Skip to content
This repository was archived by the owner on Jan 5, 2023. It is now read-only.

Commit d14eb85

Browse files
author
Max Schaefer
committed
Go analysis support for CodeQL.
0 parents  commit d14eb85

File tree

583 files changed

+52850
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

583 files changed

+52850
-0
lines changed

‎.codeqlmanifest.json

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
{ "provide": [ "ql/src/qlpack.yml",
2+
"ql/config/legacy-support/qlpack.yml" ],
3+
"ignore": [ "the-extractor-which-needs-to-be-built" ] }

‎.gitignore

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# editor and OS artifacts
2+
*~
3+
.DS_STORE
4+
5+
# query compilation caches
6+
.cache
7+
8+
# build artifacts
9+
build/*
10+
11+
# qltest projects and artifacts
12+
ql/test/**/*.testproj
13+
ql/test/**/*.actual
14+
ql/test/**/go.sum
15+
16+
# Java class files
17+
**/*.class
18+
19+
# binaries
20+
tools/bin
21+
tools/tokenizer.jar

‎CODE_OF_CONDUCT.md

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
# Contributor Covenant Code of Conduct
2+
3+
## Our Pledge
4+
5+
In the interest of fostering an open and welcoming environment, we as
6+
contributors and maintainers pledge to make participation in our project and
7+
our community a harassment-free experience for everyone, regardless of age, body
8+
size, disability, ethnicity, sex characteristics, gender identity and expression,
9+
level of experience, education, socio-economic status, nationality, personal
10+
appearance, race, religion, or sexual identity and orientation.
11+
12+
## Our Standards
13+
14+
Examples of behavior that contributes to creating a positive environment
15+
include:
16+
17+
* Using welcoming and inclusive language
18+
* Being respectful of differing viewpoints and experiences
19+
* Gracefully accepting constructive criticism
20+
* Focusing on what is best for the community
21+
* Showing empathy towards other community members
22+
23+
Examples of unacceptable behavior by participants include:
24+
25+
* The use of sexualized language or imagery and unwelcome sexual attention or
26+
advances
27+
* Trolling, insulting/derogatory comments, and personal or political attacks
28+
* Public or private harassment
29+
* Publishing others' private information, such as a physical or electronic
30+
address, without explicit permission
31+
* Other conduct which could reasonably be considered inappropriate in a
32+
professional setting
33+
34+
## Our Responsibilities
35+
36+
Project maintainers are responsible for clarifying the standards of acceptable
37+
behavior and are expected to take appropriate and fair corrective action in
38+
response to any instances of unacceptable behavior.
39+
40+
Project maintainers have the right and responsibility to remove, edit, or
41+
reject comments, commits, code, wiki edits, issues, and other contributions
42+
that are not aligned to this Code of Conduct, or to ban temporarily or
43+
permanently any contributor for other behaviors that they deem inappropriate,
44+
threatening, offensive, or harmful.
45+
46+
## Scope
47+
48+
This Code of Conduct applies within all project spaces, and it also applies when
49+
an individual is representing the project or its community in public spaces.
50+
Examples of representing a project or community include using an official
51+
project e-mail address, posting via an official social media account, or acting
52+
as an appointed representative at an online or offline event. Representation of
53+
a project may be further defined and clarified by project maintainers.
54+
55+
## Enforcement
56+
57+
Instances of abusive, harassing, or otherwise unacceptable behavior may be
58+
reported by contacting the project team at [email protected]. All
59+
complaints will be reviewed and investigated and will result in a response that
60+
is deemed necessary and appropriate to the circumstances. The project team is
61+
obligated to maintain confidentiality with regard to the reporter of an incident.
62+
Further details of specific enforcement policies may be posted separately.
63+
64+
Project maintainers who do not follow or enforce the Code of Conduct in good
65+
faith may face temporary or permanent repercussions as determined by other
66+
members of the project's leadership.
67+
68+
## Attribution
69+
70+
This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
71+
available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
72+
73+
[homepage]: https://www.contributor-covenant.org
74+
75+
For answers to common questions about this code of conduct, see
76+
https://www.contributor-covenant.org/faq

