Skip to content

Commit 3b1ee76

Browse files
shivasuryashivasurya
authored
Merge pull request #205 from shivasurya/shiva/backend-cpf
feature: Code-Pathfinder online hosted sandbox playground Visit: https://play.codepathfinder.dev
2 parents de85b83 + a900103 commit 3b1ee76

28 files changed

+3238
-6
lines changed

‎README.md

+4-1
Original file line numberDiff line numberDiff line change
@@ -8,13 +8,16 @@ About
88
Code Pathfinder, the open-source alternative to GitHub CodeQL. Built for advanced structural search, derive insights, find vulnerabilities in code.
99

1010
[![Build and Release](https://github.com/shivasurya/code-pathfinder/actions/workflows/build.yml/badge.svg)](https://github.com/shivasurya/code-pathfinder/actions/workflows/build.yml) [![Go Report Card](https://goreportcard.com/badge/github.com/shivasurya/code-pathfinder/sourcecode-parser)](https://goreportcard.com/report/github.com/shivasurya/code-pathfinder/sourcecode-parser)
11-
[![MIT License](https://img.shields.io/github/license/shivasurya/code-pathfinder)](https://github.com/shivasurya/code-pathfinder/blob/main/LICENSE)
11+
[![AGPL-3.0 License](https://img.shields.io/github/license/shivasurya/code-pathfinder)](https://github.com/shivasurya/code-pathfinder/blob/main/LICENSE)
1212
[![Discord](https://img.shields.io/discord/1259511338183557120?logo=discord&label=discord&utm_source=github)](https://discord.gg/xmPdJC6WPX)
1313
[![codecov](https://codecov.io/gh/shivasurya/code-pathfinder/graph/badge.svg?token=VYQLI49TF4)](https://codecov.io/gh/shivasurya/code-pathfinder)
14+
![Code-Pathfinder Playground](https://badgen.net/static/Online%20Playground/live/cyan?icon=terminal)
1415
</div>
1516

1617
## :tv: Demo
1718

19+
Try interactive online playground [here](https://play.codepathfinder.dev/).
20+
1821
```bash
1922
docker run --rm -v "./src:/src" shivasurya/code-pathfinder:stable-latest ci --project /src/code-pathfinder/test-src --ruleset cpf/java
2023
```

‎docs/src/content/docs/atlas/index.mdx

+3
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,9 @@ hero:
99
link: /quickstart
1010
icon: right-arrow
1111
variant: primary
12+
- text: Playground
13+
link: https://play.codepathfinder.dev
14+
icon: forward-slash
1215
- text: Documentation
1316
link: /overview
1417
icon: open-book

‎docs/src/content/docs/blog/code-pathfinder-closure-table-hierarchical-queries.mdx

+1-1
Original file line numberDiff line numberDiff line change
@@ -159,7 +159,7 @@ import { Card } from '@astrojs/starlight/components';
159159

160160
### Closing Note
161161

162-
Discover [Code-PathFinder](https://github.com/shivasurya/code-pathfinder), the open-source alternative to CodeQL—a powerful tool engineered to detect security vulnerabilities. Unlike grep-based scanners such as Semgrep or ast-grep, Code-PathFinder enables fine-tuning of queries to more effectively eliminate false positives, thanks to its advanced taint analysis and source-to-sink tracing capabilities. Give it a try, and if you encounter any bugs or have suggestions, please file an issue.
162+
Discover [Code-PathFinder](https://github.com/shivasurya/code-pathfinder), the open-source alternative to CodeQL—a powerful tool engineered to detect security vulnerabilities. Unlike grep-based scanners such as ast-grep, Code-PathFinder enables fine-tuning of queries to more effectively eliminate false positives, thanks to its advanced taint analysis and source-to-sink tracing capabilities. Give it a try, and if you encounter any bugs or have suggestions, please file an issue.
163163
</div>
164164
</Card>
165165

‎docs/src/content/docs/blog/finding-webview-misconfigurations-android.mdx

+1-1
Original file line numberDiff line numberDiff line change
@@ -132,7 +132,7 @@ import { Card } from '@astrojs/starlight/components';
132132
### Conclusion
133133

