codeql icon indicating copy to clipboard operation
codeql copied to clipboard

Dataflow: Deduplicate results when sinks accept multiple FlowStates.

Open aschackmull opened this issue 1 year ago • 1 comments

Until now we've included the FlowState in the definition of PathNodeSink, but when sinks accept multiple states then this can show up as seemingly duplicate results. Projecting the state column away on sink nodes seems preferable.

aschackmull avatar Sep 25 '24 12:09 aschackmull

Hmm, looks like we might actually introduce ~alert duplication~ potential false positives when the source is correlated with the sink state and the sink state is incorporated in the alert.

aschackmull avatar Sep 25 '24 13:09 aschackmull