Static program analysis in an object-relational mapping framework
Example implementations relate to static program analysis. For example, an apparatus includes a processor to perform static program analysis on a set of processor executable instructions associated with an object-relational mapping (ORM) framework. The first set of processor executable instructions includes an object. The processor is also to generate a propagation path of the object based on an execution flow of the object. The propagation path includes a first node and a second node. The first node corresponds to a first ORM operation to store the object in a database. The second node corresponds to a second ORM operation to retrieve the object from the database. The second node is linked to the first node based on a common attribute of the object. In response to a determination that the propagation path includes a sink, the processor is to output a security risk warning.
1. An apparatus comprising:
a processor; and
a non-transitory storage medium storing machine-readable instructions executable on the processor to:
perform static program analysis on a set of processor executable instructions associated with an object-relational mapping (ORM) framework, wherein the set of processor executable instructions includes an object;
generate a propagation path of the object based on an execution flow of the object, wherein the propagation path includes a first node and a second node, wherein the first node corresponds to a first ORM operation to store the object in a database, wherein the second node corresponds to a second ORM operation to retrieve the object from the database, and wherein the second node is linked in the propagation path to the first node based on the first ORM operation and the second ORM operation being associated with a common attribute of the object, the common attribute comprising an attribute of a relational table of the database; and
in response to a determination that the propagation path includes a sink, output a security risk warning to cause an update of the set of processor executable instructions.
2. The apparatus of claim 1 , wherein the second node is subsequent to the first node in the propagation path.
3. The apparatus of claim 1 , wherein an object type of the object is associated with the relational table in the database.
4. The apparatus of claim 1 , wherein the attribute of the relational table includes a row identifier of the object, the row identifier identifying a row in the relational table.
5. The apparatus of claim 1 , wherein the first node and the second node are consecutive nodes in the propagation path.
6. The apparatus of claim 1 , wherein the common attribute further comprises an object type of the object.
7. The apparatus of claim 1 , wherein the database is a relational database, and wherein the ORM framework enables data manipulations in the relational database without use of a database programming language.
8. The apparatus of claim 1 , wherein the database is a relational database, and wherein the ORM framework enables data manipulations in the relational database without use of a structured query language (SQL).
9. The apparatus of claim 1 , wherein the propagation path further comprises a first intermediate node and a second intermediate node between the first node and the second node, the first intermediate node being a database entry node indicating that the object or a property of the object is stored or modified in the database, and the second intermediate node being a database exit node indicating that the object or a property of the object is retrieved from the database.
10. A non-transitory computer-readable storage medium comprising instructions that when executed cause a computing device to:
identify, during static program analysis, an object from a set of processor executable instructions associated with an object-relational mapping (ORM) framework as a source;
identify, in the set of processor executable instructions, a first ORM operation to modify the object in a database based on an identifier of the first ORM operation;
identify, in the set of processor executable instructions, a second ORM operation to retrieve the object from the database based on an identifier of the second ORM operation;
in response to a determination that the first ORM operation and the second ORM operation include a common relational table attribute of the object, link the first ORM operation to the second ORM operation;
identify a sink associated with the object; and
in response to identifying the sink:
generate a propagation path of the object using the source, the first ORM operation, the second ORM operation, the linking of the first ORM operation and the second ORM operation, and the sink, wherein the first ORM operation corresponds to a first node in the propagation path, and wherein the second ORM operation corresponds to a second node in the propagation path, and
output a security risk warning to cause an update of the set of processor executable instructions.
11. The non-transitory computer-readable storage medium of claim 10 , wherein the common relational table attribute includes a row identifier of the object, the row identifier identifying a row of a relational table of the database.
12. The non-transitory computer-readable storage medium of claim 10 , wherein the propagation path is generated independent of an execution of the set of processor executable instructions at the computing device.
13. The non-transitory computer-readable storage medium of claim 10 , wherein an object type of the object is associated with a relational table in the database.
14. The non-transitory computer-readable storage medium of claim 10 , wherein the object is a user-controlled object.
15. The non-transitory computer-readable storage medium of claim 10 , wherein the propagation path further comprises a first intermediate node and a second intermediate node between the first node and the second node, the first intermediate node being a database entry node indicating that the object is stored or modified in the database, and the second intermediate node being a database exit node indicating that the object is retrieved from the database.
16. A method performed by a system comprising a hardware processor, comprising:
identifying, during static program analysis at computing device, an object from a set of processor executable instructions associated with an object-relational mapping (ORM) framework as a source, wherein the object receives a value assignment from an entity external to the set of processor executable instructions;
identifying, in the set of processor executable instructions, a first ORM operation to store the object in a database;
identifying, in the set of processor executable instructions, a second ORM operation to retrieve the object from the database;
linking the first ORM operation to the second ORM operation based on determining that a common attribute of the object is in the first ORM operation and the second ORM operation, the common attribute comprising an attribute of a relational table of the database;
identifying a sink associated with the object; and
in response to identifying the sink:
generating a propagation path of the object using the source, the first ORM operation, the second ORM operation, the linking of the first ORM operation and the second ORM operation, and the sink, wherein the first ORM operation corresponds to a first node in the propagation path, and wherein the second ORM operation corresponds to a second node in the propagation path subsequent to the first node; and
outputting a security risk warning to cause an update of the set of processor executable instructions.
17. The method of claim 16 , further comprising:
identifying a second sink associated with a first property of the object;
generating a propagation path of the first property using the source, the first ORM operation, the second ORM operation, and the second sink;
identifying a third sink associated with a second property of the object that is different from the first property; and
generating a propagation path of the second property using the source, the first ORM operation, the second ORM operation, and the second sink.
18. The method of claim 16 , wherein the propagation path is generated independent of an execution of the set of processor executable instructions at the computing device.
19. The method of claim 16 , wherein the propagation path is generated based on a taint analysis operation on the set of processor executable instructions.
20. The method of claim 16 , wherein the propagation path further comprises a first intermediate node and a second intermediate node between the first node and the second node, the first intermediate node being a database entry node indicating that the object is stored or modified in the database, and the second intermediate node being a database exit node indicating that the object is retrieved from the database.