github / github/codeql

Java: Call Graph

Abierto
#17,457 7 comentarios 0 reacciones 1 asignado Reclamado por @mbg Ver en GitHub
Java question
Lenguaje dominante
CodeQL
Estrellas
10.1k
Forks
2.1k
Merge medio
2 d 15 h
PR fusionados (30 d)
141

Descripción

Hello,

I am trying to use CodeQL to get the control flow of a program. More specifically I want to get the control flow into methods that I have marked as sensitive in a classes named `SensitiveMethodCall`. The goal is to parse the results to get the path. However, right now I am not generating a path. It is hard to tell if a path isn't being generated because of the query itself (I am used to using dataflow, so this is new to me) or if it has to do with this error

```
Error was: Expected result pattern(s) are not present for path-problem query: Expected at least two result patterns. These should include at least an 'edges' result set (see https://codeql.github.com/docs/writing-codeql-queries/creating-path-queries/). [INVALID_RESULT_PATTERNS]
```

All of the examples I see on this link have to deal with dataflow and not control flow, so I am having trouble figuring out what I am doing wrong to get the correct output. Here is my query.

```
import java
import semmle.code.java.ControlFlowGraph
import SensitiveInfo.SensitiveInfo

/**
* @name Control flow path from normal method call to sensitive method call
* @description This query identifies the full control flow path from a normal method call to a sensitive method call.
* It traces every control flow node between the normal and sensitive calls.
* @kind path-problem
* @id java/custom/control-flow-path
* @problem.severity warning
* @tags control-flow, data-flow, security, sensitive-data
* @precision medium
* @security-severity 5.0
* @cwe CWE-200, CWE-201, CWE-209
* @sub-severity high
*
* Get the control flow path from a normal method call to a sensitive method call.
* Returns the full sequence of control flow nodes.
*/
predicate controlFlowPath(MethodCall start, MethodCall end, ControlFlowNode node) {
exists(ControlFlowNode startNode, ControlFlowNode endNode |
startNode = start.getControlFlowNode() and
endNode = end.getControlFlowNode() and
startNode.getANormalSuccessor*() = node and
node.getANormalSuccessor*() = endNode
)
}

/**
* Get the full control flow path between normal and sensitive method calls.
*/
from MethodCall normalCall, SensitiveMethodCall sensitiveCall, ControlFlowNode node
where controlFlowPath(normalCall, sensitiveCall, node)
select normalCall.getControlFlowNode(), normalCall, sensitiveCall, "Full control flow path from normal method call to sensitive method call."
```

Any help would be greatly appreciated. Thank you.

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.