github / github/codeql

Encountering a Problem with CodeQL-ruby Query during the Execution Phase of the epsilonStar Function

未关闭
#15,199 4 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
question
主要语言
CodeQL
星标
10.1k
派生
2.1k
平均合并
2 天 15 小时
30 天内合并 PR
141

描述

Dear Sir/Madam,

I'm a novice CodeQL user looking to utilize the CodeQL-ruby tool to assist me in conducting a GitLab code audit. However, while using CodeQL (codeql-cli-v2.15.4) to query remotesourceflow, I've encountered an problem where the query process appears to be stuck in the execution phase of the epsilonStar function (I've waited for 12 hours with no visible progress).

I noticed that the epsilonStar function was introduced in June of this year. In an attempt to address the problem, I switched to version 2.13.3, which doesn't include this function. Interestingly, using the same query in this version yielded smooth and successful results.

Given my recent introduction to CodeQL, my understanding of the epsilonStar function's functionality is limited. As a result, I'm unsure if this issue is a result of my query approach or if there might be a certain flaw in the current functionality.

I have attached the query code I used and a screenshot of the runtime situation for your reference. I would greatly appreciate any guidance or assistance you could provide.

Thank you once again for your support.

Best regards.

```ql
/**
* @name Find all Ruby RemoteFlowSources in a project
* @description This query finds all sensitivemethod definitions in a Ruby project.
* @id rb/examples/mytaint1
*/

import codeql.ruby.AST
import codeql.ruby.DataFlow
import codeql.ruby.dataflow.RemoteFlowSources

class PathtravalConfig extends DataFlow::Configuration {
PathtravalConfig() { this = "PathtravalConfig" }

override predicate isSource(DataFlow::Node source) {
source instanceof RemoteFlowSource
}

// get sinks
override predicate isSink(DataFlow::Node sink) {
exists(Method method|
sink.asParameter() = method.getAParameter())
}
}
from DataFlow::PathNode source, DataFlow::PathNode sink, PathtravalConfig conf
where conf.hasFlowPath(source, sink)
select sink.getNode(), source, sink, "Potential sensitive operations involving $@.", source.getNode(),
"this specific variable"
```

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。