Native PHP application-oriented taint type vulnerability detection method and system

Abstract

The invention discloses a taint type vulnerability detection method and system oriented to a native PHP application, and belongs to the technical field of vulnerability detection. The method comprises the following steps: generating a control flow diagram of each function in a PHP program source code; the method comprises the following steps of: initializing a function call graph which does not contain any node for a PHP program source code; determining a value range of each variable in the PHP program based on the control flow graph and the initialized function call graph, and carrying out iterative updating on an initial value set analysis result and the initialized function call graph; fusing the final function call graph and the control flow graph to generate an inter-process control flow graph, and executing inter-process arrival constant value analysis based on the inter-process control flow graph and a final value set analysis result to generate a data dependency graph; and propagating the stain information along the data dependence graph, and combining the final value set analysis result to obtain a stain type vulnerability detection result of the PHP program. According to the method, the dynamic value can be accurately deduced, and potential taint type vulnerabilities in the Web application can be found as early as possible.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of vulnerability detection, and particularly relates to a taint type vulnerability detection method and system for a native PHP application. BACKGROUND

[0002] PHP-based web applications are the core of network infrastructure, and their wide deployment and data sensitivity make them the focus of attacks. Among them, taint type vulnerabilities are the main security threats due to their high incidence and exploitability. The cause lies in the direct transmission of unverified user input to sensitive functions, triggering attacks such as command injection, SQL injection, and XSS, leading to data leakage or system control, etc. Major risks. To address such security issues, existing detection methods are mainly divided into dynamic and static analysis: dynamic analysis methods identify vulnerabilities by injecting attack payloads and analyzing response states, but they have high requirements for manual configuration, insufficient code coverage, and are prone to false negatives; in comparison, static analysis methods have comprehensive code coverage and automation advantages, making them more easily integrated into the development process, and have become the mainstream and effective means for detecting taint type vulnerabilities in PHP applications.

[0003] The effectiveness of static analysis in detecting taint type vulnerabilities in native PHP applications is highly dependent on the accurate and complete construction of call graphs and data dependency graphs. However, the dynamic nature of PHP and the large scale of modern PHP applications pose dual challenges: 1) Static inference of dynamic values. The dynamic nature of PHP runtime (such as dynamic method calls) makes it difficult for static analysis to determine dynamic values. Existing research classifies the sources of dynamic values into three categories: code constants, user / configuration file / database external inputs, and a mixture of constants and external inputs. The mainstream method uses regular expressions to represent dynamic values, but has significant limitations: first, it ignores the context sensitivity of constant values, which may have different values in different contexts; second, the use of (.) to represent external inputs can cause function name overfitting or underfitting problems; third, for complex string processing involving loops and regular operations, existing methods simplify and reduce to (. ), resulting in inaccurate inference results; 2) Precision and efficiency trade-off in large-scale PHP applications. Precise vulnerability detection requires accurate modeling of taint propagation; however, existing methods have some significant limitations. First, the taint propagation of arrays and objects uses an overly approximate strategy, where a single element contamination marks the entire data structure, introducing excessive false positives; second, implicit data flow propagation introduced by dynamic characteristics, such as $GLOBALS superglobal array access or variable variable property operations, is not fully addressed, resulting in false negatives; finally, implementing precise taint tracking relies on computationally intensive alias analysis, resulting in excessively long analysis times, severely restricting its applicability in continuous integration processes. SUMMARY

[0004] The application discloses a taint type vulnerability detection method and system (ZIPPER) for a native PHP application.

[0005] To achieve the above object, the technical scheme of the application includes the following contents.

[0006] A taint type vulnerability detection method for a native PHP application, the method comprising:

[0007] generating a control flow graph of each function in a PHP program source code;

[0008] initializing a function call graph without any node for the PHP program source code;

[0009] determining the value range of each variable in the PHP program based on the control flow graph and the initialized function call graph to obtain an initial value set analysis result, and iteratively updating the initial value set analysis result and the initialized function call graph;

[0010] fusing the final function call graph and the control flow graph to generate an inter-process control flow graph, and performing inter-process reachability constant analysis based on the inter-process control flow graph and the final value set analysis result to generate a data dependency graph;

[0011] propagating taint information along the data dependency graph and combining the final value set analysis result to obtain a taint type vulnerability detection result of the PHP program.

[0012] Further, determining the value range of each variable in the PHP program based on the control flow graph and the initialized function call graph to obtain an initial value set analysis result comprises:

[0013] obtaining a simplified language describing the syntax of the PHP language, the simplified language being a set of one or more functions, the function definition of the simplified language comprising a function name and a parameter list, and the function body comprising one or more program statements;

[0014] defining an analysis domain of value set analysis;

[0015] generating a block digest for each basic block in the control flow graph;

[0016] According to the order of the control flow graph, collect the symbolic side-effects of global variables and formal parameters involved in each block summary, and recursively generate a function summary of a called function based on the symbolic side-effects of global variables and formal parameters involved in the block summary when processing a function call point; wherein, for functions with mutual recursion relationship, the function summary of the function is obtained by constantly iterating and merging symbolic summaries until converging to a fixed point, and the function call point is obtained based on the initialized function call graph;

[0017] Based on the simplified language, the function summary and the analysis domain are used to perform reverse evaluation on the value set to obtain an initial value set analysis result.

