Learning CodeQL

CodeQL is the code analysis platform used by security researchers to automate variant analysis. You can use CodeQL queries to explore code and quickly find variants of security vulnerabilities and bugs. These queries are easy to write and share–visit the topics below and our open source repository on GitHub to learn more. You can also try out CodeQL in the query console on LGTM.com. Here, you can query open source projects directly, without having to download CodeQL databases and libraries.

CodeQL is based on a powerful query language called QL. The following topics help you understand QL in general, as well as how to use it when analyzing code with CodeQL.

Important

If you’ve previously used QL, you may notice slight changes in terms we use to describe some important concepts. For more information, see our note about Recent terminology changes.

Getting started

If you are new to QL, start by looking at the following topics:

• Introduction to QL
• About QL
• QL detective tutorials
• River crossing puzzle

CodeQL training and variant analysis examples

To start learning how to use CodeQL for variant analysis for code written in a specific language, see:

• CodeQL training and variant analysis examples
  • CodeQL and variant analysis
  • Learning CodeQL for variant analysis
    • CodeQL and variant analysis for C/C++
    • CodeQL and variant analysis for Java
    • More resources

Writing CodeQL queries

To learn more about writing your own queries, see:

• Writing CodeQL queries
  • Information for query writers
    • Introduction to query files
    • Constructing path queries
    • Introduction to data flow analysis with CodeQL
    • Defining ‘select’ statements
    • Locations and strings for QL entities
    • Query writing: common performance issues
  • Viewing existing CodeQL queries
  • Contributing queries
    • Query metadata
    • Query help reference

For more information on using CodeQL to query code written in a specific language, see:

• CodeQL for C/C++
  • Introducing the CodeQL libraries for C/C++
  • Tutorial: Function classes
  • Tutorial: Expressions, types and statements
  • Tutorial: Conversions and classes
  • Analyzing data flow in C/C++
  • Example: Checking that constructors initialize all private fields
  • Example: Checking for allocations equal to strlen(string) without space for a null terminator
  • Advanced libraries
  • Other resources
• CodeQL for C#
  • Introducing the CodeQL libraries for C#
  • Analyzing data flow in C#
  • Other resources
• CodeQL for COBOL
  • Introducing the CodeQL libraries for COBOL
  • Other resources
• CodeQL for Go
  • Other resources
• CodeQL for Java
  • Introducing the CodeQL libraries for Java
  • Analyzing data flow in Java
  • Tutorial: Types and the class hierarchy
  • Tutorial: Expressions and statements
  • Tutorial: Navigating the call graph
  • Tutorial: Annotations
  • Tutorial: Javadoc
  • Tutorial: Working with source locations
  • AST class reference
  • Other resources
• CodeQL for JavaScript
  • Introducing the CodeQL libraries for JavaScript
  • Introducing the CodeQL libraries for TypeScript
  • Analyzing data flow in JavaScript and TypeScript
  • Tutorial: Precise data-flow analysis using flow labels
  • Tutorial: API modelling using type tracking
  • AST class reference
  • Data flow cheat sheet
  • Other resources
• CodeQL for Python
  • Introducing the CodeQL libraries for Python
  • Tutorial: Functions
  • Tutorial: Statements and expressions
  • Tutorial: Control flow analysis
  • Python control flow graph
  • Taint tracking and data flow analysis in Python
  • Tutorial: Points-to analysis and type inference
  • Other resources

Technical information

For more technical information see:

• Technical information
  • What’s in a CodeQL database?

Reference topics

For a more comprehensive guide to the query language itself, see the following reference topics:

• QL language handbook—a description of important concepts in QL.
• QL language specification—a formal specification of QL.

Search

• Search Page