CodeQL With SCA

参考：https://sumsec.me/2022/CodeQL-Usage-Tricks.html#CodeQL with SCA

https://www.yuque.com/loulan-b47wt/rc30f7/ll3a4z

实操

import java
import semmle.code.java.DependencyCounts
predicate jarDependencyCount(int total, string entity) {
  exists(JarFile targetJar, string jarStem |
    jarStem = targetJar.getStem() and
    jarStem != "rt"
  |
    total =
      sum(RefType r, RefType dep, int num |
        r.fromSource() and
        not dep.fromSource() and
        dep.getFile().getParentContainer*() = targetJar and
        numDepends(r, dep, num)
      |
        num
      ) and
    entity = jarStem
  )
}
from string name, int ndeps
where jarDependencyCount(ndeps, name)
select name, ndeps order by ndeps desc