io.joern.x2cpg.passes.frontend

A name that refers to some kind of callee.

Represents a field identifier at its declared computational unit.

Represents an identifier of some AST node at an interprocedural scope.

The Javascript specific call linker links static call sites (by full name) and call sites to methods in the same file (by name).

Represents an identifier of some AST node at an intraprocedural scope.

A variable that holds data within an intraprocedural scope.

A pass that creates a MetaData node, specifying that this is a CPG for language, and a NamespaceBlock for anything that cannot be assigned to any other namespace.

Performs type recovery from the root of a compilation unit level

Represents an identifier of some AST node at a specific scope.

Defines how a procedure is available to be called in the current scope either by it being defined in this module or being imported.

Tasks responsible for populating the symbol table with import data.

A thread-safe symbol table that can represent multiple types per symbol. Each node in an AST gets converted to an SBKey which gives contextual information to identify an AST entity. Each value in this table represents a set of types that the key could be in a flow-insensitive manner.

The SymbolTable operates like a map with a few convenient methods that are designed for this structure's purpose.

Creates a TYPE node for each type in usedTypes

Attempts to set the methodFullName and link to callees using the recovered type information from XTypeRecovery. Note that some methods may not be present as they could be external and have been dynamically discovered, thus the io.joern.x2cpg.passes.base.MethodStubCreator would have missed it.

Based on a flow-insensitive symbol-table-style approach. This pass aims to be fast and deterministic and does not try to converge to some fixed point but rather iterates a fixed number of times. This will help recover:

• Imported call signatures from external dependencies
• Dynamic type hints for mutable variables in a computational unit.

The algorithm flows roughly as follows:

• Scan for method signatures of methods for each compilation unit, either by internally defined methods or by reading import signatures. This includes looking for aliases, e.g. import foo as bar.
• (Optionally) Prune these method signatures by checking their validity against the CPG.
• Visit assignments to populate where variables are assigned a value to extrapolate its type. Store these values in a local symbol table. If a field is assigned a value, store this in the global table
• Find instances of where these fields and variables are used and update their type information.
• If this variable is the receiver of a call, make sure to set the type of the call accordingly.

In order to propagate types across computational units, but avoid the poor scalability of a fixed-point algorithm, the number of iterations can be configured using the iterations parameter. Note that iterations < 2 will not provide any interprocedural type recovery capabilities.

The symbol tables use the SymbolTable class to track possible type information.
Note: Local symbols are cleared once a compilation unit is complete. This is to keep memory usage down while maximizing concurrency.