how to detect chained method calls in Java

[ap00rv]

hi, i would like to detect the following patterns :

1 - this.record.toString() : toString() is a custom method defined in class of record object

2 - this.record.value() : value() is a custom method defined in super class of the class of record object , which returns an object

3- this.record.value().toString() : here, toString() is the default method in java (from java.lang.Object class) , called on the object returned by value()

I am able to detect pattern 1 and 2 by something like:

class RecordClass extends Class {
  ConnectRecordClass() {
    this.hasQualifiedName("org.apache.<blah>", "<blah>")
  }
}

this.getMethod().getDeclaringType().getASourceSupertype*() instanceof RecordClass and
this.getMethod().getName() = "toString" 

For pattern number 3, how can I get reference to value() to implement a check on it ?

[aeisenberg]

Presumably, you need to handle data flow, so something like this is also important:

Object x = this.record.value();
x.toString();

Is it any value that was at some point retrieved from the RecordClass::value() method, or is there a specific type that you can test for? It sounds like the answer is that it must have come from the RecordClass.

However, you are saying something that makes me think there is no robust way to do this using static analysis. You are saying that you only want to match on invocations of the toString() method defined on Object. It sounds like objects returned by value() that have overridden versions of toString() are OK.

The problem here is that this is not easily known statically since we would need to track creations of RecordClass and which objects they are populated with, and then track calls to value() and then on to toString(). Fundamentally, this is not knowable until runtime.

What would be easier to detect and may be good enough for your purpose is creations of RecordClass where the value object does not override toString().

[ap00rv]

Thanks so much for the prompt response ! :)

Is it any value that was at some point retrieved from the RecordClass::value() method, or is there a specific type that you can test for? It sounds like the answer is that it must have come from the RecordClass.

It can be anything, i don't care about it. The return type of value() method is Object.

However, you are saying something that makes me think there is no robust way to do this using static analysis. You are saying that you only want to match on invocations of the toString() method defined on Object. It sounds like objects returned by value() that have overridden versions of toString() are OK.

I want to match direct invocations of the overriden ToString() method or invocation of ToString() (from java.lang.Object) on return value of value() method. Objects returned by value() method can technically have overridden version of toString() but in my codebase , they most probably won't, so I don't want to write anything for that case.

The problem here is that this is not easily known statically since we would need to track creations of RecordClass and which objects they are populated with, and then track calls to value() and then on to toString(). Fundamentally, this is not knowable until runtime.

thanks for the clarification . I did not know this.

What would be easier to detect and may be good enough for your purpose is creations of RecordClass where the value object does not override toString().

ok, a bit confused by this statement but let me try to find out how can I write this in codeQL.

Let me know if I missed something. :)

[ap00rv]

a tangential question, do you know any example of working on chained methods in codeQL for Java ? I am quite new and I don't know how I can get reference to value() method access if I can detect the toString() in the following code by stating that its superType should be instance of java.lang.Object :

code :

this.record.value().toString()

query :

this.getMethod().getDeclaringType().getASourceSupertype*().hasQualifiedName("java.lang", "Object") and
this.getMethod().getName() = "toString" 

[intrigus-lgtm]

Do you want something like this?

from Method value, MethodAccess valueMa, MethodAccess toString
where value.hasName("value") and
valueMa.getMethod() = value and
toString.getQualifier() = valueMa and // <- chaining; `toString()`'s qualifier is `value()`.
toString.hasName("toString")
select value, valueMa, toString

This should work (untested code) and detect this.record.value().toString().

[ap00rv]

This pattern worked ! I added more statements to ensure that value() method is declared in the intended class and toString() is defined in java.lang.Object. Thank you both @intrigus-lgtm and @aeisenberg for your time :)