joern
joern copied to clipboard
JavaSrc2Cpg: Infer type by Namespace and arg/parameter size
This PR has the following changes
- Currently in
TypeInferencePass
, acall
is linked to amethod
If -Namespace
matches and -Number of arguments in call
andNumber of parameter in method
matches and -Type of arguments in call
andType of parameter in method
matches - If after applying these we are not able to link a
call to a method
, we try to link If -Namespace
matches and -Number of argument in call
andNumber of parameter in method
matches
This type inference is meant to be more sound than type recovery, so an additional constraint I'd prefer you add is that, if we're ignoring argument types, that no other method has the same number of args, otherwise we may be calling either method.
Yes, this is already handled.
The pass will only proceed and infer if we find only a single method matching the criteria
The changes in this PR seem to achieve the goal they intend to, but this was actually the way it was done in the TypeInferencePass
in the past and we added the type check because of issues with inherited, non-overridden methods not being considered. This contributed to the general problem of unresolved type issues being hidden.
@fabsx00 and @DavidBakerEffendi I think it would be good to have another discussion about type inference in javasrc2cpg. We've run into a couple of situations where legitimate bugs were hidden by various type inference mechanisms (which would've been discovered easily if the signatures contained <unresolved...
Ideally, the CPG created by javasrc2cpg would only contain type information we know from the JavaParserSymbolSolver
, along with type info from imports, with everything else happening in optional passes after AST creation (which this PR would fit).
This is a discussion to have separate from this PR though.
@khemrajrathore, based on @johannescoetzee's message, I think it would be faster to override this in Privado's side if this is an urgent feature.
@johannescoetzee Another option we discussed was if we added a flag that allows for this behaviour to be enabled, and is off by default. Would this be a good compromise?
@DavidBakerEffendi @khemrajrathore An off-by-default flag would work, although in my opinion this would be a temporary measure until we reach a decision on how to handle inference in general. As such, I suggest adding it as a hidden flag with a description saying this is temporary to avoid issues if we want to remove it later