{"action":"created","issue":{"url":"https://api.github.com/repos/fabsx00/python-joern/issues/6","labels_url":"https://api.github.com/repos/fabsx00/python-joern/issues/6/labels{/name}","comments_url":"https://api.github.com/repos/fabsx00/python-joern/issues/6/comments","events_url":"https://api.github.com/repos/fabsx00/python-joern/issues/6/events","html_url":"https://github.com/fabsx00/python-joern/issues/6","id":59053073,"number":6,"title":"Using Sideffect Variables via python-joern ","user":{"login":"er4z0r","id":286428,"avatar_url":"https://avatars.githubusercontent.com/u/286428?v=3","gravatar_id":"","url":"https://api.github.com/users/er4z0r","html_url":"https://github.com/er4z0r","followers_url":"https://api.github.com/users/er4z0r/followers","following_url":"https://api.github.com/users/er4z0r/following{/other_user}","gists_url":"https://api.github.com/users/er4z0r/gists{/gist_id}","starred_url":"https://api.github.com/users/er4z0r/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/er4z0r/subscriptions","organizations_url":"https://api.github.com/users/er4z0r/orgs","repos_url":"https://api.github.com/users/er4z0r/repos","events_url":"https://api.github.com/users/er4z0r/events{/privacy}","received_events_url":"https://api.github.com/users/er4z0r/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2015-02-26T10:39:13Z","updated_at":"2015-03-23T20:40:32Z","closed_at":null,"body":"I am trying to adopt your Taint-Style Description example for sprintf but am lost in the mix of python, groovy and germlin. Here is what I try to do:\r\n\r\n```python\r\nfuns = ['sprintf']\r\nfor f in funs:\r\n\t#find calls of bad function\r\n\tprint \"Calls to evil function %s:\" % f\r\n\tcalls = j.runGremlinQuery(\"getCallsTo('%s')\" % f) \r\n\tfor c in calls:\r\n\t\t\t\t\r\n\t\t#params = j.runGremlinQuery(\"g.v(%d).callToArguments().filter{ it.childNum!='0' }.definitions().filter{it.type=='Parameter'}\"%c._id)\r\n\t\tparams = j.runGremlinQuery(\"g.v(%d).callToArguments().filter{ it.childNum!='0' }.sideEffect{ paramName = '.*' }.filter{ it.code.matches(paramName) }.unsanitized{ it.isCheck( paramName ) }.params( paramName )\"%c._id)\r\n\t\tif set(params):\r\n\t\t\tprint \"call: %s \" % c['code']\r\n\t\t\tprint \"\\tCan be reached from function parameters:\"\r\n\t\t\tfor p in params:\r\n\t\t\t\tprint \"\\t\\t%s\" % p\r\n\r\n```\r\nHowever when I execute this script I get:\r\n```\r\nTraceback (most recent call last):\r\n  File \"my_query.py\", line 23, in <module>\r\n    params = j.runGremlinQuery(\"g.v(%d).callToArguments().filter{ it.childNum!='0' }.sideEffect{ paramName = '.*' }.filter{ it.code.matches(paramName) }.unsanitized{ it.isCheck( paramName ) }.params( paramName )\"%c._id)\r\n  File \"/usr/local/lib/python2.7/dist-packages/joern-0.1-py2.7.egg/joern/all.py\", line 44, in runGremlinQuery\r\n    return self.gremlin.execute(finalQuery)\r\n  File \"/usr/local/lib/python2.7/dist-packages/py2neo/ext/gremlin/__init__.py\", line 36, in execute\r\n    response = self.resources[\"execute_script\"].post({\"script\": script})\r\n  File \"/usr/local/lib/python2.7/dist-packages/py2neo/core.py\", line 288, in post\r\n    raise_from(self.error_class(message, **content), error)\r\n  File \"/usr/local/lib/python2.7/dist-packages/py2neo/util.py\", line 215, in raise_from\r\n    raise exception\r\npy2neo.error.BadInputException: javax.script.ScriptException: groovy.lang.MissingPropertyException: No such property: paramName for class: Script26\r\n```\r\nSo it seems like groovy tries to do a replacement here looking for paramName, which is obviously wrong.\r\nHow do I need to escape this so groovy stays out of my gremlin code?"},"comment":{"url":"https://api.github.com/repos/fabsx00/python-joern/issues/comments/85185937","html_url":"https://github.com/fabsx00/python-joern/issues/6#issuecomment-85185937","issue_url":"https://api.github.com/repos/fabsx00/python-joern/issues/6","id":85185937,"user":{"login":"cottfa","id":1989636,"avatar_url":"https://avatars.githubusercontent.com/u/1989636?v=3","gravatar_id":"","url":"https://api.github.com/users/cottfa","html_url":"https://github.com/cottfa","followers_url":"https://api.github.com/users/cottfa/followers","following_url":"https://api.github.com/users/cottfa/following{/other_user}","gists_url":"https://api.github.com/users/cottfa/gists{/gist_id}","starred_url":"https://api.github.com/users/cottfa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cottfa/subscriptions","organizations_url":"https://api.github.com/users/cottfa/orgs","repos_url":"https://api.github.com/users/cottfa/repos","events_url":"https://api.github.com/users/cottfa/events{/privacy}","received_events_url":"https://api.github.com/users/cottfa/received_events","type":"User","site_admin":false},"created_at":"2015-03-23T20:40:32Z","updated_at":"2015-03-23T20:40:32Z","body":"Never mind, figure it out. This works:\r\n\r\nimport java.util.regex.Pattern;getArguments('memcpy', '2').unsanitized{ it, s -> it._().isCheck('.*'+Pattern.quote(s)+'.*')}.locations()"}}