CodeQL based vulnerability discovery We are actively developing and refining the tool, and what has been uploaded is an early version of the initial implementation.
the rules_gen.py script generates a QL query based on AST differences between pre-patch and post-patch code.
Required Arguments: -p, --project PROJECT Project name (used as filename prefix)
Optional Arguments: -o, --output OUTPUT Output directory (default: current directory) -i, --input_dir INPUT_DIR Input file directory (default: current directory)
Input Files: Expects two input files in the specified input directory:
{project}_AST_unpatched.csv (AST data before patching)
{project}_AST_patched.csv (AST data after patching)
Output: Generates {project}_ql.ql file in the specified output directory
Example: python script.py -p myproject -i ./data -o ./results This will process:
Input: ./data/myproject_AST_unpatched.csv
Input: ./data/myproject_AST_patched.csv
Output: ./results/myproject_ql.ql