CodeQL: DIY SAST (and head). Part 1

Hello, Habr!

, (SAST) . SAST- , , , , . , . .

, -, , . , , , , , ( -, -) .

CodeQL, , . CodeQL . , , .

CodeQL- ( ) , - .

1. CodeQL

2. CodeQL

3.

4. LGTM

5. CodeQL

6.

7. CodeQL

8. ?

9.

CodeQL

CodeQL – open-source , SQL / . SAST (Static Application Security Testing).

, , . , , . , , , 5 for/while.

, , , .

CodeQL – Semmle, 2020 GitHub Security Lab. GitHub . 2000 QL-, , JavaScript C++.

CodeQL , (, , SemGrep), «» , , ( , ).

: C/C++, C#, Java, Go, Python, JavaScript/TypeScript. , .

CodeQL :

1. , CI/CD .

   
   
   
   
   

2. Visual Studio Code ad-hoc .

   
   
   
   
   

3. - LGTM, GitHub-.

   
   
   
   
   

CI/CD GitHub.

? . GitHub CTF bug bounty , , (CVE), 0-day .

CodeQL

, CodeQL :

1. , , , .

   
   
   
   
   

2. . – , ( , , . .), – . .

   
   
   
   
   

3. / , .
   
   0-day , . , , QL, .

   
   
   
   
   

4. CodeQL ( , , ).

   
   
   
   
   

QL , , , .

, CodeQL LGTM.

, . .

, Cross-Site Scripting:

( ), , :

VSCode:

CodeQL ( ), ( GET-) , . isSanitizer , , . , .

, ( ) , (. . source) , (. . sink).

LGTM

CodeQL - LGTM (Looks Good To Me). open-source , GitHub-.

CodeQL:

1. -: https://lgtm.com/query/.

   
   
   
   
   

2. JavaScript, meteor/meteor.

   
   
   
   
   

3. .

   
   
   
   
   

4. Run .

   
   
   
   
   

, , :

import javascript
from ClassExpr ce
select ce
      
      

        
        
        
      

    
        
        
        
      
      

        
        
        
      

    
    

, client.js, eval()



, :

import javascript
from CallExpr call
where call.getCalleeName() = "eval" 
and call.getLocation().getFile().getRelativePath().matches("%client.js")
select call, call.getAnArgument()
      
      

        
        
        
      

    
        
        
        
      
      

        
        
        
      

    
    

( ) ( eval()



) , . .

CodeQL

LGTM , CodeQL CLI .

, .

, , :

1. VSCode CodeQL extension.

   
   
   
   
   

2. CodeQL CLI , , codeql
   
   
   
   .

   
   
   
   
   

3. codeql %PATH%
   
   
   
   .

   
   
   
   
   

4. VSCode CodeQL ( , ):
   
   git clone https://github.com/github/vscode-codeql-starter/
   
   
   
   

   
   
   
   
   

   git submodule update --init --remote
   
   
   
   

   
   
   
   
   

   ( ) , ( JS codeql-custom-queries-javascript
   
   
   
   ).

   
   
   
   
   

5. ( , , ), ( JS) https://github.com/githubsatelliteworkshops/codeql/releases/download/v1.0/esbenabootstrap-pre-27047javascript.zip
   
   .

   
   
   
   
   

6. .

   
   
   
   
   

7. VSCode Open workspace .

   
   
   
   
   

8. VSCode CodeQL ( ) , .

   
   
   
   
   

9. . (. 4) example.ql
   
   
   
   .

   
   
   
   
   

10. ,

    
    
    
    
    

import javascript
from Expr e
select “Wazzup!”
      
      

        
        
        
      

    
        
        
        
      
      

        
        
        
      

    
    

CodeQL . . , . , (AST), . CodeQL , . – , . , CodeQL , regex'.

CodeQL . , .

. JS my-js-codebase



, :

codeql database create my-js-codebase --language=javascript

, ( Maven Java)

– VSCode. CodeQL → “Choose Database from Folder”

, - , .

CodeQL

, CodeQL JavaScript.

, jQuery- “$“ ( $(arg1, arg2)) , , . jQuery:

/**
* @name QueryName
* @kind problem
* @id my_id_1
*/
// -- 

import javascript 
//      CodeQL   
//     JavaScript.
//        
//      ,   .
//  semmle.javascript.NodeJS  python.

from CallExpr dollarCall, Expr dollarArg 
//   dollarCall  CallExpr 
//     dollarArg  Expr.
// CallExpr -     ,  
//          .
// Expr - ,    . 
//   Object.entries = function(obj)   
//     , Object, Object.entries, entries, 
//   function(obj), obj.

where dollarCall.getCalleeName() = "$"
//  ,      .
//  ,     (..  
//   ) getCaleeName() (   
//    )   dollarCall (  
//     )  "$"

and dollarArg = dollarCall.getArgument(0)
//     AND    
//     ,   .
//       ,     $ 
//      dollarArg   ( , 
//        ).

select dollarCall, dollarArg 
//   ,   (    
//   )     .

      
      

        
        
        
      

    
        
        
        
      
      

        
        
        
      

    
    

, SQL, . , , CodeQL.

?

, CodeQL , .

( , open-source) - LGTM.

- , CodeQL. , CodeQL . :

https://lab.github.com/githubtraining/codeql-u-boot-challenge-(cc++) – CodeQL C/C++

https://lab.github.com/githubtraining/codeql-for-javascript:-unsafe-jquery-plugin – JavaScript Bootstrap CodeQL.

- GitHub, CodeQL Java- ( XStream):

, CodeQL, , , .

It is dangerous to go alone! CodeQL – , , , . CodeQL (, , ). Telegram, . , CodeQL.

- https://t.me/codeql !

, :

https://help.semmle.com/codeql/ – CodeQL .

https://help.semmle.com/QL/ql-handbook/ – .

https://help.semmle.com/QL/learn-ql/ – CodeQL .

https://securitylab.github.com/get-involved – , CodeQL, , , Slack- () CodeQL.

Disclaimer

. GitHub CodeQL . , OSI-approved . GitHub:

GitHub CodeQL can only be used on codebases that are released under an OSI-approved open source license, or to perform academic research, or to generate CodeQL databases for or during automated analysis, continuous integration (CI) or continuous delivery (CD) in the following cases: (1) on any Open Source Codebase hosted and maintained on GitHub.com, and (2) to test CodeQL queries you have released under an OSI-approved open source software license. It can't be used for automated analysis, continuous integration or continuous delivery, whether as part of normal software engineering processes or otherwise, except in the express cases set forth herein. For these uses, contact the sales team.