Step 9 - Write your own class about codeql-uboot

[github-learning-lab]

The exists quantifier

So far, we have declared variables in the from section of a query clause. Sometimes we need temporary variables in other parts of the query, and don't want to expose them in the query clause. The exists keyword helps us do this. It is a quantifier: it introduces temporary variables and checks if they satisfy a particular condition.

To understand how exists works, visit the documentation.

Then look at this example from the “Find the thief” CodeQL tutorial:

from Person t
where exists(string c | t.getHairColor() = c)
select t

This query selects all persons with a hair color that is a string. So we'll get all persons that are not bald, since we are able to find a c that defines their hair color. We don't really need c in the query except to know that it exists.

[github-learning-lab]

⌨️ Activity: Write your own NetworkByteSwap class

1. We recommend that you first read the documentation on CodeQL classes.

2. Edit the file 9_class_network_byteswap.ql with the template below:

   import cpp
   
   class NetworkByteSwap extends Expr {
     NetworkByteSwap () {
       // TODO: replace <class> and <var>
       exists(<class> <var> |
         // TODO: <condition>
       )
     }
   }
   
   from NetworkByteSwap n
   select n, "Network byte swap"

3. This class extends Expr, which means it is a subclass of Expr, and it begins by taking all values from Expr. Now you need to restrict it to only the expressions we are interested in, which satisfy the condition of step 8.

   • You can do this by editing the characteristic predicate NetworkByteSwap() { ... }. The template includes the exists quantifier, which will help.
   • Declare a temporary variable in the exists that refers to a macro invocation.
   • Constrain this macro invocation in the condition section of the exists. Use the same logic from the where section of your query in step 8.
   • How is the macro invocation related to the expression? Use the same logic from the select section of your query in step 8. You can refer to the macro invocation using the name of the variable you created, and you can refer to the expression using the this variable.

4. Once you're happy with the results, submit your solution.

[github-learning-lab]

Congratulations, looks like the query you introduced in f4139ed finds the correct results!

If you created a pull request, merge it.

Let's continue to the next step.