{"id":13906351,"url":"https://github.com/ShiftLeftSecurity/codepropertygraph","last_synced_at":"2025-07-18T04:31:01.788Z","repository":{"id":38421414,"uuid":"139046493","full_name":"ShiftLeftSecurity/codepropertygraph","owner":"ShiftLeftSecurity","description":"Code Property Graph: specification, query language, and utilities","archived":false,"fork":false,"pushed_at":"2025-07-15T09:55:52.000Z","size":9448,"stargazers_count":518,"open_issues_count":26,"forks_count":77,"subscribers_count":32,"default_branch":"master","last_synced_at":"2025-07-15T21:00:57.025Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Scala","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ShiftLeftSecurity.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2018-06-28T17:00:00.000Z","updated_at":"2025-07-15T09:18:00.000Z","dependencies_parsed_at":"2023-10-10T16:05:22.680Z","dependency_job_id":"bade4921-1817-48ca-b7d1-72094dc39bd3","html_url":"https://github.com/ShiftLeftSecurity/codepropertygraph","commit_stats":{"total_commits":1678,"total_committers":34,"mean_commits":49.35294117647059,"dds":0.66746126340882,"last_synced_commit":"fdb95ad27e67ba1f642b191f5885a43fe8e2dc5a"},"previous_names":[],"tags_count":1707,"template":false,"template_full_name":null,"purl":"pkg:github/ShiftLeftSecurity/codepropertygraph","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ShiftLeftSecurity%2Fcodepropertygraph","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ShiftLeftSecurity%2Fcodepropertygraph/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ShiftLeftSecurity%2Fcodepropertygraph/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ShiftLeftSecurity%2Fcodepropertygraph/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ShiftLeftSecurity","download_url":"https://codeload.github.com/ShiftLeftSecurity/codepropertygraph/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ShiftLeftSecurity%2Fcodepropertygraph/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":265523797,"owners_count":23781870,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-06T23:01:34.026Z","updated_at":"2025-07-18T04:31:01.405Z","avatar_url":"https://github.com/ShiftLeftSecurity.png","language":"Scala","funding_links":[],"categories":["Scala"],"sub_categories":[],"readme":"[![CI pipeline](https://github.com/ShiftLeftSecurity/codepropertygraph/actions/workflows/release.yml/badge.svg)](https://github.com/ShiftLeftSecurity/codepropertygraph/actions/workflows/release.yml)\n[![Maven Central](https://maven-badges.herokuapp.com/maven-central/io.shiftleft/codepropertygraph_3/badge.svg)](https://maven-badges.herokuapp.com/maven-central/io.shiftleft/codepropertygraph_3)\n\n# Code Property Graph - Specification and Tooling\n\nYou can find a clickable specification at:\n\nhttps://cpg.joern.io\n\n**Note: for first-time users, we recommend building \"joern\" at https://github.com/joernio/joern/ instead. It combines this repo with a C/C++ language frontend to construct a complete code analysis platform.**\n\nA Code Property Graph (CPG) is an extensible and language-agnostic\nrepresentation of program code designed for incremental and\ndistributed code analysis. This repository hosts the base\nspecification together with a build process that generates data\nstructure definitions for accessing the graph with different\nprogramming languages.\n\nWe are publishing the Code Property Graph specification as a\nsuggestion for an open standard for the exchange of code in\nintermediate representations along with analysis results. With this\ngoal in mind, the specification consists of a minimal base schema that\ncan be augmented via extension schemas to enable storage of\napplication-specific data.\n\n# Usage as a dependency\n`build.sbt`:\n```\nlibraryDependencies += \"io.shiftleft\" %% \"codepropertygraph\" % \"x.y.z\"\n```\n\n# Building the code\n\nThe build process has been verified on Linux and it should be possible\nto build on OS X and BSD systems as well. The build process requires\nthe following prerequisites:\n\n* [Java runtime 11](http://openjdk.java.net/install/)\n* [Scala build tool (SBT)](https://www.scala-sbt.org/)\n* [Git-lfs](https://git-lfs.github.com/)\n* [Protocol Buffer](https://github.com/protocolbuffers/protobuf/releases)\n\nSome binary files required for testing are managed through `git-lfs`. If you haven't cloned this repository yet, simply run `git lfs install`.