Systems and methods for remote analysis of software applications

1. A method of assessing quality of a software program, the method comprising the steps of:

receiving in memory an electronic recordation of an object space of the software program, the object space:

(i) being extracted using an extraction component that is dependent on an interpreted language in which at least a portion of the software application is written and that is configured to extract the object space in a development or runtime environment of the program, the extraction of the object space using the extraction component comprising: (A) loading core components of an interpreter of a language of the software application, and (B) creating a baseline object space using at least one application program interface (API), the API being an introspection API or a reflection API, and

(ii) comprising at least one object defined by at least one of: (A) a developer specified software application code component, (B) a loaded dependency, and (C) a dynamic, run-time alterations to a previously loaded object; and

within an environment devoid of the program source code and any binary representation of the source code, assessing, by a processor in communication with the memory, the quality of the software program using only the electronic recordation,

wherein assessing the quality of the software program comprises identifying potential security vulnerabilities of the program, without having access to the program source code or a compiled binary file.

2. The method of claim 1 , wherein the extraction component is customized for a specific interpreted programming language corresponding to at least a portion of source code of the software program.

3. The method of claim 1 , wherein the object space comprises one or more objects, any object being selected from the group consisting of: a class, a class method, a constant, a name, a function argument, a function, a variable, and a class hierarchy.

4. The method of claim 3 , wherein at least one object in the object space is created or modified during execution of the software program.

5. The method of claim 1 , further comprising:

loading a primary framework and dependencies thereof;

extracting at least one object corresponding to the primary framework or the dependencies thereof; and

updating the baseline object space based on one or more extracted objects.

6. The method of claim 5 , further comprising loading any external dependencies specified in a configuration associated with the software program by invoking one or more calls of the primary framework.

7. The method of claim 5 , further comprising initially loading one or more software application units, one of the one or more units being either a packaged dependency or a code component of the software application.

8. The method of claim 5 , further comprising:

at least partially executing the software application; and

creating a final object space comprising at least one object corresponding to the software application.

9. The method of claim 8 , further comprising:

identifying and loading one or more additional software application units;

at least partially executing the software application;

extracting at least one object corresponding to at least one of the initially loaded software application units and the additional software units; and

updating the final object space using the extracted at least one object.

10. The method of claim 9 , further comprising:

updating the final object space; and

storing at least one of the updated baseline object space and the updated final object space.

11. The method of claim 9 , wherein the one or more additional software application units comprise at least one of an additional dependency and a code component of the software application.

12. A system for testing a software application comprises:

a receiver in communication with memory for receiving in the memory at least one object space comprising at least one object defined by at least one of: (A) a developer specified software application code component, (B) a loaded dependency, and (C) a dynamic, run-time alterations to a previously loaded object, the at least one object space being extracted using an extraction component that is dependent on an interpreted language in which at least a portion of the software application is written, by:

loading in a development or runtime environment of the software application: (i) a framework for executing the software application, (ii) at least a portion of the software application, and (iii) an extraction component configured to use at least one of an introspection application program interface (API) and a reflection API; and

at least partially executing the software application; and

a processor configured as an analyzer and in communication with the memory, for identifying, without access to any of source code, compiled binary, and runtime environment of the software application, in an environment devoid of the software application source code and any binary representation of the source code, any vulnerabilities in the software application using the at least one received object space.

13. The system of claim 12 , further comprising a translator that is implemented by the processor and that is configured for translating the at least one received object space into a language-independent representation, wherein the analyzer is configured to analyze input in a format of the language-independent representation.

14. The system of claim 12 , further comprising a generator that is implemented by the processor, for generating the extraction component.

15. The system of claim 12 , wherein the extraction component is configured for:

receiving in memory an assembly-level representation of the object space comprising one or more objects;

parsing by a processor in communication with the memory the assembly-level representation, selecting each object;

translating by the processor the selected object into a syntax tree format; and

generating by the processor an output comprising the syntax tree format representation of each object.

16. The system of claim 15 , wherein translating the selected object into the syntax tree format comprises:

determining if the selected object comprising one or more methods;

if the selected object comprises one or more methods, simulating each of the one or more methods and determining a sequence of operations corresponding to that method; and

translating the sequence of operations into the syntax tree format.

17. The system of claim 16 , wherein the selected object is a module or a class.

18. The system of claim 16 , wherein simulating at least one of the one or more methods comprises simulating a bytecode associated with the method.

19. The system of claim 15 , wherein one of the one or more objects is selected from the group consisting of a module, a class, a procedure, and a variable.

20. The system of claim 15 , wherein the object spaces corresponds to a software application.