You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/language/learn-ql/beginner/find-the-thief.rst
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -289,8 +289,8 @@ Have you found the thief?
289
289
290
290
➤ `See the answer in the query console on LGTM.com <https://lgtm.com/query/1505744186085/>`__
291
291
292
-
What next?
293
-
----------
292
+
Further reading
293
+
---------------
294
294
295
295
- Help the villagers track down another criminal in the :doc:`next tutorial <catch-the-fire-starter>`.
296
296
- Find out more about the concepts you discovered in this tutorial in the `QL language reference <https://help.semmle.com/QL/ql-handbook/index.html>`__.
Copy file name to clipboardExpand all lines: docs/language/learn-ql/beginner/ql-tutorials.rst
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,17 +3,17 @@ QL tutorials
3
3
4
4
Solve puzzles to learn the basics of QL before you analyze code with CodeQL. The tutorials teach you how to write queries and introduce you to key logic concepts along the way.
5
5
6
-
Before starting these tutorials, you can read the :doc:`Introduction to QL <../introduction-to-ql>` for a description of the language and some simple examples.
7
-
8
6
.. toctree::
9
7
:hidden:
10
8
9
+
../introduction-to-ql
11
10
find-the-thief
12
11
catch-the-fire-starter
13
12
crown-the-rightful-heir
14
13
cross-the-river
15
14
16
-
- :doc:`Find the thief <find-the-thief>`:Take on the role of a detective to find the thief in this fictional village. You will learn how to use logical connectives, quantifiers, and aggregates in QL along the way.
15
+
- :doc:`Introduction to QL <../introduction-to-ql>`: Work through some simple exercises and examples to learn about the basics of QL and CodeQL.
16
+
- :doc:`Find the thief <find-the-thief>`: Take on the role of a detective to find the thief in this fictional village. You will learn how to use logical connectives, quantifiers, and aggregates in QL along the way.
17
17
- :doc:`Catch the fire starter <catch-the-fire-starter>`: Learn about QL predicates and classes to solve your second mystery as a QL detective.
18
18
- :doc:`Crown the rightful heir <crown-the-rightful-heir>`: This is a QL detective puzzle that shows you how to use recursion in QL to write more complex queries.
19
19
- :doc:`Cross the river <cross-the-river>`: Use common QL features to write a query that finds a solution to the "River crossing" logic puzzle.
Copy file name to clipboardExpand all lines: docs/language/learn-ql/introduction-to-ql.rst
+25-35Lines changed: 25 additions & 35 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,22 +1,18 @@
1
1
Introduction to QL
2
2
==================
3
3
4
-
QL is the powerful query language that underlies CodeQL, which is used to analyze code.
5
-
Queries written with CodeQL can find errors and uncover variants of important security vulnerabilities.
6
-
Visit `GitHub Security Lab <https://securitylab.github.com/>`__ to read about examples of vulnerabilities that we have recently found in open source projects.
7
-
8
-
Before diving into code analysis with CodeQL, it can be helpful to learn about the underlying language more generally.
9
-
10
-
QL is a logic programming language, so it is built up of logical formulas. QL uses common logical connectives (such as ``and``, ``or``, and ``not``), quantifiers (such as ``forall`` and ``exists``), and other important logical concepts such as predicates.
11
-
12
-
QL also supports recursion and aggregates. This allows you to write complex recursive queries using simple QL syntax and directly use aggregates such as ``count``, ``sum``, and ``average``.
4
+
Work through some simple exercises to learn about the basics of QL and CodeQL.
13
5
14
6
Basic syntax
15
7
------------
16
8
17
9
The basic syntax of QL will look familiar to anyone who has used SQL, but it is used somewhat differently.
18
10
19
-
A query is defined by a **select** clause, which specifies what the result of the query should be. You can try out the examples and exercises in this topic directly in LGTM. Open the `query console on LGTM.com <https://lgtm.com/query>`__. Before you can run a query, you need to select a language and project to query (for these logic examples, any language and project will do).
11
+
QL is a logic programming language, so it is built up of logical formulas. QL uses common logical connectives (such as ``and``, ``or``, and ``not``), quantifiers (such as ``forall`` and ``exists``), and other important logical concepts such as predicates.
