github / github/codeql

Java: Call Graph

Offen
#17,457 7 Kommentare 0 Reaktionen 1 zugewiesene Person Beansprucht von @mbg Auf GitHub ansehen
Java question
Vorherrschende Sprache
CodeQL
Sterne
10.1k
Forks
2.1k
Ø Merge
2 T. 15 Std.
Gemergte PRs (30 T.)
141

Beschreibung

Hello,

I am trying to use CodeQL to get the control flow of a program. More specifically I want to get the control flow into methods that I have marked as sensitive in a classes named `SensitiveMethodCall`. The goal is to parse the results to get the path. However, right now I am not generating a path. It is hard to tell if a path isn't being generated because of the query itself (I am used to using dataflow, so this is new to me) or if it has to do with this error

```
Error was: Expected result pattern(s) are not present for path-problem query: Expected at least two result patterns. These should include at least an 'edges' result set (see https://codeql.github.com/docs/writing-codeql-queries/creating-path-queries/). [INVALID_RESULT_PATTERNS]
```

All of the examples I see on this link have to deal with dataflow and not control flow, so I am having trouble figuring out what I am doing wrong to get the correct output. Here is my query.

```
import java
import semmle.code.java.ControlFlowGraph
import SensitiveInfo.SensitiveInfo

/**
* @name Control flow path from normal method call to sensitive method call
* @description This query identifies the full control flow path from a normal method call to a sensitive method call.
* It traces every control flow node between the normal and sensitive calls.
* @kind path-problem
* @id java/custom/control-flow-path
* @problem.severity warning
* @tags control-flow, data-flow, security, sensitive-data
* @precision medium
* @security-severity 5.0
* @cwe CWE-200, CWE-201, CWE-209
* @sub-severity high
*
* Get the control flow path from a normal method call to a sensitive method call.
* Returns the full sequence of control flow nodes.
*/
predicate controlFlowPath(MethodCall start, MethodCall end, ControlFlowNode node) {
exists(ControlFlowNode startNode, ControlFlowNode endNode |
startNode = start.getControlFlowNode() and
endNode = end.getControlFlowNode() and
startNode.getANormalSuccessor*() = node and
node.getANormalSuccessor*() = endNode
)
}

/**
* Get the full control flow path between normal and sensitive method calls.
*/
from MethodCall normalCall, SensitiveMethodCall sensitiveCall, ControlFlowNode node
where controlFlowPath(normalCall, sensitiveCall, node)
select normalCall.getControlFlowNode(), normalCall, sensitiveCall, "Full control flow path from normal method call to sensitive method call."
```

Any help would be greatly appreciated. Thank you.

Beitragsleitfaden

Beitragsleitfaden öffnen

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.