Locating security vulnerabilities in source code
A tool ( 22 ) automatically analyzes application source code ( 16 ) for application level vulnerabilities. The tool integrates seamlessly into the software development process, so vulnerabilities are found early in the software development life cycle, when removing the defects is far cheaper than in the post-production phase. Operation of the tool is based on static analysis, but makes use of a variety of techniques, for example methods of dealing with obfuscated code.
1. A computer-implemented method for evaluating a computer program, the method comprising:
receiving, into a memory of a computer, source code of the computer program to be analyzed, the source code including invocations of specified methods;
automatically analyzing the invocations in the source code in order to assign the specified methods, based on parameters of the specified methods, to different, first and second invocation types;
constructing, using a source code analyzer running on the computer, a control flow graph representing a flow of the computer program, while replacing the invocations with stubs of different, first and second stub types, corresponding respectively to the first and second invocation types, in the control flow graph when the source code of the specified methods is unavailable;
analyzing the control flow graph containing at least some of the stubs, in order to identify a security vulnerability in the source code; and
reporting the identified security vulnerability.
2. The method according to claim 1 , and comprising, when the source code becomes available for a given method, replacing a corresponding stub with a single-method control flow graph.
3. The method according to claim 1 , wherein automatically analyzing the invocations comprises identifying at least a first invocation that uses but does not update the parameters of a corresponding method as belonging to the first invocation type, and wherein replacing the invocations with the stubs comprises inserting in the control flow graph, in place of at least the first invocation, at least a first of the first stub type.
4. The method according to claim 3 , automatically analyzing the invocations comprises identifying a second invocation for which the parameters influence a currently-active object in the computer program as belonging to the second invocation type, and replacing the second invocation with a second stub of the second stub type.
5. The method according to claim 4 , wherein automatically analyzing the invocations comprises deciding whether to replace a given method invocation with the first or second stub type depending on a name of the invoked method.
6. A data processing system, comprising:
a memory, having program instructions stored therein;
an I/O facility; and
a processor accessing the memory to read the instructions, which cause the processor to receive, via the I/O facility, source code of a computer program to be analyzed, the source code including invocations of specified methods, to automatically analyze the invocations in the source code in order to assign the specified methods, based on parameters of the specified methods, to different, first and second invocation types, to construct, using a source code analyzer running on the processor, a control flow graph representing a flow of the computer program, while replacing the invocations with stubs of different, first and second stub types, corresponding respectively to the first and second invocation types, in the control flow graph when the source code of the specified methods is unavailable, to analyze the control flow graph containing at least some of the stubs, in order to identify a security vulnerability in the source code, and to report the identified security vulnerability.
7. The system according to claim 6 , wherein the instructions cause the processor, when the source code becomes available for a given method, to replace a corresponding stub with a single-method control flow graph.
8. The system according to claim 6 , wherein the instructions cause the processor to identify at least a first invocation that uses but does not update the parameters of a corresponding method as belonging to the first invocation type, and wherein the instructions cause the processor to insert in the control flow graph, in place of at least the first invocation, at least a first stub of the first stub type.
9. The system according to claim 8 , wherein the instructions cause the processor to identify a second invocation for which the parameters influence a currently-active object in the computer program as belonging to the second invocation type, and to replace the second invocation with a second stub of the second stub type.
10. The system according to claim 9 , wherein the instructions cause the processor to decide whether to replace a given method invocation with the first or second stub type depending on a name of the invoked method.
11. A computer software product, comprising a tangible, non-transitory computer-readable medium in which program instructions are stored, which instructions, when read by a computer, cause the computer to receive source code of a computer program to be analyzed, the source code including invocations of specified methods, to automatically analyze the invocations in the source code in order to assign the specified methods, based on parameters of the specified methods, to different, first and second invocation types, to construct, using a source code analyzer running on the computer, a control flow graph representing a flow of the computer program, while replacing the invocations with stubs of different, first and second stub types, corresponding respectively to the first and second invocation types, in the control flow graph when the source code of the specified methods is unavailable, to analyze the control flow graph containing at least some of the stubs, in order to identify a security vulnerability in the source code, and to report the identified security vulnerability.
12. The product according to claim 11 , wherein the instructions cause the computer, when the source code becomes available for a given method, to replace a corresponding stub with a single-method control flow graph.
13. The product according to claim 11 , wherein the instructions cause the computer to identify at least a first invocation that uses but does not update the parameters of a corresponding method as belonging to the first invocation type, and wherein the instructions cause the computer to insert in the control flow graph, in place of at least the first invocation, at least a first stub of the first stub type.
14. The product according to claim 13 , wherein the instructions cause the computer to identify a second invocation for which the parameters influence a currently-active object in the computer program as belonging to the second invocation type, and to replace the second invocation with a second stub of the second stub type.
15. The product according to claim 14 , wherein the instructions cause the computer to decide whether to replace a given method invocation with the first or second stub type depending on a name of the invoked method.