QL: more precise alert locations#8937
Conversation
f4b3b26 to
467b149
Compare
|
The alternative approach would be to change If you still need the "full location" around for some reason, then consider adding it as a predicate on |
Is there any CodeQL language that does anything like that? All I've seen is that Do you know if we have any documentation on what |
This is not the exact same setup as what is being discussed here, but for many Python AST elements, the location (as emitted by the extractor) is not the same as what is spanned by the entire AST node. An example of this is Suffice it to say, I'm not a fan of doing it in the extractor (there's a sizeable chunk of I like the idea of moving this into overrides on |
The location of Java classes are just the location of the class name rather than spanning the entire class definition, so there is at least some precedence. |
Hmmm. |
Done. |
3bca02b to
73b657c
Compare
|
I rebased on |
Ignore the code-scanning failure, that is just from the existing errors getting a new location.
Drive-by removal of the
tools:latestworkaround.That one was required when some Action runners didn't have CodeQL 2.8.2 or later.
(The cached version seems to be 2.8.5 now).