Propagate uncertainty information to Evaluators #886
Conversation
…f missing lazy evaluation
CodingDepot
added
the
nicetohave
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| def.signatures.any { sig -> | ||
| // We consider a result when both the signature and the flow are not invalid | ||
| // However, if at least one of them is OPEN we propagate this information to the caller | ||
| val signature = cpgSignature(*sig.parameters.toTypedArray()) |
Check warning
Code scanning / detekt
In most cases using a spread operator causes a full copy of the array to be created before calling a method. This may result in a performance penalty. Warning
| val results = mutableListOf<Result>() | ||
| val fqn = [email protected] { sig -> | ||
| [email protected]([email protected]) { | ||
| val signature = cpgSignature(*sig.parameters.toTypedArray()) |
Check warning
Code scanning / detekt
In most cases using a spread operator causes a full copy of the array to be created before calling a method. This may result in a performance penalty. Warning
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #886 +/- ##
============================================
+ Coverage 77.20% 77.59% +0.38%
- Complexity 250 256 +6
============================================
Files 59 60 +1
Lines 1882 1959 +77
Branches 265 281 +16
============================================
+ Hits 1453 1520 +67
- Misses 308 315 +7
- Partials 121 124 +3
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
...-backends/cpg/src/test/kotlin/de/fraunhofer/aisec/codyze/backends/cpg/coko/dsl/ResultTest.kt
Fixed
Show fixed
Hide fixed
...-backends/cpg/src/test/kotlin/de/fraunhofer/aisec/codyze/backends/cpg/coko/dsl/ResultTest.kt
Fixed
Show fixed
Hide fixed
...-backends/cpg/src/test/kotlin/de/fraunhofer/aisec/codyze/backends/cpg/coko/dsl/ResultTest.kt
Fixed
Show fixed
Hide fixed
|
This PR will create conflicts with #875 as it refactors the Never and Only Evaluator to be very similar, but does not directly combine them. |
In its current form, Evaluators rely on functions from
ImplementationDsl.Ktto find relevant code locations.However, these functions only respond with locations without considering false positives that may be detected internally.
With this PR a new return type is used that propagates the knowledge of
OPENanalysis results as a context to the code locations delivered to the Evaluators.Example:
Consider the
LengthKeyword from #876, The internally used sizeof() evaluator may return-1when the size can not be determined, but thecpgFlowsTofunction can only returntrueorfalse, which then now lead to false positives in either theNever- orOnly-Evaluator.With this new return type, the
Only-Evaluator can check for each location whether the analysis was incomplete and can therefore correctly produce anOPENSARIF Result.