Method and system for quickly locating a location of tainted data in a JSON framework based on iast

Abstract

The application discloses a method and system for quickly locating the position of tainted data in a JSON framework based on IAST, which comprises the following steps: inserting a probe into a to-be-tested application program by using an IAST tool to weave vulnerability detection logic into the application program, and performing vulnerability detection by tracking the propagation path of the tainted data in the application program; obtaining the position information of a JSON parsing function return object in the current application program; extracting and storing the mapping relationship among the field name, field type and field value of the JSON object returned by the JSON parsing function after the test tainted data enters the application program; querying the execution result of the vulnerability detection logic to determine whether the current test request has a vulnerability, and if yes, associating the vulnerability information with the corresponding field name in the obtained JSON object; and when a developer checks the vulnerability data to repair the vulnerability, the technical solution can quickly locate the problem point through the field name of the tainted data, thereby facilitating the repair work of the vulnerability.

Description

Technical Field

[0001] This invention relates to the field of software testing technology, and in particular to a method and system for quickly locating tainted data in a JSON framework based on IAST for vulnerability detection and remediation in software testing. Background Technology

[0002] With the continuous development of software technology, programs are becoming increasingly larger, more complex, and more numerous. However, this also leads to a corresponding increase in the number of vulnerabilities in software, causing increasingly severe damage. Common security vulnerabilities arise from user-inputted tainted data entering sensitive functions without proper security validation or encoding. Therefore, common IAST tools on the market determine the existence of security vulnerabilities by tracing the data flow of tainted data (such as the web application testing data flow tracing method and system disclosed in Chinese invention patent CN111046396A). When the application under test still uses queryString or form data transmission, IAST tools can obtain the return value (i.e., tainted data) through functions such as getParameter(“key”). In this case, the tainted data can be associated with its key value, allowing developers to quickly locate problematic points based on the tainted data's key value. However, with the increasing development of technology, more and more applications use JSON request bodies for data parameter passing. While common IAST tools can trace the entire JSON request body, it is difficult to obtain the specific key containing tainted data within the JSON request body, which is detrimental to later vulnerability maintenance. Summary of the Invention

[0003] The purpose of this invention is to provide a method and system for quickly locating tainted data in a JSON framework based on IAST, so as to quickly locate fields of tainted data with vulnerabilities in the process of software vulnerability detection for data storage and parameter transmission based on the JSON framework, and facilitate vulnerability remediation.

[0004] To achieve the above objectives, this invention discloses a method for quickly locating tainted data in a JSON framework based on IAST, for use in application vulnerability detection and remediation. The application uses a JSON framework for data storage and parameter passing. The method includes:

[0005] The application under test is instrumented using the IAST tool to weave vulnerability detection logic into the application. The vulnerability detection logic performs vulnerability detection by tracking the propagation path of tainted data in the application.

[0006] Retrieve the location information of the object returned by the JSON parsing function in the current application;

[0007] When the test tainted data enters the application, the mapping relationship between field names, field types, and field values ​​in the JSON object returned by the JSON parsing function is extracted and stored;

[0008] The result of the vulnerability detection logic is queried to determine whether the current test request has a vulnerability. If so, the vulnerability information is associated with the corresponding field name in the JSON object obtained above.

[0009] Preferably, the IAST tool is used to instrument the JSON parsing function in the application to obtain the location information of the object returned by the JSON parsing function.

[0010] Preferably, a function library is created that includes JSON parsing functions of several known parsing types, and it is determined whether any JSON class function in the current application exists in the function library. If it does, the JSON class function is directly instrumented through the IAST tool.

[0011] If not, the JSON parsing function used to parse the JSON object is inferred based on the input parameters and return value of each JSON class function in the application.

[0012] This invention also discloses a system for quickly locating tainted data in a JSON framework based on IAST, for use in application vulnerability detection and remediation. The application uses a JSON framework for data storage and parameter passing. The system includes:

[0013] A vulnerability detection module is used to instrument the application under test using the IAST tool to weave vulnerability detection logic into the application. The vulnerability detection logic performs vulnerability detection by tracking the propagation path of tainted data in the application.

[0014] The JSON object location acquisition module is used to obtain the location information of the object returned by the JSON parsing function in the current application.

[0015] The data extraction module is used to extract and store the mapping relationship between field names, field types, and field values ​​in the JSON object returned by the JSON parsing function after the tainted data for testing enters the application.

