github / github/codeql

Java: Call Graph

Đang mở
#17,457 7 bình luận 0 reaction 1 người được giao Được @mbg nhận Xem trên GitHub
Java question
Ngôn ngữ chính
CodeQL
Star
10.1k
Fork
2.1k
Merge trung bình
2 ngày 15 giờ
Pull request đã merge (30 ngày)
141

Mô tả

Hello,

I am trying to use CodeQL to get the control flow of a program. More specifically I want to get the control flow into methods that I have marked as sensitive in a classes named `SensitiveMethodCall`. The goal is to parse the results to get the path. However, right now I am not generating a path. It is hard to tell if a path isn't being generated because of the query itself (I am used to using dataflow, so this is new to me) or if it has to do with this error

```
Error was: Expected result pattern(s) are not present for path-problem query: Expected at least two result patterns. These should include at least an 'edges' result set (see https://codeql.github.com/docs/writing-codeql-queries/creating-path-queries/). [INVALID_RESULT_PATTERNS]
```

All of the examples I see on this link have to deal with dataflow and not control flow, so I am having trouble figuring out what I am doing wrong to get the correct output. Here is my query.

```
import java
import semmle.code.java.ControlFlowGraph
import SensitiveInfo.SensitiveInfo

/**
* @name Control flow path from normal method call to sensitive method call
* @description This query identifies the full control flow path from a normal method call to a sensitive method call.
* It traces every control flow node between the normal and sensitive calls.
* @kind path-problem
* @id java/custom/control-flow-path
* @problem.severity warning
* @tags control-flow, data-flow, security, sensitive-data
* @precision medium
* @security-severity 5.0
* @cwe CWE-200, CWE-201, CWE-209
* @sub-severity high
*
* Get the control flow path from a normal method call to a sensitive method call.
* Returns the full sequence of control flow nodes.
*/
predicate controlFlowPath(MethodCall start, MethodCall end, ControlFlowNode node) {
exists(ControlFlowNode startNode, ControlFlowNode endNode |
startNode = start.getControlFlowNode() and
endNode = end.getControlFlowNode() and
startNode.getANormalSuccessor*() = node and
node.getANormalSuccessor*() = endNode
)
}

/**
* Get the full control flow path between normal and sensitive method calls.
*/
from MethodCall normalCall, SensitiveMethodCall sensitiveCall, ControlFlowNode node
where controlFlowPath(normalCall, sensitiveCall, node)
select normalCall.getControlFlowNode(), normalCall, sensitiveCall, "Full control flow path from normal method call to sensitive method call."
```

Any help would be greatly appreciated. Thank you.

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.