You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: extensions/ql-vscode/README.md
+26-26Lines changed: 26 additions & 26 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,10 +2,10 @@
2
2
3
3
This project is an extension for Visual Studio Code that adds rich language support for [CodeQL](https://help.semmle.com/codeql) and allows you to easily find problems in codebases. In particular, the extension:
4
4
5
-
* Enables you to use CodeQL to query databases generated from source code.
6
-
* Shows the flow of data through the results of path queries, which is essential for triaging security results.
7
-
* Provides an easy way to run queries from the large, open source repository of [CodeQL security queries](https://github.com/Semmle/ql).
8
-
* Adds IntelliSense to support you writing and editing your own CodeQL query and library files.
5
+
- Enables you to use CodeQL to query databases generated from source code.
6
+
- Shows the flow of data through the results of path queries, which is essential for triaging security results.
7
+
- Provides an easy way to run queries from the large, open source repository of [CodeQL security queries](https://github.com/github/codeql).
8
+
- Adds IntelliSense to support you writing and editing your own CodeQL query and library files.
9
9
10
10
To see what has changed in the last few versions of the extension, see the [Changelog](https://github.com/github/vscode-codeql/blob/master/extensions/ql-vscode/CHANGELOG.md).
11
11
@@ -14,18 +14,18 @@ To see what has changed in the last few versions of the extension, see the [Chan
14
14
The information in this `README` file describes the quickest way to start using CodeQL.
15
15
For information about other configurations, see the separate [CodeQL help](https://help.semmle.com/codeql/codeql-for-vscode.html).
16
16
17
-
**Quick start: Installing and configuring the extension**
17
+
### Quick start: Installing and configuring the extension
18
18
19
19
1.[Install the extension](#installing-the-extension).
20
20
1.[Check access to the CodeQL CLI](#checking-access-to-the-codeql-cli).
21
21
1.[Clone the CodeQL starter workspace](#cloning-the-codeql-starter-workspace).
22
22
23
-
**Quick start: Using CodeQL**
23
+
### Quick start: Using CodeQL
24
24
25
25
1.[Import a database from LGTM](#importing-a-database-from-lgtm).
26
26
1.[Run a query](#running-a-query).
27
27
28
-
-----
28
+
---
29
29
30
30
## Quick start: Installing and configuring the extension
31
31
@@ -49,7 +49,7 @@ If you have any difficulty with CodeQL CLI access, see the **CodeQL Extension Lo
49
49
### Cloning the CodeQL starter workspace
50
50
51
51
When you're working with CodeQL, you need access to the standard CodeQL libraries and queries.
52
-
Initially, we recommend that you clone and use the ready-to-use starter workspace, https://github.com/github/vscode-codeql-starter/.
52
+
Initially, we recommend that you clone and use the ready-to-use [starter workspace](https://github.com/github/vscode-codeql-starter/).
53
53
This includes libraries and queries for the main supported languages, with folders set up ready for your custom queries. After cloning the workspace (use `git clone --recursive`), you can use it in the same way as any other VS Code workspace—with the added advantage that you can easily update the CodeQL libraries.
54
54
55
55
For information about configuring an existing workspace for CodeQL, [see the documentation](https://help.semmle.com/codeql/codeql-for-vscode/procedures/setting-up.html#updating-an-existing-workspace-for-codeql).
@@ -58,15 +58,17 @@ For information about configuring an existing workspace for CodeQL, [see the doc
58
58
59
59
You can easily keep up-to-date with the latest changes to the [CodeQL standard libraries](https://github.com/github/codeql).
60
60
61
-
If you're using the [CodeQL starter workspace](https://github.com/github/vscode-codeql-starter/), you can pull in the latest standard libraries by running:
61
+
If you're using the [CodeQL starter workspace](https://github.com/github/vscode-codeql-starter/), you can pull in the latest standard libraries by running:
62
+
62
63
```shell
63
-
$ git pull
64
-
$ git submodule update --recursive
64
+
git pull
65
+
git submodule update --recursive
65
66
```
67
+
66
68
in the starter workspace directory.
67
69
68
70
If you're using your own clone of the CodeQL standard libraries, you can do a `git pull` from where you have the libraries checked out.
