Avoid Specific Libraries

[ppashakhanloo]

I used CodeQL cli 2.9.2 to create a database for a small piece of Python code. CodeQL seems to extract all the Python libraries it can find (e.g., under /Users/pardis/.pyenv). These libraries are not even relevant to the file I intend to analyze. How can I instruct CodeQL to not go through (or extract) these libraries?

[tausbn]

Can you provide an example of how you're invoking the CodeQL CLI and what your Python code looks like?

Of particular interest is whether you import any standard library modules in your Python code. The Python extractor automatically follows such imports, and so if you import, say, os, you'll get both it and all of its transitive dependencies. This can result in quite a few files getting included in the database.

[ppashakhanloo]

I think the big transitive closure might be the problem here. My Python code imports torch and dgl. To show you a very small piece of code to reproduce what I'm saying:

import torch, dgl def foo(cmd): # some work ... print(cmd) 

I use this command to create the database:

codeql database create pydb --language=python --source-root=src 

I have also attached the log file.
log.txt

[tausbn]

Thank you for the log!

Unfortunately, the Python analysis largely depends on having imports resolved correctly, in order to track flow through external calls. There's not really any easy way of disabling this functionality, and even if you could, the analysis might not give you the results you're interested in, since it might not have all the necessary information.

[KseniiaSmirn0va]

Could you tell me how this fact correlates with this thread #9780 (comment), please?
I'm, facing the problem when I have external libraries located locally under /various/folders. My project calls one of those external methods but codeql doesn't see nor define it. The problem persists with C# and golang.

[mbg]

Hi @KseniiaSmirn0va 👋🏻

This is a 3 year old discussion (and so is the other comment you linked to) related to Python. It sounds like you're working with C# and Go, so it would probably be best if you started a new discussion or opened a new issue about the problem you're having. There are differences in how CodeQL works for different languages, and things also change with time, so what was true for Python three years ago doesn't necessarily apply to other languages we support, or even Python today.