Skip to content

Commit db98163

Browse files
felickzfelickz
committed
Add data extension prompts, templates, and barrier/barrierGuard support
Add comprehensive CodeQL data extension development guidance: - Common prompt with core principles, threat models, and CLI references - Language-specific prompts for C++, C#, Go, Java/Kotlin, JS/TS, Python, Ruby - Issue template and PR template for data extension workflow - barrierModel (sanitizers) and barrierGuardModel (validators) support across all languages (CodeQL 2.25.2+)
1 parent 8c13ba1 commit db98163

10 files changed

Lines changed: 2100 additions & 0 deletions

‎.github/ISSUE_TEMPLATE/data-extension-create.yml‎

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
name: Request new CodeQL Data Exension
2+
description: Request a new CodeQL query for detecting specific code patterns
3+
title: "[Data Extension Create]: "
4+
labels: ["data-extension-create", "enhancement"]
5+
body:
6+
- type: markdown
7+
attributes:
8+
value: |
9+
Thanks for requesting a new CodeQL data extension! This template helps Copilot Coding Agent understand your requirements.
10+
11+
- type: dropdown
12+
id: target-language
13+
attributes:
14+
label: Target Language
15+
description: Which programming language should this query target?
16+
options:
17+
- actions
18+
- cpp
19+
- csharp
20+
- go
21+
- java
22+
- javascript
23+
- python
24+
- ruby
25+
default: 0
26+
validations:
27+
required: true
28+
29+
- type: input
30+
id: library-url
31+
attributes:
32+
label: Library Repository / Documentation URL
33+
description: "Link to the library's source code or API documentation. A GitHub repository URL is ideal — it allows the agent to browse the source code directly to identify sources, sinks, and summaries."
34+
placeholder: "e.g., https://github.com/databricks/databricks-sql-python"
35+
validations:
36+
required: true
37+
38+
- type: input
39+
id: extension-name
40+
attributes:
41+
label: Data Extension Name (Optional)
42+
description: "Extension name (e.g., databricks-sql.model.yml). Use <library>-<module>.model.yml naming. If the library has multiple modules/sub-packages (e.g., library-core, library-web, library-api), create separate model files per module."
43+
placeholder: "e.g., databricks-sql.model.yml, django-http.model.yml"
44+
validations:
45+
required: false
46+
47+
- type: textarea
48+
id: library-modules
49+
attributes:
50+
label: Library Modules / Components
51+
description: "If the library has distinct modules or sub-packages, list them here. Each module may become a separate model file (e.g., library-core.model.yml, library-web.model.yml). Include the import paths or package names."
52+
placeholder: |
53+
- databricks.sql (SQL connector: connect, cursor, execute)
54+
- databricks.sdk (SDK client: WorkspaceClient, jobs, clusters)
55+
- databricks.connect (Spark session bridge)
56+
validations:
57+
required: false
58+
59+
- type: textarea
60+
id: description
61+
attributes:
62+
label: Data Extension Description
63+
description: "Describe the library/framework to model. What methods are sources of untrusted data? What methods are security-sensitive sinks? What methods sanitize data (barriers) or validate data (barrier guards)? All applicable model types (sourceModel, sinkModel, summaryModel, barrierModel, barrierGuardModel, typeModel, neutralModel) will be generated automatically."
64+
placeholder: |
65+
Library: databricks-sql-connector
66+
- Sources: None (uses Flask request sources)
67+
- Sinks: cursor.execute(query) is a SQL injection sink
68+
- Summaries: connect() returns a connection, connection.cursor() returns a cursor
69+
- Barriers: db_escape(value) sanitizes output for SQL injection
70+
- Barrier Guards: is_safe_query(query) returns true when query is safe for SQL injection
71+
72+
Docs: https://docs.databricks.com/...
73+
validations:
74+
required: true
75+
76+
- type: textarea
77+
id: examples
78+
attributes:
79+
label: Code Examples
80+
description: Provide sample end to code that should be detected
81+
placeholder: |
82+
```java
83+
package org.example;
84+
85+
# Undertow is not supported out of the box
86+
import io.undertow.Undertow;
87+
import io.undertow.server.HttpHandler;
88+
import io.undertow.server.HttpServerExchange;
89+
import io.undertow.util.Headers;
90+
import java.util.Deque;
91+
import javax.crypto.Cipher;
92+
93+
public class App {
94+
public String getGreeting() {
95+
return "Hello World!";
96+
}
97+
98+
public static void main(String[] args) {
99+
System.out.println(new App().getGreeting());
100+
try {
101+
Runtime.getRuntime().exec("ls");
102+
Cipher rsanopad = Cipher.getInstance("RSA/ECB/NoPadding");
103+
} catch (Exception e) {
104+
System.out.println(e.getMessage());
105+
}
106+
107+
Undertow server = Undertow.builder()
108+
.addHttpListener(8080, "localhost")
109+
.setHandler(new HttpHandler() {
110+
@Override
111+
public void handleRequest(final HttpServerExchange exchange) throws Exception {
112+
String name = "world";
113+
Deque<String> res = exchange.getQueryParameters().get("namex"); // SOURCE
114+
if (res != null) {
115+
name = res.getFirst();
116+
}
117+
exchange.getResponseHeaders().put(Headers.CONTENT_TYPE, "text/html");
118+
exchange.getResponseSender().send("<html><body>Hello " + name + "</body<</html>"); // SINK XSS
119+
}
120+
}).build();
121+
server.start();
122+
}
123+
}
124+
```
125+
validations:
126+
required: false
127+
128+
- type: input
129+
id: references
130+
attributes:
131+
label: Additional References (Optional)
132+
description: "Any other links — API docs, CWE references, related CodeQL queries, or security advisories."
133+
placeholder: "e.g., https://docs.databricks.com/sql/connector.html"
134+
validations:
135+
required: false
136+
137+
- type: checkboxes
138+
id: terms
139+
attributes:
140+
label: Code of Conduct
141+
options:
142+
- label: I agree to follow this project's Code of Conduct
143+
required: true

