Awesome Reviewers

Verification · Static analysis · Static application security testing

Taint tracking

Follow untrusted input from sources to sinks across functions and files.

How to build it

  1. List the untrusted sources (request parameters, uploaded files, environment) and the sinks (SQL, shell, file paths, HTML).
  2. Enable the dataflow query suite for each language, or write a query for each source-sink pair that is missing.
  3. Run the queries on every pull request and keep the results in code scanning.

Signals in a repository

  • A codeql-analysis workflow that runs a security query suite.
  • Custom CodeQL query files (.ql) or a qlpack in the repository.
  • SARIF uploads from the CodeQL step to code scanning.

In practice

63 repositories run a tool for this check in the scanned set.

  • codeql · 63 repos

Examples