Getting Started with CodeQL: Static Analysis for Java Projects

Stepping into the world of static code analysis, I was introduced to CodeQL — a powerful query-based code analysis tool developed by GitHub. Over the past two weeks, I explored how to use CodeQL for analyzing Java codebases and automated the entire process using Bash and Docker. Here’s a beginner-friendly summary of what I learned.

What is CodeQL?

CodeQL is a static analysis engine that treats code like data. You can write queries in a language similar to SQL to find security flaws and bugs across large codebases.

For example, you can write a query to detect if any user input is passed directly to system commands without sanitization — a potential command injection vulnerability.

How Does CodeQL Work?

CodeQL works in three major phases:

• Database Creation: CodeQL converts your codebase into a queryable database that represents code structures like classes, methods, control flow, etc.
• Query Execution: You write queries (in a custom language similar to SQL) to extract patterns, detect vulnerabilities, or understand behavior. CodeQL runs these queries over the database and produces results.
• Results Analysis: The tool outputs potential vulnerabilities based on your queries

Example query:

from Method m
where m.getName() = "login"
select m, "Login method found."

How to Build a CodeQL Database

For Java projects, creating a CodeQL database requires:

• Checking out the project and ensuring it builds correctly.
• Running the CodeQL CLI with:

codeql database create my-db --language=java --command="mvn clean install"

The command above builds the project with Maven while CodeQL tracks everything needed for its internal database.

Java Build System

• Maven: A popular build automation tool for Java. It uses a pom.xml file to manage project structure, dependencies, and build plugins.
• POM (Project Object Model): This XML file declares Java version, Maven plugins, project dependencies, and build targets.
• SDKMAN: A version manager to install and switch between different Java and Maven versions.

Automating Java Build and CodeQL with Bash and Docker

I built a bash script that:

• Parses pom.xml to extract Java and Maven versions.
• Uses SDKMAN to install those versions inside Docker.
• Builds the project and runs CodeQL analysis.
• Mounts the results to the host system.

This automation ensures consistency, reproducibility, and portability across any Java project.

Why It’s Useful for Bug Bounty Hunters

For security researchers and bug bounty hunters:

• CodeQL allows writing reusable, precise vulnerability queries
• You can scan thousands of open-source projects for flaws in minutes
• It helps discover zero-days and high-impact bugs that automated scanners often miss

GitHub even provides CodeQL databases for many OSS projects, so you don’t need to build them yourself.

Final Thoughts

Learning CodeQL from scratch as an intern was both challenging and rewarding. It helped me understand how static analysis tools work under the hood, how security vulnerabilities can be detected programmatically, and how automation can scale these processes efficiently.

Whether you’re a developer, a security enthusiast, or a student like me. I highly recommend giving CodeQL a try!