[Java] transtive call chain considering anonymous class, runtime dispatch and overriding

[MengJingsong]

Dear all,

I’m using CodeQL to analyze a large codebase, and I’ve run into questions around runtime dispatch and polymorphism. Specifically, I’d like to check whether one method transitively calls another.
Here is an example code:

public abstract class AbstClass<T> {
    public abstract T func1();
    public T func2() {
        return func1();
    }
}

void func3() {
    int a = new AbstClass<Integer>() {
        @Override
        public Integer func1() {
            // do something
            func4();
            return 0;
        }
    }.func2();
}

void func4() {
    // ...
}

I want to determine whether func3() transitively invokes func4().
Does anyone know how to write a CodeQL query to implement this check?

Thanks!

[aschackmull]

Use Callable.polyCalls and transitive closure:

from Callable c1, Callable c2
where c1.polyCalls*() = c2 and c1.hasName("func3") and c2.hasName("func4")
select c1, c2