ERROR: codeql database run-queries --ram=5932 --threads=2 javadbs --min-disk-free=1024 -v query.qls #9609

SummerSec · 2022-06-20T02:54:47Z

SummerSec
Jun 20, 2022

I'm having the following problem with a batch query

A fatal error occurred: Cannot parse suite definition file /Users/sum/Tools/codeql/vscode-codeql-starter/codeql-custom-queries-java/query.qls: com.fasterxml.jackson.databind.exc.MismatchedInputException: No content to map due to end-of-input
at [Source: (StringReader); line: 1, column: 1]

query.qls

- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Likely Bugs/Arithmetic/InformationLoss.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-022/TaintedPath.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-022/ZipSlip.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-074/JndiInjection.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-074/XsltInjection.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-078/ExecTainted.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-078/ExecUnescaped.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-079/XSS.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-089/SqlTainted.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-090/LdapInjection.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-094/GroovyInjection.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-094/InsecureBeanValidation.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-094/JexlInjection.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-094/MvelInjection.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-094/SpelInjection.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-1104/MavenPomDependsOnBintray.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-113/NettyResponseSplitting.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-113/ResponseSplitting.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-134/ExternallyControlledFormatString.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-209/StackTraceExposure.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-266/IntentUriPermissionManipulation.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-295/InsecureTrustManager.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-297/UnsafeHostnameVerification.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-312/CleartextStorageCookie.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-335/PredictableSeed.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-338/JHipsterGeneratedPRNG.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-347/MissingJWTSignatureCheck.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-352/SpringCSRFProtection.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-470/FragmentInjection.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-470/FragmentInjectionInPreferenceActivity.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-502/UnsafeDeserialization.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-601/UrlRedirect.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-611/XXE.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-614/InsecureCookie.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-643/XPathInjection.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-681/NumericCastTainted.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-730/PolynomialReDoS.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-730/ReDoS.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-732/ReadingFromWorldWritableFile.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-807/TaintedPermissionsCheck.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-829/InsecureDependencyResolution.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-917/OgnlInjection.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-918/RequestForgery.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-927/ImplicitPendingIntents.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-940/AndroidIntentRedirection.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Likely Bugs/Concurrency/UnreleasedLock.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-078/ExecRelative.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-089/SqlUnescaped.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-117/LogInjection.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-129/ImproperValidationOfArrayConstruction.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-129/ImproperValidationOfArrayIndex.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-190/ArithmeticTainted.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-190/ArithmeticUncontrolled.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-190/ComparisonWithWiderType.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-200/TempDirLocalInformationDisclosure.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-273/UnsafeCertTrust.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-297/InsecureJavaMail.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-312/CleartextStorageAndroidDatabase.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-312/CleartextStorageAndroidFilesystem.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-312/CleartextStorageProperties.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-312/CleartextStorageSharedPrefs.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-327/MaybeBrokenCryptoAlgorithm.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-367/TOCTOURace.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-421/SocketAuthRace.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-522/InsecureBasicAuth.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-532/SensitiveInfoLog.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-676/PotentiallyDangerousFunction.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-749/UnsafeAndroidAccess.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-798/HardcodedCredentialsApiCall.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-807/ConditionalBypass.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-835/InfiniteLoop.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Security/CWE/CWE-927/SensitiveCommunication.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Diagnostics/ExtractionErrors.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Diagnostics/ExtractionWarnings.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Diagnostics/SuccessfullyExtractedFiles.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Metrics/Summaries/LinesOfCode.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Telemetry/ExternalLibraryUsage.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Telemetry/SupportedExternalSinks.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Telemetry/SupportedExternalSources.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Telemetry/SupportedExternalTaint.ql
- query: /Users/sum/Tools/codeql/vscode-codeql-starter/ql/java/ql/src/Telemetry/UnsupportedExternalAPIs.ql

query.qls from run codeql resolve queries java-security-extended.qls

smowton · 2022-06-20T10:40:32Z

smowton
Jun 20, 2022
Maintainer

Can you tell us your codeql version, which codeql, ls /Users/sum/Tools/codeql, where is vscode-codeql-starter/codeql pointing (git rev-parse HEAD), are there any local changes (git status, git diff, git diff --cached)?

0 replies

SummerSec · 2022-06-20T11:16:10Z

SummerSec
Jun 20, 2022
Author

 codeql version
CodeQL command-line toolchain release 2.9.3.

mac os

sum:~:% ls /Users/sum/Tools/codeql
codeql                codeql-debug          codeql-osx64.zip      codeqlQrepo           vscode-codeql-starter


sum:codeql:% ls /Users/sum/Tools/codeql/codeql
LICENSE.md          cpp                 html                properties          xml
Open-Source-Notices csharp              java                python
codeql              csv                 javascript          ruby
codeql.cmd          go                  legacy-upgrades     tools

sum:vscode-codeql-starter:% git status                                                                        <main ✗>
位于分支 main
您的分支与上游分支 'origin/main' 一致。

未跟踪的文件:
  （使用 "git add <文件>..." 以包含要提交的内容）
	.DS_Store
	codeql-custom-queries-java/.DS_Store
	codeql-custom-queries-java/SqlTaintedLocal.ql
	codeql-custom-queries-java/SqlUnescaped.ql
	codeql-custom-queries-java/codeql-custom-queries-java.code-workspace
	codeql-custom-queries-java/forclass.ql
	codeql-custom-queries-java/query.qls
	codeql-custom-queries-java/sqlsink.ql
	codeql-custom-queries-java/sqltainted.ql
	codeql-custom-queries-java/ssrfsink.ql

提交为空，但是存在尚未跟踪的文件（使用 "git add" 建立跟踪）

2 replies

smowton Jun 20, 2022
Maintainer

It seems this error is raised if the .qls file is empty -- is there any empty queries.qls file anywhere that you could accidentally be referring to?

