mirror of
https://github.com/github/codeql.git
synced 2025-12-17 01:03:14 +01:00
Python: CG trace: Don't abuse example dir
This commit is contained in:
@@ -1,8 +1,9 @@
|
|||||||
# Example DB
|
# Example DB
|
||||||
cg-trace-example-db/
|
cg-trace-example-db/
|
||||||
|
|
||||||
# Examples traces should be ignored in general
|
# Tests artifacts
|
||||||
example-traces/
|
tests/python-traces/
|
||||||
|
tests/cg-trace-test-db
|
||||||
|
|
||||||
# Artifact from building `pip install -e .`
|
# Artifact from building `pip install -e .`
|
||||||
src/cg_trace.egg-info/
|
src/cg_trace.egg-info/
|
||||||
|
|||||||
@@ -4,17 +4,15 @@ also known as _call graph tracing_.
|
|||||||
|
|
||||||
Execute a python program and for each call being made, record the call and callee. This allows us to compare call graph resolution from static analysis with actual data -- that is, can we statically determine the target of each actual call correctly.
|
Execute a python program and for each call being made, record the call and callee. This allows us to compare call graph resolution from static analysis with actual data -- that is, can we statically determine the target of each actual call correctly.
|
||||||
|
|
||||||
This is still in the early stages, and currently only supports a very minimal working example (to show that this approach might work).
|
|
||||||
|
|
||||||
The next hurdle is being able to handle multiple calls on the same line, such as
|
|
||||||
|
|
||||||
- `foo(); bar()`
|
|
||||||
- `foo(bar())`
|
|
||||||
- `foo().bar()`
|
|
||||||
|
|
||||||
## How do I give it a spin?
|
## How do I give it a spin?
|
||||||
|
|
||||||
After following setup instructions below, run the `recreate-db.sh` script to create the database `cg-trace-example-db`. Then run the queries inside the `ql/` directory.
|
After following setup instructions below, you should be able to reproduce the example trace by running
|
||||||
|
|
||||||
|
```
|
||||||
|
cg-trace --xml example/simple.xml example/simple.py
|
||||||
|
```
|
||||||
|
|
||||||
|
You can also run traces for all tests and build a database by running `tests/create-test-db.sh`. Then run the queries inside the `ql/` directory.
|
||||||
|
|
||||||
|
|
||||||
## Setup
|
## Setup
|
||||||
|
|||||||
@@ -1,10 +1,10 @@
|
|||||||
<root>
|
<root>
|
||||||
<info>
|
<info>
|
||||||
<cg_trace_version>0.0.2</cg_trace_version>
|
<cg_trace_version>0.0.2</cg_trace_version>
|
||||||
<args>--xml example-traces/simple.xml example/simple.py</args>
|
<args>--xml example/simple.xml example/simple.py</args>
|
||||||
<exit_status>completed</exit_status>
|
<exit_status>completed</exit_status>
|
||||||
<elapsed>0.00 seconds</elapsed>
|
<elapsed>0.00 seconds</elapsed>
|
||||||
<utctimestamp>2020-07-20T12:02:56</utctimestamp>
|
<utctimestamp>2020-07-22T12:14:02</utctimestamp>
|
||||||
</info>
|
</info>
|
||||||
<recorded_calls>
|
<recorded_calls>
|
||||||
<recorded_call>
|
<recorded_call>
|
||||||
@@ -1,31 +1,32 @@
|
|||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
|
|
||||||
set -e
|
set -Eeuo pipefail # see https://vaneyckt.io/posts/safer_bash_scripts_with_set_euxo_pipefail/
|
||||||
set -x
|
|
||||||
|
|
||||||
if ! pip show cg_trace; then
|
SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
|
||||||
|
|
||||||
|
if ! pip show cg_trace &>/dev/null; then
|
||||||
echo "You need to follow setup instructions in README"
|
echo "You need to follow setup instructions in README"
|
||||||
exit 1
|
exit 1
|
||||||
fi
|
fi
|
||||||
|
|
||||||
DB="cg-trace-example-db"
|
DB="$SCRIPTDIR/cg-trace-test-db"
|
||||||
SRC="example/"
|
SRC="$SCRIPTDIR/python-src/"
|
||||||
XMLDIR="example-traces"
|
XMLDIR="$SCRIPTDIR/python-traces/"
|
||||||
PYTHON_EXTRACTOR=$(codeql resolve extractor --language=python)
|
PYTHON_EXTRACTOR=$(codeql resolve extractor --language=python)
|
||||||
|
|
||||||
|
|
||||||
cg-trace --xml "$XMLDIR"/simple.xml example/simple.py
|
|
||||||
cg-trace --xml "$XMLDIR"/builtins.xml example/builtins.py
|
|
||||||
cg-trace --xml "$XMLDIR"/multiple-on-one-line.xml example/multiple-on-one-line.py
|
|
||||||
cg-trace --xml "$XMLDIR"/class-simple.xml example/class-simple.py
|
|
||||||
|
|
||||||
|
|
||||||
rm -rf "$DB"
|
rm -rf "$DB"
|
||||||
|
rm -rf "$XMLDIR"
|
||||||
|
|
||||||
|
mkdir -p "$XMLDIR"
|
||||||
|
|
||||||
|
for f in $(ls $SRC); do
|
||||||
|
echo "Tracing $f"
|
||||||
|
cg-trace --xml "$XMLDIR/${f%.py}.xml" "$SRC/$f"
|
||||||
|
done
|
||||||
|
|
||||||
codeql database init --source-root="$SRC" --language=python "$DB"
|
codeql database init --source-root="$SRC" --language=python "$DB"
|
||||||
codeql database trace-command --working-dir="$SRC" "$DB" "$PYTHON_EXTRACTOR/tools/autobuild.sh"
|
codeql database trace-command --working-dir="$SRC" "$DB" "$PYTHON_EXTRACTOR/tools/autobuild.sh"
|
||||||
codeql database index-files --language xml --include-extension .xml --working-dir="$XMLDIR" "$DB"
|
codeql database index-files --language xml --include-extension .xml --working-dir="$XMLDIR" "$DB"
|
||||||
codeql database finalize "$DB"
|
codeql database finalize "$DB"
|
||||||
|
|
||||||
set +x
|
|
||||||
echo "Created database '$DB'"
|
echo "Created database '$DB'"
|
||||||
@@ -0,0 +1,10 @@
|
|||||||
|
def foo():
|
||||||
|
print('foo')
|
||||||
|
|
||||||
|
def bar():
|
||||||
|
print('bar')
|
||||||
|
|
||||||
|
foo()
|
||||||
|
bar()
|
||||||
|
|
||||||
|
foo(); bar()
|
||||||
Reference in New Issue
Block a user