PHP static code analysis method based on taint analysis

Abstract

The invention relates to a PHP static code analysis method based on taint analysis. The method comprises the following steps: firstly, performing lexical analysis and grammatical analysis on PHP static codes, and constructing an abstract syntax tree corresponding to the codes; secondly, segmenting the abstract syntax tree into different sub-functions, and marking taint data streams in each function by using a taint analysis technology; and finally, judging whether a vulnerability exists or not according to the convergent point parameter property of the taint data stream. In addition, when the taint data stream is marked, the variable range is narrowed by limiting the data type of the newly added variable, and the vulnerability false alarm rate is reduced by combining measures such as conditions when the safety threat function is utilized. According to the method, automatic tool vulnerability detection can be achieved, and under the condition that no branch exists in the code, vulnerability detection of the Web application can be completed more efficiently and more accurately.

Description

technical field [0001] The invention relates to the field of network security, in particular to a static code analysis method for PHP based on stain analysis. Background technique [0002] For code auditing, the current mainstream is divided into black box testing and white box testing. The biggest difference between the two testing methods is whether the audit system can obtain the source code of the target system. In black-box testing, the audit system does not know the source code of the target, and it treats the target program as a black box without considering the internal structure and logic of the target program. The audit system determines whether there is a loophole by continuously changing the input data and obtaining the output of the program or its working status. Since each test results in abnormal results through certain data, black-box testing is a testing method with a low false positive rate, but its detection coverage for vulnerabilities depends on the ca...

AI Technical Summary

Problems solved by technology

[0005] Generally speaking, although there are already PHP vulnerability analysis tools in the industry, most of the current source code analysis tools have fallen into the situation of stopping updating, and can no longer adapt to the grammatical features of the current new version of PHP.

This leads to incorrect identification of vulnerabilities introduced from new features and false positives for new features

Images