Checkmarx CxCE: Query Language (CxQL) and Custom Query Development

What this domain tests

Whether you can read and write a CxQL query, understand how queries become active, and debug the common reasons a query "works in CxAudit but not in a scan".

Structure of a query

A CxQL query is a script that builds CxList objects and ends by assigning the final set to result. Nothing else is returned: if result is empty or never assigned, the query reports nothing. Query metadata - name, severity, CWE, category, language - is what appears in results and reports, so wrong metadata produces misleading reports even when detection is correct. Queries live in query groups; a group must be part of the preset used by the project before the query runs in a scan.

Core building blocks

• Selectors: FindByType, FindByShortName, FindByMemberAccess, Find_Methods, and library helpers such as Find_Interactive_Inputs, Find_DB_In, Find_Sanitize.
• Set algebra: Include, Exclude, GetMembersOf to narrow or widen a list.
• Flow operators: InfluencingOn (data plus control influence), DataInfluencingOn (data only), and sanitizer-aware variants such as InfluencingOnAndNotSanitized.

Start narrow. Beginning with All and filtering afterwards is the standard cause of slow, memory-hungry queries.

Worked example

To detect command execution reached by user input:

CxList inputs = Find_Interactive_Inputs();
CxList sinks = Find_Methods().FindByShortName("exec");
CxList sanitize = Find_Sanitize();
result = inputs.InfluencingOnAndNotSanitized(sinks, sanitize);

Reasoning: the helper supplies modeled sources, the sink list is narrowed by name instead of scanning everything, and the sanitizer list suppresses paths already neutralized by house validation routines. Then set severity and CWE in the metadata, place the query in a group, add that group to a preset, and rescan.

Traps that cost marks

• Forgetting the final result assignment.
• Correct detection with wrong or missing severity/CWE metadata.
• Case-sensitive name matching that misses naming conventions.
• Editing the query but not re-running the scan, or not adding the group to the preset.
• Assuming a sanitizer list from another language's library applies here.