github / github/codeql

General issue with setup

Abierto
#15,240 4 comentarios 0 reacciones 0 asignados Ver en GitHub
question
Lenguaje dominante
CodeQL
Estrellas
10.1k
Forks
2.1k
Merge medio
2 d 15 h
PR fusionados (30 d)
141

Descripción

Hello,
I am currently walking through setting up CodeQL. For simplicity I am using the java example and query from this [link](https://codeql.github.com/docs/codeql-language-guides/basic-query-for-java-code/).

```
public class TestJava {
void myJavaFun(String s) {
boolean b = s.equals("");
}
}
```
```
from MethodAccess ma
where
ma.getMethod().hasName("equals") and
ma.getArgument(0).(StringLiteral).getValue() = ""
select ma, "This comparison to empty string is inefficient, use isEmpty() instead."
```
Just so that I can get my environment setup. In addition, I am using Maven and VSCode. I have both the VSCode extension and the CLI installed. However, I am running into a few issues.

1) The first is getting the database created. I am first building with Maven to get the .class files. After that I am creating a database from these files. I tried doing these two steps in sperate commands,

```
mvn clean
codeql database create codeql_project --command="mvn install --file ../../../pom.xml" --language=java --overwrite --source-root=target/classes/snippets/
```
However, this causes this error
> CodeQL detected code written in , but not any written in Java/Kotlin. This can occur if the specified build commands failed to compile or process any code.
> - Confirm that there is some source code for the specified language in the project.
> - For codebases written in Go, JavaScript, TypeScript, and Python, do not specify
an explicit --command.
> - For other languages, the --command must specify a "clean" build which compiles
all the source code files without reusing existing build artefacts.
It seems like Java falls in the "Other" category.

Due to this, I am trying both steps in one command.
```
codeql database create codeql_project --command="mvn clean install --file ../../../pom.xml" --language=java --overwrite --source-root=target/classes/snippets/
```
The issue with this is that Maven will delete the target dir during the clean phase, which then causes issues with the source-root.

Currently, the only way I have been able to get a working database is by not specifiying the source-root with this command.
```
codeql database create codeql_project --language=java --command="mvn clean install --file pom.xml"
```
However, I don't feel confident that this is correctly working.

2) In addition I am getting a lot of type errors. Circling back to using the query above. I am getting
> Failed to run query: ERROR: Could not resolve type MethodAccess (C:\Users\Kyler-Laptop\Downloads\Demo1\Demo\codeql_queries\SimpleQuery.ql:1,6-18)
ERROR: Could not resolve type StringLiteral (C:\Users\Kyler-Laptop\Downloads\Demo1\Demo\codeql_queries\SimpleQuery.ql:4,22-35)

This is what originally made me think my database create command might be incorrect.

Any suggestions would be greatly appreciated.
Thank you

Guía de contribución

Abrir la guía de contribución

Línea de trabajo

Start with the Maven project’s pom.xml and the CodeQL database creation commands shown in the issue, then inspect codeql_queries/SimpleQuery.ql and the resulting database diagnostics. Compare the setup against the linked Java query guide. Done means the Java database is created from the Maven build and the example query resolves MethodAccess and StringLiteral without type errors.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Stack tecnológico
java
Área
devtools, security
Tipo de issue
Error
Dificultad
4/5
Tiempo estimado
3-5 días
Estado de actividad
Estancado
Claridad
Necesita aclaración
Aptitud para principiantes
20/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.