https://github.com/quark-engine/quickstart-codeql
https://github.com/quark-engine/quickstart-codeql
Last synced: about 1 year ago
JSON representation
- Host: GitHub
- URL: https://github.com/quark-engine/quickstart-codeql
- Owner: quark-engine
- Created: 2022-11-10T07:35:39.000Z (over 3 years ago)
- Default Branch: main
- Last Pushed: 2022-11-10T07:36:00.000Z (over 3 years ago)
- Last Synced: 2025-04-13T08:55:54.963Z (about 1 year ago)
- Size: 1000 Bytes
- Stars: 0
- Watchers: 4
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# QuickStart CodeQL
In this tutorial, we will learn how to install and run CodeQL with an easy example.
We show how to detect CWE-798 in an Android application [ovaa](https://github.com/oversecured/ovaa).
### Step1: Install CodeQL
1. Download the CodeQL CLI bundle
```
$ wget https://github.com/github/codeql-action/releases/latest/download/codeql-bundle.tar.gz
$ tar -xvzf ./codeql-bundle.tar.gz
```
2. Adding `//codeql` to your PATH, so that you can run the executable as just CodeQL.
### Step2: Download the detection script
Clone CodeQL script repository by running:
```
$ git clone https://github.com/github/codeql.git
```
### Step3: Download the ovaa source code
Clone the ovaa source code repository by running:
```
$ git clone https://github.com/oversecured/ovaa.git
```
### Step4: Create CodeQL database
Create CodeQL ovaa database by running:
```
$ codeql database create ovaa-db/ -l=java -c='./gradlew --no-daemon clean assembleRelease' --overwrite
```
### Step5: Analyze the sample with CWE-798 script
- Analyzing ovaa with Codeql CWE-798 script.
```
$ codeql database analyze ovaa-db --format=csv --output=result.csv codeql/java/ql/src/Security/CWE/CWE-798/HardcodedCredentialsApiCall.ql
```
- You should now see the message in the terminal:
```
Running queries.
Did not find any ML models.
[1/1] No need to rerun codeql/java/ql/src/Security/CWE/CWE-798/HardcodedCredentialsApiCall.ql.
Shutting down query evaluator.
Interpreting results.
```
- The result will be saved in `result.csv`.
Here is the excerpt from `result.csv`. It shows where the CWE-798 occured.
