Skip to content

Conversation

@MathiasVP
Copy link
Collaborator

... and also make the paths outputted in dataflow queries more readable.

This PR does two things (each in their own commit):

  1. It removes environment variables as sources in the PowerShell SQL injection query. This matches the change we did in b72af27 for the command-line injection query.
  2. It fixes a bug related to how we hide/unhide certain nodes in dataflow paths. The dataflow library has two "hooks" that decides which nodes to never show in a path (the nodeIsHidden predicate) and which nodes to always show in a path (the neverSkipInPathGraph). We had a bug in nodeIsHidden which always hid uses of local variables. This meant that paths were way too compressed to be readable. Furthermore, I chose to follow C# and always show definitions in the path.

The combination of these two fixes in (2) mean that paths are much more readable 🎉

@MathiasVP MathiasVP merged commit ae4b3e8 into main Jul 24, 2025
3 checks passed
dilanbhalla pushed a commit that referenced this pull request Aug 8, 2025
…ction

PS: Remove environment variables from `powershell/microsoft/public/sql-injection`
dilanbhalla pushed a commit that referenced this pull request Aug 8, 2025
…ction

PS: Remove environment variables from `powershell/microsoft/public/sql-injection`
dilanbhalla pushed a commit that referenced this pull request Aug 8, 2025
…ction

PS: Remove environment variables from `powershell/microsoft/public/sql-injection`
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants