CodeqlLearn

AST

学习过程

环境搭建

真实例子

下载

生成数据库

codeql database create <database> --language=<language-identifier>

codeql database create D:\codeqldb/javasec --language=java --command="mvn clean install --file pom.xml -Dmaven.test.skip=true" --source-root=./javasec

 跳过测试,构建
 --command="mvn clean install --file pom.xml -Dmaven.test.skip=true"
 无论项目结果如何,构建从不失败
 --command="mvn -fn clean install --file pom.xml -Dmaven.test.skip=true"

codeql database init --source-root=<src> --language java <db>
codeql database trace-command --working-dir=<src> <db> <java command>
codeql database index-files --language xml --include-extension .xml --working-dir=<src> <db>
codeql database finalize <db>

codeql database upgrade database/javasec

编译与非编译

基础查询

过滤 Method

根据Method name查询

import java
from Method method
where method.hasName("toObject")
select method

import java
from Method method
where method.hasName("toObject")
select method, method.getDeclaringType()

根据Method name 和 interface name 查询

import java
from Method method
where method.hasName("toObject") and method.getDeclaringType().getASupertype().hasQualifiedName("org.apache.struts2.rest.handler", "ContentTypeHandler")
select method

Call和Callable

MethodAccess

import java
from MethodAccess call, Method method
where method.hasName("toObject") and method.getDeclaringType().getASupertype().hasQualifiedName("org.apache.struts2.rest.handler", "ContentTypeHandler") and call.getMethod() = method
select call

import java
from MethodAccess call, Method method
where method.hasName("toObject") and method.getDeclaringType().getAnAncestor().hasQualifiedName("org.apache.struts2.rest.handler", "ContentTypeHandler") and call.getMethod() = method
select call

数据流跟踪

import java
import semmle.code.java.frameworks.spring.SpringController
import semmle.code.java.dataflow.TaintTracking
from Call call,Callable parseExpression,SpringRequestMappingMethod route
where
 call.getCallee() = parseExpression and 
 parseExpression.getDeclaringType().hasQualifiedName("org.springframework.expression", "ExpressionParser") and
 parseExpression.hasName("parseExpression") and 
 TaintTracking::localTaint(DataFlow::parameterNode(route.getARequestParameter()),DataFlow::exprNode(call.getArgument(0))) 
select route.getARequestParameter(),call

class MyConfig extends DataFlow::Configuration {
 MyConfig() { this = "Myconfig" }
 override predicate isSource(DataFlow::Node source) {
 ....
 
 }
 override predicate isSink(DataFlow::Node sink) {
 ....
 
 }
}

污点跟踪

import semmle.code.java.dataflow.TaintTracking
import java
class VulConfig extends TaintTracking::Configuration {
VulConfig() { this = "myConfig" }
override predicate isSource(DataFlow::Node source) {
}
override predicate isSink(DataFlow::Node sink) {
}
}
from VulConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
where config.hasFlowPath(source, sink)
select sink.getNode(), source, sink, "source are"

白盒扫描

codeql database analyze source_database_name qllib/java/ql/src/codeql-suites/java-security-extended.qls --format=csv --output=java-results.csv

/**
 * @name Incomplete regular expression for hostnames
 * @description Matching a URL or hostname against a regular expression that contains an unescaped
 * dot as part of the hostname might match more hostnames than expected.
 * @kind path-problem
 * @problem.severity warning
 * @security-severity 7.8
 * @precision high
 * @id go/incomplete-hostname-regexp
 * @tags correctness
 * security
 * external/cwe/cwe-20
 */

文章推荐