CodeQL is an industry-leading semantic code analysis engine provided by GitHub, used to discover vulnerabilities in codebases. Its core idea is to treat code as data to be queried: by writing a single query, you can find all variants of a certain vulnerability, thereby completely eliminating the problem, and you can share the query with others to use.
Main capabilities:
- Semantic code analysis: discover vulnerabilities and insecure patterns by querying code.
- Variant finding: after writing a query, you can locate all similar occurrences of the same vulnerability throughout the codebase.
- Query sharing: you can share queries you have written with others to help them discover similar issues.
- Example queries: official examples such as UnsafeDeserialization.ql are provided.
How to use:
- Install the CodeQL extension in Visual Studio Code (downloading it means you agree to the GitHub CodeQL terms and conditions).
- Obtain a CodeQL database: search GitHub.com for the open source project you want to study, follow the instructions to download and add that project's CodeQL database to VS Code, or use the CodeQL CLI to create a CodeQL database.
- Query the code and discover vulnerabilities: clone the CodeQL starter workspace and open it in VS Code, right-click the query and select Run Query to run it. More information can be found in the official documentation.
Applicable scenarios:
- Conduct vulnerability research on open source codebases.
- Learn and practice vulnerability hunting: the official Java Capture the Flag challenge is provided, through which you can hone your vulnerability discovery skills and learn about CodeQL's taint tracking capabilities; the competition ended on June 12, but you can still participate out of interest, looking for server-side template injection vulnerabilities in open source Java projects.
- View past challenges.
Restrictions and licensing: CodeQL is free for research and open source. GitHub CodeQL may only be used in the following situations: codebases released under an OSI-approved open source license; conducting academic research; or generating CodeQL databases for automated analysis, continuous integration (CI), or continuous delivery (CD) in the following cases: (1) any open source codebase hosted and maintained on GitHub.com; (2) testing your CodeQL queries released under an OSI-approved open source software license. Except for the explicitly stated situations above, CodeQL may not be used for automated analysis, continuous integration, orcontinuous delivery (whether or not it is part of a normal software engineering process). If you need these uses, please contact the sales team.
Other information: there is an official community forum.
