2024-09-05 –, Workshop track 2
It is a truth universally acknowledged, that finding and reporting vulnerabilities in software may be a daunting task. However little known, there are tools and techniques that may assist on this journey.
CodeQL is a static analysis tool that can be used to automatically scan your applications for vulnerabilities and to assist with a manual code review. We can use it to find vulnerabilities in software at scale, in thousands of projects at once.
Join me in this beginner-friendly primer about finding vulnerabilities in software with CodeQL. Perhaps, by the end of this session, you might get inspired and learn how to find your own.
This session will introduce fundamentals of security research when looking for vulnerabilities in software via source code review. We will use an example of a simple vulnerability, walk through how CodeQL could detect it, and provide examples on how the audience could use CodeQL to find vulnerabilities themselves. We will also introduce how we could scale our security research to thousands of projects at once using multi-repository variant analysis.
If you can, please set up the workshop codespace before the workshop by following the instructions in the workshop repository: http://gh.io/orangecon-2024-ws
The codespace is basically a virtual machine from GitHub, which you can use for free for up to 120 hours, and this one will automatically set up everything you need for running CodeQL. After you are done remember to go to https://github.com/codespaces, select the three dots next to the codespace and choose “Stop codespace” so you don’t use up your hours.
We are also going to set it up together during the workshop, so feel free to wait until the workshop day with setup.
Sylwia is security researcher at GitHub Security Lab, where she works with finding vulnerabilities in open source software. See hers, as well as other Security Lab researchers' advisories at securitylab.github.com/advisories.
In her free time, she enjoys Magic The Gathering and other TCGs, reading, and playing JRPGs.