Application vulnerability detection method and system with custom validation function

Abstract

The application discloses an application vulnerability detection method and system with a self-defined verification function, and the detection method comprises the following steps: an IAST instrument is used to instrument a to-be-detected application program, so that vulnerability detection logic is woven into the application program; position information of a JSON analysis function return object in the application program is acquired; a mapping relationship among a field name, a field type and a field value in a JSON object returned by the JSON analysis function is extracted and stored, so that a tracking data set is obtained; a verification function is analyzed, so that a verification parameter in the current verification function that matches a verification rule model is acquired; the verification parameter is bound with a related field name in the tracking data set; a field bound with a feature field parameter in the tracking data set is marked as default security data; and according to the above method, when a field pointed by a vulnerability detection result belongs to a field bound with a verification parameter, the vulnerability information is automatically filtered out, so that false positives and false negatives are avoided, and the accuracy of a detection result is ensured.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of application program security detection, and in particular to an application program vulnerability detection method and system with a self-defined verification function. BACKGROUND

[0002] With the increasing size and complexity of programs, the number of vulnerabilities is also increasing, and the damage caused by the vulnerabilities is also increasing. Generally, security vulnerabilities are caused by unverified or encoded user input data directly entering sensitive functions. Therefore, common IAST tools on the market track the data flow propagation process of the tainted data to determine whether a security vulnerability exists. In actual application scenarios, an application program is provided with a user-defined verification function to verify input data. Fields verified by the verification function are safe fields. Therefore, when vulnerability information in a vulnerability detection result points to the safe field, the vulnerability information can be automatically filtered out, thereby improving detection accuracy.

[0003] The self-defined verification function is generally divided into two types. The first type is to verify the tainted data itself. The input parameter of the verification function is a single feature string in the tainted data (such as a login username or an email account). For this type of verification function, in an application program with multiple input operations, even if multiple input operations contain the same content, the feature parameter of the same field needs to be defined for each operation. The second type of self-defined verification function is used in an application program based on a JSON framework for data storage and parameter transmission. The verification function takes the entire JSON object data and the feature word to be verified as input parameters. That is, when user input request data is input, the entire tainted data object and the feature word (that is, the tainted data key) to be verified are input into the verification function. The verification function dynamically obtains the specific field from the tainted data object for verification using the tainted data key.

[0004] For the first type of self-defined verification function, since the input verification function is a single specific field, the existing IAST tool can well identify the field verified by the verification function, and define the field as a safe field. However, for the second type of self-defined verification function, since the entire JSON object is the output parameter, the IAST tool cannot identify the feature field being verified. If security marking is performed, the entire JSON object is marked as safe. Obviously, this cannot guarantee the accuracy of the detection result. If security marking is not performed, false positives may occur. SUMMARY

[0005] The purpose of this invention is to provide an application vulnerability detection method and system with a custom verification function to solve the above-mentioned technical problems, so as to effectively identify characteristic fields verified by the verification function and avoid false alarms during the vulnerability detection process of data storage and parameter passing of JSON framework.

[0006] To achieve the above objectives, this invention discloses an application vulnerability detection method with a custom verification function. The application uses a JSON framework for data storage and parameter passing, and includes a verification function for custom verification of tainted data input by the user. The verification function takes the entire JSON object and the feature to be verified as input parameters. The detection method includes:

[0007] The application under test is instrumented using the IAST instrumentation tool to weave vulnerability detection logic into the application. The vulnerability detection logic performs vulnerability detection by tracking the propagation path of tainted data in the application.

[0008] Retrieve the location information of the object returned by the JSON parsing function in the current application;

[0009] When the test tainted data enters the application, the mapping relationship of field names, field types, and field values ​​in the JSON object returned by the JSON parsing function is extracted and stored to obtain the tracking dataset;

[0010] The verification function is parsed to obtain the verification parameters in the current verification function that match the verification rule model;

[0011] Bind the verification parameters to the relevant field names in the tracking dataset;

[0012] Mark the fields in the tracking dataset that are bound to the feature field parameters as default safe data.

[0013] Preferably, the method for parsing the verification function includes:

[0014] The verification function is instrumented using the IAST instrumentation tool. When the tainted data passes through the verification function, the verification parameters are obtained from the verification parameter list position of the verification function according to the preset rules of the verification function; or,

[0015] The verification parameters are calculated based on empirical algorithms.

[0016] Preferably, the IAST tool is used to instrument the JSON parsing function in the application to obtain the location information of the object returned by the JSON parsing function.

