Open-source software vulnerability analysis
To analyze open-source code at a large scale, a security domain graph language (“SGL”) has been created that functions as a vulnerability description language and facilitates program analysis queries. The SGL facilitates building and maintaining a graph database to catalogue vulnerabilities found in open-source components. This vulnerability database generated with SGL is used for analysis of software projects which use open source components. An agent which interacts with the vulnerability database can perform a scan of a software project to identify open-source components used in the project and submit queries to the vulnerability database to identify vulnerabilities which may affect the open-source components in the project. Results of the scan are presented to a user in the form of a vulnerability report which indicates vulnerabilities that have been discovered and which open-source components the vulnerabilities affect.
1 . A method comprising:
scanning a software project for vulnerable open source components, wherein scanning the software project for vulnerable open source components comprises,
generating a call graph for the software project;
identifying one or more open source components used in the software project based on traversing the call graph;
for each open source component of the one or more open source components identified from traversal of the call graph,
generating a graph database query that indicates an identifier of the open source component and indicates a version of the open source component, and
submitting the graph database query to a graph database of vulnerabilities known to affect open source components, wherein a result of submitting the graph database query indicates if the open source component is affected by a vulnerability documented in the graph database; and
generating a vulnerability report for the software project with results from scanning the software project, wherein the results from scanning the software project comprise results from the submitted graph database queries, wherein the vulnerability report indicates vulnerabilities affecting any of the one or more open source components.
2 . The method of claim 1 , wherein identifying the open source components comprises determining for each vertex in the call graph whether open source attribution information exists in the software project.
3 . The method of claim 1 further comprising generating a dependency graph indicating dependencies of code units in the software project upon each identified open source component.
4 . The method of claim 3 , wherein generating the vulnerability report comprises correlating each vulnerability indicated in the results with code units of the software project based on the dependency graph.
5 . The method of claim 4 , wherein generating the vulnerability report also comprises determining an impact of each identified vulnerability and indicating the impact in the vulnerability report, wherein determining the impact of each identified vulnerability comprises determining frequency of use of the open source component corresponding to the identified vulnerability and number of different code units of the software project that use the open source component corresponding to the identified vulnerability.
6 . The method of claim 1 further comprising distinguishing between code units with direct dependencies upon an open source component corresponding to a vulnerability indicated in the results and code units with indirect dependencies upon an open source component corresponding to a vulnerability indicated in the results.
7 . The method of claim 1 , wherein an open source component is an open source library.
8 . The method of claim 1 , wherein generating the graph database query comprises generating the graph database query according to a schema of the graph database that indicates a graph structure comprising a first vertex to represent a vulnerability source, a second vertex to represent a vulnerability, a third vertex to indicate a software component version or version range, a plurality of vertices to represent different types of software components, and edges among the vertices to indicate types of relationships among the vertices.
9 . A non-transitory computer-readable medium having instructions stored thereon that are executable by a computing device to perform operations comprising:
scanning a software project for vulnerable open source libraries, wherein scanning the software project for vulnerable open source libraries comprises,
generating a call graph for a software project;
identifying a set of one or more open source libraries used in the software project based on traversing the call graph;
for each open source library of the set of open source libraries identified from traversal of the call graph,
generating a graph database query that indicates an identifier of the open source library and that indicates a version of the open source library, and
submitting the graph database query to a graph database of vulnerabilities known to affect open source libraries, wherein a result of submitting the graph database query indicates if the open source library is affected by a vulnerability documented in the graph database; and
generating a vulnerability report for the software project with results from scanning the software project, wherein the results from scanning the software project comprise results of the submitted graph database queries, wherein the vulnerability report indicates vulnerabilities affecting any of the set of open source libraries.
10 . The non-transitory computer-readable medium of claim 9 , wherein identifying the set of one or more open source libraries comprises determining open source attribution information based on traversing the call graph.
11 . The non-transitory computer-readable medium of claim 9 , wherein the operations further comprise determining dependencies upon the set of one or more open source libraries.
12 . The non-transitory computer-readable medium of claim 11 , wherein generating the vulnerability report comprises correlating each vulnerability indicated in the results with code units of the software project based on the dependencies.
13 . The non-transitory computer-readable medium of claim 12 , wherein generating the vulnerability report also comprises determining an impact of each identified vulnerability and indicating the impact in the vulnerability report.
14 . The non-transitory computer-readable medium of claim 13 , wherein determining the impact of each identified vulnerability comprises determining at least one of frequency of use of the open source library corresponding to the identified vulnerability and number of different code units of the software project that use the open source library corresponding to the identified vulnerability.
15 . An apparatus comprising:
a processor; and
a non-transitory machine-readable medium having program code stored therein, the program code executable by the processor to cause the apparatus to,
scan a software project for vulnerable open source components, wherein the program code executable by the processor to cause the apparatus to scan the software project for vulnerable open source components comprises program code executable by the processor to cause the apparatus to,
generate a call graph for the software project;
based on traversal of the call graph, identify each open source component used in the software project and dependencies upon each open source component;
for each open source component identified from the traversal of the call graph,
generate a graph database query that indicates an identifier of the open source component, and
submit the graph database query to begin traversal of a subgraph of a graph database of vulnerabilities known to affect open source components from a vertex that indicates the identifier of the open source component, wherein a result of the submitted graph database query indicates if the open source component is affected by a vulnerability documented in the graph database; and
generate vulnerability information with results from the scan of the software project, wherein the results from the scan of the software project comprise results from the submitted graph database queries, wherein the vulnerability information indicates vulnerabilities affecting open source components used in the software project.
16 . The apparatus of claim 15 , wherein the program code to generate the graph database query comprises program code to generate the graph database query to also indicate a version of the open source component.
17 . The apparatus of claim 15 , wherein the program code to generate the vulnerability information comprises program code to indicate correspondence between code units of the software project and vulnerability descriptions from the results based on the dependencies.
18 . The apparatus of claim 15 , wherein the program code to generate the graph database query comprises program code to generate the graph database query in accordance with a graph database schema that includes vertices at least representing different types of software components, a vulnerability, and a vulnerability source and that includes edges representing different types of relationships among vertices.
19 . The apparatus of claim 15 , wherein the program code to identify each open source component used in the software project comprises program code to determine for each vertex in the call graph whether open source attribution information exists in the software project.
20 . The apparatus of claim 15 further comprising program code to distinguish between code units with direct dependencies upon an open source component corresponding to a vulnerability indicated in the vulnerability information and code units with indirect dependencies upon an open source component corresponding to a vulnerability indicated in the vulnerability information.