Pros of ApplicationInspector

• Lightweight and easy to use, with a focus on rapid analysis
• Provides a comprehensive HTML report with visualizations
• Supports multiple programming languages out of the box

Cons of ApplicationInspector

• Less extensive query language compared to CodeQL
• Limited to pattern-based analysis, potentially missing complex vulnerabilities
• Smaller community and ecosystem of pre-built queries

Code Comparison

ApplicationInspector uses simple JSON-based rules:

{
  "name": "Hardcoded Password",
  "id": "AI000100",
  "description": "Detects hardcoded passwords",
  "tags": ["Security", "Credential"],
  "severity": "Critical",
  "patterns": [
    {
      "pattern": "password\\s*=\\s*[\"']\\w+[\"']",
      "type": "regex"
    }
  ]
}

CodeQL uses a custom query language:

import csharp

from Variable var, StringLiteral literal
where var.getName().toLowerCase().matches("%password%")
  and literal = var.getInitializer()
select var, "Possible hardcoded password."

Both tools aim to detect security issues, but CodeQL offers more sophisticated analysis capabilities at the cost of a steeper learning curve.

Pros of Semgrep

• Easier to learn and use, with a simpler syntax for writing rules
• Faster analysis, especially for large codebases
• More language support, including non-traditional languages like Terraform and Dockerfile

Cons of Semgrep

• Less powerful and flexible than CodeQL's query language
• Limited support for inter-procedural and data flow analysis
• Smaller ecosystem and community compared to CodeQL

Code Comparison

Semgrep rule example:

rules:
  - id: unsafe-deserialization
    pattern: pickle.loads($X)
    message: Unsafe deserialization detected
    severity: WARNING
    languages: [python]

CodeQL query example:

import python

from Call call
where call.getFunc().getName() = "loads"
  and call.getFunc().getScope().(ImportExpr).getName() = "pickle"
select call, "Unsafe deserialization detected"

Both examples detect unsafe deserialization in Python, but CodeQL's query language offers more flexibility and power for complex analyses. Semgrep's rule is more concise and easier to write for simple patterns.

Pros of Infer

• Supports multiple languages including Java, C/C++, and Objective-C
• Focuses on specific bug classes like null pointer dereferences and memory leaks
• Integrates well with build systems and CI/CD pipelines

Cons of Infer

• Limited query customization compared to CodeQL's extensive query language
• Smaller community and ecosystem than CodeQL
• Less comprehensive coverage of security vulnerabilities

Code Comparison

Infer example (Java):

@Nullable
public String getName() {
    return this.name;
}

public void printName() {
    System.out.println(getName().toLowerCase()); // Potential null pointer dereference
}

CodeQL example (Java):

import java

from MethodAccess call, Method method
where
  call.getMethod() = method and
  method.hasName("getName") and
  method.getReturnType() instanceof TypeString and
  not exists(ConditionialExpr cond | cond.getThen() = call or cond.getElse() = call)
select call, "Potential null pointer dereference when calling getName()"

Both tools can detect potential null pointer dereferences, but CodeQL offers more flexibility in defining custom queries for specific vulnerability patterns.

Pros of osv-scanner

• Lightweight and focused specifically on vulnerability scanning
• Faster execution for quick security checks
• Supports multiple package ecosystems (npm, PyPI, Go, etc.)

Cons of osv-scanner

• Limited to known vulnerabilities in the OSV database
• Lacks advanced code analysis capabilities
• Does not support custom query development

Code Comparison

osv-scanner:

osv-scanner /path/to/project

CodeQL:

codeql database create mydb --language=javascript
codeql database analyze mydb javascript-security-and-quality.qls

Summary

osv-scanner is a lightweight tool focused on quickly identifying known vulnerabilities in project dependencies across multiple ecosystems. It's easy to use and provides fast results, making it suitable for rapid security checks.

CodeQL, on the other hand, is a more comprehensive static analysis tool that allows for deep code analysis and custom query development. It offers advanced capabilities for identifying complex security issues and code quality problems but requires more setup and execution time.

While osv-scanner is limited to known vulnerabilities, CodeQL can potentially uncover novel security issues through its advanced analysis capabilities. However, this comes at the cost of increased complexity and longer execution times.

Choose osv-scanner for quick vulnerability checks across multiple package ecosystems, and opt for CodeQL when in-depth code analysis and custom query development are required.