weggli-rs / weggli

weggli is a fast and robust semantic search tool for C and C++ codebases. It is designed to help security researchers identify interesting functionality in large codebases.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Can't query across files?

p1v07 opened this issue · comments

commented

test code:

test1.cpp

#include "test2.h"
static INT64 func1(VOID)
{

    lResult = func2(1, func3, (VOID *)NULL);

    return SUCCESS;
}

test2.cpp

VOID *func3(VOID *pStr)
{
    int i = 0;
    (VOID)pthread_detach(pthread_self());

    return (VOID *)0;
} //lint !e715 !e818

my query not work:

weggli -C --cpp --unique 'func2(_,$fn,_);' -p '_ $fn(_){
_;
pthread_detach(pthread_self());
    }' test

When I put it together, the query works. So is it my query worng or weggli not support query across files?

Hi,

can you try this again with the current master branch? This works as expected for me.

√ weggli-test % weggli -C --cpp --unique 'func2(_,$fn,_);' -p '_ $fn(_){_; pthread_detach(pthread_self());}' .
/private/tmp/weggli-test/./test1.cpp:2
static INT64 func1(VOID)
{

    lResult = func2(1, func3, (VOID *)NULL);

    return SUCCESS;
}
/private/tmp/weggli-test/./test2.cpp:1
VOID *func3(VOID *pStr)
{
    int i = 0;
    (VOID)pthread_detach(pthread_self());

    return (VOID *)0;
}
commented

I made a mistake. It's test1.cpp and test2.c , some times there is c and cpp mixed. Is there a solution for this situation?

You can manually override the searched file extensions using the -e (--extensions) flag like this.
This will still parse the ".c" files in C++ mode, but that shouldn't be an issue for most codebases.

weggli --extensions c cpp --cpp --unique 'func2(_,$fn,_);' -p '_ $fn(_){_; pthread_detach(pthread_self());}' .

commented

Thanks Master!