Locating security vulnerabilities in source code

Abstract

A tool ( 22 ) automatically analyzes application source code ( 16 ) for application level vulnerabilities. The tool integrates seamlessly into the software development process, so vulnerabilities are found early in the software development life cycle, when removing the defects is far cheaper than in the post-production phase. Operation of the tool is based on static analysis, but makes use of a variety of techniques, for example methods of dealing with obfuscated code.

1 - 13 . (canceled) 
   
   
       1 . The method according to  claim 67 ,
 wherein said variables comprise data structures having member variables, said member variables having member names   and wherein constructing said model comprises assigning respective identifiers to said member variables, and   wherein analyzing said graph comprises identifying references to a predetermined member variable using said respective identifiers thereof, wherein said member name of said predetermined member variable is identical to said member name of another member variable.   
   
   
       2 . The method according to  claim 68 , wherein said source code is written in an object oriented language. 
   
   
       3 . The method according to  claim 2 , wherein said object oriented language comprises a currently active object, and said data flow graph comprises called methods, wherein said step of deriving a data flow graph comprises using said currently active object as a parameter to said called methods. 
   
   
       4 . The method according to  claim 67 , further comprising the step of modifying said source code to remove said security vulnerability. 
   
   
       5 . The method according to  claim 68 , wherein said step of analyzing comprises code-slicing said control dependence graph to define blocks of said control dependence graph that represent atomic elements of said source code, wherein no more than a single action is performed. 
   
   
       6 . (canceled) 
   
   
       7 . The method according to  claim 68 , wherein said step of analyzing comprises the steps of:
 identifying data flow nodes in said data flow graph wherein input data is validated; and   verifying that said input data is validated in said identified data flow nodes in accordance with a predetermined specification.   
   
   
       8 . The method according to  claim 67 , wherein said security vulnerability comprises a logical error wherein a portion of said source code is non-compliant with a specification thereof. 
   
   
       9 . The method according to  claim 67 , wherein said security vulnerability comprises an unenforced restriction on user access. 
   
   
       10 . The method according to  claim 67 , wherein said step of analyzing comprises a revelation of a data access layer methodology. 
   
   
       11 . The method according to  claim 67 , wherein said security vulnerability comprises an ability of a user to display a hidden field of a web page. 
   
   
       12 . The method according to  claim 67 , wherein said security vulnerability comprises an enablement of I/O operations on a virtual directory. 
   
   
       13 . The method according to  claim 67 , wherein said step of analyzing comprises applying software fault tree analysis to said source code. 
   
   
       14 . The method according to  claim 67 , further comprising the step of generating test cases for a data validation function to identify scenarios wherein said data validation function fails. 
   
   
       15 . The method according to  claim 67 , further comprising the steps of:
 automatically preparing a configuration file that specifies access privileges to objects of said computer program;   querying said configuration file to determine that said access privileges exist for predetermined ones of said objects; and   canceling said access privileges for said predetermined ones of said objects.   
   
   
       16 . The method according to  claim 68 , wherein said control flow graph, said data flow graph and said control dependence graph correspond to a single function of said computer program. 
   
   
       17 . The method according to  claim 67 , wherein said source code is obfuscated. 
   
   
       18 . The method according to  claim 67 ,
 wherein constructing said graph comprises constructing a control flow graph   and deriving a control dependence graph from said control flow graph having control dependence nodes, and   wherein analyzing comprises traversing a first portion of said control dependence graph a first time, and marking a traversed segment of said control dependence graph; and thereafter traversing a second time a second portion of said control dependence graph that includes said marked segment by skipping said marked segment.   
   
   
       19 . (canceled) 
   
   
       20 . The method according to  claim 18 , wherein said step of analyzing comprises code-slicing said control dependence graph to identify only said control dependence nodes thereof that affect a predetermined one of said variables, wherein only semantics-preserving operations are performed on said control dependence graph. 
   
   
       21 - 35 . (canceled) 
   
   
       22 . The method according to  claim 67 ,
 wherein constructing said graph comprises constructing a control flow graph   and deriving a data flow graph from said control flow graph, said data flow graph comprising data flow nodes and data flow edges connecting said data flow nodes   wherein analyzing comprises the steps of:   in said data flow graph identifying first data flow nodes wherein input is accepted, second data flow nodes wherein data is validated, and third data flow nodes wherein data is consumed;   removing said second data flow nodes from said data flow graph;   thereafter determining that one of said third data flow nodes is connected to one of said first data flow nodes by one of said data flow edges; and   reporting said one third data flow node as having an unvalidated input vulnerability.   
   
   
       23 . The method according to  claim 22 , wherein said step of analyzing comprises the steps of:
 identifying data flow nodes in said data flow graph wherein input data is validated; and   verifying that said input data is validated in said identified data flow nodes in accordance with a predetermined specification.   
   
