java.lang.Object
- com.tonic.analysis.cpg.query.CPGQuery

```
public class CPGQuery
extends Object
```
Fluent, stream-backed traversal over a CPG.

Constructor Summary

Constructors
Constructor Description

CPGQuery(CodePropertyGraph cpg)
Creates an empty query over a graph; select a starting set with methods like methods() or all().

Method Summary

All Methods Instance Methods Concrete Methods
Modifier and Type	Method	Description
`CPGQuery`	`all()`	Selects every node in the graph.
`CPGQuery`	`astChildren()`	Steps to direct AST children.
`CPGQuery`	`astDescendants()`	Expands to every transitive AST descendant, excluding the starting nodes.
`CPGQuery`	`astParent()`	Steps to AST parents.
`CPGQuery`	`blocks()`	Selects all basic block nodes.
`CPGQuery`	`both(CPGEdgeType... edgeTypes)`	Steps along edges in both directions.
`CPGQuery`	`callees()`	Steps to direct callees along call edges.
`CPGQuery`	`calleesTransitive()`	Expands to every transitive callee, excluding the starting nodes.
`CPGQuery`	`callers()`	Steps to direct callers along call edges.
`CPGQuery`	`callersTransitive()`	Expands to every transitive caller, excluding the starting nodes.
`CPGQuery`	`callSites()`	Selects all call site nodes.
`CPGQuery`	`callsTo(String owner, String method)`	Selects call sites targeting a method name regardless of descriptor.
`CPGQuery`	`callsTo(String owner, String method, String descriptor)`	Selects call sites targeting an exact method signature.
`CPGQuery`	`cfgNext()`	Steps to direct control-flow successors.
`CPGQuery`	`cfgPrev()`	Steps to direct control-flow predecessors.
`CPGQuery`	`cfgReachable()`	Expands to every node transitively reachable along control-flow edges, including the starting nodes.
`CPGQuery`	`controlDependents()`	Steps to nodes control-dependent on the current ones.
`long`	`count()`	Terminates the query by counting its nodes.
`CPGQuery`	`dataFlowIn()`	Steps backwards along data-flow edges to definition sources.
`CPGQuery`	`dataFlowOut()`	Steps forwards along data-flow edges to dependent uses.
`CPGQuery`	`dedup()`	Removes duplicate nodes from the result.
`boolean`	`exists()`	Terminates the query by testing for any result.
`CPGQuery`	`filter(Predicate<CPGNode> predicate)`	Keeps only nodes matching a predicate.
`CPGQuery`	`filterType(CPGNodeType... types)`	Keeps only nodes of the given node types.
`Optional<CPGNode>`	`first()`	Terminates the query with its first node.
`CPGQuery`	`flatMap(Function<CPGNode,Stream<CPGNode>> mapper)`	Replaces each node with the nodes produced by the mapper.
`void`	`forEach(Consumer<CPGNode> action)`	Terminates the query by applying an action to each node.
`CodePropertyGraph`	`getCpg()`
`Stream<CPGNode>`	`getCurrentNodes()`
`CPGQuery`	`hasProperty(String key)`	Keeps only nodes carrying a property.
`CPGQuery`	`hasProperty(String key, Object value)`	Keeps only nodes carrying a property with the given value.
`CPGQuery`	`in(CPGEdgeType... edgeTypes)`	Steps along incoming edges to their sources.
`CPGQuery`	`instructions()`	Selects all instruction nodes.
`CPGQuery`	`instructions(Class<? extends IRInstruction> type)`	Selects instruction nodes wrapping a specific IR instruction class.
`CPGQuery`	`isAllocation()`	Keeps only object or array allocation instructions.
`CPGQuery`	`isBranch()`	Keeps only conditional branch instructions.
`CPGQuery`	`isFieldAccess()`	Keeps only field access instructions.
`CPGQuery`	`isMethodCall()`	Keeps only call site nodes.
`CPGQuery`	`isReturn()`	Keeps only return instructions.
`CPGQuery`	`limit(int n)`	Truncates the result to at most n nodes.
`<T> Stream<T>`	`map(Function<CPGNode,T> mapper)`	Terminates the query by mapping each node to a value.
`CPGQuery`	`method(String owner, String name, String descriptor)`	Selects a single method by exact signature.
`CPGQuery`	`methods()`	Selects all method nodes.
`CPGQuery`	`methods(String namePattern)`	Selects method nodes whose name matches a regex.
`CPGQuery`	`nameMatches(String regex)`	Keeps only nodes whose name property matches a regex.
`CPGQuery`	`out(CPGEdgeType... edgeTypes)`	Steps along outgoing edges to their targets.
`CPGQuery`	`ownerMatches(String regex)`	Keeps only nodes whose owner or target owner property matches a regex.
`CPGQuery`	`skip(int n)`	Drops the first n nodes.
`List<CPGNode>`	`toList()`	Terminates the query into a list.
`Set<CPGNode>`	`toSet()`	Terminates the query into an insertion-ordered set.
`Stream<CPGNode>`	`toStream()`
`CPGQuery`	`where(CPGQuery subQuery)`	Keeps only the nodes the sub-query also yields.
`CPGQuery`	`whereNot(CPGQuery subQuery)`	Keeps only the nodes the sub-query does not yield.

