[pipedream] Add control flow / data dependency operators to ast-grep

[HerringtonDarkholme]

inspired by https://docs.joern.io/code-property-graph/, or more specifically, https://docs.joern.io/cpgql/data-flow-steps/

pattern: $A.is_some()
controls:
  pattern: print!($$$)

which should matches

if option.is_some() {
  print!("123");
}

[HerringtonDarkholme]

State of Art:

• https://arxiv.org/pdf/2208.07461.pdf

  • parser: tree-sitter
  • cfg/data flow: built for Python

• https://nickgregory.me/post/2022/07/02/go-code-as-a-graph/

  • https://github.com/kallsyms/go-graph
  • parser: go
  • cfg/dataflow: golangx/tool
  • golang team's tooling is crazy...

• https://docs.rs/tree-sitter-graph/0.10.4/tree_sitter_graph/reference/

  • parser: tree-sitter
  • cfg/data flow: N/A. It only supports graph construction.

• joern

  • parser: graal based. e.g. graalJS or custom parser generator
  • e.g. Python https://github.com/joernio/joern/blob/7e6615548fa06e94c3307da2a85709295d9f660f/joern-cli/frontends/pysrc2cpg/pythonGrammar.jj#L10
  • cfg: based on a generic-ast. https://github.com/joernio/joern/tree/7e6615548fa06e94c3307da2a85709295d9f660f/joern-cli/frontends/x2cpg/src/main/scala/io/joern/x2cpg

---

Not related but worth looking

• eslint: https://github.com/eslint/eslint/blob/main/lib/linter/code-path-analysis/code-path-analyzer.js
• oxc: https://github.com/Boshen/oxc/blob/main/crates/oxc_semantic2/src/reference.rs
• ruff: https://github.com/astral-sh/ruff/tree/main/crates/ruff_python_semantic/src