134134
While [Code-PathFinder, the open-source alternative to CodeQL](https://codepathfinder.dev), is a powerful tool for finding security vulnerabilities in Android applications, one can always tweak the queries to filter out false positives
135-
more effectively compared to grep-based scanners like `Semgrep` or `ast-grep`. This is because the taint analysis and source-to-sink analysis are far more powerful than grep-based scanners. Give it a try and file an [issue](https://github.com/shivasurya/code-pathfinder/issues)
135+
more effectively compared to grep-based scanners like `ast-grep`. This is because the taint analysis and source-to-sink analysis are far more powerful than grep-based scanners. Give it a try and file an [issue](https://github.com/shivasurya/code-pathfinder/issues)
136136
if you find any bugs or have any suggestions.
137137

138138

‎docs/src/content/docs/index.mdx

+3-3
Original file line numberDiff line numberDiff line change
@@ -9,15 +9,15 @@ hero:
99
link: /quickstart
1010
icon: right-arrow
1111
variant: primary
12+
- text: Playground
13+
link: https://play.codepathfinder.dev
14+
icon: forward-slash
1215
- text: Browse Rules
1316
link: /atlas
1417
icon: open-book
1518
- text: Tech Blog
1619
link: /blog
1720
icon: pen
18-
- text: Get Source
19-
link: https://github.com/shivasurya/code-pathfinder
20-
icon: github
2121
---
2222

2323
import { Card, CardGrid, Icon } from '@astrojs/starlight/components';

‎playground-Dockerfile

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
# Use Wolfi as base image with Go support for builder stage
2+
FROM cgr.dev/chainguard/go:latest as builder
3+
4+
# Set working directory
5+
WORKDIR /build
6+
7+
# First, copy the sourcecode-parser module
8+
COPY ./sourcecode-parser /build/sourcecode-parser
9+
10+
# Copy the playground module
11+
COPY ./playground /build/playground
12+
13+
# Set working directory to playground
14+
WORKDIR /build/playground
15+
16+
# Build the application with security flags
17+
ENV CGO_ENABLED=1
18+
RUN go build -o playground
19+
20+
# Use distroless base image for minimal attack surface
21+
FROM cgr.dev/chainguard/wolfi-base:latest
22+
23+
# Create non-root user
24+
USER nonroot:nonroot
25+
26+
# Set working directory
27+
WORKDIR /app
28+
29+
# Copy the binary from builder
30+
COPY --from=builder --chown=nonroot:nonroot /build/playground/playground /app/
31+
32+
# Copy static files
33+
COPY --from=builder --chown=nonroot:nonroot /build/playground/public/static /app/public/static
34+
35+
# Create and set permissions for temporary directory
36+
RUN mkdir -p /tmp/code-analysis && \
37+
chmod 0750 /tmp/code-analysis && \
38+
chown nonroot:nonroot /tmp/code-analysis
39+
40+
# Expose port 8080
41+
EXPOSE 8080
42+
43+
# Run the application with reduced capabilities
44+
CMD ["/app/playground"]
45+

‎playground/.dockerignore

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# Version control
2+
.git
3+
.gitignore
4+
5+
# Go build artifacts
6+
*.exe
7+
*.exe~
8+
*.dll
9+
*.so
10+
*.dylib
11+
*.test
12+
*.out
13+
14+
# IDE directories
15+
.idea/
16+
.vscode/
17+
18+
# Temporary files
19+
*.tmp
20+
*.temp
21+
tmp/
22+
temp/
23+
24+
# Docker files
25+
Dockerfile
26+
.dockerignore
27+
28+
# Debug files
29+
debug/
30+
31+
# Dependencies
32+
/vendor/

‎playground/README.md

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
### Code-Pathfinder Playground
2+
3+
The Code-Pathfinder Playground is a online interactive app that allows you to analyze code and execute Code-Pathfinder (CodeQL) queries on it.
4+
5+
![Code-Pathfinder Playground](https://badgen.net/static/Online%20Playground/live/cyan?icon=terminal)
6+
7+
### Quickstart
8+
9+
In the playground directory, run:
10+
11+
```shell
12+
$ go run main.go
13+
```
14+
15+
This will start the playground server. Visit `http://localhost:8080` to access the playground.
16+
17+
### Docker Build
18+
19+
From the root directory, run:
20+
21+
```shell
22+
$ podman build --platform linux/amd64 -t docker.io/shivasurya/cpf-playground:latest . -f playground-Dockerfile
23+
```
24+
25+
This will build the playground Docker image.
26+

