Suppressing warning from config

[bit-envoy]

I have question about suppressing warning from config. I have created config:

name: "CodeQL CPP config"

packs:
  - microsoft/windows-drivers
  
query-filters:
  - exclude:
      id:
        - cpp/drivers/irql-function-not-annotated

I am running commands:

.\codeql database create .\MyDriver --language=c --source-root="C:\Users\nidanachain\source\repos\MyDriver1" --command="C:\Users\nidanachain\source\repos\MyDriver1\MyDriver1\Build.bat" --overwrite --codescanning-config="C:\codeql\config.yml"
.\codeql database analyze .\MyDriver --format=sarifv2.1.0 --output=DriverAnalysis.json

And cpp/drivers/irql-function-not-annotated is not suppressed. Why is that? What should I do to suppress globally warning cpp/drivers/irql-function-not-annotated.

[redsun82]

EDIT: this answer is wrong, discussion continues below

previous wrong answer

👋 @bit-envoy

The code scanning configuration is not persisted after being used in the database creation, so you will need to pass it to the database analyze command as well for the packs and query-filters options to apply.

When using github/codeql-action, you can pass the configuration just once to the github/codeql-action/init action and it will be used in all following steps, but with the CLI you need to pass it to all relevant commands.

[bit-envoy]

What would be correct sequence of commands?

[redsun82]

EDIT: this answer is wrong, discussion continues below

previous wrong answer

> What would be correct sequence of commands?

.\codeql database create .\MyDriver --language=c --source-root="C:\Users\nidanachain\source\repos\MyDriver1" --command="C:\Users\nidanachain\source\repos\MyDriver1\MyDriver1\Build.bat" --overwrite --codescanning-config="C:\codeql\config.yml"
.\codeql database analyze .\MyDriver --format=sarifv2.1.0 --output=DriverAnalysis.json --codescanning-config="C:\codeql\config.yml"

(notice the added --codescanning-config command added to .\codeql database analyze)

In your particular case you could probably even skip the --codescanning-config flag on the database create command, as I'm not seeing any configuration property that would affect that command (for example a paths or paths-ignore setting), but it's probably best to keep it just in case the configuration evolves in the future.

[redsun82]

@bit-envoy sorry, I just double checked my answer and I was entirely wrong and misreading the help. I think your initial command should have worked, let me try something locally and I'll get back to you.

[redsun82]

So, I tested your initial command as far as packs and query-filters in the code scanning config is concerned, and I see now that it should have worked, so I don't see anything out of order. In particular I wasn't aware that codeql database analyze will in fact use the configuration from the previous database create invocation.

I also double-checked any kind of typos, but cpp/drivers/irql-function-not-annotated is the correct ID for this query. Next , I'll try testing out whether the sarif format or running on Windows somehow interferes with this.

Is this analysis carried out on a public repository?

Sorry again for my previous misguiding answers 🙇

[redsun82]

I can confirm your configuration should work as you expect, and there doesn't seem to be any bug related to the combination of packs and query-filters, or with the sarif format flag, or with running on Windows. Something else must be going on in your case.

Could you tell us what version of codeql you are running, and provide some more context, like run logs?