From 3d94d2b1622944ca7fabf485f3a61288c6525811 Mon Sep 17 00:00:00 2001 From: kerry Date: Mon, 21 Sep 2026 20:56:23 +0000 Subject: [PATCH] ci(codeql): exclude py/log-injection, which exceeds the 2 GiB result limit Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- .github/codeql/codeql-config.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml index 6e15c1069a3..aa1442b0d26 100644 --- a/.github/codeql/codeql-config.yml +++ b/.github/codeql/codeql-config.yml @@ -4,7 +4,7 @@ queries: - uses: security-and-quality # Known OOM queries on large Python codebases: -# CodeQL builds a full data flow graph in memory. These two queries trace +# CodeQL builds a full data flow graph in memory. These queries trace # sensitive data through every log call / regex pattern, causing combinatorial # path explosion on codebases with extensive logging like LiteLLM (>2 GiB # result sets). This is a known CodeQL scaling limitation, not a code issue. @@ -12,6 +12,8 @@ queries: query-filters: - exclude: id: py/clear-text-logging-sensitive-data # CWE-312 + - exclude: + id: py/log-injection # CWE-117 - exclude: id: py/polynomial-redos # CWE-730 # Import resolution confuses stdlib types with management_endpoints/types.py.