Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Avoid Specific Libraries #9372

Unanswered
ppashakhanloo asked this question in Q&A
May 30, 2022 · 1 comments · 4 replies
Discussion options

I used CodeQL cli 2.9.2 to create a database for a small piece of Python code. CodeQL seems to extract all the Python libraries it can find (e.g., under /Users/pardis/.pyenv). These libraries are not even relevant to the file I intend to analyze. How can I instruct CodeQL to not go through (or extract) these libraries?

You must be logged in to vote

Replies: 1 comment 4 replies

Comment options

Can you provide an example of how you're invoking the CodeQL CLI and what your Python code looks like?

Of particular interest is whether you import any standard library modules in your Python code. The Python extractor automatically follows such imports, and so if you import, say, os, you'll get both it and all of its transitive dependencies. This can result in quite a few files getting included in the database.

You must be logged in to vote
4 replies
Comment options

I think the big transitive closure might be the problem here. My Python code imports torch and dgl. To show you a very small piece of code to reproduce what I'm saying:

import torch, dgl
def foo(cmd):
 # some work ...
 print(cmd)

I use this command to create the database:

codeql database create pydb --language=python --source-root=src

I have also attached the log file.
log.txt

Comment options

Thank you for the log!

Unfortunately, the Python analysis largely depends on having imports resolved correctly, in order to track flow through external calls. There's not really any easy way of disabling this functionality, and even if you could, the analysis might not give you the results you're interested in, since it might not have all the necessary information.

Comment options

Could you tell me how this fact correlates with this thread #9780 (comment), please?
I'm, facing the problem when I have external libraries located locally under /various/folders. My project calls one of those external methods but codeql doesn't see nor define it. The problem persists with C# and golang.

Comment options

mbg Sep 12, 2025
Maintainer

Hi @KseniiaSmirn0va 👋🏻

This is a 3 year old discussion (and so is the other comment you linked to) related to Python. It sounds like you're working with C# and Go, so it would probably be best if you started a new discussion or opened a new issue about the problem you're having. There are differences in how CodeQL works for different languages, and things also change with time, so what was true for Python three years ago doesn't necessarily apply to other languages we support, or even Python today.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

AltStyle によって変換されたページ (->オリジナル) /