Syntax tree-based taint tracking analysis method

Abstract

The application provides a syntax tree-based taint tracking analysis method, which comprises the following steps: defining source points, sink points and sanitizer points; analyzing source code and constructing a syntax tree; constructing a defect symbol table of taint variables based on source code based on the source points and traversing the syntax tree, wherein each entry in the defect symbol table contains a taint identification bit representing the taint state of a variable; traversing the syntax tree and tracking the transmission of taint variables and constructing a taint propagation chain table for recording the propagation path of the taint variables according to the logical operation relationship between the variables; constructing an untainted data set of variables that have been purified by the sanitizer points and exist in the taint propagation chain table during the tracking process of the transmission of the taint variables; and judging whether a node of the syntax tree is a sink point, when the node is a sink point, judging the taint state of a variable related to the sink point in the defect symbol table and whether the variable exists in the untainted data set, and determining whether to output the taint propagation path of the taint propagation chain table based on the judgment result.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of source code analysis, and more particularly to a syntax tree-based taint tracking analysis method. BACKGROUND

[0002] Software development is a complex task, especially now that software technology is developing rapidly, the environment is constantly evolving, software architecture and composition are becoming diversified, and code is becoming increasingly complex. As a result, there are more and more code problems, and software development teams only focus on the usability of their software, often ignoring potential defects in the code.

[0003] Code defect analysis refers to analyzing the lexical, syntactic and semantic of the target program (source code or binary) without running the target program, and combining the program's data flow and control flow information to mine vulnerabilities in the program through type inference, security rule checking, model detection, etc. Common static code defect analysis techniques play a very important role in software testing.

[0004] Existing taint tracking techniques are mostly based on data flow and control flow graph analysis techniques, which require the generated code to be converted into intermediate code and generate a control flow graph, and then perform defect analysis based on the control flow graph. The tracking process also creates a large number of context processes, tracks and maintains the context information of variables, which can seriously affect the speed and efficiency of the analysis.

[0005] Existing taint tracking techniques are mostly based on data flow and control flow graph analysis techniques, which require the generated code to be converted into intermediate code and generate a control flow graph, and then perform defect analysis based on the control flow graph. The tracking process also creates a large number of context processes, tracks and maintains the context information of variables, which can affect the speed and efficiency of the defect analysis. SUMMARY

[0006] The purpose of the present application is to provide a syntax tree-based taint tracking analysis method, which customizes source points, sink points and sanitizer points, analyzes the syntax tree layer by layer, and constructs the propagation path of each taint and tracks it, making the taint propagation analysis customizable and extensible, while simplifying the traditional analysis process and steps and improving the efficiency of defect analysis.

[0007] To achieve the above object, the application provides a syntax tree-based taint tracking analysis method, which comprises the following steps: predefining a source point, a sink point and a sanitizer point; analyzing source code and constructing a syntax tree; constructing a defect symbol table of a tainted variable based on the source code by traversing the syntax tree based on the source point, wherein each entry in the defect symbol table contains a taint identification bit representing a variable taint state; traversing the syntax tree and tracking the propagation of the tainted variable and constructing a taint propagation chain table for recording the propagation path of the tainted variable according to the logical operation relationship between variables; constructing an untainted data set of variables that are purified by the sanitizer point and exist in the taint propagation chain table during the tracking of the propagation of the tainted variable; and judging whether a node of the syntax tree is the sink point, when the node is the sink point, judging the taint state of a variable related to the sink point in the defect symbol table and whether the variable exists in the untainted data set, and determining whether to output the taint propagation path of the taint propagation chain table based on the judgment result.

[0008] Further, the step of constructing a defect symbol table of a tainted variable based on the source code by traversing the syntax tree based on the source point comprises the following steps: traversing the syntax tree; finding the source point, creating the defect symbol table, adding the found source point to the defect symbol table, and setting the taint identification bit of the source point; adding a variable that is contaminated by a variable existing in the defect symbol table through a logical operation relationship to the defect symbol table, and setting the taint identification bit of the variable that is contaminated by the variable existing in the defect symbol table.

