World map

 

BM

World 8: Shields: Security

CodeQL basics

You will learn: how CodeQL finds risky code before attackers do.

The problem

Your login page works. The tests pass. But one line lets a trickster read every user’s data. Could you find it in 500 files?

Watch

CodeQL: GitHub's code detective. It turns code into data and asks questions to find risky code. is a code detective from GitHub. It turns your code into data. Then it asks questions, like “can typed text reach the database?”

Try it

Be the detective. Tap the line that glues typed text into a database question.

Tap the line that glues typed text into the query.

0 of 1 found

Watch

CodeQL runs as code scanning: Automatic checks, like CodeQL, that look for security problems in your code.. Turn it on. Then GitHub Actions checks your code on pushes and pull requests. Problems show up as alerts on the exact line.

Try it

Three guards, three jobs. Who catches what?

Drag a card into a box. Or tap the card, then tap the box.

        Predict

        CodeQL flags a line in your pull request. What now?

        Check

        Put the code scanning loop in order, first at the top.

        First step at the top. Put these in order. Use the arrows, or drag.

        • Open a pull request
        • Turn on code scanning
        • You read the alert and fix the line
        • CodeQL checks the new code

        You did it!

        You can now let CodeQL hunt for risky code.

        Go deeper (optional)

        The bug in the detective card is called SQL injection. CodeQL knows many languages, like JavaScript, Python, Java, Go, C# and Ruby. Default setup picks settings for you. Advanced setup adds a workflow file that you can change.