title: How to traverse AST tree
body: <p>I'm trying to create an static analysis for Groovy. As a POC for my superiors I'm just trying to parse simple code and detect SQL injections, which are the easiest kind to spot. I did it successfully on Python, which is my main language, but my company mostly uses Grails (on Groovy). </p>
  
  <p>This is what I have so far:</p>
  
  <pre><code>import org.codehaus.groovy.ast.expr.*;
  import org.codehaus.groovy.ast.stmt.*;
  import org.codehaus.groovy.ast.*
  import org.codehaus.groovy.control.CompilePhase
  import org.codehaus.groovy.ast.CodeVisitorSupport
  import org.codehaus.groovy.ast.builder.AstBuilder
  
  public class SecurityCheck extends CodeVisitorSupport {
      void visitBlockStatement(BlockStatement statement) {
          println "NEW BLOCK STATEMENT:"
          println statement.getText();
          //keep walking...
          statement.getStatements().each { ASTNode child -&gt;
              println "CHILD FOUND: "
              println child.getText();
              child.visit(this)
          }
      }
  }
  
  def code = new File('groovy_source.groovy').text // get the code from the source file
  def AstBuilder astBuilder = new AstBuilder()  // build an instance of the ast builder
  def ast = astBuilder.buildFromString(CompilePhase.CONVERSION, code) // build from string when the compiler converts from tokens to AST
  def SecurityCheck securityCheck = new SecurityCheck()  // create an instance of our security check class
  println ast
  println ast[0]
  ast[0].visit(securityCheck)
  </code></pre>
  
  <p>The groovy_source.groovy file is very simple, containing only a minimal file with a super easy to spot vulnerability:</p>
  
  <pre><code>def post(id) {
     query = "SELECT * FROM table WHERE id = " + id;
     result = sql.execute query
     return result;
  }
  </code></pre>
  
  <p>It is my understanding that, as I'm inheriting from CodeVisitorSupport, this would just visit a BlockStatement and then, for each statement inside that statement, it would visit it using the method from the supper class.</p>
  
  <p>Nevertheless, when I print the text from the BlockStatement, it is an empty string, and the for each method never even gets called (which I assume must mean the AST found no children for my block statement, even when the function definitively has statements inside it.</p>
  
  <pre><code>[org.codehaus.groovy.ast.stmt.BlockStatement@363a52f[]]  // println ast
  org.codehaus.groovy.ast.stmt.BlockStatement@363a52f[]  // println ast[0]
  NEW BLOCK STATEMENT:
  {  }  // println statement.getText()
  </code></pre>
  
  <p>Any help here would be tremendously appreciated. Thanks!</p>