mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-13 23:11:40 +00:00
02509b1f11
The security-and-quality suite's py/log-injection query hits the CodeQL 2 GiB result-set limit on this codebase (LogInjection.ql traces sensitive data through every logging call), which fails the scheduled scan job before results can upload. Follows the same pattern already used for py/clear-text-logging-sensitive-data and py/polynomial-redos in this file. Co-authored-by: Krrish Dholakia <krrish-berri-2@users.noreply.github.com>
23 lines
772 B
YAML
23 lines
772 B
YAML
name: "LiteLLM CodeQL config"
|
|
|
|
queries:
|
|
- uses: security-and-quality
|
|
|
|
# Known OOM queries on large Python codebases:
|
|
# CodeQL builds a full data flow graph in memory. These queries trace
|
|
# sensitive data through every log call / regex pattern, causing combinatorial
|
|
# path explosion on codebases with extensive logging like LiteLLM (>2 GiB
|
|
# result sets). This is a known CodeQL scaling limitation, not a code issue.
|
|
# Re-test periodically as CodeQL improves or the codebase refactors logging.
|
|
query-filters:
|
|
- exclude:
|
|
id: py/clear-text-logging-sensitive-data # CWE-312
|
|
- exclude:
|
|
id: py/polynomial-redos # CWE-730
|
|
- exclude:
|
|
id: py/log-injection # CWE-117
|
|
|
|
paths-ignore:
|
|
- tests
|
|
- docs
|
|
- "**/*.md"
|