violation	no	no	no	no	yes	no	no	no	no
CWE-502	Deserialization of Untrusted Data	no	no	yes	no	yes	yes	yes	yes	yes
CWE-521	Weak Password Requirements	no	no	yes	no	no	no	no	no	no
CWE-522	Insufficiently Protected Credentials	no	no	no	no	no	yes	no	no	no
CWE-552	Files or Directories Accessible to External Parties	no	no	no	yes	yes	no	no	no	no
CWE-554	ASP.NET Misconfiguration: Not Using Input Validation Framework	no	no	yes	no	no	no	no	no	no
CWE-561	Dead Code	yes	yes	no	no	no	no	no	no	no
CWE-562	Return of Stack Variable Address	yes	yes	no	no	no	no	no	no	no
CWE-563	Assignment to Variable without Use	yes	yes	no	no	no	no	no	no	no
CWE-573	Improper Following of Specification by Caller	yes	yes	no	no	no	no	no	no	no
CWE-587	Assignment of a Fixed Address to a Pointer	yes	yes	no	no	no	no	no	no	no
CWE-588	Attempt to Access Child of a Non-structure Pointer	yes	yes	no	no	no	no	no	no	no
CWE-598	Use of GET Request Method With Sensitive Query Strings	no	no	no	no	no	no	yes	no	no
CWE-599	Missing Validation of OpenSSL Certificate	no	no	no	no	no	yes	no	no	no
CWE-601	URL Redirection to Untrusted Site ('Open Redirect')	no	no	yes	yes	yes	yes	yes	yes	yes
CWE-606	Unchecked Input for Loop Condition	no	no	no	no	no	yes	no	yes	no
CWE-611	Improper Restriction of XML External Entity Reference	no	no	yes	yes	yes	yes	yes	yes	no
CWE-613	Insufficient Session Expiration	no	no	no	no	no	yes	no	no	no
CWE-614	Sensitive Cookie in HTTPS Session Without 'Secure' Attribute	no	no	yes	yes	yes	yes	yes	no	no
CWE-639	Authorization Bypass Through User-Controlled Key	no	no	no	no	no	no	no	no	yes
CWE-643	Improper Neutralization of Data within XPath Expressions ('XPath Injection')	no	no	yes	no	yes	yes	no	yes	no
CWE-667	Improper Locking	yes	yes	no	no	no	no	no	no	no
CWE-670	Always-Incorrect Control Flow Implementation	yes	yes	no	no	no	no	no	no	no
CWE-672	Operation on a Resource after Expiration or Release	yes	yes	no	no	no	no	no	no	no
CWE-676	Use of Potentially Dangerous Function	yes	yes	no	no	no	no	no	no	no
CWE-684	Incorrect Provision of Specified Functionality	yes	yes	no	no	no	no	no	no	no
CWE-685	Function Call with Incorrect Number of Arguments	yes	yes	no	no	no	no	no	no	no
CWE-686	Function Call With Incorrect Argument Type	yes	yes	no	no	no	no	no	no	no
CWE-687	Function Call With Incorrectly Specified Argument Value	yes	yes	no	no	no	no	no	no	no
CWE-704	Incorrect Type Conversion or Cast	yes	yes	no	no	yes	no	no	no	no
CWE-732	Incorrect Permission Assignment for Critical Resource	yes	yes	no	yes	yes	no	no	yes	no
CWE-749	Exposed Dangerous Method or Function	no	no	no	no	yes	no	no	no	yes
CWE-754	Improper Check for Unusual or Exceptional Conditions	yes	yes	no	no	no	no	no	no	yes
CWE-757	Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')	no	no	no	no	no	yes	no	no	no
CWE-758	Reliance on Undefined, Unspecified, or Implementation-Defined Behavior	yes	yes	no	no	no	no	no	no	no
CWE-762	Mismatched Memory Management Routines	yes	yes	no	no	no	no	no	no	no
CWE-764	Multiple Locks of a Critical Resource	yes	yes	no	no	no	no	no	no	no
CWE-770	Allocation of Resources Without Limits or Throttling	yes	yes	no	yes	no	yes	no	yes	no
CWE-772	Missing Release of Resource after Effective Lifetime	yes	yes	no	no	no	no	no	no	no
CWE-775	Missing Release of File Descriptor or Handle after Effective Lifetime	yes	yes	no	no	no	no	no	no	no
CWE-776	Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')	no	no	no	no	no	yes	no	no	no
CWE-780	Use of RSA Algorithm without OAEP	no	no	no	no	yes	no	no	no	no
CWE-787	Out-of-bounds Write	yes	yes	no	no	no	yes	no	no	no
CWE-789	Memory Allocation with Excessive Size Value	yes	yes	no	no	no	no	no	no	no
CWE-798	Use of Hard-coded Credentials	no	no	no	no	no	yes	no	no	no
CWE-805	Buffer Access with Incorrect Length Value	yes	yes	no	no	no	no	no	no	no
CWE-821	Incorrect Synchronization	yes	yes	no	no	no	no	no	no	no
CWE-823	Use of Out-of-range Pointer Offset	yes	yes	no	no	no	no	no	no	no
CWE-824	Access of Uninitialized Pointer	yes	yes	no	no	no	no	no	no	no
CWE-825	Expired Pointer Dereference	yes	yes	no	no	no	no	no	no	no
CWE-833	Deadlock	yes	yes	no	no	no	no	no	no	no
CWE-843	Access of Resource Using Incompatible Type ('Type Confusion')	yes	yes	no	no	no	no	no	no	no
CWE-908	Use of Uninitialized Resource	yes	yes	no	no	no	no	no	no	no
CWE-913	Improper Control of Dynamically-Managed Code Resources	no	no	no	no	no	yes	no	no	no
CWE-915	Improperly Controlled Modification of Dynamically-Determined Object Attributes	no	no	no	no	no	no	no	no	yes
CWE-917	Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')	no	no	no	no	yes	no	no	no	no
CWE-918	Server-Side Request Forgery (SSRF)	no	no	yes	yes	yes	yes	yes	yes	yes
CWE-942	Permissive Cross-domain Policy with Untrusted Domains	no	no	no	yes	yes	yes	no	yes	no
CWE-943	Improper Neutralization of Special Elements in Data Query Logic	no	no	no	yes	yes	yes	no	no	no
CWE-1004	Sensitive Cookie Without 'HttpOnly' Flag	no	no	yes	yes	yes	yes	yes	yes	yes
CWE-1021	Improper Restriction of Rendered UI Layers or Frames	no	no	no	no	yes	no	no	no	no
CWE-1024	Comparison of Incompatible Types	yes	yes	no	no	no	no	no	no	no
CWE-1061	Insufficient Encapsulation	yes	yes	no	no	no	no	no	no	no
CWE-1077	Floating Point Comparison with Incorrect Operator	yes	yes	no	no	no	no	no	no	no
CWE-1079	Parent Class without Virtual Destructor Method	yes	yes	no	no	no	no	no	no	no
CWE-1098	Data Element containing Pointer Item without Proper Copy Control Element	yes	yes	no	no	no	no	no	no	no
CWE-1104	Use of Unmaintained Third Party Components	no	no	no	no	no	no	no	yes	no
CWE-1116	Inaccurate Comments	yes	yes	no	no	no	no	no	no	no
CWE-1164	Irrelevant Code	yes	yes	no	no	no	no	no	no	no
CWE-1204	Generation of Weak Initialization Vector (IV)	no	no	no	no	no	yes	no	no	no
CWE-1260	Improper Handling of Overlap Between Protected Memory Ranges	yes	yes	no	no	no	no	no	no	no
CWE-1275	Sensitive Cookie with Improper SameSite Attribute	no	no	no	no	no	yes	yes	yes	no
CWE-1321	Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')	no	no	no	no	no	yes	no	no	no
CWE-1327	Binding to an Unrestricted IP Address	no	no	no	yes	no	no	no	yes	no
CWE-1333	Inefficient Regular Expression Complexity	no	no	no	no	no	no	no	yes	yes
CWE-1335	Incorrect Bitwise Shift of Integer	yes	yes	no	no	no	no	no	no	no
CWE-1336	Improper Neutralization of Special Elements Used in a Template Engine	no	no	no	no	no	no	yes	no	no
CWE-1390	Weak Authentication	no	no	no	no	yes	no	no	yes	no
CWE-1341	Multiple Releases of Same Resource or Handle	yes	yes	no	no	no	no	no	no	no
CWE-1419	Incorrect Initialization of Resource	yes	yes	no	no	no	no	no	no	no