Methods inherited from class java.lang.Object
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

- Constructor Detail
  - CPGQuery
```
public CPGQuery(CodePropertyGraph cpg)
```
    Creates an empty query over a graph; select a starting set with methods like methods() or all().
    
    Parameters:
    
    cpg - the graph to query
- Method Detail
  - getCpg
```
public CodePropertyGraph getCpg()
```
    Returns:
    
    the cpg
  - getCurrentNodes
```
public Stream<CPGNode> getCurrentNodes()
```
    Returns:
    
    the current nodes
  - methods
```
public CPGQuery methods()
```
    Selects all method nodes.
    
    Returns:
    
    a query positioned on every method
  - methods
```
public CPGQuery methods(String namePattern)
```
    Selects method nodes whose name matches a regex.
    
    Parameters:
    
    namePattern - the regex the method name must match in full
    
    Returns:
    
    a query positioned on the matching methods
  - method
```
public CPGQuery method(String owner,
                       String name,
                       String descriptor)
```
    Selects a single method by exact signature.
    
    Parameters:
    
    owner - the declaring class internal name
    
    name - the method name
    
    descriptor - the method descriptor
    
    Returns:
    
    a query positioned on the method, or an empty query
  - instructions
```
public CPGQuery instructions()
```
    Selects all instruction nodes.
    
    Returns:
    
    a query positioned on every instruction
  - instructions
```
public CPGQuery instructions(Class<? extends IRInstruction> type)
```
    Selects instruction nodes wrapping a specific IR instruction class.
    
    Parameters:
    
    type - the IR instruction class
    
    Returns:
    
    a query positioned on the matching instructions
  - callSites
```
public CPGQuery callSites()
```
    Selects all call site nodes.
    
    Returns:
    
    a query positioned on every call site
  - callsTo
```
public CPGQuery callsTo(String owner,
                        String method)
```
    Selects call sites targeting a method name regardless of descriptor.
    
    Parameters:
    
    owner - the target class internal name
    
    method - the target method name
    
    Returns:
    
    a query positioned on the matching call sites
  - callsTo
```
public CPGQuery callsTo(String owner,
                        String method,
                        String descriptor)
```
    Selects call sites targeting an exact method signature.
    
    Parameters:
    
    owner - the target class internal name
    
    method - the target method name
    
    descriptor - the target method descriptor
    
    Returns:
    
    a query positioned on the matching call sites
  - blocks
```
public CPGQuery blocks()
```
    Selects all basic block nodes.
    
    Returns:
    
    a query positioned on every block
  - all
```
public CPGQuery all()
```
    Selects every node in the graph.
    
    Returns:
    
    a query positioned on all nodes
  - out
```
public CPGQuery out(CPGEdgeType... edgeTypes)
```
    Steps along outgoing edges to their targets.
    
    Parameters:
    
    edgeTypes - the edge types to follow; empty follows every edge
    
    Returns:
    
    a query positioned on the reached nodes
  - in
```
public CPGQuery in(CPGEdgeType... edgeTypes)
```
    Steps along incoming edges to their sources.
    
