Can not slice about joern HOT 7 CLOSED

@HJX-zhanS Yes I noticed it's run on the arguments instead of the call itself. I'm looking at fixing this too in the patch for the above

from joern.

Upon investigating, it seems that there are .code properties with null values inside. Confirming now the locations of these and if it's the frontend or something with ODB

from joern.

At the point of the exception, I've obtained the culprit with

          c.argument.filter(_.code == null).foreach { n =>
            println(s"${n.id}:${n.method.fullName}:${n.lineNumber.getOrElse(-1)}")
          }

Looks like this is the open method declaration:

Node ID: 151
Parent Method Full Name: foo.js::program
Line Number: 20

However, when jumping into Joern, the code property is non-null

joern> cpg.graph.node(151)
val res1: overflowdb.Node = MethodRef(
  id = 151L,
  argumentIndex = 2,
  argumentName = None,
  code = "open",
  columnNumber = Some(value = 0),
  dynamicTypeHintFullName = ArraySeq(),
  lineNumber = Some(value = 20),
  methodFullName = "foo.js::program:open",
  order = 2,
  possibleTypes = ArraySeq(),
  typeFullName = "foo.js::program:open"
)

Bizzare. Let me try with more memory, as this may be a ODB issue.

from joern.

Another culprit

joern> cpg.graph.node(154)
val res1: overflowdb.Node = MethodRef(
  id = 154L,
  argumentIndex = 2,
  argumentName = None,
  code = "escape",
  columnNumber = Some(value = 0),
  dynamicTypeHintFullName = ArraySeq(),
  lineNumber = Some(value = 61),
  methodFullName = "foo.js::program:escape",
  order = 2,
  possibleTypes = ArraySeq(),
  typeFullName = "foo.js::program:escape"
)

from joern.

Ok, seems like it comes down to a concurrency issue when reading code from MethodRef nodes when they're instances of Expression nodes. @HJX-zhanS a workaround for now would be adding -p 1 to set parallelism to 1.

from joern.

Ok, seems like it comes down to a concurrency issue when reading code from MethodRef nodes when they're instances of Expression nodes. @HJX-zhanS a workaround for now would be adding -p 1 to set parallelism to 1.

Thank you, @DavidBakerEffendi . When I use -p 1, the above error no longer appear. However, I think there may be some issues. Because when I set --sink-filter "exec\([\S\s]+?\)" to try to get the slice of exec(opener + ' "' + escape(target) + '"', callback), the result is empty. When I set --sink-filter "exec", I can get a slice. However, the slice is only related to var exec = require('child_process').exec.

from joern.

@HJX-zhanS Fix is up: #4463 I also recommend lowering the --slice-depth since it seems to take a while to finish on 20 hops

from joern.