Filter result by number of steps in path #19981
Replies: 2 comments 8 replies
-
|
I made this but is there a better way to do this ? Because it takes a lot of time on some databases. I tried to pass an integer as a parameter but I got some issues regarding inlining / recursion and constraints. int pathLengthBetweenNodes(MyFlow::PathNode src, MyFlow::PathNode dst) {
(result = 0 and src = dst)
or
exists(MyFlow::PathNode intermediate |
intermediate.getASuccessor() = dst and
result <= 42 and
result = pathLengthBetweenNodes(src, intermediate) + 1
)
}
module MyFlow = TaintTracking::Global<MyConfig>; // or DataFlow::Global<..>
from MyFlow::PathNode source, MyFlow::PathNode sink
where MyFlow::flowPath(source, sink)
pathLengthBetweenNodes(source, sink) <= 42
select sink.getNode(), source, sink, "Sample TaintTracking query" |
Beta Was this translation helpful? Give feedback.
-
|
The CodeQL query doesn't have any access to the path length. It doesn't actually construct any paths - this is done in a later step, before the results are shown in VS code. The closest thing that I can think of is that when using partial flow (where you specify the source but not the sink, or vice versa) you can specify some kind of length (I think it might be steps into function calls.) But using partial flow generally increases the number of results massively, so probably wouldn't help you. Note that there are two slightly different things here: you might have lots of results, with one path each, or you might have one result with lots of paths. By default only 4 paths are constructed and shown for each result, though this can be adjusted. So I assume what you are seeing is lots of results. And you say that there are too many to show in VS code? Could you share more about what the query you are running is? Is it possible to apply some heuristic to reduce the number of results, other than path length? |
Beta Was this translation helpful? Give feedback.
-
|
Access path limit has this documentation: Field flow branch limit has this documentation: |
Beta Was this translation helpful? Give feedback.
-
|
Alright thank you so much for the explanation. |
Beta Was this translation helpful? Give feedback.
-
|
Another though: using local flow rather than a global data flow has a similar effect to limiting the path length. It isn't helpful if you want to find paths that don't stay in one function, though. |
Beta Was this translation helpful? Give feedback.
-
|
As @owen-mc writes, we are not actually computing paths in QL, but only the graph from which paths are then derived by the CodeQL CLI. Attempting to restrict results based on path length in QL is probably a symptom that the query is simply too imprecise; that being said, if you still want to try it out, I suggest using the built-in |
Beta Was this translation helpful? Give feedback.
-
|
I'll take a look thank you for all the information! |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Is it possible to filter path-based problem query results by the number of steps in the path from the source to the sink? I have numerous results, making it impossible to display them all in VSCode. I want to retain only those paths with a length of 30 steps or fewer. Is this feasible? In VSCode, the number of steps is displayed, but I'm unsure if I can directly filter this in my CodeQL query.
Beta Was this translation helpful? Give feedback.
All reactions