[0009] Further, the constructing the taint propagation chain table for recording the propagation path of the tainted variable comprises: creating a taint propagation chain table; creating a node for a variable tainted by the source point in the taint propagation chain table, and recording the variable tainted by the source point into the created node, the created node being provided with a content module; traversing the syntax tree and judging whether a current node variable of the syntax tree is tainted and whether the current node variable is purified by the sanitizer point according to a logical operation relationship between variables; if the current node variable is tainted, creating a new node for the current node variable in the taint propagation chain table, recording the current node variable into the new node, and adding the current node variable into the content module of the node of the variable which taints the current node variable; if the current node variable is purified by the sanitizer point, judging whether the current node variable exists in the node of the taint propagation chain table; and if the current node variable is purified by the sanitizer point and the node recording the current node variable exists in the taint propagation chain table, deleting the current node variable from the content module of the node of the variable which taints the current node variable in the taint propagation chain table.

[0010] Further, each node of the taint propagation chain table records a line number at which the variable recorded by the node is tainted.

[0011] Further, each node of the taint propagation chain table is implemented in a key-value structure.

[0012] Further, the content module of each node of the taint propagation chain table is implemented in a child node structure.

[0013] Further, the method further comprises: in the process of tracing the propagation of the tainted variable, judging whether a current node variable of the syntax tree is tainted and whether the current node variable is purified by the sanitizer point; if the current node variable is tainted and purified by the sanitizer point, modifying a taint identification bit of the current node variable in the defect symbol table, and if a node recording the current node variable exists in the taint propagation chain table, storing the current node variable into the untainted data set.

[0014] Further, the method further comprises: in the process of tracing the propagation of the tainted variable, if a current node variable is tainted, a node recording the current node variable exists in the taint propagation chain table, and the current node variable exists in the untainted data set, deleting the current node variable from the untainted data set, and modifying the taint identification bit of the current node variable in the defect symbol table.

[0015] Further, constructing the uncontaminated data set of variables that have undergone the sanitizer point purification process and exist in the taint propagation chain includes: creating the uncontaminated data set; if the current node variable has undergone the sanitizer point purification process and there is a node recording the current node variable in the taint propagation chain, then adding the current node variable to the uncontaminated data set; if the current node variable is contaminated, and there is a node recording the current node variable in the taint propagation chain, and the current node variable exists in the uncontaminated data set, then deleting the current node variable from the uncontaminated data set.

[0016] Furthermore, determining whether to output the taint propagation path of the taint propagation chain based on the judgment result includes: when the tainted variable is in a tainted state in the taint flag bit of the defect symbol table and does not exist in the untainted data set, then outputting the taint propagation path of the variable related to the sink point in the taint propagation chain.

[0017] Furthermore, each entry in the defect symbol table may also include the row number where the contaminated variable is located.

[0018] Furthermore, the logical operations between the variables include variable assignment, variable parameter passing, string concatenation, and reference passing.

[0019] Furthermore, the method is applicable to PHP source code and Python source code.

[0020] According to another aspect of this application, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program executable on the processor, and the processor executes the computer program to implement the steps of the above-described syntax tree-based taint tracing analysis method.

[0021] According to another aspect of this application, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the steps of the above-described syntax tree-based taint tracing analysis method.

[0022] According to the present invention, the propagation path of each taint can be constructed and tracked, making taint propagation analysis customizable and scalable, while simplifying the traditional analysis process and steps and improving the efficiency of defect analysis. Attached Figure Description

[0023] The accompanying drawings, which form part of this application, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an undue limitation of the invention. In the drawings:

[0024] Figure 1 A flowchart of a syntax tree-based taint tracking analysis method according to an embodiment of this application is shown.

