Skip to content

Docs: document the access path limit in the Java data flow guide #23047

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
yuan2li wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Docs: document the access path limit in the Java data flow guide #23047

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
eed5331
Docs: document the access path limit in the Java data flow guide
yuan2li Nov 8, 2026
fba3022
Docs: state the upper bound on a configured access path limit
yuan2li Nov 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 30 additions & 0 deletions docs/codeql/codeql-language-guides/analyzing-data-flow-in-java.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -197,6 +197,7 @@ These predicates are defined in the configuration:
- ``isSink`` - defines where data may flow to.
- ``isBarrier`` - optional, defines where data flow is blocked.
- ``isAdditionalFlowStep`` - optional, adds additional flow steps.
- ``accessPathLimit`` - optional, sets the maximum length of access paths (see ":ref:`Access path limit <access-path-limit-java>`" below).

The data flow analysis is performed using the predicate ``flow(DataFlow::Node source, DataFlow::Node sink)``:

Expand All @@ -206,6 +207,35 @@ The data flow analysis is performed using the predicate ``flow(DataFlow::Node so
where MyFlow::flow(source, sink)
select source, "Data flow to $@.", sink, sink.toString()

.. _access-path-limit-java:

Access path limit
~~~~~~~~~~~~~~~~~

When data is stored in a field, an element of a collection, or the value of a map, the analysis tracks it with an *access path*: the sequence of contents the data must be read back through. For example, after ``b.inner.val = source`` the data is reached through ``inner`` followed by ``val``, and a value added to a list that is itself added to a list is reached through two element contents.

To keep the analysis tractable, the length of access paths is limited. The default limit is 5 (``accessPathLimit()`` in the shared data flow library), and Java and Kotlin use this default. A flow that needs a longer access path is not reported, and no warning is given.

A configuration can change the limit by defining ``accessPathLimit``:

.. code-block:: ql

module MyFlowConfiguration implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
...
}

predicate isSink(DataFlow::Node sink) {
...
}

int accessPathLimit() { result = 8 }
}

For Java and Kotlin, a configured limit takes effect up to 10, twice the default. A larger value behaves like 10, and no warning is given.

A higher limit can find more flows, but the analysis takes more time and memory.
Comment on lines +232 to +237

@yuan2li yuan2li Nov 10, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

#23049 is now merged, so a configured limit above the default takes effect again. fba3022 adds that it does so up to 10 for Java and Kotlin, and that a larger value behaves like 10.


Using global taint tracking
~~~~~~~~~~~~~~~~~~~~~~~~~~~

Expand Down
Loading