How can I use codeql cli without metadata?

[Gao-Chuan]

This is a snippets from codeql's example:

/**
 * @id java/examples/method-call
 * @name Call to method
 * @description Finds calls to com.example.Class.methodName
 * @tags call
 *       method
 */

import java

from MethodAccess call, Method method
where
  call.getMethod() = method and
  method.hasName("methodName") and
  method.getDeclaringType().hasQualifiedName("com.example", "Class")
select call, method

When I try to run it, codeql give me this error

Error was: Cannot process query metadata for a query without the '@kind' metadata property. To learn more, see https://codeql.github.com/docs/writing-codeql-queries/metadata-for-codeql-queries/ [NO_KIND_SPECIFIED]

I understand that this is because I didn't add a @kind in the metadata. So I added @kind problem and received a new error:

Error was: Expected result pattern(s) are not present for problem query: Expected at least 2 columns. [INVALID_RESULT_PATTERNS]

My problem is: I don't care about the metadata at all. I just want to use it like a database query and I just want to get the raw result as a csv file.

Is there anyway that I can draft my own query without bothering the metadata?

[MathiasVP]

Hi @Gao-Chuan,

I can provide you with two answers to this question, and I hope one of them will be helpful to you (or maybe even both of them!).

First answer

The reason you're getting this error when you add @kind problem metadata:

Error was: Expected result pattern(s) are not present for problem query: Expected at least 2 columns. [INVALID_RESULT_PATTERNS]

is because your select doesn't select the right columns. For a @kind problem query your select must look like:

select element, string

and you're selecting two elements (i.e., a MethodAccess and a Method). So if you change your select to something like:

select call, "This call targets $@", method, method.toString()

this uses the placeholder feature to include both elements and still be of the form select element, string.

I hope that helps!

Second answer

Regarding:

My problem is: I don't care about the metadata at all. I just want to use it like a database query and I just want to get the raw result as a csv file.

Is there anyway that I can draft my own query without bothering the metadata?

there definitely is! I will recommend simply adding the metadata (and selecting the right columns in your select clause) as I explained in the first answer, but if you really just want to get out the raw csv data you can do that as follows:

codeql query run ... -o output.bqrs # i.e., run your query and store the output in `output.bqrs`
codeql bqrs decode output.bqrs --format=csv # i.e., decode the bqrs file into csv information

The codeql bqrs decode command has many different output formats. You can tell it to output data in various formats (codeql bqrs decode tells me some of the other available formats are text and json).

I hope that also helps! 😄