How to add an AdditionalTaintStep globally ?

[hugo-syn]

Hi, I would like to define and import an TaintTracking::AdditionalTaintStep for all the default path queries. Is it possible to do this ? If yes how can I do this, maybe with the extension model feature but I'm not sure.

Thanks :)

[hugo-syn]

I found Customization.qll which seems a good candidate, but I have a file for each pack I don't know which one I should modify

[owen-mc]

Which language are you analyzing?

[hugo-syn]

Which language are you analyzing?

I'm analyzing Java

[smowton]

Is https://codeql.github.com/docs/codeql-language-guides/customizing-library-models-for-java-and-kotlin/ useful for your use case? That specifically handles additional taint steps that relate to library methods, e.g. propagating taint from a particular function call's parameter to its return value.

[hugo-syn]

I would like to add a more complex additional step like the ones here, but globally: https://github.com/GitHubSecurityLab/CodeQL-Community-Packs/blob/7a6a71525bd2d3466718bd36b4c5b1b114bac532/java/lib/ResearchMode.qll#L86

[smowton]

The tooling for this sort of customisation for usage on Actions is not very mature, but you might consider using the GitHub Security Lab's tooling at https://github.com/advanced-security/codeql-bundle-action and in particular its support for providing a Customizations.qll file documented at https://github.com/advanced-security/codeql-bundle-action?tab=readme-ov-file#customizations

[hugo-syn]

Hi @smowton I'm having issues with what you linked.

Here is what I tried:

1. Workspace creation (not very sure)

$ cat codeql-workspace.yml
provide:
  - "java-customizations/qlpack.yml"
  - "/home/user/.codeql/packages/codeql/java-all/5.0.0/qlpack.yml"

2. Custom pack creation

$ find java-customizations/
java-customizations/
java-customizations/synacktiv
java-customizations/synacktiv/java_customizations
java-customizations/synacktiv/java_customizations/Customizations.qll
java-customizations/qlpack.yml
java-customizations/codeql-pack.lock.yml
$ cat java-customizations/qlpack.yml
---
library: true
warnOnImplicitThis: false
name: synacktiv/java-customizations
version: 0.0.1
dependencies:
  codeql/java-all: ^5.0.0 

3. Build the bundle

$ codeql-bundle -b codeql-bundle-linux64.tar.gz -w codeql-workspace.yml -o /tmp/output -p linux64 -l INFO java-customizations /home/user/.codeql/packages/codeql/java-all/5.0.0/
INFO: Creating custom bundle of codeql-bundle-linux64.tar.gz using CodeQL pack(s) in workspace .
INFO: Unpacking provided bundle codeql-bundle-linux64.tar.gz to /tmp/tmpicf7tabu.
INFO: Validating the CodeQL CLI version part of the bundle.
INFO: Found CodeQL CLI version 2.20.1.
CRITICAL: Failed to build custom bundle with reason: 'Could not resolve dependency codeql/java-all@^5.0.0 for pack synacktiv/[email protected]!'
INFO: Removing temporary directory /tmp/tmpicf7tabu used to build custom bundle.

I don't understand what I'm missing here do you have an idea ?

I can resolve the packs :

$ codeql resolve packs | grep -i 'codeql/java-all' -A 4
    codeql/java-all:
      @1.1.2: (library) /home/user/.codeql/packages/codeql/java-all/1.1.2/qlpack.yml
      @4.2.0: (library) /home/user/.codeql/packages/codeql/java-all/4.2.0/qlpack.yml
      @5.0.0: (library) /home/user/.codeql/packages/codeql/java-all/5.0.0/qlpack.yml

[smowton]

What does the -l DEBUG output look like?

[hugo-syn]

It found codeql/[email protected]

DEBUG:2025-01-08 15:10:58,435 Loading CodeQL pack configuration at /tmp/tmphkyzjauz/codeql/qlpacks/codeql/java-all/6.0.0/qlpack.yml.
DEBUG:2025-01-08 15:10:58,436 Loaded codeql/java-all with version 6.0.0 at /tmp/tmphkyzjauz/codeql/qlpacks/codeql/java-all/6.0.0/qlpack.yml.
[...]
DEBUG:2025-01-08 15:10:58,461 Resolving dependency codeql/java-all:6.0.0.
DEBUG:2025-01-08 15:10:58,461 Considering candidate pack codeql/[email protected].
DEBUG:2025-01-08 15:10:58,461 Found candidate pack codeql/[email protected].
DEBUG:2025-01-08 15:10:58,461 Resolving pack codeql/[email protected]
DEBUG:2025-01-08 15:10:58,461 Resolved pack codeql/[email protected], already resolved.
DEBUG:2025-01-08 15:10:58,461 Resolving pack codeql/[email protected]
DEBUG:2025-01-08 15:10:58,461 Resolving dependency codeql/java-all:6.0.0.
DEBUG:2025-01-08 15:10:58,461 Considering candidate pack codeql/[email protected].
DEBUG:2025-01-08 15:10:58,461 Found candidate pack codeql/[email protected].
DEBUG:2025-01-08 15:10:58,461 Resolving pack codeql/[email protected]
DEBUG:2025-01-08 15:10:58,461 Resolved pack codeql/[email protected], already resolved.
[...]
DEBUG:2025-01-08 15:10:59,646 Resolving pack synacktiv/[email protected]
DEBUG:2025-01-08 15:10:59,646 Resolving dependency codeql/java-all:^5.0.0.
DEBUG:2025-01-08 15:10:59,646 Considering candidate pack codeql/[email protected].

And I can't add the 6.0.0 version:

$ codeql pack add --dir=java-customizations codeql/[email protected]
ERROR: No version of 'codeql/java-all' matches version range '6.0.0'. The latest available version is '5.0.0'. (/home/hugov/Downloads/java-customizations/qlpack.yml:1,1-1)

$ codeql pack download 'codeql/[email protected]'
Package specifications to check for download: codeql/[email protected]
ERROR: No version of 'codeql/java-all' matches version range '6.0.0'. The latest available version is '5.0.0'. (Compiler Generated)

[hugo-syn]

I was using a pre-release bundle, but using the latest bundle is better. Now, once it is bundled and built, I can use it, and my customization.qll will be imported for all queries ? Does it work with packs downloaded from registries, or do I have to obtain the source code of the associated pack and run it from there? I think downloaded packs come with their own libraries.

[smowton]

Could you give an example of how you're currently running queries from a third-party pack?

[hugo-syn]

Ok, so I have this qls file, basically I wan't to run all the security queries from the default codeql/java-queries and from githubsecuritylab/codeql-java-queries :

$ cat java-sec.qls
- queries: .
  from: codeql/java-queries

- queries: '.'
  from: githubsecuritylab/codeql-java-queries

- include:
    kind:
      - problem
      - path-problem
    tags contain: security

- exclude:
    tags contain:
      - debugging
      - audit
      - template

# Remove local testing folders
- exclude:
    query path:
      - /testing\/.*/% 

So I made a qlpack with this qls file:

$ codeql pack ls -- /.../packs/training
Running on packs: synacktiv/training.
Found synacktiv/[email protected]

And here is the final command:

$ codeql database analyze database --format=sarif-latest --output=custom.sarif --additional-packs /.../packs/training --additional-packs /.../CodeQL-Community-Packs/java/src/ --rerun synacktiv/training:java-sec.qls

The path /.../CodeQL-Community-Packs/java/src/ contains the source code downloaded directly from git.

And I want to add my customization.qll to both codeql/java-queries and githubsecuritylab/codeql-java-queries