CodeQL maps CWE-730, which MITRE prohibits from being used for mapping

[wiggin15]

CodeQL maps weakness CWE-730 on Code Scanning alerts. According to MITRE, CWE-730 is a Category and it is marked PROHIBITED (this CWE ID must not be used to map to real-world vulnerabilities).

Also note that this CWE is not listed in CodeQL's CWE coverage page in the docs.

[hvitved]

Hi

As far as I know, those tags are mainly used to generate to generate links to MITRE from the query help pages (example), so I think we still want to keep event the Category tags.

[wiggin15]

Thanks for the reply :)
From what I can tell, those tags aren't just used for the query help pages - they're also the CWE mapping returned in SARIF reports (example) and the Code Scanning REST API, so external/cwe/cwe-730 is what consumers parse as the CWE-730 mapping (which is what MITRE prohibits). There is no separate CWE field.