[0016] The association module is used to associate the vulnerability information with the corresponding field name in the JSON object obtained above when a test request has a vulnerability.

[0017] Preferably, the JSON object location acquisition module instrumentes the JSON parsing function in the application using the IAST tool to obtain the location information of the object returned by the JSON parsing function.

[0018] Preferably, the JSON object location acquisition module includes a function library creation module, a matching module, an instrumentation module, and an inference module;

[0019] The function library creation module is used to create a function library that includes JSON parsing functions for several known parsing types;

[0020] The matching module is used to match any JSON-type function in the current application with the functions in the function library to identify the JSON parsing function in the application.

[0021] The inference module is used to infer the JSON parsing function used to parse JSON objects based on the input parameters and return values ​​of each JSON-type function in the application when the matching module confirms that no JSON-type function in the current application matches the function in the function library.

[0022] The instrumentation module is used to instrument the JSON parsing function using the IAST tool.

[0023] This invention also discloses a system for quickly locating tainted data in a JSON framework based on IAST, comprising:

[0024] One or more processors;

[0025] Memory;

[0026] And one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs including instructions for performing the method described above for quickly locating tainted data in a JSON framework based on IAST.

[0027] The present invention also discloses a computer-readable storage medium comprising a computer program that can be executed by a processor to perform the method described above for quickly locating tainted data in a JSON framework based on IAST.

[0028] Compared with existing technologies, the above-mentioned technical solution of the present invention, for vulnerability detection of applications that use JSON framework for data storage and parameter passing, pre-obtains the location information of the JSON parsing function returned by the application under test. Thus, when tainted data is entered into the application, the mapping relationship between field names, field types, and field values ​​in the JSON object returned by the JSON parsing function in the application can be obtained. Then, when a vulnerability is detected, the code line, function, and parameters to which the vulnerability belongs can be located based on the tainted data stream tracing method. Therefore, the vulnerability information can be associated with the corresponding field names in the obtained JSON object. Thus, when developers view the vulnerability data and perform vulnerability remediation, they can quickly locate the problem point through the field names of the tainted data, facilitating the vulnerability remediation work. Attached Figure Description

[0029] Figure 1 This is a flowchart illustrating the method for locating tainted data in a JSON framework according to an embodiment of the present invention. Detailed Implementation

[0030] To illustrate the technical content, structural features, objectives, and effects of the present invention in detail, the following description is provided in conjunction with the embodiments and accompanying drawings.

[0031] This embodiment discloses a method for quickly locating tainted data in a JSON framework based on IAST instrumentation technology, for use in application vulnerability detection and remediation. The application in this embodiment uses a JSON framework for data storage and parameter passing. During vulnerability detection of this application, locating the vulnerability-related fields (KEYs) in the tainted data makes subsequent vulnerability review and remediation easier. Specifically, as... Figure 1 The method includes the following steps:

[0032] S1: The application under test is instrumented using the IAST tool to weave vulnerability detection logic into the application. The vulnerability detection logic performs vulnerability detection by tracing the propagation path of tainted data within the application. It should be noted that the specific execution process of the vulnerability detection logic in this embodiment is well-known in the art, such as the web application testing data flow tracing method and system disclosed in Chinese invention patent CN111046396A, and therefore will not be elaborated upon here.

[0033] S2: Retrieves the location information of the object returned by the JSON parsing function in the current application;

[0034] S3: When the test tainted data (i.e. the JSON request body) enters the application, the mapping relationship of field names, field types, and field values ​​in the JSON object returned by the JSON parsing function is extracted and stored based on the location information of the JSON parsing function returned by the JSON parsing function obtained in step S2.

[0035] S4: Query the result of the vulnerability detection logic execution to determine whether the current test request has a vulnerability. If so, associate the vulnerability information with the corresponding field name in the JSON object obtained above.

[0036] Based on the above location method, when tainted data for testing enters the application, the mapping relationship of field names, field types, and field values ​​in the JSON object returned by the SON parsing function in the application can be obtained. Then, when a vulnerability is detected, since the code line, function, and parameters to which the vulnerability belongs can be located based on the tainted data stream tracing method, the vulnerability information can be associated with the corresponding field names in the JSON object obtained above. Thus, when developers view the vulnerability data to perform vulnerability remediation, they can quickly locate the problem point through the field names of the tainted data, which facilitates the vulnerability remediation work.

