How to write query to get Call Graph in python?

[vzcrab]

And I want to use @kind graph to draw a graph. Although I find the FunctionInvocation in the CallGraph module, it's hard to get what I want.

[smowton]

How about

/**
 * @kind graph
 */

import semmle.python.pointsto.CallGraph

query predicate edges(CallNode caller, CallNode callee) {
  exists(FunctionInvocation callerFI, FunctionInvocation calleeFI |
    callerFI.getCall() = caller and
    calleeFI.getCall() = callee and
    callerFI.getACallee() = calleeFI and
    calleeFI = callerFI.getACallee()
  )
}

NB. I'm unfamiliar with that callgraph library, so Python team members might be able to recommend a better way!

[vzcrab]

Thanks for your reply @RasmusWL. I'm glad to hear that.

The example code is in this repository. https://github.com/SINC-G/Melody

I hope this will help you.

[andrescodas]

Hi!... I'm working on this use case. I'm wondering if you can point me to an example where more information about the callee is displayed, like where it is defined, its module, qualifiedName, etc...

My end goals it to be able to tell whether a call within a certain scope, is targeting a callee that is defined in another module or file

Thanks so much!

[RasmusWL]

Hi @andrescodas, for something like calls to functions/classes in different modules, you could use something like this:

import python

from Value val, CallNode call, Scope scope
where
  val.getACall() = call and
  (
    scope = val.(CallableValue).getScope()
    or
    scope = val.(ClassValue).getScope()
  ) and
  not call.getEnclosingModule() = scope.getEnclosingModule()
select call, val, scope

if you want to restrict it to only be for calls and functions/classes in user-written code, you could do this instead:

import python

from Value val, CallNode call, Scope scope
where
  val.getACall() = call and
  (
    scope = val.(CallableValue).getScope()
    or
    scope = val.(ClassValue).getScope()
  ) and
  not call.getEnclosingModule() = scope.getEnclosingModule() and
  exists(scope.getLocation().getFile().getRelativePath()) and
  exists(call.getLocation().getFile().getRelativePath())
select call, val, scope

happy coding 👍

[andrescodas]

Hi @RasmusWL ,

Thanks for your help so far. I have a new related question.

I have been using this query to build a Call Graph:

import python 

from Value val,
     CallNode call,
     string call_location,
     string caller_scope_location,
     string callee_definition_location
where
  call = val.getACall() and
  (
    callee_definition_location = val.(CallableValue).getScope().getLocation().toString()
    or
    callee_definition_location = val.(ClassValue).getScope().getLocation().toString()
  ) and
  caller_scope_location = call.getScope().getLocation().toString() and
  call_location = call.getLocation().toString() 
select call_location, caller_scope_location, callee_definition_location

However, this didnt work as expected for the call to foreach here

Particularly, I was expecting to see in the output this tuple:

[
"../test_pipetools/test_decorators.py:10",
"../test_pipetools/test_decorators.py:9",
"../pipetools/utils.py:24"
],

Can you help me improve my query so I catch this case too?

[RasmusWL]

Can you help me improve my query so I catch this case too?

sounds like this could just be a case of the call not being resolved properly