[0018] Further, the definition of the analysis domain includes:

[0019] Locations l∈L represent identifiers of positions where statements are located, and are used to distinguish statements at different positions in the program; wherein, L represents a set of positions where all statements in the program are located;

[0020] Fields f∈F refer to field or attribute names that can be accessed in an object; wherein, F represents a set of all field names;

[0021] Strings s∈V_str represent an element in a set of string values; wherein, V_str represents a set of all string values in the program;

[0022] Integers i∈V_int represent an element in a set of integer values; wherein, V_int represents a set of all integer values in the program. In addition, the values of the Boolean type are represented by integer values;

[0023] Objects o∈V_obj represent an element in a set of symbolic objects; wherein, V_obj represents a set of all symbolic objects in the program;

[0024] Arrays a∈V_arr represent an element in a set of symbolic arrays; wherein, V_arr represents a set of all symbolic arrays in the program;

[0025] Symbolic values V=V_int∪V_str∪V_arr∪V_obj define the entire symbolic value space V;

[0026] Variables x,y,…∈Var represent variables appearing in the program; wherein, Var represents a set of all possible variable names in the program;

[0027] Environment E represents associating a certain variable in the set Var to a corresponding symbol value set; wherein, the type of the symbol value includes: integer type, string type, array type or object type;

[0028] Object state O represents a binary mapping, wherein the binary mapping Object state O accepts data (o, f), and returns a symbol value set, o∈V_obj, f∈F;

[0029] Array state A represents a binary mapping, wherein the binary mapping Array state A accepts data (a, k), and returns a symbol value set, a∈V_arr, k∈V_int∪V_str.

[0030] Further, the value set analysis result includes: integer value set, string value set, array information set, class object value set and Boolean value set, wherein the Boolean value is represented in the form of integer.

[0031] Further, the initial value set analysis result and the initialized function call graph are iteratively updated, including:

[0032] Based on the initialized function call graph, a work queue composed of function call points is maintained;

[0033] On the basis of the initial value set analysis result, the calling relationship of the function is gradually parsed in an iterative manner to obtain the final function call graph;

[0034] Wherein, in each iteration, according to the type of the function call point, the corresponding construction rule is selected for parsing processing, and if the called function set corresponding to the function call point changes after parsing, the newly discovered function call point is added to the work queue.

[0035] Further, the construction rule includes:

[0036] For class method calling, the object variable corresponding object is obtained based on the value set analysis result of the corresponding iteration round, and the corresponding method is searched in the class to which the object belongs;

[0037] For dynamic function calling, modeling processing is carried out based on the string parsing rule, object calling rule and array parsing rule; wherein, for the built-in function supporting callback mechanism, the built-in function is equivalent converted into dynamic calling form for unified processing;

[0038] For a file inclusion call in a PHP program, the top-level code of the file to be included is regarded as an entry function, and when an include statement is detected by the analysis, a corresponding variable holding a string is obtained according to the value set analysis result of the corresponding iteration round to find the corresponding PHP file, and a call edge is established between the current call point and the entry function;

[0039] When the result of the backward evaluation is empty or a string, a first heuristic rule is applied, the first heuristic rule comprising:

[0040] A corresponding symbolic expression is obtained by collecting path constraints of the basic block;

[0041] A value set analysis is applied to the symbolic expression, and a symbolic expression involving a target variable is screened out;

[0042] The screened symbolic expression is converted into an automaton based on semantics, and a final regular expression is generated by automaton intersection;

[0043] When the evaluation fails and the variable to be evaluated is a receiver object of a method call, a second heuristic rule is applied, the second heuristic rule comprising:

[0044] All method calls in the folder containing the receiver object are collected;

[0045] Based on all method calls in the folder containing the receiver object, the control flow graph is traversed to extract data flow features;

[0046] After clustering based on the data flow features and identifying a class definition containing all method names in the cluster, a placeholder object of the corresponding type is created to assist in method call resolution.

[0047] Further, inter-procedural reach constant analysis is performed based on the inter-procedural control flow graph and the final value set analysis result to generate a data dependency graph, including:

[0048] The inter-procedural control flow graph is pruned, and the pruning is used to retain statement nodes involving global variable reading and writing;

[0049] Inter-procedural reach constant analysis is performed based on the pruned inter-procedural control flow graph; wherein the reach constant analysis comprises:

[0050] The string value set in the final value set analysis result is used to determine the actual global variable name referenced by each $GLOBALS expression;

[0051] For a variable variable, the string value set in the final value set analysis result is used to assist in resolving the actual meaning of the variable name;

[0052] For the extract() function, the array information in the final value set analysis result is utilized to restore the imported variable set.