\nIf you have cloned it already, additionally run `git lfs pull` (from within the repository).\n\nAdditional build-time dependencies are automatically downloaded as\npart of the build process. To build and install into your local Maven\ncache, issue the command `sbt clean test publishM2`.\n\n# Code style\n\nCode style is automatically verified by [scalafmt](https://github.com/scalameta/scalafmt)\n\nIf your PR build fails code formatting check, simply run `sbt scalafmt` and submit the change along with the rest of the code. The commands runs necessary formatting in the right order.\n\n# Creating Protocol Buffer bindings for different languages\n\nThe _codepropertygraph-VERSION.jar_ artifact contains a Protocol Buffer definition file _cpg.proto_ that you\ncan use to generate your own language-specific bindings. For instance, to create C++ and Python bindings, issue the following series of commands:\n\n```\nsbt package\ncd codepropertygraph/target\nmkdir cpp python\nprotoc --cpp_out=cpp --python_out=python cpg.proto\n```\n\n# Loading a codepropertygraph\n\nHere's how you can load a cpg into ShiftLeft Tinkergraph [3] in the sbt console - the next section will list some queries you can interactively run from there.\n\nThere are some sample cpgs in this repository in the `resources/testcode/cpgs` directory.\nYou can run `./regenerate-test-cpgs.sh` to update them, but this requires the proprietary java2cpg installed locally.\n\n### [Tinkergraph (in memory reference db)](http://tinkerpop.apache.org/docs/current/reference/#tinkergraph-gremlin)\n```\nsbt semanticcpg/console\n```\n```scala\nimport io.shiftleft.codepropertygraph.generated.Cpg\nimport io.shiftleft.semanticcpg.language._\nval cpg = io.shiftleft.codepropertygraph.cpgloading.CpgLoader.load(\"./resources/testcode/cpgs/hello-shiftleft-0.0.5/cpg.bin.zip\")\n```\n\n# Querying the cpg\n\nOnce you've loaded a cpg you can run queries, which are provided by the `query-primitives` subproject. Note that if you're in the sbt shell you can play with it interactively: `TAB` completion is your friend. Otherwise your IDE will assist.\n\nHere are some simple traversals to get all the base nodes. Running all of these without errors is a good test to ensure that your cpg is valid:\n\n```scala\ncpg.literal.toList\ncpg.file.toList\ncpg.namespace.toList\ncpg.types.toList\ncpg.methodReturn.toList\ncpg.parameter.toList\ncpg.member.toList\ncpg.call.toList\ncpg.local.toList\ncpg.identifier.toList\ncpg.argument.toList\ncpg.typeDecl.toList\ncpg.method.toList\n```\n\nFrom here you can traverse through the cpg. The query-primitives DSL ensures that only valid steps are available - anything else will result in a compile error:\n\n```scala\ncpg.method.name(\"getAccountList\").parameter.toList\n/* List(\n *   MethodParameterIn(Some(v[7054781587948444580]),this,0,this,BY_SHARING,io.shiftleft.controller.AccountController,Some(28),None,None,None),\n *   MethodParameterIn(Some(v[7054781587948444584]),request,2,request,BY_SHARING,javax.servlet.http.HttpServletRequest,Some(28),None,None,None),\n *   MethodParameterIn(Some(v[7054781587948444582]),response,1,response,BY_SHARING,javax.servlet.http.HttpServletResponse,Some(28),None,None,None)\n *   )\n **/\n\ncpg.method.name(\"getAccountList\").definingTypeDecl.toList.head\n// TypeDecl(Some(v[464]),AccountController,io.shiftleft.controller.AccountController,false,List(java.lang.Object))\n```\n\n# Scripts\n\n## Dump the CPG schema\n\nYou can dump the current Code Property Graph schema using the `schema2json.sh`\nbash script.\n\n```bash\n./schema2json.sh\nSchema written to: /tmp/schema.json\n```\n\n# Further Reading\n\n- Rodriguez and Neubauer - The Graph Traversal Pattern: https://pdfs.semanticscholar.org/ae6d/dcba8c848dd0a30a30c5a895cbb491c9e445.pdf\n\n- Yamaguchi et al. - Modeling and Discovering Vulnerabilities with Code Property Graphs: https://www.sec.cs.tu-bs.de/pubs/2014-ieeesp.pdf\n\n- The ShiftLeft Tinkergraph: https://github.com/ShiftLeftSecurity/tinkergraph-gremlin\n\n- ShiftLeft OverflowDB: https://github.com/ShiftLeftSecurity/overflowdb\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FShiftLeftSecurity%2Fcodepropertygraph","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FShiftLeftSecurity%2Fcodepropertygraph","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FShiftLeftSecurity%2Fcodepropertygraph/lists"}