使用CodeQL提取Java方法本地数据流时SELECT阶段耗时过长求助

我想要提取Java方法的本地数据流，编写了如下CodeQL查询语句以提取函数内变量的声明、访问与赋值情况：

/**
 * @name Empty block
 * @kind problem
 * @problem.severity warning
 * @id java/example/empty-block
 */

import java
import semmle.code.java.dataflow.DataFlow

from File fl, LocalVariableDeclExpr ld, VarAccess va, Assignment asn
where 
    fl.getBaseName() = "Calculator.java"
    and 
    ld.getEnclosingCallable().getName()= "calc"
    and va.getEnclosingCallable().getName() = "calc"
    and asn.getEnclosingCallable().getName() = "calc"
    
    and ld.getLocation().getFile() = fl 
    and va.getLocation().getFile() = fl 
    and asn.getLocation().getFile() = fl 
    and va.getLocation().getStartLine() = ld.getLocation().getStartLine()
select ld, "\"" + va.getVariable().getName()+"\""  + "->" + "\"" +ld.getVariable().getName()+"\""  + "\n" + "\"" +asn.getDest()+"\""  + "->" + "\"" +asn.getSource()+"\""  + "\n"

但该查询在SELECT阶段耗时极长。目标方法如下：

public double calc(double x, String input, char opt) {
        inText.setFont(inText.getFont().deriveFont(Font.PLAIN));
        double y = Double.parseDouble(input);
        switch (opt) {
            case '+':
                return x + y;
            case '-':
                return x - y;
            case '*':
                return x * y;
            case '/':
                return x / y;
            case '%':
                return x % y;
            case '^':
                return Math.pow(x, y);
            default:
                inText.setFont(inText.getFont().deriveFont(Font.PLAIN));
                return y;
        }
    }

优化建议 #

1. 提前定位目标Callable，缩小查询范围 #

原查询重复检查每个元素的所属方法和文件，导致多表关联范围过大。先定位到calc方法，再基于该方法筛选变量声明、访问和赋值，能大幅减少计算量。

修改后的核心条件片段：

from Callable calcMethod, File fl, LocalVariableDeclExpr ld, VarAccess va, Assignment asn
where
    fl.getBaseName() = "Calculator.java"
    and calcMethod.getName() = "calc"
    and calcMethod.getFile() = fl
    // 基于目标方法直接关联后续元素
    and ld.getEnclosingCallable() = calcMethod
    and va.getEnclosingCallable() = calcMethod
    and asn.getEnclosingCallable() = calcMethod
    // 移除重复的文件检查（已通过calcMethod关联）
    and va.getLocation().getStartLine() = ld.getLocation().getStartLine()

2. 移除未使用的导入 #

原查询导入了semmle.code.java.dataflow.DataFlow但未实际使用，多余导入会增加查询初始化开销，直接删除即可。

3. 简化SELECT语句的字符串拼接 #

原SELECT中复杂的字符串拼接会降低查询效率，可拆分字段或简化拼接逻辑：

select ld, 
    "\"" + va.getVariable().getName() + "\" -> \"" + ld.getVariable().getName() + "\"",
    "\"" + asn.getDest() + "\" -> \"" + asn.getSource() + "\""

4. 修正行号匹配逻辑（可选） #

原查询中va.getLocation().getStartLine() = ld.getLocation().getStartLine()仅匹配同一行的变量访问与声明，会遗漏跨行的数据流（比如y的声明在第2行，访问在switch分支中）。如果需要提取完整数据流，建议移除该条件。

最终优化后的完整查询 #

/**
 * @name Extract calc method local data flow
 * @kind problem
 * @problem.severity warning
 * @id java/example/calc-local-dataflow
 */

import java

from Callable calcMethod, File fl, LocalVariableDeclExpr ld, VarAccess va, Assignment asn
where
    fl.getBaseName() = "Calculator.java"
    and calcMethod.getName() = "calc"
    and calcMethod.getFile() = fl
    and ld.getEnclosingCallable() = calcMethod
    and va.getEnclosingCallable() = calcMethod
    and asn.getEnclosingCallable() = calcMethod
    // 可选：关联变量访问与对应的声明
    // and va.getVariable() = ld.getVariable()
select ld, 
    "\"" + va.getVariable().getName() + "\" -> \"" + ld.getVariable().getName() + "\"",
    "\"" + asn.getDest() + "\" -> \"" + asn.getSource() + "\""

额外：使用内置本地数据流库追踪完整路径 #

如果目标是追踪变量的完整数据流路径，直接使用CodeQL内置的LocalFlow库更高效：

/**
 * @name Track calc method local variable flow
 * @kind problem
 * @problem.severity warning
 * @id java/example/calc-local-flow
 */

import java
import semmle.code.java.dataflow.LocalFlow

from Callable calcMethod, File fl, LocalNode source, LocalNode sink
where
    fl.getBaseName() = "Calculator.java"
    and calcMethod.getName() = "calc"
    and calcMethod.getFile() = fl
    and source.getEnclosingCallable() = calcMethod
    and sink.getEnclosingCallable() = calcMethod
    and LocalFlow::localFlow(source, sink)
select source, "flows to", sink

内容的提问来源于stack exchange，提问作者m0ss