CFG for shell script in CodeQL

[rizwanhrizvi]

Hello, we are looking for methods to extract control flow graph from shell scripts?

We tried getACommand (by calling it multiple times against the same script). However, it seems the sequence of results, which are commands in the target script, does not necessarily follow the order of those commands in the script file (or the run section of workflow file).

Just want to clarify: Are there any support of basic control-flow graph in CodeQL?

[d10c]

Hi, thanks for reaching out. Just to be clear, which language are you trying to analyze with CodeQL?

If you're trying to run CodeQL against standalone shell scripts, then it won't work because it's not one of the officially supported languages.

But if you're trying to analyze a GitHub Action that contains an embedded shell script, then instead of ShellScript.getACommand(), which returns the commands in a script in an arbitrary order, use ShellScript.getCommand(int index), which returns the command at a specific index. That's a common idiom in QL: getAFoo() is the same as getFoo(_). You can also check out getStmt(int i), getCmd(int i), getFileReadCommand(int i), and getAssignment(int i), which are different ways of looking into a (Bash)ShellScript and can be used as building blocks for a bash CFG.

However, the existing Actions CFG module (codeql.actions.Cfg) doesn't appear to compute a CFG at the granularity of individual shell script commands.

[rizwanhrizvi]

Hi thanks for your timely response.

Our goal is analyzing shell scripts (extracted from workflow files, say under the “run” sections). I guess your suggestion for getCommand(i) works for straightline code block. Just wonder if there are any CFG support for conditional statements, like if else clause or even loops in shell scripts.

[redsun82]

👋 @rizwanhrizvi there is no such support for the moment. Having support for that in practice corresponds to implementing full CodeQL support for the sh/bash language as a whole. This is currently not on our roadmap, but we may consider it in the future.