Code Review: Strategies

Top To Bottom Approach

pick a function which is accessible to user or container user input and try to go cover all the function calls to that perticular functionality.

Bottom To Top Approach

Pick a function which is indipendent and try to go from bottom to top and do the same to cover all function used in which it has been used.

Grepping approach

Bad way to learn. match some keywords like eval, exec or something dangerous and try to read the whole function.

Pick A Functonality

Take a functinality and read all the code related to it.

Pro-tip: Try to read same functonality accross different applications at the same time.

Getting function graphs from source code

To generate a function call graph from a GitHub repository, follow these steps:

1. Clone the Repository

First, clone the repository to your local system:

git clone https://github.com/user/repo.git
cd repo

2. Use a Tool to Generate the Function Call Graph

There are several tools available depending on the programming language of the repository.

For Python

• Use pyan3 to generate a call graph:

  pip install pyan3
  pyan3 *.py --dot | dot -Tpng -o call_graph.png
  

  This generates a PNG file of the call graph.

• Alternatively, use pycallgraph2:

  pip install pycallgraph2 graphviz
  pycallgraph graphviz -- python your_script.py
  

For C and C++

• Use cflow:

  sudo apt install cflow
  cflow --output=callgraph.txt *.c
  

• Use doxygen:

  1. Install Doxygen:

     sudo apt install doxygen graphviz
     

  2. Generate a config file:

     doxygen -g
     

  3. Edit Doxyfile:

     EXTRACT_ALL = YES
     CALL_GRAPH = YES
     

  4. Run Doxygen:

     doxygen
     

  5. Open the generated html/index.html.

For Go

• Use gocallvis:

  go install github.com/ofabry/gocallvis@latest
  gocallvis -group pkg,type -format svg -output callgraph.svg ./...
  

For Java

• Use JCallGraph:

  java -jar jcallgraph.jar -jar your-java-project.jar
  

• Or use Soot for more advanced analysis.

3. Visualize the Graph

If the tool generates a .dot file, you can convert it using Graphviz:

dot -Tpng callgraph.dot -o callgraph.png

Code Review: Reviewing

Above is an example of how not to write a function.

Regex

Filtering

Read Eval Print Loop

use programing containers docker to run and evaluate code

example:

to test java code you can write a java snippet and use the following.

docker run -it -v `pwd`:/code openjdk /bin/bash
# inside the bash 

javac Testing.java
java Testing