Kotlin support

[dector]

Considering growing popularity of Kotlin and that fact that it's preferable language for Android development for now, is there some documentation that will help community to bring Kotlin support to GitHub Security Lab and Code Scanning tools?

Thanks!

[JLLeitschuh]

Not an answer, but a comment. I don't know what the current support is for cross-language codeflow analysis is. Currently, the code flow analysis seems to be tightly coupled to the specifics of the language. Unfortunately, I think that this means that there would be no good way to do Kotlin <---> Java or Java <---> Groovy code flow analysis. I could be wrong. But the unfortunate reality of that would be that queries that are written for Java would not be cross language compatible with these other languages that are also running on the JVM.

[dector]

I guess it's totally fine since even related languages have implementation details (e.g. source code is translated to byte-code in a different way sometimes). Besides that Kotlin departed from JVM-land but it not a JVM-only language anymore (e.g. K/JS target has dynamic keyword that is not present in other targets).

There is open-source https://github.com/github/codeql-go implementation that can be used as a reference but would be nice to have additional documentation how to bootstrap language support.

[intrigus-lgtm]

Have a look at #134
#codeql-hacking on the Security Lab Slack instance has some additional information.