[RESOLVED] Got result with predicate but not with the whole query

[CaledoniaProject]

I'm trying to list interesting sinks with the following query:

import java
import DataFlow::PathGraph
import semmle.code.java.dataflow.DataFlow

predicate isCmdi(DataFlow::Node node) {
    exists(Call call, Callable callable |
        node.asExpr() = call.getAnArgument() and
        call.getCallee() = callable and
        (
          callable.hasName("exec") and
          callable.getDeclaringType().hasQualifiedName("java.lang", "Runtime")
          or
          callable.hasName("ProcessBuilder") and
          callable.getDeclaringType().hasQualifiedName("java.lang", "ProcessBuilder")
        )
      )
}

from DataFlow::Node node, MethodAccess ma, Method me
where
isCmdi(node)
and node.asExpr() = ma
and ma.getMethod() = me
select
ma.getFile() as file,
ma.getEnclosingCallable() as method,
ma

The quick evaluation on isCmdi works, but the select query does not yield anything, what was wrong?

[intrigus-lgtm]

Did you try quick-evaluating parts of the where clause?

[CaledoniaProject]

There's no prompt for parts other than isCmdi, how can I do that?

[intrigus-lgtm]

Have a look at https://codeql.github.com/docs/codeql-for-visual-studio-code/analyzing-your-projects/#running-a-specific-part-of-a-query-or-library
TLDR: Select the part of that you want to quick-evaluate, right-click and select CodeQL: Quick Evaluation

[intrigus-lgtm]

Without knowing what results you are expecting it is hard to answer your question.

So what I'm writing here might not exactly explain why you are getting no results.

1. isCmdi(DataFlow::Node node) contains this part node.asExpr() = call.getAnArgument().
   However, your where clause contains this part:

   isCmdi(node)
   and node.asExpr() = ma

   So what you are effectively saying is that node must be an expression that is used as an argument to a call AND that node must be a MethodAccess.
   While these cases could exist (e.g. java.lang.Runtime.getRuntime().exec(methodThatReturnsAString()) [methodThatReturnsAString() would be the node here]) I don't think this is what you are looking for.
   I'd think what you probably wanted is node.asExpr() = call in your isCmdi predicate.

2. Assuming that you did the change suggested above, there is another problem.
   Every MethodAccess is a Call, but not every Call is a MethodAccess (Same with Method and Callable)!
   isCmdi operates on Callss, but in your where clause you require that these Calls are actually MethodAccesses.
   This will break if for example node refers to new ProcesssBuilder(), because this is a ConstructorCall. This constructor call will make isCmdi hold because isCmdi expects something that is of the type Call (and ConstructorCall is a Call), but it will break in your where clause: this clause expects that node is a MethodAccess (and a ConstructorCall is NOT a `MethodAccess).

Did this help?

[CaledoniaProject]

That was indeed quite helpful ... I've fixed it as your suggestion

import java

predicate isCmdi(Callable callable) {
  callable.hasName("exec") and
  callable.getDeclaringType().hasQualifiedName("java.lang", "Runtime")
  or
  callable.hasName("ProcessBuilder") and
  callable.getDeclaringType().hasQualifiedName("java.lang", "ProcessBuilder")
}

from Callable callable, Call call
where
  isCmdi(callable) and
  call.getCallee() = callable
select call.getFile() as file, call.getEnclosingCallable() as method, call