CWE coverage inquiry

[phnx]

Hello,

I've been working in a project that involves mapping CWE items to CodeQL queries. I stumbled upon this coverage page which is very helpful. Then I found that some of the queries are mapped to CWE items that CWE recommended not to refer to if more precise items exist. While I found that a lot of these queries are also mapped to other CWE items which makes the mapping interpretation more accurate, a handful of them are only mapped to problematic items or pillar (top level) CWE items.

For example, cpp/count-untrusted-data-external-api and cpp/late-check-of-function-argument which are mapped to CWE-20 and CWE-693 or cpp/errors-after-refactoring which is mapped to CWE-691.

I think CWE published that recommendation recently. So it's understandable if some queries were mapped earlier. I'm just wondering if there's an official plan for the coverage to be reviewed, revised, or clarified?

Thank you in advance :)

[MathiasVP]

Hi @phnx,

Thanks for raising this issue! I will forward it to the appropriate teams :)