https://codeql.github.com/docs/codeql-language-guides/navigating-the-call-graph/

两个重要的类

Callable
A Callable is something that can be invoked.
Call
A Call is something that invokes a Callable.

点击查看【processon】
代码示例

class Super {
    int x;
    // callable
    public Super() {
        this(23);       // call
    }
    // callable
    public Super(int x) {
        this.x = x;
    }
    // callable
    public int getX() {
        return x;
    }
}
    class Sub extends Super {
    // callable
    public Sub(int x) {
        super(x+19);    // call
    }
    // callable
    public int getX() {
        return x-19;
    }
}
class Client {
    // callable
    public static void main(String[] args) {
        Super s = new Sub(42);  // call
        s.getX();               // call
    }
}

成员谓词

Call类

getCallee谓词，Gets the target callable of this call.

Callable Call::getCallee()

getCaller谓词，Gets the callable invoking this call.

Callable Call::getCaller()

代码示例

import java
from Call sink
select sink,sink.getCallee(),sink.getCaller()

结果匹配示例

在如上代码中sink是MethodAccess类型，commence是Method类型

Callable类

calls谓词，Holds if this callable calls target，如果这个Callable调用了target则返回True

predicate Callable::calls(Callable target)

polyCalls谓词，如果这个Callable直接调用了m，或者间接调用（Callable调用的某个方法覆盖了m）了m则返回True

predicate Callable::polyCalls(Callable m)

代码示例

import java
from Callable caller, Callable callee
where caller.calls(callee)
select caller, callee

匹配结果示例

查找未被调用的方法

寻找已经被定义，但是从未被调用过的方法