CodeQL Lab: Java Command Injection Detection

This repository is a practical lab focused on AppSec and SAST using CodeQL. The main goal is to detect command injection vulnerabilities using modern Taint Tracking techniques.

Overview

The lab analyzes a Java application (src/App.java) that takes user input through System.console().readLine() and passes it directly to Runtime.getRuntime().exec(). This creates a critical vulnerability where an attacker can execute arbitrary commands on the system.

Project Structure

• src/: Contains the vulnerable Java source code.
• queries/: Custom CodeQL queries.
  • find-exec.ql: Basic query to locate sinks.
  • path-problem.ql: Advanced Taint Tracking query using the modern CodeQL API.
• qlpack.yml: Configuration file for the CodeQL pack.

How to Run

Prerequisites

• CodeQL CLI installed and in your PATH.
• VS Code with the official CodeQL extension.

Step 1: Create the Database

Run this command from the root directory to build the CodeQL database:

codeql database create db-java --language=java --source-root=./src

Step 2: Run the Analysis

Execute the taint tracking query and generate the results in SARIF format:

codeql database analyze db-java queries/path-problem.ql --format=sarifv2.1.0 --output=results.sarif

Step 3: Review Results

You can open results.sarif in VS Code using a SARIF viewer or use the CodeQL extension to run the queries interactively and see the full data flow paths from source to sink.

Key Concepts

• Source: Untrusted user input via readLine.
• Sink: Dangerous execution function exec.
• Taint Tracking: Mapping how data flows from a source to a sink without proper sanitization.
• Modern API: Implementation using the DataFlow::ConfigSig and TaintTracking::Global modules.