Skip to content

Create pipeline for symbol reachability - #2151

Merged
tdruez merged 45 commits into
aboutcode-org:mainfrom
ziadhany:add-symbol-reachability
Aug 31, 2026
Merged

Create pipeline for symbol reachability#2151
tdruez merged 45 commits into
aboutcode-org:mainfrom
ziadhany:add-symbol-reachability

Conversation

@ziadhany

@ziadhany ziadhany commented Apr 22, 2026

Copy link
Copy Markdown
Collaborator

Issues

Changes

Add Pipeline(s) that can retrieve vulnerable / fix symbols, collect local symbols (pur2sym) and match them
Pipeline Graph:

graph TD
    %% Main Entry Point
    Start([SymbolReachability Pipeline]) --> Step1[get_vulnerabilities_patches]
    
    %% Step 1: Get Patches
    Step1 --> ExtractPatches[Extract fixed_in_patches from vulnerabilities]
    ExtractPatches --> DedupePatches[Deduplicate by vcs_url & commit_hash]
    DedupePatches --> Step2[collect_resource_index]
    
    %% Step 2: Collect Resource Index
    Step2 --> FilterResources[Filter codebaseresources by TS_QUERIES languages]
    FilterResources --> ResLoop{For each candidate_resource}
    ResLoop -->|Next resource| BuildResIndex[ResourceAnalyzer.build_index]
    BuildResIndex --> ExtractDefs[Extract definitions, imports, calls & callers_of]
    ExtractDefs --> SaveResIndex[Store in resource_indexes]
    SaveResIndex --> ResLoop
    ResLoop -->|All resources processed| Step3[collect_patch_symbols]
    
    %% Step 3: Collect Patch Symbols
    Step3 --> GroupPatches[Group patches by vcs_url]
    GroupPatches --> RepoLoop{For each repository}
    RepoLoop -->|Next repo| CloneRepo[Clone repo to temp dir]
    CloneRepo --> PatchLoop{For each patch in repo}
    PatchLoop -->|Next patch| PatchAnalyzer[PatchAnalyzer.collect_patch_symbols]
    PatchAnalyzer --> GetDiff[Get changed files & diff vulnerable/fixed texts]
    GetDiff --> DetectLang[detect_language_with_scancode]
    DetectLang --> ParseAST[LanguageQuery.parse_code_to_ast]
    ParseAST --> ExtractSymbols[SymbolExtractor.extract_changed_symbols]
    ExtractSymbols --> DiffSymbols[diff_changed_symbols]
    DiffSymbols --> SavePatchSyms[Store in patch_symbols by commit_hash]
    SavePatchSyms --> PatchLoop
    PatchLoop -->|All patches checked| RepoLoop
    RepoLoop -->|All repos processed| Step4[collect_and_match_resources]
    
    %% Step 4: Match Resources and Patches
    Step4 --> MatchPatchLoop{For each patch}
    MatchPatchLoop -->|Next patch| MatchResLoop{For each candidate_resource}
    MatchResLoop -->|Next resource| CheckLang{Language matches patch?}
    CheckLang -->|No| MatchResLoop
    CheckLang -->|Yes| Matcher[ResourcePatchMatcher.match]
    
    Matcher --> MatchVuln[Match Vulnerable Symbols]
    Matcher --> MatchFixed[Match Fixed Symbols]
    
    MatchVuln & MatchFixed --> CheckEvidence{Evidence found?}
    CheckEvidence -->|No| MatchResLoop
    CheckEvidence -->|Yes| Classify[classify_reachability]
    Classify --> StatusReach[REACHABLE / UNKNOWN / NOT_REACHABLE]
    StatusReach --> UpdateData[save_resource_reachability_report]
    UpdateData --> MatchResLoop
    
    MatchResLoop -->|All resources checked| MatchPatchLoop
    MatchPatchLoop -->|All patches checked| End([End Process])

    %% Styling
    classDef stepNode fill:#e1f5fe,stroke:#03a9f4,stroke-width:2px;
    classDef functionNode fill:#f1f8e9,stroke:#4caf50,stroke-width:2px;
    classDef logicNode fill:#fff3e0,stroke:#ff9800,stroke-width:2px;
    classDef loopNode fill:#f3e5f5,stroke:#9c27b0,stroke-width:2px;
    
    class Start,End,Step1,Step2,Step3,Step4 stepNode;
    class RepoLoop,PatchLoop,ResLoop,MatchPatchLoop,MatchResLoop loopNode;
    class CheckLang,CheckEvidence logicNode;
    class PatchAnalyzer,Matcher,Classify,BuildResIndex functionNode;

Loading

Checklist

  • I have read the contributing guidelines
  • I have linked an existing issue above
  • I have added unit tests covering the new code
  • I have reviewed and understood every line of this PR

