[csharp] How to add a flow step with a separate class

[KseniiaSmirn0va]

Hello,
I'm facing a problem with csharp global data flow. It breaks at property accessors:

Order {
      get { return order_; }  // order_ is the last node which codeql tracks
      set {
        order_ = value;
      }
    }

Because of this problem, codeql build-in queries sometimes fail to build proper flow between a source and a sink.
To fix this problem, I could add default predicate isAdditionalFlowStep(Node node1, Node node2) into sql/ssrf/xss/... queries, as was suggested in #19794 but it's cumbersome in my case.

I'd prefer to create a single class in a customization .qll file which would add the missing flowstep throughout codeql. This mechanism is claimed to be already available https://codeql.github.com/docs/codeql-language-guides/analyzing-data-flow-in-csharp/#extending-library-data-flow, but it isn't))
There is no such predicate as callableFlow() in the source code of codeql latest versions.

Could you tell me how to create an additional flow step so that it is recognized by the global dataflow across codeql, please?
My codeql version is 2.21.0

[smowton]

Here are the latest docs for library modelling -- apologies for the out-of-date reference to the old way of doing things; I'll pass that onto the team:

https://codeql.github.com/docs/codeql-language-guides/customizing-library-models-for-csharp/

[KseniiaSmirn0va]

Thank you for the link)
I followed the instructions but my extension doesn’t work.
In my example below, model is tainted but taint is not propagated further towards sorting :

    [ApiController]
    public class DataController : ControllerBase
    {
        [HttpPost("/dangerous-smth")]
        public IActionResult DangerousSmth([FromBody] SomeModel model)
        {
            var sorting = model.Sort;     
            return Ok($"Received sort value: {sorting}");
        }
    }
}

The Sort property is defined this way:

namespace TaintFlowDemo.Controllers
{
    public class SomeModel
    {
        private string sort_;
        public string Sort
        {
            get { return sort_; }
            set { sort_ = value; }
        }
    }

Into the qlpacks/codeql/csharp-queries/1.1.0/.codeql/libraries/codeql/csharp-all/5.1.3/ext/Test.model.yml file, I added this:

extensions:
  - addsTo:
      pack: codeql/csharp-all
      extensible: summaryModel
    data: 
    - ["TaintFlowDemo.Controllers", "SomeModel", False, "get_Sort", "", "", "Argument[this]", "ReturnValue", "value", "manual"]
    - ["TaintFlowDemo.Controllers", "SomeModel", False, "set_Sort", "", "", "Argument[this]", "ReturnValue", "value", "manual"]

I also tried to move elements in the tuples around, but nothing works.
Or maybe this yml extension is not enough to fix the flow?
Can you tell me why this doesn't work, please?

[KseniiaSmirn0va]

@smowton Would you tell me if there is any debug mechanism for testing yml extensibles in codeql? Or are there tests for existing extensibles?
The documentation doesn't seem to cover all possible variants which can be passed into the tuple.