Package: joern-lib
IntroductionThis project offers a high level python library to perform code analysis with CPG and Joernserver. Several API methods including integration withNetworkXandPyTorch Geometricare offered to perform code analysis and research on complex code bases in a pythonic manner from cli and from notebooks.pipinstalljoern-lib# To install the optional science pack, clone this repo and use poetry > 1.5 to install the science grouppoetryinstall--withscience# cpupoetryinstall--withscience-cu117# cuda 11.7poetryinstall--withscience-cu118# cuda 11.8Notebook supportThe repository includes docker compose configuration to interactively query the joern server with polynote notebooks.UsageRun joern server and polynote locally.git clone https://github.com/appthreat/joern-lib.git
# Edit docker-compose.yml to set sources directory
docker compose up -d

# podman-compose up --buildNavigate tohttp://localhost:8192for an interactive polynote notebook. You could open one of the sample notebooks from thecontribdirectory to learn about Joern server and this library.Common stepsRefer to theAPI documentationfor programmatic usage.python -m asyncioExecute single queryfrom joern_lib import client, workspace, utils
from joern_lib.detectors import common as cpg

connection = await client.get("http://localhost:9000", "http://localhost:7072", "admin", "admin")

# connection = await client.get("http://localhost:9000")

res = await client.q(connection, "val a=1");

# {'response': 'a: Int = 1\n'}Execute bulk queryres = await client.bulk_query(connection, ["val a=1", "val b=2", "val c=a+b"]);
# [{'response': 'a: Int = 1\n'}, {'response': 'b: Int = 2\n'}, {'response': 'c: Int = 3\n'}]WorkspaceList workspacesres = await workspace.ls(connection)Get workspace pathres = await workspace.get_path(connection)
# /workspace (Response would be parsed)Check if cpg existsawait workspace.cpg_exists(connection, "NodeGoat")Import code for analysisres = await workspace.import_code(connection, "/app", "NodeGoat")
# TrueImport an existing CPG for analysisres = await workspace.import_cpg(connection, "/app/sandbox/crAPI/cpg_out/crAPI-python-cpg.bin.zip", "crAPI-python")Create a CPG with a remote cpggen serverres = await workspace.create_cpg(connection, "/app/sandbox/crAPI", out_dir="/app/sandbox/crAPI/cpg_out", languages="python", project_name="crAPI-python")CPG coreList filesres = await cpg.list_files(connection)
# list of filesPrint call treeres = await cpg.get_call_tree(connection, "com.example.vulnspring.WebController.issue:java.lang.String(org.springframework.ui.Model,java.lang.String)")
utils.print_tree(res)Java specificfrom joern_lib.detectors import javaList http routesawait java.list_http_routes(connection)JavaScript specificfrom joern_lib.detectors import jsList http routesawait js.list_http_routes(connection)Name of the variable containing express()await js.get_express_appvar(connection)List of require statementsawait js.list_requires(connection)List of import statementsawait js.list_imports(connection)List of NoSQL DB collection namesawait js.list_nosql_collections(connection)Get HTTP sourcesawait js.get_http_sources(connection)
await js.get_http_sinks(connection)AWSRequires TypeScript projectawait js.list_aws_modules(connection)TroubleshootingNo response from serverIf Joern server stops responding after a while restart docker.docker compose down
docker compose up -dWebsockets connection closed errorAdding asyncio.sleep(0) seems to fix such errors.# Workaround to fix websockets.exceptions.ConnectionClosedError
await asyncio.sleep(0)Alternatively, use the sync api.pygraphviz refuses to installpygraphviz/graphviz_wrap.c:2711:10: fatal error: graphviz/cgraph.h: No such file or directory
   2711 | #include "graphviz/cgraph.h"
        |          ^~~~~~~~~~~~~~~~~~~
  compilation terminated.
  error: command '/usr/bin/gcc' failed with exit code 1Installgraphviz-develorgraphviz-devpackage for your OS. Seehere