CodeQL: Tracking Path

[hOwD4yS]

I got sink and source using Dataflow library, but have no idea getting sequential path.
If the fullpath is source->A->B->sink, I want to know fullpath that included source A,B,sink.
Can I get the solution?

[intrigus-lgtm]

Hi, have a look at #138 which should answer your question :)
Feel free to ask further questions if this didn't answer your question.

TLDR:
Use PathNodes and PathGraph to also get intermediate nodes.
A tutorial can be found here.

[intrigus-lgtm]

I'm afraid, but I didn't fully understand your question.

As an example, take a look at the Resolving XML external entity in user-controlled data query:
This is one of the alerts. To view the complete path, click on "Show Paths" and you should see the different steps
https://lgtm.com/projects/g/jbosstm/narayana/snapshot/43efd39a261e1eff52d0166bad550c949285f4ca/files/rts/at/util/src/main/java/org/jboss/jbossts/star/util/TxSupport.java#xee4a48ed2d0a7a22:1

[hOwD4yS]

As you said, "Show Paths" shows the complete path. But I want to get and use the path step by step on query.

[xcorail]

Hello @hOwD4yS

IIUC you want to "use" the path steps DURING your query, so basically you want to navigate the path and its steps as an object that you could query as any other object?
Can you please give a precise example of what you want to do with this information?

[wmliang]

hi @intrigus-lgtm
i go through the tutorial and this one also
i use vscode
expect: the path query result should be listed under "alerts" dropdown menu
result: "alerts" menu shows 0 results
but the query has around 800 results under the "#select" dropdown menu

what i did on my previous .ql is

+ @kind path-problem
+ import DataFlow::PathGraph
- select source, sink
+ select sink.getNode(), source, sink, "<message>"

sorry for this noob question

[intrigus-lgtm]

@wmliang I think it would be best if you would open a new discussion and post the full ql file :)