CodeQL should respect Java's @SuppressWarnings("all") annotation

[lenaschoenburg]

Description of the issue
Similar to #2076, it'd be nice to respect @SuppressWarnings(all) by supressing all lgtm warnings. This is often used by generated code, for example code generated by SBE:

https://github.com/real-logic/simple-binary-encoding/blob/44ca92f152cbfaaaf0b72bc9ee08e2f2c345b303/sbe-tool/src/main/java/uk/co/real_logic/sbe/generation/java/JavaGenerator.java#L1664

[aibaars]

It should be easy to extend AlertSuppressionAnnotations.ql that was introduced in
#2152 to treat @SuppressWarnings(all) as equivalent to @SuppressWarnings(lgtm) . This would make LGTM suppress the alerts and the CodeQL CLI would mark the alerts as suppressedInSource in its SARIF output.

[smowton]

@oleschoenburg are you using code scanning, LGTM or the CLI to run your analysis?

[lenaschoenburg]

@smowton We are using the CodeQL Github Workflow

[aibaars]

GitHub CodeScanning does not support alert suppression comments and annotations at the moment. Please file a feature request in https://github.com/github/codeql/discussion .

As a workaround you might want to use https://github.com/zbazztian/filter-sarif . This is an Action that can be used to filter results by file path . You can use it to remove results from the "SARIF" file containing the alerts before it is uploaded to the CodeScanning API. As a quick way to get a list of file paths you could run git grep -l '@SuppressWarnings(all)' .

[lenaschoenburg]

Okay, thanks for the clarification! Still would be a useful improvement I think 🙂

[Marcono1234]

Just for reference: The "all" value is not standardized, it is not mentioned in the language specification. And apparently javac indeed does not support it (yet), see JDK-7141469. However, Eclipse and IntelliJ both seem to support it.
So it probably makes sense to have CodeQL support it nonetheless?

[leerho]

It has been a year now. Where is this issue of being able to suppress codeQL errors and warnings that are determined to be false positives?