Accepting configuration information from user in a CodeQL query

[r4k3-sh]

Is there a way in CodeQL to get user input inside a CodeQL query (e.g. read from a configuration file)? It may required in case we want to setup a particular threshold value for a rule and seek that value from the user via a configuration file. I couldn't find a way to do it from my searches around this topic.

[intrigus-lgtm]

(The CodeQL language does not provide any way to read files that are not included in a database as far as I'm aware)

You could consider using an external predicate and supply a CSV file with the threshold value(s) for that predicate when running the query.

external string getAThreshold();

> codeql query run --help
Usage: codeql query run [OPTIONS] -- <file.ql>
Run a single query.
...
      --external=<pred>=<file.csv>
                             A CSV file that contains rows for external
                               predicate <pred>. Multiple --external options
                               can be supplied.
...

(Adapted from #9758 (comment) by @aibaars)

I don't think there is currently another way besides editing the CodeQL query itself or using an external predicate.

[r4k3-sh]

Thanks for the reply! What does the implementation of getAThreshold() look like? Do we need to open the csv file and look for the row containing the threshold value? Are there constructs in CodeQL that help us to read a file? Its not very clear how this works.

[MathiasVP]

getAThreshold should not have an implementation (since it's marked as external). You really just need to copy-paste in the line that @intrigus-lgtm wrote. For example, if your query looks like:

import cpp

external int getAThreshold();

select getAThreshold()

and you have a a csv file named foo-data.csv with the following contents:

42

then you can then invoke CodeQL with a command like:

codeql query run /path/to/my-database /path/to/my-query --external=getAThreshold=/path/to/foo-data.csv

and you'll get the value 42.

[r4k3-sh]

Thanks for the detailed answer!