[0025] Figure 2 A block diagram illustrating the analysis flow of a stain tracing analysis method according to an embodiment of this application is shown;

[0026] Figure 3 An example of a PHP code snippet and its corresponding PHP syntax tree is shown;

[0027] Figure 4 The structure of the defect symbol table of a taint tracing analysis method based on a syntax tree according to an embodiment of this application is shown;

[0028] Figure 5A The structure of a node in a taint propagation list of a taint tracing analysis method based on a syntax tree according to an embodiment of this application is shown;

[0029] Figure 5B The structure of a node in a taint propagation list of a taint tracing analysis method based on a syntax tree according to another embodiment of this application is shown;

[0030] Figure 6A The structure of the content module of a node in a taint propagation list of a taint tracing analysis method based on a syntax tree according to another embodiment of this application is shown.

[0031] Figure 6B The structure of the content module of the node of the taint propagation list of the taint tracking analysis method according to another embodiment of the present application is shown;

[0032] Figure 7 A PHP code example is shown that performs taint tracing analysis according to the syntax tree-based taint tracing analysis method of this application;

[0033] Figure 8 It shows according to Figure 7 The syntax tree of the PHP code example shown;

[0034] Figure 9 This application illustrates a syntax tree-based taint tracking analysis method based on... Figure 8 The diagram shows the changes in the taint propagation chain during the tracing of the syntax tree.

[0035] Figure 10 It shows the relationship withFigure 7 The PHP code shown is equivalent to the Python code. Detailed Implementation

[0036] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0037] According to this application, such as Figure 1 As shown, a syntax tree-based taint tracking analysis method is provided. This method includes: predefining source points, sink points, and sanitizer points (S101); analyzing the source code and constructing a syntax tree (S102); creating a defect symbol table for tainted variables based on the source points and traversing the syntax tree, wherein each entry in the defect symbol table contains a taint flag indicating the taint status of the variable (S103); traversing the syntax tree and tracing the transmission of the tainted variables according to the logical operation relationships between variables, and constructing a method for recording the taint status. The taint propagation chain list of the tainted variable propagation path is established (S104); during the process of tracing the transmission of the tainted variable, an untainted data set of variables that have been cleaned by the sanitizer point and exist in the taint propagation chain list is constructed (S105); and it is determined whether the node of the syntax tree is the sink point. If it is the sink point, the taint status of the variables related to the sink point in the defect symbol table and whether they exist in the untainted data set are determined, and based on the determination result, it is determined whether to output the taint propagation chain list of the taint propagation path (S106).

[0038] According to the present invention, the propagation path of each taint can be constructed and tracked, making taint propagation analysis customizable and scalable, while simplifying the traditional analysis process and steps and improving the efficiency of defect analysis.

[0039] Figure 2 A block diagram illustrating the analysis flow of a stain tracing analysis method according to an embodiment of this application is shown.

[0040] First, the source point, sink point, and sanitizer point to be used during taint analysis are predefined, the source code is analyzed, and a syntax tree is constructed.

[0041] Using existing lexical analysis tools, such as Antlr, the code is lexically analyzed by scanning the source program (written in a high-level language) character by character from left to right, generating individual word symbols, thus transforming the source program in string form into a word symbol representation.

[0042] Using existing syntax analysis tools, such as Antlr, syntax analysis is performed. This process transforms the word symbols in lexical analysis into a tree representing the program's syntactic structure, namely an Abstract Syntax Tree (AST), which consists of nested symbols. In the AST, leaf nodes are usually variable or function names or function parameter variable information, while non-leaf nodes are code statements, logical operations such as addition, subtraction, multiplication, and division, or function call declarations, parameter declarations, etc. Figure 3 An example of PHP code and its corresponding PHP syntax tree is shown.

[0043] After the syntax tree is built, the generated syntax tree structure is traversed layer by layer from bottom to top. The source points in the program are analyzed and a defect symbol table (PT) for polluted variables is constructed to maintain the pollution status of variables. Based on the logical operation relationships between variables, such as variable assignment, variable parameter passing, string concatenation, and reference passing, the process of variable pollution propagation is tracked. The basis for tracking pollution propagation is that when an analyzed variable is marked as polluted, the pollution status will propagate to variables that depend on it, including variables that use the variable as a parameter for a function call or variables that are assigned values.

