Code Property Graph (CPG)

The Code Property Graph (CPG) is a language-agnostic graph representation of source code. The graph is composed of nodes and edges that represent various program properties. To understand the full structure of the CPG, you can explore the following specialized graph models and specifications:

• Graph Model: The fundamental structure of nodes and edges.
• Data Flow Graph (DFG): Represents how data moves through the program.
• Data Flow Graph (DFG) Function Summaries: Summaries of data flow behavior at the function level.
• Evaluation Order Graph (EOG): Represents the order in which expressions are evaluated.
• Program Dependence Graph (PDG): Represents dependencies between statements in a program.
• Inference Rules: The rules used to modify or augment the graph.
• Overlay Graphs: A mechanism to encode additional information on top of the base graph.

The CPG-Library provides the core interface for interacting with the graph. As a user of the library, you can perform the following tasks:

• Project Loading: Load entire projects or individual source files into the graph.
• Analysis & Visualization: Visualize the code structure and perform semantic analysis.
• Extensibility: Implement and register new Language Frontends to support additional languages.
• Component Modification: Extend and modify existing components, such as passes (analysis passes).
• Incremental Parsing: Parse code incrementally to handle changes efficiently.

The Code Property Graph (CPG) can be integrated and used in four primary ways depending on your requirements:

1. Using Codyze: For high-level interaction and exploration.
2. As a Kotlin/Java library: For programmatic access and integration into JVM-based applications.
3. With custom automated analyses via the Query API: For building specialized analysis tools and automated workflows.
4. Via Neo4j: For direct graph database access and visualization.

For the first three methods, you can use Shortcuts to quickly explore relevant information.

A Code Property Graph (CPG) is a representation of source code as a labelled directed multi-graph. In this model, every node and edge is assigned a set of key-value pairs called properties.

This structure allows source code to be stored in graph databases (such as Neo4j, Neptune, or Cosmos) and queried using graph query languages like Cypher, NQL, SQL, or Gremlin. This enables both manual navigation of code structures and automated pattern matching for security or logic analysis.

A Pass is a transformation unit that takes a prebuilt Code Property Graph (CPG)—which must at least contain the CPG-AST—and outputs a modified graph.

Passes are used to extend the syntactic representation of code by adding new nodes and edges that represent program semantics. They are designed to be executed in sequence, where the output of one pass becomes the input for the next.

A Code Property Graph (CPG) is a language-agnostic, graph-based representation of source code. It functions as a 'supergraph' that unites multiple code representations into a single structure, including:

• Abstract Syntax Tree (AST)
• Control Flow Graph (CFG)
• Evaluation Order Graph (EOG)
• Data Flow Graph (DFG)
• Control Dependence Graph (CDG)

This unified representation provides the necessary abstraction for conducting advanced static program analysis across different programming languages.

A Program Dependence Graph (PDG) is a graph representation that combines both data dependencies (DFG) and control dependencies (CDG).

By spanning both types of dependencies, the PDG allows you to determine if one node has an effect on another, whether through direct data flow or by impacting the execution path (control flow). This makes the PDG particularly useful for:

• Program Slicing: Determining the subset of a program that affects a specific value or node.
• Identifying Implicit Dataflows: Detecting information leakage where a value is not directly passed to a sink, but its properties influence the control flow that eventually reaches a sink (e.g., a secret value being used in an if condition that determines a printed output).

A standard Code Property Graph (CPG) represents a program using nodes ($N_{AST}$) from the Abstract Syntax Tree and various edges (AST, DFG, EOG, Call Graph, etc.). However, the standard CPG lacks semantic information or expert knowledge about specific frameworks.

An Overlay Graph extends the CPG by adding nodes ($N_O$) that are not part of the original AST. These overlay nodes are used to represent information not directly visible in the source code (e.g., semantic properties or framework-specific behaviors). Overlay nodes are connected to existing AST nodes via edges and can possess their own additional edges and properties.

The Code Property Graph (CPG) is a unified representation of source code designed to capture multiple dimensions of program semantics. When performing analysis or queries, you can rely on the CPG to represent the following properties:

• Structure/Syntax: The hierarchical arrangement of the code.
• Data Flows: How data moves through the program.
• Execution Order/Control Flow: The paths the program execution can take.
• Variable Usage: How variables are declared, assigned, and accessed.
• Calls: Function and method invocation relationships.
• The Type System: The relationships and constraints defined by the language's types.