   
       24 - 40 . (canceled) 
   
   
       25 . The method according to claim
 wherein constructing said graph comprises constructing a control flow graph comprising nodes, wherein said control flow graph describes a plurality of functions in said source code, said variables further comprise global variables, and said global variables are passed to said functions as a super-global variable having said global variables as data members thereof.   
   
   
       26 - 44 . (canceled) 
   
   
       27 . The method according to  claim 67 ,
 wherein constructing said graph comprises constructing a control flow graph comprising nodes, and deriving a data flow graph from said control flow graph, said data flow graph comprising data flow nodes and data flow edges connecting said data flow nodes, wherein deriving a data flow graph is performed by the steps of:   associating a first array and a second array with each of said data flow nodes, wherein said first array holds static information regarding ones of said variables on which its respective associated data flow node depends, and said second array holds information that identifies other variables that influence said associated data flow node, said other variables being associated with others of said data flow nodes;   performing a traversal of said control flow graph, and at each of said nodes thereof establishing said information in said second array of a corresponding data flow node in said data flow graph; and   responsively to said step of establishing said information, constructing said data flow edges to connect said data flow nodes with said others of said data flow nodes, respectively.   
   
   
       28 - 48 . (canceled) 
   
   
       29 . The method according to  claim 67 ,
 wherein said variables comprise member variables, said member variables having member names   and   wherein constructing said graph comprises constructing a control flow graph comprising nodes, each of said nodes having a topological order in said control flow graph, and a portion of said nodes having at least one child node,   and   deriving a control dependence graph from said control flow graph having control dependence nodes wherein deriving a control dependence graph is performed by the steps of:   assigning each of said nodes of said control flow graph an innate property that is inherited by said at least one child node thereof in equal proportions as inherited properties therein;   in each of said nodes canceling ones of said inherited properties that sum to said innate property thereof;   maintaining respective inheritance records of said inherited properties of said nodes, said inheritance records comprising identifications of said nodes that are sources of origin of respective said inherited properties;   identifying an entry node in said control flow graph;   identifying a first set of said nodes, members of said first set lacking said inherited properties;   establishing respective first edges between members of first set and said entry node;   identifying a second set of said nodes, wherein members of said second set have inherited properties;   identifying in members of said second set a respective closest topological order of said sources of origin in said inheritance records thereof, respectively; and   constructing second edges between said members of said second set and said sources of origin having said closest topological order, respectively.   
   
   
       30 - 66 . (canceled) 
   
   
       67 . A computer-implemented method for detecting security vulnerabilities in a computer program, comprising the steps of:
 receiving into a memory source code of said computer program to be analyzed, said source code comprising code elements and statements, at least a portion of said statements referencing variables;   constructing, using a source code analyzer running on a processor, an object-oriented model of said source code, wherein said code elements are represented by respective objects;   using said model, constructing a graph representing a flow of said computer program;   receiving a query, in a predefined code graph query language, with respect to a security vulnerability;   analyzing said graph responsively to said query so as to identify a portion of said source code having said security vulnerability; and   reporting said security vulnerability.   
   
   
       68 . The method according to  claim 67 , wherein constructing said graph comprises:
 constructing a control flow graph;   deriving a data flow graph from said control flow graph, said data flow graph comprising data flow nodes and data flow edges connecting said data flow nodes; and   deriving a control dependence graph from said control flow graph, said control dependence graph comprising control dependence nodes, and   wherein analyzing said graph comprises analyzing one or more of said control flow graph, said data flow graph, and said control dependence graph.   
   
   
       69 . A data processing system for detecting security vulnerabilities in a computer program, comprising:
 a memory having computer program instructions stored therein;   an I/O facility; and   a processor accessing said memory to read said instructions, wherein said instructions cause said processor to receive, via said I/O facility, source code of said computer program to be analyzed, said source code comprising code elements and statements, at least a portion of said statements referencing variables, to construct an object-oriented model of said source code, wherein said code elements are represented by respective objects, to construct, using said model, a graph representing a flow of said computer program, to receive a query, in a predefined code graph query language, with respect to a security vulnerability, to analyze said graph responsively to said query so as to identify a portion of said source code having said security vulnerability, and to report said security vulnerability.   
   
   
       70 . A computer software product for detecting security vulnerabilities in a computer program, including a tangible computer-readable medium in which computer program instructions are stored, which instructions, when read by a computer, cause the computer to receive source code of said computer program to be analyzed, said source code comprising code elements and statements, at least a portion of said statements referencing variables, to construct an object-oriented model of said source code, wherein said code elements are represented by respective objects, to construct, using said model, a graph representing a flow of said computer program, to receive a query, in a predefined code graph query language, with respect to a security vulnerability, to analyze said graph responsively to said query so as to identify a portion of said source code having said security vulnerability, and to report said security vulnerability.