github / github/codeql

Alert is removed, incorrect alert is marked as fixed, and all other alerts jump to other links

Đang mở
#18,745 1 bình luận 0 reaction 0 người được giao Xem trên GitHub
question
Ngôn ngữ chính
CodeQL
Star
10.1k
Fork
2.1k
Merge trung bình
2 ngày 15 giờ
Pull request đã merge (30 ngày)
141

Mô tả

We have five alerts in one file for the same rule:
Line 410
Line 417
Line 472
Line 531
Line 580

Our developer worked on the first two alerts first, for lines 410 and 417. The code around line 410 was unneeded, so they deleted that code entirely. They then fixed the alert for line 417. Upon merging and a new codeql scan, the following happened for each line:
Line 410 marked as fixed
Line 417 this alert now corresponded to the alert that was for line 472 (which after code deletion is line 466)
Line 472 this alert now corresponded to the alert that was for line 531 (which after code deletion is line 525)
Line 531 this alert now corresponded to the alert that was for line 580 (which after code deletion is line 574)
Line 580 this alert marked as fixed

The alert for line 417 is no longer present, as it has been switched to line 472. The developer then fixed the alert for line 525 (which did not involve deleting any code). After the merge and new codeql scan, the following happened:
Line 466 this alert still corresponds to 466
Line 525 this alert now corresponds to the alert that was for line 574
Line 574 this alert marked as fixed

The alert for line 525 is no longer present, as it has been switched to line 574 (and the old alert with the same rule and same line has now been marked as fixed).

The fact that CodeQL is shifting the alerts around like this makes it so that some of the alerts are incorrectly marked as fixed when they haven't been, and other alerts disappear altogether.

I understand that this is confusing, but it also makes it just as confusing for the developers working on fixing the alerts in the first place. Feel free to ask any questions to clarify!

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Hướng nghiên cứu

No source files or tests are named; start by reproducing the five-alert scenario described in the issue, including deleting one alert's code and fixing another. Done should mean alerts retain the correct identities across scans, while only genuinely fixed or removed alerts are marked fixed and unrelated alerts do not disappear.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Đánh giá

Lĩnh vực
security
Loại issue
Lỗi
Độ khó
4/5
Thời gian dự kiến
3-5 ngày
Mức độ hoạt động
Đình trệ
Độ rõ ràng
Cần làm rõ
Mức phù hợp với người mới
20/100

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.