‎.github/PULL_REQUEST_TEMPLATE/data-extension-create.md‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
---
2+
name: 📦 New CodeQL Data Extension
3+
about: Pull request for creating a new CodeQL data extension model
4+
title: '[NEW DATA EXTENSION] '
5+
labels:
6+
- data-extension-create
7+
- enhancement
8+
---
9+
10+
## 📝 Data Extension Information
11+
12+
- **Language**: <!-- e.g., java, python, javascript -->
13+
- **Extension Name(s)**: <!-- e.g., databricks-sql.model.yml. Use <library>-<module>.model.yml naming. List all files if multiple modules. -->
14+
- **Extension Types**: <!-- sourceModel, sinkModel, summaryModel, barrierModel, barrierGuardModel, neutralModel, typeModel -->
15+
- **Target Library/Framework**: <!-- e.g., Undertow, Databricks SQL -->
16+
- **Library Modules Covered**: <!-- List the distinct modules/sub-packages modeled, one per model file. e.g., databricks.sql, databricks.sdk -->
17+
18+
## 🎯 Description
19+
20+
### What This Data Extension Models
21+
22+
<!-- Clear description of the library/framework being modeled and what sources, sinks, summaries, barriers (sanitizers), or barrier guards (validators) it adds -->
23+
24+
### Threat Model
25+
26+
<!-- e.g., remote, local (file, commandargs, database, environment, stdin, windows-registry) -->
27+
28+
### Example Vulnerable Code
29+
30+
```[language]
31+
// Code that should be detected with this data extension
32+
```
33+
34+
### Example Safe Code
35+
36+
```[language]
37+
// Code that should NOT be detected
38+
```
39+
40+
## 📦 Extension Details
41+
42+
### Extension YAML
43+
44+
<!-- Provide the data extension YAML content or a summary of the models added -->
45+
46+
```yaml
47+
extensions:
48+
- addsTo:
49+
pack: codeql/[language]-all
50+
extensible: sinkModel
51+
data:
52+
# - ["package","Member[...].Argument[0]","sink-kind"]
53+
```
54+
55+
### Access Path Explanation
56+
57+
<!-- Explain the access path(s) used and how they map to the target API -->
58+
59+
## 🧪 Testing
60+
61+
- [ ] Extension YAML resolves without errors
62+
- [ ] Database created with sample code (`codeql database create` or `codeql test extract`)
63+
- [ ] Single query verified with extension applied (`codeql query run --additional-packs=<model-pack-dir>`)
64+
- [ ] Unit tests pass with extension applied (`codeql test run --additional-packs=<model-pack-dir>`)
65+
- [ ] Positive test cases (vulnerable code detected)
66+
- [ ] Negative test cases (safe code not flagged)
67+
68+
## 📋 Checklist
69+
70+
- [ ] Extension YAML is valid and properly formatted
71+
- [ ] Extension placed in correct location (`languages/[language]/custom/src/`)
72+
- [ ] `qlpack.yml` includes `dataExtensions` configuration
73+
- [ ] Access paths verified via API graph queries
74+
- [ ] No false positives in test cases
75+
- [ ] Documentation/comments included in YAML
76+
77+
## 🔗 References
78+
79+
<!-- Links to library/framework docs, CWE, OWASP, or related queries -->
80+
81+
---
82+
83+
**Note**: This data extension was developed following CodeQL Models as Data best practices.

0 commit comments

Comments
 (0)