[0053] Further, the taint information is propagated along the data dependency graph, and combined with the final value set analysis result, to obtain the taint-type vulnerability detection result of the PHP program, including:

[0054] The taint information is propagated along the data dependency graph, and if a function call is encountered during the propagation, the called function is entered, and after the corresponding local data dependency graph is constructed, the formal parameters are regarded as taints and the propagation is continued; wherein, the alias relationship existing in the propagation process is determined based on the final value set analysis result;

[0055] When the taint propagation reaches the taint sink, the corresponding path is determined as a potential vulnerability path.

[0056] Further, the alias relationship existing in the propagation process is determined based on the final value set analysis result, including:

[0057] For the nodes involving object property access or array element access, the object or array referenced by the node and the corresponding object property name or array index are determined based on the final value set analysis result;

[0058] All access nodes intersecting with the object / array and the property name / index are found back along the control flow graph, so as to identify the potential alias.

[0059] A taint-type vulnerability detection system for native PHP applications, the system comprising:

[0060] A code preprocessing module for generating a control flow graph of each function in the PHP program source code;

[0061] A function call graph construction module for initializing a function call graph not containing any node for each function in the PHP program source code;

[0062] A value set analysis module for determining the value range of each variable in the PHP program based on the control flow graph and the initialized function call graph, to obtain an initial value set analysis result; wherein, the function call graph construction module and the value set analysis module are further used to iteratively update the initial value set analysis result and the initialized function call graph;

[0063] A data dependency graph generation module for fusing the final function call graph and the control flow graph to generate an inter-process control flow graph, and performing inter-process reachability analysis based on the inter-process control flow graph and the final value set analysis result, to generate a data dependency graph;

[0064] A fragile path exploration module is configured to propagate the taint information along the data dependence graph and combine the final value set analysis result to obtain a taint-type vulnerability detection result of the PHP program.

[0065] Compared with the prior art, the present application has at least the following beneficial effects.

[0066] 1) The present application can assist software developers to find potential taint-type vulnerabilities in software systems as early as possible, thereby improving the security and reliability of the software system.

[0067] 2) The processing of the dynamic characteristics of the native PHP language in the present application can be applied to the static analysis of the dynamic characteristics of other scripting languages, thereby improving the accuracy of the static analysis. BRIEF DESCRIPTION OF DRAWINGS

[0068] Figure 1 The figure shows the architecture of the taint-type vulnerability detection system for native PHP applications. DETAILED DESCRIPTION

[0069] The present application will be further described in detail below with reference to the accompanying drawings, and the examples are only used to explain the present application and are not intended to limit the scope of the present application.

[0070] The taint-type vulnerability detection system for native PHP applications ZIPPER as shown in the figure is composed of code preprocessing, context-sensitive value set analysis, function call graph construction, data dependence graph generation and fragile path search. Figure 1

[0071] I. Code preprocessing.

[0072] The code preprocessing module takes the PHP program source code as input, first constructs the corresponding abstract syntax tree, and then generates the corresponding control flow graph for each function in the source code.

[0073] II. Context-sensitive value set analysis.

[0074] The value set analysis is based on the control flow graph and the function call graph, and determines the possible value range of each variable in the program through static analysis. These values can include integers (Boolean types are modeled as integers), strings, arrays and class objects. Among them, the functions of various values are as follows:

[0075] 1) The strings, arrays and class objects will be used for the construction of the function call graph in Section III;

[0076] 2) The strings and arrays will be used for the generation of the data dependence graph in Section IV;

[0077] 3) The integers, strings, arrays and class objects will be used for the search of the fragile path in Section V. ​

[0078] The value set analysis and the function call graph construction in Section 3 are interdependent. To solve this circular dependency problem, the present application introduces an iteration mechanism: when performing the value set analysis for the first time, an empty function call graph is used as the initial input, and the function call graph is updated step by step during the analysis until it no longer changes. The detailed implementation is described in Section 3.

[0079] 2.1 Basic definitions.

[0080] For the convenience of explanation, the present application first describes the syntax of the PHP language in a simplified language, so as to explain the analysis method of the present application:

[0081] 1. Top-level structure. A program in the simplified language is a collection of one or more functions (Function). The function definition of the simplified language contains a function name, with a parameter list (such as $x, $y, etc.), and the function body is composed of one or more statements S.

[0082] 2. Program statements.

[0083] a) $x = new τ: Create a new object or a new array (of type τ), and assign it to variable $x.

[0084] b) $x = e: Calculate the expression e, and assign the result to variable $x.

[0085] c) ArrStore ($x, $y, $z): Corresponding to $x[$y] = $z in PHP, that is, store the value $z in the $yth item of the array $x.

