codeql-lab/codeql-jedis/README.org

• Jedis Codeql Setup
• Jedis Codeql Modeling
  • Setup and Start
  • Using the Editor
  • Relevant Queries
  • Primary Query File
  • Experiment with test clone

Jedis Codeql Setup

• fork at https://github.com/hohn/jedis

• github db build: enable code scanning, advanced config

  • only java-kotlin, build-mode: none.
  • creates https://github.com/hohn/jedis/blob/master/.github/workflows/codeql.yml
  • action run at https://github.com/hohn/jedis/actions/workflows/codeql.yml

  • db download

      # list dbs
      curl -H "Authorization: token $GITHUB_TOKEN" \
           https://api.github.com/repos/hohn/jedis/code-scanning/analyses
    
    
      # Get DB via curl
      cd ~/work-gh/codeql-lab/assets
      curl -H "Authorization: token $GITHUB_TOKEN" \
           -H "Accept: application/zip" \
           -L \
           https://api.github.com/repos/hohn/jedis/code-scanning/codeql/databases/java \
           -o jedis-database-gh.zip

  • db at ~/work-gh/codeql-lab/assets/jedis-database-gh.zip

• local db build:

    cd ~/work-gh/codeql-lab/
  
    # Add the submodule
    git submodule add https://github.com/hohn/jedis extern/jedis
  
    # Initialize and clone the submodule
    git submodule update --init --recursive
  
  
    # Build directly once to resolve any errors
    cd ~/work-gh/codeql-lab/extern/jedis
    mvn install -DskipTests=true -Dmaven.javadoc.skip=true -B -V
  
    # Build under codeql
    # Step 1: Clean any prior Maven builds
    cd ~/work-gh/codeql-lab/extern/jedis
    mvn clean
  
    # Step 2: Run CodeQL DB creation with mvn install
    cd ~/work-gh/codeql-lab
    codeql database create assets/jedis-db-local \
           --overwrite \
           --language=java \
           --command="mvn install -DskipTests=true -Dmaven.javadoc.skip=true -B -V" \
           --source-root=extern/jedis

Jedis Codeql Modeling

Setup and Start

  # Step 1: Go to your CodeQL lab directory
  cd ~/work-gh/codeql-lab

  # Step 2: Extract the prebuilt CodeQL database for the Jedis project
  unzip -q assets/jedis-db-local.zip

  # Step 3: Extract the CodeQL command-line tools (platform-specific)
  unzip -q assets/codeql-osx64.zip

  # Step 4: Change directory to the unpacked CodeQL CLI tools
  cd ~/work-gh/codeql-lab/codeql

  # Step 5: Add the CodeQL CLI directory to your shell's PATH
  # This allows you to run `codeql` from any location
  export PATH="$(pwd):$PATH"

  # Step 6: Launch Visual Studio Code with the lab workspace
  code qllab.code-workspace

  # In VS Code, perform the following setup manually:
  # - Set the current database to: jedis-db-local
  #   (Usually from the CodeQL extension pane – this connects the UI to your analysis DB)
  # - Set the CodeQL CLI executable to: ~/work-gh/codeql-lab/codeql/codeql
  #   (Tell the extension where to find the CLI you just extracted)
  # - In the CodeQL extension tab, scroll to the bottom and select:
  #   'CodeQL: Method modeling' to begin a guided modeling tutorial

Using the Editor

Note that just by starting CodeQL: Method modeling, the new file

.github/codeql/extensions/jedis-db-local-java/codeql-pack.yml

is created.

Relevant Queries

A quick grep shows

  grep 'java.*modelgen' files  |grep -v test/

  ql/java/ql/src/utils/modelgenerator
  ql/java/ql/src/utils/modelgenerator/CaptureNeutralModels.ql
  ql/java/ql/src/utils/modelgenerator/CaptureTypeBasedSummaryModels.ql
  ql/java/ql/src/utils/modelgenerator/CaptureSinkModels.ql
  ql/java/ql/src/utils/modelgenerator/CaptureContentSummaryModels.ql
  ql/java/ql/src/utils/modelgenerator/internal
  ql/java/ql/src/utils/modelgenerator/internal/CaptureModels.qll
  ql/java/ql/src/utils/modelgenerator/internal/CaptureTypeBasedSummaryModels.qll
  ql/java/ql/src/utils/modelgenerator/internal/CaptureModelsPrinting.qll
  ql/java/ql/src/utils/modelgenerator/CaptureSummaryModels.ql
  ql/java/ql/src/utils/modelgenerator/RegenerateModels.py
  ql/java/ql/src/utils/modelgenerator/CaptureSourceModels.ql
  ql/java/ql/src/utils/modelgenerator/debug
  ql/java/ql/src/utils/modelgenerator/debug/CaptureSummaryModelsPartialPath.ql
  ql/java/ql/src/utils/modelgenerator/debug/CaptureSummaryModelsPath.ql
  ql/java/ql/src/utils/modelgenerator/debug/README.md

Primary Query File

The primary query file is

../ql/java/ql/src/utils/modelgenerator/internal/CaptureModels.qll

This acts as the backbone, exposing traits like:

• SummaryModelGeneratorInput
• ModelGeneratorCommonInput
• isPrimitiveTypeUsedForBulkData(…)

• Likely common predicates such as:

  • hasNoSideEffects(…)
  • isNeutralReturn(…)
  • isBulkGetterLike(…)

  These are imported by:

  • CaptureSinkModels.ql
  • CaptureSummaryModels.ql
  • CaptureContentSummaryModels.ql
  • CaptureHeuristicSummaryModels.ql

• Design: Three Modeling Targets

  Module	Implements	Purpose
  —————————-	——————————-	————————————————
  `SummaryModelGeneratorInput`	`SummaryModelGeneratorInputSig`	Models pass-through or computed summaries
  `SourceModelGeneratorInput`	`SourceModelGeneratorInputSig`	Models user-controlled or origin taint sources
  `SinkModelGeneratorInput`	`SinkModelGeneratorInputSig`	Models taint sinks (e.g., logging, SQL, network)

• Shared Input System ModelGeneratorCommonInput provides:

  • Name formatting
  • Type filtering (isRelevantType)
  • Signature stringification
  • “Approximate output” helpers like Argument[pos].Element

  This gives a stable data interface to the rest of the system.

• Filtering logic

    private predicate relevant(Callable api) {
      api.isPublic() and
      api.getDeclaringType().isPublic() and
      api.fromSource() and
      not isUninterestingForModels(api) and
      not isInfrequentlyUsed(api.getCompilationUnit())
    }

Experiment with test clone

The needed imports are private, so clone

ql/java/ql/test/utils/modelgenerator/dataflow/CaptureSourceModels.ql

and experiment there.

  import java
  import utils.modelgenerator.internal.CaptureModels
  import SourceModels
  import utils.test.InlineMadTest

  module InlineMadTestConfig implements InlineMadTestConfigSig {
    string getCapturedModel(Callable c) { result = Heuristic::captureSource(c) }

    string getKind() { result = "source" }
  }

  import InlineMadTest<InlineMadTestConfig>