mirrors/keycloak
1
0
Fork 0
mirror of https://github.com/keycloak/keycloak.git synced 2026-01-25 16:42:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

The CodeQL analysis is broken due to the large content of the SARIF file (#10606)

Browse Source 
The issue was originally caused by high number of flows paths per alert
generated by the LDAP federation module. That was identified taking the
SARIF file generated and running:

```
jq '.runs[0].results | map({query_id: .rule.id, numPaths: .codeFlows |
length})' java.sarif

```

Together we reduced the number of flows paths, adding optimizations to
skip some paths and avoid false alerts.

Co-authored-by: Bruno Oliveira da Silva <bruno@abstractj.com>

Closes #10203

Co-authored-by: Joshua Mulliken <joshua@mulliken.net>
This commit is contained in:
Bruno Oliveira da Silva
2022-03-11 09:55:17 -03:00
committed by GitHub
parent 30d2dcb7b3
commit f06ba05405
4 changed files with 107 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
.github/scripts/codeql/codeql-analyze.sh vendored Executable file
View File

@@ -0,0 +1,40 @@
#!/bin/sh
CODEQL_BINARY="./codeql/codeql"
# Check if the binary exists
if [ ! -f "$CODEQL_BINARY" ];
then
printf "CodeQL binary not found!"
exit 1
fi
upload_results () {
echo "Uploading $1"
$CODEQL_BINARY github upload-results --sarif="$1" --repository="$GITHUB_REPOSITORY" --ref="$GITHUB_REF"
}
# Create the database based on the specifics per language
if [ "$1" = "java" ];
then
printf "Analyzing CodeQL Java database"
$CODEQL_BINARY database analyze "$1-database" codeql/java-queries --format=sarifv2.1.0 --output="$1".sarif --download --max-paths=1 --sarif-add-query-help
< java.sarif jq 'del(.runs[].results[].codeFlows)' > processed-java.sarif
upload_results processed-java.sarif
elif [ "$1" = "javascript" ];
then
printf "Analyzing themes database"
$CODEQL_BINARY database analyze themes-database codeql/javascript-queries --format=sarifv2.1.0 --output=themes.sarif --download --max-paths=1 --sarif-add-query-help
< themes.sarif jq 'del(.runs[].results[].codeFlows)' > processed-themes.sarif
upload_results processed-themes.sarif
printf "Analyzing js-adapter database"
$CODEQL_BINARY database analyze js-adapter-database codeql/javascript-queries --format=sarifv2.1.0 --output=js-adapter.sarif --download --max-paths=1 --sarif-add-query-help
< js-adapter.sarif jq 'del(.runs[].results[].codeFlows)' > processed-js-adapter.sarif
upload_results processed-js-adapter.sarif
fi

25
.github/scripts/codeql/codeql-database-create.sh vendored Executable file
View File

@@ -0,0 +1,25 @@
#!/bin/sh
CODEQL_BINARY="./codeql/codeql"
# Check if the binary exists
if [ ! -f "$CODEQL_BINARY" ];
then
printf "CodeQL binary not found!"
exit 1
fi
# Create the database based on the specifics per language
if [ "$1" = "java" ];
then
printf "Creating CodeQL Java database"
$CODEQL_BINARY database create "$1-database" --no-run-unnecessary-builds --language="$1" --command='mvn clean install -Dmaven.test.skip -DskipQuarkus -DskipTestsuite -DskipExamples -DskipTests'
elif [ "$1" = "javascript" ];
then
printf "Creating themes database"
$CODEQL_BINARY database create themes-database --no-run-unnecessary-builds --language=javascript --source-root=themes/ --command='mvn install -Dmaven.test.skip -DskipQuarkus -DskipTestsuite -DskipExamples -DskipTests'
printf "Creating js-adapter database"
$CODEQL_BINARY database create js-adapter-database --no-run-unnecessary-builds --language=javascript --source-root=adapters/oidc/js/ --command='mvn install -Dmaven.test.skip -DskipQuarkus -DskipTestsuite -DskipExamples -DskipTests'
fi

6
.github/scripts/codeql/codeql-install.sh vendored Executable file
View File

@@ -0,0 +1,6 @@
#!/bin/sh
LATEST_RELEASE_URL=$(curl -s https://api.github.com/repos/github/codeql-cli-binaries/releases/latest | grep browser_download_url | cut -d '"' -f 4 | grep -i linux)
wget -q --show-progress "$LATEST_RELEASE_URL"
unzip codeql-linux64.zip