[0086] d) ObjStore ($x, $f, $y): Corresponding to $x->f = $y in PHP, that is, store the value $y in the property f of the object $x.

[0087] e) VarStore ($x, $y): Corresponding to $$x = $y in PHP, that is, store the value $y in the variable whose variable name is $x (variable variable assignment).

[0088] f) f ($v1, $v2,...): Function call, call the function f, and pass in the arguments $v1, $v2,...

[0089] g) return $x: Return the value of variable $x from the function.

[0090] h) if ($x) {S 1；} else {S 2；}: Conditional statement. If $x is true, execute statement S1, otherwise execute S2.

[0091] i) S1; S2: execute two statements sequentially, i.e., S1 first, then S2.

[0092] 3. Expression.

[0093] a) $y: represents variable access.

[0094] b) UaryOp $y: unary operator on variable $y.

[0095] c) BinaryOp ($y, $z): binary operator on two variables $y and $z.

[0096] 4. Binary operator BinaryOp

[0097] a) ArrLoad: array read operation (e.g., $x = $a[$b]);

[0098] b) ObjLoad: object field read (e.g., $x = $a->f);

[0099] c) +, -,... : common arithmetic operators.

[0100] 5. Unary operator UaryOp

[0101] a) VarLoad: read value from variable variable, i.e., $y = $$x;

[0102] b) -,... : common arithmetic operators.

[0103] In this simplified language, 1) all loop structures (e.g., for loop) are unrolled once; 2) $y = VarLoad ($x) and VarStore ($x, $y) are used to represent the statements $y = $$x and $$x = $y, respectively. In PHP language, $$x represents variable variable, i.e., the value of variable $x is used as the name of another variable, then $y = $$x represents reading value from $a and assigning to $y, while $$x = $y represents storing the value of variable $y to variable $a; 3) BinaryOp represents binary operator, which includes not only regular arithmetic operations, but also array and object read operations, denoted as ArrLoad and ObjLoad, respectively. Write operations are represented by ArrStore ($x, $y, $z) (corresponding to $x[$y] = $z in PHP) and ObjStore ($x, f, y) (corresponding to $x->f = $y in PHP); 4) the simplified language only supports simple function call in the form of f ($x, $y,...). How to support more complex features in PHP will be further introduced in Section 3.

[0104] Next, the analysis domain of value set analysis will be introduced by the present application:

[0105] 1. Locations l∈L represent the identifiers of the locations where the statements are located, which are used to distinguish the statements in different locations in the program. Where L represents the set of locations where all statements in the program are located;

[0106] 2. Fields f∈F refer to the names of the "fields" or "properties" that can be accessed in the object. Where F represents the set of all possible field names;

[0107] 3. Strings s∈V_str represent an element in the set of "string" values. Where V_str represents the set of all possible string values in the program;

[0108] 4. Integers i∈V_int represent an element in the set of "integer" values. Where V_int represents the set of all possible integer values in the program. In addition, the values of the Boolean type are represented by integer values;

[0109] 5. Objects o∈V_obj represent an element in the set of "symbolic objects". Where V_obj represents the set of all possible symbolic objects in the program;

[0110] 6. Arrays a∈V_arr represent an element in the set of "symbolic arrays". Where V_arr represents the set of all possible symbolic arrays in the program;

[0111] 7. Symbolic values V=V_int∪V_str∪V_arr∪V_obj define the entire "symbolic value space"

[0112] V. After merging these four sub-sets, all possible symbolic values are formed. At any time, variable or field access can only get values in a subset of V;

[0113] 8. Variables x,y,…∈Var represent the variables appearing in the program. Where Var represents the set of all possible variable names in the program;

[0114] 9. Environment E is a mapping that associates a variable in Var to a "set of possible symbolic values".

[0115] Symbolic values can be integers (Vint), strings (Vstr), arrays (Varr), or objects (Vobj);

[0116] 10. Object state O is a binary mapping that takes a pair (o, f), where o e V_obj and f e F, and returns a set of symbolic values. This represents all the symbolic values that can be stored for the field f of the object o;

[0117] 11. Array state A is a binary mapping, Array state A is also a binary mapping that takes a pair (a, k), where a e V_arr and k e V_int U V_str, and returns a set of symbolic values. This represents all the symbolic values that can be stored at the index k of the array a.

[0118] 2.2 Function summary construction.

[0119] The present application captures the semantic information of functions and basic blocks in a PHP program through symbolic summaries (symbolic expressions and side effects).

