For a flow config using the new API (ConfigSig and so on) that does what I was expecting. I was a bit surprised that it didn’t do anything for old-style configuration classes. I guess it’s not important, as everything will move over to the new API in time.

The C/C++ XXE query gets a bunch of additional steps due to its

  predicate isAdditionalFlowStep(
    DataFlow::Node node1, FlowState state1, DataFlow::Node node2, FlowState state2
  ) {
    // create additional flow steps for `XxeFlowStateTransformer`s
    state2 = node2.asIndirectExpr().(XxeFlowStateTransformer).transform(state1) and
    DataFlow::simpleLocalFlowStep(node1, node2)
  }

Is that desirable? Or should we add a predicate neverSkip(Node node) { none() } in the XXE config?

Edit: There are also a bunch of other queries with additional steps where we might also want to consider whether or not to use the new default that this PR introduces.

The C/C++ XXE query gets a bunch of additional steps due to its

  predicate isAdditionalFlowStep(
    DataFlow::Node node1, FlowState state1, DataFlow::Node node2, FlowState state2
  ) {
    // create additional flow steps for `XxeFlowStateTransformer`s
    state2 = node2.asIndirectExpr().(XxeFlowStateTransformer).transform(state1) and
    DataFlow::simpleLocalFlowStep(node1, node2)
  }

Is that desirable? Or should we add a predicate neverSkip(Node node) { none() } in the XXE config?

Edit: There are also a bunch of other queries with additional steps where we might also want to consider whether or not to use the new default that this PR introduces.

We resolved this on Slack and decided to add a neverSkip override (see 8a71408).