---
id: wiki-2026-0508-코드-속성-그래프-cpg
title: 코드 속성 그래프 CPG
category: 10_Wiki/Topics
status: verified
canonical_id: self
aliases: [Code Property Graph, CPG, Joern]
duplicate_of: none
source_trust_level: A
confidence_score: 0.9
verification_status: applied
tags: [static-analysis, security, graph, cpg]
raw_sources: []
last_reinforced: 2026-05-10
github_commit: pending
tech_stack:
  language: Scala / Python
  framework: Joern / CodeQL
---

# 코드 속성 그래프 CPG

## 매 한 줄
> **"매 AST + CFG + PDG 의 unified graph — 매 한 query 의 vulnerability 의 발견."**. 매 Yamaguchi et al. (2014) 의 IEEE S&P 에서 introduce, 매 Joern 의 open-source flagship, 매 GitHub CodeQL 의 commercial 형태. 매 SAST 의 modern foundation.

## 매 핵심

### 매 구성 layer
- **AST (Abstract Syntax Tree)**: 매 syntactic structure — 매 node 의 declaration, expression, statement.
- **CFG (Control Flow Graph)**: 매 execution order — 매 branch, loop, function call.
- **PDG (Program Dependence Graph)**: 매 data + control dependency — 매 variable 의 def-use chain.
- **Call Graph**: 매 inter-procedural connection — 매 caller / callee.

### 매 query language
- **Joern CPGQL**: 매 Scala-based DSL — `cpg.method.name(".*sql.*").parameter`.
- **CodeQL**: 매 Datalog-inspired — 매 GitHub Security 의 powering.
- **Semgrep**: 매 lightweight pattern matching — 매 CPG 의 simplified form.

### 매 응용
1. **Vulnerability detection**: 매 SQL injection, XSS, buffer overflow 의 taint analysis.
2. **API misuse**: 매 unsafe deserialization, hardcoded secret 의 탐지.
3. **Refactoring**: 매 dead code, duplicated pattern 의 발견.

## 💻 패턴

### Joern 의 SQL injection 탐지
```scala
// Joern shell
importCode("/path/to/project")

// 매 user input → SQL query 의 taint flow
def source = cpg.call.name("getParameter").argument
def sink = cpg.call.name("executeQuery").argument
sink.reachableByFlows(source).p
```

### CodeQL 의 path injection
```ql
import javascript

from PathExpr path, DataFlow::Node source
where
  source.asExpr() instanceof RemoteFlowSource and
  DataFlow::localFlow(source, DataFlow::valueNode(path))
select path, "Path constructed from user input"
```

### Joern 의 API misuse
```scala
// 매 MD5 의 사용 의 탐지
cpg.call
  .name("getInstance")
  .where(_.argument.code(".*MD5.*"))
  .location.toJson
```

### Python 의 CPG construction
```python
from joern_lib import CPGQLSClient

async def find_vulns():
    async with CPGQLSClient("localhost:8080") as client:
        await client.execute(f'importCode("{path}")')
        result = await client.execute(
            'cpg.method.name(".*deserialize.*").l'
        )
        return result
```

### CodeQL 의 custom query 의 CI
```yaml
# .github/workflows/codeql.yml
name: CodeQL
on: [push, pull_request]
jobs:
  analyze:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: github/codeql-action/init@v3
        with:
          languages: javascript, python
          queries: ./custom-queries
      - uses: github/codeql-action/analyze@v3
```

### Semgrep rule
```yaml
# .semgrep/sql-injection.yml
rules:
  - id: sqli-string-concat
    pattern: |
      $CONN.execute("..." + $USER_INPUT)
    message: SQL injection — 매 parameterized query 의 사용
    severity: ERROR
    languages: [python]
```

### Taint analysis 의 flow
```scala
// Joern — 매 source → sink 의 path 의 추출
val flows = cpg.method
  .name("handleRequest")
  .ast.isCall.name("exec")
  .reachableByFlows(cpg.parameter)
  .map(_.elements.map(_.code))
```

## 매 결정 기준
| 상황 | Approach |
|---|---|
| 매 OSS / self-host | Joern |
| 매 GitHub repo | CodeQL (free for public) |
| 매 lightweight rule | Semgrep |
| 매 enterprise SAST | Checkmarx / Veracode |
| 매 LLM-augmented | Snyk Code / GitHub Copilot Autofix |

**기본값**: 매 GitHub repo — CodeQL. 매 self-host — Joern. 매 quick rule — Semgrep.

## 🔗 Graph
- 부모: [[Static Analysis]] · [[Program Analysis]]
- 변형: [[AST]]
- 응용: [[SAST]]
- Adjacent: [[LLM-based_Code_Analysis]] · [[정적 분석(Static Analysis)]]

## 🤖 LLM 활용
**언제**: 매 CPG query 의 explanation, 매 vulnerability finding 의 triage, 매 false positive 의 review.
**언제 X**: 매 CPG 의 construction 자체 — 매 deterministic tool (Joern, CodeQL) 의 우선.

## ❌ 안티패턴
- **Manual taint tracking**: 매 grep + manual review — 매 inter-procedural flow 의 누락.
- **Single-layer analysis**: 매 AST-only 의 의존 — 매 control / data flow 의 정보 누락.
- **Rule explosion**: 매 1000+ rule 의 false positive 의 폭증 — 매 high-signal rule 의 우선.
- **CI 의 block**: 매 모든 finding 의 build break — 매 severity 의 gating.

## 🧪 검증 / 중복
- Verified (Yamaguchi et al. 2014 IEEE S&P, Joern docs, GitHub CodeQL docs).
- 신뢰도 A.

## 🕓 Changelog
| 날짜 | 변경 |
|---|---|
| 2026-05-08 | Phase 1 |
| 2026-05-10 | Manual cleanup — CPG 의 layers + Joern/CodeQL queries |
