Closed
Description
In fact, no need to adding intermediate calls step by step, codeql could use edges
predicate to draw call graph.
Below is my query based on your library.
query predicate edges(ControlFlowNode node1, ControlFlowNode node2) {
(node1.(MethodAccess).getMethod() = node2 and node2 instanceof RecursiveCallToDangerousMethod) or
(node2.(MethodAccess).getEnclosingCallable() = node1 and node1 instanceof RecursiveCallToDangerousMethod)or
(node1.(RecursiveCallToDangerousMethod).polyCalls(node2) and node2 instanceof RecursiveCallToDangerousMethod)
}
predicate hasCalls(RecursiveCallToDangerousMethod c0, RecursiveCallToDangerousMethod c1) {
c0.polyCalls(c1) or exists(RecursiveCallToDangerousMethod unsafe | c0.polyCalls(unsafe) and hasCalls(unsafe, c1))
}
from RecursiveCallToDangerousMethod c0, RecursiveCallToDangerousMethod c1, DangerousExpression de
where de.getEnclosingCallable() = c1 and
c0 instanceof Source and
hasCalls(c0, c1)
select c0, c0, c1, "recursive call to dangerous expression $@", de, de.toString()
Metadata
Metadata
Assignees
Labels
No labels