I am integrating GitHub Security with another product that creates a Vulnerable Item for each security issue found in GitHub repository. However, what I have identified is that GitHub is only reporting one issue of same kind in a file. I am using the standard CodeQL yaml file that is generated.

Is this file configured to only pick one instance of the same issue? For example, I have this code below. It reports a SQL injection issue for the getValue function but not for the getValue2 function.

I have cloned a public repo so the repo can be seen here: https://github.com/RahmanGitHubOrg/My-API-Vul/blob/246f747265ebada61dd01e34a166969aec5806ed/My_API/Controllers/ValuesDao.cs#L16-L16

Any reasons for this. Appologies that I am a newbie on CodeQl thing…

Many thanks

 public class ValuesDao {
        
        public string getValue(string id) {
                        var connection = new SqlConnection();
            try
            {
                connection.ConnectionString = "db info";
                connection.Open();
                var selectSql = string.Format("select from MyStuff where id='{0}';", id);
                var selectCommand = new SqlCommand(selectSql, connection);

                var dataReader = selectCommand.ExecuteReader();
                return dataReader.GetString(0);
            }
            catch (Exception ex)
            {
            }
            finally
            {
                if (connection.State == ConnectionState.Open)
                {
                    connection.Close();
                }
            }
            return null;
        } 
        
        // TODO: Just for test,this is just for testing if two VIs are created for this
        public string getValue2(string id) {
                        var connection = new SqlConnection();
            try
            {
                connection.ConnectionString = "db info";
                connection.Open();
                var selectSql = string.Format("select from MyStuff where id='{0}';", id);
                var selectCommand = new SqlCommand(selectSql, connection);

                var dataReader = selectCommand.ExecuteReader();
                return dataReader.GetString(0);
            }
            catch (Exception ex)
            {
            }
            finally
            {
                if (connection.State == ConnectionState.Open)
                {
                    connection.Close();
                }
            }

            return null;
        }
    }