Introduction
CodeQL is an industry-leading semantic code analysis engine according to here. If you have heard of semantic code analysis before, then this is the one that is free for any researchers. CodeQL lets you query code as though it were data and find vulnerabilities among databases by writing a query.
Prerequisites
Basically, it’s rather easy to install the CLI by following the document. But, since I’ll use VSCode to manage the CLI, I check-out the “starter” workspace instead of obtaining a local copy of the CodeQL queries under $HOME/codeql-home/.
After all were done, you should have directories structure like:
Don’t forget to install the CodeQL extension into your VSCode, and follow the instruction to finish the rest of the things. Especially, to point the CLI to your local copy.
Write our first query 🎉
Finally, we’re gonna start writing our very first query.
Step 1: Use the “File > Open Workspace” command and select the Workspace file, vscode-codeql-starter.code-workspace
Step 2: Click the CodeQL icon in Activity Bar and load a database (I’m using a JavaScript project here) by clicking the “plus”
Step 3: Click the example.ql file in the Workspace under codeql-custom-queries-{language} directory
Final Step: Give it a simple snippet!!
import javascriptselect "Hello, World!"
This is how it goes at last.
We succeed to execute the query! 🥳🥳🥳