[0044] For example, if the predefined source point is _GET[u], the sink point is mysql_query, and the sanitizer point is mysql_real_escape_string, then the symbol $_GET[u] represents the system defect entry point. For the statement $a = $_GET[u], the pollution value is propagated to the symbol $a during the assignment operation; that is, the pollution attribute of $a receives the pollution attribute value from $_GET[u].

[0045] For the statements $a = "test" or $a = mysql_real_escape_string("$_GET[u]"), if the variable's state is unpolluted or is a parameter of the PHP cleanup function (mysql_real_escape_string is a system-provided filter function), the polluted state of the variable will not be propagated.

[0046] While analyzing the syntax tree, a taint propagation list (DPC) is constructed to record the propagation path of contaminated variables. At the same time, an uncontaminated dataset (CS) is maintained. During the analysis, purified variables are added to the uncontaminated dataset and removed from the propagation path to ensure the accuracy of the taint propagation path.

[0047] According to an embodiment of this application, the construction process of the defect symbol table, the taint propagation chain list and the uncontaminated data set, as well as the implementation process of taint analysis, are described in detail below.

[0048] Traverse the nodes in the syntax tree from bottom to top to find the pollution source entry point, such as the PHP built-in property $_GET (which allows external data input to be retrieved, and this input is considered risky). Create a defect symbol table and add the found source point to the polluted defect symbol table, setting its pollution flag. Each data item in the defect symbol table contains information about polluted variables collected from program statements, which may include the corresponding code symbol, the line number where the symbol is located, and the pollution flag. Figure 4 An example of the structure of the defect symbol table is shown (tainted = 0 represents uncontaminated, 1 represents contaminated).

[0049] In the syntax tree, traverse the syntax tree layer by layer along the entry point of the pollution source. According to the logical operation relationship of the node it points to, add the variable that is polluted by the variable that exists in the defect symbol table to the defect symbol table, and set the pollution flag bit of the variable that is polluted by the variable that exists in the defect symbol table.

[0050] Traversing the syntax tree simultaneously creates a taint propagation list (DPC) to record defect execution path information and tracing status.

[0051] Each node in a taint propagation list (DPC) includes variable symbol information and a content module for the tainted variable. Each node in a DPC may also include the row number information for the tainted variable recorded by that node.

[0052] Figure 5A The structure of a node in a taint propagation list of a taint tracing analysis method based on a syntax tree according to an embodiment of this application is shown. Figure 5B This illustrates the structure of a node in a taint propagation list of a taint tracing analysis method based on a syntax tree, according to another embodiment of this application. Figure 5A The difference in the example shown is that the node includes row number information. For example... Figure 5A and Figure 5B As shown, each node in the taint propagation path linked list can be implemented using a key-value structure. Each node should also include a variable (e.g., a pointer or reference) pointing to the next node (not illustrated).

[0053] Figure 6A The diagram illustrates the structure of the content module of a node in a taint propagation list of a taint tracking analysis method based on a syntax tree according to an embodiment of this application. Figure 6B This illustrates the structure of the content module of a node in a taint propagation list of a taint tracing analysis method based on a syntax tree, according to another embodiment of this application. Figure 6A The difference in the example shown is that the node includes row number information. For example... Figure 6A and Figure 6BAs shown, the content module of each node in the taint propagation list can be implemented using a child node structure. Each node should also include a variable (e.g., a pointer or reference) pointing to the next node (not shown).

[0054] According to one embodiment of this application, a node is created for the variable contaminated by the source point, serving as the first node in the taint propagation list. The structure of the node is as described above. Figure 5A , 5B As shown in 6A and 6B, variables contaminated by the source point are recorded in the nodes, and each node has a content module. The syntax tree is traversed, and based on the logical relationships between variables, it is determined whether the variable of the current node is contaminated. If the current node variable is contaminated, a new node is created for the current node variable in the taint propagation list, and the current node variable is recorded in the new node. Simultaneously, the current node variable is added to the content module of the node of the variable that contaminated it. If the current node variable exists in a node of the taint propagation list and is cleaned by a sanitizer point, the current node variable is removed from the content module of the node of the variable that contaminated it.

