How can i use CodeQL on partial c source code?

Question

I have a partial c source code of a project which as a result i can't build. Does anyone know if possible to run codeql on that project?

Normally, to create a database, the codeql cli requires to specify the command that builds the project and i wasn't able to bypass that, even though i would say it doesn't look very important being able to build the project.

I could be wrong though, any insights welcome.

Answer 1

CodeQL needs to know how to process each compilation unit you want to analyze, in order to get things like include paths, macros from the compiler command-line, C/C++ dialect and language version, and data model right. Because of this, there's no direct way of importing a project you can't build; interpreting arbitrary partial C/C++ source code accurately is just not possible.

Depending on your exact situation, you may be able to work around in various ways. For example, you could write a bash script that invokes gcc or clang on all the source files you care about, with your best-guess of options that should be passed, and suppressing the error exit code with || true or similar after each command. If you then give this script as the "build command" for CodeQL, it will follow your lead and interpret the code as your compiler invocations would. Even if you get compilation errors, you'll still get a (partial) CodeQL database which you can use.