About the CodeQL for research
2 min readNov 25, 2019
Today, GitHub has a GitHub Security Lab for protecting source code on it.
- GitHub Security Advisories : This is a chanel which project owner can contact to a Security Research Team in private to try to find and fix the security problem.Then, its will public a solution when they can fix it
- GitHub Advisory Database : They try to find a defect hole of public database chancel on the databases with connect to GitHub source. And also try to protect it.
- Token Scanning : GitHubprovide services for scanning and detecting a Hard code key or token. GitHub has more than 20 formats keys to detect.They will report to cloud provider to remove that key or token.
However, the interesting point is “CodeQL” .This is code to query defects.
The example of CodeQL
Let’s play with CodeQL
- Login to your project then select the language of code and stucture of project like photo below:
2. After that , run the checking and you will see the result.
3. In addtion, GitHub has some examples of CodeQL to show and to lean about a query.
Reference
