What does the plus symbol do here?

[CaledoniaProject]

I found a query online and it does a edges+ query:

from TargetMethod end, MyMainMethod entryPoint
where edges+(entryPoint, end)
select end, entryPoint, end, "Found a path from start to target."

What does the + symbol do here?

[MathiasVP]

Hi @CaledoniaProject,

The + symbol means "transitive closure". That is, the query you've posted finds all end, entryPoint pairs where there exists a sequence of nodes n1, ..., nk such that edges(entryPoint, n1), edges(n1, n2), ..., edges(nk, end).

You can read about transitive closures here: https://codeql.github.com/docs/ql-language-reference/recursion/#transitive-closures

[CaledoniaProject]

How can I do this in C++? I'm just trying to find calls from main() to system():

/**
 * @name test
 * @kind path-problem
 */

import cpp
import DataFlow::PathGraph
import semmle.code.cpp.dataflow.DataFlow
import semmle.code.cpp.dataflow.TaintTracking
import semmle.code.cpp.valuenumbering.GlobalValueNumbering
import semmle.code.cpp.controlflow.Guards

class MainFunction extends Function {
  MainFunction() {
      getName() = "main"
  }
}

class SystemFunction extends Function {
  SystemFunction() { 
      getName() = "system"
  }
}

from MainFunction start, SystemFunction end
where edges+(start, end)
select start, end, "Found a path from start to target."

[MathiasVP]

The following query should do that:

/**
 * @name test
 * @kind path-problem
 */

import cpp

class MainFunction extends Function {
  MainFunction() { getName() = "main" }
}

class SystemFunction extends Function {
  SystemFunction() { getName() = "system" }
}

query predicate edges(Function caller, Function callee) { caller.calls(callee) }

from MainFunction start, SystemFunction end
where edges+(start, end)
select end, start, end, "Found a path from start to target."

Note that this will ignore calls through function pointers and inheritance. If you want to include some of those cases you could make the edges predicate a bit smarter and use our ResolveCall library:

/**
 * @name test
 * @kind path-problem
 */

import cpp
import semmle.code.cpp.ir.dataflow.ResolveCall

class MainFunction extends Function {
  MainFunction() { getName() = "main" }
}

class SystemFunction extends Function {
  SystemFunction() { getName() = "system" }
}

query predicate edges(Function caller, Function callee) {
  callee = resolveCall(any(Call call | call.getEnclosingFunction() = caller))
}

from MainFunction start, SystemFunction end
where edges+(start, end)
select end, start, end, "Found a path from start to target."

However, if you're going down that route, you should take a look at our dataflow library which is well suited for these kinds of things.

[CaledoniaProject]

It does not work with this cpp file: test.txt

I'm just trying to find all calls to system() initiated from main(), the query should find 3 call paths, but it didn't find any.

[CaledoniaProject]

I've created a wrapper predicate and it's still not working:

/**
 * @name test
 * @kind path-problem
 */

// https://github.com/github/codeql/discussions/8927#discussioncomment-2661524

import cpp
import semmle.code.cpp.ir.dataflow.ResolveCall

class MainFunction extends Function {
  MainFunction() { getName() = "main" }
}

class SystemFunction extends Function {
  SystemFunction() { getName() = "system" }
}

predicate edges1(Function caller, Function callee) {
  callee = resolveCall(any(Call call | call.getEnclosingFunction() = caller))
}
predicate edges2(Function caller, Function callee) { caller.calls(callee) }

query predicate edges(Function caller, Function callee) {
  edges1(caller, callee) or edges2(caller, callee)
}

from MainFunction start, SystemFunction end
where edges+(start, end)
select end, start, end, "Found a path from start to target."

[CaledoniaProject]

Hi @MathiasVP, can you help?

[MathiasVP]

Ah, yes. I think see what's going on now. Most likely, the issue isn't with your QL code, but instead how the path is rendered.

If you look in the database folder you'll find a codeql-database.yml file containing a sourceLocationPrefix field. CodeQL will only show the path when the endpoints are located in a file that's nested within that directory. In this case, the system function is most likely located in your standard library's directory.

There are a couple of ways you can go about fixing this:

• As a quick fix, you can modify the sourceLocationPrefix value to something like "/" to not exclude any paths based on location. That should cause your paths to show up, but it might mean that the elements interact weirdly with the CLI or with VSCode (since you're editing a field that we don't expect you to edit).
• A more proper fix is to specify another working directory using codeql database create ... --working-dir=my-directory where my-directory is a directory that's both a root of your standard library's included files and your own project files.

[CaledoniaProject]

system() is defined in libc and I don't have its source code ...

[MathiasVP]

You don't need the source code for the system function, but you need to specify a --working-dir that is a prefix of the directory where the system function is declared. For instance, my cstdlibheader is located at/Applications/Xcode-12.5.0.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/include/c++/v1/cstdlib, and if I specify codeql database create ... --working-dir=/Applicationsany path that ends with an element in a file that is within the/Applications` folder will be shown.

Alternatively, if your program is sufficiently simple to compile (which the example program you linked is) you can cd into /Applications and run codeql database create my-test-db --language=cpp --command="clang++ absolute-path-to-test-file.cpp". That should give you a database with a sourceLocationPrefix that will show paths even though they end inside a of libc folder.