CodeQL Bundle: Precompiled queries have mode 0600

Open
#2,540 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
45/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Domain
security

Research direction

Inspect how the CodeQL Bundle packages its precompiled queries, using the v2.19.1 bundle and the CodeQL CLI behavior described in the issue as references. Confirm that the shipped queries are readable by users other than the file owner, equivalent to the stated chmod go=u result, and verify that the CLI no longer recompiles them when run as another user.

Written by the indexing model from the issue text.

Description

The precompiled queries in the CodeQL Bundle (e.g., v2.19.1) have file permission 0600; i.e., read-writable by the file owner only. This causes the CodeQL CLI to be unable to read the precompiled queries when it's run as a different user, which starts a lengthy compilation process.

This can be resolved with chmod go=u, but it would be handy if the bundle was shipped in this state.

Dominant language
TypeScript
Stars
1.6k
Forks
493
Avg merge
1d 13h
Merged PRs (30d)
44

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github/codeql-action

All issues in github/codeql-action

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.