mirror of
https://github.com/hohn/codeql-info.git
synced 2025-12-16 20:53:04 +01:00
304 lines
19 KiB
HTML
304 lines
19 KiB
HTML
<!DOCTYPE html>
|
||
|
||
<html lang="en" data-content_root="../">
|
||
<head>
|
||
<meta charset="utf-8" />
|
||
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
|
||
|
||
<title>About CodeQL — CodeQL</title>
|
||
<link rel="stylesheet" type="text/css" href="../_static/pygments.css?v=fa44fd50" />
|
||
<link rel="stylesheet" type="text/css" href="../_static/alabaster.css?v=93459777" />
|
||
<script src="../_static/documentation_options.js?v=5929fcd5"></script>
|
||
<script src="../_static/doctools.js?v=888ff710"></script>
|
||
<script src="../_static/sphinx_highlight.js?v=dc90522c"></script>
|
||
<link rel="icon" href="../_static/favicon.ico"/>
|
||
<link rel="index" title="Index" href="../genindex.html" />
|
||
<link rel="search" title="Search" href="../search.html" />
|
||
<link rel="next" title="Supported languages and frameworks" href="supported-languages-and-frameworks.html" />
|
||
<link rel="prev" title="CodeQL overview" href="index.html" />
|
||
|
||
<title>CodeQL docs</title>
|
||
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
||
<link rel="stylesheet" href="../_static/custom.css" type="text/css" />
|
||
<link rel="stylesheet" href="../_static/primer.css" type="text/css" />
|
||
|
||
|
||
</head><body>
|
||
<header class="Header">
|
||
<div class="Header-item--full">
|
||
<a href="https://codeql.github.com/docs" class="Header-link f2 d-flex flex-items-center">
|
||
<!-- <%= octicon "mark-github", class: "mr-2", height: 32 %> -->
|
||
<svg height="32" class="octicon octicon-mark-github mr-2" viewBox="0 0 16 16" version="1.1" width="32"
|
||
aria-hidden="true">
|
||
<path fill-rule="evenodd"
|
||
d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0 0 16 8c0-4.42-3.58-8-8-8z">
|
||
</path>
|
||
</svg>
|
||
<span class="hide-sm">CodeQL documentation</span>
|
||
</a>
|
||
</div>
|
||
<div class="Header-item hide-sm hide-md">
|
||
<script src="https://addsearch.com/js/?key=93b4d287e2fc079a4089412b669785d5&categories=!0xhelp.semmle.com,0xcodeql.github.com,1xdocs,1xcodeql-standard-libraries,1xcodeql-query-help"></script>
|
||
</div>
|
||
<div class="Header-item">
|
||
|
||
<details class="dropdown details-reset details-overlay d-inline-block">
|
||
<summary class="btn bg-gray-dark text-white border" aria-haspopup="true">
|
||
CodeQL resources
|
||
<div class="dropdown-caret"></div>
|
||
</summary>
|
||
|
||
<ul class="dropdown-menu dropdown-menu-se dropdown-menu-dark">
|
||
<li><a class="dropdown-item" href="https://codeql.github.com/docs/codeql-overview">CodeQL overview</a></li>
|
||
<li class="dropdown-divider" role="separator"></li>
|
||
<div class="dropdown-header">
|
||
CodeQL tools
|
||
</div>
|
||
<li><a class="dropdown-item" href="https://codeql.github.com/docs/codeql-for-visual-studio-code">CodeQL for VS Code</a>
|
||
<li><a class="dropdown-item" href="https://codeql.github.com/docs/codeql-cli">CodeQL CLI</a>
|
||
</li>
|
||
<li class="dropdown-divider" role="separator"></li>
|
||
<div class="dropdown-header">
|
||
CodeQL guides
|
||
</div>
|
||
<li><a class="dropdown-item" href="https://codeql.github.com/docs/writing-codeql-queries">Writing CodeQL queries</a></li>
|
||
<li><a class="dropdown-item" href="https://codeql.github.com/docs/codeql-language-guides">CodeQL language guides</a>
|
||
<li class="dropdown-divider" role="separator"></li>
|
||
<div class="dropdown-header">
|
||
Reference docs
|
||
</div>
|
||
<li><a class="dropdown-item" href="https://codeql.github.com/docs/ql-language-reference/">QL language
|
||
