C++: Support access paths for sources and sinks by MathiasVP · Pull Request #22374 · github/codeql

MathiasVP · 2026-08-18T15:43:33Z

Now that #22145 has been merged we can finally add MaD support for access paths at sources and sinks.

Commit-by-commit review recommended.

1a811d5 does some small refactorings to our ParameterNodes and ArgumentNodes in dataflow which will make the main commit simpler.
79ac009 (and 1dd500d) does the main bulk of this PR.
b89e4f1 hides some consistency errors like Rust does.
fe46062 fixes a problem with the SQL-injection query. The query was assuming that the sink was always a non-flow summary node, and that assumption is changing in this PR. This causes a single alert to change location slightly:
```
(SQLCHAR *)     sql
^ new location  ^ old location
```

There's a small change to the toString on sources (and sinks) defined in MaD. Previously, it would be the toString of the underlying dataflow node. However, due to the way MaD works it's hard (impossible?) to keep this behavior.

I need to update an .expected file in the internal repo as well (because of the toString changes). I'll do that once this PR has been reviewed to avoid unnecessary submodule bumps.

…nks (no test changes).

… be an (indirect)expr.

Copilot

Pull request overview

Adds C++ models-as-data support for source and sink access paths in the IR data-flow framework.

Changes:

Introduces flow-summary reporting nodes for modeled sources and sinks.
Refactors argument/parameter node handling and consistency checks.
Updates SQL injection handling, tests, and expected outputs.

Show a summary per file

File	Description
`cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/ExposedSystemData.expected`	Updates expected source/sink labels.
`cpp/ql/test/query-tests/Security/CWE/CWE-089/SqlTainted/SqlTainted.expected`	Updates SQL alert locations and labels.
`cpp/ql/test/library-tests/dataflow/models-as-data/testModels.expected`	Records new flow-summary nodes.
`cpp/ql/test/library-tests/dataflow/external-models/test.cpp`	Adds source access-path test cases.
`cpp/ql/test/library-tests/dataflow/external-models/sources.expected`	Updates expected modeled sources.
`cpp/ql/test/library-tests/dataflow/external-models/sinks.expected`	Updates expected modeled sinks.
`cpp/ql/test/library-tests/dataflow/external-models/flow.ext.yml`	Adds field and callback source models.
`cpp/ql/test/library-tests/dataflow/external-models/flow.expected`	Records updated flow graphs.
`cpp/ql/src/Security/CWE/CWE-089/SqlTainted.ql`	Supports flow-summary sink nodes.
`cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll`	Refactors argument and position abstractions.
`cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowNodes.qll`	Exposes and labels source/sink summary nodes.
`cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll`	Excludes summary nodes from consistency checks.
`cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll`	Implements C++ source/sink access-path reporting.
`cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll`	Routes modeled sources and sinks through summary nodes.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Suppressed comments (1)

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll:629

This cannot resolve index -1, because Cpp::Parameter only represents zero-based explicit parameters. However, decodePosition accepts Parameter[-1] and callback-self positions also use -1, so models rooted at that source parameter and source/sink callback paths targeting a member function's receiver cannot obtain a reporting element and silently disappear. Add an explicit representation/mapping for the implicit this parameter instead of routing it through Cpp::Parameter.

  Parameter getParameter(Function f) {
    result.getFunction() = f and
    this.getArgumentIndex() = result.getIndex()
  }

Files reviewed: 14/14 changed files
Comments generated: 4
Review effort level: Balanced

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

hvitved

Looks great, a couple of minor comments.

hvitved · 2026-08-21T09:42:03Z

+    }
+
+    SourceSinkReportingElement getASuccessor(Impl::Private::SummaryComponent sc) {
+      exists(ParameterPosition pos | sc = Impl::Private::SummaryComponent::parameter(pos) |


Is it relevant to also track clousures through local data flow, like Rust does?

Hmm, possibly, yes. I don't think it's very common to pass around closures like that in C++. But it does seem pretty easy to basically copy that line from Rust so I'll look into it

Fixed in 150d0a7. It's mostly a copy from Rust (except that we never added a user-friendly predicate like assigns on Ssa::WriteDefinition).

hvitved · 2026-08-21T09:46:27Z

+      p.isParameterOf(e.getEnclosingCallable(), pos) and
+      result = p


I would think e = p.getParameter() to work.

We still need to relate pos (i.e., the parameter position) and the parameter, though.

hvitved · 2026-08-21T09:46:55Z

-  class SourceSinkReportingElement extends Void {
-    Location getLocation() { none() }
+  class SourceSinkReportingElement extends Element {
+    SourceSinkReportingElement() { this instanceof Expr or this instanceof Parameter }


This means that implicit this parameters are not handled, right?

