Is there any way to build call graph path? · github/codeql · Discussion #7531

ox1234
Jan 7, 2022

The codeql document only shows how to generate path query through DataFlow problem.Now i just want to generate call graph path from source to sink and don't want to do any data flow track.Is there a way to do so?

Answered by intrigus-lgtm

Jan 10, 2022

Have a look at this discussion: #5353 (comment)
Also look at the additional comments from @Marcono1234.

I think this is what you want :)

(Quote from the above discussion also copied and pasted below)

Yes, this is possible!

The site you linked to mentions it here and here although it's easy too miss or easy to underestimate its potential.

When you use taint or data-flow the edges predicate is defined by the PathGraph module. But you can also define your own edges query-predicate.

A self-defined query-predicate is used in @agustingianni's blog post. It's relatively easy to port the code to "Java CodeQL".

Here's my code that only creates a path for methods itself and not for the (control fl...

View full answer

Replies: 2 comments 4 replies

smowton
Jan 10, 2022
Maintainer

So you've got a DataFlow::PathNode source, DataFlow::PathNode sink but you want something different to the usual dataflow path? Could you given an example of what you do want?

1 reply

@ox1234

ox1234 Jan 10, 2022
Author

Now i have one source method and one sink method. I want to know the call graph path from source to sink such as: source() -> func1() -> func2() -> sink(). I don't want to do any data flow tracking. All i just want to get is the call method path from source to sink. So is there any way to do that?

intrigus-lgtm
Jan 10, 2022

Have a look at this discussion: #5353 (comment)
Also look at the additional comments from @Marcono1234.

I think this is what you want :)

(Quote from the above discussion also copied and pasted below)

Yes, this is possible!

The site you linked to mentions it here and here although it's easy too miss or easy to underestimate its potential.

When you use taint or data-flow the edges predicate is defined by the PathGraph module. But you can also define your own edges query-predicate.

A self-defined query-predicate is used in @agustingianni's blog post. It's relatively easy to port the code to "Java CodeQL".

Here's my code that only creates a path for methods itself and not for the (control flow) basic-blocks. Link to query
/**
 * @kind path-problem
 */
import java
class StartMethod extends Method {
 StartMethod() { getName() = "validateExpression" }
}
class TargetMethod extends Method {
 TargetMethod() { getName() = "findValue" }
}
query predicate edges(Method a, Method b) { a.calls(b) }
from TargetMethod end, StartMethod entryPoint
where edges+(entryPoint, end)
select end, entryPoint, end, "Found a path from start to target."