This commit is contained in:
Michael Hohn
2024-12-03 14:50:51 -08:00
committed by =Michael Hohn
parent 1d483db5a9
commit 58803c7f45

View File

@@ -1,40 +1,36 @@
* NEXT Introduction to CodeQL * Introduction to CodeQL
The full CodeQL and GHAS integration is shown [[https://htmlpreview.github.io/?https://github.com/hohn/codeql-intro-csharp/blob/mh-wip/codeql-system.drawio.svg][here]]. This document is intended The document [[./CodeQL-workshop-overview-only.pdf]] gives a very short overview
to support CodeQL workshops and presentations; it focuses on the the section just to highlight the language capabilities.
labeled 'CodeQL Running Sequence', in grids C2 through E5.
This document is intended to support CodeQL workshops and presentations; it
focuses on the the section labeled 'CodeQL Running Sequence', in grids C2
through E5 of the full CodeQL and GHAS integration diagram shown [[https://htmlpreview.github.io/?https://github.com/hohn/codeql-intro-csharp/blob/mh-wip/codeql-system.drawio.svg][here]].
The section 'CodeQL query development sequence, using CI artifacts', in grids H0 The section 'CodeQL query development sequence, using CI artifacts', in grids H0
through J4, is a subset without database building. through J4, is a subset without database building.
* TODO CodeQL overview
- /Users/hohn/local/codeql-dataflow-sql-injection/CodeQL-workshop-overview-only.pdf
There are two identifyable tracks for codeql users: [[*CodeQL for Devops and Administrators][devops]] and [[*CodeQL for Query Writers][query writers]]. There are two identifyable tracks for codeql users: [[*CodeQL for Devops and Administrators][devops]] and [[*CodeQL for Query Writers][query writers]].
The first one focuses on setup, deployment, and query selection; the second on The first one focuses on setup, deployment, and query selection; the second on
query writing. There is significant overlap; the [[*CodeQL CLI Setup][CodeQL CLI Setup]] is needed by query writing. There is significant overlap; the [[*CodeQL CLI Setup][CodeQL CLI Setup]] is needed by
both. both.
* TODO CodeQL CLI Setup * CodeQL CLI Setup
#+BEGIN_SRC text After you have installed the CodeQL CLI proceed with setting up this repository:
#+BEGIN_SRC sh
# Clone repository
cd && mkdir -p work-gh && cd work-gh
git clone https://github.com/hohn/codeql-intro-csharp.git
# Initialize CodeQL
cd ~/work-gh/codeql-intro-csharp cd ~/work-gh/codeql-intro-csharp
codeql resolve packs codeql resolve packs
codeql pack install codeql pack install
#+END_SRC #+END_SRC
Using
#+BEGIN_SRC yaml Using the file =qlpack.yml=, this will install the packs matching this codeql
library: false version, then create =codeql-pack.lock.yml=
name: sample/csharp-sql-injection
version: 0.0.1
dependencies:
codeql/csharp-all: "*"
#+END_SRC
with
: codeql pack install
will install the packs matching this codeql version, then create
: codeql-pack.lock.yml
which pins the version. which pins the version.
* DONE Test Problem Setup * Setup Test Problems
** Hello World Sample ** Hello World Sample
#+BEGIN_SRC sh #+BEGIN_SRC sh
# Install sdk # Install sdk
@@ -56,8 +52,7 @@
./bin/Debug/net9.0/HelloWorld ./bin/Debug/net9.0/HelloWorld
#+END_SRC #+END_SRC
** SQL Injection Sample
** SQL Injection
#+BEGIN_SRC sh #+BEGIN_SRC sh
# Project Setup # Project Setup
cd ~/work-gh/codeql-intro-csharp/ cd ~/work-gh/codeql-intro-csharp/
@@ -96,7 +91,7 @@
# Parse error near line 2: no such table: users # Parse error near line 2: no such table: users
#+END_SRC #+END_SRC
* DONE SQL Injection Code Compilation and Sample Run * SQL Injection Code Sample Run
#+BEGIN_SRC sh #+BEGIN_SRC sh
# All run in pwsh, typical prompt is # All run in pwsh, typical prompt is
# PS /Users/hohn/work-gh/codeql-intro-csharp> # PS /Users/hohn/work-gh/codeql-intro-csharp>
@@ -128,7 +123,7 @@
#+END_SRC #+END_SRC
* NEXT Build CodeQL Database * Build CodeQL Database
To get started, build the codeql database (adjust paths to your setup). To get started, build the codeql database (adjust paths to your setup).
The bash version The bash version
@@ -208,7 +203,6 @@
dotnet build codeql-intro-csharp.sln dotnet build codeql-intro-csharp.sln
#+END_SRC #+END_SRC
* TODO CodeQL VS Code Setup
* TODO CodeQL for Devops and Administrators * TODO CodeQL for Devops and Administrators
- https://docs.github.com/en/code-security/codeql-cli/codeql-cli-manual - https://docs.github.com/en/code-security/codeql-cli/codeql-cli-manual
- https://github.com/hohn/codeql-visual-guides/blob/master/codeql-system.drawio.pdf - https://github.com/hohn/codeql-visual-guides/blob/master/codeql-system.drawio.pdf