Comment by spatulon | Hacker News Reader

Comment by spatulon | Hacker News Reader

Parent Full thread

I work on C/C++ analysis at Semmle, and am happy to answer any questions you might have. (We also support C#, Java, JavaScript, Python... and Cobol!)

We have a few high-profile projects using our automated code review (marketing people tell me I'm not allowed to call it 'PR integration' any more). One example is on the AMP Project, where we caught a regex injection vulnerability in a PR before a human looked at it: https://github.com/ampproject/amphtml/pull/13060

Our default analysis has found a few other vulnerabilities (remote buffer overflows due to misuse of snprintf in rsyslog and Icecast spring to mind) but, honestly, I think our strength lies in the fact that you can write custom queries that find bugs specific to a single codebase's foibles.

For example, my first ever CVE was for a vulnerability in ChakraCore. Google Project Zero found the original bug - type confusion caused by failure to check a flag indicating that the last element of a list should be cast to a different type - but we wrote a query to verify that code accessing that particular list always checked the flag. So when some new code got introduced with the same bug, we noticed as soon as we re-ran the query on the new commit.

Is there a public language reference on the query language? The Help section of the website only has intro examples. How long does it take for a new developer to learn to write non-trivial queries?

Any technical comparisons with other static analysis tools?

It would be useful to have a public database of QL sample queries alongside matching OSS code snippets. In theory, this could be constructed from Github, but presumably LGTM already has that historical viewpoint.

I think the QL handbook is what you're looking for: https://help.semmle.com/QL/ql-handbook/

Other QL references (such as the reference manuals for the language-specific libraries) are linked from here: https://help.semmle.com/QL/ql-home.html

Personally (having joined the company reasonably recently), I haven't found it particularly hard to figure out how to express my intentions in QL. Most complex queries start their lives as simple ones that return too many results; the complexity comes from adding extra conditions to refine the results, and is generally manageable. However, I do occasionally have difficulties where a query I'm developing returns no results, and my years of experience debugging imperative programs don't really help as much as I would like in figuring out what's wrong. It can also be quite easy for beginners to write queries that are interminably slow for non-obvious reasons; I believe we're working on documentation to help with that.

We do have a database of all the default queries here: https://help.semmle.com/wiki/display/QL/Built-in+queries

But I notice that not all of them have examples, and many of the examples we do have are fairly contrived. I like your idea of taking snippets from matching OSS projects.

Edit: our CEO gently reminded me that, if you look at the help page on lgtm.com for a particular query/rule/alert, you can get a list of all results across every OSS project we analyse, e.g. https://lgtm.com/rules/1506728586782/alerts/

Thanks for the references, that last link is very cool!

> It can also be quite easy for beginners to write queries that are interminably slow for non-obvious reasons; I believe we're working on documentation to help with that

RDBMS have the same challenge. Data visibility for query parser internals can help, https://www.embarcadero.com/images/dm/technical-papers/sybas...

> We also support C#, Java, JavaScript, Python... and Cobol!)

Where do these rank in chances of future support?

  - Go
  - Rust
  - Lua
  - Swift
  - Haskell

apparently golang is, but d is not: https://discuss.lgtm.com/t/which-languages-are-in-the-pipeli...

and no swift for now: https://discuss.lgtm.com/t/does-lgtm-support-swift/1575

Go support is currently in development, so very likely :)

As for the other languages there, there are no plans currently on the roadmap for 2019 to add any of them. However if this is something that particularly interests you, we'd encourage you to apply for a job and note that you'd like to add support for a particular language :)

Reply on news.ycombinator.com