Automated security analysis of software libraries
A method for identifying security vulnerabilities in a third party software component includes generating a test application for the third party software component. The test application is generated such that every externally accessible data path in the third party component is called. The test application and the third party software component are analyzed using a static application security testing (SAST) code analyzer. One or more test results are obtained from the SAST code analyzer. The one or more test results are used to identify security vulnerabilities in the third party component.
1. A method for identifying security vulnerabilities in a third party software component, the method comprising:
identifying procedures used in the third party software component;
implementing a procedure call for each identified procedure, respectively, in the third party software component;
obtaining a result of each procedure call;
passing the result of each procedure call to a taint checking method; and
using the taint checking method to determine whether the result of each procedure call includes tainted data.
2. The method of claim 1 , further comprising:
analyzing the result of each procedure call with a static application security testing (SAST) code analyzer; and
using the SAST code analyzer to determine whether tainted data is generated by the third party software component.
3. The method of claim 1 , further comprising:
generating test data;
passing the test data into the third party software component;
implementing each identified procedure call using the test data;
obtaining a result of each procedure call using the test data;
passing the result of each procedure call using the test data to the taint checking method; and
using the taint checking method to determine whether the result of each procedure call using the test data includes tainted data.
4. The method of claim 3 , further comprising:
analyzing the result of each procedure call using the test data with a static application security testing (SAST) code analyzer; and
using the SAST code analyzer to determine whether tainted data is generated by the third party software component as a result of using the test data.
5. The method of claim 1 , further comprising testing every externally accessible data path in the third party component.
6. The method of claim 1 , wherein at least one procedure call is a non-deterministic procedure call.
7. The method of claim 1 , further comprising adding tainted data to the taint checking method.
8. The method of claim 7 , wherein the tainted data is added by using a specific method call that adds the tainted data.
9. The method of claim 1 , wherein each procedure used in the third party software component includes all public methods and constructors and all protected methods and constructors of non-final classes.
10. The method of claim 9 , wherein all public methods and constructors includes all accessible static methods, all accessible constructors, all singleton style constructors, all accessible setter methods and all accessible getter methods.
11. The method of claim 1 , wherein at least one procedure used in the third party software component is called more than once.
12. The method of claim 1 , further comprising using a test application to implement each procedure call.
13. The method of claim 12 , further comprising compiling the test application with the third party software component.