General issue - Using this taint-tracking script can only show the source node and sink node?

When I used the script that was found in [https://github.com/github/codeql/blob/main/python/ql/src/Security/CWE-078/CommandInjection.ql](url) to do a command-injection taint tracking, I found that it can only show the source node and the sink node but not give me the node between them so that I can't build a full path to record the way that taint data passed to vulnerable function.

File: CommandInjection.ql

```ql
/**
* @name Uncontrolled command line
* @description Using externally controlled strings in a command line may allow a malicious
* user to change the meaning of the command.
* @kind path-problem
* @problem.severity error
* @sub-severity high
* @precision high
* @id py/command-line-injection
* @tags correctness
* security
* external/owasp/owasp-a1
* external/cwe/cwe-078
* external/cwe/cwe-088
*/

import python
import semmle.python.security.dataflow.CommandInjection
import DataFlow::PathGraph

from CommandInjectionConfiguration config, DataFlow::PathNode source, DataFlow::PathNode sink
where config.hasFlowPath(source, sink)
select sink.getNode(), source, sink, "This command depends on $@.", source.getNode(),
"a user-provided value"
```

Example vuln code:

```python
from flask import Flask, request
import subprocess

app = Flask(__name__)

@app.route('/run_command')
def get_run_command():
binary = request.args.get("bin") #source1
args = request.args.get("args") #source2
if len(binary) > 0: #?
if len(args) < 10: #?
subprocess.Popen([binary, args]) #sink
return "success"
else:
return "fail"

def main():
app.run(debug=True)
```

In my impression, the old version of **CommandInjection example ql-script** that does not encapsulate class “**CommandInjectionConfiguration**” can achieve the functions I mentioned above.