[0017] Preferably, a function library is created that includes JSON parsing functions of several known parsing types, and it is determined whether any JSON class function in the current application exists in the function library. If it does, the JSON class function is directly instrumented through the IAST tool.

[0018] If not, the JSON parsing function used to parse the JSON object is inferred based on the input parameters and return value of each JSON class function in the application.

[0019] This invention also discloses an application vulnerability detection system with a custom verification function. The application uses a JSON framework for data storage and parameter passing. Furthermore, the application includes a verification function for custom verification of tainted data input by the user. This verification function takes the entire JSON object and the feature to be verified as input parameters. The detection system includes:

[0020] The vulnerability detection module is used to instrument the application under test using the IAST instrumentation tool to weave vulnerability detection logic into the application. The vulnerability detection logic performs vulnerability detection by tracking the propagation path of tainted data in the application.

[0021] A location information acquisition module, which is used to acquire the location information of the object returned by the JSON parsing function in the current application;

[0022] The dataset generation module is used to extract and store the mapping relationship of field names, field types, and field values ​​in the JSON object returned by the JSON parsing function after the test tainted data enters the application, so as to obtain the tracking dataset;

[0023] The verification parameter acquisition module is used to parse the verification function to obtain the verification parameters in the current verification function that match the verification rule model;

[0024] A binding module, which is used to bind the verification parameters to the relevant field names in the tracking dataset;

[0025] A tagging module is used to tag fields in the tracking dataset that are bound to the feature field parameters as default safe data.

[0026] Preferably, the verification parameter acquisition module is used to instrument the verification function using the IAST instrumentation tool. When the tainted data passes through the verification function, the module obtains the verification parameters from the verification parameter list position of the verification function according to the preset rules of the verification function, or calculates the verification parameters according to an empirical algorithm.

[0027] Preferably, the location information acquisition module instrumentes the JSON parsing function in the application using the IAST tool to obtain the location information of the object returned by the JSON parsing function.

[0028] Preferably, the location information acquisition module includes a function library creation module, a matching module, an instrumentation module, and an inference module;

[0029] The function library creation module is used to create a function library that includes JSON parsing functions for several known parsing types;

[0030] The matching module is used to match any JSON-type function in the current application with the functions in the function library to identify the JSON parsing function in the application.

[0031] The inference module is used to infer the JSON parsing function used to parse JSON objects based on the input parameters and return values ​​of each JSON-type function in the application when the matching module confirms that no JSON-type function in the current application matches the function in the function library.

[0032] The instrumentation module is used to instrument the JSON parsing function using the IAST tool.

[0033] This invention also discloses an application vulnerability detection system with a custom verification function, comprising:

[0034] One or more processors;

[0035] Memory;

[0036] And one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs including instructions for performing the application vulnerability detection method with custom verification functions as described above.

[0037] The present invention also discloses a computer-readable storage medium comprising a computer program that can be executed by a processor to perform the application vulnerability detection method with a custom verification function as described above.

[0038] Compared with existing technologies, the above-mentioned technical solution of the present invention performs vulnerability detection on applications that use JSON frameworks for data storage and parameter transmission. It detects vulnerabilities by tracing the propagation path of tainted data within the application. The application also includes a verification function. Since this verification function takes the entire JSON object and the feature words to be verified as input parameters, during vulnerability detection, when tainted data is verified, the verification function is parsed to obtain the verification parameters that match the verification rule model. These verification parameters are then bound to relevant field names in the tracking dataset extracted from the JSON object. Thus, when the field pointed to by the vulnerability detection result belongs to the field bound to the verification parameter, the vulnerability information is automatically filtered out, thereby avoiding false positives and false negatives and ensuring the accuracy of the detection results. Attached Figure Description

[0039] Figure 1 This is a flowchart of the application vulnerability detection method in an embodiment of the present invention.

[0040] Figure 2 This is a schematic diagram of the application vulnerability detection system in an embodiment of the present invention. Detailed Implementation

[0041] To illustrate the technical content, structural features, objectives, and effects of the present invention in detail, the following description is provided in conjunction with the embodiments and accompanying drawings.