[0120] Specifically, it is divided into the following two steps:

[0121] 1. Block summary construction. The present application first generates a block summary for each basic block in the control flow graph of a function. Through the semantics of each program statement, the block summary maps each variable x to a set of symbolic expressions and symbolic side effects, thus effectively modeling data dependencies and side effects operations. Symbolic expressions use a nested tree structure to accurately model expressions and their data dependencies in the program, where leaf nodes represent variables or parameters defined outside the current block. Symbolic side effects are used to represent program statements with side effects, such as VarStore, ArrStore, and ObjStore, which correspond to modifications of the variable environment (E), array environment (A), and object environment (O), respectively. Side effects themselves can also contain symbolic expressions as sub-expressions. To ensure the flow sensitivity of the analysis process, the present application traverses the statements in the basic block in the order of the control flow to generate the block summary.

[0122] 2. Function summary construction. The function summary consists of three parts: the block summaries of the basic blocks within the function, the symbolic side effects of the function on global variables and formal parameters, and the symbolic expression of the function return value. After completing the construction of all basic block summaries within the function, according to the order of the control flow graph, the symbolic side effects of global variables and formal parameters involved in each block summary are collected. When processing a function call point, the function summary of the called function will be recursively generated. For functions with mutual recursion, the symbolic summaries are continuously iterated and merged until they converge to a fixed point.

[0123] 2.3 Backwards evaluation.

[0124] The present invention implements value inference based on the function summaries constructed from the above method. During the intra-procedural analysis phase, when a value query is initiated for a variable $x at a program point p, the present invention performs a backward traversal along the control flow graph from point p, collects the relevant symbolic expressions and symbolic side effects, and interprets them according to the following rules, and returns the final result as the evaluation result:

[0125] 1. Rule [NEW]. For an $x = new τ statement, a set of symbolic objects of the specified type is created.

[0126] 2. Rule [ASSIGN]. For an $x = e statement. The auxiliary function eval evaluates the expression e and updates the value set of variable $x. The auxiliary function eval supports three types of expression evaluation, including variable expression (VAREXP), unary expression (UNARYEXP), and binary expression (BINARYEXP).

[0127] a) Rule [VAREXP]. When the expression e is a variable $y, the eval function extracts the symbolic value set associated with the variable $y from the environment E as the evaluation result of the expression.

[0128] b) Rule [UNARYEXP]. When the expression e is in the form of a unary operation Unary $y, the eval function first obtains the symbolic value set corresponding to the variable $y from the environment E, and then applies the unary operator Unary to each element in the set to generate a new symbolic value set.

[0129] c) Rule [BINARYEXP]. When the expression e is a binary operation BinaryOp ($x, $y), the eval function first extracts the symbolic value sets associated with variables $x and $y from the environment E, respectively. Subsequently, the two sets are combined according to the binary operator BinaryOp to produce a new symbolic value set.

[0130] 3. Rule [OBJSTORE]. For the program statement ObjStore ($x, $y, $z), the eval function first extracts the symbolic variable sets X, Y, and Z corresponding to variables $x, $y, and $z from the environment E. Subsequently, it writes Z to the field f of each object o in set X, where f ∈ Y, to update the corresponding state information.

[0131] 4. Rule [ARRSTORE]. For the program statement ArrStore ($x, $y, $z), the eval function first obtains the symbolic variable sets X, Y, and Z associated with variables $x, $y, and $z from the environment E. Subsequently, it writes Z to the state at index k of each array a in set X, where k ∈ Y.

[0132] 5. Rule [VARSTORE]. For the program statement VarStore ($x, $y), the eval function first extracts the sets of symbolic variables X and Y associated with the variables $x and $y from the environment E, and then writes Y into the state associated with each variable v in X in the environment E.

[0133] In the inter-procedural analysis phase, the present invention supports the case that the query depends on a formal parameter p in the current method, where the value of p is derived from the actual parameter passed by the caller. In this case, the query is propagated to the corresponding call site to complete the parameter evaluation. For variables that are not defined in the current scope, such as global variables, the present invention also adopts the query propagation approach.

[0134] 2.4 Heuristic rules.

[0135] 2.3 Backwards evaluation may not be able to determine the value set of a variable precisely when dealing with user input or complex string operations. To this end, the present invention introduces two heuristic reasoning rules to further refine the analysis:

[0136] 1) Constraint-based reasoning. When the result of backwards evaluation is empty or a string, the following rule is applied: (a) collect path constraints: starting from the basic block containing the variable to be evaluated, traverse the control flow graph backwards to collect the path constraints that reach the block; (b) extract relevant constraints: apply value set analysis on the collected symbolic expressions to filter out the ones involving the target variable; (c) constraint to regular expression: convert the filtered symbolic expressions to automata based on semantics (e.g. x e {s1, s2,...} to s1 | s2 |...), and generate the final regular expression by taking the intersection of the automata.

[0137] 2) Feature-based reasoning. If the evaluation fails and the variable to be evaluated is the receiver object of a method call, this rule is applied.

[0138] This rule is based on the observation that receiver objects in functionally similar files (e.g. Controllers) often have similar features (e.g. variable naming, assignment calls). Collect all method calls in the folder containing the receiver object. Traverse the control flow graph to extract data flow features (e.g. variable names, function names, and parameters). Cluster based on features, identify the class definition containing all the method names in the cluster, and create a placeholder object of this type to assist in method call resolution.

