Analyze code that uses web framework using local parameter model
Example embodiments disclosed herein relate to analyze code of a web application associated with a framework. The code is loaded. Data objects of the framework that are used by the code are modeled using local parameters with explicit control flow. The code is analyzed to identify at least one vulnerability by analyzing one or more execution paths of the code using the explicit control flow.
1. A non-transitory machine-readable storage medium storing instructions that upon execution by a processor, cause the processor to perform software security testing of a web application to identify a vulnerability of the web application by:
loading code of the web application, the web application associated with a framework and using data objects of the framework including a request object of the framework and response object of the framework;
determining a model of the framework, the model identifying the data objects of the framework used by the web application including the request object and the response object of the framework, wherein the request object and the response object are global objects of the framework, wherein the data objects are modeled by the model using local artificial parameters defining explicit control flow, wherein the model is based on a specification of the framework, and wherein the specification does not define the data objects as parameters;
replacing, in the code of the web application, data objects of the framework used by the code of the web application with the local artificial parameters of the model; and
analyzing the code to identify the vulnerability by analyzing one or more execution paths of the code using the explicit control flow defined in the local artificial parameters of the model.
2. The non-transitory machine-readable storage medium of claim 1 , wherein the code includes a read from a property or an attribute of one of the local artificial parameters, and wherein the read is replaced in the code of the web application with a field access.
3. The non-transitory machine-readable storage medium of claim 1 , wherein the code includes a write to a property or an attribute of one of the local artificial parameters, and wherein the write is replaced in the code of the web application with an assignment statement to a field of a respective local artificial parameter of the local artificial parameters.
4. The non-transitory machine-readable storage medium of claim 1 , wherein the instructions upon execution cause the processor to use the specification to determine explicit method calls with modeled data objects in the code during the analyzing.
5. A method for performing software security testing of a web application to identify a security vulnerability of the web application, the method comprising:
loading, by a security testing system, code of the web application, the web application associated with a framework and using data objects of the framework including a request object of the framework and a response object of the framework;
determining, by the security testing system, a model for the framework, wherein the model uses local parameters defining explicit control flow for the request object of the framework and the response object of the framework based on a specification of the framework, wherein the request object and the response object comprise global objects of the framework;
loading, by the security testing system, the code of the web application that uses the framework;
determining, by the security testing system, data objects including the request object and the response object of the framework used by the code;
replacing, by the security testing system, in the code of the web application, the request object with the local parameters defining the explicit control flow for the request object and the response object with the local parameters defining the explicit control flow for the response object; and
analyzing, by the security testing system, the code using the model to identify the security vulnerability by analyzing one or more execution paths of the code using the explicit control flow defined in the local parameters.
6. The method of claim 5 , wherein the specification does not define the data objects as parameters, and wherein the model uses artificial parameters to represent the request object and the response object.
7. The method of claim 6 , wherein the code includes a read from a property or an attribute of one of the artificial parameters, and wherein the read is replaced in the code of the web application with a field access.
8. The method of claim 6 , wherein the code includes a write to a property or an attribute of one of the artificial parameters, and wherein the write is replaced in the code of the web application with an assignment statement.
9. A computing system comprising:
a processor; and
a memory coupled with and readable by the processor and storing instructions which, when executed by the processor, cause the processor to perform software security testing of a web application to identify a security vulnerability of the web application by:
loading code of the web application that uses a framework;
determining a plurality of data objects of the framework used by the code, the plurality of data objects including a request object and a response object used by the code, wherein the request object and the response object are global objects of the framework;
replacing the request object with local parameters of a model defining explicit control flow for the request object and the response object with local parameters of the model defining explicit control flow for the response object, wherein the model uses the local parameters with explicit control flow based on a specification of the framework; and
identifying the security vulnerability by analyzing one or more execution paths of the code using the explicit control flow defined in the local parameters of the model.
10. The computing system of claim 9 , wherein the model uses artificial parameters to represent the request object and the response object, and wherein the code includes a read from a property or an attribute of one of the artificial parameters, and wherein the read is replaced in the code of the web application with a field access.
11. The computing system of claim 9 , wherein the model uses artificial parameters to represent the request object and the response object, wherein the code includes a write to a property or an attribute of one of the artificial parameters, and wherein the write is replaced in the code of the web application with an assignment statement to a field of a respective artificial parameter.
12. The non-transitory machine-readable storage medium of claim 1 , wherein the request object is to retrieve a value from an entity, and the response object is to send a value to the entity.
13. The non-transitory machine-readable storage medium of claim 1 , wherein the explicit control flow comprises function calls to track the local parameters across methods.
14. The non-transitory machine-readable storage medium of claim 13 , wherein the explicit control flow refers to an order of evaluation of instructions of the code and the framework.
15. The method of claim 5 , wherein the request object is to retrieve a value from an entity, and the response object is to send a value to the entity.
16. The method of claim 5 , wherein the explicit control flow comprises function calls to track the local parameters across methods.
17. The computing system of claim 9 , wherein the request object is to retrieve a value from an entity, and the response object is to send a value to the entity.
18. The method of claim 16 , wherein the explicit control flow refers to an order of evaluation of instructions of the code and the framework.
19. The computing system of claim 9 , wherein the explicit control flow comprises function calls to track the local parameters across methods.
20. The computing system of claim 19 , wherein the explicit control flow refers to an order of evaluation of instructions of the code and the framework.