12
+
13
+
QL also supports recursion and aggregates. This allows you to write complex recursive queries using simple QL syntax and directly use aggregates such as ``count``, ``sum``, and ``average``.
14
+
15
+
You can try out the following examples and exercises using `CodeQL for VS Code <https://help.semmle.com/codeql/codeql-for-vscode.html>`__, or you can run them in the `query console on LGTM.com <https://lgtm.com/query>`__. Before you can run a query on LGTM.com, you need to select a language and project to query (for these logic examples, any language and project will do).
20
16
21
17
Once you have selected a language, the query console is populated with the query:
22
18
@@ -26,7 +22,7 @@ Once you have selected a language, the query console is populated with the query
26
22
27
23
select "hello world"
28
24
29
-
This query simply returns the string ``"hello world"``.
25
+
This query returns the string ``"hello world"``.
30
26
31
27
More complicated queries typically look like this:
32
28
@@ -49,14 +45,14 @@ Note that ``int`` specifies that the **type** of ``x`` and ``y`` is 'integer'. T
49
45
Simple exercises
50
46
----------------
51
47
52
-
You can try to write simple queries using the some of the basic functions that are available for the ``integer``, ``date``, ``float``, ``boolean`` and ``string`` types. To apply a function, simply append it to the argument. For example, ``1.toString()`` converts the value ``1`` to a string. Notice that as you start typing a function, a pop-up is displayed making it easy to select the function that you want. Also note that you can apply multiple functions in succession. For example, ``100.log().sqrt()`` first takes the natural logarithm of 100 and then computes the square root of the result.
48
+
You can try to write simple queries using the some of the basic functions that are available for the ``int``, ``date``, ``float``, ``boolean`` and ``string`` types. To apply a function, append it to the argument. For example, ``1.toString()`` converts the value ``1`` to a string. Notice that as you start typing a function, a pop-up is displayed making it easy to select the function that you want. Also note that you can apply multiple functions in succession. For example, ``100.log().sqrt()`` first takes the natural logarithm of 100 and then computes the square root of the result.
53
49
54
50
Exercise 1
55
51
~~~~~~~~~~
56
52
57
53
Write a query which returns the length of the string ``"lgtm"``. (Hint: `here <https://help.semmle.com/QL/ql-spec/language.html#built-ins-for-string>`__ is the list of the functions that can be applied to strings.)
58
54
59
-
➤ `Answer<https://lgtm.com/query/2103060623/>`__
55
+
➤ `See answer in the query console on LGTM.com<https://lgtm.com/query/2103060623/>`__
60
56
61
57
There is often more than one way to define a query. For example, we can also write the above query in the shorter form:
62
58
@@ -69,24 +65,24 @@ Exercise 2
69
65
70
66
Write a query which returns the sine of the minimum of ``3^5`` (``3`` raised to the power ``5``) and ``245.6``.
71
67
72
-
➤ `Answer<https://lgtm.com/query/2093780343/>`__
68
+
➤ `See answer in the query console on LGTM.com<https://lgtm.com/query/2093780343/>`__
73
69
74
70
Exercise 3
75
71
~~~~~~~~~~
76
72
77
73
Write a query which returns the opposite of the boolean ``false``.
78
74
79
-
➤ `Answer<https://lgtm.com/query/2093780344/>`__
75
+
➤ `See answer in the query console on LGTM.com<https://lgtm.com/query/2093780344/>`__
80
76
81
77
Exercise 4
82
78
~~~~~~~~~~
83
79
84
80
Write a query which computes the number of days between June 10 and September 28, 2017.
85
81
86
-
➤ `Answer<https://lgtm.com/query/2100260596/>`__
82
+
➤ `See answer in the query console on LGTM.com<https://lgtm.com/query/2100260596/>`__
87
83
88
-
Example queries
89
-
---------------
84
+
Example query with multiple results
85
+
-----------------------------------
90
86
91
87
The exercises above all show queries with exactly one result, but in fact many queries have multiple results. For example, the following query computes all `Pythagorean triples <https://en.wikipedia.org/wiki/Pythagorean_triple>`__ between 1 and 10:
92
88
@@ -114,15 +110,15 @@ To simplify the query, we can introduce a class ``SmallInt`` representing the in
114
110
115
111
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/2101340747/>`__
116
112
117
-
Now that you've seen some general examples, let's use the CodeQL libraries to analyze projects.