reference</a>
|
||
<li><a class="dropdown-item" href="https://codeql.github.com/codeql-standard-libraries">CodeQL
|
||
standard-libraries</a>
|
||
<li><a class="dropdown-item" href="https://codeql.github.com/codeql-query-help">CodeQL
|
||
query help</a>
|
||
<li class="dropdown-divider" role="separator"></li>
|
||
<div class="dropdown-header">
|
||
Source files
|
||
</div>
|
||
<li><a class="dropdown-item" href="https://github.com/github/codeql">CodeQL repository</a>
|
||
</ul>
|
||
</details>
|
||
|
||
</div>
|
||
|
||
</header>
|
||
<main class="bg-gray-light clearfix">
|
||
<nav class="SideNav position-sticky top-0 col-lg-3 col-md-3 float-left p-4 hide-sm hide-md overflow-y-auto">
|
||
|
||
<ul class="current">
|
||
<li class="toctree-l1 current"><a class="reference internal" href="index.html">CodeQL overview</a><ul class="current">
|
||
<li class="toctree-l2 current"><a class="current reference internal" href="#">About CodeQL</a></li>
|
||
<li class="toctree-l2"><a class="reference internal" href="supported-languages-and-frameworks.html">Supported languages and frameworks</a></li>
|
||
<li class="toctree-l2"><a class="reference internal" href="codeql-tools.html">CodeQL tools</a></li>
|
||
<li class="toctree-l2"><a class="reference internal" href="codeql-glossary.html">CodeQL glossary</a></li>
|
||
</ul>
|
||
</li>
|
||
<li class="toctree-l1"><a class="reference internal" href="../codeql-for-visual-studio-code/index.html">CodeQL for Visual Studio Code</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="../codeql-cli/index.html">CodeQL CLI</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="../writing-codeql-queries/index.html">Writing CodeQL queries</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="../codeql-language-guides/index.html">CodeQL language guides</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="../ql-language-reference/index.html">QL language reference</a></li>
|
||
</ul>
|
||
|
||
|
||
</nav>
|
||
|
||
|
||
<div class="body col-sm-12 col-md-9 col-lg-9 float-left border-left">
|
||
|
||
<div class="hide-lg hide-xl px-4 pt-4">
|
||
|
||
<div class="related" role="navigation" aria-label="related navigation">
|
||
<ul>
|
||
<li class="nav-item nav-item-0"><a href="../contents.html">CodeQL</a> »</li>
|
||
<li class="nav-item nav-item-1"><a href="index.html"
|
||
accesskey="U">CodeQL overview</a> »</li>
|
||
</ul>
|
||
</div>
|
||
</div>
|
||
|
||
<article class="p-4 col-lg-10 col-md-10 col-sm-12">
|
||
|
||
<section id="about-codeql">
|
||
<span id="id1"></span><h1>About CodeQL<a class="headerlink" href="#about-codeql" title="Link to this heading">¶</a></h1>
|
||
<p>CodeQL is the analysis engine used by developers to automate security checks, and by
|
||
security researchers to perform variant analysis.</p>
|
||
<p>In CodeQL, code is treated like data. Security vulnerabilities, bugs,
|
||
and other errors are modeled as queries that can be executed against databases
|
||
extracted from code. You can run the standard CodeQL queries, written by GitHub
|
||
researchers and community contributors, or write your own to use in custom
|
||
analyses. Queries that find potential bugs highlight the result directly in the
|
||
source file.</p>
|
||
<section id="about-variant-analysis">
|
||
<h2>About variant analysis<a class="headerlink" href="#about-variant-analysis" title="Link to this heading">¶</a></h2>
|
||
<p>Variant analysis is the process of using a known security vulnerability as a
|
||
seed to find similar problems in your code. It’s a technique that security
|
||
engineers use to identify potential vulnerabilities, and ensure these threats
|
||
