CPG Reachability Tools

The cpg_reachability pipeline uses a Code Property Graph (CPG) to determine whether code symbols referenced by a vulnerability patch are reachable from a public entry point in your codebase. Each advisory is classified as yes, unknown, or no.

Requirements

• Fraunhofer CPG tool installed and configured.

• A running Neo4j instance with the APOC plugin:

docker run -d --name neo4j \
  -p 7474:7474 -p 7687:7687 \
  -e NEO4J_AUTH=neo4j/password \
  -e NEO4J_PLUGINS='["apoc"]' \
  -e NEO4J_server_memory_heap_max__size=6g \
  -e NEO4J_server_memory_pagecache_size=1g \
  neo4j:5

Configuration

Set these environment variables in your .env:

CPG_NEO4J_HOST="localhost"       # Neo4j host
CPG_NEO4J_PORT="7687"            # Neo4j port
CPG_NEO4J_USER="neo4j"            # Neo4j username
CPG_NEO4J_PASSWORD="password"    # Neo4j password
CPG_NEO4J_EXECUTABLE="./cpg/cpg-neo4j/build/install/cpg-neo4j/bin/cpg-neo4j"  # Path to the ``cpg-neo4j`` executable

Running the pipeline

1. Open a Project that contains resources and at least one package vulnerability.

2. Click “Add pipeline” and select “cpg_reachability”.

3. Select “Execute pipeline now” and click “Add pipeline”.

4. After completion, open the Resources view (click the count under “RESOURCES”), then click an affected file and open the Extra tab to view the symbols_reachability data.

Output

The pipeline writes two timestamped JSON reports and embeds the same advisory data in each resource’s extra_data.symbols_reachability.

1. reachability-YYYY-MM-DD-HH-MM-SS.json the advisory reachability report. Aggregates results per advisory, listing each advisory with its overall verdict, matched vulnerable/fixed symbols, and per-symbol witness paths. Schema:

{
  "purl": "pkg:pypi/b2sdk@1.14.0",
  "advisories": [
    {
      "advisory_uid": "pypa/b2sdk/PYSEC-2022-33",
      "is_reachable": "yes",
      "details": [
        {
          "symbol_name": "SqliteAccountInfo._create_database",
          "is_defined": true,
          "is_reachable": true,
          "eog_path": [
            "b2sdk.scan_folder",
            "b2sdk.LocalSyncFolder._get_folder",
            "SqliteAccountInfo._create_database"
          ]
        }
      ],
      "vulnerable_symbols": [
        "SqliteAccountInfo",
        "SqliteAccountInfo._create_database"
      ],
      "fixed_symbols": [
        "SqliteAccountInfo",
        "SqliteAccountInfo._create_database"
      ]
    }
  ]
}

2. cpg_reachability-YYYY-MM-DD-HH-MM-SS.json the graph generated from CPG tool, serialized as a node/edge document.

{
   "nodes": [...],
   "edges": [...]
}