Steps in Global Dataflow Paths [python]

[ppashakhanloo]

When a global dataflow query indicates that there is some path between source N and sink M, is there a way to get the individual dataflow steps that comprise the path between N and M?

[intrigus-lgtm]

You can use DataFlow::PathNodes (and hasFlowPath) instead of ordinary DataFlow::Nodes and then use the getASuccessor function to get the successor of the source N and so on.
But as far as I know, CodeQL will aggressively prune steps for performance reasons, i.e., some steps of the flow are not represented as PathNodes and will not be returned by getASuccessor.

[hvitved]

Also, there is no way to actually refer to the paths that are shown in the UI, so while it is possible to traverse the graph via PathNode::getASuccessor, there is no way to relate that to what is shown in the UI.

[ppashakhanloo]

Thank you, @intrigus-lgtm and @hvitved !

@intrigus-lgtm You mentioned that CodeQL aggressively prunes steps. Is there any details on these kinds of optimizations and the global data flow to read? I have looked into the corresponding *.qll files but they do not show these details.

@hvitved I see. By UI do you mean a graphical UI (lgtm) or the cli? I only use cli version.
While codeql engine is doing its computations, I expect it to fetch tuples from the database to run a number of operations. Is there a (not necessarily neat!) way to log these operations or fetches? Maybe there is some information in them about the behavior of the global dataflow analyzer?

[hvitved]

By UI do you mean a graphical UI (lgtm) or the cli? I only use cli version.

What I meant was the flow paths that are generated for @kind path-problem queries. These paths are normally consumed in the form of SARIF files (when using the CLI) or visually when run in VS Code.