Packages

  • package root
    Definition Classes
    root
  • package io
    Definition Classes
    root
  • package shiftleft
    Definition Classes
    io
  • package queryprimitives

    Domain specific language for querying code property graphs

    Domain specific language for querying code property graphs

    This is the API reference for the CPG query language, a language to mine code for defects and vulnerabilities both interactively on a code analysis shell (REPL), or using non-interactive scripts.

    Queries written in the CPG query language express graph traversals (see https://en.wikipedia.org/wiki/Graph_traversal). Similar to the standard graph traversal language "Gremlin" (see https://en.wikipedia.org/wiki/Gremlin_(programming_language))) these traversals are formulated as sequences of primitive language elements referred to as "steps". You can think of a step as a small program, similar to a unix shell utility, however, instead of processing lines one by one, the step processes nodes of the graph.

    Starting a traversal

    All traversals begin by selecting a set of start nodes, e.g.,

    cpg.method

    will start the traversal at all methods, while

    cpg.local

    will start at all local variables. The complete list of starting points can be found here: io.shiftleft.queryprimitives.steps.starters.Cpg

    Lazy evaluation

    Queries are lazily evaluated, e.g., cpg.method creates a traversal which you can add more steps to. You can, for example, evaluate the traversal by converting it to a list:

    cpg.method.toList

    Since toList is such a common operation, we provide the shorthand l, meaning that

    cpg.method.l

    provides the same result as the former query.

    Properties

    Nodes have "properties", key-value pairs where keys are strings and values are primitive data types such as strings, integers, or Booleans. Properties of nodes can be selected based on their key, e.g.,

    cpg.method.name

    traverses to all method names. Nodes can also be filtered based on properties, e.g.,

    cpg.method.name(".*exec.*")

    traverse to all methods where name matches the regular expression ".*exec.*". You can see a complete list of properties by browsing to the API documentation of the corresponding step. For example, you can find the properties of method nodes at io.shiftleft.queryprimitives.steps.types.structure.Method.

    Side effects

    Useful if you want to mutate something outside the traversal, or simply debug it: This prints all typeDecl names as it traverses the graph and increments i for each one.

    var i = 0
cpg.typeDecl.sideEffect{typeTemplate => println(typeTemplate.name); i = i + 1}.exec

    [advanced] Selecting multiple things from your traversal

    If you are interested in multiple things along the way of your traversal, you label anything using the as modulator, and use select at the end. Note that the compiler automatically derived the correct return type as a tuple of the labelled steps, in this case with two elements.

    cpg.method.as("method").definingTypeDecl.as("classDef").select.toList
// return type: List[(nodes.Method, nodes.TypeDecl)]

    [advanced] For comprehensions

    You can always start a new traversal from a node, e.g.,

    val someMethod = cpg.method.head
someMethod.start.parameter.toList

    You can use this e.g. in a for comprehension, which is (in this context) essentially an alternative way to select multiple intermediate things. It is more expressive, but more computationally expensive.

    val query = for {
  method <- cpg.method
  param <- method.start.parameter
} yield (method.name, param.name)

query.toList
    Definition Classes
    shiftleft
  • package steps

    Steps for traversing the code property graph

    Steps for traversing the code property graph

    All traversal start at io.shiftleft.queryprimitives.starters.Cpg.

    Definition Classes
    queryprimitives
  • package starters
    Definition Classes
    steps
  • Cpg
  • NodeTypeStarters

class Cpg extends NodeTypeStarters

Traversal starting point This is the starting point of all traversals. A variable of this type named cpg is made available in the REPL.

Linear Supertypes
NodeTypeStarters, AnyRef, Any
Ordering
  1. Alphabetic
  2. By Inheritance
Inherited
  1. Cpg
  2. NodeTypeStarters
  3. AnyRef
  4. Any
  1. Hide All
  2. Show All
Visibility
  1. Public
  2. All

Instance Constructors

  1. new Cpg(graph: Graph)

    graph

    the underlying graph

Value Members

  1. final def !=(arg0: Any): Boolean
    Definition Classes
    AnyRef → Any
  2. final def ##(): Int
    Definition Classes
    AnyRef → Any
  3. final def ==(arg0: Any): Boolean
    Definition Classes
    AnyRef → Any
  4. def all: CpgSteps[StoredNode, HNil]

    Traverse to all nodes.

    Traverse to all nodes.

