github / github/codeql

[Rust] Including dependencies in the analysis

Open
#20,534 4 comments 0 reactions 0 assignees View on GitHub
question Rust
Dominant language
CodeQL
Stars
10.1k
Forks
2.1k
Avg merge
2d 15h
Merged PRs (30d)
141

Description

Hi, is there any way to include cargo dependencies within the generated dbs? Right now im generating it like this

```bash
codeql database create rust-db \
--language=rust \
--source-root . \
--command "cargo build --all-targets --all-features" \
--extractor-option rust.cargo_all_targets=true \
--extractor-option rust.extract_dependencies_as_source=true \
--overwrite
```

But my queries still dont seem to go down into my dependecies

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the listed `codeql database create` command with the Rust extractor options and checking whether queries traverse the generated database's dependencies. Done means Rust cargo dependencies are included in the database analysis as requested.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.