[英]CodeQL find dependency usages
How do I get a list of method calls which the implementation is from a dependency如何获取实现来自依赖项的方法调用列表
For example, dependency group id: "com.google.protobuf"例如,依赖组 id:“com.google.protobuf”
Method calls are modelled by the CodeQL class MethodAccess
.方法调用由 CodeQL 类
MethodAccess
建模。 If you want to include constructor calls as well, then you can instead use the CodeQL superclass Call
.如果您还想包含构造函数调用,那么您可以改用 CodeQL 超类
Call
。 Java method reference expressions (eg MyClass::doSomething
) are modelled separately as MemberRefExpr
, so you need to handle them separately in case you want to consider them too. Java 方法引用表达式(例如
MyClass::doSomething
)被单独建模为MemberRefExpr
,因此您需要单独处理它们以防您也想考虑它们。
The easiest way to match the method calls would be to check the package name.匹配方法调用的最简单方法是检查包名称。 For example the Protobuf classes are in the package
com.google.protobuf
or in subpackages.例如,Protobuf 类位于
com.google.protobuf
包或子包中。 The following query finds calls to them:以下查询查找对它们的调用:
import java
from MethodAccess call
where
call.getMethod()
.getCompilationUnit()
.getPackage()
// Check if name starts with "com.google.protobuf"
.getName().matches("com.google.protobuf%")
select call
Using the Maven group and artifact ID is a bit more complicated and possibly also not as reliable, and it probably won't work if the build is not using Maven.使用 Maven 组和工件 ID 有点复杂,也可能不那么可靠,如果构建不使用 Maven,它可能无法工作。 Maven artifacts are modelled by the CodeQL class
MavenRepoJar
; Maven 工件由 CodeQL 类
MavenRepoJar
; this class is in a separate module and requires an import
:这个类在一个单独的模块中,需要一个
import
:
import java
import semmle.code.xml.MavenPom
from MethodAccess call, MavenRepoJar repoJar
where
call.getMethod()
// Get the source declaration to prevent any issues with generic methods
.getSourceDeclaration()
.getCompilationUnit()
// Match the Maven artifact which contains the class
// Uses a transitive closure (`+`) to apply the predicate one or more times
// see https://codeql.github.com/docs/ql-language-reference/recursion/#transitive-closures
.getParentContainer+() = repoJar
and repoJar.getGroupId() = "com.google.protobuf"
select call
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.