cpg-analysis

name	cpg-analysis
description	This skill should be used when the user asks about "Code Property Graph", "CPG analysis", "Joern queries", "CPGQL", "data flow verification", "taint tracking with Joern", "semantic code analysis", or needs to understand how CPG-based verification works for vulnerability detection.
version	1.0.0

Code Property Graph (CPG) Analysis

What is a Code Property Graph?

A Code Property Graph (CPG) is a unified data structure that combines three representations of code:

1. Abstract Syntax Tree (AST) - Structural representation
2. Control Flow Graph (CFG) - Execution paths
3. Program Dependence Graph (PDG) - Data and control dependencies

This combination enables powerful semantic queries that pattern-matching tools cannot achieve.

When to Use CPG vs Pattern Matching

Approach	Use When	Example
Pattern Matching (Semgrep)	Known vulnerability patterns, syntax-level issues	Finding dynamic code execution calls
CPG Analysis (Joern)	Data flow tracking, cross-function analysis	Proving request input reaches database query through 5 functions

Rule of thumb: Use CPG when you need to prove data flows between points, especially across function boundaries.

Joern Overview

Joern is the primary tool for CPG analysis. It:

• Parses source code into CPG representation
• Provides CPGQL (Scala-based) query language
• Supports JavaScript, TypeScript, Python, Java, C/C++, Go, PHP

Basic Joern Workflow

# 1. Parse codebase into CPG
joern-parse /path/to/code --output cpg.bin

# 2. Start Joern REPL or run scripts
joern --script analysis.sc --params cpgFile=cpg.bin

# 3. Or use Joern REPL interactively
joern
> importCpg("cpg.bin")
> cpg.method.name(".*login.*").l

CPGQL Query Language

CPGQL uses Scala syntax with CPG-specific operations.

Core Concepts

Nodes: Represent code elements

• cpg.method - All methods/functions
• cpg.call - All function calls
• cpg.parameter - Function parameters
• cpg.literal - Literal values
• cpg.identifier - Variable references

Traversals: Navigate the graph

• .name("pattern") - Filter by name (regex)
• .code("pattern") - Filter by code content
• .argument - Get call arguments
• .caller - Get calling methods
• .callee - Get called methods

Data Flow: Track how data moves

• .reachableBy(source) - Find if source reaches this point
• .reachableByFlows(source) - Get full paths

Common Query Patterns

Find all calls to a function:

cpg.call.name("query").l

Find parameters that reach dangerous sinks:

val sources = cpg.parameter.name("req.*|request.*")
val sinks = cpg.call.name("query|execute|run")
sinks.argument.reachableBy(sources).l

Get full data flow paths:

val sources = cpg.parameter.name("userInput")
val sinks = cpg.call.name("executeQuery")
sinks.argument.reachableByFlows(sources).p

Confidence Scoring

After CPG verification:

Verification Result	Confidence	Meaning
Data flow confirmed	HIGH (0.9+)	CPG proves exploitability
Partial flow found	MEDIUM (0.6-0.9)	Some path exists, manual review needed
No flow found	LOW (0.3-0.6)	May be false positive or complex flow
Verification failed	UNKNOWN	Query error, manual analysis required

Skill References

• references/cpgql-patterns.md - Common vulnerability query patterns
• references/joern-cheatsheet.md - Quick Joern/CPGQL reference

Related Skills

• data-flow-tracing - Manual source-to-sink analysis
• dangerous-functions - Sink identification by language
• vuln-patterns - Pattern-based vulnerability knowledge