‎CONTRIBUTING.md

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
## Contributing
2+
3+
Hi there! We're thrilled that you'd like to contribute to this project. Your help is essential for keeping it great.
4+
5+
Contributions to this project are [released](https://help.github.com/articles/github-terms-of-service/#6-contributions-under-repository-license) to the public under the [project's open source license](LICENSE).
6+
7+
Please note that this project is released with a [Contributor Code of Conduct][CODE_OF_CONDUCT.md]. By participating in this project you agree to abide by its terms.
8+
9+
## Adding a new query
10+
11+
If you have an idea for a query that you would like to share with other CodeQL users, please open a pull request to add it to this repository.
12+
Follow the steps below to help other users understand what your query does, and to ensure that your query is consistent with the other CodeQL queries.
13+
14+
1. **Consult the documentation for query writers**
15+
16+
There is lots of useful documentation to help you write CodeQL queries, ranging from information about query file structure to language-specific tutorials. For more information on the documentation available, see [Writing QL queries](https://help.semmle.com/QL/learn-ql/writing-queries/writing-queries.html) on [help.semmle.com](https://help.semmle.com).
17+
18+
2. **Format your code correctly**
19+
20+
All of the standard CodeQL queries and libraries are uniformly formatted for clarity and consistency, so we strongly recommend that all contributions follow the same formatting guidelines. If you use the CodeQL extension for Visual Studio Code, you can auto-format your query in the [QL editor](https://help.semmle.com/ql-for-eclipse/Content/WebHelp/ql-editor.html). For more information, see the [QL style guide](https://github.com/Semmle/ql/blob/master/docs/ql-style-guide.md).
21+
22+
3. **Make sure your query has the correct metadata**
23+
24+
Query metadata is used by Semmle's analysis to identify your query and make sure the query results are displayed properly.
25+
The most important metadata to include are the `@name`, `@description`, and the `@kind`.
26+
Other metadata properties (`@precision`, `@severity`, and `@tags`) are usually added after the query has been reviewed by the maintainers.
27+
For more information on writing query metadata, see the [Query metadata style guide](https://github.com/Semmle/ql/blob/master/docs/query-metadata-style-guide.md).
28+
29+
4. **Make sure the `select` statement is compatible with the query type**
30+
31+
The `select` statement of your query must be compatible with the query type (determined by the `@kind` metadata property) for alert or path results to be displayed correctly in LGTM and Visual Studio Code.
32+
For more information on `select` statement format, see [Introduction to query files](https://help.semmle.com/QL/learn-ql/writing-queries/introduction-to-queries.html#select-clause) on help.semmle.com.
33+
34+
5. **Write a query help file**
35+
36+
Query help files explain the purpose of your query to other users. Write your query help in a `.qhelp` file and save it in the same directory as your new query.
37+
For more information on writing query help, see the [Query help style guide](https://github.com/Semmle/ql/blob/master/docs/query-help-style-guide.md).
38+
39+
## Resources
40+
41+
- [How to Contribute to Open Source](https://opensource.guide/how-to-contribute/)
42+
- [Using Pull Requests](https://help.github.com/articles/about-pull-requests/)
43+
- [GitHub Help](https://help.github.com)
44+
- [A Note About Git Commit Messages](http://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html)

‎COPYRIGHT

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
Copyright (c) Semmle Inc and other contributors. All rights reserved.
2+
3+
Licensed under the Apache License, Version 2.0 (the "License"); you may not use
4+
this file except in compliance with the License. You may obtain a copy of the
5+
License at http://www.apache.org/licenses/LICENSE-2.0
6+
7+
THIS CODE IS PROVIDED ON AN *AS IS* BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
8+
KIND, EITHER EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION ANY IMPLIED
9+
WARRANTIES OR CONDITIONS OF TITLE, FITNESS FOR A PARTICULAR PURPOSE,
10+
MERCHANTABLITY OR NON-INFRINGEMENT.
11+
12+
See the Apache Version 2.0 License for specific language governing permissions
13+
and limitations under the License.

‎LICENSE

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2019 GitHub
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎Makefile

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
all: tools ql/src/go.dbscheme
2+
3+
ifeq ($(OS),Windows_NT)
4+
EXE = .exe
5+
else
6+
EXE =
7+
endif
8+
9+
.PHONY: tools
10+
tools: tools/bin/go-extractor$(EXE) tools/bin/go-tokenizer$(EXE) tools/bin/go-autobuilder$(EXE) tools/tokenizer.jar tools/bin/go-bootstrap$(EXE)
11+
12+
tools/bin/go-extractor$(EXE): FORCE
13+
go build -mod=vendor -o $@ ./extractor/cli/go-extractor
14+
15+
tools/bin/go-tokenizer$(EXE): FORCE
16+
go build -mod=vendor -o $@ ./extractor/cli/go-tokenizer
17+
18+
tools/bin/go-autobuilder$(EXE): FORCE
19+
go build -mod=vendor -o $@ ./extractor/cli/go-autobuilder
20+
21+
tools/bin/go-bootstrap$(EXE): FORCE
22+
go build -mod=vendor -o $@ ./extractor/cli/go-bootstrap
23+
24+
FORCE:
25+
26+
tools/tokenizer.jar: tools/net/sourceforge/pmd/cpd/GoLanguage.class
27+
jar cf $@ -C tools net
28+
jar uf $@ -C tools opencsv
29+
30+
tools/net/sourceforge/pmd/cpd/GoLanguage.class: extractor/net/sourceforge/pmd/cpd/GoLanguage.java
31+
javac -cp extractor -d tools $^
32+
rm tools/net/sourceforge/pmd/cpd/AbstractLanguage.class
33+
rm tools/net/sourceforge/pmd/cpd/SourceCode.class
34+
rm tools/net/sourceforge/pmd/cpd/TokenEntry.class
35+
rm tools/net/sourceforge/pmd/cpd/Tokenizer.class
36+
37+
ql/src/go.dbscheme: tools/bin/go-extractor$(EXE)
38+
env TRAP_FOLDER=/tmp tools/bin/go-extractor --dbscheme $@
39+
40+
ql/src/go.dbscheme.stats: ql/src/go.dbscheme
41+
odasa createProject --force --template templates/project --threads 4 \
42+
--variable repository https://github.com/golang/tools \
43+
--variable revision 6e04913c \
44+
--variable SEMMLE_REPO_URL golang.org/x/tools \
45+
build/stats-project
46+
odasa addSnapshot --latest --overwrite --name revision --project build/stats-project
47+
odasa buildSnapshot --latest --project build/stats-project
48+
odasa collectStats --dbscheme $^ --db build/stats-project/revision/working/db-go --outputFile $@
49+
50+
test: all build/testdb/check-upgrade-path
51+
odasa qltest --language go --library ql/src ql/test
52+
cd extractor; go test -mod=vendor ./... | grep -vF "[no test files]"
53+
54+
.PHONY: build/testdb/check-upgrade-path
55+
build/testdb/check-upgrade-path : build/testdb/go.dbscheme ql/src/go.dbscheme
56+
odasa upgradeDatabase --db build/testdb --upgrade-packs upgrades
57+
diff -q build/testdb/go.dbscheme ql/src/go.dbscheme
58+
59+
build/testdb/go.dbscheme: upgrades/initial/go.dbscheme
60+
echo >build/empty.trap
61+
odasa cli --dbscheme upgrades/initial/go.dbscheme --import build/empty.trap --db build/testdb

‎README.md

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
# Go analysis support for CodeQL
2+
3+
This open-source repository contains the extractor, CodeQL libraries, and queries that power Go
4+
support in [LGTM](https://lgtm.com), CodeQL, and other Semmle products.
5+
6+
It contains two major components:
7+
- an extractor, itself written in Go, that parses Go source code and converts it into a database
8+
that can be queried using CodeQL.
9+
- static analysis libraries and queries written in [QL](https://help.semmle.com/QL) that can be
10+
used to analyze such a database to find coding mistakes or security vulnerabilities.
11+
12+
The goal of this project is to provide comprehensive static analysis support for Go in CodeQL.
13+
14+
## Installation
15+
16+
Simply clone this repository. There are no external dependencies.
17+
18+
If you want to use the CodeQL extension for Visual Studio Code, import this repository into your VS
19+
Code workspace.
20+
21+
## Usage
22+
23+
To analyze a Go codebase, either use the CodeQL command-line interface to create a database
24+
yourself, or download a pre-built database from LGTM.com. You can then run any of the queries
25+
contained in this repository either on the command line or using the VS Code extension.
26+
27+
Note that the [lgtm.com](https://github.com/github/codeql-go/tree/lgtm.com) branch of this
28+
repository corresponds to the version of the queries that is currently deployed on LGTM.com.
29+
The [master](https://github.com/github/codeql-go/tree/master) branch may contain changes that
30+
have not been deployed yet, so you may need to upgrade databases downloaded from LGTM.com before
31+
running queries on them.
32+
33+
## Contributions
34+
35+
Contributions are welcome! Please see our [contribution guidelines](CONTRIBUTING.md) and our
36+
[code of conduct](CODE_OF_CONDUCT.md) for details on how to participate in our community.
37+
38+
## Licensing
39+
40+
The code in this repository is licensed under the [MIT license](LICENSE).
41+
42+
## Resources
43+
44+
- [Writing CodeQL queries](https://help.semmle.com/QL/learn-ql/ql/writing-queries/writing-queries.html)
45+
- [Learning CodeQL](https://help.semmle.com/QL/learn-ql/index.html)

‎SECURITY.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
If you discover a security issue in this repo, please submit it through the [GitHub Security Bug Bounty](https://hackerone.com/github).
2+
3+
Thanks for helping make CodeQL safe for everyone.

‎alert_weighting.properties

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
precision = ("veryhigh", "high", "medium", "low")
2+
severity = ("error", "warning", "recommendation")
3+
security = ("true", "false")

0 commit comments

Comments
 (0)