[0055] For example, according to one embodiment of this application, a device with... can be created in the following manner. Figure 6B The taint propagation list DPC with the structure shown is as follows:

[0056] For each new contamination variable generated by the defect symbol table PT during the analysis process, a node is created to record the variable symbol information v;

[0057] Create a child node 1b for each row where the variable symbol information v is contaminated, and record the row number information of that row;

[0058] The content module in the child node is used to record that if a new contaminating variable nt exists during subsequent analysis, and this variable is contaminated by the current node variable v, then nt will be added to the child node content.

[0059] During the process of tracking the transmission of contaminated variables, an uncontaminated dataset is created.

[0060] According to one embodiment of this application, an uncontaminated data set can be constructed in the following manner: An uncontaminated data set is created; if the current node variable has been purified by a sanitizer point, and there is a node recording the current node variable in the taint propagation chain, then the current node variable is added to the uncontaminated data set; if the current node variable is contaminated, and there is a node recording the current node variable in the taint propagation chain, and the current node variable exists in the uncontaminated data set, then the current node variable is deleted from the uncontaminated data set.

[0061] During the tracing of the propagation of contaminated variables, it is determined whether the current node variable in the syntax tree is contaminated and whether it has undergone purification by a sanitizer point. If the current node variable is contaminated and has undergone purification by a sanitizer point, and a node recording the current node variable exists in the taint propagation chain, then the contamination flag of the current node variable in the defect symbol table is modified to the uncontaminated state 0 (refer to...). Figure 4 The current node variable is stored in the uncontaminated data set, and the contamination propagation analysis of this path is terminated. That is, the current node path analysis is terminated, and the analysis returns to the previous node to continue analyzing other path information and looking for defective path information.

[0062] Conversely, during the tracing of the propagation of contaminated variables, if the current node variable is contaminated, a node recording the current node variable exists in the taint propagation chain, and the current node variable exists in the uncontaminated dataset, then the current node variable is deleted from the uncontaminated dataset, and the contamination flag of the current node variable in the defect symbol table is modified. For example, if a variable is stored in the uncontaminated dataset CS after purification filtering during propagation, and when it becomes contaminated again, it needs to be deleted from CS because it still exists in the taint propagation chain, and the variable is set to a contaminated state in the defect symbol table PT.

[0063] When a contaminated variable is traced to the sink point (i.e., the syntax tree node represents the sink point call declaration), the contamination status of the variable related to the sink point in the defect symbol table and its existence in the uncontaminated data set are determined. Based on the determination result, it is decided whether to output the contamination propagation path of the taint propagation chain. Specifically, if the contaminated variable has a contaminated flag in the defect symbol table and does not exist in the uncontaminated data set, the contamination propagation path of the variable related to the sink point in the taint propagation chain is output. The complete contamination propagation path information can consist of the source point, the contaminated nodes in the taint propagation chain, and the sink point.

[0064] The following example of PHP code illustrates the taint tracking analysis method based on syntax tree according to this application.

[0065] Figure 7 A PHP code example is shown, illustrating taint tracing analysis performed according to the syntax tree-based taint tracing analysis method of this application. The following will use this code snippet as an example to specifically illustrate the taint tracing analysis process according to the present invention. Figure 8 It shows according to Figure 7 The syntax tree for the PHP code example shown. Figure 9 The taint tracking analysis method based on syntax tree according to this application is based on... Figure 8The diagram shows the changes in the taint propagation list during the tracing of the syntax tree.

[0066] The code above exhibits a pollution propagation path because `$a` receives an unprocessed value from the entry point (line 1) (where `$_GET` is a predefined Source point) and assigns it to `$b` (line 2). Analyzing line 3 reveals that `$b` has undergone purification (where `mysql_real_escape_string` is a predefined Sanitizer point) and is no longer polluting. However, in line 4, `$query` is polluted by `$a` during string concatenation. Since the polluted data reaches the Sink point (where `mysql_query` is a predefined Sink point), a SQL injection vulnerability is generated in line 5. The complete defect propagation path is 1->4->5.

