From 7ce0a30161b7be9cfc73b7a50ca0026c77231eb9 Mon Sep 17 00:00:00 2001 From: Marius Ciepluch <11855163+norandom@users.noreply.github.com> Date: Fri, 11 Sep 2026 10:42:35 +0200 Subject: [PATCH] docs(cpg): name the upstream issue for joern-parse --overlaysonly (joernio/joern#6283) Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG --- .kiro/specs/contributor-scan/tasks.md | 2 +- src/openultrasast/cpg/backend.py | 2 +- src/openultrasast/cpg/queries/overlay.sc | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.kiro/specs/contributor-scan/tasks.md b/.kiro/specs/contributor-scan/tasks.md index daa15f2..f2b4280 100644 --- a/.kiro/specs/contributor-scan/tasks.md +++ b/.kiro/specs/contributor-scan/tasks.md @@ -892,7 +892,7 @@ Three changes, each named in the log rather than silent: (1) `queries/overlay.sc` runs `importCpg` + `save` once at build time and the saved graph replaces the raw one (`joern-parse --overlaysonly` is the - obvious tool and NPEs in 4.0.623); (2) a source file over `MAX_SOURCE_BYTES` (1 MB) is excluded from + obvious tool and NPEs in 4.0.623 -- filed as joernio/joern#6283); (2) a source file over `MAX_SOURCE_BYTES` (1 MB) is excluded from the build as a data table and reported in `unparsed`; (3) the hook half's seeds are the callback's own file. The payload diff between a raw and a saved-overlay pmpro graph was checked request by request: identical (sink, line, source kind, sanitized) sets, fewer repeated flow paths on the saved one. diff --git a/src/openultrasast/cpg/backend.py b/src/openultrasast/cpg/backend.py index fba30f2..f46e41b 100644 --- a/src/openultrasast/cpg/backend.py +++ b/src/openultrasast/cpg/backend.py @@ -616,7 +616,7 @@ class JoernBackend: CVE-2022-25148 on, one hour before the switch, from a `joern-parse` build. Task 5.13. `queries/overlay.sc` is that once: `importCpg`, `save`, and the saved graph replaces the raw one - under the same path. (`joern-parse --overlaysonly` is the obvious tool and is broken in 4.0.623.) + under the same path. (`joern-parse --overlaysonly` is the obvious tool and is broken in 4.0.623: joernio/joern#6283.) A failure here is logged and the raw graph kept, so the scan degrades to the old cost rather than losing its graph. """ diff --git a/src/openultrasast/cpg/queries/overlay.sc b/src/openultrasast/cpg/queries/overlay.sc index 9acf24b..c84bed9 100644 --- a/src/openultrasast/cpg/queries/overlay.sc +++ b/src/openultrasast/cpg/queries/overlay.sc @@ -10,7 +10,7 @@ // // Measured after: the saved graph reloads in 8 s where the raw one took 64 s, and the request that had // timed out at 520 s answered in 39 s including the JVM. `joern-parse --overlaysonly` would be the -// obvious tool and is broken in 4.0.623 (NullPointerException in a post-processing step that needs the +// obvious tool and is broken in 4.0.623 -- joernio/joern#6283 (NullPointerException in a post-processing step that needs the // frontend it did not run), so the once is this script. // // `save` writes to `workspace//cpg.bin` under the working directory; the driver moves that over