QL是一种查询语言，支持对C++，C#，Java，JavaScript，Python，go等多种语言进行分析，可用于分析代码，查找代码中控制流等信息。

from QueryInjectionSink query, DataFlow::PathNode source, DataFlow::PathNode sink where queryTaintedBy(query, source, sink)selectquery, source,sink

class QueryInjectionFlowConfig extends TaintTracking::Configuration {//定义配置 this可以随意写  QueryInjectionFlowConfig() { this = "SqlInjectionLib::QueryInjectionFlowConfig" }//定义source的来源，这里是来自RemoteFlowSource，这是一个官方写的class，较为全面的定义了远程可控的来源，但是还是有一些问题。我做了一些补充，以后会提及  override predicate isSource(DataFlow::Node src) { src instanceof RemoteFlowSource }//QueryInjectionSink定义了sink的约束条件  override predicate isSink(DataFlow::Node sink) { sink instanceof QueryInjectionSink }//过滤条件，这里对node中的数据类型做了判断，如果是一些int long之类的数据类型就会抛弃不会进入数据流判断，这也是CodeQL较为准确的识别SQL注入的原因之一。  override predicate isSanitizer(DataFlow::Node node) {    node.getType() instanceof PrimitiveType or    node.getType() instanceof BoxedType or    node.getType() instanceof NumberType  }}

predicate queryTaintedBy(  QueryInjectionSink query, DataFlow::PathNode source, DataFlow::PathNode sink) {  exists(QueryInjectionFlowConfig conf | conf.hasFlowPath(source, sink) and sink.getNode() = query)}

接下来我们开始定义个简单的谓词

string methodIsPostOrGet(DataFlow::PathNode source){    if source.getNode().asParameter().getAnAnnotation().toString().regexpMatch("RequestParam")    then result = "get"    else result = "post"   }

from QueryInjectionSink query, DataFlow::PathNode source, DataFlow::PathNode sink where queryTaintedBy(query, source, sink)selectquery, "接口地址:",//获得source的注解的值，Spring中为接口地址source    .getNode()    .asParameter()    .getCallable()    .getAnAnnotation()    .getValue("value"),"接口参数:",//获得接口的参数名source    .getNode()    .asParameter()    .getAnAnnotation().getValue("value"),//获得sink所在的文件位置"文件地址:",sink.getNode().asExpr().getLocation(),//获得source节点的路径的http方法"请求类型:",methodIsPostOrGet(sink),"注解内容为:",//获得注解source.getNode().asParameter().getAnAnnotation().toString()

POST http/1.1header:xxxxx
Username=xsser’ and 1=1

GET /url/from/Spring?username=xsser%27 and 1=1 http/1.1hederxxxxxxx

abstract class PathCreation extends Expr {  abstract Expr getInput();}
class PathsGet extends PathCreation, MethodAccess {  PathsGet() {    …  }
  override Expr getInput() { result = this.getAnArgument() }}
class FileSystemGetPath extends PathCreation, MethodAccess {  FileSystemGetPath() {    …  }
  override Expr getInput() { result = this.getAnArgument() }}
class FileCreation extends PathCreation, ClassInstanceExpr {  FileCreation() { …}
  override Expr getInput() {    result = this.getAnArgument() and    // Relevant arguments include those that are not a `File`.    not result.getType() instanceof TypeFile  }}
class FileWriterCreation extends PathCreation, ClassInstanceExpr {  FileWriterCreation() { this.getConstructedType().getQualifiedName() = "java.io.FileWriter" }
  override Expr getInput() {    result = this.getAnArgument() and    // Relevant arguments are those of type `String`.    result.getType() instanceof TypeString  }}
predicate inWeakCheck(Expr e) {  none()}
// Ignore cases where the variable has been checked somehow,// but allow some particularly obviously bad cases.predicate guarded(VarAccess e) {  none()  )}

abstract class PathCreation extends Expr {    abstract Expr getInput();  }    class PathsGet extends PathCreation, MethodAccess {    // 寻找`java.nio.file.Paths`类下的get方法    PathsGet() {      exists(Method m | m = this.getMethod() |        m.getDeclaringType() instanceof TypePaths and        m.getName() = "get"      )    }    // 返回这个方法的集合    override Expr getInput() { result = this.getAnArgument() }  }    class FileSystemGetPath extends PathCreation, MethodAccess {    // 寻找`java.nio.file.FileSystem`类下的getPath方法并通过getInput方法返回这个集合    FileSystemGetPath() {      exists(Method m | m = this.getMethod() |        m.getDeclaringType() instanceof TypeFileSystem and        m.getName() = "getPath"      )    }      override Expr getInput() { result = this.getAnArgument() }  }    class FileCreation extends PathCreation, ClassInstanceExpr {    //   限定实例化的对象的原型在`java.io.File`类下    // 例如new xxx()  这个xxx必须在`java.io.File`下    FileCreation() { this.getConstructedType() instanceof TypeFile }      override Expr getInput() {        // 获得上述实例化的class的参数，并且这个参数的类型必须是file类型的，并返回满足and条件的参数集合      result = this.getAnArgument() and      // Relevant arguments include those that are not a `File`.      not result.getType() instanceof TypeFile    }  }    class FileWriterCreation extends PathCreation, ClassInstanceExpr {    //   限定在`java.io.FileWriter`类下    FileWriterCreation() { this.getConstructedType().getQualifiedName() = "java.io.FileWriter" }    // 返回参数类型是String类型的参数    override Expr getInput() {      result = this.getAnArgument() and      // Relevant arguments are those of type `String`.      result.getType() instanceof TypeString    }  }    predicate inWeakCheck(Expr e) {    // None of these are sufficient to guarantee that a string is safe.    // 约束一个类下的方法如果是startswith等方法，注意这里的方法是原生的，这里建议扩大覆盖范围，使用matches去匹配类似的方法名    exists(MethodAccess m, Method def | m.getQualifier() = e and m.getMethod() = def |      def.getName() = "startsWith" or      def.getName() = "endsWith" or      def.getName() = "isEmpty" or      def.getName() = "equals"    )    or    // Checking against `null` has no bearing on path traversal.    exists(EqualityTest b | b.getAnOperand() = e | b.getAnOperand() instanceof NullLiteral)  }    // Ignore cases where the variable has been checked somehow,  // but allow some particularly obviously bad cases.  predicate guarded(VarAccess e) {    //   一个参数必须存在于上面抽象类返回结果的集合中且条件分支为True的情况下的方法，还要不是StartsWith等方法    exists(PathCreation p | e = p.getInput()) and    exists(ConditionBlock cb, Expr c |      cb.getCondition().getAChildExpr*() = c and      c = e.getVariable().getAnAccess() and      cb.controls(e.getBasicBlock(), true) and      // Disallow a few obviously bad checks.      not inWeakCheck(c)    )  }