codeql vscode plugin show result in #select page but not alert page

[KiruaLawliet]

evnironment:
CodeQL command-line toolchain release 2.7.3.
vscode Version: 1.63.2
codeql plugin ver：v1.5.9
OS: Windows_NT x64 10.0.19042

database of project A：compiled from openjdk8u which is a huge java project（about 18,800+ java files）
database of project B：compiled from project A with additional two java projects（rome1.0 and rhino:js:1.7R2）

After successfully compiling , I checked database directory of project B and seen all source files of three projects included in src.zip file.
However，when I run query script individually on each database, query result of porject B is strange.

result of project A

this result is exactually what I want.

result of project B

All path nodes in the result showed above are from porject A. Thus, it should come out to share the same part of query result,
but as you can see below，no result in alert page,

just one result in #select page and not in path-problem view

don't know why, here are my simplify query script which got isAdditionalTaintStep removed：

/**@kind path-problem */

import java
import semmle.code.java.dataflow.TaintTracking

import DataFlow::PathGraph

class DeserialFlowConfig extends TaintTracking::Configuration
{
    DeserialFlowConfig()
    {
        this = "DeserialFlowConfig" 
    }

    override predicate isSource(DataFlow::Node node) {
        node.asParameter().getCallable().hasQualifiedName("java.util", "HashMap", "hash")
        and node.asParameter().getPosition() = 0
    }

    override predicate isSink(DataFlow::Node node) {
        exists(MethodAccess ma|
            ma.getMethod().hasName("hashCode")
            and ma.getEnclosingCallable().hasName("hashCode")
            and ma.getAnArgument() = node.asExpr()
            and ma.getMethod().getDeclaringType().hasQualifiedName("java.net", "URLStreamHandler")
        )

    }
}


from DeserialFlowConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
where config.hasFlowPath(source, sink)
select sink.getNode(), source, sink, "RESULT"

[smowton]

Possibly related: are the source or sink source locations outside the source root for project B? If so I know they can get dropped from path explanation generation.

[KiruaLawliet]

@smowton No, all path nodes of query result of project A are from jdk8u and also I'm sure that project B has all those source files included in src.zip file which locates in database directory.

In additionally, Run isSource predicate and isSink predicate individually by Quick Evaluation on Porject B can get the correct result：

[smowton]

Are you able to share your database B and a query that produces the desired result (does the simplified query you pasted above produce it?)

[KiruaLawliet]

@smowton Yes, the simplified query also produces that strange result but not normal path-problem view on alert page.
I shared database B by Git Large File Storage (LFS). Plz check if you can access this repository and fetch the file openjdk8u-mixed-database.zip https://github.com/KiruaLawliet/TransferStation/
also plz use this query：

/**@kind path-problem */

import java
import semmle.code.java.dataflow.TaintTracking

import DataFlow::PathGraph

class DeserialFlowConfig extends TaintTracking::Configuration
{
    DeserialFlowConfig()
    {
        this = "DeserialFlowConfig" 
    }

    override predicate isSource(DataFlow::Node node) {
        node.asParameter().getCallable().hasQualifiedName("java.util", "HashMap", "hash")
        and node.asParameter().getPosition() = 0
    }

    override predicate isSink(DataFlow::Node node) {
        exists(MethodAccess ma|
            ma.getMethod().hasName("hashCode")
            and ma.getEnclosingCallable().hasName("hash")
            and ma.getQualifier() = node.asExpr()
            and ma.getEnclosingCallable().getDeclaringType().hasQualifiedName("java.util", "HashMap")
        )

    }
}


from DeserialFlowConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
where config.hasFlowPath(source, sink)
select sink.getNode(), source, sink, "RESULT"

and it's query result on my pc.

build commands of database B：

codeql database create java-database --language=java --overwrite --command='build.sh'

# build.sh
cd ../openjdk8u/
make all
cd ../rhino-1.7.10/
mvn clean compile
cd ../rome1.0/
mvn clean compile

[smowton]

The cause is indeed down to source locations: it looks like you've run the build command from /home/ming/software/build_jdk/build_common, but the selected element is key which is in /home/ming/software/build_jdk/openjdk-jdk8u-master. The result is dropped from path explanations because it isn't within build_common.

This could be overcome by phrasing your build process such that it commences in a path that includes all the code you wish to consider in scope. However we can also just quickly hack it: edit java-database/codeql-database.yml and java-database/.dbinfo, replacing /home/ming/software/build_jdk/build_common with /home/ming/software/build_jdk. Then all your code will be considered "in scope" and you'll get a path explanation as expected.

[KiruaLawliet]

@smowton Many thanks !! It really works!!