69
-
71
+
70
72
## Quick start: Using CodeQL
71
73
72
74
You can find all the commands contributed by the extension in the Command Palette (**Ctrl+Shift+P** or **Cmd+Shift+P**) by typing `CodeQL`, many of them are also accessible through the interface, and via keyboard shortcuts.
@@ -75,23 +77,21 @@ You can find all the commands contributed by the extension in the Command Palett
75
77
76
78
While you can use the [CodeQL CLI to create your own databases](https://help.semmle.com/codeql/codeql-cli/procedures/create-codeql-database.html), the simplest way to start is by downloading a database from LGTM.com.
77
79
78
-
1. Log in to LGTM.com.
79
-
1. Find a project you're interested in and display the **Integrations** tab (for example, [Apache Kafka](https://lgtm.com/projects/g/apache/kafka/ci/)).
80
-
1. Scroll to the **CodeQL databases for local analysis** section at the bottom of the page.
81
-
1. Download databases for the languages that you want to explore.
82
-
1. For each database that you want to import:
83
-
1. Go to the CodeQL Databases view in the sidebar. Hover over the Databases title bar and click the icon to **Choose Database from Archive**.
84
-
1. Browse to the zipped database that you downloaded from LGTM.
85
-
86
-
Once you've added a CodeQL database, it is displayed in the Databases view.
80
+
1. Open [LGTM.com](https://lgtm.com) in your browser.
81
+
1. Search for a project you're interested in, for example [Apache Kafka](https://lgtm.com/projects/g/apache/kafka).
82
+
1. Copy the link to that project, for example `https://lgtm.com/projects/g/apache/kafka`.
83
+
1. In VS Code, open the Command Palette and choose the **CodeQL: Download Database from LGTM** command.
84
+
1. Paste the link you copied earlier.
85
+
1. Select the language for the database you want to download (only required if the project has databases for multiple languages).
86
+
1. Once the CodeQL database has been imported, it is displayed in the Databases view.
87
87
88
88
### Running a query
89
89
90
90
The instructions below assume that you're using the CodeQL starter workspace, or that you've added the CodeQL libraries and queries repository to your workspace.
91
91
92
92
1. Expand the `ql` folder and locate a query to run. The standard queries are grouped by target language and then type, for example: `ql/java/ql/src/Likely Bugs`.
93
93
1. Open a query (`.ql`) file.
94
-
3. Right-click in the query window and select **CodeQL: Run Query**. Alternatively, open the Command Palette (**Ctrl+Shift+P** or **Cmd+Shift+P**), type `Run Query`, then select **CodeQL: Run Query**.
94
+
1. Right-click in the query window and select **CodeQL: Run Query**. Alternatively, open the Command Palette (**Ctrl+Shift+P** or **Cmd+Shift+P**), type `Run Query`, then select **CodeQL: Run Query**.
95
95
96
96
The CodeQL extension runs the query on the current database using the CLI and reports progress in the bottom right corner of the application.
97
97
When the results are ready, they're displayed in the CodeQL Query Results view. Use the dropdown menu to choose between different forms of result output.
@@ -102,10 +102,10 @@ If there are any problems running a query, a notification is displayed in the bo
102
102
103
103
For more information about the CodeQL extension, [see the documentation](https://help.semmle.com/codeql/codeql-for-vscode.html). Otherwise, you could:
104
104
105
-
*[Create a database for a different codebase](https://help.semmle.com/codeql/codeql-cli/procedures/create-codeql-database.html).
106
-
*[Try out variant analysis](https://help.semmle.com/QL/learn-ql/ql-training.html).
107
-
*[Learn more about CodeQL](https://help.semmle.com/QL/learn-ql/).
108
-
*[Read how security researchers use CodeQL to find CVEs](https://securitylab.github.com/research).
105
+
-[Create a database for a different codebase](https://help.semmle.com/codeql/codeql-cli/procedures/create-codeql-database.html).
106
+
-[Try out variant analysis](https://help.semmle.com/QL/learn-ql/ql-training.html).
107
+
-[Learn more about CodeQL](https://help.semmle.com/QL/learn-ql/).
108
+
-[Read how security researchers use CodeQL to find CVEs](https://securitylab.github.com/research).
0 commit comments