    Definition Classes
    NodeTypeStarters
  5. def argument: Expression[HNil]

    Traverse to all arguments passed to methods

    Traverse to all arguments passed to methods

    Definition Classes
    NodeTypeStarters
  6. final def asInstanceOf[T0]: T0
    Definition Classes
    Any
  7. def call: Call[HNil]

    Traverse to all call sites

    Traverse to all call sites

    Definition Classes
    NodeTypeStarters
  8. def clone(): AnyRef
    Attributes
    protected[java.lang]
    Definition Classes
    AnyRef
    Annotations
    @native() @throws( ... )
  9. final def eq(arg0: AnyRef): Boolean
    Definition Classes
    AnyRef
  10. def equals(arg0: Any): Boolean
    Definition Classes
    AnyRef → Any
  11. def file: File[HNil]

    Traverse to all source files

    Traverse to all source files

    Definition Classes
    NodeTypeStarters
  12. def finalize(): Unit
    Attributes
    protected[java.lang]
    Definition Classes
    AnyRef
    Annotations
    @throws( classOf[java.lang.Throwable] )
  13. final def getClass(): Class[_]
    Definition Classes
    AnyRef → Any
    Annotations
    @native()
  14. val graph: Graph
  15. def hashCode(): Int
    Definition Classes
    AnyRef → Any
    Annotations
    @native()
  16. def identifier: Identifier[HNil]

    Traverse to all identifiers, e.g., occurrences of local variables or class members in method bodies.

    Traverse to all identifiers, e.g., occurrences of local variables or class members in method bodies.

    Definition Classes
    NodeTypeStarters
  17. final def isInstanceOf[T0]: Boolean
    Definition Classes
    Any
  18. def literal: Literal[HNil]

    Traverse to all literals (constant strings and numbers provided directly in the code).

    Traverse to all literals (constant strings and numbers provided directly in the code).

    Definition Classes
    NodeTypeStarters
  19. def local: Local[HNil]

    Traverse to all local variable declarations

    Traverse to all local variable declarations

    Definition Classes
    NodeTypeStarters
  20. def member: Member[HNil]

    Traverse to all class members

    Traverse to all class members

    Definition Classes
    NodeTypeStarters
  21. def method: Method[HNil]

    Traverse to all methods

    Traverse to all methods

    Definition Classes
    NodeTypeStarters
  22. def methodInst: MethodInst[HNil]

    Traverse to all method instances

    Traverse to all method instances

    Definition Classes
    NodeTypeStarters
  23. def methodReturn: MethodReturn[HNil]

    Traverse to all formal return parameters

    Traverse to all formal return parameters

    Definition Classes
    NodeTypeStarters
  24. def namespace: Namespace[HNil]

    Traverse to all namespaces, e.g., packages in Java.

    Traverse to all namespaces, e.g., packages in Java.

    Definition Classes
    NodeTypeStarters
  25. def namespaceBlock: NamespaceBlock[HNil]

    Traverse to all namespace blocks, e.g., packages in Java.

    Traverse to all namespace blocks, e.g., packages in Java.

    Definition Classes
    NodeTypeStarters
  26. final def ne(arg0: AnyRef): Boolean
    Definition Classes
    AnyRef
  27. final def notify(): Unit
    Definition Classes
    AnyRef
    Annotations
    @native()
  28. final def notifyAll(): Unit
    Definition Classes
    AnyRef
    Annotations
    @native()
  29. def param: MethodParameter[HNil]

    Traverse to all input parameters

    Traverse to all input parameters

    Definition Classes
    NodeTypeStarters
  30. implicit lazy val scalaGraph: ScalaGraph

    The underlying graph.

    The underlying graph.

    This member provides raw access to the underlying graph.

    Definition Classes
    Cpg → NodeTypeStarters
  31. final def synchronized[T0](arg0: ⇒ T0): T0
    Definition Classes
    AnyRef
  32. def toString(): String
    Definition Classes
    AnyRef → Any
  33. def typeDecl: TypeDecl[HNil]

    Traverse to all declarations, e.g., Set<T>

    Traverse to all declarations, e.g., Set<T>

    Definition Classes
    NodeTypeStarters
  34. def types: Type[HNil]

    Traverse to all types, e.g., Set<String>

    Traverse to all types, e.g., Set<String>

    Definition Classes
    NodeTypeStarters
  35. final def wait(): Unit
    Definition Classes
    AnyRef
    Annotations
    @throws( ... )
  36. final def wait(arg0: Long, arg1: Int): Unit
    Definition Classes
    AnyRef
    Annotations
    @throws( ... )
  37. final def wait(arg0: Long): Unit
    Definition Classes
    AnyRef
    Annotations
    @native() @throws( ... )

Inherited from NodeTypeStarters

Inherited from AnyRef

Inherited from Any

Ungrouped