github / codeql

CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security

Home Page:https://codeql.github.com

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

codeql for visual studio code(VS2022 17.8)

neruoReuben opened this issue · comments

commented

when i use codeql 2.15.0, it generates error:

[2024-04-12 15:26:16] [build-stdout] 15:26:16.937 2>cl : command line warning D9002: ignoring unknown option '--version'
[2024-04-12 15:26:16] [build-stdout] 15:26:16.937 2>cl : command line error D8003: missing source filename

I find other issues which show that it may be caused by non-English operating system, but my system is actual English system.
image

I also tried to use latest codeql (version >= 2.15.4), it seems that no D8003 errors occur, but it takes too long time to analysis my project (project itself is very large). and take too much time in the stage like :

Running TRAP import for CodeQL database at C:\test\devops-codeql-database...
Grouping TRAP files by link target
Grouping unlinked TRAP files together
Scanning TRAP files

but i found no TRAP's output in 2.15.0, this new feature seems to take too much time.
is there some options to disable this feature(TRAP)?

Hi @neruoReuben ,

You forgot the to include the error, but you're likely running into the problem reported here: #14927. The fix is to upgrade to CodeQL 2.15.4 or later.

but i found no TRAP's output in 2.15.0, this new feature seems to take too much time.
is there some options to disable this feature(TRAP)?

It's not a new feature. It's just missing with CodeQL 2.15.0, because no TRAP output is produced due to the error you encounter. To clarify: TRAP is an intermediate file format we use between parsing your source files, and creating a database. You might be able to speed up this step by providing the -j option to CodeQL, see for example here.

but it takes too long time to analysis my project (project itself is very large)

Did you try with older versions of Visual Studio and CodeQL 2.15.0? If so, was that much faster?

commented

yeah, quite faster(the previous may be 5-6 hours, use MsBuild 2019, toolset is v141_xp). while when we use MsBuild 2022 toolset v143, codeql database create takes more than 12 hours.

my codeql command: codeql database create {my_output_dir} -- source-root {my_sourcecode_dir} --language=cpp --command="call build.bat"
build.bat: 2019{now use 2022}/Professional/MsBuild/Current/bin/msbuild.exe /t:project:rebuild "my_project.sln" /p:Configuration=Release /p:Platform=Win32 /p:BuildProjectReference=false -m:8 -nr:true

i will try to use -j option , hope it can work for me.

yeah, quite faster(the previous may be 5-6 hours, use MsBuild 2019, toolset is v141_xp). while when we use MsBuild 2022 toolset v143, codeql database create takes more than 12 hours.

I'm not sure if you can check, but is database creation also faster for the 2019 build if you use an up-to-date CodeQL? Or does that show a similar slowdown? If the latter, how do the sizes of the database directories compare?

commented

yeah, quite faster(the previous may be 5-6 hours, use MsBuild 2019, toolset is v141_xp). while when we use MsBuild 2022 toolset v143, codeql database create takes more than 12 hours.

I'm not sure if you can check, but is database creation also faster for the 2019 build if you use an up-to-date CodeQL? Or does that show a similar slowdown? If the latter, how do the sizes of the database directories compare?

for 2019 build is much faster, and the sizes of database directories : 2019 build(dozens of GB) is also much smaller than 2022 build (quite big... hundreds of GB) i really want wo use old version (do it has another way to
avoid D8003) 😭

for 2019 build is much faster, and the sizes of database directories : 2019 build(dozens of GB) is also much smaller than 2022 build (quite big... hundreds of GB) i really want wo use old version (do it has another way to avoid D8003) 😭

With which version of CodeQL is the database for that 2019 build created?

commented

for 2019 build is much faster, and the sizes of database directories : 2019 build(dozens of GB) is also much smaller than 2022 build (quite big... hundreds of GB) i really want wo use old version (do it has another way to avoid D8003) 😭

With which version of CodeQL is that 2019 build?

2019 build use codeql 2.15.0

2019 build use codeql 2.15.0

Have you tried a 2019 build with a more recent version of CodeQL? If so, what is the size of the database in that case?

commented

2019 build use codeql 2.15.0

Have you tried a 2019 build with a more recent version of CodeQL? If so, what is the size of the database in that case?

nope, if i have time, i will try this.

So my expectation is that CodeQL 2.15.0 is actually not able parse much of the code from your codebase, and this has been fixed in more recent versions. Giving you a much larger database and longer build times, but also a much more complete database. I'd expect that even a 2019 build with a recent version of CodeQL will give you a database that is hundreds of GB.

Another way to tell whether the above is the case would be to look at the build-tracer.log that is located in the database directory and see what kind of errors you see in there.