feat(model): an access-control finding names a line, and what the PDG does not give us

contributor-scan 2.7. Taint and config verdicts have always carried a
`path:line:function` location; dominance never did, so every
access-control finding reached a contributor as
`api_views/users.py:?:update_password` -- the right file by accident,
because the region was asked about that file, and no line at all. The
query now reports the operation's file and the verdict carries the
location, with an engine that cannot report one getting no location rather
than an invented one.

Two questions answered by measurement while doing it.

**Does this factor in the PDG?** The data half, centrally: `reachableByFlows`
is the entire taint arbiter and `joern-parse` applies the `dataflowOss`
overlay. The control half, not at all -- and it is not available to us.
Measured: 0 of 13,184 calls in the libpng CPG and 0 of 1,152 in the vampi
CPG have a controlling control structure, so `controlledBy` returns nothing
in either. Everything guard-shaped therefore runs on CFG dominance or on
syntactic conditions, which is exactly why 2.12's first attempt failed:
libpng's bound reaches its sink through an `error` flag, and that is a
control-dependence fact and nothing else. Recorded as 2.14, including the
possibility that it cannot be enabled -- which would bound what guard
reasoning this engine can ever do.

**Would checking out a vulnerable libpng find a known CVE?** No, and not
because of the version. Every one of the twelve files using
`strcpy`/`strcat`/`sprintf`/`gets` is under `contrib/`; the library itself
uses none of them. libpng overflows through array and pointer arithmetic
and `memcpy` sizing, and five of its buffer-overflow fixes touch no
modelled sink at all. Pinning an older commit would produce the same
silence for the same reason.

That leaves two routes of very different size, recorded as 2.15: pin a C
project whose CVE genuinely runs through a string function, which is cheap
and would give the memory family its first true positive; or model how C
actually overflows, which is size arithmetic rather than sink matching and
should not be started by accident.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

tests/test_model_dominance.py

@@ -114,3 +114,53 @@ def test_the_spec_drives_the_query_parameters() -> None:
     assert seen["operations"] == ("filter_by", "query.get", "session.delete")
     assert seen["dischargers"] == ("login_required", "current_user", "check_permission")
     assert seen["function"] == "f"
+
+
+def test_an_access_control_finding_names_a_line_a_contributor_can_open() -> None:
+    """contributor-scan 2.7. Taint and config verdicts always carried a location; dominance did not, so every
+    access-control finding arrived as `api_views/users.py:?:update_password` -- the right file by accident,
+    because the region was asked about that file, and no line at all."""
+    from pathlib import Path
+
+    from openultrasast.cpg.backend import CpgResult
+    from openultrasast.model.dominance import verdict
+    from openultrasast.model.specs import dominance_specs
+
+    rows = [
+        {
+            "operation": "User.query.filter_by(username = username)",
+            "opLine": "187",
+            "opMethod": "update_password",
+            "opFile": "api_views/users.py",
+            "dominatingGuards": [],
+        },
+        {
+            "operation": "User.query.filter_by(username = resp['sub'])",
+            "opLine": "33",
+            "opMethod": "me",
+            "opFile": "api_views/users.py",
+            "dominatingGuards": ["resp['sub']"],
+        },
+    ]
+    spec = dominance_specs(language="python")["access_control"]
+
+    answer = verdict(CpgResult(cpg_path=Path("c.bin"), run=lambda q, p: rows), spec, function="update_password")
+
+    assert answer is not None
+    assert answer.location == "api_views/users.py:187:update_password"
+
+
+def test_a_verdict_without_a_reported_file_carries_no_location() -> None:
+    """An engine that could not report the file must not have a location invented for it."""
+    from pathlib import Path
+
+    from openultrasast.cpg.backend import CpgResult
+    from openultrasast.model.dominance import verdict
+    from openultrasast.model.specs import dominance_specs
+
+    rows = [{"operation": "q.filter_by(x)", "opLine": "-1", "opMethod": "handler", "opFile": "", "dominatingGuards": []}]
+    spec = dominance_specs(language="python")["access_control"]
+
+    answer = verdict(CpgResult(cpg_path=Path("c.bin"), run=lambda q, p: rows), spec, function="handler")
+
+    assert answer is not None and answer.location == ""