‎playground/go.mod

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
module github.com/shivasurya/code-pathfinder/playground
2+
3+
go 1.24.1
4+
5+
replace github.com/shivasurya/code-pathfinder/sourcecode-parser => ../sourcecode-parser
6+
7+
require (
8+
github.com/google/uuid v1.6.0
9+
github.com/shivasurya/code-pathfinder/sourcecode-parser v0.0.0-00010101000000-000000000000
10+
github.com/smacker/go-tree-sitter v0.0.0-20240827094217-dd81d9e9be82
11+
)
12+
13+
require (
14+
github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
15+
github.com/expr-lang/expr v1.16.9 // indirect
16+
github.com/joho/godotenv v1.5.1 // indirect
17+
github.com/posthog/posthog-go v1.2.24 // indirect
18+
golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8 // indirect
19+
)

‎playground/go.sum

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
github.com/antlr4-go/antlr/v4 v4.13.1 h1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=
2+
github.com/antlr4-go/antlr/v4 v4.13.1/go.mod h1:GKmUxMtwp6ZgGwZSva4eWPC5mS6vUAmOABFgjdkM7Nw=
3+
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
4+
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
5+
github.com/expr-lang/expr v1.16.9 h1:WUAzmR0JNI9JCiF0/ewwHB1gmcGw5wW7nWt8gc6PpCI=
6+
github.com/expr-lang/expr v1.16.9/go.mod h1:8/vRC7+7HBzESEqt5kKpYXxrxkr31SaO8r40VO/1IT4=
7+
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
8+
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
9+
github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
10+
github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
11+
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
12+
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
13+
github.com/posthog/posthog-go v1.2.24 h1:A+iG4saBJemo++VDlcWovbYf8KFFNUfrCoJtsc40RPA=
14+
github.com/posthog/posthog-go v1.2.24/go.mod h1:uYC2l1Yktc8E+9FAHJ9QZG4vQf/NHJPD800Hsm7DzoM=
15+
github.com/smacker/go-tree-sitter v0.0.0-20240827094217-dd81d9e9be82 h1:6C8qej6f1bStuePVkLSFxoU22XBS165D3klxlzRg8F4=
16+
github.com/smacker/go-tree-sitter v0.0.0-20240827094217-dd81d9e9be82/go.mod h1:xe4pgH49k4SsmkQq5OT8abwhWmnzkhpgnXeekbx2efw=
17+
github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
18+
github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
19+
golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8 h1:yqrTHse8TCMW1M1ZCP+VAR/l0kKxwaAIqN/il7x4voA=
20+
golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8/go.mod h1:tujkw807nyEEAamNbDrEGzRav+ilXA7PCRAd6xsmwiU=
21+
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
22+
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

‎playground/main.go

+42
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
// Package main implements a web server for analyzing Java source code and executing CodeQL queries.
2+
// It provides endpoints for code analysis, AST parsing, and visualization.
3+
package main
4+
5+
import (
6+
"log"
7+
"net/http"
8+
"os"
9+
"strings"
10+
11+
"github.com/shivasurya/code-pathfinder/playground/pkg/handlers"
12+
"github.com/shivasurya/code-pathfinder/playground/pkg/middleware"
13+
)
14+
15+
func main() {
16+
// Create a new mux for better control over middleware
17+
mux := http.NewServeMux()
18+
19+
// Serve static files with security and logging middleware
20+
fs := http.FileServer(http.Dir("public/static"))
21+
mux.Handle("/", middleware.LoggingMiddleware(fs))
22+
23+
// API endpoints with security and logging middleware
24+
mux.Handle("/api/analyze", middleware.LoggingMiddleware(http.HandlerFunc(handlers.AnalyzeHandler)))
25+
mux.Handle("/api/parse", middleware.LoggingMiddleware(http.HandlerFunc(handlers.ParseHandler)))
26+
27+
// Get port from environment variable or use default
28+
port := os.Getenv("PORT")
29+
if port == "" {
30+
port = "8080"
31+
}
32+
33+
// Ensure port starts with :
34+
if !strings.HasPrefix(port, ":") {
35+
port = ":" + port
36+
}
37+
38+
log.Printf("Starting server on port %s", port)
39+
if err := http.ListenAndServe(port, mux); err != nil {
40+
log.Fatalf("Server failed to start: %v", err)
41+
}
42+
}

0 commit comments

Comments
 (0)