How to ignore empty evaluations in string concat?

[0x73746F70626F74686572696E676D65]

Suppose you have:

select data, predicate1(data) + predicate2(data)

both predicates return strings, though if one doesn't (predicate2 for instance), the entire row won't be output. codeql won't tell you this in output either as far as im aware of.

how can i avoid this?

[0x73746F70626F74686572696E676D65]

just for clarification: how can i output the row despite a missing column?

[0x73746F70626F74686572696E676D65]

oh and one last thing: how can i be aware of codeql omitting results like this even when im not actively checking for empty string scenarios with custom predicates?

[owen-mc]

Three ways spring to mind:

• If predicate2 is in your control you could make it output an empty string for any input that it doesn't hold for (within reason)
• You could make a wrapper for predicate2, like

string predicate2Wrapper(string data) {
  if predicate2(data)
  then result = predicate2(data)
  else result = ""
  }

• You could modify your query to account for the possibility that predicate2 doesn't hold:

  from ..., string p2
  where
    ...
    and
      if predicate2(data)
      then p2 = predicate2(data)
      else p2 = ""
select predicate1(data) + p2

The way to think about it is that predicate2 doesn't hold for some values of data. In general a predicate can have multiple values for any given set of inputs. It doesn't quite match the intuition you get from thinking of functions in imperative languages.

[zairulshah80]

3