Repository navigation
Description
Description of the issue
Rust is missing an AlertSuppression.ql query, which means // codeql[...] and // lgtm[...] inline suppression comments have no effect on Rust code scanning alerts. Every other supported language (C++, C#, Go, Java, JavaScript, Python, Ruby, Swift) has this query.
All the building blocks already exist in the Rust CodeQL library:
- Shared suppression module:
shared/util/codeql/util/suppression/AlertSuppression.qll— requiresAstNode(withhasLocationInfo) andSingleLineComment(withhasLocationInfo,getText,toString) - Rust
Commentclass:rust/ql/lib/codeql/rust/elements/Comment.qll— already hasgetText()(raw text including//),getCommentText()(stripped),hasLocationInfo(inherited fromAstNode/Token), andtoString - Rust
AstNode:rust/ql/lib/codeql/rust/elements/AstNode.qll
Proposed implementation
A new file at rust/ql/src/AlertSuppression.ql, following the same pattern as python/ql/src/AlertSuppression.ql:
/**
* @name Alert suppression
* @description Generates information about alert suppressions.
* @kind alert-suppression
* @id rust/alert-suppression
*/
private import codeql.util.suppression.AlertSuppression as AS
private import codeql.rust.elements.Comment as C
private import codeql.rust.elements.AstNode as A
class AstNode instanceof A::AstNode {
predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
super.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
}
string toString() { result = super.toString() }
}
class SingleLineComment instanceof C::Comment {
SingleLineComment() {
// Only match single-line comments (// ...), not block comments (/* ... */)
super.getText().matches("//%")
}
predicate hasLocationInfo(
string filepath, int startline, int startcolumn, int endline, int endcolumn
) {
super.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
}
string getText() { result = super.getText() }
string toString() { result = super.toString() }
}
import AS::Make<AstNode, SingleLineComment>The qlpack.yml at rust/ql/src/qlpack.yml already depends on codeql/util, so no dependency changes are needed.
Motivation
Without this, there is no way to suppress false positives inline for Rust. The only workaround is dismissing alerts via the GitHub API or UI, which doesn't persist reliably across code changes.
Activity
jketema commentedon Apr 2, 2026
Hi @christiannuss-ybor,
This looks sensible. Feel free to open a PR that adds your proposed solution.
feat(rust): add AlertSuppression.ql for inline suppression comments
feat(rust): add AlertSuppression.ql for inline suppression comments
feat(rust): add AlertSuppression.ql for inline suppression comments
feat(rust): add AlertSuppression.ql for inline suppression comments
cnuss commentedon Apr 2, 2026
Thanks @jketema! PR is up: #21638
ci(audit): stop rust/hard-coded-cryptographic-value from recurring
ci: analyse production sources with CodeQL advanced setup
ci(codeql): add a config file for path and rule exclusions
ci(codeql): add a config file for path and rule exclusions
fix: keep secrets and session ids out of cleartext sinks (#17)
ROCMAI-82: fix misplaced CodeQL suppression-comment tags
ROCMAI-82: fix misplaced CodeQL suppression-comment tags
ROCMAI-82: fix misplaced CodeQL suppression-comment tags
ROCMAI-82: fix misplaced CodeQL suppression-comment tags
ROCMAI-82: extract driver-install, engines, serve from main.rs (ROCm#540
docs(codeql): say that Rust ignores the inline suppression for now
refactor(server): the configuration file, the HTTP half and the comma…
test(security): generate fresh webhook signing keys (#305)
CI: scan with advanced CodeQL setup and drop path-injection noise
CI: scan with advanced CodeQL setup and drop path-injection noise
CI: scan with advanced CodeQL setup and drop path-injection noise (#256)