ShiftLeftSecurity / ShiftLeftSecurity/codepropertygraph

CONTAINS edges incomplete

Open
#1,082 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Scala
Stars
597
Forks
84
Avg merge
18h 29m
Merged PRs (30d)
1

Description

I am very confused about CONTAINS edges. I did not find any documentation on them. However, I did find a file called EdgeTypes.java in this repo which contains this:

 /** Shortcut over multiple AST edges */
 public static final String CONTAINS = "CONTAINS";

Given that that's all I know about these edges, I'd assume that ... well ... CONTAINS edges are the transitive closure of AST edges. I'm assuming that the transitive closure is meant by "shortcut". However, this is not the case in the implementation.

Take the graph that is created for this code:

void calculateWinner() {
  int hash = getHashOfBlock();
  if(hash < 27) {
	int receiver = 0;
	send(15);
  }
}

If we count the number of nodes connected to the method node via CONTAINS edges, we get 14:

joern> cpg.method.name("calculateWinner").outE(EdgeTypes.CONTAINS).inV.l.size 
res124: Int = 14

Now lets tally up the nodes in the transitive closure of AST edges:

joern> cpg.method.name("calculateWinner").astChildren.l.size 
res125: Int = 2

joern> cpg.method.name("calculateWinner").astChildren.astChildren.l.size 
res126: Int = 3

joern> cpg.method.name("calculateWinner").astChildren.astChildren.astChildren.l.size 
res127: Int = 4

joern> 
cpg.method.name("calculateWinner").astChildren.astChildren.astChildren.astChildren.l.size 
res128: Int = 5

joern> 
cpg.method.name("calculateWinner").astChildren.astChildren.astChildren.astChildren.astChildren.l.size 
res129: Int = 3

joern> 
cpg.method.name("calculateWinner").astChildren.astChildren.astChildren.astChildren.astChildren.astChildren.l.size 
res130: Int = 0

They sum up to 17, not 14.

This is not because of duplicate nodes (not that that would make sense in an abstract syntax tree) because after deduplication, we're still at 17:

joern> 
Traversal(cpg.method.name("calculateWinner").astChildren.astChildren.astChildren.astChildren.astChildren.l.concat(cpg.method.name("calculateWinner").astChildren.astChildren.astChildren.astChildren.l).concat(cpg.method.name("calculateWinner").astChildren.astChildren.astChildren.l).concat(cpg.method.name("calculateWinner").astChildren.astChildren.l).concat(cpg.method.name("calculateWinner").astChildren.l)).dedup.size 
res139: Int = 17

I have no idea how to best diff traversals in Joern, so I diffed them externally. In this particular case, the METHOD_RETURN node and the LOCAL nodes are missing. But I have no idea what nodes are missing in general.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with EdgeTypes.java and the CONTAINS definition, then reproduce the Joern queries in the issue against the shown calculateWinner example. Compare CONTAINS targets with the AST traversal results, including the reported METHOD_RETURN and LOCAL nodes. Done means the missing-node behavior and intended CONTAINS semantics are explained or corrected, with the relevant documentation updated.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, scala
Domain
devtools
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.