Question

A security engineer is reviewing a CodeQL alert flagged as 'SQL query built from user-controlled sources'. The alert view shows a series of connected steps from an HTTP request parameter through several variable assignments and finally into a database execution call. A developer argues the alert is a false positive because the input is validated. Which aspect of the CodeQL alert should the engineer examine to determine whether the reported vulnerability path is actually exploitable?

Accepted Answer

The dataflow path trace, verifying whether any step between the source and sink applies effective sanitization that CodeQL did not recognize as a barrier

Answer

The CVSS base score attached to the alert, which determines whether the flow reaches the sink

Answer

The Dependabot advisory linked to the alert, since it confirms the transitive dependency introducing the flaw

Answer

The commit timeline in the alert's history, which shows whether the source and sink were introduced in the same pull request