From 02509b1f11362fe92e2b3734cf9a956dba9b8131 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Sun, 9 Aug 2026 12:04:12 +0000 Subject: [PATCH] ci(codeql): exclude py/log-injection from python scans The security-and-quality suite's py/log-injection query hits the CodeQL 2 GiB result-set limit on this codebase (LogInjection.ql traces sensitive data through every logging call), which fails the scheduled scan job before results can upload. Follows the same pattern already used for py/clear-text-logging-sensitive-data and py/polynomial-redos in this file. Co-authored-by: Krrish Dholakia --- .github/codeql/codeql-config.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml index 36d70c1d746..b167171cc31 100644 --- a/.github/codeql/codeql-config.yml +++ b/.github/codeql/codeql-config.yml @@ -4,7 +4,7 @@ queries: - uses: security-and-quality # Known OOM queries on large Python codebases: -# CodeQL builds a full data flow graph in memory. These two queries trace +# CodeQL builds a full data flow graph in memory. These queries trace # sensitive data through every log call / regex pattern, causing combinatorial # path explosion on codebases with extensive logging like LiteLLM (>2 GiB # result sets). This is a known CodeQL scaling limitation, not a code issue. @@ -14,6 +14,8 @@ query-filters: id: py/clear-text-logging-sensitive-data # CWE-312 - exclude: id: py/polynomial-redos # CWE-730 + - exclude: + id: py/log-injection # CWE-117 paths-ignore: - tests