tree dfc118289f1c5f263f6299228b2230de61bad3be
parent 4bd4888cc0609c2fdddc1eb4e66fa070397d921e
author Zvonimir Pavlinovic <zpavlinovic@google.com> 1654133773 -0700
committer Zvonimir Pavlinovic <zpavlinovic@google.com> 1654191724 +0000

vulncheck: remove synthetic nodes from call graph

This removes ~20% edges for k8s call graph. It also skips call stacks
that go through one level of indirection with wrappers.

The reason why this change is correct is as follows. Vulnerability db
entries never specify ssa wrappers as dbs are unaware of these. The only
type of wrappers applicable are the ones that are generated for calls to
pointer receivers where the source defines methods only on value
receivers. Vulnerability dbs do not care about this distinction nor do
the users, so it should be safe to inline the wrappers. This is exactly
what callgraph.DeleteSyntheticNodes does.

Change-Id: I2d76c0570d95f78ff4a2463ddf7cd95110fff15c
Reviewed-on: https://go-review.googlesource.com/c/vuln/+/410054
Reviewed-by: Jonathan Amsterdam <jba@google.com>
Run-TryBot: Zvonimir Pavlinovic <zpavlinovic@google.com>
Reviewed-by: Julie Qiu <julieqiu@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>