Abstract

CodeQL is commonly used to detect known vulnerability patterns and their associated variants in code. CodeQL queries are usually written to find very specific vulnerabilities for variant analysis purposes and are often integrated into CI/CD pipelines to automatically detect bugs. However, CodeQL can also serve as an interactive SAST Swiss army knife to support more general code auditing workflows. Since CodeQL makes a program’s AST and dataflows queryable, it has the ability to effectively answer many of the general questions that commonly arise when auditing code, such as “which APIs are tainted by user controlled input?”, “which integer arithmetic may be influenced by network controlled data?” and “which parts of the code have a high bug density?”. In this talk Agustin Gianni and Bas Alberts of the GitHub Security Lab will demonstrate practical CodeQL auditing workflows that enhance your ability to efficiently explore new attack surfaces.