github / github/codeql

Use Specific Python Virtual Environment Dependency

Abierto
#14,187 4 comentarios 0 reacciones 0 asignados Ver en GitHub
Python question
Lenguaje dominante
CodeQL
Estrellas
10.1k
Forks
2.1k
Merge medio
2 d 15 h
PR fusionados (30 d)
141

Descripción

## System
- Codeql version: 2.11.2.
- Ubuntu 20.04
- system wide installation in folder (`/home/user/.local/lib/`): `python3.6`, `python3.8`, `python3.10`.
- local python version (virtual environment): `venv38/lib/python3.8/`

## What

I have a bash script that generates the CodeQL database from a specific folder:
```bash
...
# enter in the python3.8 environment with my libraries installed
source venv38/bin/activate
...
# create the db
codeql database create $dataset_path/codeql \
--language=python \
--overwrite \
--source-root=$dataset_raw_files_path
...
```
Output Log:
```txt
...
[2023-09-12 13:54:00] [build-stdout] [INFO] [2] Extracted file /usr/lib/python3.6/tarfile.py in 2036ms
[2023-09-12 13:54:00] [build-stdout] [INFO] [6] Extracted module _md5 in 13ms
[2023-09-12 13:54:00] [build-stdout] [INFO] [3] Extracted file /home/username/.local/lib/python3.6/site-packages/my_fancy_dependency/folder/dependency_file_version_36.py in 352ms
..
```

## Expectation
I would expect codeql to create the db with the custom path to my virtual environment `venv38/lib/python3.8/site-packages/..` and not the system wide python installation: `.local/lib/python3.6`.

**Question**: How can I achieve that? Is there a specific flag or procedure? I cannot find it in the manual [codeql database create](https://docs.github.com/en/code-security/codeql-cli/codeql-cli-manual/database-create)

## Extra Info
1. I need this because the package I need (e.g., in the example the ficticious `my_fancy_dependency`) has a different version for python3.6 (systemwide python installation) and python3.8.
2. I noted that I have other databases which correctly use the right version of python, but it is unclear how they have been created since I have a similar script to generate them from the same folder.

Let me know if you need more info.

Guía de contribución

Abrir la guía de contribución

Línea de trabajo

Start with the reported bash invocation and the `codeql database create` documentation, focusing on how Python extraction selects installed dependencies. Reproduce the setup with system Python 3.6 and the `venv38` environment, then determine whether the documented procedure or a CLI option makes the database use the virtual-environment package version. Done means the extracted dependency comes from `venv38/lib/python3.8/site-packages` rather than the system installation.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Stack tecnológico
bash, python
Área
security
Tipo de issue
Error
Dificultad
3/5
Tiempo estimado
1-2 días
Estado de actividad
Estancado
Claridad
Bastante claro
Aptitud para principiantes
35/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.