    Parameters:
    
    edgeTypes - the edge types to follow; empty follows every edge
    
    Returns:
    
    a query positioned on the reached nodes
  - both
```
public CPGQuery both(CPGEdgeType... edgeTypes)
```
    Steps along edges in both directions.
    
    Parameters:
    
    edgeTypes - the edge types to follow; empty follows every edge
    
    Returns:
    
    a query positioned on the reached nodes
  - cfgNext
```
public CPGQuery cfgNext()
```
    Steps to direct control-flow successors.
    
    Returns:
    
    a query positioned on the successor nodes
  - cfgPrev
```
public CPGQuery cfgPrev()
```
    Steps to direct control-flow predecessors.
    
    Returns:
    
    a query positioned on the predecessor nodes
  - cfgReachable
```
public CPGQuery cfgReachable()
```
    Expands to every node transitively reachable along control-flow edges, including the starting nodes.
    
    Returns:
    
    a query positioned on the reachable nodes
  - astParent
```
public CPGQuery astParent()
```
    Steps to AST parents.
    
    Returns:
    
    a query positioned on the parent nodes
  - astChildren
```
public CPGQuery astChildren()
```
    Steps to direct AST children.
    
    Returns:
    
    a query positioned on the child nodes
  - astDescendants
```
public CPGQuery astDescendants()
```
    Expands to every transitive AST descendant, excluding the starting nodes.
    
    Returns:
    
    a query positioned on the descendant nodes
  - dataFlowIn
```
public CPGQuery dataFlowIn()
```
    Steps backwards along data-flow edges to definition sources.
    
    Returns:
    
    a query positioned on the source nodes
  - dataFlowOut
```
public CPGQuery dataFlowOut()
```
    Steps forwards along data-flow edges to dependent uses.
    
    Returns:
    
    a query positioned on the dependent nodes
  - controlDependents
```
public CPGQuery controlDependents()
```
    Steps to nodes control-dependent on the current ones.
    
    Returns:
    
    a query positioned on the dependent nodes
  - callers
```
public CPGQuery callers()
```
    Steps to direct callers along call edges.
    
    Returns:
    
    a query positioned on the calling nodes
  - callees
```
public CPGQuery callees()
```
    Steps to direct callees along call edges.
    
    Returns:
    
    a query positioned on the called nodes
  - callersTransitive
```
public CPGQuery callersTransitive()
```
    Expands to every transitive caller, excluding the starting nodes.
    
    Returns:
    
    a query positioned on the calling nodes
  - calleesTransitive
```
public CPGQuery calleesTransitive()
```
    Expands to every transitive callee, excluding the starting nodes.
    
    Returns:
    
    a query positioned on the called nodes
  - filter
```
public CPGQuery filter(Predicate<CPGNode> predicate)
```
    Keeps only nodes matching a predicate.
    
    Parameters:
    
    predicate - the node test
    
    Returns:
    
    a query positioned on the matching nodes
  - filterType
```
public CPGQuery filterType(CPGNodeType... types)
```
    Keeps only nodes of the given node types.
    
    Parameters:
    
    types - the accepted node types
    
    Returns:
    
    a query positioned on the matching nodes
  - hasProperty
```
public CPGQuery hasProperty(String key)
```
    Keeps only nodes carrying a property.
    
    Parameters:
    
    key - the property key
    
    Returns:
    
    a query positioned on the matching nodes
  - hasProperty
```
public CPGQuery hasProperty(String key,
                            Object value)
```
    Keeps only nodes carrying a property with the given value.
    
    Parameters:
    
    key - the property key
    
    value - the required value
    
    Returns:
    
    a query positioned on the matching nodes
  - where
```
public CPGQuery where(CPGQuery subQuery)
```
    Keeps only the nodes the sub-query also yields.
    
    Parameters:
    
    subQuery - the query whose nodes are kept
    
    Returns:
    
    a query positioned on the matching nodes
  - whereNot
```
public CPGQuery whereNot(CPGQuery subQuery)
```
    Keeps only the nodes the sub-query does not yield.
    
    Parameters:
    
    subQuery - the query whose nodes are dropped
    
    Returns:
    
    a query positioned on the matching nodes
  - isMethodCall
```
public CPGQuery isMethodCall()
```
    Keeps only call site nodes.
    
