js/weak-cryptographic-algorithm/BrokenCryptoAlgorithm got 25-30x slower #18604

Activity

1. maschwenk

   added

   questionFurther information is requestedFurther information is requested

   on Jan 28, 2025
2. asgerf commented on Jan 28, 2025

   

   asgerf

   on Jan 28, 2025

   Contributor

   More actions

   Hi @maschwenk, thanks for the report.

   If you've seen this on a public repository could you share a link to the repository?
3. maschwenk commented on Jan 28, 2025

   

   maschwenk

   on Jan 28, 2025

   Last edited by maschwenk

   Author

   More actions

   Sadly not public, and unsure of how to give a repro. Failing on a very large 20k+ LoC typescript app.
4. oliveirafilipe commented on May 14, 2025

   

   oliveirafilipe

   on May 14, 2025

   More actions

   Hey folks.

   Do you have any new information about this?

   On a private repository, after I switched from the cypto-js lib to Node's native crypto lib, this particular query appears to be timing out the pipeline.
   codeql/javascript-queries/Security/CWE-327/BrokenCryptoAlgorithm.ql

   Current runner version: '2.323.0'
   Runner name: 'ubuntu-latest_1a42b9204bdb'
   Runner group name: 'Default'
   Machine name: 'pkrvmjydaqcps29'
   ##[group]Operating System
   Ubuntu
   24.04.2
   LTS
   ##[endgroup]
   ##[group]Runner Image
   Image: ubuntu-24.04
   Version: 20250504.1.0
   
   [build-stdout] Found Node.js version: v20.19.1
   
   [command]/opt/hostedtoolcache/CodeQL/2.21.2/x64/codeql/codeql version --format=json
   {
     "productName" : "CodeQL",
     "vendor" : "GitHub",
     "version" : "2.21.2",
     "sha" : "1ee17689399348659904c76fb340946964fc053e",
     "branches" : [
       "codeql-cli-2.21.2"
     ],
     "copyright" : "Copyright (C) 2019-2025 GitHub, Inc.",
     "unpackedLocation" : "/opt/hostedtoolcache/CodeQL/2.21.2/x64/codeql",
     "configFileLocation" : "/home/runner/.config/codeql/config",
     "configFileFound" : false,
     "features" : {
       "analysisSummaryV2Default" : true,
       "buildModeOption" : true,
       "bundleSupportsIncludeDiagnostics" : true,
       "bundleSupportsIncludeLogs" : true,
       "databaseInterpretResultsSupportsSarifRunProperty" : true,
       "featuresInVersionResult" : true,
       "indirectTracingSupportsStaticBinaries" : false,
       "informsAboutUnsupportedPathFilters" : true,
       "supportsPython312" : true,
       "mrvaPackCreate" : true,
       "threatModelOption" : true,
       "traceCommandUseBuildMode" : true,
       "v2ramSizing" : true,
       "mrvaPackCreateMultipleQueries" : true,
       "setsCodeqlRunnerEnvVar" : true,
       "sarifMergeRunsFromEqualCategory" : true,
       "forceOverwrite" : true,
       "generateSummarySymbolMap" : true,
       "pythonDefaultIsToNotExtractStdlib" : true
     }
   
   ##[group]Run github/codeql-action/analyze@v3
   with:
     upload: never
     ref: REDACTED
     sha: REDACTED
     output: ../results
     cleanup-level: brutal
     add-snippets: false
     skip-queries: false
     checkout_path: REDACTED
     upload-database: true
     wait-for-processing: true
     token: ***
     matrix: null
     expect-error: false
   env:
     REF: REDACTED
     SHA: REDACTED
     CODEQL_ACTION_FEATURE_MULTI_LANGUAGE: false
     CODEQL_ACTION_FEATURE_SANDWICH: false
     CODEQL_ACTION_FEATURE_SARIF_COMBINE: true
     CODEQL_ACTION_FEATURE_WILL_UPLOAD: true
     CODEQL_ACTION_VERSION: 3.28.17
     CODEQL_ACTION_INIT_HAS_RUN: true
     CODEQL_WORKFLOW_STARTED_AT: 2025-05-14T01:57:36.292Z
     CODEQL_RAM: 6914
     CODEQL_THREADS: 2
   
5. hvitved commented on Aug 24, 2026

   

   hvitved

   on Aug 24, 2026

   Contributor

   More actions

   A potential fix has now been merged, which will be included in the 2.27.0 release. Please report back once the release is out. Thanks for your patience.