pass queries to codeql via a file

lib/finalize-db.js

@@ -86,25 +86,30 @@ async function runResolveQueries(codeqlCmd, queries) {
 }
 async function resolveQueryLanguages(codeqlCmd, config) {
     let res = new Map();
-    const languages = await util.getLanguages();
-    for (const language of languages) {
-        res[language] = [];
-    }
-    if (config.additionalSuites.length !== 0) {
+    if (!config.disableDefaultQueries || config.additionalSuites.length !== 0) {
         const suites = [];
         for (const language of await util.getLanguages()) {
+            if (!config.disableDefaultQueries) {
+                suites.push(language + '-code-scanning.qls');
+            }
             for (const additionalSuite of config.additionalSuites) {
                 suites.push(language + '-' + additionalSuite + '.qls');
             }
         }
         const resolveQueriesOutputObject = await runResolveQueries(codeqlCmd, suites);
         for (const [language, queries] of Object.entries(resolveQueriesOutputObject.byLanguage)) {
+            if (res[language] === undefined) {
+                res[language] = [];
+            }
             res[language].push(...Object.keys(queries));
         }
     }
     if (config.additionalQueries.length !== 0) {
         const resolveQueriesOutputObject = await runResolveQueries(codeqlCmd, config.additionalQueries);
         for (const [language, queries] of Object.entries(resolveQueriesOutputObject.byLanguage)) {
+            if (res[language] === undefined) {
+                res[language] = [];
+            }
             res[language].push(...Object.keys(queries));
         }
         const noDeclaredLanguage = resolveQueriesOutputObject.noDeclaredLanguage;
@@ -125,11 +130,16 @@ async function runQueries(codeqlCmd, databaseFolder, sarifFolder, config) {
     const queriesPerLanguage = await resolveQueryLanguages(codeqlCmd, config);
     for (let database of fs.readdirSync(databaseFolder)) {
         core.startGroup('Analyzing ' + database);
-        const queries = [];
-        if (!config.disableDefaultQueries) {
-            queries.push(database + '-code-scanning.qls');
+        const queries = queriesPerLanguage[database] || [];
+        if (queries.length === 0) {
+            throw new Error('Unable to analyse ' + database + ' as no queries were selected for this language');
         }
-        queries.push(...(queriesPerLanguage[database] || []));
+        // Pass the queries to codeql using a file instead of using the command
+        // line to avoid command line length restrictions, particularly on windows.
+        const querySuite = path.join(databaseFolder, database + '-queries.qls');
+        const querySuiteContents = queries.map(q => '- query: ' + q).join('\n');
+        fs.writeFileSync(querySuite, querySuiteContents);
+        core.debug('Query suite file for ' + database + '...\n' + querySuiteContents);
         const sarifFile = path.join(sarifFolder, database + '.sarif');
         await exec.exec(codeqlCmd, [
             'database',
@@ -139,7 +149,7 @@ async function runQueries(codeqlCmd, databaseFolder, sarifFolder, config) {
             '--format=sarif-latest',
             '--output=' + sarifFile,
             '--no-sarif-add-snippets',
-            ...queries
+            querySuite
         ]);
         core.debug('SARIF results for database ' + database + ' created at "' + sarifFile + '"');
         core.endGroup();