Merge pull request #23049 from aschackmull/dataflow/accesspathlimit

Dataflow: Allow a config access path limit above the language default.

Author: aschackmull

shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll

@@ -566,15 +566,15 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
 
         pragma[nomagic]
         private int getAnApLengthLowerBound(Ap ap) {
-          accessPathLimit() != 0 and // `accessPathLimit() = 0` is already checked in `useFieldFlow`
+          Config::accessPathLimit() != 0 and // `accessPathLimit() = 0` is already checked in `useFieldFlow`
           result = ap.length()
           or
           not exists(ap.length()) and
           exists(Ap tail |
             fwdFlowConsCand(_, ap, _, _, tail) and
             ap != tail and // no need to report a longer length
             result = 1 + getAnApLengthLowerBound(tail) and
-            result <= accessPathLimit()
+            result <= Config::accessPathLimit()
           )
         }
 
@@ -612,7 +612,7 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
             fwdFlowStore(_, _, ap0, _, c, t, stored, node, cc, summaryCtx) and
             ap = apCons(c, ap0) and
             apa = getApprox(ap) and
-            getAnApLengthLowerBound(ap0) < accessPathLimit()
+            getAnApLengthLowerBound(ap0) < Config::accessPathLimit()
           )
           or
           // read
@@ -1340,15 +1340,15 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
 
         pragma[nomagic]
         private int getAnApLengthLowerBoundRev(Ap ap) {
-          accessPathLimit() != 0 and // `accessPathLimit() = 0` is already checked in `useFieldFlow`
+          Config::accessPathLimit() != 0 and // `accessPathLimit() = 0` is already checked in `useFieldFlow`
           result = ap.length()
           or
           not exists(ap.length()) and
           exists(Ap tail |
             revFlowConsCand(ap, _, tail) and
             ap != tail and // no need to report a longer length
             result = 1 + getAnApLengthLowerBoundRev(tail) and
-            result <= accessPathLimit()
+            result <= Config::accessPathLimit()
           )
         }
 
@@ -1389,7 +1389,7 @@ module MakeImpl<LocationSig Location, InputSig<Location> Lang> {
           exists(Nd mid, Ap ap0 |
             revFlow(mid, returnCtx, returnAp, ap0) and
             readStepFwd(node, ap, _, mid, ap0) and
-            getAnApLengthLowerBoundRev(ap0) < accessPathLimit()
+            getAnApLengthLowerBoundRev(ap0) < Config::accessPathLimit()
           )
           or
           // flow into a callable

shared/dataflow/codeql/dataflow/internal/DataFlowImplCommon.qll

@@ -1794,15 +1794,22 @@ module MakeImplCommon<LocationSig Location, InputSig<Location> Lang> {
       TReturnCtxNoFlowThrough() or
       TReturnCtxMaybeFlowThrough(ReturnPosition pos)
 
+    /**
+     * Gets the upper bound for the access path length limit that is supported
+     * in data flow Configurations. This is set to be at least twice the
+     * language default access path limit.
+     */
+    private int accessPathLimitConfigCap() { result = 10.maximum(2 * accessPathLimit()) }
+
     cached
     newtype TAccessPathFront =
       TFrontNil() or
-      TFrontHead(Content c, int length) { length in [1 .. accessPathLimit()] }
+      TFrontHead(Content c, int length) { length in [1 .. accessPathLimitConfigCap()] }
 
     cached
     newtype TApproxAccessPathFront =
       TApproxFrontNil() or
-      TApproxFrontHead(ContentApprox c, int length) { length in [1 .. accessPathLimit()] }
+      TApproxFrontHead(ContentApprox c, int length) { length in [1 .. accessPathLimitConfigCap()] }
 
     cached
     newtype TAccessPathFrontOption =