Skip to content
The CodeQL extractor and libraries for Go.
Go Java Makefile Other
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
build Go analysis support for CodeQL. Nov 8, 2019
change-notes
codeql-tools Go analysis support for CodeQL. Nov 8, 2019
extractor Fix a dead assignment. Nov 20, 2019
ql Merge pull request #195 from max/impossible-interface-nil-check Nov 27, 2019
templates/project Go analysis support for CodeQL. Nov 8, 2019
tools Go analysis support for CodeQL. Nov 8, 2019
upgrades Add more codeql metadata files. Nov 14, 2019
vendor Go analysis support for CodeQL. Nov 8, 2019
.codeqlmanifest.json Add more codeql metadata files. Nov 14, 2019
.gitignore
.lgtm.yml Update .lgtm.yml to classify examples. Dec 2, 2019
CODE_OF_CONDUCT.md Go analysis support for CodeQL. Nov 8, 2019
CONTRIBUTING.md Go analysis support for CodeQL. Nov 8, 2019
COPYRIGHT Go analysis support for CodeQL. Nov 8, 2019
LICENSE Go analysis support for CodeQL. Nov 8, 2019
Makefile Go analysis support for CodeQL. Nov 8, 2019
README.md Go analysis support for CodeQL. Nov 8, 2019
SECURITY.md Go analysis support for CodeQL. Nov 8, 2019
alert_weighting.properties Go analysis support for CodeQL. Nov 8, 2019
codeql-extractor.yml Go analysis support for CodeQL. Nov 8, 2019
go.mod Go analysis support for CodeQL. Nov 8, 2019
go.sum Go analysis support for CodeQL. Nov 8, 2019

README.md

Go analysis support for CodeQL

This open-source repository contains the extractor, CodeQL libraries, and queries that power Go support in LGTM, CodeQL, and other Semmle products.

It contains two major components:

  • an extractor, itself written in Go, that parses Go source code and converts it into a database that can be queried using CodeQL.
  • static analysis libraries and queries written in QL that can be used to analyze such a database to find coding mistakes or security vulnerabilities.

The goal of this project is to provide comprehensive static analysis support for Go in CodeQL.

Installation

Simply clone this repository. There are no external dependencies.

If you want to use the CodeQL extension for Visual Studio Code, import this repository into your VS Code workspace.

Usage

To analyze a Go codebase, either use the CodeQL command-line interface to create a database yourself, or download a pre-built database from LGTM.com. You can then run any of the queries contained in this repository either on the command line or using the VS Code extension.

Note that the lgtm.com branch of this repository corresponds to the version of the queries that is currently deployed on LGTM.com. The master branch may contain changes that have not been deployed yet, so you may need to upgrade databases downloaded from LGTM.com before running queries on them.

Contributions

Contributions are welcome! Please see our contribution guidelines and our code of conduct for details on how to participate in our community.

Licensing

The code in this repository is licensed under the MIT license.

Resources

You can’t perform that action at this time.