github / github/codeql

CodeQL Python query runs extremely slow on medium-sized project using TaintTracking::Global

オープン
#19,928 コメント 1 件 リアクション 0 件 担当者 0 名 GitHub で見る
question
主要言語
CodeQL
スター
10.1k
フォーク
2.1k
平均マージ
2日 15時間
マージ済み PR(30日)
141

説明

I'm experiencing very slow performance when running a CodeQL query on a Python project using `TaintTracking::Global`. The analysis never finishes, even after more than **2 hours**, on a project that I believe is not very large. Below are some details:

* **CVE project**: CVE-2024-23637
* **Python files**: 263
* **Total lines**: \~88,981
* **Sources**: < 200
* **Sinks**: < 200
* **Tracking config**: `TaintTracking::Global`

My query looks like this:

```ql
module RemoteToFileConfiguration implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
MySources::isSource(source)
}

predicate isSink(DataFlow::Node sink) {
MySinks::isMySink(sink)
}
}

module Flow = TaintTracking::Global;
import Flow::PathGraph

from Flow::PathNode source, Flow::PathNode sink
where Flow::flowPath(source, sink)
select sink.getNode(), source, sink, "Flow path from source to sink"
```

I defined sinks or sources like this (simplified):

```ql
module MySinks {
class Sink extends DataFlow::Node {
Sink() {
exists(FunctionValue func, Call call |
func.getQualifiedName() = "run_code" or
func.getQualifiedName() = "check_syntax_error" or
...
call.getFunc().pointsTo(func) and
this = DataFlow::exprNode(call.getAnArg())
)
}
}

predicate isMySink(DataFlow::Node sink) {
exists(Sink s | s = sink)
}
}
```

### My questions:

1. Why is the performance so slow in this case?
2. Are there any best practices for optimizing `TaintTracking::Global` on Python?
3. I tried using `func.getQualifiedName()` with a full path like `"Module xml.etree.ElementInclude.Function default_loader"`, but it didn’t work in VSCode (the function wasn't found). Is there a correct way to define sinks using fully qualified names for Python?

Thank you very much for any guidance or suggestions!

コントリビューションガイド

コントリビューションガイドを開く

調査の方向性

No repository file or test is named. Start by reproducing the shown TaintTracking::Global query against the CVE-2024-23637 project, then inspect the source and sink definitions, including the getQualifiedName usage in VSCode. Done means documenting the performance cause or optimization guidance and the correct Python sink naming approach.

索引モデルが issue の本文から書いたものです。

評価

技術スタック
python, vscode
領域
devtools, security
issue の種類
バグ
難易度
5/5
見積もり時間
1週間以上
活発さ
停滞
明瞭さ
説明が足りない
初心者へのやさしさ
25/100

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。