github / github/codeql

Whether the codeql result contains function call chain information.

Open
#18,796 3 comments 0 reactions 0 assignees View on GitHub
question
Dominant language
CodeQL
Stars
10.1k
Forks
2.1k
Avg merge
2d 15h
Merged PRs (30d)
141

Description

test code:
```
[root@*** test_case]# cat f_open_test_0.cpp
#include
#include
using namespace std;

const char * do_getenv1(const char * name) {
return getenv(name);
}
[root@*** test_case]# cat f_open_test_a.cpp
#include "f_open_test_0.cpp"
extern const char * do_getenv1(const char *);

const char * do_getenv() {
return do_getenv1("FILENAME1");
}

[root@*** test_case]# cat f_open_test_b.cpp
#include "f_open_test_a.cpp"
extern const char * do_getenv();

int main(){
const char * filename1 = do_getenv();
FILE * file1 = fopen(filename1, "r");
}
```
running rule:
fopen-flow-from-getenv.ql

but results file don't contain the function call chain, results like this:
```
"results": [{
"ruleId": "cpp/huawei/member-variable-to-resource-leak",
"ruleIndex": 0,
"rule": {
"id": "cpp/huawei/member-variable-to-resource-leak",
"index": 0
},
"message": {
"text": "This 'fopen' uses data from [call to 'getenv'](1)."
},
"locations": [{
"physicalLocation": {
"artifactLocation": {
"uri": "f_open_test_b.cpp",
"uriBaseId": "%SRCROOT%",
"index": 0
},
"region": {
"startLine": 6,
"startColumn": 26,
"endColumn": 35
},
"contextRegion": {
"startLine": 4,
"endLine": 8,
"snippet": {
"text": "int main(){\n const char * filename1 = do_getenv();\n FILE * file1 = fopen(filename1, \"r\");\n}\n\n"
}
}
}
}],
"partialFingerprints": {
"primaryLocationLineHash": "6f35e497d744c2f6:1",
"primaryLocationStartColumnFingerprint": "21"
},
"relatedLocations": [{
"id": 1,
"physicalLocation": {
"artifactLocation": {
"uri": "f_open_test_0.cpp",
"uriBaseId": "%SRCROOT%",
"index": 1
},
"region": {
"startLine": 6,
"startColumn": 12,
"endColumn": 18
},
"contextRegion": {
"startLine": 4,
"endLine": 7,
"snippet": {
"text": "\nconst char * do_getenv1(const char * name) {\n return getenv(name);\n}\n"
}
}
},
"message": {
"text": "call to 'getenv'"
}
}]
}],
"columnKind": "utf16CodeUnits",
"properties": {
"semmle.formatSpecifier": "sarif-latest"
}
}]
```

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the example with f_open_test_0.cpp, f_open_test_a.cpp, and f_open_test_b.cpp using fopen-flow-from-getenv.ql, then inspect the generated SARIF result and its relatedLocations entry. Determine whether the expected function call chain is represented in the result and document the behavior or missing change.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
devtools, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.