How to create a new pass for use in Django

[simkimsia]

I came here via #1916 (comment). Based on my understanding, I nee to create a new pass for my use case.

My purpose is to use cpg library to build a cpg graph for a Django codebase.

I have two installation/usage questions

Q1: https://fraunhofer-aisec.github.io/cpg/GettingStarted/cli/ taught me to do this at the project root ./gradlew :cpg-console:installDist and then cpg-console/build/install/cpg-console/bin/cpg-console

I assume this means that in order to study a django codebase at this stage I should type :translate /path/to/the/djangocodebase/ yes?

Q2: I looked at https://fraunhofer-aisec.github.io/cpg/CPG/impl/ and noticed the Passes part

I guess this means that I have to write my own Pass class/file?

I searched in the code base and I noticed the list of files under /passes is a lot longer than the one shown in the diagram

am i right to create my own and follow the instructions in https://fraunhofer-aisec.github.io/cpg/CPG/impl/passes/ ?

so the code will look something like:

@DependsOn(SymbolResolver::class)  // We need symbols to be resolved first
class DjangoRenderPass(ctx: TranslationContext) : ComponentPass(ctx) {
    override fun accept(component: Component) {
        val walker = SubgraphWalker.ScopedWalker(scopeManager)
        
        walker.registerHandler { node ->
            when (node) {
                is CallExpression -> handlePossibleRenderCall(node)
            }
        }
        
        walker.iterate(component)
    }

    private fun handlePossibleRenderCall(call: CallExpression) {
        // Check if this is django.shortcuts.render
        if (isDjangoRender(call)) {
            // Create RenderTemplate node
            val renderTemplate = newRenderTemplate(call)
            
            // Add to overlay edges instead of replacing
            call.overlayEdges.add(renderTemplate)
        }
    }
}

am i getting close to the situation?

[oxisto]

Q1: While that is possible to use the cpg-console, you will find it hard to extend it with your custom passes. Therefore the recommended approach here would be to create a separate project, ideally based on Gradle (or maven), run gradle init and add the CPG as a dependency as described here. https://fraunhofer-aisec.github.io/cpg/GettingStarted/library/#2-configuring-the-translation

This will give you complete control over the TranslationConfiguration, which can be used to configure

• The source locations
• The registered languages (python), using registerLanguage
• And most importantly the configured passes, defaultPasses(), as well as registerPass to register your own

Q2: At first glance this looks good

[simkimsia]

Therefore the recommended approach here would be to create a separate project, ideally based on Gradle (or maven), run gradle init and add the CPG as a dependency as described here. https://fraunhofer-aisec.github.io/cpg/GettingStarted/library/#2-configuring-the-translation

I created a separate project as recommended https://github.com/simkimsia/django-cpg-analyzer/commits/feat/django-render-pass/ and this time i imported cpg as library

I am usually a python dev so I'm new to Kotlin. Any feedback on improving my Kotlin code is most welcome.

When I run, I get the following print out

Starting Django Render Pass Analysis...
Analyzing component: application
  Analyzing translation unit: /Users/kimsia/Projects/django-cpg-analyzer/app/src/test/resources/python/test_django_view.py
    Found call: render at line 4
Django Render Pass Analysis completed

Analysis completed
Source: Test File
Analyzing unit: /Users/kimsia/Projects/django-cpg-analyzer/app/src/test/resources/python/test_django_view.py

I know it's not curretly doing any useful analysis but am I on the right path so far?

What would be my next step?

[simkimsia]

The source locations
The registered languages (python), using registerLanguage
And most importantly the configured passes, defaultPasses(), as well as registerPass to register your own

See my attempt here

Am I doing this part correctly?

[oxisto]

That looks good so far. The next step would be to declare your own overlay node type something like

class TemplateRenderer : OverlayNode() {
}

and then create a new TemplateRenderer node inside your pass. The important step is to then set the underlyingNode on the overlay node, for example to the call expression. This will then automatically add it to the overlay nodes of the call expression.

You can also add additional properties that you want to the template renderer class and of course define multiple overlay nodes and connect them with each other.