Joern negative reachability misses executed Python functions
Original title: When Static Reachability Says No: Checking Joern-Based Negative Verdicts for Python Against Execution
In asciinema, 113 of 123 functions Joern called unreachable from entry points still ran; Sublist3r executed 19 of 24.
SourceLens checks Joern-based negative reachability verdicts for Python by mapping Semgrep findings onto a call graph and comparing them with executed calls. On two PyCG macro-benchmark programs where the manual call graph and Joern disagree, many functions marked unreachable from entry points still executed. The latest Joern release produced the same verdicts. Missing edges involve values passed around and constructs without a call expression, including with blocks and property reads. A rule that turns negative verdicts into unknown recovered many executed functions but none of five security findings.
Unconfirmed: Selectivity is unmeasured because only 10 and 5 negative verdicts were not executed.
- Asciinema: 123 functions unreachable from entry points; integration script ran 86 and all runs ran 113.
- Sublist3r executed 19 of 24 functions Joern marked unreachable.
- Four missing asciinema edges make 50 of the 113 executed functions reachable.
- The unknown-verdict rule recovered 62 of 113 and 15 of 19, but 0 of 5 security findings.
From the original article
1 min read at arxiv.orgA negative reachability verdict removes a finding from human review. We check such verdicts against execution. Our pipeline, SourceLens, maps Semgrep findings to a Python program's call graph, whose edges a query takes from the calls that Joern links in its code property graph.
By Artur Zięba-Kozarzewski · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.