[Paper Review] A Language-Independent Analysis Platform for Source Code

Konrad Weiß, Christian Banse|arXiv (Cornell University)|Mar 16, 2022

Software Engineering Research4 citations

TL;DR

This paper presents the CPG analysis platform, a language-independent source code analysis system that translates code into a unified code property graph (CPG) for static analysis. By leveraging fuzzy parsing and a graph-based representation, it enables precise, language-agnostic security and compliance checks across heterogeneous codebases, with evaluation showing efficient analysis of small to medium repositories in acceptable time.

ABSTRACT

In this paper, we present the CPG analysis platform, which enables the translation of source code into a programming language-independent representation, based on a code property graph. This allows security experts and developers to capture language level semantics for security analyses or identify patterns with respect to code compliance. Through the use of fuzzy parsing, also incomplete or non-compilable code, written in different programming languages, can be analyzed. The platform comprises an analysis library and interfaces to query, interact with or visualize source code graphs. This set of CPG tools allows finding common weaknesses in heterogeneous software environments, independently of the underlying programming language.

Motivation & Objective

• To enable secure, language-agnostic source code analysis for heterogeneous software systems.
• To support analysis of incomplete or non-compilable code during early development and audits.
• To provide a reusable, extensible platform for static analysis in CI/CD pipelines and security audits.
• To model fine-grained language semantics to improve analysis precision.
• To offer a unified graph-based representation that supports data flow, control flow, and type state analysis across languages.

Proposed method

• Translating source code from multiple languages (Java, C/C++, Go, Python, TypeScript, LLVM-IR) into a language-agnostic code property graph (CPG).
• Using fuzzy parsing to handle incomplete or non-compilable code by reconstructing syntactic structure from partial inputs.
• Representing code as a labeled, directed, multi-graph with nodes for syntactic elements and edges for relationships (e.g., control-flow, data-flow, call relations).
• Modeling ASTs with a semantic hierarchy of node types (e.g., Expression, CallExpression, MemberCallExpression) and edge indices to preserve order and context.
• Constructing an evaluation order graph (EOG) to capture fine-grained execution order, including side effects in expressions like a() + b() or ternary operations.
• Applying language-independent graph passes to enrich semantics (e.g., call resolution, data flow) and enabling query-based analysis via a standardized API.

Experimental results

Research questions

• RQ1 Can a unified, language-independent graph representation effectively model diverse programming language constructs for static analysis?
• RQ2 How accurately can fuzzy parsing reconstruct and analyze incomplete or non-compilable source code?
• RQ3 To what extent does the platform support precise, language-aware analysis while remaining independent of specific programming languages?
• RQ4 How efficient is the platform in analyzing real-world codebases across multiple languages?
• RQ5 Can the platform be effectively integrated into CI/CD pipelines and security audits for heterogeneous systems?

Key findings

• The platform successfully analyzed 211,541 SLoC of Java and 148,036 SLoC of C++ code in 1,042 and 687 seconds, respectively, demonstrating feasibility for small to medium repositories.
• Analysis of C++ code was faster per SLoC than Java, though coverage metrics suggest this may be due to slightly lower code coverage in C++.
• Graph-enriching passes (e.g., control-flow, data-flow) consumed 37% of total time for Java and 46% for C++, indicating intra-procedural operations dominate performance.
• The coverage metric is an upper bound due to unhandled AST nodes, with upper bounds of 99% for Java and 96% for C++, reflecting prioritization of common language features.
• 211,541 and 148,036 SLoC were analyzed in 1,042 and 687 seconds respectively, showing acceptable performance for CI/CD and audit scenarios.
• 200 repositories were evaluated, with 14 (3 Java, 12 C++) exceeding the 5-minute timeout, suggesting scalability challenges for very large codebases.