SummerSec Jun 21, 2022
Author

It seems this error is raised if the .qls file is empty -- is there any empty queries.qls file anywhere that you could accidentally be referring to?

I don't think this happens because the query.qls file uses the command to generate the points and is not something I edit manually.Unless there is a problem with this generated command and it generates a file that points to an empty file.

SummerSec · 2022-06-21T06:19:37Z

SummerSec
Jun 21, 2022
Author

Why does the following command not report an error，Are they any different?

codeql database run-queries --search-path   --rerun javadbs /Users/sum/Tools/codeql/vscode-codeql-starter/codeql-custom-queries-java/query.qls

6 replies

SummerSec Jun 21, 2022
Author

codeql database run-queries --ram=5932 --threads=2 javadbs --min-disk-free=1024 -v /Users/sum/Tools/codeql/vscode-codeql-starter/codeql-custom-queries-java/query.qls

atorralba Jun 21, 2022

Both commands should correctly process the query.qls file, as long as it's not empty. Do you still reproduce the error with the original command? Can you confirm that the contents of query.qls are what you expect at the time you're running codeql database run-queries?

smowton Jun 21, 2022
Maintainer

Side note: using resolve queries xyz.qls to produce a list of queries, saving that as abc.qls and then running abc.qls should be identical to just running xyz.qls.

SummerSec Jun 21, 2022
Author

Side note: using resolve queries xyz.qls to produce a list of queries, saving that as abc.qls and then running abc.qls should be identical to just running xyz.qls.

yes, I did this a few months ago, but on a Windows computer.

smowton Jun 22, 2022
Maintainer

Do you still have a .qls file that reproduces this error? If so, could you give the full command-line run and upload the qls file?

SummerSec · 2022-06-22T02:36:15Z

SummerSec
Jun 22, 2022
Author

I found an error when I allowed the following command

 codeql bqrs decode --format csv -o /javadbs/results/codeql/java-queries/Likely Bugs/Arithmetic/InformationLoss.csv /javadbs/results/codeql/java-queries/Likely Bugs/Arithmetic/InformationLoss.bqrs

error : Unmatched arguments from index 3: '/javadbs/results/codeql/java-queries/Likely', 'Bugs/Arithmetic/InformationLoss.bqrs'
Try codeql bqrs decode --help for usage help.

The problem should be caused by the existence of spaces in the incoming command, can we improve the parsing of command parameters?

1 reply

atorralba Jun 22, 2022

Have you tried enclosing the arguments in single quotes?

 codeql bqrs decode --format csv -o '/javadbs/results/codeql/java-queries/Likely Bugs/Arithmetic/InformationLoss.csv' '/javadbs/results/codeql/java-queries/Likely Bugs/Arithmetic/InformationLoss.bqrs'

SummerSec · 2022-06-22T02:42:32Z

SummerSec
Jun 22, 2022
Author

How can I process the bqrs file from the batch query to aggregate all the valid information? Any suggestions in this regard? Thanks!

1 reply

smowton Jun 22, 2022
Maintainer

What information do you want to get out? Is codeql database interpret-results what you're looking for?

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ERROR: codeql database run-queries --ram=5932 --threads=2 javadbs --min-disk-free=1024 -v query.qls #9609

{{title}}

Replies: 5 comments 10 replies

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

ERROR: codeql database run-queries --ram=5932 --threads=2 javadbs --min-disk-free=1024 -v query.qls #9609

SummerSec Jun 20, 2022

Replies: 5 comments · 10 replies

smowton Jun 20, 2022 Maintainer

SummerSec Jun 20, 2022 Author

smowton Jun 20, 2022 Maintainer

SummerSec Jun 21, 2022 Author

SummerSec Jun 21, 2022 Author

SummerSec Jun 21, 2022 Author

atorralba Jun 21, 2022

smowton Jun 21, 2022 Maintainer

SummerSec Jun 21, 2022 Author

smowton Jun 22, 2022 Maintainer

SummerSec Jun 22, 2022 Author

atorralba Jun 22, 2022

SummerSec Jun 22, 2022 Author

smowton Jun 22, 2022 Maintainer

SummerSec
Jun 20, 2022

Replies: 5 comments 10 replies

smowton
Jun 20, 2022
Maintainer

SummerSec
Jun 20, 2022
Author

smowton Jun 20, 2022
Maintainer

SummerSec Jun 21, 2022
Author

SummerSec
Jun 21, 2022
Author

SummerSec Jun 21, 2022
Author

smowton Jun 21, 2022
Maintainer

SummerSec Jun 21, 2022
Author

smowton Jun 22, 2022
Maintainer

SummerSec
Jun 22, 2022
Author

SummerSec
Jun 22, 2022
Author

smowton Jun 22, 2022
Maintainer