I have setup a project to test the capability of CodeQL，to test taint tracking ablitity

[hatface]

here is my project

https://github.com/hatface/codeql_cap_evalution

here is the test result

https://github.com/hatface/codeql_cap_evalution/blob/main/CodeQL_Capacibility_Test_Result.md

here is the CodeQL Query

https://github.com/hatface/codeql_cap_evalution/blob/main/taint_cap_test.ql

and the case5 is failed

QUESTION：
how to fix the situation using isAdditionalTaintStep

[jketema]

Hi @hatface. Thanks for your question. As we have been discussing on #11734, CodeQL might not give you back all the paths. When I modify your main function to be just

     source(sourceInt, sourceStr);
     sceneTest05(sourceInt, sourceStr);

the relevant path shows up for me. You really want to disentangle your test cases. So instead of having a single main function with overlapping test cases create 6 separate ones that look something like:

void test0() {
    ...
     source(sourceInt, sourceStr);
     sink(sourceInt, sourceStr);
}

void test1() {
    ...
     source(sourceInt, sourceStr);
     sceneTest01(sourceInt, sourceStr);
}

...

void test5() {
    ...
     source(sourceInt, sourceStr);
     sceneTest05(sourceInt, sourceStr);
}

int main(int argc, char **argv) {
  test0();
  test1();
  ...
  test5();
  return 0;
}

[hatface]

@jketema thx a lot, but I followed your advice, the test case 5 still fail, my project, my QL, my test result updated

[jketema]

Are you sure the path is actually missing? With the latest version of your project I'm seeing the following, which I your 5th test case.

[hatface]

emm， it seems that we encounter a problem，would you pls use the lastest version of my program，and query with the lastest ql。all resource in here https://github.com/hatface/codeql_cap_evalution。
I can't find the testcase 5.

ps：codeql-repo and codeql-binary-cli is the lastest

[jketema]

My result above is with the latest versions.

[jketema]

Which operating system are you on and which compiler do you use?

[hatface]

compile on ubuntu
compiler：gcc version 7.5.0 (Ubuntu 7.5.0-3ubuntu1~18.04)

run result on windows
with vscode-codeql and codeql on windows

[jketema]

compile on ubuntu
compiler：gcc version 7.5.0 (Ubuntu 7.5.0-3ubuntu1~18.04)

I haven't checked on Windows, but I see your issue on Linux. This issue is a combination of the dataflow library you're using and the way shared pointers are implemented by gcc. The solution is to switch to our IR-based dataflow library. To do so, replace

import semmle.code.cpp.dataflow.TaintTracking

by

import semmle.code.cpp.ir.dataflow.TaintTracking

[hatface]

can you share the testcases，which is used by codeQL team？

[jketema]

can you share the testcases，which is used by codeQL team？

I'm not sure what you mean. I just tested with the project you shared.

[hatface]

I mean share CodeQL team's testcases，which your team use to test the ability of CodeQL，or benchmark code，may be

[jketema]

All the test cases are located in https://github.com/github/codeql