Avoid Specific Libraries

[ppashakhanloo]

I used CodeQL cli 2.9.2 to create a database for a small piece of Python code. CodeQL seems to extract all the Python libraries it can find (e.g., under /Users/pardis/.pyenv). These libraries are not even relevant to the file I intend to analyze. How can I instruct CodeQL to not go through (or extract) these libraries?

[tausbn]

Can you provide an example of how you're invoking the CodeQL CLI and what your Python code looks like?

Of particular interest is whether you import any standard library modules in your Python code. The Python extractor automatically follows such imports, and so if you import, say, os, you'll get both it and all of its transitive dependencies. This can result in quite a few files getting included in the database.

[ppashakhanloo]

I think the big transitive closure might be the problem here. My Python code imports torch and dgl. To show you a very small piece of code to reproduce what I'm saying:

import torch, dgl

def foo(cmd):
  # some work ...
  print(cmd)

I use this command to create the database:

codeql database create pydb --language=python --source-root=src

I have also attached the log file.
log.txt

[tausbn]

Thank you for the log!

Unfortunately, the Python analysis largely depends on having imports resolved correctly, in order to track flow through external calls. There's not really any easy way of disabling this functionality, and even if you could, the analysis might not give you the results you're interested in, since it might not have all the necessary information.