Correct. I can't imagine why you'd want to pick that one as a source (or sink) element so I think that's fine. I'm curious if you think it's worth handling (and if so which element you'd pick for it?)

hvitved · 2026-08-21T09:51:16Z

-    exists(Expr taintedArg | result = [taintedArg.getLocation(), sink.getLocation()] |
-      taintedArg = asSinkExpr(sink)
-    )
-  }


Isn't it important to keep this predicate for diff-informed?

Since the primary location of the query is now exactly the sink of the configuration the default implementation should Just Work, I think?

jketema · 2026-08-21T13:15:17Z

+  isSink(sinkNode.getNode(), extraText) and
  taintSource = sourceNode.getNode()
-select taintedArg, sourceNode, sinkNode,
+select sinkNode.getNode(), sourceNode, sinkNode,


Could this potentially give rise to new results?

I was actually expecting 0 alert changes from this, but DCA does reveal a single alert change since we picked somehow picked the location of the unconverted expression, and we now pick the location of the converted expression.

But I think that's the only case, as we don't see the location changing in any query tests.

…nges.

jketema · 2026-08-21T14:50:06Z

I'm happy with the changes here. I'll leave the actual approval to @hvitved.

MathiasVP added 2 commits August 17, 2026 15:08

C++: Cleanup in preparation for adding access paths at sources and si…

1a811d5

…nks (no test changes).

C++: Add tests with missing flow sources.

2ea969d

github-actions Bot added the C++ label Aug 18, 2026

MathiasVP added 3 commits August 19, 2026 11:22

C++: Support for access path at sources and sinks.

79ac009

C++: Accept test changes.

af7db96

C++: Hide flow summary nodes from consistency just like Rust does.

b89e4f1

MathiasVP force-pushed the cpp-access-paths-for-sources-and-sinks-3 branch from e164ec1 to 497d9b6 Compare August 19, 2026 10:24

MathiasVP added 2 commits August 19, 2026 15:39

C++: Fixup 'cpp/sql-injection' so that it doesn't require the sink to…

fe46062

… be an (indirect)expr.

C++: Accept test changes. Nothing exciting here.

5077b54

MathiasVP force-pushed the cpp-access-paths-for-sources-and-sinks-3 branch from 497d9b6 to 5077b54 Compare August 19, 2026 14:39

MathiasVP marked this pull request as ready for review August 19, 2026 15:10

MathiasVP requested a review from a team as a code owner August 19, 2026 15:10

Copilot AI balanced review requested due to automatic review settings August 19, 2026 15:10

Copilot started reviewing on behalf of MathiasVP August 19, 2026 15:13 View session

Copilot AI reviewed Aug 19, 2026

View reviewed changes

MathiasVP and others added 2 commits August 19, 2026 16:23

Potential fix for pull request finding

20788f1

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

C++: Add change note.

98285fa

github-actions Bot added the documentation label Aug 19, 2026

MathiasVP marked this pull request as draft August 19, 2026 15:30

MathiasVP added 2 commits August 19, 2026 16:41

C++: Fix bug spotted by Copilot.

2e43cea

C++: Add tests with missing flow sources and sinks.

ea70e5c

github-advanced-security Bot found potential problems Aug 20, 2026

View reviewed changes

Comment thread cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll Fixed

Comment thread cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll Fixed

MathiasVP added 2 commits August 20, 2026 16:51

C++: Support 'ReturnValue' in both sources and sinks.

1dd500d

C++: Accept test changes.

f0a4145

MathiasVP force-pushed the cpp-access-paths-for-sources-and-sinks-3 branch from fd24dab to f0a4145 Compare August 20, 2026 15:57

MathiasVP marked this pull request as ready for review August 20, 2026 19:48

hvitved requested changes Aug 21, 2026

View reviewed changes

C++: Fix QLDoc.

74807b0

jketema reviewed Aug 21, 2026

View reviewed changes

C++: Add tests with missing flow sources.

3649784

C++: Track function pointers using local dataflow and accept test cha…

150d0a7

…nges.

Merge branch 'main' into cpp-access-paths-for-sources-and-sinks-3

3ffcc1e

MathiasVP added the depends on internal PR This PR should only be merged in sync with an internal Semmle PR label Aug 21, 2026

Merge branch 'main' into cpp-access-paths-for-sources-and-sinks-3

b34e1cc

		p.isParameterOf(e.getEnclosingCallable(), pos) and
		result = p

Uh oh!

Conversation

MathiasVP commented Aug 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

hvitved left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

MathiasVP Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jketema commented Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

MathiasVP commented Aug 18, 2026 •

edited

Loading

MathiasVP Aug 21, 2026 •

edited

Loading

jketema commented Aug 21, 2026 •

edited

Loading