reddit / emacs

emacs-codeql: a package to write and test CodeQL queries

lispislife 路 2022-04-08 04:48
In the category "things I wrote because I wanted them for my own use", I released a pre-alpha of [emacs-codeql](https://github.com/anticomputer/emacs-codeql) [CodeQL](https://codeql.github.com/) is GitHub's static analysis toolchain and its primary IDE support is targeted at VSCode, there also exists a [neovim plugin](https://github.com/pwntester/codeql.nvim) which served as the primary inspiration for this package in terms of feature parity goals. emacs-codeql is fairly opinionated package that includes an [emacs-tree-sitter](https://emacs-tree-sitter.github.io/) based indentation and syntax highlighting mode for the [QL language](https://codeql.github.com/docs/ql-language-reference/about-the-ql-language/) as well as a transient driven interface to interact with CodeQL databases, run partial or full queries, view ASTs, and other such activities. It provides a full xref backend for database archive source files and also works over TRAMP (2.5.x recommended). It comes with automagic point-synchronization between source file buffers and their AST buffers as well as a lot of other small quality-of-life features focused on making CodeQL query development a low-friction experience on emacs. For LSP support emacs-codeql recommends and cleanly integrates with eglot. It also depends on Projectile for project-root detection for eglot's new workspaceFolders initialization, which is required for the CodeQL language server to operate properly. Since the intersection between emacs users and emacs users that also use this one very specific static analysis toolchain is likely not that big, I don't expect this to be very popular. But I wanted to share it with the broader community to save someone else the hassle just in case. I'll be putting a lot of mileage on this package myself, so expect a pretty active feature churn in the coming months. As it stands emacs-codeql is ready to be used for most all general CodeQL use cases.
AndreaSomePostfix 路 2022-04-08 11:08
That is interesting. A question about CodeQL (and your integration really): where are the queries defined? I can see in the test project of the codeql website [https://lgtm.com/query/rule:1823453799/lang:java/](https://lgtm.com/query/rule:1823453799/lang:java/) that there are some predefined queries. Can you create your own? And where can I find the pre-defined ones?
lispislife 路 2022-04-08 13:41
Yep, this package is aimed at writing your own custom CodeQL queries. You can find a bunch of existing/example queries in the [CodeQL repo](https://github.com/github/codeql) ... this is also where all the language support libraries live. For example, all the c/cpp queries live at https://github.com/github/codeql/tree/main/cpp/ql/src ... the main repo has all the queries for c/cpp, javascript, ruby, etc. but Go has its own dedicated QL repo at https://github.com/github.com/github/codeql-go. If you're more interested in just running queries, you don't need this package and can just use the codeql toolchain directly to run qlpacks and query suites (collections of queries) against the database for a project. See: https://codeql.github.com/docs/codeql-cli/analyzing-databases-with-the-codeql-cli/ CodeQL also integrates into GitHub CI/CD through [GitHub code scanning](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-with-codeql)
gsingh93 路 2022-04-08 15:24
Nice! I'm a daily user of CodeQL, so I'll definitely be trying this out. Thanks for sharing 馃檪
lispislife 路 2022-04-08 23:05
Nice! Feel free to file issues if you run into friction.