Swift and Objective-C CWE coverage

Status: Beta

Swift and Objective-C analysis is in beta and runs as a separate CI/CD job, gitlab-advanced-sast-ext. For more information, see Swift and Objective-C configuration.

GitLab Advanced SAST finds the following types of weaknesses across Swift and Objective-C combined. Coverage is not identical for both languages and continues to expand during the beta.

CWE	CWE Description
CWE-22	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-78	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-89	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-90	Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
CWE-134	Use of Externally-Controlled Format String
CWE-200	Exposure of Sensitive Information to an Unauthorized Actor
CWE-295	Improper Certificate Validation
CWE-312	Cleartext Storage of Sensitive Information
CWE-319	Cleartext Transmission of Sensitive Information
CWE-321	Use of Hard-coded Cryptographic Key
CWE-327	Use of a Broken or Risky Cryptographic Algorithm
CWE-328	Use of Weak Hash
CWE-329	Generation of Predictable IV with CBC Mode
CWE-330	Use of Insufficiently Random Values
CWE-347	Improper Verification of Cryptographic Signature
CWE-367	Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-477	Use of Obsolete Function
CWE-502	Deserialization of Untrusted Data
CWE-522	Insufficiently Protected Credentials
CWE-532	Insertion of Sensitive Information into Log File
CWE-598	Use of GET Request Method With Sensitive Query Strings
CWE-601	URL Redirection to Untrusted Site ('Open Redirect')
CWE-611	Improper Restriction of XML External Entity Reference
CWE-639	Authorization Bypass Through User-Controlled Key
CWE-643	Improper Neutralization of Data within XPath Expressions ('XPath Injection')
CWE-916	Use of Password Hash With Insufficient Computational Effort
CWE-917	Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
CWE-918	Server-Side Request Forgery (SSRF)
CWE-1333	Inefficient Regular Expression Complexity

Note

Did this page answer the question you had? If not, comment on epic 15343 to share your use case.