ShiftLeftSecurity / ShiftLeftSecurity/codepropertygraph
CONTAINS edges incomplete
Nobody has claimed this yet.
- Dominant language
- Scala
- Stars
- 597
- Forks
- 84
- Avg merge
- 18h 29m
- Merged PRs (30d)
- 1
Description
I am very confused about CONTAINS edges. I did not find any documentation on them. However, I did find a file called EdgeTypes.java in this repo which contains this:
/** Shortcut over multiple AST edges */
public static final String CONTAINS = "CONTAINS";
Given that that's all I know about these edges, I'd assume that ... well ... CONTAINS edges are the transitive closure of AST edges. I'm assuming that the transitive closure is meant by "shortcut". However, this is not the case in the implementation.
Take the graph that is created for this code:
void calculateWinner() {
int hash = getHashOfBlock();
if(hash < 27) {
int receiver = 0;
send(15);
}
}
If we count the number of nodes connected to the method node via CONTAINS edges, we get 14:
joern> cpg.method.name("calculateWinner").outE(EdgeTypes.CONTAINS).inV.l.size
res124: Int = 14
Now lets tally up the nodes in the transitive closure of AST edges:
joern> cpg.method.name("calculateWinner").astChildren.l.size
res125: Int = 2
joern> cpg.method.name("calculateWinner").astChildren.astChildren.l.size
res126: Int = 3
joern> cpg.method.name("calculateWinner").astChildren.astChildren.astChildren.l.size
res127: Int = 4
joern>
cpg.method.name("calculateWinner").astChildren.astChildren.astChildren.astChildren.l.size
res128: Int = 5
joern>
cpg.method.name("calculateWinner").astChildren.astChildren.astChildren.astChildren.astChildren.l.size
res129: Int = 3
joern>
cpg.method.name("calculateWinner").astChildren.astChildren.astChildren.astChildren.astChildren.astChildren.l.size
res130: Int = 0
They sum up to 17, not 14.
This is not because of duplicate nodes (not that that would make sense in an abstract syntax tree) because after deduplication, we're still at 17:
joern>
Traversal(cpg.method.name("calculateWinner").astChildren.astChildren.astChildren.astChildren.astChildren.l.concat(cpg.method.name("calculateWinner").astChildren.astChildren.astChildren.astChildren.l).concat(cpg.method.name("calculateWinner").astChildren.astChildren.astChildren.l).concat(cpg.method.name("calculateWinner").astChildren.astChildren.l).concat(cpg.method.name("calculateWinner").astChildren.l)).dedup.size
res139: Int = 17
I have no idea how to best diff traversals in Joern, so I diffed them externally. In this particular case, the METHOD_RETURN node and the LOCAL nodes are missing. But I have no idea what nodes are missing in general.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with EdgeTypes.java and the CONTAINS definition, then reproduce the Joern queries in the issue against the shown calculateWinner example. Compare CONTAINS targets with the AST traversal results, including the reported METHOD_RETURN and LOCAL nodes. Done means the missing-node behavior and intended CONTAINS semantics are explained or corrected, with the relevant documentation updated.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, scala
- Domain
- devtools
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100