You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/src/content/docs/blog/codeql-oss-alternative.mdx
+17-18Lines changed: 17 additions & 18 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,56 +13,55 @@ import PostHogLayout from '../../../layouts/PostHogLayout.astro';
13
13
14
14
## What is Code PathFinder?
15
15
16
-
Code PathFinder is a code analysis tool that helps you find exact code pattern and paths in your codebase. While there are several ways to
17
-
grep source code, having source code broken down into individual entities, building graph & edges which helps in building
16
+
Code PathFinder is a code analysis tool that helps you find exact code patterns and paths in your codebase. While there are several ways to
17
+
grep source code, having source code broken down into individual entities, building graphs & edges which help in establishing
18
18
relationships between entities, imitates the way a human reads code.
19
19
20
+
### How do security engineers interact with codebases today?
20
21
21
-
### How do security engineers interact with codebase today?
22
-
23
-
If you generically think about how engineers interact with codebase, it is something like this:
22
+
If you think about how engineers generally interact with a codebase, it typically follows this process:
24
23
25
24
1. Start by searching for a symbol
26
25
2. Resolve the symbol to an entity such as a class or function
27
26
3. Find the entity's definition
28
27
4. Find the entity's references across the codebase and often across multiple repositories
29
28
5. Determine the flow of the code
30
29
- 5A. Have a source in mind such as user inputs, database, or a file or even network operations
31
-
- 5B. Have a sink in mind such as above symbols definition
30
+
- 5B. Have a sink in mind such as the above symbol's definition
32
31
- 5C. Determine the flow of the code including method jumps, method calls, and method returns
33
-
- 5D. Identify if there is any blocker in between such as conditions, loops, etc
32
+
- 5D. Identify if there are any blockers in between such as conditions, loops, etc.
34
33
6. Identify the variables that are modified and the variables that are used within the flow
35
34
36
-
Representing it technically as a graph, can be more useful in finding the flow of the code. Moreover, the relationship as edges
35
+
Representing this process technically as a graph can be more useful in finding the flow of the code. Moreover, the relationships as edges
37
36
between entities can be used as conditions to focus on the paths that are relevant to the source and sink.
38
37
39
-
For example, Find code pattern where `Socket` class is instantiated and `send` method is called on it and get me all enclosing methods.
38
+
For example, to find a code pattern where the `Socket` class is instantiated and the `send` method is called on it, and to get all enclosing methods, you could use:
39
+
40
40
41
-
```sql
42
41
SELECT MethodInvocation AS mi, MethodDeclaration AS md, ClassInstanceExpr AS ci
SELECT MethodDeclaration AS md, MethodInvocation AS mi
48
-
```
49
-
The above query will return all the enclosing methods of the `send` method in the `Socket` class and invoked call to `send` method.
50
-
The above entities such as `MethodInvocation`, `MethodDeclaration`, `ClassInstanceExpr` are called as entities and they are represented as nodes in the graph.
51
-
The edges between the nodes are represented as relationships between the entities.
47
+
48
+
The above query will return all the enclosing methods of the `send` method in the `Socket` class and invoked calls to the`send` method.
49
+
The entities such as `MethodInvocation`, `MethodDeclaration`, and `ClassInstanceExpr` are called entities and are represented as nodes in the graph.
50
+
The edges between the nodes represent relationships between the entities.
52
51
53
52
### How does Code PathFinder work?
54
53
55
54
Code Pathfinder uses tree-sitter to parse the source code and build a graph of the code. The graph is then used to find answers to queries.
56
55
Similar to SQL, Code Pathfinder uses a query language to filter and apply conditions to the graph nodes logically. Sometimes, it generates
57
-
cartesian product of the graph nodes to retrieve all possible combinations and apply the conditions in order to find the paths in code.
58
-
While there are lot of APIs yet to be implemented, lacks support for classes and inheritance, Code Pathfinder is currently equipped with
56
+
a cartesian product of the graph nodes to retrieve all possible combinations and applies the conditions in order to find the paths in code.
57
+
While there are still many APIs yet to be implemented and it lacks support for classes and inheritance, Code Pathfinder is currently equipped with
59
58
the following features:
60
59
61
60
- Predicates
62
61
- Complex conditions
63
62
- Aliases
64
63
64
+

65
+
65
66
If you are interested in contributing to Code Pathfinder, please check out the [Code Pathfinder](https://github.com/shivasurya/code-pathfinder) repository.
66
67
Give it a try and file an issue if you find any bugs or have any suggestions.
0 commit comments