Python extractor reports parse errors for files no longer in the scanned commit
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 48/100
Research direction
Start by reproducing the Python extractor diagnostics against commit 996e624, where the reported files were deleted, and compare the extractor's scanned file set with the checked-out commit. Use python -m py_compile as the syntax baseline. Done means accepted files do not produce false parse errors and deleted files are not reported.
Written by the indexing model from the issue text.
Description
Setup
- CodeQL version: 2.27.0
- Language: Python 3.13
- GitHub default CodeQL analysis (Advanced Security > Code scanning > Default setup)
- Repo (private): https://github.com/lumin-ai/lumin-bot
Observed behavior
CodeQL reports parse errors about two Python files. Here's a log sample (I've replaced my actual filenames with foo.py and bar.py):
Analysis produced the following diagnostic information:
##[group]Could not process some files due to syntax errors (2 results)
* foo.py#L0C0:0: A parse error occurred while processing `foo.py`, and as a result this file could not be analyzed. Check the syntax of the file using the `python -m py_compile` command and correct any invalid syntax.
* bar.py#L0C0:0: A parse error occurred while processing `bar.py`, and as a result this file could not be analyzed. Check the syntax of the file using the `python -m py_compile` command and correct any invalid syntax.
##[endgroup]
What I tried
-
I ran
python -m py_compileon both files. This check completed without errors on Python 3.7, 3.8, 3.9, 3.10, 3.11, and 3.12. -
I removed an old header from the files:
# -*- coding: future_fstrings -*-. This header was a leftover from a Python 2 to Python 3 migration involving https://github.com/asottile-archive/future-fstrings. The warnings stayed. (I imagine, but am not sure, that this header caused the original parsing problem. These two files were the only ones in the repo that still had it.) -
I checked the files for invisible characters and for a byte order mark. The only non-ASCII characters were some bullet characters inside one docstring. I replaced them with ASCII hyphens. The warnings stayed.
-
I replaced the full contents of both files with a single
passstatement. The warnings stayed. -
I deleted both files. The warnings stayed. I believe these logs confirm that CodeQL scanned the commit where I deleted the files (commit 996e624 in pull request 3584):
##[group]Checking out the ref [command]/usr/bin/git checkout --progress --force refs/remotes/pull/3584/head Note: switching to 'refs/remotes/pull/3584/head'. You are in 'detached HEAD' state. You can look around, make experimental changes and commit them, and you can discard any commits you make in this state without impacting any branches by switching back to a branch. If you want to create a new branch to retain commits you create, you may do so (now or later) by using -c with the switch command. Example: git switch -c <new-branch-name> Or undo this operation with: git switch - Turn off this advice by setting config variable advice.detachedHead to false HEAD is now at 996e624 bisect: blow away the whole python modules to see if codeql still complains [skip tests] ##[endgroup]
Expected behavior
- CodeQL must not report parse errors for Python files that
python -m py_compileaccepts. - CodeQL must not report parse errors for files that do not exist in the scanned commit.
- Dominant language
- CodeQL
- Stars
- 10.1k
- Forks
- 2.1k
- Avg merge
- 2d 16h
- Merged PRs (30d)
- 143
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from github/codeql
-
agentic-workflows
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
false-positive javascript
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
C#: cs/simplifiable-boolean-expression false positive on Nullable<bool> compared with a literal Open
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
false-positive
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Similar issues
-
ZCode 3.14.3 に対応する Open
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
supermomonga/zcode-acp#24 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
learningequality/ricecooker#747 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
KhronosGroup/glTF-Blender-IO#2769 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100