Data and control flow analysis
Builds a code property graph or interprocedural model to answer reachability questions: can this null reach that dereference, which callers reach this function.
Sub-techniques
3
| ID | Name | Description |
|---|---|---|
V1014.001 | Interprocedural null and resource analysis | Report null dereferences and leaks along concrete paths. |
V1014.002 | Code property graph queries | Query syntax, control flow and data flow together to find custom bug patterns. |
V1014.003 | Call graph impact | List every caller and downstream consumer of a changed symbol. |
Craft it
- Run the analyzer on the default branch to establish a baseline.
- Run it on the change and report only new paths.
- Save the queries that found real bugs as regression rules.
Reverse engineer it
Signs that a codebase already runs this technique, and where to read how it is configured.
- infer or spotbugs tasks in the build, or Joern scripts in the repository.
- SCIP or LSIF index uploads in CI for code navigation.