[0042] This embodiment discloses an application vulnerability detection method for performing vulnerability detection on applications with custom verification functions based on the IAST instrumentation tool. The application uses a JSON framework for data storage and parameter passing; therefore, the verification function takes the key (feature word) of the entire JSON object (key-value pairs) as input parameter. For this verification function, a unified interception is performed at the application's request entry point, extracting a preset verification rule model and dynamically matching the incoming data. This verification rule model is implemented by configuring the key-value structure's keyword matching relationship through a configuration file, where the key is the field name in the tainted data and the value is the verification regular expression. If the incoming tainted data contains the same key, the corresponding verification regular expression is used to perform security verification on the tainted data. This verification method, for the IAST tool, cannot pinpoint which specific feature fields in the tainted data are being securely verified, which can lead to false positives or false negatives. Therefore, to solve this problem, such as... Figure 1 The detection method in this embodiment includes the following steps:

[0043] S1: The IAST instrumentation tool is used to instrument the application under test to weave vulnerability detection logic into the application. The vulnerability detection logic performs vulnerability detection by tracking the propagation path of tainted data in the application.

[0044] S2: Get the location information of the object returned by the JSON parsing function in the current application.

[0045] S3: When test tainted data enters the application, extract and store the mapping relationship of field names, field types, and field values ​​in the JSON object returned by the JSON parsing function to obtain the tracking dataset.

[0046] S4: Parse the validation function at the request input interface in the application to obtain the validation parameter that matches the validation rule model in the current validation function. For example, if the complete tainted data (i.e., the entire JSON object data) passed in through the request input interface is {"email":"zhangsan@qq.com","name":zhangsan","age":30}, and the feature to be validated is "email", then after receiving the complete JSON object data, the validation function matches it with the preset validation rule model to obtain the validation regular expression corresponding to "email". Therefore, after parsing, the obtained validation parameter is email.

[0047] S5: Bind the validation parameters to the relevant field names in the tracking dataset.

[0048] S6: Mark the fields in the tracking dataset that are bound to the feature field parameters as default secure data. This way, even if a security vulnerability is detected in the email field, the vulnerability information can be automatically filtered out.

[0049] The detection method disclosed in the above embodiments allows for the extraction and storage of mapping relationships between field names, field types, and field values ​​in the JSON object returned by the JSON parsing function during vulnerability detection. This is achieved by obtaining the location information of the object returned by the JSON parsing function in the application, thus obtaining a tracking dataset. The vulnerability detection logic performs vulnerability detection by tracing the data flow in this tracking dataset. Since the application has a verification function that verifies one or more features in the tainted data, and fields verified by the verification function can be confirmed as secure data, by parsing the verification function, obtaining the verification parameters that match the verification rule model in the current verification function, and binding these verification parameters with the relevant field names in the tracking dataset extracted from the JSON object, the vulnerability information is automatically filtered out when the field pointed to by the vulnerability detection result belongs to the field bound to the verification parameter. This avoids false positives and false negatives, ensuring the accuracy of the detection results.

[0050] Furthermore, methods for parsing the verification function include:

[0051] The IAST instrumentation tool is used to instrument the verification function. When tainted data passes through the verification function, if the syntax rules of the verification function are known, the verification parameters are obtained from the position of the verification parameter list of the verification function according to the preset rules of the verification function; if the syntax rules of the verification function are unknown, the verification parameters are calculated according to an empirical algorithm. The empirical algorithm is a conventional technique in this field and will not be described in detail here.

[0052] Furthermore, the location information of the object returned by the JSON parsing function in the IAST tool instrumentation application is obtained.

[0053] Therefore, in practical applications, if we want to automatically instrument JSON parsing functions in an application using the IAST tool, the IAST tool must first be able to identify which function in the application is the JSON parsing function; otherwise, manual instrumentation will be necessary, which is time-consuming. To solve this problem, the location method in this embodiment further includes:

[0054] Create a function library containing JSON parsing functions of several known parsing types, and determine whether any JSON class function in the current application exists in the function library. If it does, directly instrument the JSON class function using the IAST tool.

[0055] If not, the JSON parsing function used to parse JSON objects is inferred based on the input parameters and return values ​​of each JSON-class function in the application, thereby identifying the JSON parsing function in the application. Then, the JSON parsing function identified by the IAST tool can be instrumented.

[0056] Specifically, the request body containing a JSON-like function is as follows:

[0057]

[0058] In the request body mentioned above, since the JSON class function "readValue" is pre-defined in the function library, the JSON parsing function (i.e., readValue) in the request body can be quickly matched by comparing it with the various JSON parsing functions in the function library. Then, the readValue function in ObjectMapper can be instrumented, and the return value can be marked.

