Missing taint flow
- Dominant language
- CodeQL
- Stars
- 10.1k
- Forks
- 2.1k
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 141
Description
**Description of the false positive**
**Code samples or links to source code**
**URL to the alert on GitHub code scanning (optional)**
I use the following query analysis code:
```
import python
import semmle.python.dataflow.new.DataFlow
import semmle.python.dataflow.new.TaintTracking
import semmle.python.dataflow.new.RemoteFlowSources
import semmle.python.Concepts
import semmle.python.ApiGraphs
module BackwardDataFlowConfiguration implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
source instanceof DataFlow::ExprNode
and source.asExpr() instanceof Name
and source.getLocation().getFile().getRelativePath() = "lollms/server/endpoints/lollms_personalities_infos.py"
and exists(Name n |
n = source.asExpr() and n.getId() = "category")
and source.getLocation().getStartLine() = 330
}
predicate isSink(DataFlow::Node sink) {
sink instanceof DataFlow::Node
}
}
module BackwardDataFlow = TaintTracking::Global;
from DataFlow::Node begin, DataFlow::Node end
where BackwardDataFlow::flow(begin, end)
select
begin,
"$@,$@"
,
begin.getLocation(),
"begin location"
,
end.getLocation(),
"end location"
```
this is the results:

Starting from the `category` variable I specified, I tried to find all the nodes that it could potentially flow to. However, I only ended up with six results, which are marked in the figure above. Apparently, the `package_full_path` in the row where the sixth point is located is also a node that category could flow to, but the results don't reflect this. Why is that? Thank you for your answer!
Contributor guide
Research direction
Start with the supplied CodeQL query and the source location lollms/server/endpoints/lollms_personalities_infos.py at line 330. Reproduce the flow results for category, then inspect the location containing package_full_path and compare it with the reported nodes. Done means explaining, or identifying the needed correction for, why that location is absent from the results.
Written by the indexing model from the issue text.
Assessment
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100