Auto-remediation workflow for computer security testing
Techniques for performing auto-remediation on computer system vulnerabilities in source code are disclosed herein. An application source code representation is scanned to determine any security vulnerabilities and from those vulnerabilities, a set of security patch rules are generated that may be used to automatically remediate the vulnerabilities. One or more of the security patch rules is selected for verification and, once verified may be used to generate a security patch. The security patch may then be automatically applied to the source code representation to produce a patched representation of the application source code with the vulnerability at least partly remediated.
1. A computer-implemented method comprising:
receiving results of a scan of a representation of a source code, wherein the scan of the representation of the source code did not execute the representation of the source code;
determining, from the results of the scan and without executing the representation of the source code, one or more vulnerabilities, wherein each vulnerability record of the one or more vulnerabilities at least specifies a respective location of a corresponding vulnerability of the one or more vulnerabilities within the representation of the source code;
generating one or more security patch rules based at least in part on the one or more vulnerabilities and based at least in part on one or more security fix rules;
verifying the one or more security patch rules;
in response to the one or more security patch rules being verified, producing a security patch based at least in part on the one or more verified security patch rules; and
applying the security patch to the representation of the source code.
2. The computer-implemented method of claim 1 , wherein the representation of the source code is a data structure representation of the source code.
3. The computer-implemented method of claim 1 , wherein the scanning is performed using static analysis.
4. The computer-implemented method of claim 1 , wherein the one or more security fix rules are configuration analysis rules, wherein the configuration analysis rules generate the one or more security patch rules based on the one or more vulnerabilities being located in one or more configuration files in the representation of the source code.
5. The computer-implemented method of claim 1 , wherein the one or more security fix rules are semantic analysis rules, wherein the semantic analysis rules generate the one or more security fix rules based on the one or more vulnerabilities being located in arguments to methods, default values, common programming errors or application programming interfaces in the representation of the source code.
6. The computer-implemented method of claim 1 , wherein the one or more security fix rules are dataflow analysis rules, wherein the dataflow analysis rules generate the one or more security fix rules based on the one or more vulnerabilities being located in a dataflow of the representation of the source code to determine a particular point within the dataflow to apply encryption, process output or preprocess calls to external systems or services.
7. The computer-implemented method of claim 1 , wherein the verifying is performed via an automated process to determine that the one or more security patch rules remediate the one or more vulnerabilities.
8. The computer-implemented method of claim 1 , wherein the scanning further comprising:
applying one or more security vulnerability rules to the representation of the source code to identify the one or more vulnerabilities by comparing the representation of the source code to one or more security vulnerability criteria, the one or more security vulnerability criteria specified in the one or more security vulnerability rules,
wherein the one or more security vulnerability rules are based on historical vulnerabilities.
9. The computer-implemented method of claim 1 , wherein applying the security patch to the representation of the source code to produce a patched representation of the source code comprises:
identifying at least a portion of the representation of the source code based at least in part on the security patch;
applying the security patch to the portion of the representation of the source code to produce a patched portion of the representation of the source code; and
providing the patched portion of the representation of the source code.
10. A system comprising:
a processor; and
a memory storing instructions, which when executed causes the processor to:
receive results of a scan of a representation of a source code, wherein the scan of the representation of the source code did not execute the representation of the source code;
determine, from the results of the scan and without executing the representation of the source code, one or more vulnerabilities, wherein each vulnerability record of the one or more vulnerabilities at least specifies a respective location of a corresponding vulnerability of the one or more vulnerabilities within the representation of the source code;
generate one or more security patch rules based at least in part on the one or more vulnerabilities and based at least in part on one or more security fix rules;
verify the one or more security patch rules;
in response to the one or more security patch rules being verified, produce a security patch based at least in part on the one or more verified security patch rules; and
apply the security patch to the representation of the source code.
11. The system of claim 10 , wherein the representation of the source code is a data structure representation of the source code.
12. The system of claim 10 , wherein the scanning is performed using static analysis.
13. The system of claim 10 , wherein the one or more security fix rules are configuration analysis rules, wherein the configuration analysis rules generate the one or more security patch rules based on the one or more vulnerabilities being located in one or more configuration files in the representation of the source code.
