Locating security vulnerabilities in source code

Abstract

A tool ( 22 ) automatically analyzes application source code ( 16 ) for application level vulnerabilities. The tool integrates seamlessly into the software development process, so vulnerabilities are found early in the software development life cycle, when removing the defects is far cheaper than in the post-production phase. Operation of the tool is based on static analysis, but makes use of a variety of techniques, for example methods of dealing with obfuscated code.

1 - 66 . (canceled) 
     
     
         67 . A computer-implemented method for evaluating a computer program, the method comprising:
 receiving, into a memory of a computer, source code of the computer program to be analyzed;   constructing, using a source code analyzer running on the computer, a data flow graph (DFG) of the computer program;   receiving in the computer a query, directing the computer to identify unvalidated inputs in the computer program;   assigning the nodes in the DFG to three categories, consisting of a first category corresponding to entry points of input data, a second category corresponding to input validation functions, and a third category corresponding to locations where the input data is consumed;   responsively to the query, traversing the DFG to identify the nodes in the second category, and removing the identified nodes in the second category and the edges connected to the identified nodes from the DFG;   after removing the identified nodes and the edges, traversing the DFG to detect a node in the first category having an edge extending to one of the nodes in the third category; and   reporting the detected node as an unvalidated input vulnerability.   
     
     
         68 . The method according to  claim 67 , wherein constructing the data flow graph comprises:
 constructing an object-oriented model of the source code;   using the model, constructing a control flow graph of the computer program; and   deriving the data flow graph from the control flow graph.   
     
     
         69 . The method according to  claim 67 , wherein the entry points correspond to interactive inputs to the computer program, and the input validation functions sanitize the interactive inputs. 
     
     
         70 . The method according to  claim 67 , wherein the locations where the input data is consumed correspond to database access commands, and wherein the unvalidated input vulnerability comprises an SQL injection vulnerability. 
     
     
         71 . The method according to  claim 67 , wherein the locations where the input data is consumed correspond to Web screen outputs, and wherein the unvalidated input vulnerability comprises a cross-site scripting vulnerability. 
     
     
         72 . The method according to  claim 67 , wherein the locations where the input data is consumed correspond to operating system direct access commands, and wherein the unvalidated input vulnerability comprises a command injection vulnerability. 
     
     
         73 . The method according to  claim 67 , wherein the locations where the input data is consumed correspond to LDAP access commands, and wherein the unvalidated input vulnerability comprises an LDAP injection vulnerability. 
     
     
         74 . The method according to  claim 67 , wherein the locations where the input data is consumed correspond to reflection commands, and wherein the unvalidated input vulnerability comprises a reflection injection vulnerability. 
     
     
         75 . The method according to  claim 67 , wherein the locations where the input data is consumed correspond to file access commands, and wherein the unvalidated input vulnerability comprises a path manipulation vulnerability. 
     
     
         76 . The method according to  claim 67 , and comprising modifying the source code to remove the security vulnerability. 
     
     
         77 . A data processing system, comprising:
 a memory, having program instructions stored therein;   an I/O facility; and   a processor accessing the memory to read the instructions, which cause the processor to receive, via the I/O facility, source code of a computer program to be analyzed, to construct, by analyzing the source code, a data flow graph (DFG) of the computer program, to receive a query, directing the system to identify unvalidated inputs in the computer program, to assign the nodes in the DFG to three categories, consisting of a first category corresponding to entry points of input data, a second category corresponding to input validation functions, and a third category corresponding to locations where the input data is consumed, to traverse the DFG, responsively to the query, in order to identify the nodes in the second category, and remove the identified nodes in the second category and the edges connected to the identified nodes from the DFG, and after removing the identified nodes and the edges, to traverse the DFG to detect a node in the first category having an edge extending to one of the nodes in the third category and to report the detected node as an unvalidated input vulnerability.   
     
     
         78 . The system according to  claim 77 , wherein constructing the data flow graph comprises:
 constructing an object-oriented model of the source code;   using the model, constructing a control flow graph of the computer program; and   deriving the data flow graph from the control flow graph.   
     
     
         79 . The system according to  claim 77 , wherein the entry points correspond to interactive inputs to the computer program, and the input validation functions sanitize the interactive inputs. 
     
     
         80 . The system according to  claim 77 , wherein the locations where the input data is consumed correspond to database access commands, and wherein the unvalidated input vulnerability comprises an SQL injection vulnerability. 
     
     
         81 . The system according to  claim 77 , wherein the locations where the input data is consumed correspond to Web screen outputs, and wherein the unvalidated input vulnerability comprises a cross-site scripting vulnerability. 
     
     
         82 . The system according to  claim 77 , wherein the locations where the input data is consumed correspond to operating system direct access commands, and wherein the unvalidated input vulnerability comprises a command injection vulnerability. 
     
     
         83 . The system according to  claim 77 , wherein the locations where the input data is consumed correspond to LDAP access commands, and wherein the unvalidated input vulnerability comprises an LDAP injection vulnerability. 
     
     
         84 . The system according to  claim 77 , wherein the locations where the input data is consumed correspond to reflection commands, and wherein the unvalidated input vulnerability comprises a reflection injection vulnerability. 
     
     
         85 . The system according to  claim 77 , wherein the locations where the input data is consumed correspond to file access commands, and wherein the unvalidated input vulnerability comprises a path manipulation vulnerability. 
     
     
         86 . The system according to  claim 77 , wherein the processor is configured to modify the source code to remove the security vulnerability. 
     
     
         87 . A computer software product, comprising a tangible, non-transitory computer-readable medium in which program instructions are stored, which instructions, when read by a computer, cause the computer to receive source code of a computer program to be analyzed, to construct, by analyzing the source code, a data flow graph (DFG) of the computer program, to receive a query, directing the system to identify unvalidated inputs in the computer program, to assign the nodes in the DFG to three categories, consisting of a first category corresponding to entry points of input data, a second category corresponding to input validation functions, and a third category corresponding to locations where the input data is consumed, to traverse the DFG, responsively to the query, in order to identify the nodes in the second category, and remove the identified nodes in the second category and the edges connected to the identified nodes from the DFG, and after removing the identified nodes and the edges, to traverse the DFG to detect a node in the first category having an edge extending to one of the nodes in the third category and to report the detected node as an unvalidated input vulnerability.