Show Paths in CSV output file for Query

[akanksha1131]

This is the query:

/**
 * @name Query built from user-controlled sources
 * @description Building a SQL or Java Persistence query from user-controlled sources
 * is vulnerable to insertion of malicious code by the user.
 * @kind path-problem
 * @problem.severity error
 * @security-severity 8.8
 * @precision high
 * @id java/sql-injection
 * @tags security
 * external/cwe/cwe-089
 * external/cwe/cwe-564
 */

 import java
 import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.security.SqlInjectionQuery
 import QueryInjectionFlow::PathGraph
 
 // Define the query flow from user-controlled sources to sinks
 from QueryInjectionSink query, QueryInjectionFlow::PathNode source, QueryInjectionFlow::PathNode sink
 where queryIsTaintedBy(query, source, sink)
 select query, source, sink, 
   "This query depends on a user-provided value", 
   source.getNode(), 
   "user-provided value"
 

I am able to see results as follows for the above query in vs code (Note: The path steps are visible):

When I run this query from a batch file: codeql database analyze --rerun "%DB_PATH%" "%QUERY_PATH_1%" --format=csv --output="%CSV_REPORT_FILE_1%"
and store results in csv, the csv file looks like this:

1 row from the csv file:

"Query built from user-controlled sources","Building a SQL or Java Persistence query from user-controlled sources is vulnerable to insertion of malicious code by the user.","error","This query depends on a user-provided value","/app/src/main/java/com/veracode/verademo/commands/IgnoreCommand.java","40","49","40","56"

I want the paths as shown in the result in vs code, to be seen in the csv file.
Can anyone tell me how to go about this?

[aibaars]

That is currently not possible. As far as I know the only format that includes the flows paths is SARIF. You could write a script that extracts the paths and alert information from SARIF and writes it in CSV format. SARIF is json-based, so it is fairly easy to parse using standard json libraries and tools.

Alternatively, you could use codeql bqrs decode --format=csv --result-set=edges to get all the edges of the flow graph in CSV format (use --result-set=nodes to get the nodes). Note that this gives you all the graph data. You would need to "walk" the graph to create a collection of sample paths.