Method, system, and computer program product for automatically mitigating vulnerabilities in source code

1. A method for automatically mitigating vulnerabilities in a source code of an application comprising:

building a path graph according to the source code, wherein the path graph comprises a plurality of paths, and wherein each of the paths comprises a plurality of nodes;

identifying a plurality of tainted paths from the path graph, wherein each of the tainted paths corresponds to a vulnerability;

locating a same target node in a plurality of intersecting tainted paths among the tainted paths based on an existence of a tainted object; and

mitigating a plurality of vulnerabilities in the target node automatically comprising:

obtaining a plurality of sanitization methods corresponding to the vulnerabilities in the target node; and

mitigating the vulnerabilities in the target node automatically, based on a determination of whether any one of the sanitization methods is able to mitigate all of the vulnerabilities in the target node corresponding to all of the intersecting tainted paths, by using either only one of the sanitization methods or more than one of the sanitization methods in a priority order for sanitization.

2. The method according to claim 1 , wherein the step of mitigating the vulnerabilities in the target node automatically comprises:

determining whether a designated sanitization method among the sanitization methods is able to mitigate all of the vulnerabilities in the target node corresponding to all of the intersecting tainted paths; and

in response that the designated sanitization method is able to mitigate all of the vulnerabilities in the target node corresponding to all of the intersecting tainted paths, mitigating all of the vulnerabilities in the target node automatically by only using the designated sanitization method.

3. The method according to claim 1 , wherein the intersecting tainted paths comprise a first tainted path and a second tainted path, wherein the sanitization methods comprise a first sanitization method corresponding to the first tainted path and a second sanitization method corresponding to the second tainted path, and wherein the step of mitigating the vulnerabilities in the target node automatically comprises:

determining whether the first sanitization method is able to mitigate both of the vulnerabilities in the target node corresponding to both the first tainted path and the second tainted path; and

in response that the first sanitization method is able to mitigate both of the vulnerabilities in the target node corresponding to both the first tainted path and the second tainted path, mitigating the vulnerabilities in the target node automatically by only using the first sanitization method.

4. The method according to claim 3 , wherein the intersecting tainted paths further comprise a plurality of other tainted paths, and wherein the step of mitigating the vulnerabilities in the target node automatically further comprises:

determining whether the first sanitization method is able to mitigate vulnerabilities in the target node corresponding to the other tainted paths; and

in response that the first sanitization method is able to mitigate the vulnerability in the target node corresponding to at least one first other tainted path among the other tainted paths, mitigating the vulnerability in the target node corresponding to the at least one first other tainted path automatically by using the first sanitization method.

5. The method according to claim 1 , wherein the step of mitigating the vulnerabilities in the target node automatically comprises:

obtaining the priority order for sanitization; and

mitigating the vulnerabilities in the target node automatically by using more than one of the sanitization methods in sequence according to the priority order for sanitization.

6. The method according to claim 1 , wherein the intersecting tainted paths comprise a first tainted path and a second tainted path, wherein the sanitization methods comprise a first sanitization method corresponding to the first tainted path and a second sanitization method corresponding to the second tainted path, and wherein the step of mitigating the vulnerabilities in the target node automatically comprises:

obtaining the priority order for sanitization; and

mitigating the vulnerabilities in the target node automatically by using the first sanitization method and the second sanitization method in sequence according to the priority order for sanitization.

7. The method according to claim 6 , wherein before the step of obtaining the priority order for sanitization, the method further comprises:

setting the priority order for sanitization based on user settings.

8. The method according to claim 6 , wherein before the step of obtaining the priority order for sanitization, the method further comprises:

setting the priority order for sanitization based on a confidence score associated with a first instant-fix call corresponding to the first sanitization method and a second instant-fix call corresponding to the second sanitization method.

9. The method according to claim 8 , wherein the step of setting the priority order for sanitization based on the confidence score associated with the first instant-fix call corresponding to the first sanitization method and the second instant-fix call corresponding to the second sanitization method comprises:

obtaining a first confidence score of the target node corresponding to a first order for sanitization, wherein the first order for sanitization is to apply the first instant-fix call followed by the second instant-fix call on the target node;

obtaining a second confidence score of the target node corresponding to a second order for sanitization, wherein the second order for sanitization is to apply the second instant-fix call followed by the first instant-fix call on the target node;

setting the first order for sanitization as the priority order for sanitization in response to the first confidence score being higher than the second confidence score; and

setting the second order for sanitization as the priority order for sanitization in response to the second confidence score being higher than the first confidence score.

10. A system for automatically mitigating vulnerabilities in a source code of an application comprising:

a memory;

a processor, coupled to the memory and configured to:

build a path graph according to the source code, wherein the path graph comprises a plurality of paths, and wherein each of the paths comprises a plurality of nodes;

identify a plurality of tainted paths from the path graph, wherein each of the tainted paths corresponds to a vulnerability;

locate a same target node in a plurality of intersecting tainted paths among the tainted paths based on an existence of a tainted object; and

mitigate a plurality of vulnerabilities in the target node automatically comprising:

obtain a plurality of sanitization methods corresponding to the vulnerabilities in the target node; and

mitigate the vulnerabilities in the target node automatically, based on a determination of whether any one of the sanitization methods is able to mitigate all of the vulnerabilities in the target node corresponding to all of the intersecting tainted paths, by using either only one of the sanitization methods or more than one of the sanitization methods in a priority order for sanitization.

11. A non-transitory computer-readable medium comprising a plurality of program instructions, which when executed by a computer system, cause the computer system to execute steps of:

building a path graph according to the source code, wherein the path graph comprises a plurality of paths, and wherein each of the paths comprises a plurality of nodes;

identifying a plurality of tainted paths from the path graph, wherein each of the tainted paths corresponds to a vulnerability;

locating a same target node in a plurality of intersecting tainted paths among the tainted paths based on an existence of a tainted object; and

mitigating a plurality of vulnerabilities in the target node automatically mitigating a plurality of vulnerabilities in the target node automatically comprising:

obtaining a plurality of sanitization methods corresponding to the vulnerabilities in the target node; and

mitigating the vulnerabilities in the target node automatically, based on a determination of whether any one of the sanitization methods is able to mitigate all of the vulnerabilities in the target node corresponding to all of the intersecting tainted paths, by using either only one of the sanitization methods or more than one of the sanitization methods in a priority order for sanitization.