Evaluate codeQL on e.g. on https://github.com/arburk/fishbone

[MarkusTiede]

https://github.com/github/codeql

[culmat]

what is cQL ?

[arburk]

CodeQL
QL is the query language that powers CodeQL. QL is an object-oriented logic programming language. GitHub, language experts, and security researchers create the queries used for code scanning, and the queries are open source. The community maintains and updates the queries to improve analysis and reduce false positives. For more information, see CodeQL on the GitHub Security Lab website.
https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code

[culmat]

see also
https://semmle.com/codeql
https://lgtm.com/

[arburk]

Conducted the tutorials https://help.semmle.com/QL/learn-ql/beginner/ql-tutorials.html and played around a little. Would like to discuss with someone also interested in this topic.

[MarkusTiede]

Let‘s do that!

[MarkusTiede]

current status & ideas

• https://owasp.org/www-project-juice-shop/ (https://github.com/bkimminich/juice-shop/actions) is already using cQL
• https://github.com/arburk/fishbone trying to reproduce very simple cQL issues

next steps

• verify severity level is set correctly
• https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/uploading-a-sarif-file-to-github

[MarkusTiede]

Catch: works as designed - see https://github.com/github/codeql/blob/main/java/ql/test/query-tests/UseBraces/UseBraces.java

[MarkusTiede]

Next step(s)

• execute / run checks locally on dev-machines
• publish results within GitHub scope

Postponed

• execute / run checks on Jenkins CI

[arburk]

The generated sarif can be added as artifact by the following workflow step

- name: Archive sarif files
    uses: actions/upload-artifact@v2
    with:
      name: Sarif file from codeQL scan
      path: /home/runner/work/fishbone/results/java-builtin.sarif

The path needs to be adjusted to related repo of course 😉

[MarkusTiede]

agenda for security show & tell (@MarkusTiede, @arburk)

• introduction to codeQL
• codeQL hands-on via GitHub
• codeQL PoC @ Baloise Infrastructure context
  • codeQL CLI in container on Jenkins
  • idea: convert SArif file to sonarcube
• next steps
  • continue? what's necessary next?

experiences so far

• code scans are resource intensive

[arburk]

Evaluation is completed so far. Followup story to be created for an integrated usage with Jenkins/Sonarqube