Open
Description
Hello,
I am trying to use CodeQL to get the control flow of a program. More specifically I want to get the control flow into methods that I have marked as sensitive in a classes named SensitiveMethodCall. The goal is to parse the results to get the path. However, right now I am not generating a path. It is hard to tell if a path isn't being generated because of the query itself (I am used to using dataflow, so this is new to me) or if it has to do with this error
Error was: Expected result pattern(s) are not present for path-problem query: Expected at least two result patterns. These should include at least an 'edges' result set (see https://codeql.github.com/docs/writing-codeql-queries/creating-path-queries/). [INVALID_RESULT_PATTERNS]
All of the examples I see on this link have to deal with dataflow and not control flow, so I am having trouble figuring out what I am doing wrong to get the correct output. Here is my query.
import java
import semmle.code.java.ControlFlowGraph
import SensitiveInfo.SensitiveInfo
/**
* @name Control flow path from normal method call to sensitive method call
* @description This query identifies the full control flow path from a normal method call to a sensitive method call.
* It traces every control flow node between the normal and sensitive calls.
* @kind path-problem
* @id java/custom/control-flow-path
* @problem.severity warning
* @tags control-flow, data-flow, security, sensitive-data
* @precision medium
* @security-severity 5.0
* @cwe CWE-200, CWE-201, CWE-209
* @sub-severity high
*
* Get the control flow path from a normal method call to a sensitive method call.
* Returns the full sequence of control flow nodes.
*/
predicate controlFlowPath(MethodCall start, MethodCall end, ControlFlowNode node) {
exists(ControlFlowNode startNode, ControlFlowNode endNode |
startNode = start.getControlFlowNode() and
endNode = end.getControlFlowNode() and
startNode.getANormalSuccessor*() = node and
node.getANormalSuccessor*() = endNode
)
}
/**
* Get the full control flow path between normal and sensitive method calls.
*/
from MethodCall normalCall, SensitiveMethodCall sensitiveCall, ControlFlowNode node
where controlFlowPath(normalCall, sensitiveCall, node)
select normalCall.getControlFlowNode(), normalCall, sensitiveCall, "Full control flow path from normal method call to sensitive method call."
Any help would be greatly appreciated. Thank you.