github / github/codeql

CodeQL Python query runs extremely slow on medium-sized project using TaintTracking::Global

Open
#19,928 1 comment 0 reactions 0 assignees View on GitHub
question
Dominant language
CodeQL
Stars
10.1k
Forks
2.1k
Avg merge
2d 15h
Merged PRs (30d)
141

Description

I'm experiencing very slow performance when running a CodeQL query on a Python project using `TaintTracking::Global`. The analysis never finishes, even after more than **2 hours**, on a project that I believe is not very large. Below are some details:

* **CVE project**: CVE-2024-23637
* **Python files**: 263
* **Total lines**: \~88,981
* **Sources**: < 200
* **Sinks**: < 200
* **Tracking config**: `TaintTracking::Global`

My query looks like this:

```ql
module RemoteToFileConfiguration implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
MySources::isSource(source)
}

predicate isSink(DataFlow::Node sink) {
MySinks::isMySink(sink)
}
}

module Flow = TaintTracking::Global;
import Flow::PathGraph

from Flow::PathNode source, Flow::PathNode sink
where Flow::flowPath(source, sink)
select sink.getNode(), source, sink, "Flow path from source to sink"
```

I defined sinks or sources like this (simplified):

```ql
module MySinks {
class Sink extends DataFlow::Node {
Sink() {
exists(FunctionValue func, Call call |
func.getQualifiedName() = "run_code" or
func.getQualifiedName() = "check_syntax_error" or
...
call.getFunc().pointsTo(func) and
this = DataFlow::exprNode(call.getAnArg())
)
}
}

predicate isMySink(DataFlow::Node sink) {
exists(Sink s | s = sink)
}
}
```

### My questions:

1. Why is the performance so slow in this case?
2. Are there any best practices for optimizing `TaintTracking::Global` on Python?
3. I tried using `func.getQualifiedName()` with a full path like `"Module xml.etree.ElementInclude.Function default_loader"`, but it didn’t work in VSCode (the function wasn't found). Is there a correct way to define sinks using fully qualified names for Python?

Thank you very much for any guidance or suggestions!

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.