Unresolved ql packs / library contents

[hohn]

Unresolved ql packs / library contents

The problem You get unresolved ql packs / library references when using a combination of codeql cli + codeql library snapshot (from https://github.com/github/codeql-cli-binaries/releases and https://github.com/github/codeql/tags, respectively).

Details Unable to resolve codeql library / packs, with the error:

ERROR: Referenced pack 'codeql/cpp-all' not found. (/Users/hohn/local/codeql-dataflow-sql-injection/qlpack.yml:1,1-1)

Even though the pack is clearly there

2:$ codeql resolve qlpacks
codeql/cpp-all (/Users/hohn/local/codeql-v2.9.3/ql/cpp/ql/lib)

when using this qlpack.yml:

name: hohn/cpp-sql-injection
version: 0.0.0
dependencies:
    codeql/cpp-all: "*"

[hohn]

Possible fixes When using the codeql binary + codeql library snapshot:

1. Fix one: use the original libraryPathDependencies in qlpack.yml

   name: sample/cpp-sql-injection
   version: 0.0.1
   groups: 
   - cpp
   - queries
   libraryPathDependencies: codeql/cpp-all
   extractor: cpp
   

2. Fix two: use --additional-packs instead of --search-path:

   codeql database analyze                                 \
   -v                                               \
   --ram=14000                                      \
   -j12                                             \
   --rerun                                          \
   --additional-packs $HOME/local/codeql-v2.9.3/ql       \
   --format=sarif-latest                            \
   --output cpp-sqli.sarif                          \
   --                                               \
   $DB                                              \
   $SRCDIR/SqlInjection.ql
   

[aeisenberg]

Thanks for documenting this.

--additional-packs and --search-path are similar, but subtly different. The former allows only one reference to a pack in the path. Multiple references are an error. The latter allows multiple references and the first reference found always wins.

We decided that --search-path is not compatible with packaging since the list of references is generated in a more complex way, making the order of references generally opaque to the user. We should be warning the user when this occurs. See https://github.com/github/codeql-core/issues/2688

[aeisenberg]

I'm guessing the lack of indentation in the last line is a typo here, since that my cause some unexpected resolution failures as well:

name: hohn/cpp-sql-injection
version: 0.0.0
dependencies:
codeql/cpp-all: "*"

should be:

name: hohn/cpp-sql-injection
version: 0.0.0
dependencies:
  codeql/cpp-all: "*"

[hohn]

Fixed. Thanks!