cravex2-reachability: Evaluate atom+chen on a simple end-to-end flow #2148

Activity

1. pombredanne

   added a parent issue on Feb 5, 2026

   • cravex2-reachability: Vulnerable code "reachability" determination #1964
2. pombredanne

   added this to 00-AboutCodePlanneron Feb 5, 2026
3. pombredanne

   assigned

   ziadhany

   on Feb 5, 2026
4. ziadhany

   moved this to In progress in 00-AboutCodePlanneron Feb 12, 2026
5. ziadhany commented on Feb 16, 2026

   

   ziadhany

   on Feb 16, 2026

   Last edited by ziadhany

   Member

   More actions

   1- Install atom+chen

   atom installation is easier than chen, but both can run in Docker according to the docs.
   I was able to run atom locally and used Docker to run the chennai cli.

   • https://github.com/AppThreat/atom/?tab=readme-ov-file#installation
   • https://github.com/AppThreat/chen?tab=readme-ov-file#interactive-console

   2- Select a good CVE to use as a test.

   I picked CVE-2026-1285 because it is straightforward.

   3- Collect the fix patch/commit
   django/django@a33540b we can easily identify the affected and fixed function: handle_endtag.

   4- Compute the graph on the vulnerable package with atom+chen:

   $ git clone https://github.com/django/django/
   $ cd django
   $ git checkout 6.0
   Previous HEAD position was 16ae193550 [6.0.x] Bumped version for 6.0 alpha 1 release.
   HEAD is now at 36b5f39d93 [6.0.x] Bumped version for 6.0 release.
   

   run atom to compute the call graph (note: generate atom file take some times around 10 minutes or more depend on project complexity )

   $ nvm use v24.0.2 # Make sure you use a valid Node.js version.
   $ atom -o app.atom -l python .
   $ atom usages -l language -o app.atom -s usages.json .
   $ cdxgen -t python --deep -o bom.json .
   $ atom reachables -o app.atom -s reachables.json -l python .
   

   5- Query that graph

   docker run --rm -v /tmp:/tmp -v $HOME:$HOME -v $(pwd):/app:rw -it ghcr.io/appthreat/chen chennai
   

   docker cp /home/ziad-hany/django/app.atom containier_name:/tmp/app.atom
   

   chennai> importAtom("/tmp/app1.atom")
   
   chennai> imports
   │           │ django.template.TemplateDoesNotExist                                       │
   ├───────────┼────────────────────────────────────────────────────────────────────────────┤
   │           │ django.template.loader                                                     │
   ├───────────┼────────────────────────────────────────────────────────────────────────────┤
   │           │ django.utils._os.safe_join                                                 │
   ├───────────┼────────────────────────────────────────────────────────────────────────────┤
   │           │ django.utils.http.http_date                                                │
   ├───────────┼────────────────────────────────────────────────────────────────────────────┤
   │           │ django.utils.http.parse_http_date                                          │
   ├───────────┼────────────────────────────────────────────────────────────────────────────┤
   │           │ django.utils.translation.gettext                                           │
   ├───────────┼────────────────────────────────────────────────────────────────────────────┤
   │           │ django.utils.translation.gettext_lazy                                      │
   └───────────┴────────────────────────────────────────────────────────────────────────────┘
   
   chennai> atom.method(".*handle_endtag.*").name.l
   val res31: List[String] = List(
     "handle_endtag",
     "handle_endtag<metaClassAdapter>",
     "handle_endtag",
     "handle_endtag<metaClassAdapter>",
     "handle_endtag"
   )
   
   chennai> atom.method(".*handle_endtag.*").caller.name.l
   val res47: List[String] = List(
     "handle_endtag<metaClassAdapter>",
     "handle_endtag<metaClassAdapter>",
     "handle_startendtag",
     "handle_startendtag"
   )
   
   

   5- Report here about the experience:

   • By using the app.atom, usage.json, and reachables.json files, we can see exactly how the code works and find every path a function takes.
   • Chennai for queries is great, but it is difficult to test because the documentation is not clear and lacks examples.
   • Issues with Small Projects:
     I tested the tool with a single simple function CVE-2020-22083 to see how it performs in different situations. Sometimes the reachables.json file is empty when testing small projects, possibly because there isn't enough information to map but we still have the usage.json file and it can be very helpful for finding the information we need.
6. TG1999 commented on Jun 11, 2026

   

   TG1999

   on Jun 11, 2026

   Contributor

   More actions

   • Scan codebase
   • Do a vuln scan on packages
   • Do reachability analaysis on vuln packages using code symbol lookups / atom + chen
7. ziadhany commented on Jun 18, 2026

   

   ziadhany

   on Jun 18, 2026

   Last edited by ziadhany

   Member

   More actions

   Using Atom and chennai, we can also run more complex queries on symbols or function names.

   Let’s take the following example:
   _default_template_ctx_processor function

   • pallets/flask@089cb86

   val target = ".*_default_template_ctx_processor.*"
   
   val defined = atom.method(target).nonEmpty
   val imported = atom.imports.filter(_.code.matches(target)).nonEmpty
   val called = atom.call.name(target).nonEmpty
   val reachableFrom = atom.method(target).repeat(_.caller)(_.emit).fullName.distinct.l
   
   val evidenceJson = s"""
   {
     "defined": $defined,
     "called": $called,
     "imported": $imported,
     "reachable_from": ${reachableFrom.map(s => s"\"$s\"").mkString("[", ", ", "]")}
   }
   """
   
   println(evidenceJson)
   

   Output

   val target: String = ".*_default_template_ctx_processor.*"
   val defined: Boolean = true
   val imported: Boolean = false
   val called: Boolean = false
   val reachableFrom: List[String] = List(
     "build/lib/flask/templating.py:<module>._default_template_ctx_processor",
     "src/flask/templating.py:<module>._default_template_ctx_processor"
   )
   val evidenceJson: String = """
   {
     "defined": true,
     "called": false,
     "imported": false,
     "reachable_from": ["build/lib/flask/templating.py:<module>._default_template_ctx_processor", "src/flask/templating.py:<module>._default_template_ctx_processor"]
   }
   """
   
8. ziadhany commented on Jul 30, 2026

   

   ziadhany

   on Jul 30, 2026

   Member

   More actions

   This is now complete. I evaluated the end-to-end Atom + Chen workflow and posted the steps above.
9. ziadhany

   closed this as completedon Jul 30, 2026
10. github-project-automation

    moved this from In progress to Done in 00-AboutCodePlanneron Jul 30, 2026