[0059] Another request body containing a JSON-like function is as follows:

[0060]

[0061] Within the request body, a comparison with function libraries containing multiple JSON parsing functions revealed no JSON class function with the same known parsing type as the function in question. Therefore, since normal JSON parsing functions typically take two parameters: a string or byte stream as the carrier of the JSON data, and the type of the JSON parsing object (e.g., returning an Object or a type identical to the JSON parsing object in Java), the JSON parsing function used to parse the JSON object, i.e., `parseObject`, can be inferred based on the input parameters and return value of each JSON class function in the request body. Then, the `parseObject` function can be instrumented using the IAST instrumentation tool.

[0062] In addition, JSON parsing objects generally return either class or object types. The former clearly indicates the object type, while the latter requires further techniques such as reflection to obtain the object type.

[0063] In the example above, for Person.class, in step S3, the field names in the object can be obtained first using techniques such as reflection. The specific execution statement is as follows:

[0064]

[0065] At this point, the extracted field names, field values, field types, and other mapping relationships can be stored, such as {"key":"name","value":"Zhang San","type":"string"}. It should be noted that the value attribute here stores a value carrying a memory address, meaning that two identical strings "Zhang San" will have different memory addresses.

[0066] like Figure 2 In another preferred embodiment of the present invention, an application vulnerability detection system with a custom verification function is also disclosed. The application uses a JSON framework for data storage and parameter passing, and the application is equipped with a verification function for custom verification of tainted data input by the user. The verification function takes the entire JSON object and the feature words to be verified as input parameters. The detection system includes:

[0067] The vulnerability detection module is used to instrument the application under test using the IAST instrumentation tool to weave vulnerability detection logic into the application. The vulnerability detection logic performs vulnerability detection by tracking the propagation path of tainted data in the application.

[0068] The location information acquisition module is used to obtain the location information of the object returned by the JSON parsing function in the current application;

[0069] The dataset generation module is used to extract and store the mapping relationship of field names, field types, and field values ​​in the JSON object returned by the JSON parsing function after the test taint data enters the application, so as to obtain the tracking dataset.

[0070] The verification parameter acquisition module is used to parse the verification function to obtain the verification parameters in the current verification function that match the verification rule model.

[0071] The binding module is used to bind validation parameters to relevant field names in the tracking dataset;

[0072] The tagging module is used to tag fields in the tracking dataset that are bound to the feature field parameters as default safe data.

[0073] Furthermore, the verification parameter acquisition module is used to instrument the verification function using the IAST instrumentation tool. When tainted data passes through the verification function, the verification parameters are obtained from the position of the verification parameter list of the verification function according to the preset rules of the verification function, or the verification parameters are calculated based on empirical algorithms.

[0074] Furthermore, the location information acquisition module obtains the location information of the object returned by the JSON parsing function in the IAST tool instrumentation application.

[0075] Furthermore, the location information acquisition module includes a function library creation module, a matching module, an instrumentation module, and an inference module;

[0076] The function library creation module is used to create function libraries that include JSON parsing functions for several known parsing types;

[0077] The matching module is used to match any JSON-type function in the current application with functions in the function library to identify the JSON parsing function in the application;

[0078] The inference module is used to infer the JSON parsing function used to parse JSON objects based on the input parameters and return values ​​of each JSON-type function in the application when the matching module confirms that no JSON-type function in the current application matches the function in the function library.

[0079] The instrumentation module is used to instrument JSON parsing functions using the IAST tool.

[0080] It should be noted that the working principle and process of the application vulnerability detection system in this embodiment are detailed in the above-mentioned application vulnerability detection method, and will not be repeated here.

[0081] This invention also discloses another application vulnerability detection system, which includes one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors. The programs include instructions for performing the application vulnerability detection method described above. The processor may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, used to execute the relevant programs to achieve the functions required by the modules in the application vulnerability detection system of this application embodiment, or to execute the application vulnerability detection method of this application method embodiment.

[0082] This invention also discloses a computer-readable storage medium comprising a computer program executable by a processor to perform the application vulnerability detection method described above. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium can be read-only memory (ROM), random access memory (RAM), or magnetic media, such as floppy disks, hard disks, magnetic tapes, magnetic disks, or optical media, such as digital versatile discs (DVDs), or semiconductor media, such as solid-state disks (SSDs).

[0083] This application also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. The processor of an electronic device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the electronic device to perform the aforementioned application vulnerability detection method.

[0084] The above-disclosed embodiments are merely preferred embodiments of the present invention and should not be construed as limiting the scope of the present invention. Therefore, any equivalent variations made in accordance with the claims of the present invention are still within the scope of the present invention.