14. The system of claim 10 , wherein the one or more security fix rules are semantic analysis rules, wherein the semantic analysis rules generate the one or more security fix rules based on the one or more vulnerabilities being located in arguments to methods, default values, common programming errors or application programming interfaces in the representation of the source code.
15. The system of claim 10 , wherein the one or more security fix rules are dataflow analysis rules, wherein the dataflow analysis rules generate the one or more security fix rules based on the one or more vulnerabilities being located in a dataflow of the representation of the source code to determine a particular point within the dataflow to apply encryption, process output or preprocess calls to external systems or services.
16. The system of claim 10 , wherein the verifying is performed via an automated process to determine that the one or more security patch rules remediate the one or more vulnerabilities.
17. The system of claim 10 , comprising further instructions which when executed by the processor causes the processor to:
apply one or more security vulnerability rules to the representation of the source code to identify the one or more vulnerabilities by comparing the representation of the source code to one or more security vulnerability criteria, the one or more security vulnerability criteria specified in the one or more security vulnerability rules,
wherein the one or more security vulnerability rules are based on historical vulnerabilities.
18. The system of claim 10 , comprising further instructions which when executed by the processor causes the processor to:
identify at least a portion of the representation of the source code based at least in part on the security patch;
apply the security patch to the portion of the representation of the source code to produce a patched portion of the representation of the source code; and
provide the patched portion of the representation of the source code.
19. A non-transitory computer readable medium storing instructions which when executed causes a processor to:
receive results of a scan of a representation of a source code, wherein the scan of the representation of the source code did not execute the representation of the source code;
determine, from the results of the scan and without executing the representation of the source code, one or more vulnerabilities, wherein each vulnerability record of the one or more vulnerabilities at least specifies a respective location of a corresponding vulnerability of the one or more vulnerabilities within the representation of the source code;
generate one or more security patch rules based at least in part on the one or more vulnerabilities and based at least in part on one or more security fix rules;
verify the one or more security patch rules;
in response to the one or more security patch rules being verified, produce a security patch based at least in part on the one or more verified security patch rules; and
apply the security patch to the representation of the source code.
20. The non-transitory computer readable medium of claim 19 , wherein the representation of the source code is a data structure representation of the source code.
21. The non-transitory computer readable medium of claim 19 , wherein the scanning is performed using static analysis.
22. The non-transitory computer readable medium of claim 19 , wherein the one or more security fix rules are configuration analysis rules, wherein the configuration analysis rules generate the one or more security patch rules based on the one or more vulnerabilities being located in one or more configuration files in the representation of the source code.
23. The non-transitory computer readable medium of claim 19 , wherein the one or more security fix rules are semantic analysis rules, wherein the semantic analysis rules generate the one or more security fix rules based on the one or more vulnerabilities being located in arguments to methods, default values, common programming errors or application programming interfaces in the representation of the source code.
24. The non-transitory computer readable medium of claim 19 , wherein the one or more security fix rules are dataflow analysis rules, wherein the dataflow analysis rules generate the one or more security fix rules based on the one or more vulnerabilities being located in a dataflow of the representation of the source code to determine a particular point within the dataflow to apply encryption, process output or preprocess calls to external systems or services.
25. The non-transitory computer readable medium of claim 19 , wherein the verifying is performed via an automated process to determine that the one or more security patch rules remediate the one or more vulnerabilities.
26. The non-transitory computer readable medium of claim 19 , comprising further instructions which when executed by the processor causes the processor to:
apply one or more security vulnerability rules to the representation of the source code to identify the one or more vulnerabilities by comparing the representation of the source code to one or more security vulnerability criteria, the one or more security vulnerability criteria specified in the one or more security vulnerability rules,
wherein the one or more security vulnerability rules are based on historical vulnerabilities.
27. The non-transitory computer readable medium of claim 19 , comprising further instructions which when executed by the processor causes the processor to:
identify at least a portion of the representation of the source code based at least in part on the security patch;
apply the security patch to the portion of the representation of the source code to produce a patched portion of the representation of the source code; and
provide the patched portion of the representation of the source code.