github / github/codeql

CodeQL for Stack Overflow Snippets

オープン
#4,788 コメント 3 件 リアクション 0 件 担当者 0 名 GitHub で見る
Java question Stale
主要言語
CodeQL
スター
10.1k
フォーク
2.1k
平均マージ
2日 15時間
マージ済み PR(30日)
141

説明

**Description of the issue**

I am working on using CodeQL to find security vulnerabilities in code snippets posted on Stack Overflow. The problem, however, is that most snippets on Stack Overflow are not compilable due to missing import statements for libraries. This means that I need to work around this problem in order to be able to create a CodeQL database.

To work around the problem, I wrote a sample program(`GenerateByteCode.java`) that uses the Javaassist library to generate class files (`.class`) for each non-compilable snippet (kind of a way to compile the snippets). This program is a maven-based project and includes all the snippets that cannot be compiled. I configured the maven build to exclude all snippet files in the snippets directory(the directory containing non-compilable snippets).

I was able to successfully create a CodeQL database using `--command='mvn clean install'`. However, when I try to query e.g all method accesses, I only see the method access of my sample program(i.e `GenerateByteCode.java`) and not of the snippet files. My explanation for this is that the database was only created for the file that maven can compile.

My question is: Can CodeQL be used to find vulnerabilities in partial programs (e.g stack overflow code snippets) which can't be compiled? Is there a way to workaround this problem?

コントリビューションガイド

コントリビューションガイドを開く

評価

この issue はまだ評価されていません。

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。