How to get Paths from source to sink in Sarif output file

[akanksha1131]

Hi, I want to find paths from source to sink.
With the below given query, I am able to find source and sinks.
I went through this article, and would like to know if I can tweak the select statement to get paths between source and sink as well.
I want the sarif output file to contain the steps/flow from source to sink.
Can anyone please guide me on how to go about this?

/**
 * ...
 * @kind path-problem
 * @name Path2 
 * ...
 */

 import semmle.code.java.dataflow.DataFlow
 
 module MyFlowConfiguration implements DataFlow::ConfigSig {
    predicate isSource(DataFlow::Node src) {
      // Parameters commonly associated with CWEs
      exists(Parameter p |
        p.getName() in [
          "username", "password", "remember", "target", "realName",
          "blabName", "blabberUsername", "command", "cpassword",
          "host", "fortuneFile", "count", "length", "imageName"
        ] 
      ) or
      // Method calls for cookies and session IDs
      exists(MethodAccess access |
        access.getMethod().getDeclaringType().getName() = "javax.servlet.http.HttpServletRequest" and
        (
          access.getMethod().hasName(["getCookies", "getSession", "getId"]) or
          access.getMethod().hasName("getCookieFromRequestByName")
        ) and
        src.asExpr() = access 
      )
    }
   
   /**
    * Define sinks where unvalidated data could lead to vulnerabilities.
    */
   predicate isSink(DataFlow::Node snk) {
      // Detect file access sinks
      exists(MethodAccess fileAccess |
        fileAccess.getMethod().getDeclaringType().getName() = "java.io.File" and
        fileAccess.getMethod().hasName("transferTo") and
        snk.asExpr() = fileAccess
      )
      or
      // Detect SQL injection sinks
      exists(MethodAccess sqlMethod |
        sqlMethod.getMethod().getDeclaringType().getName() = "java.sql.Statement" and
        (
          sqlMethod.getMethod().hasName("executeQuery") or
          sqlMethod.getMethod().hasName("executeUpdate") or
          sqlMethod.getMethod().hasName("execute")
        ) and
        snk.asExpr() = sqlMethod
      )
      or
      // Detect command execution sinks
      exists(MethodAccess cmdExec |
        cmdExec.getMethod().getDeclaringType().getName() = "java.lang.Runtime" and
        cmdExec.getMethod().hasName("exec") or
        cmdExec.getMethod().getDeclaringType().getName() = "java.lang.ProcessBuilder" and
        cmdExec.getMethod().hasName("start") and
        snk.asExpr() = cmdExec
      )
      or
      // Detect object stream access sinks
      exists(MethodAccess objectStreamAccess |
        objectStreamAccess.getMethod().getDeclaringType().getName() = "java.io.ObjectInputStream" and
        objectStreamAccess.getMethod().hasName("readObject") and
        snk.asExpr() = objectStreamAccess
      )
      or
      // Detect string concatenation sinks
      exists(BinaryExpr concatExpr |
        (concatExpr.getLeftOperand() instanceof Literal or concatExpr.getRightOperand() instanceof Literal) and
        snk.asExpr() = concatExpr
      )
      or
      // Detect format method sinks
      exists(MethodAccess formatAccess |
        formatAccess.getMethod().hasName("format") and
        snk.asExpr() = formatAccess
      )
      or
      // Detect session management sinks
      exists(MethodAccess sessionUtils |
        sessionUtils.getMethod().getDeclaringType().getName() = "Utils" and
        (
          sessionUtils.getMethod().hasName("setSessionUserName") or
          sessionUtils.getMethod().hasName("setUsernameCookie")
        ) and
        snk.asExpr() = sessionUtils
      )
      or
      // Detect MessageDigest method sinks
      exists(MethodAccess digestMethod |
        digestMethod.getMethod().getDeclaringType().getName() = "java.security.MessageDigest" and
        digestMethod.getMethod().hasName("getInstance") and
        snk.asExpr() = digestMethod
      )
      or
      // Detect Class.forName method sinks
      exists(MethodAccess classForName |
        classForName.getMethod().getDeclaringType().getName() = "java.lang.Class" and
        classForName.getMethod().hasName("forName") and
        snk.asExpr() = classForName
      )
      or
      // Detect Logger method sinks
      exists(MethodAccess loggerMethod |
        loggerMethod.getMethod().getDeclaringType().getName().matches(".*Logger.*") and
        loggerMethod.getMethod().hasName("info") and
        snk.asExpr() = loggerMethod
      )
      or
      // Detect file input stream sinks
      exists(MethodAccess fileIO |
        fileIO.getMethod().getDeclaringType().getName() = "java.io.FileInputStream" and
        fileIO.getMethod().hasName("FileInputStream") and
        snk.asExpr() = fileIO
      )
      or
      // Detect path concatenation sinks
      exists(BinaryExpr pathConcat |
        pathConcat.getLeftOperand() instanceof Literal and
        snk.asExpr() = pathConcat
      )
    }
  }

 module Flow = DataFlow::Global<MyFlowConfiguration>;
 import Flow::PathGraph
 
 from Flow::PathNode source, Flow::PathNode sink
 where Flow::flowPath(source, sink)
 select sink.getNode(), source, sink, ""

Output:

[aibaars]

You can get the SARIF output by right clicking an item in the Query History list in side panel on the left. However, if your query result has no alerts, then the SARIF will not contain any paths.

Looking at your query I think the definitions of isSource() are wrong. They all select the "return" value of method calls or + operations. Typically sinks are places where data flows into a dangerous operation, these would normally be the arguments of method calls.

[akanksha1131]

Looking at your query I think the definitions of isSource() are wrong. They all select the "return" value of method calls or + operations.

Thanks! I am new to this, can you please elaborate?

[aibaars]

For example for method call like Utils.setUsernameCookie(response, value), you would like an alert if user input flows into the response or the value parameter. So in the isSink() predicate you should select the argument nodes of the method call. If you select the entire method call you are actually selecting the node that belong to the return value of the method call. That's not what you need, and in this case the method probably returns nothing (void).

The isSink() definition would look like the following.

   /**
    * Define sinks where unvalidated data could lead to vulnerabilities.
    */
   predicate isSink(DataFlow::Node snk) {
      exists(MethodAccess sessionUtils |
        sessionUtils.getMethod().getDeclaringType().getName() = "Utils" and
        (
          sessionUtils.getMethod().hasName("setSessionUserName") or
          sessionUtils.getMethod().hasName("setUsernameCookie")
        ) and
          snk.asExpr() = sessionUtils.getAnArgument()
      )
   }

Note that this select any argument of the method, if you only want to select the value argument, you can use sessionUtils.getArgument(1).

The same needs to be done for all the other sinks.

[akanksha1131]

Thanks! The changes you mentioned worked!