[0139] III. Function call graph construction.

[0140] The application proposes a method of constructing accurate function call graph based on value set analysis. Because of the flexible and diverse forms of function calls in PHP, traditional static call graph is difficult to cover all possible call paths. The application parses function call statements through the results of value set analysis and gradually expands the call graph.

[0141] In addition, because of the inter-procedural context sensitivity of value set analysis, it is necessary to rely on function call graph as input. For the mutual dependence between function call graph and value set analysis, the application introduces an iterative mechanism to solve it. In the initial stage, the function call graph is empty; during the analysis process, when the function call graph changes, the updated call graph is used as the input of value set analysis to run again until the function call graph no longer changes. Specifically, the application maintains a work queue composed of function call points and gradually parses the call relationship between functions through iteration. In each iteration, the corresponding construction rule is selected according to the type of the call point for processing. If the set of called functions corresponding to a call point changes after parsing, the newly discovered function call point is added to the work queue. Initially, the work queue is composed of call points in the program entry function, and the system parses the reachable functions and their call points layer by layer until the fixed point is reached, that is, no new reachable functions are found.

[0142] The application gives the construction rules of function call graph:

[0143] 1. Rule [MCALL]. For class method call, such as $x->m(...), the application uses rule [MCALL] to parse. The rule first obtains the object set that the object variable $x may correspond to based on value set analysis, and parses the method name m based on the class definition of each object, that is, searches for the method named m in the class to which the object o belongs.

[0144] 2. Rule [DCALL]. For dynamic function call, that is, the call statement whose call target is determined by a variable (such as $x()), the application uses a combination of multiple rules to model and process, including string parsing, object call and array parsing. In addition, built-in functions such as call_user_func that support callback mechanism can be equivalent to dynamic call form for unified processing. The following rules are all based on value set analysis to obtain the value set that the object variable $x may correspond to:

[0145] a) String parsing rule. If the variable $x holds a string s, find the function named s;

[0146] b) Object call rule. If $x is an object o, search for the __invoke magic method defined in its class;

[0147] c) Array resolution rules. If $x is an array, the first element is assumed to be a class object and the second element is assumed to be a method name, to determine the call target.

[0148] 3. Rule [INCLUDE]. For file inclusion calls in PHP, i.e., dynamically loading and executing the content of other PHP script files via include statements, the present invention regards the top-level code of the included file as its "entry function". When an include statement such as include $x is detected, ZIPPER looks for the corresponding PHP file based on the string held in $x obtained from the value set analysis, and establishes a call edge between the current call site and the entry function of the file, thus achieving a unified representation of file inclusion and function call graph.

[0149] To cope with the case that the string value is not fully known (e.g., only the prefix is available), the present invention further supports a fuzzy matching mechanism. When the name of the call target cannot be accurately obtained, regular expressions can be used to match the function name or file name, and possible candidate functions or files can be resolved.

[0150] Four. Data dependence graph generation.

[0151] The data dependence graph (DDG) employed by the present invention is composed of a global data dependence graph (GDDG) and a local data dependence graph (LDDG), which are used to comprehensively model the definition-use relationships among variables. 1) The GDDG describes the data dependence relationships among global variables and class static attributes. To construct the GDDG, the present invention first fuses the function call graph and the control flow graph to generate an inter-procedural control flow graph (ICFG); then performs inter-procedural reaching definition analysis based on the IFDS framework, and finally generates the GDDG based on the analysis result. To improve the analysis efficiency, the ICFG is pruned before performing the reaching definition analysis, and only the key statement nodes involving global variable read / write are retained. In addition, to accurately identify the global variables accessed via $GLOBALS, the present invention uses the set of string values obtained from the value set analysis to determine the actual global variable names referenced by each $GLOBALS expression, so that only the statements that actually affect the global state are retained; 2) The LDDG is constructed on demand, and is generated only when the pollution propagation enters a function, which is used to capture the data flow relationships among its local variables. During the construction, for mutable variables, the string values provided by the value set analysis can assist in resolving the actual meaning of the variable name; for the extract() function, the array information output by the value set analysis can be used to restore the set of variables imported, so that the local data dependence relationships can be restored more accurately.

[0152] In the above manner, the present invention achieves accurate modeling of the data dependence between global and local variables in static analysis, and has good adaptability and analysis accuracy in handling dynamic characteristics.

[0153] V. Fragile path search.

[0154] On the basis of the above, the application proposes a method of on-demand taint analysis to improve the detection accuracy and efficiency of potential taint-type vulnerabilities in PHP programs. According to the fourth section, the method represents the program to be analyzed as a data dependence graph and models the taint analysis as a reachability problem on the graph. During the analysis, the taint information propagates along the data dependence graph, identifying potential paths from untrusted input to sensitive operations. The method supports on-demand construction of LDDG and integrates accurate on-demand alias analysis to improve overall performance and accuracy.

