> For the complete documentation index, see [llms.txt](https://gitbook.youngseaz.com/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gitbook.youngseaz.com/notes/00-wang-luo-an-quan/an-quan-gong-ju/codeql/01-codeql-ji-ben-yong-fa.md).

# 01 codeql 基本用法

## codeql 安装

codeql 安装部署、数据库编译等[见官方文档](https://docs.github.com/zh/code-security/codeql-cli)

## codeql 规则编写

codeql 文档 [Writing CodeQL Queries](https://codeql.github.com/docs/writing-codeql-queries/)

### 保留关键字

```
and
any
as
asc
avg
boolean
by
class
concat
count
date
desc
else
exists
extends
false
float
forall
forex
from
if
implies
import
in
instanceof
int
max
min
module
newtype
none
not
or
order
predicate
rank
result
select
strictconcat
strictcount
strictsum
string
sum
super
then
this
true
unique
where
```

### 运算符

```
<
<=
=
>
>=
_
-
,
;
!=
/
.
..
(
)
[
]
{
}
*
%
+
|
```

### 谓词

谓词用于描述组成QL程序的逻辑关系。严格来说，谓词用于计算一组元组，看下面的例子：

```
predicate isCountry(string country) {
  country = "Germany"
  or
  country = "Belgium"
  or
  country = "France"
}

predicate hasCapital(string country, string capital) {
  country = "Belgium" and capital = "Brussels"
  or
  country = "Germany" and capital = "Berlin"
  or
  country = "France" and capital = "Paris"
}
```

谓词 `isCountry` 是一元组集合 `{("Belgium"),("Germany"),("France")}`，谓词 `isCountry` 是二元组集合 `{("Belgium","Brussels"),("Germany","Berlin"),("France","Paris")}`，通常来说，谓词的集合中的元组拥有相同数量的元组

### 查询语句

基本查询语句 `select xxx`, xxx 为变量，返回 xxx

codeql 典型查询结构如下

```
from /* ... variable declarations ... */
where /* ... logical formulas ... */
select /* ... expressions ... */
```

**当 where 的条件语句过长时，就可以使用谓词，用谓词函数把条件封装起来**