Automatic inference of whitelist-based validation as part of static analysis for security

1. A method, comprising:

performing by a computer system taint analysis of a computer program and determining an original set of paths from sources to sinks, wherein each path corresponds to a vulnerability because taint flows from a source in the path to a sink in the path, wherein an output of the performed taint analysis includes a map from program points to taint facts holding at these points:

determining by the computer system for each variable whose type is a collection and is accessed in one of the paths in the original set of paths whether the variable points to a concrete value whose internal state is not tainted according to the taint analysis comprises:

determining by the computer system at a program point by static types whether a variable is a collection and, if so, adding the collection to a list;

determining, by the computer system using the map, if taint facts at the program point indicate the variable points to a concrete value whose internal state may be tainted and, if so, removing the collection from the list; and

performing by the computer system for all points in the computer program the determining at a program point and determining if taint facts at the program point, wherein the list indicates each variable whose type is a collection points to a concrete value whose internal state is not tainted according to the taint analysis;

for each of the collections found not to be tainted according to the taint analysis, determining by the computer system all points in the computer program where a membership check against the collection is performed; and

for each of the points, determining by the computer system corresponding paths and removing those paths from the original set of paths to create a reduced set of paths.

2. The method of claim 1 , further comprising displaying by the computer system the reduced set of paths to a user.

3. The method of claim 1 , wherein determining at a program point by static types whether a variable is a collection is performed at least in part by using known types for collections indicating which variables are collections.

4. The method of claim 1 , wherein determining at a program point by static types whether a variable is a collection is performed at least in part by using a user supplied specification of types for collections indicating which variables are collections.

5. The method of claim 1 , wherein determining all the points in the computer

program where a membership check against the collection is performed further comprises determining a membership check is performed at least in part by using known types for collections indicating which collections perform membership checks.

6. The method of claim 1 , wherein a membership check against a collection

comprises a whitelist-based validator.

7. An apparatus, comprising:

one or more memories comprising computer readable program code;

one or more processors configured, in response to execution of the computer readable program code, to cause the apparatus to perform at least the following:

performing taint analysis of a computer program and determining an original set of paths from sources to sinks, wherein each path corresponds to a vulnerability because taint flows from a source in the path to a sink in the path, wherein an output of the performed taint analysis includes a map from program points to taint facts holding at these points:

determining for each variable whose type is a collection and is accessed in one of the paths in the original set of paths whether the variable points to a concrete

value whose internal state is not tainted according to the taint analysis comprises:

determining at a program point by static types whether a variable is a collection and, if so, adding the collection to a list;

determining, using the map, if taint facts at the program point indicate the variable points to a concrete value whose internal state may be tainted and, if so, removing the collection from the list; and

performing for all points in the computer program the determining at a program point and determining if taint facts at the program point;

wherein the list indicates each variable whose type is a collection points to a concrete value whose internal state is not tainted according to the taint analysis;

for each of the collections found not to be tainted according to the taint analysis, determining all points in the computer program where a membership check against the collection is performed; and

for each of the points, determining corresponding paths and removing those paths from the original set of paths to create a reduced set of paths.

8. The apparatus of claim 7 , further comprising displaying the reduced set of paths to a user.

9. The apparatus of claim 7 , wherein determining at a program point by static types whether a variable is a collection is performed at least in part by using known types for collections indicating which variables are collections.

10. The apparatus of claim 7 , wherein determining at a program point by static types whether a variable is a collection is performed at least in part by using a

user-supplied specification of types for collections indicating which variables are collections.

11. The apparatus of claim 7 , wherein determining all the points in the computer program where a membership check against the collection is performed further comprises determining a membership check is performed at least in part by using known types for collections indicating which collections perform membership checks.

12. The apparatus of claim 7 , wherein a membership check against a collection comprises a whitelist-based validator.

13. A computer program product, comprising:

a non-transitory computer readable storage medium having computer readable program code embodied thereon, the computer readable program code comprising:

code for performing taint analysis of a computer program and determining an

original set of paths from sources to sinks, wherein each path corresponds to a vulnerability because taint flows from a source in the path to a sink in the path, wherein an output of the performed taint analysis includes a map from program points to taint facts holding at these points;

code for determining for each variable whose type is a collection and is accessed

in one of the paths in the original set of paths whether the variable points to a concrete value whose internal state is not tainted according to the taint analysis comprises:

code for determining by the computer system at a program point by static types whether a variable is a collection and, if so, adding the collection

to a list;

code for determining, by the computer system using the map, if taint facts at the program point indicate the variable points to a concrete value whose internal state may be tainted and, if so, removing the collection from the list; and

code for performing by the computer system for all points in the computer program the determining at a program point and determining if taint facts at the program point, wherein the list indicates each variable whose type is a collection points to a concrete value whose internal state is not tainted according to the taint analysis;

code for, for each of the collections found not to be tainted according to the taint analysis, determining all points in the computer program where a membership check against the collection is performed; and

code for, for each of the points, determining corresponding paths and removing those paths from the original set of paths to create a reduced set of paths.

14. The computer program product of claim 13 , further comprising displaying the reduced set of paths to a user.

15. The computer program product of claim 13 , wherein determining at a program point by static types whether a variable is a collection is performed at least in part by using known types for collections indicating which variables are collections.

16. The computer program product claim 13 , wherein determining at a program point by static types whether a variable is a collection is performed at least in part by using a user-supplied specification of types for collections indicating which variables are collections.

17. The computer program product of claim 13 , wherein determining all the points in the computer program where a membership check against the collection is performed further comprises determining a membership check is performed at least in part by using known types for collections indicating which collections perform membership checks.

18. The computer program product of claim 13 , wherein a membership check against a collection comprises a whitelist-based validator.