118
-
In particular, LGTM generates a database representing the code and then CodeQL is used to query this database. For more information, see `Database generation <https://lgtm.com/help/lgtm/generate-database>`__ on LGTM.com.
113
+
Example CodeQL queries
114
+
----------------------
119
115
120
-
.. XX: Perhaps a link to the "CodeQL libraries for X"?
116
+
The previous examples used the primitive types built in to QL. Although we chose a project to query, they did not use the project-specific database. The following example queries *do* use these databases and give you an idea of how CodeQL is used to analyze projects.
121
117
122
-
The previous exercises just used the primitive types built in to QL. Although we chose a project to query, they did not use the project-specific database. The following example queries *do* use these databases and give you an idea of what CodeQL can be used for. There are more details about how to use CodeQL `below <#learning-ql>`__, so don't worry if you don't fully understand these examples yet!
118
+
Queries using the CodeQL libraries can find errors and uncover variants of important security vulnerabilities in codebases.
119
+
Visit `GitHub Security Lab <https://securitylab.github.com/>`__ to read about examples of vulnerabilities that we have recently found in open source projects.
123
120
124
-
Python
125
-
~~~~~~
121
+
To import the CodeQL library for a specific programming language, type ``import <language>`` at the start of the query.
126
122
127
123
.. code-block:: ql
128
124
@@ -132,10 +128,7 @@ Python
132
128
where count(f.getAnArg()) > 7
133
129
select f
134
130
135
-
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/2096810474/>`__. The ``from`` clause defines a variable ``f`` representing a function. The ``where`` part limits the functions ``f`` to those with more than 7 arguments. Finally, the ``select`` clause lists these functions.
136
-
137
-
JavaScript
138
-
~~~~~~~~~~
131
+
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/2096810474/>`__. The ``from`` clause defines a variable ``f`` representing a Python function. The ``where`` part limits the functions ``f`` to those with more than 7 arguments. Finally, the ``select`` clause lists these functions.
139
132
140
133
.. code-block:: ql
141
134
@@ -145,10 +138,7 @@ JavaScript
145
138
where c.getText().regexpMatch("(?si).*\\bTODO\\b.*")
146
139
select c
147
140
148
-
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/2101530483/>`__. The ``from`` clause defines a variable ``c`` representing a comment. The ``where`` part limits the comments ``c`` to those containing the word ``"TODO"``. The ``select`` clause lists these comments.
149
-
150
-
Java
151
-
~~~~
141
+
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/2101530483/>`__. The ``from`` clause defines a variable ``c`` representing a JavaScript comment. The ``where`` part limits the comments ``c`` to those containing the word ``"TODO"``. The ``select`` clause lists these comments.
152
142
153
143
.. code-block:: ql
154
144
@@ -158,11 +148,11 @@ Java
158
148
where not exists(p.getAnAccess())
159
149
select p
160
150
161
-
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/2098670762/>`__. The ``from`` clause defines a variable ``p`` representing a parameter. The ``where`` clause finds unused parameters by limiting the parameters ``p`` to those which are not accessed. Finally, the ``select`` clause lists these parameters.
151
+
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/2098670762/>`__. The ``from`` clause defines a variable ``p`` representing a Java parameter. The ``where`` clause finds unused parameters by limiting the parameters ``p`` to those which are not accessed. Finally, the ``select`` clause lists these parameters.
162
152
163
-
Learning CodeQL
153
+
Further reading
164
154
---------------
165
155
166
156
- To find out more about how to write your own queries, try working through the :doc:`QL tutorials <beginner/ql-tutorials>`.
167
157
- For an overview of the other available resources, see :doc:`Learning CodeQL <../index>`.
168
-
- For a more technical description of the underlying language, see the `QL language reference <https://help.semmle.com/QL/ql-handbook>`__
158
+
- For a more technical description of the underlying language, see the `QL language reference <https://help.semmle.com/QL/ql-handbook>`__.
0 commit comments