93 questions
0
votes
0
answers
40
views
CodeQL documentation
recently I have been using CodeQL and been trying to read through the documentation to find what methods I should use. I do not know if I am looking in the wrong place or if their documentation is bad....
- 23
1
vote
1
answer
69
views
How can I run multiple CodeQL query suites in a single GitHub Actions workflow?
My goal is to run multiple CodeQL query packs and suites (like security-extended and audit) in one GitHub Action workflow, and ideally merge the results into one SARIF file for upload to GitHub Code ...
- 19
0
votes
1
answer
54
views
CodeQL Assignment do not report all assignments in code
I am using following Java code
package com.example;
public class TestClass {
public String s = "test";
public void directCall() {
s = "test2";
...
- 796
0
votes
0
answers
58
views
CSRF Vulnerability in nodejs
I was getting Missing CSRF Vulnerability in codeQL to fix that i implemented it , i am using both session base and auth base (Jwt)
STEP 1 - Installed Lusca and Enabled Sessions (CSRF needs them) - npm ...
- 23
0
votes
1
answer
213
views
Errors with Setting Up custom CodeQL queries
I have been trying to setup the following query in a linux enviorment.
/**
* @name SpectreV1
* @description Finds potential spectre v1 gadgets
* @kind path-problem
* @problem.severity warning
* @...
- 37
1
vote
0
answers
112
views
Customising ApiClient class generated by OpenApi3 generator
I am looking at a Microservices Gradle project which has got flagged by CodeQL scan with the alert: "'TrustManager' that accepts all certificates".
When I looked into the alert, the class ...
- 457
1
vote
0
answers
54
views
Is it possible to track clone value in CodeQL
Is it possible to search for UAF by tracking clones of arguments from the "free" function? For example, in this code:
/**
* @name Use after free
* @kind path-problem
* @id cpp/use-after-...
- 21
0
votes
0
answers
17
views
Global taintflow not marking objects as tainted from sourceNode when returned from a method
I want to write a codeql query in which the sourceNode is a parameter of a class and the sink is any object it affects (for my personal usecase I want to get all instances where the value eventually ...
0
votes
1
answer
500
views
Changing the severity or relevance of CodeQL alerts in GitHub Advanced Security silently fails
I have an GitHub Advanced Security environment running in my GitHub enterprise account. When it uses either the default configuration, or the advanced configuration that I've built, it works. ...
0
votes
0
answers
81
views
How to display full text in CodeQL exported results?
Using CodeQL CLI, when I decode the results of query below to get initialized values, the output for longer strings are truncated (For instance, instead of Hello World in full, it appears as Hel .. ...
- 1
0
votes
1
answer
599
views
CodeQL in Github not showing found issues for custom queries
I am running CodeQL inside a private organization with advanced security enabled. It is working good for default queries. The queries security-extended and security-and-quality are executed, results ...
- 1,374
0
votes
1
answer
110
views
VerifyTests: ‘TestContext' is a type, which is not valid in the given context
We recently started to use VerifyTests/Verify on Mstest .Net 8. Projects.
One of my colleagues has an error on local build:
CS0119 'TestContext' is a type, which is not valid in the given
context
...
- 28.8k
0
votes
1
answer
306
views
Ignore lines of Javascript when running CodeQL
Qt have a distinct way of importing JavaScript resources from other JavaScript resources, where the syntax is:
.import "filename.js" as Qualifier
More about this syntax is found here.
The ...
- 19
0
votes
1
answer
114
views
Codeql Filter-SARIF Paths Not Ignored in Master Branch but Work in Other Branches
I'm using filter-sarif in my codeql yml file to ignore certain paths. This setup works perfectly in a feature branch where I initially added the ignore paths. However, after merging the changes into ...
0
votes
0
answers
294
views
CodeQL Environment Variables Not Passed to XCode Task Azure DevOps
I have an Azure DevOps build pipeline. In that pipeline I am trying to build a Swift codebase and scan it with CodeQL. I am using indirect tracing to separate the CodeQL and build steps into separate ...
- 2,787
1
vote
1
answer
532
views
Validating file paths to satisfy GitHub CodeQL's "Uncontrolled data used in path expression" alert
I'm writing functions for a Python package to register files from a file system to an SQL database, and GitHub's CodeQL has flagged that the file paths are a potential security risk.
I have ...
1
vote
1
answer
158
views
Write CodeQL Script to Check Pointers Before Pointer Field Access
Given the example code below:
#include <stdio.h>
#include <stdlib.h>
typedef struct {
int name;
} type4;
typedef struct {
int name;
type4 *p4;
} type3;
typedef struct {
...
