Difference between DataFlow::Node and DataFlow::PathNode?

[atwilso]

In some documentation and tutorials I see path queries expressed as follows:

from Config config, DataFlow::PathNode source, DataFlow::PathNode sink
where config.hasFlowPath(source, sink)
select stuff

Elsewhere I see DataFlow::Node and config.hasPath() instead.

What's the difference? When should I use one over the other?

[smowton]

Guessing you're thinking of config.hasFlow?

hasFlowPath specifies PathNodes, which are used to produce the path explanation that accompanies alerts from @kind path-problem queries. Therefore it's useful specifically in the select clause of such a query.

hasFlow on the other hand specifies plain old Nodes, which are useful for other purposes -- maybe navigating to related dataflow nodes, such as from a call node to its arguments. If you're not selecting these nodes in a path-problem query, this saves you a .getNode() to access a PathNode's underlying Node.

[atwilso]

OK, let me make sure I understand --

PathNode is most useful for generating the path explanations that show up in the results for @kind path-problem queries. Node sounds like it's more useful when you actually want to do further analysis starting from the source or sink nodes. You can get to Node from PathNode; it's just a question of preference which one you select.

Does that sound right?

[smowton]

Pretty much -- you might also select a plain old Node if this was a @kind problem (i.e. non-path) query, since you don't need the path-explanation feature that is PathNode's main purpose. PathNode.getNode() will indeed get you the same Nodes you would have got from hasFlow, so using hasFlow is just an abbreviation.

[atwilso]

Got it. Thank you!

[intrigus-lgtm]

Note that if you have a PathNode pn, pn.getNode() will always return a Node.
But if you have an arbitrary Node node, there must not necessarily exist a PathNode that wraps node.
I.e. exists(PathNode pn | pn.getNode() = node) might not hold.

This is because PathNodes are specific to a Configuration. Only nodes that occur on a path from source to sink on this configuration can be PathNodes. So if your Node is not part of such a configuration, it has no corresponding PathNode.