X Tutup
The Wayback Machine - https://web.archive.org/web/20240324153528/https://github.com/github/codeql/issues/8976
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

LGTM.com - Missing Vulnerability Path Steps in LGTM render #8976

Open
JLLeitschuh opened this issue Apr 29, 2022 · 2 comments
Open

LGTM.com - Missing Vulnerability Path Steps in LGTM render #8976

JLLeitschuh opened this issue Apr 29, 2022 · 2 comments
Labels
false-positive

Comments

@JLLeitschuh
Copy link
Contributor

JLLeitschuh commented Apr 29, 2022 •
edited

Description of the false positive

I've encountered a few cases where LGTM and the VS Code plugin won't correctly render path steps. It's my hunch that this may be related to when additionalTaintSteps are duplicated, ie. are both captured in the CSV model, and in a CodeQL query in directly. It seems when this happens, one path gets generated without this double represented element, and one path does get generated.

URL to the alert on the project page on LGTM.com

Example: there are two paths, the first one is only 6 steps, and is missing the critical new File call, the second, longer path with 7 steps is correct.
https://lgtm.com/projects/g/apache/ace/snapshot/dbdba56171c187ef5f7796afe5245f7224c86169/files/org.apache.ace.client.workspace/src/org/apache/ace/client/workspace/impl/DPHelper.java?sort=name&dir=ASC&mode=heatmap#L101
@aschackmull
Copy link
Contributor

This is expected, and working as currently intended. An additional step defined on the configuration that's purely local gets collapsed together with other local steps in the path explanation, whereas the steps that are added as a result of a csv model is a more complex sequence that involves dispatch to a synthesised (but hidden) method/constructor body. It is this indirection through a call that then causes the additional step to appear in the path explanation.

Since the csv model exists, then the additional step on the configuration becomes superfluous, so simply removing that should fix it such that only the 7 step path is shown.

@JLLeitschuh
Copy link
Contributor Author

This is expected, and working as currently intended. An additional step defined on the configuration that's purely local gets collapsed together with other local steps in the path explanation, whereas the steps that are added as a result of a csv model is a more complex sequence that involves dispatch to a synthesised (but hidden) method/constructor body. It is this indirection through a call that then causes the additional step to appear in the path explanation.

This is non-intuitive and kinda annoying, especially when local method paths are non-trivial. I'd personally prefer if full paths were always displayed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
false-positive
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@JLLeitschuh @aschackmull
X Tutup