DOCSEARCHbyAlgolia
Submit Docs

CodeQL Standard Libraries and Queries

repository·main·Indexed 27 days ago

https://github.com/github/codeql

An open-source repository of standard libraries and queries powering GitHub Advanced Security for semantic code analysis. It includes language-specific support for Go, Java, C#, and JavaScript/TypeScript, as well as tools for generating stubs, managing JavaScript externs, and utilizing Automodel extraction queries for LLM prompt creation.

Tokens
215.6K
Snippets
410
Records
1.3K
Agent score
91%

What's inside CodeQL

  2. Overview of YEAST framework

    main
    YEAST (YEAST Elaborates Abstract Syntax Trees) is a framework used to transform tree-sitter parse trees before they are extracted into a CodeQL database. It sits between the tree-sitter parser and the TRAP extractor, allowing developers to rewrite parts of the AST according to declarative rules. This is primarily used for 'desugaring'—converting concrete syntax (like Ruby's for loop) into a simplified abstract syntax (like .each blocks) so that CodeQL queries can be more concise and effective.

  4. Overview of CodeQL pack types

    main

    CodeQL uses three distinct types of packs to manage expertise and dependencies:

    TypePurpose
    Query packsDesigned to be run. They include query sources and pre-compiled representations of all transitive dependencies for efficient execution.
    Model packsUsed to model dependencies not supported by standard libraries. They allow queries to recognize specific sources, sinks, and flow steps.
    Library packsDesigned to be used by other packs (query or library packs). They contain libraries but do not contain queries themselves and are not compiled separately.

  7. Understand CodeQL core concepts

    main

    CodeQL relies on several key components to perform static analysis:

    • CodeQL database: A directory containing queryable data extracted from source code, a source reference for displaying results, query results, and log files.
    • Extractor: A tool that produces relational data and source references from input files to build a CodeQL database.
    • CodeQL packs: Units used to create, share, and run queries, libraries, and models. They can be query packs, library packs, or model packs.
    • Data extensions: Files used to model sources and sinks for custom dependencies without needing to write new queries or full libraries.
    • Source reference: A mechanism (such as a source archive directory, ZIP archive, or git repository) that allows CodeQL to retrieve the original source file contents based on absolute filenames used during extraction.

  11. Understand JavaScript externs definitions

    main

    The javascript/externs directory contains externs definitions used to improve the precision of JavaScript analyses within CodeQL. These definitions provide type information for standard environments and libraries that the analyzer might otherwise treat as unknown or imprecise.

    Externs are organized into five functional categories:

    • es: ECMAScript language standard definitions (sourced from Google Closure Compiler).
    • web: Web standards and browser-specific extensions (sourced from Google Closure Compiler).
    • vm: Specific JavaScript Virtual Machine definitions (sourced from Google Closure Compiler).
    • nodejs: Common Node.js module definitions (generated from DefinitelyTyped TypeScript definitions with custom extensions).
    • lib: Definitions for popular third-party JavaScript libraries.

  12. Understand the JavaScript extractor architecture

    main

    The JavaScript extractor is responsible for parsing ECMAScript (including proposed and historic extensions) and generating Abstract Syntax Trees (ASTs) for both JavaScript and TypeScript.

    Key components include:

    • Parser: Located in src/com/semmle/jcorn.
    • JavaScript AST classes: Located in src/com/semmle/js/ast.
    • TypeScript AST classes: Located in src/com/semmle/ts/ast.

    Note: The extractor cannot currently be built in isolation because it depends on various libraries that are not bundled with the source code.