You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Note that the given module name *must not* contain any ```::`` symbols. Thus, something like
42
-
`API::getTopLevelMember("Net::HTTP")`` will not do what you expect. Instead, this should be decomposed
43
-
into an access of the ``HTTP`` member of the API graph node for ``Net``, as in the example above.
40
+
Note that you should specify module names without ``::`` symbols. If you write ``API::getTopLevelMember("Net::HTTP")``, it will not do what you expect. Instead, you need to decompose this name
41
+
into an access of the ``HTTP`` member of the API graph node for ``Net``, as shown in the example above.
44
42
45
43
Calls and class instantiations
46
44
------------------------------
@@ -78,13 +76,13 @@ The following snippet builds on the above to find calls of the ``Regexp#match?``
78
76
Subclasses
79
77
----------
80
78
81
-
For many libraries, the main mode of usage is to extend one or more library classes. To track this
79
+
Many libraries are used by extending one or more library classes. To track this
82
80
in the API graph, you can use the ``getASubclass`` method to get the API graph node corresponding to
83
-
all the immediate subclasses of this node. To find *all* subclasses, use ``*`` or ``+`` to apply the
84
-
method repeatedly, as in ``getASubclass*``.
81
+
the immediate subclasses of a node. To find *all* subclasses, use ``*`` or ``+`` to apply the
82
+
method repeatedly. You can see an example where all subclasses are identified using ``getASubclass*`` below.
85
83
86
-
Note that ``getASubclass`` does not account for any subclassing that takes place in library code
87
-
that has not been extracted. Thus, it may be necessary to account for this in the models you write.
84
+
Note that ``getASubclass`` can only return subclasses that are extracted as part of the CodeQL database
85
+
that you are analyzing. When libraries have predefined subclasses, you will need to explicitly include them in your model.
88
86
For example, the ``ActionController::Base`` class has a predefined subclass ``Rails::ApplicationController``. To find
89
87
all subclasses of ``ActionController::Base``, you must explicitly include the subclasses of ``Rails::ApplicationController`` as well.
90
88
@@ -109,10 +107,14 @@ Using the API graph in dataflow queries
109
107
110
108
Dataflow queries often search for points where data from external sources enters the code base
111
109
as well as places where data leaves the code base. API graphs provide a convenient way to refer
112
-
to external API components such as library functions and their inputs and outputs. API graph nodes
113
-
cannot be used directly in dataflow queries they model entities that are defined externally,
114
-
while dataflow nodes correspond to entities defined in the current code base. To brigde this gap
115
-
the API node classes provide the ``asSource()`` and ``asSink()`` methods.
110
+
to external API components such as library functions and their inputs and outputs.
111
+
However, you do not use API graph nodes directly in dataflow queries.
112
+
113
+
- API graph nodes model entities that are defined outside your code base.
114
+
- Dataflow nodes model entities defined within the current code base.
115
+
116
+
You bridge the gap between the entities outside and inside your code base using
117
+
the API node class methods: ``asSource()`` and ``asSink()``.
116
118
117
119
The ``asSource()`` method is used to select dataflow nodes where a value from an external source
118
120
enters the current code base. A typical example is the return value of a library function such as
@@ -135,15 +137,15 @@ of the ``File.write(path, value)`` method.
0 commit comments