Method and device for detecting security flaws of source files

Abstract

The invention provides a method and a device for detecting security flaws of source files. The method includes scanning the source files one by one and executing steps on the scanned source files including subjecting the source files to lexical analysis and grammatical analysis, performing variable identification operation and risk point identification operation in the process of the lexical analysis, wherein the variable identification operation includes identifying variables and storing identified variables; the risk point identification operation includes identifying risk points, backtracking the stored variables by means of parameters of the risk points which are identified, and if the parameters of the risk points can be backtracked to an importable point, considering the risk point is potential risk points to cause security flaws when without security function processing in the process of backtracking. Compared with the prior art, the method for detecting security flaws of the source files has no need to build up an abstract syntax tree, processing procedures are simplified, resources of a testing system are saved, and code scanning efficiency is improved.

Description

【Technical field】 [0001] The invention relates to the technical field of software security in information security, in particular to a detection method and detection device for source file security loopholes. 【Background technique】 [0002] Existing methods for detecting security vulnerabilities in source files usually scan and analyze the source code to establish its corresponding abstract syntax tree (AST), and according to the pre-defined maneuverable points and risk points, in the established abstract syntax tree Search the execution path between the controllable point and the risk point to find potential risks that may lead to security breaches. If the risk point on the execution path can be controlled by the maneuverable point on the execution path, then determine the execution path as a potentially risky execution path that may lead to a security breach. This kind of detection method by building an abstract syntax tree, and then traversing the abstract syntax tree fo...

AI Technical Summary

Problems solved by technology

This kind of detection method by building an abstract syntax tree, and then traversing the abstract syntax tree for backtracking algorithm, and finally finding a user-controllable path is relatively complicated. For each source code file to be scanned, an abstract syntax tree needs to be constructed, so Need to consume more test system resources, resulting in low efficiency of code testing

Images