regarding PartialPathGraph

[ice-doom]

myself ql rule:

conf.hasPartialFlow did not get the correct results, it stay at getHost()

when use PathGraph conf.hasFlowPath The correct results can be obtained

What caused it

[smowton]

That truncated partial path looks right to me: the function getHost returns a string constant, so it is correct that there is taint in the vul_name field of this, but that the getHost function does not return it.

You will surely find that one of the other partial paths proposed recreates the full flow to rt.exec that you see with a normal PathGraph.

[ice-doom]

I found what I wanted, but the results are in random order. If the amount of code is large and there are thousands of results, how can I use conf.hasFlowPath to filter them out?

[smowton]

I often find the easiest way is to restrict the source-location of the sink -- "I'm interested in partial paths that end in file Xyz.java lines 101-104" sort of thing. Note for partial paths the "sink" is the end of the partial path, not the sink as defined in the Configuration.