logo

CodeQL zero to hero part 5: Debugging queries

ID: 5034c3ec-49f0-5008-a808-7b44553a1e39

STIX ID: report--5034c3ec-49f0-5008-a808-7b44553a1e39

Feed Name: GitHub Security Lab

Date Published: 2025-09-29

Date Updated: 2026-04-27

Author: Sylwia Budzynska

...
...

This post teaches how to debug and improve CodeQL taint-tracking queries by walking through a Gradio-based unsafe deserialization example (user-uploaded file passed via `gr.File.name` to `open()` and `pickle.load`). It shows how to minimize examples, use Quick Evaluation, AST viewer, and `getAQlClass`, analyze partial path graphs to find where taint stops, and add targeted taint steps (e.g., attribute read of `name`, propagation through `open`) to reach deserialization sinks, culminating in a refined, more maintainable query.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.