[0037] Furthermore, the location information of the object returned by the JSON parsing function in the IAST tool instrumentation application is obtained.

[0038] Therefore, in practical applications, if we want to automatically instrument JSON parsing functions in an application using the IAST tool, the IAST tool must first be able to identify which function in the application is the JSON parsing function; otherwise, manual instrumentation will be necessary, which is time-consuming. To solve this problem, the location method in this embodiment further includes:

[0039] Create a function library containing JSON parsing functions of several known parsing types, and determine whether any JSON class function in the current application exists in the function library. If it does, directly instrument the JSON class function using the IAST tool.

[0040] If not, the JSON parsing function used to parse JSON objects is inferred based on the input parameters and return values ​​of each JSON-class function in the application, thereby identifying the JSON parsing function in the application. Then, the JSON parsing function identified by the IAST tool can be instrumented.

[0041] Specifically, the request body containing a JSON-like function is as follows:

[0042]

[0043] In the request body mentioned above, since the JSON class function "readValue" is pre-defined in the function library, the JSON parsing function (i.e., readValue) in the request body can be quickly matched by comparing it with the various JSON parsing functions in the function library. Then, the readValue function in ObjectMapper can be instrumented, and the return value can be marked.

[0044] Another request body containing a JSON-like function is as follows:

[0045]

[0046] Within the request body, a comparison with function libraries containing multiple JSON parsing functions revealed no JSON class function with the same known parsing type. Therefore, since normal JSON parsing functions typically take two parameters: a string or byte stream as the carrier of the JSON data, and the type of the JSON parsing object (generally returned as an Object or the same type as the JSON parsing object in Java), the JSON parsing function used to parse the JSON object, i.e., `parseObject`, can be inferred based on the input parameters and return value of each JSON class function in the request body. Then, the `parseObject` function can be instrumented using the IAST instrumentation tool.

[0047] In addition, JSON parsing objects generally return either class or object types. The former clearly indicates the object type, while the latter requires further techniques such as reflection to obtain the object type.

[0048] In the example above, for Person.class, in step S3, the field names in the object can be obtained first using techniques such as reflection. The specific execution statement is as follows:

[0049]

[0050] At this point, the extracted field names, field values, field types, and other mapping relationships can be stored, such as {"key":"name","value":"Zhang San","type":"string"}. It should be noted that the value attribute here stores a value carrying a memory address, meaning that two identical strings "Zhang San" will have different memory addresses.

[0051] In another preferred embodiment of the present invention, a system for quickly locating tainted data in a JSON framework based on IAST is also disclosed for use in application vulnerability detection and remediation. The application uses the JSON framework for data storage and parameter transmission. The system includes a vulnerability detection module, a JSON object location acquisition module, a data extraction module, and an association module.

[0052] The vulnerability detection module is used to instrument the application under test using the IAST tool to weave vulnerability detection logic into the application. The vulnerability detection logic performs vulnerability detection by tracking the propagation path of tainted data in the application.

[0053] The JSON object location retrieval module is used to obtain the location information of objects returned by JSON parsing functions in the current application.

[0054] The data extraction module is used to extract and store the mapping relationship between field names, field types, and field values ​​in the JSON object returned by the JSON parsing function after the tainted data is entered into the application for testing.

[0055] The association module is used to associate the vulnerability information with the corresponding field name in the JSON object obtained above when a test request has a vulnerability.

[0056] Furthermore, the JSON object location acquisition module obtains the location information of the object returned by the JSON parsing function in the IAST tool instrumentation application.

[0057] Furthermore, the JSON object location acquisition module includes a function library creation module, a matching module, an instrumentation module, and an inference module.

[0058] The function library creation module is used to create function libraries that include JSON parsing functions for several known parsing types.

[0059] The matching module is used to match any JSON-related function in the current application with functions in the function library to identify the JSON parsing function in the application.

[0060] The inference module is used to infer the JSON parsing function used to parse JSON objects based on the input parameters and return values ​​of each JSON-type function in the application, when the matching module confirms that no JSON-type function in the current application matches any function in the function library.

[0061] The instrumentation module is used to instrument JSON parsing functions using the IAST tool.

[0062] This invention also discloses another system for locating tainted data in a JSON framework, comprising one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors. The programs include instructions for performing the method described above for locating tainted data in a JSON framework. The processor may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, for executing the relevant programs to implement the functions required by the modules in the system for locating tainted data in a JSON framework according to the embodiments of this application, or to execute the method for locating tainted data in a JSON framework according to the method embodiments of this application.