    Returns:
    
    a query positioned on the matching nodes
  - isFieldAccess
```
public CPGQuery isFieldAccess()
```
    Keeps only field access instructions.
    
    Returns:
    
    a query positioned on the matching nodes
  - isAllocation
```
public CPGQuery isAllocation()
```
    Keeps only object or array allocation instructions.
    
    Returns:
    
    a query positioned on the matching nodes
  - isReturn
```
public CPGQuery isReturn()
```
    Keeps only return instructions.
    
    Returns:
    
    a query positioned on the matching nodes
  - isBranch
```
public CPGQuery isBranch()
```
    Keeps only conditional branch instructions.
    
    Returns:
    
    a query positioned on the matching nodes
  - nameMatches
```
public CPGQuery nameMatches(String regex)
```
    Keeps only nodes whose name property matches a regex.
    
    Parameters:
    
    regex - the pattern the name must match in full
    
    Returns:
    
    a query positioned on the matching nodes
  - ownerMatches
```
public CPGQuery ownerMatches(String regex)
```
    Keeps only nodes whose owner or target owner property matches a regex.
    
    Parameters:
    
    regex - the pattern the owner must match in full
    
    Returns:
    
    a query positioned on the matching nodes
  - limit
```
public CPGQuery limit(int n)
```
    Truncates the result to at most n nodes.
    
    Parameters:
    
    n - the maximum number of nodes to keep
    
    Returns:
    
    a query positioned on the truncated set
  - skip
```
public CPGQuery skip(int n)
```
    Drops the first n nodes.
    
    Parameters:
    
    n - the number of nodes to skip
    
    Returns:
    
    a query positioned on the remaining nodes
  - dedup
```
public CPGQuery dedup()
```
    Removes duplicate nodes from the result.
    
    Returns:
    
    a query positioned on the distinct nodes
  - map
```
public <T> Stream<T> map(Function<CPGNode,T> mapper)
```
    Terminates the query by mapping each node to a value.
    
    Type Parameters:
    
    T - the result element type
    
    Parameters:
    
    mapper - the node transform
    
    Returns:
    
    a stream of mapped values
  - flatMap
```
public CPGQuery flatMap(Function<CPGNode,Stream<CPGNode>> mapper)
```
    Replaces each node with the nodes produced by the mapper.
    
    Parameters:
    
    mapper - the node expansion
    
    Returns:
    
    a query positioned on the produced nodes
  - toStream
```
public Stream<CPGNode> toStream()
```
    Returns:
    
    the current node stream
  - toList
```
public List<CPGNode> toList()
```
    Terminates the query into a list.
    
    Returns:
    
    the result nodes in encounter order
  - toSet
```
public Set<CPGNode> toSet()
```
    Terminates the query into an insertion-ordered set.
    
    Returns:
    
    the distinct result nodes
  - first
```
public Optional<CPGNode> first()
```
    Terminates the query with its first node.
    
    Returns:
    
    the first result node, if any
  - count
```
public long count()
```
    Terminates the query by counting its nodes.
    
    Returns:
    
    the number of result nodes
  - exists
```
public boolean exists()
```
    Terminates the query by testing for any result.
    
    Returns:
    
    whether the query matched at least one node
  - forEach
```
public void forEach(Consumer<CPGNode> action)
```
    Terminates the query by applying an action to each node.
    
    Parameters:
    
    action - the action to run per node

Class CPGQuery

Constructor Summary

Method Summary

Methods inherited from class java.lang.Object

Constructor Detail

CPGQuery

Method Detail

getCpg

getCurrentNodes

methods

methods

method

instructions

instructions

callSites

callsTo

callsTo

blocks

all

out

in

both

cfgNext

cfgPrev

cfgReachable

astParent

astChildren

astDescendants

dataFlowIn

dataFlowOut

controlDependents

callers

callees

callersTransitive

calleesTransitive

filter

filterType

hasProperty

hasProperty

where

whereNot

isMethodCall

isFieldAccess

isAllocation

isReturn

isBranch

nameMatches

ownerMatches

limit

skip

dedup

map

flatMap

toStream

toList

toSet

first

count

exists

forEach