Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[dataflowengineoss] globalFromLit only when it's a standalone assignment #4559

Merged
merged 2 commits into from
May 15, 2024

Conversation

xavierpinho
Copy link
Contributor

@xavierpinho xavierpinho commented May 15, 2024

In #4549, we noticed an extra flow in the following sample:

x = foo(20) # with source being the LITERAL
sink(x)

This was traced to globalFromLiteral, in which the statement x = foo(20) would consider x, adding it to the starting points of the query.

In this patch we only trigger if the literal is the RHS of the assignment.

I may be missing some relevant context here that I didn't gather from the failing unit-tests. Before going through the trouble of fixing them all, is this patch coherent?

EDIT: Resolves #4549

@DavidBakerEffendi
Copy link
Collaborator

This patch looks coherent, I see the inAssignment was unintentional in its recursive upward behaviour. Looking at the tests now.

Copy link
Collaborator

@DavidBakerEffendi DavidBakerEffendi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree with this way of expressing the query, and the failing tests lose 1 flow but they are never 0, so I don't think this is an issue and rather a side effect of overtainting in the original query

@@ -16,14 +16,12 @@ class SingleAssignmentTests extends RubyCode2CpgFixture(withPostProcessing = tru
val source = cpg.literal.l
val sink = cpg.method.name("puts").callIn.argument.l
val flows = sink.reachableByFlows(source).map(flowToResultPairs).distinct.sortBy(_.length).l
flows.size shouldBe 6
val List(flow1, flow2, flow3, flow4, flow5, flow6) = flows
val List(flow1, flow2, flow3, flow4, flow5) = flows
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The previously called flow3 is removed, but I reckon the new flow4 covers it better.

@xavierpinho
Copy link
Contributor Author

Was actually expecting more tests to fail, as I don't have the required setup locally to test all frontends. Turns out there was only 7 of them and all on ruby. Took the opportunity to make those flow tests more explicit, instead of just looking at their sizes. Please kindly see if the changes committed after your approval still make sense, @DavidBakerEffendi

Copy link
Collaborator

@DavidBakerEffendi DavidBakerEffendi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@xavierpinho xavierpinho merged commit 4f78879 into master May 15, 2024
5 checks passed
@xavierpinho xavierpinho deleted the xavierp/global-from-lit branch May 15, 2024 14:12
karan-batavia pushed a commit to Privado-Inc/joern that referenced this pull request Jun 18, 2024
…ent (joernio#4559)

* [dataflowengineoss] globalFromLit trigger only when it's a standalone assignment

* fix unit-tests
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[python] incoherent flow when using a literal vs identifier argument
2 participants