CodeQL Editor

About the tool

CodeQL is a semantic code analysis engine that allows you to write queries to find bugs and vulnerabilities in your code.

I've built this tool to create an environment for editing CodeQL files online.

Demo

untitled.ql — CodeQL Editor

/**
 * @name Taint-tracking to 'eval' calls
 * @description Tracks user-controlled values into 'eval' calls (special case of js/code-injection).
 * @kind problem
 * @problem.severity error
 * @tags security
 * @id js/examples/eval-taint
 */

import javascript
import DataFlow

class EvalTaint extends TaintTracking::Configuration {
  EvalTaint() { this = "EvalTaint" }

  override predicate isSource(Node node) { node instanceof RemoteFlowSource }

  override predicate isSink(Node node) { node = globalVarRef("eval").getACall().getArgument(0) }
}

from EvalTaint cfg, Node source, Node sink
where cfg.hasFlow(source, sink)
select sink, "Eval with user-controlled input from $@.", source, "here"1
/**
2
 * @name Taint-tracking to 'eval' calls
3
 * @description Tracks user-controlled values into 'eval' calls (special case of js/code-injection).
4
 * @kind problem
5
 * @problem.severity error
6
 * @tags security
7
 * @id js/examples/eval-taint
8
 */
9

10
import javascript
11
import DataFlow
12

13
class EvalTaint extends TaintTracking::Configuration {
14
  EvalTaint() { this = "EvalTaint" }
15

16
  override predicate isSource(Node node) { node instanceof RemoteFlowSource }
17

18
  override predicate isSink(Node node) { node = globalVarRef("eval").getACall().getArgument(0) }
19
}
20

21
from EvalTaint cfg, Node source, Node sink
22
where cfg.hasFlow(source, sink)
23
select sink, "Eval with user-controlled input from $@.", source, "here"

Made by Anton Vasetenkov.

If you want to say hi, you can reach me on LinkedIn or via email. If you like my work, you can support me by buying me a coffee.