are properly fixed across multiple codebases.</p>
|
||
<p>Querying code using CodeQL is the most efficient way to perform variant
|
||
analysis. You can use the standard CodeQL queries to identify seed
|
||
vulnerabilities, or find new vulnerabilities by writing your own custom CodeQL
|
||
queries. Then, develop or iterate over the query to automatically find logical
|
||
variants of the same bug that could be missed using traditional manual
|
||
techniques.</p>
|
||
</section>
|
||
<section id="codeql-analysis">
|
||
<h2>CodeQL analysis<a class="headerlink" href="#codeql-analysis" title="Link to this heading">¶</a></h2>
|
||
<p>CodeQL analysis consists of three steps:</p>
|
||
<ol class="arabic simple">
|
||
<li><p>Preparing the code, by creating a CodeQL database</p></li>
|
||
<li><p>Running CodeQL queries against the database</p></li>
|
||
<li><p>Interpreting the query results</p></li>
|
||
</ol>
|
||
<section id="database-creation">
|
||
<h3>Database creation<a class="headerlink" href="#database-creation" title="Link to this heading">¶</a></h3>
|
||
<p>To create a database, CodeQL first extracts a single relational representation
|
||
of each source file in the codebase.</p>
|
||
<p>For compiled languages, extraction works by monitoring the normal build process.
|
||
Each time a compiler is invoked to process a source file, a copy of that file is
|
||
made, and all relevant information about the source code is collected. This includes
|
||
syntactic data about the abstract syntax tree and semantic data about name
|
||
binding and type information.</p>
|
||
<p>For interpreted languages, the extractor runs directly on the source code,
|
||
resolving dependencies to give an accurate representation of the codebase.</p>
|
||
<p>There is one <a class="reference internal" href="codeql-glossary.html#extractor"><span class="std std-ref">extractor</span></a> for each language supported by CodeQL
|
||
to ensure that the extraction process is as accurate as possible. For
|
||
multi-language codebases, databases are generated one language at a time.</p>
|
||
<p>After extraction, all the data required for analysis (relational data, copied
|
||
source files, and a language-specific <a class="reference internal" href="codeql-glossary.html#codeql-database-schema"><span class="std std-ref">database schema</span></a>, which specifies the mutual relations in the data) is
|
||
imported into a single directory, known as a <a class="reference internal" href="codeql-glossary.html#codeql-database"><span class="std std-ref">CodeQL database</span></a>.</p>
|
||
</section>
|
||
<section id="query-execution">
|
||
<h3>Query execution<a class="headerlink" href="#query-execution" title="Link to this heading">¶</a></h3>
|
||
<p>After you’ve created a CodeQL database, one or more queries are executed
|
||
against it. CodeQL queries are written in a specially-designed object-oriented
|
||
query language called QL. You can run the queries checked out from the CodeQL
|
||
repo (or custom queries that you’ve written yourself) using the <a class="reference internal" href="../codeql-for-visual-studio-code/index.html#codeql-for-visual-studio-code"><span class="std std-ref">CodeQL
|
||
for VS Code extension</span></a> or the <a class="reference internal" href="../codeql-cli/index.html#codeql-cli"><span class="std std-ref">CodeQL CLI</span></a>. For more information about queries, see “<a class="reference internal" href="../writing-codeql-queries/about-codeql-queries.html#about-codeql-queries"><span class="std std-ref">About CodeQL queries</span></a>.”</p>
|
||
</section>
|
||
<section id="query-results">
|
||
