Changing ProcessNameToHash query to path-problem. Any additional feedback will be welcomed

Author: raulgarciamsft

csharp/ql/src/experimental/Security Features/backdoor/PotentialTimeBomb.ql

@@ -122,16 +122,15 @@ private class FlowsFromTimeComparisonCallableToSelectionStatementCondition exten
  * which is then used for a DateTime comparison timeComparisonCall and the result flows to a Selection statement which is likely a TimeBomb trigger
  */
 predicate isPotentialTimeBomb(
-  DataFlow::PathNode pathSource, DataFlow::PathNode pathSink,
-  Call getLastWriteTimeMethodCall, Call timeArithmeticCall, Call timeComparisonCall,
-  SelectionStmt selStatement
+  DataFlow::PathNode pathSource, DataFlow::PathNode pathSink, Call getLastWriteTimeMethodCall,
+  Call timeArithmeticCall, Call timeComparisonCall, SelectionStmt selStatement
 ) {
   exists(
     FlowsFromGetLastWriteTimeConfigToTimeSpanArithmeticCallable config1, Node sink,
     DateTimeStruct dateTime, FlowsFromTimeSpanArithmeticToTimeComparisonCallable config2,
     Node sink2, FlowsFromTimeComparisonCallableToSelectionStatementCondition config3, Node sink3
   |
-    pathSource.getNode() = exprNode(getLastWriteTimeMethodCall) and 
+    pathSource.getNode() = exprNode(getLastWriteTimeMethodCall) and
     config1.hasFlow(exprNode(getLastWriteTimeMethodCall), sink) and
     timeArithmeticCall = dateTime.getATimeSpanArtithmeticCallable().getACall() and
     timeArithmeticCall.getAChild*() = sink.asExpr() and
@@ -144,13 +143,13 @@ predicate isPotentialTimeBomb(
   )
 }
 
-from DataFlow::PathNode source, DataFlow::PathNode sink,
-  Call getLastWriteTimeMethodCall, Call timeArithmeticCall, Call timeComparisonCall,
-  SelectionStmt selStatement
+from
+  DataFlow::PathNode source, DataFlow::PathNode sink, Call getLastWriteTimeMethodCall,
+  Call timeArithmeticCall, Call timeComparisonCall, SelectionStmt selStatement
 where
-  isPotentialTimeBomb(source, sink, getLastWriteTimeMethodCall, timeArithmeticCall, timeComparisonCall,
-    selStatement)
-select selStatement, source, sink, 
+  isPotentialTimeBomb(source, sink, getLastWriteTimeMethodCall, timeArithmeticCall,
+    timeComparisonCall, selStatement)
+select selStatement, source, sink,
   "Possible TimeBomb logic triggered by $@ that takes into account $@ from the $@ as part of the potential trigger.",
   timeComparisonCall, timeComparisonCall.toString(), timeArithmeticCall, "an offset",
   getLastWriteTimeMethodCall, "last modification time of a file"

csharp/ql/src/experimental/Security Features/backdoor/ProcessNameToHashTaintFlow.ql

@@ -2,7 +2,7 @@
  * @name ProcessName to hash function flow
  * @description Flow from a function retrieving process name to a hash function
  *              NOTE: This query is an example of a query that may be useful for detecting potential backdoors, and Solorigate is just one such example that uses this mechanism.
- * @kind problem
+ * @kind path-problem
  * @tags security
  *       solorigate
  * @problem.severity warning
@@ -11,7 +11,7 @@
  */
 
 import csharp
-import DataFlow
+import DataFlow::PathGraph
 import experimental.code.csharp.Cryptography.NonCryptographicHashes
 
 class DataFlowFromMethodToHash extends TaintTracking::Configuration {
@@ -49,8 +49,8 @@ predicate isSuspiciousPropertyName(PropertyRead pr) {
   pr.getTarget().getQualifiedName() = "System.Diagnostics.Process.ProcessName"
 }
 
-from Node src, Node sink, DataFlowFromMethodToHash conf
-where conf.hasFlow(src, sink)
-select src,
+from DataFlow::PathNode src, DataFlow::PathNode sink, DataFlowFromMethodToHash conf
+where conf.hasFlow(src.getNode(), sink.getNode())
+select src.getNode(), src, sink,
   "The hash is calculated on the process name $@, may be related to a backdoor. Please review the code for possible malicious intent.",
-  sink, "here"
+  sink.getNode(), "here"