CodeQL code scanning JavaScript ML-powered queries in beta 🚀

[AlonaHlobina]

We've launched code scanning JavaScript ML-powered queries in beta 🚀 !

What's in the box?

The four ML-powered queries focus on finding even more instances of the most common and dangerous JavaScript vulnerabilities, such as cross-site scripting (XSS) and SQL injection.

A CodeQL query identifies code that could be affected by a particular type of vulnerability. Our team and the community of security researchers continuously improve those queries to include more knowledge of the most common frameworks and libraries. For example, in order to flag up a SQL injection vulnerability in a web application, we need to recognise both (1) the web framework through which untrusted user data enters the application and (2) the SQL library that is used to execute the SQL query. CodeQL knows about many such frameworks and libraries, but not all — there are simply too many of them!

We trained a model by mining the patterns of such libraries and frameworks that are already covered by existing queries. The model learns from these examples and predicts potential additional sinks in which untrusted user data should not be used. The ML-powered queries can therefore find results otherwise missed by the original query.

Experimental alerts

ML-generated alerts are displayed alongside the other code scanning alerts in the security view of the repository, as well as in pull requests. The new alerts are marked with the Experimental label.

These alerts have a higher false positive rate relative to results generated by our standard queries. As with many machine learning models, results will improve over time, and we encourage everyone to experiment and provide feedback!

How do I enable it?

The new experimental alerts start appearing automatically on all repositories that enabled code scanning with CodeQL, contain JavaScript code, and have opted to use the security-extended or security-and-quality query suites.

Note: in its default configuration, code scanning uses the security query suite, which does not contain the new experimental queries.

To get the new experimental alerts you simply need to ensure your repository has enabled code scanning. Then add the security-extended or security-and-quality suites to your existing workflow (see below).

- uses: github/codeql-action/init@v1
  with:
      queries: +security-extended

How can I give feedback?

If you run into any problems or have a question about CodeQL code scanning ML-powered queries (setup, alerts, etc.), please respond to this thread. Please supply as much detail as you can about the issue you encountered, as well as information to reproduce if available. If you don't feel comfortable posting in this public discussion, please open a support ticket.

We also encourage you to use the CodeQL Discussions forum for any questions related to running or writing CodeQL.