github / github/codeql

Encountering a Problem with CodeQL-ruby Query during the Execution Phase of the epsilonStar Function

オープン
#15,199 コメント 4 件 リアクション 0 件 担当者 0 名 GitHub で見る
question
主要言語
CodeQL
スター
10.1k
フォーク
2.1k
平均マージ
2日 15時間
マージ済み PR(30日)
141

説明

Dear Sir/Madam,

I'm a novice CodeQL user looking to utilize the CodeQL-ruby tool to assist me in conducting a GitLab code audit. However, while using CodeQL (codeql-cli-v2.15.4) to query remotesourceflow, I've encountered an problem where the query process appears to be stuck in the execution phase of the epsilonStar function (I've waited for 12 hours with no visible progress).

I noticed that the epsilonStar function was introduced in June of this year. In an attempt to address the problem, I switched to version 2.13.3, which doesn't include this function. Interestingly, using the same query in this version yielded smooth and successful results.

Given my recent introduction to CodeQL, my understanding of the epsilonStar function's functionality is limited. As a result, I'm unsure if this issue is a result of my query approach or if there might be a certain flaw in the current functionality.

I have attached the query code I used and a screenshot of the runtime situation for your reference. I would greatly appreciate any guidance or assistance you could provide.

Thank you once again for your support.

Best regards.

```ql
/**
* @name Find all Ruby RemoteFlowSources in a project
* @description This query finds all sensitivemethod definitions in a Ruby project.
* @id rb/examples/mytaint1
*/

import codeql.ruby.AST
import codeql.ruby.DataFlow
import codeql.ruby.dataflow.RemoteFlowSources

class PathtravalConfig extends DataFlow::Configuration {
PathtravalConfig() { this = "PathtravalConfig" }

override predicate isSource(DataFlow::Node source) {
source instanceof RemoteFlowSource
}

// get sinks
override predicate isSink(DataFlow::Node sink) {
exists(Method method|
sink.asParameter() = method.getAParameter())
}
}
from DataFlow::PathNode source, DataFlow::PathNode sink, PathtravalConfig conf
where conf.hasFlowPath(source, sink)
select sink.getNode(), source, sink, "Potential sensitive operations involving $@.", source.getNode(),
"this specific variable"
```

コントリビューションガイド

コントリビューションガイドを開く

評価

この issue はまだ評価されていません。

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。