@ziadhany
ziadhany force-pushed the add-symbol-reachability branch from 944dcbe to da128db Compare June 3, 2026 11:39
@ziadhany

Copy link
Copy Markdown
Collaborator Author

The pipeline requires the unidiff dependency to parse diffs/patch text

@ziadhany
ziadhany force-pushed the add-symbol-reachability branch from d5fed3d to 08512ab Compare June 16, 2026 15:54
@ziadhany
ziadhany marked this pull request as ready for review June 16, 2026 16:24
@ziadhany

Copy link
Copy Markdown
Collaborator Author

This depends on:

We have an API support for patching VulnerableCode, see:

@ziadhany
ziadhany force-pushed the add-symbol-reachability branch 2 times, most recently from 3686a85 to dfbb4db Compare July 1, 2026 13:06
Comment thread scanpipe/pipes/symbols.py Outdated
Comment thread uv.lock
@ziadhany
ziadhany requested a review from TG1999 July 2, 2026 00:58
@ziadhany

ziadhany commented Jul 2, 2026

Copy link
Copy Markdown
Collaborator Author

I'm also not sure why Run unit tests on macOS / run-unit-tests (3.13) is failing.

@TG1999

TG1999 commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

@ziadhany try to fix the failing test please

data = {
"purls": purls,
"details": True,
"reachability": True,

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You should only go for reachability if collect_symbols_reachability has called it, not for every VCIO call

@ziadhany ziadhany Jul 14, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We're currently relying on the find_vulnerabilities pipeline to retrieve vulnerabilities. One possible solution is to introduce an optional field reachability in the find_vulnerabilities pipeline.

Comment thread scanpipe/pipes/reachability.py Outdated
Comment thread scanpipe/pipes/reachability.py
@TG1999

TG1999 commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

@ziadhany this mostly looks good, let's have a session soon and do a demo and understand the limitations of the current approach

Comment thread pyproject.toml Outdated
Comment thread pyproject.toml Outdated
@ziadhany
ziadhany force-pushed the add-symbol-reachability branch from 6768aa8 to 577d4be Compare July 23, 2026 00:53
Comment thread scanpipe/pipelines/find_vulnerabilities.py Outdated
@ziadhany
ziadhany requested a review from TG1999 July 28, 2026 13:17
@ziadhany
ziadhany force-pushed the add-symbol-reachability branch from 1555040 to 27de9f1 Compare July 29, 2026 23:39
@ziadhany
ziadhany requested a review from tdruez July 30, 2026 13:02

@tdruez tdruez left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • The new code does not follow current codebase conventions: remote all the type hint.
  • Make sure all functions have a proper docstrings and are properly covered by a unit test
  • Lack of a global test for the new pipeline

Comment thread scanpipe/pipelines/analyze_symbols_reachability.py Outdated
Comment thread scanpipe/pipelines/analyze_symbols_reachability.py
@tdruez
tdruez removed the request for review from TG1999 August 10, 2026 11:21

@keshav-space keshav-space left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ziadhany thanks. We should not rebuild index over and over again for the same resource each time we match against a new patch. I suggest that instead of having one big monolithic step, we break the pipeline into minimum 4 logical steps.

  • Step 1: get vcs_url and patch for all vulnerabilities.
  • Step 2: for each patch, collect vulnerable symbols.
  • Step 3: iterate over resource, parse and collect resource symbols, and match them against vulnerable symbols.
  • Step 4: prepare and store consolidated reachability for each vulnerability.

The final reachability report should be keyed by vulnerability. For each vulnerability I should get reachability (Yes, No, or Unknown) along with tool-specific details.
Also please remove type hints as we don't yet use/support type hints in SCIO

Comment thread scanpipe/pipes/reachability.py
Comment thread scanpipe/pipes/reachability.py Outdated
Comment thread scanpipe/pipes/reachability.py Outdated
Comment thread scanpipe/pipes/reachability.py Outdated
@ziadhany
ziadhany requested a review from keshav-space August 14, 2026 15:19
@ziadhany

ziadhany commented Aug 18, 2026

Copy link
Copy Markdown
Collaborator Author

Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Add end-to-end test for Symbol Reachability pipeline

Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Split pipeline to multiple steps
Build resource_index once per resource

Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Simplify add_reachability_report function
Remove type hints for symbols.py

Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
…all commits

Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Refactor the pipeline

Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Fix the test

Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Add resource filter based on language we support

Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
ziadhany force-pushed the add-symbol-reachability branch from bdc627e to cb83ff3 Compare August 31, 2026 12:51
@tdruez
tdruez merged commit 4fffe68 into aboutcode-org:main Aug 31, 2026
8 checks passed
@ziadhany
ziadhany deleted the add-symbol-reachability branch August 31, 2026 21:45
chinyeungli pushed a commit that referenced this pull request Aug 31, 2026
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
chinyeungli pushed a commit that referenced this pull request Sep 3, 2026
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants