Skip to main content

Call Graph

Simple Story

You can work out from the source which method calls which, and draw the same kind of map the bytecode analysis draws.

The catch is that the source only shows what the pupil wrote. Anything borrowed from a library is a name on the page with nothing behind it.

What it is

A call graph derived from an abstract syntax tree (AST) is built by walking the tree and recording each call expression. It answers questions such as does this method call itself, which is how recursion is detected.

How it differs from the bytecode call graph

AST call graphBytecode call graph, built by the T. J. Watson Libraries for Analysis (WALA)
Built fromsourcecompiled classes
Sees library internalsnoyes
Sees synthetic methodsnoyes
Resolving a call targetneeds symbol solvingresolved by the compiler
Suited tostructural requirementsreachability of forbidden operations

Resolving which method a call refers to needs more than the tree, which is why Ares depends on javaparser-symbol-solver-core and not only on javaparser-core.

Not a security boundary

The AST layer answers questions about how code is written. It is not an enforcement mechanism: source-level analysis cannot bind what a program does at runtime.

Further reading