There is no parsing library for `build.gradle` file

[fxzyyy]

I found that there is no parsing library for build.gradle in the CodeQL library. Are there any considerations for supporting it? need to support Groovy code.

[sj]

Thanks for the suggestion, @fxzyyy! At the moment we don't have Groovy support on our roadmap. What sort of CodeQL queries would you like to write on build.gradle? Are there particular security problems you're interested in?

[intrigus-lgtm]

One important advantage of being able to parse build.gradle files would be information on which dependencies are used and their version.

[sj]

How exactly would you like to use that data in a CodeQL query? What sort of security problem are you looking for that requires that data? Are there other possible sources for that data?

[intrigus-lgtm]

Have a look at these two code snippets:

codeql/java/ql/src/experimental/Security/CWE/CWE-094/SpringViewManipulationLib.qll

Lines 12 to 21 in b0fa8df

	predicate thymeleafIsUsed() {
	exists(Pom p |
	p.getADependency().getArtifact().getValue() in [
	"spring-boot-starter-thymeleaf", "thymeleaf-spring4", "springmvc-xml-thymeleaf",
	"thymeleaf-spring5"
	]
	)
	or
	exists(SpringBean b | b.getClassNameRaw().matches("org.thymeleaf.spring%"))
	}

codeql/java/ql/src/experimental/Security/CWE/CWE-094/SpringViewManipulation.ql

Lines 16 to 21 in b0fa8df

	from DataFlow::PathNode source, DataFlow::PathNode sink, SpringViewManipulationConfig conf
	where
	thymeleafIsUsed() and
	conf.hasFlowPath(source, sink)
	select sink.getNode(), source, sink, "Potential Spring Expression Language injection from $@.",
	source.getNode(), "this user input"

The predicate thymeleafIsUsed only works with maven based projects.
So this specific query can only find results in maven based projects, but not in gradle based ones.

So the use-case would be:
Checking whether a specific dependency is used at all or whether a specific dependency version is used.
To determine whether a vulnerability really exists.

Other possible sources for that data:
I think getting this data is possible without parsing build.gradle files. (Using some specific gradle command that generates a list of dependencies)
I remember that @JLLeitschuh also commented on a similar issue on Github (or was it on Slack?), but I can't find the comment right now.

[fxzyyy]

How exactly would you like to use that data in a CodeQL query? What sort of security problem are you looking for that requires that data? Are there other possible sources for that data?

It is relative to the analysis of the build.gradle file to find the dependent components used by the project. Because the dependent components may have vulnerabilities.

[JLLeitschuh]

Also, being able to look for repositories blocks would allow me to expand these queries:

• https://lgtm.com/rules/1511115648721/
• https://lgtm.com/rules/1513539141514/

[github-actions]

This issue is stale because it has been open 14 days with no activity. Comment or remove the stale label in order to avoid having this issue closed in 7 days.