4 ms·

I wonder how much the difficulty of writing queries varies between languages. I was disappointed to not see Ruby on the beta sign-up list, and GitHub being a pr

I wonder how much the difficulty of writing queries varies between languages. I was disappointed to not see Ruby on the beta sign-up list, and GitHub being a pretty heavy user, I'm sure they have their reasons for excluding it.

daeken 6y ago
This is based on Semmle, which they acquired last year. According to their docs (https://help.semmle.com/lgtm-enterprise/admin/help/sys-requirements/language-support.html https://help.semmle.com/lgtm-enterprise/admin/help/sys-requi...) it supports C, C++, C#, Go, Java, JS, TypeScript, and Python; no Ruby. (Edit to add: Woops, missed that this list is also literally on the page. I had even looked first.) It's really hard to do any kind of static analysis on something like Ruby or Perl where 1) you need a ton of context just to parse it properly, and 2) tracing calls is a nightmare. Given that, I'm completely unsurprised they haven't supported it yet.
- user5994461 6y ago
  How hard can ruby be compared to python? Python is very dynamic. I've used and worked on linting tools for python, tried commercial static analyzers, and they do a pretty good job in my opinion in spite of the language being dynamic. Not perfect but miles above anything I would have expected.
  - sophiebits 6y ago
    In Ruby, monkeypatching is idiomatic and you can’t even tell what package any given global came from.
- antpls 6y ago
  Interestingly there is no support for Rust. Is it because Rust is bullet proof, or too young to be considered for now?
greysteil 6y ago
We (GitHub) absolutely plan to expand the list of languages CodeQL supports, and Ruby is a language we'd love to add (we're heavy users of it internally). In the meantime, because code scanning is extensible you can plug in third party analysis engines to scan the languages that CodeQL doesn't support.

4 ms·

I wonder how much the difficulty of writing queries varies between languages. I was disappointed to not see Ruby on the beta sign-up list, and GitHub being a pr

by frizkie 6y ago

daeken 6y ago
This is based on Semmle, which they acquired last year. According to their docs (https://help.semmle.com/lgtm-enterprise/admin/help/sys-requirements/language-support.html https://help.semmle.com/lgtm-enterprise/admin/help/sys-requi...) it supports C, C++, C#, Go, Java, JS, TypeScript, and Python; no Ruby. (Edit to add: Woops, missed that this list is also literally on the page. I had even looked first.) It's really hard to do any kind of static analysis on something like Ruby or Perl where 1) you need a ton of context just to parse it properly, and 2) tracing calls is a nightmare. Given that, I'm completely unsurprised they haven't supported it yet.
- user5994461 6y ago
  How hard can ruby be compared to python? Python is very dynamic. I've used and worked on linting tools for python, tried commercial static analyzers, and they do a pretty good job in my opinion in spite of the language being dynamic. Not perfect but miles above anything I would have expected.
  - sophiebits 6y ago
    In Ruby, monkeypatching is idiomatic and you can’t even tell what package any given global came from.
- antpls 6y ago
  Interestingly there is no support for Rust. Is it because Rust is bullet proof, or too young to be considered for now?
greysteil 6y ago
We (GitHub) absolutely plan to expand the list of languages CodeQL supports, and Ruby is a language we'd love to add (we're heavy users of it internally). In the meantime, because code scanning is extensible you can plug in third party analysis engines to scan the languages that CodeQL doesn't support.