QL playground

playground.ql

//
from string s
where s = "hello".charAt(_)
select s

//
predicate isCountry(string country) {
  country = "Germany"
  or
  country = "Belgium"
  or
  country = "France"
}
from string s where isCountry(s) select s

//
predicate hasCapital(string country, string capital) {
  country = "Belgium" and capital = "Brussels"
  or
  country = "Germany" and capital = "Berlin"
  or
  country = "France" and capital = "Paris"
}
from string c, string a where hasCapital(c,a) select c,a

// "calls to predicates with results are themselves expressions"
// select ::= ("from" var_decls)? ("where" formula)? "select" as_exprs ("order" "by" orderbys)?
// as_exprs ::= as_expr ("," as_expr)*
// as_expr ::= expr ("as" simpleId)?
int foo() {
  result = 5
}
select foo() as somefoo

// cartesian product
int foo() {
  result = 5 or result = 6
}
int bar() {
  result = 1 or result = 2
}
select foo() as somefoo, bar() as somebar

// returns one tuple. https://help.semmle.com/QL/ql-spec/language.html#built-ins
where any()
select "foo"

// returns 0 tuples.
where none()
select "foo"

// This compiles
predicate foo(int i) {
  none()
}
from int i where foo(i) select i

// This doesn't compile. "i is not bound to a value"
predicate foo(int i) {
  any()
}
from int i where foo(i) select i

// https://help.semmle.com/QL/ql-handbook/types.html#defining-an-algebraic-datatype
newtype T =
  Type1()
  or
  Type2()

class Summy extends T {
    abstract string toString();
}
class Summy1 extends Summy,Type1 {
    override string toString() {
      result = "summy1"
    }
}
class Summy2 extends Summy,Type2 {
    override string toString() {
      result = "summy2"
    }
}
from Summy s select s

//
select "20160403".toDate()

//
select [2..3]

//
from int i where i in [2..3] select i

//
select count([2..3])

//
select count(int i | i in [-1..1] | i)

//
select min(int i | i in [-1..1] | i)

//
select min(int i | i in [-1..1] | i.abs())

//
class Foo extends int {
  Foo() {
  	this = 1 or this = 2 or this = 3
  }
}
Foo succ(Foo x) {
  if x = 1 then result = 2 
           else if x=2 then result = 3
                       else result = 1
}
select succ*(1)

// logic programming meets OOP meets stringly typed
// Using strings instead of Shore directly doesnt' compile
class Shore extends string {
  Shore() { this = "L" or this = "R"  }
}
class Foo extends string {
  Shore a;
  Shore b;
  Foo() { this = a + ";" + b }
  string getA() { result = a }
}
from Foo s
where s = "L;R"
select s.getA()

// get consecutive params that have the same type
import java
from Method m, Parameter u, Parameter v
where
  u = m.getAParameter()
  and
  v = m.getAParameter()
  and
  u.getType() = v.getType()
  and 
  u.getPosition() = v.getPosition() + 1
select m, u, v, u.getPosition()