[0067] When analyzing according to the method of this application, the process iterates to the node $_GET['m'], which is a predefined source point. A defect symbol table PT is created, and the source point is added to PT with its contamination flag set to 1. The assignment operation node "=" assigns $_GET['m'] to $a, contaminating the variable $a. The variable $a is then placed in PT, and its contamination flag is set to 1. A taint propagation list (DPC) is created. Because the variable $a is contaminated, a taint propagation list DPC node is created, along with an attribute to represent the line of code where $a is contaminated, such as... Figure 9 Step 1 (see) Figure 9 (Top left part)

[0068] Continuing the traversal, the assignment operation node "=" assigns the value of $a to $b. Variable $b is then contaminated by variable $a in the defect symbol table (PT). Variable $b is added to the defect symbol table (PT) and its contamination flag is set to 1. Simultaneously, a new node is created for variable $b in the taint propagation list (DPC), and variable $b is recorded in this new node. At the same time, variable $b is added to the content module of the node containing variable $a, as shown below. Figure 9 Step 2 (see) Figure 9 (Lower left part)

[0069] Continuing the iteration, `mysql_real_escape_string` (the sanitizer point) cleanses the variable `$b`, making it uncontaminated. Therefore, an uncontaminated data set is created, and the variable `$b` is added to this set. It is then removed from the content module of node `$a` in the taint propagation list (DPC), as shown below. Figure 9 Step 3 (see) Figure 9 (bottom right part)

[0070] Continuing to traverse the syntax tree, the node "." represents a string concatenation operation. The node str represents the string "SELECT * FROM users WHERE u=", which has been concatenated with node $a and assigned to $query. During this assignment, $query is polluted by node $a. Therefore, $query is added to PT, its pollution flag is set to 1, and $query is also added to the content module of node $a in the taint propagation list (DPC). Figure 9 Step 4 (see) Figure 10 (Upper right part)

[0071] Continue traversing the syntax tree, identify the node mysql_query as the sink point, and the pollution flag of the parameter variable $query in the defect symbol table (PT) is 1, and the variable $query does not exist in the unpolluted data set (CS). Therefore, output the pollution propagation path recorded in the taint propagation list (DPC): a->query.

[0072] Combining the source and sink points, the complete vulnerability propagation path is _GET['m'](source)->a->query->mysql_query(sink), with line numbers 1 4 5.

[0073] According to another embodiment of this application, the method of this application can also be applied to other code, such as Python code.

[0074] ​ The Python code corresponding to the PHP code above is shown, and its syntax tree construction process and taint tracking analysis process are the same as those of PHP.

[0075] According to this embodiment, the taint tracing analysis method based on syntax trees simplifies the defect analysis process. It completes the taint defect analysis process using syntax trees, defect symbol tables, taint propagation lists, and untainted data sets, eliminating the need for complex tracing procedures. Simultaneously, it improves taint analysis efficiency. Compared to traditional analysis methods that require maintaining a large number of context relationships and consume storage and computing resources, the existing analysis process is simple to maintain and easy to trace.

[0076] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0077] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A taint tracking analysis method based on syntax trees, the method comprising: Predefine source point, sink point, and sanitizer point; Analyze the source code and construct a syntax tree; Based on the source point and by traversing the syntax tree, a defect symbol table of contaminated variables based on the source code is constructed, wherein each entry in the defect symbol table contains a contamination flag indicating the contamination status of the variable; Traverse the syntax tree and, based on the logical operation relationships between variables, trace the transmission of the contaminated variables and construct a taint propagation list to record the propagation path of the contaminated variables; During the process of tracing the propagation of the contaminated variables, a set of uncontaminated data of variables that have undergone the sanitizer point purification process and exist in the taint propagation chain is constructed; and Determine whether a node in the syntax tree is the sink point. If it is the sink point, determine the contamination status of the variables related to the sink point in the defect symbol table and whether they exist in the uncontaminated data set. Based on the determination result, decide whether to output the contamination propagation path of the taint propagation list. Specifically, determining whether to output the taint propagation path of the taint propagation chain based on the judgment result includes: when the tainted variable is in a tainted state in the taint flag bit of the defect symbol table and does not exist in the untainted data set, then outputting the taint propagation path of the variable related to the sink point in the taint propagation chain. The contamination propagation path of the taint propagation chain only includes variables whose contamination flag in the defect symbol table is in a contaminated state and do not exist in the uncontaminated data set.

