Variant analysis
summary
Shows real results: a semantic query engine built as CodeQL (originating at Semmle, now on GitHub) encodes taint‑tracking and interprocedural data‑flow in a declarative Datalog‑style language and runs at scale. Concrete wins include the Curiosity landing code pattern that surfaced 30 similar bugs, a Java template‑injection RCE found across container orchestration and contact‑tracing servers, and multiple responsibly disclosed fixes. The talk demonstrates exact query predicates, evaluation flow, and how to extend libraries to reduce false positives.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 8:25Variant analysis
- 10:08Variant analysis tools
- 18:06Queries
- 20:28Visual Studio Code
- 30:25patterns
- 34:04future work
- 37:40secret sauce
- 41:22education
- 44:58codeql themes
- 51:12soft side of ML
- 53:29final thoughts
related talks
23mStopping vulnerabilities at the source
37mSecurity as Code: A DevSecOps Approach
34mHow To Find And Prevent Entire Classes Of Security Vulnerabilities
32mCodeQL: Also a Powerful Binary Analysis Engine
33mSecurity as Code: A DevSecOps Approach
22mSecurity as Code: A DevSecOps Approach
19mScalable Language Agnostic Taint Tracking using Explicit Data Dependencies
59mSecurity as Code: A DevSecOps Approach