From 6b3afee892607c029b494e12cd7207d87019bca7 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Tue, 11 Aug 2026 13:57:33 +0200
Subject: [PATCH 1/3] Data flow: Earlier pruning based on `accessPathLimit`

---
 .../codeql/dataflow/internal/DataFlowImpl.qll | 39 ++++++++++++++++++-
 1 file changed, 37 insertions(+), 2 deletions(-)

diff --git a/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll b/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll
index 3af6b9eab99a..806b4d5a2413 100644
--- a/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll
+++ b/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll
@@ -561,6 +561,21 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
           )
         }
 
+        pragma[nomagic]
+        private int getAnApLengthLowerBound(Ap ap) {
+          accessPathLimit() > 1 and // `accessPathLimit() <= 1` is already checked in stages 1 and 2
+          ap instanceof ApNil and
+          result = 0
+          or
+          exists(Content c, Ap tail |
+            ap = apCons(c, tail) and
+            fwdFlowConsCand(_, ap, c, _, tail) and
+            ap != tail and // no need to report a longer length
+            result = 1 + getAnApLengthLowerBound(tail) and
+            result <= accessPathLimit()
+          )
+        }
+
         pragma[nomagic]
         private predicate fwdFlow0(
           Nd node, Cc cc, SummaryCtx summaryCtx, Typ t, Ap ap, ApApprox apa, TypOption stored
@@ -594,7 +609,10 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
           exists(Content c, Ap ap0 |
             fwdFlowStore(_, _, ap0, _, c, t, stored, node, cc, summaryCtx) and
             ap = apCons(c, ap0) and
-            apa = getApprox(ap)
+            apa = getApprox(ap) and
+            if accessPathLimit() > 1
+            then getAnApLengthLowerBound(ap0) < accessPathLimit()
+            else any()
           )
           or
           // read
@@ -1320,6 +1338,20 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
           fwdFlow(node, _, _, _, ap, _)
         }
 
+        pragma[nomagic]
+        private int getAnApLengthLowerBoundRev(Ap ap) {
+          accessPathLimit() > 1 and // `accessPathLimit() <= 1` is already checked in stages 1 and 2
+          ap instanceof ApNil and
+          result = 0
+          or
+          exists(Ap tail |
+            revFlowConsCand(ap, _, tail) and
+            ap != tail and // no need to report a longer length
+            result = 1 + getAnApLengthLowerBoundRev(tail) and
+            result <= accessPathLimit()
+          )
+        }
+
         pragma[nomagic]
         private predicate revFlow0(Nd node, ReturnCtx returnCtx, ApOption returnAp, Ap ap) {
           fwdFlow(node, _, any(SummaryCtx sinkCtx | sinkCtx.isASinkCtx()), _, ap, _) and
@@ -1356,7 +1388,10 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
           // read
           exists(Nd mid, Ap ap0 |
             revFlow(mid, returnCtx, returnAp, ap0) and
-            readStepFwd(node, ap, _, mid, ap0)
+            readStepFwd(node, ap, _, mid, ap0) and
+            if accessPathLimit() > 1
+            then getAnApLengthLowerBoundRev(ap0) < accessPathLimit()
+            else any()
           )
           or
           // flow into a callable

From ccbab33f2712f4103a9614a034fdb3e27ea0e526 Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Thu, 13 Aug 2026 12:46:49 +0200
Subject: [PATCH 2/3] Update
 shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll

Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
---
 shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll | 1 -
 1 file changed, 1 deletion(-)

diff --git a/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll b/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll
index 806b4d5a2413..285451510375 100644
--- a/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll
+++ b/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll
@@ -568,7 +568,6 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
           result = 0
           or
           exists(Content c, Ap tail |
-            ap = apCons(c, tail) and
             fwdFlowConsCand(_, ap, c, _, tail) and
             ap != tail and // no need to report a longer length
             result = 1 + getAnApLengthLowerBound(tail) and

From aa48658a760046b6c42ada55a63f46769bbd074f Mon Sep 17 00:00:00 2001
From: Tom Hvitved <hvitved@github.com>
Date: Thu, 13 Aug 2026 13:28:32 +0200
Subject: [PATCH 3/3] Data flow: Remove unused variable

---
 shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll b/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll
index 285451510375..c6bdcc206b45 100644
--- a/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll
+++ b/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll
@@ -567,8 +567,8 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
           ap instanceof ApNil and
           result = 0
           or
-          exists(Content c, Ap tail |
-            fwdFlowConsCand(_, ap, c, _, tail) and
+          exists(Ap tail |
+            fwdFlowConsCand(_, ap, _, _, tail) and
             ap != tail and // no need to report a longer length
             result = 1 + getAnApLengthLowerBound(tail) and
             result <= accessPathLimit()