Claims

1. A method for detecting application vulnerabilities with a custom verification function, characterized in that, The application uses a JSON framework for data storage and parameter passing. It also includes a validation function for custom validation of user-inputted tainted data. This validation function takes the entire JSON object and the feature to be validated as input parameters. The detection method includes: The application under test is instrumented using the IAST instrumentation tool to weave vulnerability detection logic into the application. The vulnerability detection logic performs vulnerability detection by tracking the propagation path of tainted data in the application. Retrieve the location information of the object returned by the JSON parsing function in the current application; When the test tainted data enters the application, the mapping relationship of field names, field types, and field values ​​in the JSON object returned by the JSON parsing function is extracted and stored to obtain the tracking dataset; The verification function is parsed to obtain the verification parameters in the current verification function that match the verification rule model; Bind the verification parameters to the relevant field names in the tracking dataset; Mark the fields in the tracking dataset that are bound to the verification parameters as default security data; The methods for parsing the verification function include: The verification function is instrumented using the IAST instrumentation tool. When the tainted data passes through the verification function, the verification parameters are obtained from the verification parameter list position of the verification function according to the preset rules of the verification function; or, The verification parameters are calculated based on empirical algorithms.

2. The application vulnerability detection method with a custom verification function according to claim 1, characterized in that, The IAST instrumentation tool is used to instrument the JSON parsing function in the application to obtain the location information of the object returned by the JSON parsing function.

3. The application vulnerability detection method with a custom verification function according to claim 2, characterized in that, Create a function library containing JSON parsing functions of several known parsing types, and determine whether any JSON class function in the current application exists in the function library. If it does, directly instrument the JSON class function using the IAST instrumentation tool. If not, the JSON parsing function used to parse the JSON object is inferred based on the input parameters and return value of each JSON class function in the application.

4. An application vulnerability detection system with a custom verification function, characterized in that, The application uses a JSON framework for data storage and parameter passing. Furthermore, the application includes a validation function for custom validation of user-input tainted data. This validation function takes the entire JSON object and the feature to be validated as input parameters. The detection system includes: The vulnerability detection module is used to instrument the application under test using the IAST instrumentation tool to weave vulnerability detection logic into the application. The vulnerability detection logic performs vulnerability detection by tracking the propagation path of tainted data in the application. A location information acquisition module, which is used to acquire the location information of the object returned by the JSON parsing function in the current application; The dataset generation module is used to extract and store the mapping relationship of field names, field types, and field values ​​in the JSON object returned by the JSON parsing function after the test tainted data enters the application, so as to obtain the tracking dataset; The verification parameter acquisition module is used to parse the verification function to obtain the verification parameters in the current verification function that match the verification rule model; A binding module, which is used to bind the verification parameters to relevant field names in the tracking dataset; A tagging module is used to tag fields in the tracking dataset that are bound to the verification parameters as default secure data; The verification parameter acquisition module is used to instrument the verification function using the IAST instrumentation tool. When the taint data passes through the verification function, the module obtains the verification parameters from the verification parameter list position of the verification function according to the preset rules of the verification function, or calculates the verification parameters according to an empirical algorithm.

5. The application vulnerability detection system with a custom verification function according to claim 4, characterized in that, The location information acquisition module uses the IAST instrumentation tool to instrument the JSON parsing function in the application to obtain the location information of the object returned by the JSON parsing function.

6. The application vulnerability detection system with a custom verification function according to claim 5, characterized in that, The location information acquisition module includes a function library creation module, a matching module, an instrumentation module, and an inference module; The function library creation module is used to create a function library that includes JSON parsing functions for several known parsing types; The matching module is used to match any JSON-type function in the current application with the functions in the function library to identify the JSON parsing function in the application. The inference module is used to infer the JSON parsing function used to parse JSON objects based on the input parameters and return values ​​of each JSON-type function in the application when the matching module confirms that no JSON-type function in the current application matches the function in the function library. The instrumentation module is used to instrument the JSON parsing function using the IAST instrumentation tool.

7. An application vulnerability detection system with a custom verification function, characterized in that, include: One or more processors; Memory; And one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs including instructions for performing the application vulnerability detection method with a custom verification function as described in any one of claims 1 to 3.

8. A computer-readable storage medium, characterized in that, Includes a computer program that can be executed by a processor to perform the application vulnerability detection method with a custom verification function as described in any one of claims 1 to 3.

Images