<span id="interpret-query-results"></span><h3>Query results<a class="headerlink" href="#query-results" title="Link to this heading">¶</a></h3>
|
||
<p>The final step converts results produced during query execution into a form that
|
||
is more meaningful in the context of the source code. That is, the results are
|
||
interpreted in a way that highlights the potential issue that the queries are
|
||
designed to find.</p>
|
||
<p>Queries contain metadata properties that indicate how the results should be
|
||
interpreted. For instance, some queries display a simple message at a single
|
||
location in the code. Others display a series of locations that represent steps
|
||
along a data-flow or control-flow path, along with a message explaining the
|
||
significance of the result. Queries that don’t have metadata are not
|
||
interpreted—their results are output as a table and not displayed in the source
|
||
code.</p>
|
||
<p>Following interpretation, results are output for code review and triaging. In
|
||
CodeQL for Visual Studio Code, interpreted query results are automatically
|
||
displayed in the source code. Results generated by the CodeQL CLI can be output
|
||
into a number of different formats for use with different tools.</p>
|
||
</section>
|
||
</section>
|
||
<section id="about-codeql-databases">
|
||
<h2>About CodeQL databases<a class="headerlink" href="#about-codeql-databases" title="Link to this heading">¶</a></h2>
|
||
<p>CodeQL databases contain queryable data extracted from a codebase, for a single
|
||
language at a particular point in time. The database contains a full,
|
||
hierarchical representation of the code, including a representation of the
|
||
abstract syntax tree, the data flow graph, and the control flow graph.</p>
|
||
<p>Each language has its own unique database schema that defines the relations used
|
||
to create a database. The schema provides an interface between the initial
|
||
lexical analysis during the extraction process, and the actual complex analysis
|
||
using CodeQL. The schema specifies, for instance, that there is a table for
|
||
every language construct.</p>
|
||
<p>For each language, the CodeQL libraries define classes to provide a layer of
|
||
abstraction over the database tables. This provides an object-oriented view of
|
||
the data which makes it easier to write queries.</p>
|
||
<p>For example, in a CodeQL database for a Java program, two key tables are:</p>
|
||
<ul class="simple">
|
||
<li><p>The <code class="docutils literal notranslate"><span class="pre">expressions</span></code> table containing a row for every single expression in the
|
||
source code that was analyzed during the build process.</p></li>
|
||
<li><p>The <code class="docutils literal notranslate"><span class="pre">statements</span></code> table containing a row for every single statement in the
|
||
source code that was analyzed during the build process.</p></li>
|
||
</ul>
|
||
<p>The CodeQL library defines classes to provide a layer of abstraction over each
|
||
of these tables (and the related auxiliary tables): <code class="docutils literal notranslate"><span class="pre">Expr</span></code> and <code class="docutils literal notranslate"><span class="pre">Stmt</span></code>.</p>
|
||
</section>
|
||
</section>
|
||
|
||
|
||
</article>
|
||
|
||
<!-- GitHub footer, with links to terms and privacy statement -->
|
||
<div class="px-3 px-md-6 f6 py-4 d-sm-flex flex-justify-between flex-row-reverse flex-items-center border-top">
|
||
<ul class="list-style-none d-flex flex-items-center mb-3 mb-sm-0 lh-condensed-ultra">
|
||
<li class="mr-3">
|
||
