CodeQL, a semantic code analysis engine and query tool for finding security vulnerabilities across a codebase, has been made available for free by GitHub for anyone to use in research or to analyze open source code.
CodeQL queries code as if it were data. Developers can use CodeQL to write a query that finds all variants of a vulnerability, and then share that query with other developers. For example, a developer could create a query that mimics a bug class for cross-site scripting, then use that query to find any bug class. CodeQL also can be used to find zero days, variants of critical vulnerabilities, and defects such as buffer overflows or SQL injection issues.
CodeQL was developed several years ago by Semmle, which was acquired by GitHub in September. Prior to making CodeQL available for free for open source code, Semmle provided it as a commercially available service. It is still available under a commercial license for private code repositories.
Features of CodeQL include:
- Libraries for control and data flow analysis, taint tracking, and threat model exploration. Languages supported include C/C++, C#, Java, JavaScript, Python, and others. One language currently not supported is Rust.
- CodeQL plug-ins to IDEs.
- The LGTM query console, which can be used to write CodeQL in a browser and query a portfolio for vulnerabilities.
- The ability to run out-of-the-box queries or custom queries on multiple codebases.
How to access CodeQL
CodeQL can be tried out in the LGTM query console at LGTM.com.