- 11
0
votes
1
answer
360
views
Sample Codeql Query for SpringBootApplication
I am trying to learn Codeql analysis tool and running into some issues while running the query.
I am able to successfully create the database upon running the command:
codeql database create
But ...
- 433
2
votes
1
answer
58
views
How to get all the initializations of empty byte array in CodeQL for Go
I have a variable that is set as a global variable in the package (not inside a function):
var myArr []byte = make([]byte, 0)
I wanted to find all the places where a variable is initialized with make(...
- 13.9k
0
votes
1
answer
106
views
A codeql sensitive configuration detection problem
My company's development project uses yml files as configuration files. How can I use codeql to detect whether these yml files contain sensitive information such as plain text passwords?
When I ...
- 21
1
vote
3
answers
2k
views
Custom CodeQL query in Azure DevOps in yaml pipeline gives error: No queries defined for javascript
I want to run custom codeql queries for Advanced Security in Azure DevOps (this is a feature that is now available in Azure DevOps not only GitHub). The built in default queries like security-and-...
- 1,157
1
vote
1
answer
653
views
Rewriting URL request function to satisfy GitHub CodeQL server side request forgery (SSRF) warning
I'm working on a function that returns a HTTP response from https://pypi.org/simple/ when Python's pip installer requests it for a package. When pushing my code onto GitHub, the CodeQL checks warn of ...
0
votes
1
answer
61
views
Windows capture outputs into file and play it back
I am captuing stdout and stderror of running a process into a file in windows:
.\run-process > debug-log.txt 2>&1
But the problem is this combines stdout and stderror into a single file ...
- 1,724
0
votes
0
answers
41
views
Simple regex, but polynomial regular expression error from CodeQL [duplicate]
I have a really simple regex (/<[^>]*?>/g) which strips tags and leave text. I know it isn't perfect, and I know that I should be used a DOM parser for such a test, but please humour me :-)
...
- 5,541
0
votes
2
answers
256
views
Todo comment violation not reported in github codeql code scanning
I am new to github advance security. I have create a Github repo and enabled Codeql scanning. And used queries: security-extended,security-and-quality in codeql.yml file. Still if I add a comment in ...
- 159
1
vote
0
answers
730
views
Why am I getting this error when using dataflow in Codeql
I am working on creating a query using codeql so that I can detect CWE vulnerabilities in Java code. My query executes just fine using the VS Code CodeQL extension, so I know that logically it works ...
- 43
1
vote
1
answer
961
views
Running CodeQL Action always looks for the latest CLI version
I have a CodeQL CLI bundle (v2.13.5) stored on an on-prem Artifactory repository. I want to fetch this, store it using the tool-cache action and then run the CodeQL action on GitHub Actions.
I have ...
- 2,787
0
votes
0
answers
269
views
Missing Override annotation
Working through some code alerts and came across this note on CodeQL:
Missing Override annotation.
along with the following description:
This method overrides abstractEntity.canEqual; it is advisable ...
- 1
1
vote
1
answer
758
views
Forcing CodeQL to Analyze all files in different compiled projects
Suppose you wanted to run CodeQL analysis across a large set of repos that contain Java code.
Some repos have mvn/ant/gradle setup properly to build their code.. CodeQL results look solid + works ...
- 2,135
-1
votes
2
answers
1k
views
How does the autobuild step work in Github Advanced Security for Azure Devops?
I have a yaml pipeline to do code scanning and dependency scanning with Github Advanced Security for Azure devops:
pool:
vmImage: ubuntu-latest
steps:
- task: AdvancedSecurity-Codeql-Init@1
...
- 3,645
0
votes
1
answer
93
views
Codeql Scanning Alerts "Dereferenced variable may be null"
In my code I get the above warning. Here is the part of the code where I get it,
@Data
@Builder
public class Employee {
private String email;
@Data
@Builder
public static class Department{
...
0
votes
1
answer
585
views
CodeQL analysis TRAP import
On CodeQL analysis, I faced the below issue with
Dataset codeql_databases/go/db-go has been finalized and does not support further TRAP import.
The github/codeql-action/init is used for the creation ...
- 21
0
votes
0
answers
55
views
c# get paths to specific method
How can I get all different paths to specific method?
import csharp
import DataFlow::PathGraph
class TaintTrackingConfiguration extends TaintTracking::Configuration {
TaintTrackingConfiguration() {...
- 39
1
vote
0
answers
141
views
Codeql C# Cannot directly invoke the abstract method
I'm trying to execute a simple CodeQL query without any success.
