CodeQL models-as-data add custom sanitizers and validators
The news at the time
GitHub describes declarative sanitizers and validators in CodeQL YAML data extensions, using barrierModel and barrierGuardModel.
The announcement lists availability starting with CodeQL 2.25.2. This is the minimum version in that historical announcement, not a current upgrade recommendation.
Follow-up checked during renewal
No additional follow-up fact was established in this renewal. This does not establish that nothing changed.
What to review before applying this
Model only the vulnerability kinds and paths the sanitizer actually protects. Test positive and negative examples so an overly broad barrier does not hide real taint flows; this draft does not claim a measured reduction in false positives.
Editorial review suggestions; no hands-on product experiment was performed.
Claim-by-claim source evidence
GitHub describes declarative sanitizers and validators in CodeQL YAML data extensions, using barrierModel and barrierGuardModel.
two new extensible predicates: barrierModel
Evidence source ↗
The announcement lists availability starting with CodeQL 2.25.2. This is the minimum version in that historical announcement, not a current upgrade recommendation.
available starting with CodeQL 2.25.2
Evidence source ↗
Korean digest for the historical date: 2026-05-06. Quotations and source context were reviewed editorially; this is not an independent experimental verification.
Discussion