CodeQl support for liquid template language

[amitjoshi438]

Hello everyone,

Does CodeQl support liquid or can someone suggest is there a way if I want to add support for it, how to get started?

Thanks

[adityasharad]

I will assume you are referring to the Liquid template language. As far as I am aware, CodeQL does not explicitly support analysis of Liquid templates, though it will attempt to gracefully continue in analysing the surrounding code if it detects Liquid templates within JS or Ruby code.

Can you please tell us in what context you are using Liquid that you would like to analyse, e.g. are you looking at JS code, Ruby code, or something else?

[amitjoshi438]

Thanks for the reply @adityasharad

So, we use liquid in website development, and it will be wrapped in HTML or JS code.

Example of liquid snippet which we would like to analyse:

{% assign userInput = request.params.userInput %} {{ userInput }}

If an attacker provides malicious input like {{ malicious_code_here }}, the Liquid template engine will execute this code as part of the rendering process. This can lead to various security risks, and we want to analyse liquid for such use cases.

Also sharing an example of how we consume liquid along with HTML:

`<div class="wrapper-body">
  <div class="container" role="main">
    {% editable page 'adx_copy' %}
  </div>
  <div class="push"></div>
</div>`

[amitjoshi438]

Hi @adityasharad, is some more information needed?

[mbg]

Hi @amitjoshi438 👋🏻

As @adityasharad noted, we don't explicitly support the analysis of Liquid templates and adding support for this is not something we have currently planned. You can see our plans for CodeQL on the public roadmap.

In terms of adding support for this yourself, we don't have (m)any resources to guide you in doing so, but many of the implementations of the languages we support are open-source in this repository. You could explore the code for and modify the Javascript extractor to see if you can add support for liquid templates there yourself.