2. The method according to claim 1, characterized in that, Constructing a defect symbol table for contaminated variables based on the source point and traversing the syntax tree includes: Traverse the syntax tree; Locate the source point, create the defect symbol table, add the found source point to the defect symbol table, and set the contamination flag bit of the source point; Add variables that are polluted by variables existing in the defect symbol table through logical operations to the defect symbol table, and set the pollution flag bit of the variables that are polluted by variables existing in the defect symbol table.

3. The method according to claim 1 or 2, characterized in that, The construction of the taint propagation list for recording the propagation path of the contaminated variable includes: Create a taint propagation list; In the taint propagation chain, a node is created for the variable contaminated by the source point, and the variable contaminated by the source point is recorded in the created node. The created node is equipped with a content module. Traverse the syntax tree and, based on the logical operation relationships between variables, determine whether the current node variable of the syntax tree is contaminated and whether it has undergone the purification process of the sanitizer point; If the current node variable is contaminated, a new node is created for the current node variable in the taint propagation chain, and the current node variable is recorded in the new node. At the same time, the current node variable is added to the content module of the node of the variable that contaminated it. If the current node variable has undergone purification by the sanitizer point, determine whether the current node variable exists in the node of the taint propagation list; and If the current node variable has been purified by the sanitizer point, and there is a node in the taint propagation chain that records the current node variable, then the current node variable will be deleted from the content module of the node in the taint propagation chain that contaminated the variable.

4. The method according to claim 3, characterized in that, Each node in the taint propagation list records the row number where the variable recorded by that node is tainted.

5. The method according to claim 3, characterized in that, Each node in the taint propagation list is implemented using a key-value structure.

6. The method according to claim 3, characterized in that, The content module of each node in the taint propagation chain is implemented using a child node structure.

7. The method according to claim 1 or 2, characterized in that, The method further includes: During the process of tracing the transmission of the contaminated variable, it is determined whether the current node variable of the syntax tree is contaminated and whether it has been purified by the sanitizer point; If the current node variable is contaminated and has been cleaned by the sanitizer point, then the contamination flag of the current node variable in the defect symbol table is modified, and if there is a node recording the current node variable in the taint propagation chain, then the current node variable is stored in the uncontaminated data set.

8. The method according to claim 1 or 2, characterized in that, The method further includes: During the process of tracing the transmission of the contaminated variable, if the current node variable is contaminated, there is a node recording the current node variable in the taint propagation chain, and the current node variable exists in the uncontaminated data set, then the current node variable is deleted from the uncontaminated data set, and the contamination flag bit of the current node variable in the defect symbol table is modified.

9. The method according to claim 1 or 2, characterized in that, The set of uncontaminated data for variables that have undergone the sanitizer point purification process and exist in the taint propagation chain includes: Create the aforementioned uncontaminated data set; If the current node variable has been purified by the sanitizer point, and there is a node recording the current node variable in the taint propagation chain, then the current node variable is added to the uncontaminated data set. If the current node variable is contaminated, and there is a node recording the current node variable in the taint propagation chain, and the current node variable exists in the uncontaminated data set, then the current node variable is deleted from the uncontaminated data set.

10. The method according to claim 1 or 2, characterized in that, Each entry in the defect symbol table also includes the row number where the contaminated variable is located.

11. The method according to claim 1 or 2, wherein the logical operation relationship between the variables includes variable assignment, variable parameter passing, string concatenation, and reference passing.

12. The method according to claim 1, characterized in that, The method is applicable to PHP source code and Python source code.

13. A computer device comprising a memory and a processor, wherein the memory stores a computer program capable of running on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 12.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 12.

Images