Skip to content

FlowSummaryImpl: Model more source/sink steps as jump steps - #22470

Open
hvitved wants to merge 2 commits into
github:mainfrom
hvitved:flow-summary-source-sink-jump-step
Open

FlowSummaryImpl: Model more source/sink steps as jump steps#22470
hvitved wants to merge 2 commits into
github:mainfrom
hvitved:flow-summary-source-sink-jump-step

Conversation

@hvitved

@hvitved hvitved commented Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Modeling more source/sink steps as jump steps instead of local steps means that we avoid skipping over nodes that we would like to see in the path graph. For example, in

let callback = |x| sink(x);
//              ^ A
//                      ^ B
pass_source_into_callback(callback)
//                        ^^^^^^^^ C

we would previously get a direct edge C -> B, but now we instead get two edges C -> A and A -> B.
@hvitved
hvitved force-pushed the flow-summary-source-sink-jump-step branch from 001b6cd to 4144ee0 Compare August 31, 2026 14:08
@github-actions github-actions Bot added the Rust Pull requests that update Rust code label Aug 31, 2026
@hvitved
hvitved force-pushed the flow-summary-source-sink-jump-step branch from 4144ee0 to c0610f0 Compare September 1, 2026 07:29
@github-actions github-actions Bot added the C++ label Sep 1, 2026
@hvitved
hvitved force-pushed the flow-summary-source-sink-jump-step branch from c0610f0 to 78dce11 Compare September 1, 2026 08:27
@hvitved hvitved added the no-change-note-required This PR does not need a change note label Sep 1, 2026
@hvitved
hvitved marked this pull request as ready for review September 1, 2026 11:37
Copilot AI balanced review requested due to automatic review settings September 1, 2026 11:37
@hvitved
hvitved requested review from a team as code owners September 1, 2026 11:37
@hvitved
hvitved requested a review from MathiasVP September 1, 2026 11:38
Copilot AI reviewed Sep 1, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

The unrelated Windows CI-status filtering should be reverted, separated, or documented.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 1 Medium severity

New issues introduced by this change (1)
Severity Finding
Medium severity misc/​scripts/​accept-expected-changes-from-ci.py — This changes contributor tooling outside the PR's stated flow-summary scope: Windows language-test…
What changed in this PR

Refines flow-summary path graphs so callback and parameter nodes remain visible.

Changes:

  • Reclassifies source/sink boundary steps as jump steps where appropriate.
  • Updates Rust and C++ path expectations.
  • Modifies CI expected-output tooling, including Windows status filtering.
File Description
shared/​dataflow/​codeql/​dataflow/​internal/​FlowSummaryImpl.qll Refines source/sink step classification.
rust/​ql/​test/​query-tests/​security/​CWE-918/​RequestForgery.expected Updates request-forgery paths.
rust/​ql/​test/​query-tests/​security/​CWE-117/​LogInjection.expected Updates log-injection paths.
rust/​ql/​test/​query-tests/​security/​CWE-079/​warp/​XSS.expected Updates Warp XSS paths.
rust/​ql/​test/​query-tests/​security/​CWE-079/​axum/​XSS.expected Updates Axum XSS paths.
rust/​ql/​test/​query-tests/​security/​CWE-079/​actix/​XSS.expected Updates Actix XSS paths.
rust/​ql/​test/​library-tests/​dataflow/​sources/​web_frameworks/​InlineFlow.expected Records intermediate web-framework nodes.
rust/​ql/​test/​library-tests/​dataflow/​sources/​database/​InlineFlow.expected Records intermediate database callback nodes.
rust/​ql/​test/​library-tests/​dataflow/​models/​models.expected Updates modeled-flow paths.
misc/​scripts/​accept-expected-changes-from-ci.py Changes log retrieval and Windows filtering.
cpp/​ql/​test/​library-tests/​dataflow/​external-models/​flow.expected Updates external-model paths.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment thread misc/scripts/accept-expected-changes-from-ci.py
lang_test_failures: List[GithubStatus] = list()
for status in newest_status.values():
if " Language Tests" in status.context or status.context in supported_internal_status_language_test_names:
if " Language Tests" in status.context and not " Language Tests Windows" in status.context or status.context in supported_internal_status_language_test_names:
@hvitved
hvitved force-pushed the flow-summary-source-sink-jump-step branch from 78dce11 to d64ad79 Compare September 1, 2026 14:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

C++ DataFlow Library no-change-note-required This PR does not need a change note Rust Pull requests that update Rust code

2 participants

@hvitved