[0063] This invention also discloses a computer-readable storage medium comprising a computer program executable by a processor to perform the method described above for locating tainted data in a JSON frame. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium can be read-only memory (ROM), random access memory (RAM), or magnetic media, such as floppy disks, hard disks, magnetic tapes, magnetic disks, or optical media, such as digital versatile discs (DVDs), or semiconductor media, such as solid-state disks (SSDs).

[0064] This application also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. The processor of an electronic device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the electronic device to perform the method described above for locating tainted data in a JSON framework.

[0065] The above-disclosed embodiments are merely preferred embodiments of the present invention and should not be construed as limiting the scope of the present invention. Therefore, any equivalent variations made in accordance with the claims of the present invention are still within the scope of the present invention.

Claims

1. A method for quickly locating tainted data in a JSON framework based on IAST, for use in application vulnerability detection and remediation, wherein the application uses a JSON framework for data storage and parameter passing, characterized in that... The method includes: The application under test is instrumented using the IAST tool to weave vulnerability detection logic into the application. The vulnerability detection logic performs vulnerability detection by tracking the propagation path of tainted data in the application. Retrieve the location information of the object returned by the JSON parsing function in the current application; When the test tainted data enters the application, the mapping relationship between field names, field types, and field values ​​in the JSON object returned by the JSON parsing function is extracted and stored; The result of the vulnerability detection logic is queried to determine whether the current test request has a vulnerability. If so, the vulnerability information is associated with the corresponding field name in the JSON object.

2. The method for quickly locating tainted data in a JSON framework based on IAST according to claim 1, characterized in that, The IAST tool is used to instrument the JSON parsing function in the application to obtain the location information of the object returned by the JSON parsing function.

3. The method for quickly locating tainted data in a JSON framework based on IAST according to claim 2, characterized in that, Create a function library containing JSON parsing functions of several known parsing types, and determine whether any JSON class function in the current application exists in the function library. If it does, directly instrument the JSON class function using the IAST tool. If not, the JSON parsing function used to parse the JSON object is inferred based on the input parameters and return value of each JSON class function in the application.

4. A system for quickly locating tainted data in a JSON framework based on IAST, for use in application vulnerability detection and remediation, wherein the application uses a JSON framework for data storage and parameter transmission, characterized in that... The system includes: A vulnerability detection module is used to instrument the application under test using the IAST tool to weave vulnerability detection logic into the application. The vulnerability detection logic performs vulnerability detection by tracking the propagation path of tainted data in the application. The JSON object location acquisition module is used to obtain the location information of the object returned by the JSON parsing function in the current application. The data extraction module is used to extract and store the mapping relationship between field names, field types, and field values ​​in the JSON object returned by the JSON parsing function after the tainted data for testing enters the application. The association module is used to associate the vulnerability information with the corresponding field name in the JSON object when a test request has a vulnerability.

5. The system for quickly locating tainted data in a JSON framework based on IAST according to claim 4, characterized in that, The JSON object location acquisition module instrumentes the JSON parsing function in the application using the IAST tool to obtain the location information of the object returned by the JSON parsing function.

6. The system for quickly locating tainted data in a JSON framework based on IAST according to claim 5, characterized in that, The JSON object location acquisition module includes a function library creation module, a matching module, an instrumentation module, and an inference module; The function library creation module is used to create a function library that includes JSON parsing functions for several known parsing types; The matching module is used to match any JSON-type function in the current application with the functions in the function library to identify the JSON parsing function in the application. The inference module is used to infer the JSON parsing function used to parse JSON objects based on the input parameters and return values ​​of each JSON-type function in the application when the matching module confirms that no JSON-type function in the current application matches the function in the function library. The instrumentation module is used to instrument the JSON parsing function using the IAST tool.

7. A system for quickly locating tainted data in a JSON framework based on IAST, characterized in that, include: One or more processors; Memory; And one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs including instructions for performing the method for quickly locating tainted data in a JSON framework based on IAST as described in any one of claims 1 to 3.

8. A computer-readable storage medium, characterized in that, Includes a computer program that can be executed by a processor to perform the method for quickly locating tainted data in a JSON framework based on IAST as described in any one of claims 1 to 3.

Images