.bqrs file¶

A binary query result set (BQRS) file. BQRS is the binary representation of the rawresult of a query, with the extension.bqrs. A BQRS file can beinterpreted into meaningful results and related to your source code. Forexample, alert query results are interpreted to display a string at thelocation in the source code where the alert occurs, as specified in the query.Similarly, path query results are interpreted as pairs of locations(sources and sinks) between which information can flow. These results can beexported as a variety of different formats, including SARIF.

CodeQL database¶

A database (or CodeQL database) is a directory containing:

• queryable data, extracted from the code.

• a source reference, for displaying query results directly in the code.

• query results.

• log files generated during database creation, queryexecution, and other operations.

CodeQL packs¶

CodeQL packs are used to create, share, depend on, and run CodeQL queries, libraries, and models. You can publish your own CodeQL packs and download packs created by others. CodeQL query packs may contain queries, library files, query suites, and metadata. CodeQL library packs include one or more CodeQL libraries. CodeQL model packs include one or more data extension files that extend the core libraries by modeling additional libraries and frameworks (dependencies of your code base).

Data extensions¶

When you want to model the sources and sinks of a custom dependency, you can create a CodeQL library (.qll file) and write queries that use it, but it’s usually much simpler to create a data extension file. If you model the sources and sinks in data extension, you can use this information to expand the standard queries to cover your custom dependencies. You don’t need to write any new queries.

DIL¶

DIL stands for Datalog Intermediary Language. It is an intermediaterepresentation between QL and relation algebra (RA) that is generatedduring query compilation. DIL is useful for advanced users as an aidfor debugging query performance.The DIL format may change without warning between CLI releases.

When you specify the--dump-dil option forcodeqlquerycompile, CodeQLprints DIL to standard output for the queries it compiles. You can alsoview results in DIL format when you run queries in VS Code.For more information, seeRunning CodeQL queries in the GitHub documentation.

Extractor¶

An extractor is a tool that produces the relational data and sourcereference for each input file, from which a CodeQL database can be built.

QL database schema¶

A QL database schema is a file describing the column types andextensional relations that make up a raw QL dataset. It is a text filewith the.dbscheme extension.

The extractor and core CodeQL pack for a language each declare the databaseschema that they use. This defines the database layout they create orexpect. When you create a CodeQL database, the extractor copiesits schema into the database. The CLI uses this to check whether theCodeQL database is compatible with a particular CodeQL library.If they aren’t compatible you can usedatabaseupgrade to upgradethe schema for the CodeQL database.

There is currently no public-facing specification for the syntax of schemas.

.qlo files¶

.qlo files are optionally generated during query compilation.If you specify the--dump-qlo option forcodeqlquerycompile,CodeQL writes.qlo files for the queries it compiles. They can be usedas an aid for debugging and performance tuning for advanced users.

.qlo is a binary format that represents a compiledand optimized query in terms of relational algebra (RA) or theintermediateDIL format..qlo files can be expanded toreadable text usingcodeqlquerydecompile.

The exact details of the.qlo format may change without warning between CLI releases.

SARIF file¶

Static analysis results interchange format (SARIF) is an output format used forsharing static analysis results. For more information, see “SARIF.”

Source reference¶

A source reference is a mechanism that allows the retrieval of thecontents of a source file, given an absolute filename at which that fileresided during extraction. Specific examples include:

• A source archive directory, within which the requested absolutefilename maps to a UTF8-encoded file.

• A source archive, typically in ZIP format, which contains the UTF8-encodedcontent of all source files.

• A source archive repository, typically ingit format, typically bare,which contains the UTF8-encoded content of all source files.

Source references are typically included in CodeQL databases.

TRAP file¶

A TRAP file is a UTF-8 encoded file generated by a CodeQL extractorwith the extension.trap. To save space, they are usually archived. Theycontain the information that, when interpreted relative to a QL databaseschema, is used to create a QL dataset.