How do you catch that blocking step toward the sink?

[Sim4n6]

This is more of an open discussion about how you guys figure out the blocking additional taint step to add.
I mean suppose I have an app that takes an input, say aaa.
I am aware that the user input reaches a sink somehow unaltered.
But, the TaintTracking configuration does not get to reach the flow path.
So I guess I have an additional taint step to figure out.

My question is :

How do you identify where the flow ends, please? do you use some partial paths? in Codeql Python?

Thank you in advance

[atorralba]

Partial flow might be what you're looking for.

[owen-mc]

Note that the interface to partial flow has recently changed, as part of moving to a new API for dataflow, and isn't well documented yet. I put some instructions in point 5 of this comment.

[Sim4n6]

@atorralba it is a bit outdated, I believe you started using FlowExploration instead.
Do you have any ready-made debugging query for a sample TaintTracking Config related to Python, please?

[Sim4n6]

Two comments, same exact time. Thank you @owen-mc ... heading there right away.

[Sim4n6]

well, it takes an endless time on my machine, but I have got a little latitude-5490 ... so maybe it is me.

[owen-mc]

Partial flow does take a long time (quite possibly so long that it will never terminate) if you don't restrict it. It's advised to restrict to just one source (maybe by specifying the file and line number). You can also start with a low value of n to see what you get, and slowly increase it.