Description
Description:
When trying to export path-problem query results using codeql database analyze (v2.20.0) with CSV format,
codeql database analyze python-db query.ql \
--format=csv \
--output=results.csvI receive the error:
Error was: Expected result pattern(s) are not present for path-problem query: Expected at least two result patterns. These should include at least an 'edges' result set (see https://codeql.github.com/docs/writing-codeql-queries/creating-path-queries/). [INVALID_RESULT_PATTERNS]
The query works in VS Code extension but fails in CLI export. The Python query follows path-problem requirements but seems to miss edge information needed for CLI export.
Environment:
- CodeQL CLI: 2.20.0
- OS: macOS 13.2.1
- Language: Python
Query Code:
/**
* @name RemoteToFile Flow
* @description Sample vulnerability path data flow query
* @kind path-problem
* @id security/experimental/cve-test
*/
import python
import semmle.python.dataflow.new.DataFlow
import semmle.python.dataflow.new.TaintTracking
import semmle.python.dataflow.new.RemoteFlowSources
import semmle.python.Concepts
import semmle.python.ApiGraphs
module RemoteToFileConfiguration implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
source instanceof DataFlow::ExprNode
and source.asExpr() instanceof Name
and source.getLocation().getFile().getRelativePath() = "src/apis/project.py"
and exists(Name n |
n = source.asExpr() and n.getId() = "project_path")
and source.getLocation().getStartLine() = 40
}
predicate isSink(DataFlow::Node sink) {
sink instanceof DataFlow::Node
}
}
module Flow = TaintTracking::Global<RemoteToFileConfiguration>;
// from DataFlow::Node begin, DataFlow::Node end
// where RemoteToFileFlow::flow(begin, end)
// select
// begin, begin.getLocation().getFile().getRelativePath(),
// end, end.asExpr(),end.getLocation(),
// "This node uses data from $@."
// 为了满足 path-problem 查询要求，增加对边的结果绑定
// 查询：返回从 begin 到 end 的流以及连接它们的边
from Flow::PathNode source, Flow::PathNode sink
where Flow::flowPath(source, sink)
select sink.getNode(), source, sink, "Flow path from source to sink"
Additional Notes:
The query works in VS Code interface but fails during command. Following documentation for path queries, we tried including edge information through PathEdge but Python implementation seems to have different requirements compared to other languages.
The query aims to track data flow paths from a specific source (project_path at line 40 of project.py) to any potential sink.
Key Question:
How can we properly structure a Python path query to satisfy CLI's export requirements while maintaining the goal of tracing source to anything data flow paths?
Activity