Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Path-problem query fails CSV export with "Expected at least two result patterns" error in CLI (Python) #18841

Open
half450 opened this issue Feb 22, 2025 · 2 comments
Labels
question Further information is requested

Comments

@half450
Copy link

half450 commented Feb 22, 2025

Description:
When trying to export path-problem query results using codeql database analyze (v2.20.0) with CSV format,

codeql database analyze python-db query.ql \
  --format=csv \
  --output=results.csv

I receive the error:

Error was: Expected result pattern(s) are not present for path-problem query: Expected at least two result patterns. These should include at least an 'edges' result set (see https://codeql.github.com/docs/writing-codeql-queries/creating-path-queries/). [INVALID_RESULT_PATTERNS]

The query works in VS Code extension but fails in CLI export. The Python query follows path-problem requirements but seems to miss edge information needed for CLI export.

Environment:

  • CodeQL CLI: 2.20.0
  • OS: macOS 13.2.1
  • Language: Python

Query Code:

/**
 * @name RemoteToFile Flow
 * @description Sample vulnerability path data flow query
 * @kind path-problem
 * @id security/experimental/cve-test
 */

import python
import semmle.python.dataflow.new.DataFlow
import semmle.python.dataflow.new.TaintTracking
import semmle.python.dataflow.new.RemoteFlowSources
import semmle.python.Concepts
import semmle.python.ApiGraphs

module RemoteToFileConfiguration implements DataFlow::ConfigSig {
  predicate isSource(DataFlow::Node source) {

    source instanceof DataFlow::ExprNode
    and source.asExpr() instanceof Name
    and source.getLocation().getFile().getRelativePath() = "src/apis/project.py"
    and exists(Name n | 
      n = source.asExpr() and n.getId() = "project_path")

    and source.getLocation().getStartLine() = 40

    }

  predicate isSink(DataFlow::Node sink) {
    sink instanceof DataFlow::Node
  }
}

module Flow = TaintTracking::Global<RemoteToFileConfiguration>;

// from DataFlow::Node begin, DataFlow::Node end
// where RemoteToFileFlow::flow(begin, end)
// select 
// begin, begin.getLocation().getFile().getRelativePath(),
// end, end.asExpr(),end.getLocation(),
// "This node  uses data from $@."


// 为了满足 path-problem 查询要求,增加对边的结果绑定
// 查询:返回从 begin 到 end 的流以及连接它们的边

from Flow::PathNode source, Flow::PathNode sink
where Flow::flowPath(source, sink)
select sink.getNode(), source, sink, "Flow path from source to sink"

Additional Notes:
The query works in VS Code interface but fails during command. Following documentation for path queries, we tried including edge information through PathEdge but Python implementation seems to have different requirements compared to other languages.

The query aims to track data flow paths from a specific source (project_path at line 40 of project.py) to any potential sink.

Key Question:
How can we properly structure a Python path query to satisfy CLI's export requirements while maintaining the goal of tracing source to anything data flow paths?

@half450 half450 added the question Further information is requested label Feb 22, 2025
@intrigus-lgtm
Copy link
Contributor

Try adding import Flow::PathGraph.
I think the CLI is just a bit more strict in the interpretation than VS Code.

@half450
Copy link
Author

half450 commented Feb 23, 2025

Try adding import Flow::PathGraph. I think the CLI is just a bit more strict in the interpretation than VS Code.

think you for your advice, i have solved this problem.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
question Further information is requested
Projects
None yet
Development

No branches or pull requests

2 participants