Taint tracking produces duplicate findings

[erwanlr]

Describe the bug
Taint mode can produces duplicate findings

To Reproduce
https://semgrep.dev/s/WOzo

Expected behavior
There should not be duplicate findings

Screenshots

What is the priority of the bug to you?

P1: important to fix or quite annoying

Environment
Semgrep.dev & CLI 0.62.0 on MacOSX (Installed via Homebrew)

[IagoAbal]

The way taint tracking works it is non-trivial to guarantee that there are no duplicates. Right now, internally, we use search-mode queries to compute the ranges of sources, sanitizers, and sinks. Then if e.g. an expression is inside a pattern-sources range, then we consider it a source of taint; and, if it is inside a pattern-sinks range, we consider it a sink. We have some mechanisms to remove duplicates, but they don't work when a single Generic "instruction" translates into multiple Dataflow IL instructions.

[IagoAbal]

Another example reported by @emjin: https://semgrep.dev/s/d0dZ/

[IagoAbal]

I will let the engine produce the duplicates and filter these duplicates at the end. Unless there are too many taint matches, it should not cause perf problems. There may be a better solution but I need to think more on it and discuss it with some colleagues.

[erwanlr]

Fine by me ;) I think the max duplicates per issue I had so far is 3

Btw, I noticed another issue (ticket linked) when trying to reduce duplicate output by adding functions such as isset(...) as sanitizer (which works in term of eliminating some duplicates, but then some code won't match :o)