reaches
Check if a source value flows into a sink via value or points-to edges. Get a labeled witness path for confirmation or a clear negative when no path exists.
Instructions
Read-only. Does src reach sink through value flow? Returns the labeled witness path when it does, or an honest negative when it doesn't (a negative under truncation is not proof of no path). Use it to confirm one specific source->sink pair; use flow/sources_of to explore a whole cone. NOTE: it follows VALUE_FLOWS_TO/POINTS_TO, a different edge set than taint, so adjudicate taint witnesses from their own path.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| src | Yes | source value name or graph node id | |
| sink | Yes | sink value name or graph node id | |
| format | No | text (compact, default) | json (structured result page) |