mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-14 23:21:35 +00:00
dbdc7ea7f0
The Security/CWE-117/LogInjection.ql query has been consistently failing with 'Result set is larger than the limit of 2GiB' on every scheduled and push run for the last several days, breaking CodeQL / Analyze (python) on main and litellm_internal_staging. This is the same known CodeQL scaling limitation already documented for py/clear-text-logging-sensitive-data (CWE-312) and py/polynomial-redos (CWE-730): taint-flow queries produce combinatorial path explosion on codebases with pervasive logging like LiteLLM. Extend the existing exclusion pattern to cover py/log-injection. Co-authored-by: Krrish Dholakia <krrish-berri-2@users.noreply.github.com>
23 lines
772 B
YAML
23 lines
772 B
YAML
name: "LiteLLM CodeQL config"
|
|
|
|
queries:
|
|
- uses: security-and-quality
|
|
|
|
# Known OOM queries on large Python codebases:
|
|
# CodeQL builds a full data flow graph in memory. These queries trace
|
|
# sensitive data through every log call / regex pattern, causing combinatorial
|
|
# path explosion on codebases with extensive logging like LiteLLM (>2 GiB
|
|
# result sets). This is a known CodeQL scaling limitation, not a code issue.
|
|
# Re-test periodically as CodeQL improves or the codebase refactors logging.
|
|
query-filters:
|
|
- exclude:
|
|
id: py/clear-text-logging-sensitive-data # CWE-312
|
|
- exclude:
|
|
id: py/polynomial-redos # CWE-730
|
|
- exclude:
|
|
id: py/log-injection # CWE-117
|
|
|
|
paths-ignore:
|
|
- tests
|
|
- docs
|
|
- "**/*.md"
|