Apparatus and method for performing dynamic security testing using static analysis data
A computer readable storage medium includes executable instructions to perform a static analysis of a set of target code to identify a first set of security issues. A dynamic analysis of the target code is executed to identify a second set of security issues. The first set of security issues and the second set of security issues are compared and common security issues are reported.
1. A non-transitory computer readable storage medium, comprising executable instructions to:
execute a dynamic analysis of target code to identify a first set of identified security issues, wherein each security issue in the first set of identified security issues includes a first security category, a complete Uniform Resource Locator (URL), and a first common parameter name;
perform a static analysis of the target code to identify a second set of identified security issues wherein the first set of identified security issues are used to tailor the static analysis and wherein each security issue in the second set of identified security issues includes a second security category, a partial URL, and a second common parameter name; and
compare the first set of identified security issues and the second set of identified security issues to report common identified security issues wherein common identified security issues include the first security category that matches the second category, the complete URL that matches the partial URL, and the first common parameter name that matches the second common parameter name.
2. The non-transitory computer readable storage medium of claim 1 wherein the executable instructions to perform a static analysis include executable instructions to analyze configuration files to map a URL to a subset of code and thereby provide access information for a dynamic analysis.
3. The non-transitory computer readable storage medium of claim 2 further comprising executable instructions to analyze configuration files to map the URL to a class.
4. The non-transitory computer readable storage medium of claim 1 wherein the executable instructions to perform a static analysis include executable instructions to access a list equating and subsets of code to provide access information for a dynamic analysis.
5. The non-transitory computer readable storage medium of claim 4 further comprising equating URLs with classes.
6. The non-transitory computer readable storage medium of claim 1 further comprising executable instructions to embed monitors in the set of target code.
7. The non-transitory computer readable storage medium of claim 6 further comprising executable instructions to receive runtime information from the monitors during dynamic analysis.
8. The non-transitory computer readable storage medium of claim 7 wherein the runtime information includes an accessed and corresponding subset of the set target code.
9. The non-transitory computer readable storage medium of claim 8 further comprising executable instructions to associate the URL with a class.
10. The non-transitory computer readable storage medium of claim 1 further comprising monitors in the target code to generate runtime information when the target code is executed.
11. The non-transitory computer readable storage medium of claim 10 wherein the runtime information includes a URL and a corresponding class file.
12. A non-transitory computer readable storage medium, comprising executable instructions to:
execute a dynamic analysis of target code to identify a first set of identified security issues, wherein the dynamic analysis includes retrieving Uniform Resource Locators (URLs) and corresponding class files from monitors in the target code and wherein each security issue in the first set of identified security issues includes a first security category, a complete URL, and a first common parameter name;
perform a static analysis of the target code to identify a second set of identified security issues, wherein the first set of identified security issues are used to tailor the static analysis and wherein each security issue in the second set of identified security issues includes a second security category, a partial URL, and a second common parameter name; and
compare the first set of identified security issues and the second set of identified security issues to report common security issues wherein common identified security issues include the first security category that matches the second category, the complete URL that matches the partial URL, and the first common parameter name that matches the second common parameter name.