Get Function Body when in output of select

[akanksha1131]

This is the query:

/**
 * @name Query built from user-controlled sources
 * @description Building a SQL or Java Persistence query from user-controlled sources
 * is vulnerable to insertion of malicious code by the user.
 * @kind path-problem
 * @problem.severity error
 * @security-severity 8.8
 * @precision high
 * @id java/sql-injection
 * @tags security
 * external/cwe/cwe-089
 * external/cwe/cwe-564
 */

 import java
 import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.security.SqlInjectionQuery
 import QueryInjectionFlow::PathGraph
 
 // Define the query flow from user-controlled sources to sinks
 from QueryInjectionSink query, QueryInjectionFlow::PathNode source, QueryInjectionFlow::PathNode sink
 where queryIsTaintedBy(query, source, sink)
 select query, source, sink, 
   "This query depends on a user-provided value", 
   source.getNode(), 
   "user-provided value"
 

I am able to see results as follows for the above query in vs code (Note: The path steps are visible):

How can i alter the above query that the path will also have the function body.
For example:


is referring to this line:

The project I am making requires me to give the entire path with the function body to an LLM for analysis. How can I alter the query to give me step by step path, and the code/function body of each step in path, so the llm has context of the code.

[aibaars]

If I understand correctly, you need the source code text to pass it to a LLM. CodeQL normally returns the location (file path + start position + end position) and not the actual text of the source code. While it is possible to write a predicate string toText(AstNode n), this is quite a bit of work.

Would the following option (for SARIF output only) be helpful in your case ?

      --sarif-add-snippets
                             [SARIF formats only] Include code snippets for
                               each location mentioned in the results, with two
                               lines of context before and after the reported
                               location.

Alternatively you can write a script that copies the relevant lines of code from the source files based on the location information returned by CodeQL. Note, that a CodeQL database contains a zip archive src.zip containing the analyzed code. This is quite similar to what the --sarif-add-snippets option does. So I recommend you use that, unless the 2 lines of context is not good enough for your use-case.