Selecting an object for on which a particular function is never called

[ivan-gavran]

Hi!
I am new to codeQL, pretty impressed and excited about using it :) But being a beginner, I am facing some problems.

I am attempting to select all objects (of a certain kind) on which a particular member function function validate is never called. The problem is that I do not know how to indicate that I am looking for an object (the same object, regardless of through how many functions it passed in between its initialization and a call ).

If I attempted to achieve the opposite (to find all those objects when that validation function is called), I do it by

   from DataFlow::Node obj, DataFlow::CallNode call
  where  
     obj.getType().hasQualifiedName("interesting", "kind")
    and
    call.getTarget().getName() = "validate" 
    and
    call.getReceiver() = msg  
  select  call

But this works because here the difference between an object and its particular usage in the dataflow does not matter.

What I attempted to do so far was

   from DataFlow::Node obj
   where
    obj.getType().hasQualifiedName("interesting", "kind")
    and
    not exists(
       DataFlow::CallNode call |
       call.getTarget.getName() = "validate"
       and
      call.getReceiver = obj         
   )
  select call

But the result of it are all the obj nodes for which validate was not called (even if it was called on the same object, but in a deeper function).

Let me know if I could provide any more information or details on what I am trying to accomplish.
(I am analyzing golang code)

[tausbn]

Thank you for your question!

From your description, it sounds like you should be able model this using a data-flow query. Basically, what I would propose is a setup where your sources are the objects you're interested in, and your sinks are calls to the validate method.

In that case, the sources that have flow to some sink will be exactly (or at least roughly) the complement of the set of objects you're interested in, and so if you look for sources that don't have flow to a sink, then these should be (again, roughly) what you're looking for.

You can find some documentation on how to set up data-flow queries here (unfortunately we don't appear to have any documentation for Go specifically, but the data-flow library is shared between many of the languages, and the Java version of the docs is hopefully sufficient 🙂).

[ivan-gavran]

Hi @tausbn, thanks for your reply!
I experimented with the idea, but I always come into the issue that it seems that queries describing non-existence of the flow never finish.
It looks reasonable to me that it would take them longer time (since they have to eliminate all possible flows). Are there some good practices to reduce the time? I was using a query of the form

from MyDataFlowConfiguration dataflow, DataFlow::Node source, DataFlow::Node sink
where not dataflow.hasFlow(source, sink)

I tried to speed up things by being as specific as possible in defining my source and sink, but that did not help much.
If you have any other ideas to try, I'd love to hear them.

[tausbn]

Your quoted query leaves out a crucial detail: what exactly are you selecting?

If it's both the source and the sink, then that's likely your problem. (Think about it: there are lots of pairs of nodes where there isn't flow from one to the other.)

[ivan-gavran]

Your quoted query leaves out a crucial detail: what exactly are you selecting?

If it's both the source and the sink, then that's likely your problem. (Think about it: there are lots of pairs of nodes where there isn't flow from one to the other.)

Thanks for the help, @tausbn ! This was indeed the problem with running too long (I selected both source and the sink). I am still trying to resolve some other confusions. Once I do so, I will post here the lessons learned and the final query that solves the problem.