• AST Sample for Javascript Source
• Correspondence between query and graph
  • Node Query
  • Edge Query
  • graph properties
• Simple direct use of graph API

AST Sample for Javascript Source

Create dot output from query and db, and then get a rendered graph in SVG.

  # 
  export PATH=$HOME/local/vmsync/codeql250:"$PATH"

  # 
  cd ~/w/codeql-javascript/src/
  codeql database create -j8 -v --language=javascript -s . callbacks.db

  # 
  cd ~/w/codeql-javascript/queries/
  codeql database analyze                                 \
         ~/w/codeql-javascript/src/callbacks.db/          \
         ~/w/codeql-javascript/queries/printast.ql        \
         -j8 -v --ram=16000                               \
         --format=dot                                     \
         --output=printast.dot

  # Results in 
  ls ./callbacks.db/results/codeql-custom-queries-javascript/printast.bqrs
  # and
  ls ./printast.dot/null.dot

  # 
  cd ~/w/codeql-javascript/src/
  dot -Tsvg < ./printast.dot/null.dot > ./printast.dot/null.svg
  open -a safari printast.dot/null.svg

Correspondence between query and graph

Node Query

query predicate nodes(PrintAstNode node, string key, string value)

query result

node	key	value
[DeclStmt] var arr = …	semmle.label	[DeclStmt] var arr = …

dot source in ./src/printast.dot/null.dot

  digraph {
    28[label="[DeclStmt] var arr = ..."; ];
  }

Edge Query

query predicate edges(PrintAstNode source, PrintAstNode target, string key, string value)

query result

source	target	key	value
[DeclStmt] var result = …	[VariableDeclarator] result … > 3; })	semmle.order	1
[DeclStmt] var result = …	[VariableDeclarator] result … > 3; })	semmle.label	1

dot source in ./src/printast.dot/null.dot

  digraph {
    29[label="[DeclStmt] var result = ..."; ];
    9[label="[VariableDeclarator] result ... > 3; })"; ];

    29 -> 9[label="1"; ];
  }

graph properties

  query predicate graphProperties(string key, string value) {
    key = "semmle.graphKind" and value = "tree"
  }

query result

key	value
semmle.graphKind	tree

dot source: none

Simple direct use of graph API

For illustration, the query ./queries/graphout.ql uses the @kind graph output for a trivial graph defined in the edges() predicate.

The ouput:

  # 
  export PATH=$HOME/local/vmsync/codeql250:"$PATH"

  # Create the db
  cd ~/w/codeql-javascript/src/
  rm -fR callbacks.db
  codeql database create -j8 -v --language=javascript -s . callbacks.db

  # Run the query to create dot file (and bqrs as side effect)
  cd ~/w/codeql-javascript/
  codeql database analyze                                 \
         ~/w/codeql-javascript/src/callbacks.db/          \
         ~/w/codeql-javascript/queries/graphout.ql        \
         -j8 -v --ram=16000                               \
         --format=dot --rerun                             \
         --output=printast.dot

  # Create SVG version of graph
  cd ~/w/codeql-javascript/
  dot -Tsvg < ./printast.dot/null.dot > ./printast.dot/null.svg
  open -a safari printast.dot/null.svg

  # List query result meta info
  BQRS=src/callbacks.db/results/exploratory-queries-javascript/graphout.bqrs
  codeql bqrs info --format=text -- $BQRS

  # Format results using bqrs decode. 
  codeql bqrs decode --output=printast.csv --result-set=edges \
         --format=csv --entities=all -- $BQRS
  codeql bqrs decode --output=printast.json --format=json --entities=all -- $BQRS

  # Result files
  ls -1l ./src/callbacks.db/results/exploratory-queries-javascript/graphout.bqrs  \
     ./printast.dot/null.dot                                                      \
     printast.csv  printast.json