You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I'm trying to understand how CodeQL fundamentally works in a clear way. I read this paper which talks about adding language support to CodeQL. The authors mention that declarative static analysis typically works in three steps.
First, it transforms a program source code into a database containing facts that are tuples of values. Second, it derives new facts from known facts in the database by applying rules. Each rule specifies a set of base facts and a derived fact that will be added to the database if satisfying all the base facts. Finally, the analysis applies queries for specific properties via a query system and produces the results of the queries as its analysis results.
I've been looking for this process throughout the database construction, I know syntactic facts are extracted and stored during during compilation/extraction which I can find here. I can't find where the "rules" are supposed to be located.
My understanding is the rules are iteratively applied to build additional derived facts, which makes me believe that their results are stored in the database alongside syntactic facts extracted from the AST, CFG, ect. But I can't locate this process.
The paper mentions
Using QL, one can depict rules by defining predicates and classes.
But I didn't think these generate results that are written to the database.
I can see that in Glean they contain queries which generate additional facts to be stored in the database.
My question is how does Codeql actually define the "rules" it uses, where are they located and how are these results stored/used to assist queries?
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
-
I'm trying to understand how CodeQL fundamentally works in a clear way. I read this paper which talks about adding language support to CodeQL. The authors mention that declarative static analysis typically works in three steps.
I've been looking for this process throughout the database construction, I know syntactic facts are extracted and stored during during compilation/extraction which I can find here. I can't find where the "rules" are supposed to be located.
My understanding is the rules are iteratively applied to build additional derived facts, which makes me believe that their results are stored in the database alongside syntactic facts extracted from the AST, CFG, ect. But I can't locate this process.
The paper mentions
But I didn't think these generate results that are written to the database.
I can see that in Glean they contain queries which generate additional facts to be stored in the database.
My question is how does Codeql actually define the "rules" it uses, where are they located and how are these results stored/used to assist queries?
Thanks!
Beta Was this translation helpful? Give feedback.
All reactions