[Question]How does Joern know if a function can call to another function?

[duhang1996]

[duhang1996]

why the result is empty?

[ycclnn]

why the result is empty?

because the sink is the method, not the call. Try to swap them

[duhang1996]

the result is as the same

[duhang1996]

the result is as the same

@yzn12345 Do you know why?

[duhang1996]

@prabhu could you help?

[prabhu]

@duhang1996, I don't see any code snippet but in general the granularity of reachability detection is at the method parameter or call argument level.

So you can do

def source=cpg.method.parameter
def sink=cpg.call.argument

sink.reachableByFlows(source).p

[scanleale]

reachableByFlows only for data flow analysis, in your case, you should use caller or callee to find your call path.