[0155] Specifically, the application takes a set of taint sources, taint sinks and sanitization functions as input, propagates taint information along the data dependence graph. During the propagation process, if a function call is encountered, all possible called functions are entered, the corresponding LDDG is constructed, and the formal parameters are considered as taints and continue to propagate; once the taint propagation reaches the taint sink, the corresponding path is determined as a potential vulnerability path. To accurately capture the taint propagation relationship in heap structures such as object properties and array elements, the application introduces an on-demand alias analysis mechanism during the propagation process, which relies on the value set analysis results to determine the alias relationship. Specifically, for nodes involving object property access (such as $obj->prop) or array element access (such as $arr[$index]), the actual object or array referenced by $obj / $arr and the possible property name or array index represented by prop / $index need to be determined based on the value set analysis results. Subsequently, all access nodes that may have intersections with the object / array and property name / index are found by backtracking along the control flow graph, thereby identifying potential aliases and expanding the taint propagation path. In addition, to improve the feasibility of the vulnerability path, the application extracts the control dependency conditions of each path during the taint path analysis phase, and combines the integer values obtained in the value set analysis to evaluate the reachability of the path in actual execution, thereby effectively filtering out false paths that are not reachable at runtime, improving the accuracy of the detection results. At the same time, the application implements context-sensitive taint propagation analysis by maintaining a function call stack, further enhancing the accuracy of the analysis.

[0156] Although specific embodiments of the application are disclosed for illustrative purposes, the purpose is to help understand the content of the application and to implement it, those skilled in the art can understand that various substitutions, changes and modifications are possible without departing from the spirit and scope of the application and the appended claims. Therefore, the application should not be limited to the disclosed content of the best embodiment, the scope of the application claimed is the scope defined by the claims.

Claims

1. A method for detecting tainted vulnerabilities in native PHP applications, characterized in that, The method includes: Generate the control flow graph for each function in the PHP program source code; For the PHP program source code, initialize a function call graph that does not contain any nodes; Based on the control flow graph and the initialized function call graph, the value range of each variable in the PHP program is determined to obtain the initial value set analysis results, and the initial value set analysis results and the initialized function call graph are iteratively updated. By merging the final function call graph and the control flow graph, an inter-process control flow graph is generated. Based on the inter-process control flow graph and the final value set analysis results, an inter-process arrival setpoint analysis is performed to generate a data dependency graph. Taint information is propagated along the data dependency graph, and combined with the analysis results of the final value set to obtain the tainted vulnerability detection results of the PHP program.

2. The method according to claim 1, characterized in that, Based on the control flow graph and the initialized function call graph, the value range of each variable in the PHP program is determined to obtain the initial value set analysis results, including: Obtain a simplified language that describes the syntax of the PHP language. The simplified language is a collection of one or more functions. The function definition of the simplified language contains a function name and a parameter list, and the function body consists of one or more program statements. Define the domain of analysis for value set analysis; Generate a block summary for each basic block in the control flow graph; According to the order of the control flow graph, the symbolic side effects of global variables and formal parameters involved in each block summary are collected. When processing function call points, the function summary of the called function is recursively generated based on the symbolic side effects of global variables and formal parameters involved in the block summary. For functions with mutual recursive relationships, the function summary of the function is obtained by iteratively merging symbolic summaries until convergence to a fixed point. The function call points are obtained based on the initialized function call graph. Based on the simplified language, the value set is evaluated in reverse based on the function summary and the analysis domain to obtain the initial value set analysis results.

3. The method according to claim 2, characterized in that, The definition of the analysis domain includes: Locations l∈L represent identifiers indicating the location of statements, used to distinguish statements in different locations within the program; where L represents the set of all statement locations in the program. Fields f∈F refer to the names of accessible fields or properties in the object; where F represents the set of all field names. Strings s∈V_str represents an element in the set of strings; where V_str represents the set of all string values ​​in the program; Integers i∈V_int represent an element in the set of integer values; where V_int represents the set of all integer values ​​in the program, and Boolean values ​​are represented by integer values; Objects o∈V_obj represent an element in the set of symbolic objects; where V_obj represents the set of all symbolic objects in the program; Arrays a∈V_arr represent an element in the set of symbol arrays; where V_arr represents the set of all symbol arrays in the program; Symbolic values ​​V = V_int ∪ V_str ∪ V_arr ∪ V_obj define the entire symbolic value space V; Variables x, y, ... ∈ Var represent the variables that appear in the program; where Var represents the set of all possible variable names in the program; Environment E represents associating a variable in the set Var with the corresponding set of symbolic values; where the types of symbolic values ​​include: integer type, string type, array type, or object type; Object state O represents a binary mapping that accepts data (o, f) and returns a set of symbolic values, o ∈ V_obj, f ∈ F; Array state A represents a binary mapping where it accepts data (a, k) and returns a set of symbolic values, a ∈ V_arr, k ∈ V_int ∪ V_str.