The following query should just list calls to GetSanitizedName method. Small example to reproduce the error(s):
set -x
TEST_DIR="/...
- 39
1
vote
1
answer
2k
views
Why does CodeQL not populate the CodeQL database with a Gradle build?
I have a repository that has a Java codebase that is built using Gradle. In the Azure DevOps pipeline for this application I am first running the following command to setup the CodeQL build tracing:
...
- 2,787
1
vote
1
answer
787
views
Can I make the configuration for the analysis in php? on codeQL
I have this error, I read that it can be configured to scan php code, but it fails. What am I doing wrong?
Languages from configuration: php
Error: Did not recognize the following languages: php
name: ...
0
votes
1
answer
343
views
Get Process ID of the current running build on Azure DevOps
I'm trying to piece together some scripts to add CodeQL scanning to a existing build pipeline on Azure DevOps.
For compiled languages such as .NET, a pre-compile command is required to create a CodeQL ...
- 2,787
1
vote
2
answers
2k
views
Github Advanced Security for Azure DevOps : CodeQL analyzer not working
Anyone has any experience with «GitHub Advanced Security for Azure DevOps»?
https://learn.microsoft.com/en-us/azure/devops/repos/security/configure-github-advanced-security-features?view=azure-devops&...
- 279
0
votes
1
answer
4k
views
Codeql failing to scan github repository storing only java code
I'm trying to scan java code with codeql.
In my repo I have some class files:
src/com/org/proj/Main.java
src/com/org/proj/Task.java
It's very simple and was built by Eclipse and I only exported the ...
- 76
0
votes
1
answer
620
views
inefficient regular expression in javascript
Hi in our below code using codeql scanning got an alert that "This part of the regular expression may cause exponential backtracking on strings starting with '0' and containing many repetitions ...
- 43
2
votes
1
answer
409
views
CodeQL: Gin / MongoDB API - Database query built from user-controlled sources error
I have a simple Golang Gin API that uses MongoDB as the backend database. My team is using GitHub CodeQL, so we want to be sure we are following the best standards. However, we continue to get this ...
- 781
0
votes
1
answer
704
views
CodeQL Java Analysis - missing parameters
for various reasons I decided to set an environment variable in IntelliJ for the output directory defined in pom.xml.
<plugin>
<groupId>org.apache.maven.plugins&...
0
votes
1
answer
177
views
additional TaintStep for taint tracking in python programs
I am using codeql TaintTracking and I noticed by default it does not follow data for functions it doesn't know.
for exapmple for this code:
import pd
a = src + anything
df = pd.DataFrame(a)
if src is ...
- 592
-4
votes
2
answers
228
views
Bad HTML filtering regexp [closed]
do you know why CodeQL suggest this? what is wrong in the code?
values = vals.replace(/(^\s*<!--)|(-->\s*$)|\s+/g, '').split(',');
This regular expression only parses --> and not --!> as a ...
1
vote
0
answers
419
views
What is the correct way to organize (and referer to) a set of CodeQL queries?
I am learning CodeQL and I now have several custom CodeQL queries for a Java library that we use. The queries run in VSCode, if I run them one by one. I would like to be able to use them duing the ...
- 33k
-1
votes
1
answer
387
views
running precommit hooks with codeql/GHAS sast scans?
I'm just getting started with CodeQL and we have a requirement from our devs to CodeQL sast scans as precommit hooks. I could not find any docs on how to set up CodeQL to make it run on my machine.
...
- 177
2
votes
2
answers
821
views
How do I display full string in a CodeQL exported result?
Converting a.getChild(1) to a string using toString()
test.ql
/**
* @id custom
* @kind problem
* @problem.severity warning
*
*/
import javascript
from ObjectExpr oe, Property p1, int i, AstNode ...
- 47
0
votes
1
answer
2k
views
GitHub Actions CodeQL init action failed Not Found
I am trying to configure CodeQL scanning on my repo. For that purpose I am using the template provided by GitHub:
# For most projects, this workflow file will not need changing; you simply need
# to ...
- 669
0
votes
1
answer
1k
views
Why does codeql create database run into issue?
It's my first time using codeql,the dir demo contains a simple cpp file,i tried to run a demo like this codeql database create ./demo-db -s . --language=cpp . However,it ran into issue,here are the ...
- 11
1
vote
1
answer
657
views
CodeQL dataflow query on a C program not finding a simple path from an assignment expression to a function's argument
I am new to CodeQL and have started learning about dataflow queries for C/C++ programs. Following is a excerpt of a C program that I want to analyse:
int main(int argc, char * argv[])
{
unsigned ...
- 95