<a href="https://twitter.com/github" title="GitHub on Twitter" style="color: #959da5;">
|
||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 273.5 222.3" class="d-block" height="18">
|
||
<path
|
||
d="M273.5 26.3a109.77 109.77 0 0 1-32.2 8.8 56.07 56.07 0 0 0 24.7-31 113.39 113.39 0 0 1-35.7 13.6 56.1 56.1 0 0 0-97 38.4 54 54 0 0 0 1.5 12.8A159.68 159.68 0 0 1 19.1 10.3a56.12 56.12 0 0 0 17.4 74.9 56.06 56.06 0 0 1-25.4-7v.7a56.11 56.11 0 0 0 45 55 55.65 55.65 0 0 1-14.8 2 62.39 62.39 0 0 1-10.6-1 56.24 56.24 0 0 0 52.4 39 112.87 112.87 0 0 1-69.7 24 119 119 0 0 1-13.4-.8 158.83 158.83 0 0 0 86 25.2c103.2 0 159.6-85.5 159.6-159.6 0-2.4-.1-4.9-.2-7.3a114.25 114.25 0 0 0 28.1-29.1"
|
||
fill="currentColor"></path>
|
||
</svg>
|
||
</a>
|
||
</li>
|
||
<li class="mr-3">
|
||
<a href="https://www.facebook.com/GitHub" title="GitHub on Facebook" style="color: #959da5;">
|
||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 15.3 15.4" class="d-block" height="18">
|
||
<path
|
||
d="M14.5 0H.8a.88.88 0 0 0-.8.9v13.6a.88.88 0 0 0 .8.9h7.3v-6h-2V7.1h2V5.4a2.87 2.87 0 0 1 2.5-3.1h.5a10.87 10.87 0 0 1 1.8.1v2.1h-1.3c-1 0-1.1.5-1.1 1.1v1.5h2.3l-.3 2.3h-2v5.9h3.9a.88.88 0 0 0 .9-.8V.8a.86.86 0 0 0-.8-.8z"
|
||
fill="currentColor"></path>
|
||
</svg>
|
||
</a>
|
||
</li>
|
||
<li class="mr-3">
|
||
<a href="https://www.youtube.com/github" title="GitHub on YouTube" style="color: #959da5;">
|
||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 19.17 13.6" class="d-block" height="16">
|
||
<path
|
||
d="M18.77 2.13A2.4 2.4 0 0 0 17.09.42C15.59 0 9.58 0 9.58 0a57.55 57.55 0 0 0-7.5.4A2.49 2.49 0 0 0 .39 2.13 26.27 26.27 0 0 0 0 6.8a26.15 26.15 0 0 0 .39 4.67 2.43 2.43 0 0 0 1.69 1.71c1.52.42 7.5.42 7.5.42a57.69 57.69 0 0 0 7.51-.4 2.4 2.4 0 0 0 1.68-1.71 25.63 25.63 0 0 0 .4-4.67 24 24 0 0 0-.4-4.69zM7.67 9.71V3.89l5 2.91z"
|
||
fill="currentColor"></path>
|
||
</svg>
|
||
</a>
|
||
</li>
|
||
<li class="mr-3 flex-self-start">
|
||
<a href="https://www.linkedin.com/company/github" title="GitHub on Linkedin" style="color: #959da5;">
|
||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 19 18" class="d-block" height="18">
|
||
<path
|
||
d="M3.94 2A2 2 0 1 1 2 0a2 2 0 0 1 1.94 2zM4 5.48H0V18h4zm6.32 0H6.34V18h3.94v-6.57c0-3.66 4.77-4 4.77 0V18H19v-7.93c0-6.17-7.06-5.94-8.72-2.91z"
|
||
fill="currentColor"></path>
|
||
</svg>
|
||
</a>
|
||
</li>
|
||
<li>
|
||
<a href="https://github.com/github" title="GitHub's organization" style="color: #959da5;">
|
||
<svg version="1.1" width="20" height="20" viewBox="0 0 16 16" class="octicon octicon-mark-github"
|
||
aria-hidden="true">
|
||
<path fill-rule="evenodd"
|
||
d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z">
|
||
</path>
|
||
</svg>
|
||
</a>
|
||
</li>
|
||
</ul>
|
||
<ul class="list-style-none d-flex text-gray">
|
||
<li class="mr-3">©
|
||
<script type="text/javascript">document.write(new Date().getFullYear());</script> GitHub, Inc.</li>
|
||
<li class="mr-3"><a
|
||
href="https://docs.github.com/github/site-policy/github-terms-of-service"
|
||
class="link-gray">Terms </a></li>
|
||
<li><a href="https://docs.github.com/github/site-policy/github-privacy-statement"
|
||
class="link-gray">Privacy </a></li>
|
||
</ul>
|
||
</div>
|
||
</div>
|
||
</main>
|
||
|
||
<script type="text/javascript">
|
||
$(document).ready(function () {
|
||
$(".toggle > *").hide();
|
||
$(".toggle .name").show();
|
||
$(".toggle .name").click(function () {
|
||
$(this).parent().children().not(".name").toggle(400);
|
||
$(this).parent().children(".name").toggleClass("open");
|
||
})
|
||
});
|
||
</script>
|
||
|
||
</body>
|
||
</html> |