01 codeql 基本用法

codeql 安装

codeql 安装部署、数据库编译等见官方文档

codeql 规则编写

codeql 文档 Writing CodeQL Queries

保留关键字

and
any
as
asc
avg
boolean
by
class
concat
count
date
desc
else
exists
extends
false
float
forall
forex
from
if
implies
import
in
instanceof
int
max
min
module
newtype
none
not
or
order
predicate
rank
result
select
strictconcat
strictcount
strictsum
string
sum
super
then
this
true
unique
where

运算符

<
<=
=
>
>=
_
-
,
;
!=
/
.
..
(
)
[
]
{
}
*
%
+
|

谓词

谓词用于描述组成QL程序的逻辑关系。严格来说，谓词用于计算一组元组，看下面的例子：

predicate isCountry(string country) {
  country = "Germany"
  or
  country = "Belgium"
  or
  country = "France"
}

predicate hasCapital(string country, string capital) {
  country = "Belgium" and capital = "Brussels"
  or
  country = "Germany" and capital = "Berlin"
  or
  country = "France" and capital = "Paris"
}

谓词 isCountry 是一元组集合 {("Belgium"),("Germany"),("France")}，谓词 isCountry 是二元组集合 {("Belgium","Brussels"),("Germany","Berlin"),("France","Paris")}，通常来说，谓词的集合中的元组拥有相同数量的元组

查询语句

基本查询语句 select xxx, xxx 为变量，返回 xxx

codeql 典型查询结构如下

from /* ... variable declarations ... */
where /* ... logical formulas ... */
select /* ... expressions ... */

当 where 的条件语句过长时，就可以使用谓词，用谓词函数把条件封装起来