4. The method according to claim 1, characterized in that, The value set analysis results include: an integer value set, a string value set, an array information set, a class object value set, and a Boolean value set, wherein the Boolean values ​​are represented in integer form.

5. The method according to claim 4, characterized in that, Iterative updates are performed on the initial value set analysis results and the initialized function call graph, including: Based on the initialized function call graph, a work queue consisting of function call points is maintained; Based on the analysis results of the initial value set, the function call relationship is parsed step by step through an iterative method to obtain the final function call graph; In each iteration, the corresponding construction rule is selected for parsing based on the type of the function call point. If the set of called functions corresponding to a function call point changes after parsing, the newly discovered function call point is added to the work queue.

6. The method according to claim 5, characterized in that, The construction rules include: For class method calls, the object corresponding to the object variable is obtained based on the value set analysis results of the corresponding iteration round, and the corresponding method is searched in the class to which the object belongs; For dynamic function calls, modeling is performed based on string parsing rules, object calling rules, and array parsing rules; among them, for built-in functions that support callback mechanisms, the built-in functions are equivalently converted into dynamic calling forms for unified processing; For file inclusion calls in PHP programs, the top-level code of the included file is regarded as the entry function. When the analysis detects the inclusion statement, the corresponding PHP file is found by obtaining the string held in the corresponding variable based on the analysis result of the value set of the corresponding iteration round, and a call edge is established between the current call point and the entry function. When the result of reverse evaluation is empty or a string, the first heuristic rule is applied, which includes: The corresponding symbolic expressions are obtained by collecting the path constraints of the basic blocks; Value set analysis is applied to the symbolic expression to filter symbolic expressions involving the target variable; The filtered symbolic expressions are converted into automata based on semantics, and the final regular expression is generated by finding the intersection of the automata. When evaluation fails and the variable to be evaluated is the receiver object of the method call, the second heuristic rule is applied, which includes: Collect all method calls within the folder containing the receiver object; Traverse the control flow graph based on all method calls within the folder containing the receiver object to extract data flow features; Clustering is performed based on the characteristics of this data stream. After identifying the class definitions that contain all method names in the cluster, placeholder objects of the corresponding type are created to assist in method call resolution.

7. The method according to claim 4, characterized in that, Based on the inter-process control flow graph and final value set analysis results, perform inter-process reach-setpoint analysis to generate a data dependency graph, including: The inter-process control flow graph is trimmed to preserve statement nodes that involve reading and writing global variables. Inter-process reach-setpoint analysis is performed based on the trimmed inter-process control flow graph; wherein, the reach-setpoint analysis includes: Use the set of string values ​​in the final value set analysis results to determine the actual global variable name referenced by each $GLOBALS expression; For variable variables, the set of string values ​​in the final value set analysis results is used to help interpret the actual meaning of the variable name; The extract() function uses array information from the final value set analysis results to reconstruct the imported variable set.

8. The method according to claim 4, characterized in that, Taint information is propagated along the data dependency graph, and combined with the final value set analysis results, the tainted vulnerability detection results of the PHP program are obtained, including: Taint information is propagated along the data dependency graph. If a function call is encountered during the propagation process, the called function is entered, and after constructing the corresponding local data dependency graph, the formal parameters are treated as taints and the propagation continues. The aliasing relationships existing during the propagation process are determined based on the analysis results of the final value set. When a taint propagates to the taint convergence point, the corresponding path is identified as a potential vulnerability path.

9. The method according to claim 8, characterized in that, Based on the analysis results of the final value set, determine the aliasing relationships that exist during the propagation process, including: For nodes involving access to object properties or array elements, the object or array referenced by the node, as well as the corresponding object property name or array index, is determined based on the final value set analysis results. By backtracking along the control flow graph, we can find all access nodes that intersect with object / array and property name / index, thereby identifying potential aliases.

10. A tainted vulnerability detection system for native PHP applications, characterized in that, The system includes: The code preprocessing module is used to generate the control flow graph of each function in the PHP program source code; The function call graph building module is used to initialize a function call graph that does not contain any nodes for each function in the PHP program source code; The value set analysis module is used to determine the value range of each variable in the PHP program based on the control flow graph and the initialized function call graph, so as to obtain the initial value set analysis results; wherein, the function call graph construction module and the value set analysis module are also used to iteratively update the initial value set analysis results and the initialized function call graph; The data dependency graph generation module is used to merge the final function call graph and the control flow graph to generate an inter-process control flow graph, and to perform inter-process arrival setpoint analysis based on the inter-process control flow graph and the final value set analysis results to generate a data dependency graph. The vulnerability path exploration module is used to propagate taint information along the data dependency graph and combine it with the final value set analysis results to obtain the taint-type vulnerability detection results of the PHP program.

Images