Creating code for a new query may require studying the CxSAST query programming language (detailed in the Checkmarx CxQuery Language API Guide). However, some shortcuts are available.
In the QA analysis example of creating a query to find hardcoded text in generated files, we might look at the building-block queries under Cx > General, and find a query called Find_Strings . Its code is as follows:
Clearly, it is the first line that is searching for literal strings. We don't want that in a final result, but rather in a variable, so in our query we'll write:
Then we need to find places where files are generated. If we can find one place in the code where a file is generated, we can right-click it and select one of the Findby options. The resulting code is put into the Corp > CxDefaultQueryGroup > CxDefaultQuery query, and we can then copy it to our query and edit it. For our purposes we would change it to:
For the final query result, we need to find where file creation is at the end of a path coming from a literal string. So, the whole query would be: