A static taint data flow analysis method for applet

Abstract

The application proposes a static taint data flow analysis method for small programs, which is divided into four steps to construct data flow and analyze taint for small programs: firstly, the API of the target small program is analyzed, and it is divided into Source type API (i.e. Source API) or Sink type API (i.e. Sink API) according to the API function; secondly, the project source code of the small program is parsed into an abstract syntax tree (i.e. AST), and the lexical scope chain in each code file and the symbol table of each lexical scope are constructed by analyzing the AST; then, the AST is traversed, the dependency analysis of the lexical scope of each function level in each file is performed, and the dependency relationship of the file, function and variable entities is constructed; finally, the taint source is determined according to the specific API of the small program, and the taint analysis is performed on the entity dependency relationship by applying the taint propagation rule. Through the above method, the taint data flow of the small program can be quickly and accurately constructed according to the characteristics of the small program, and the result can be further used for the analysis of data leakage detection and other problems.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of program static analysis of applets in mobile applications, in particular to the field of performing taint data flow analysis on applets. BACKGROUND

[0002] In recent years, the mobile Internet application in China has developed rapidly. Among various mobile applications, applets, as an application that does not need to be installed and uninstalled and can be used by clicking, have been welcomed by users and developers. According to relevant survey data, the number of applets on platforms such as WeChat and Alipay exceeded 7.5 million, and the daily active users exceeded 780 million in the first half of 2022. With the booming development of the applet ecosystem, the data security and behavior compliance issues brought about by various applets have become increasingly prominent. In order to automatically, quickly and accurately solve the above problems, a static data flow analysis method specific to applets is needed. However, the current static data flow analysis method for mobile applications mainly targets Android native APPs, and the programming language is Java; while applets are mostly written in JavaScript. On the other hand, the current data flow analysis method for JavaScript programs mainly targets web applications built with JavaScript and does not take into account the characteristics of applets.

[0003] In the field of static data flow analysis of applets, the existing methods are not well adapted to emerging applet applications. Directly using the existing methods has problems such as unsupported programming language, low analysis precision, and low analysis accuracy. SUMMARY

[0004] The present application is to propose a static taint data flow analysis method for applets to solve the above technical problems. This method consists of four steps to construct the data flow and perform taint analysis on applets: first, analyze the APIs of the target applet and divide them into Source type APIs (Source APIs) or Sink type APIs (Sink APIs) according to their functions; second, parse the project source code of the applet into an abstract syntax tree (AST), and construct the lexical scope chain in each code file and the symbol table of each lexical scope by analyzing the AST; third, traverse the AST and perform dependency analysis on the lexical scope of each function in each file, and construct the dependency relationship among files, functions and variables; finally, determine the taint source according to the specific APIs of the applet and apply the taint propagation rules on the entity dependency relationship to perform taint analysis. Through the above method, the taint data flow of the applet can be quickly and accurately constructed according to its characteristics, and the results can be further used for analysis of data leakage detection and other issues.

[0005] To achieve the above object, the present application adopts the following technical solutions:

[0006] 1) Analysis of applet characteristics and API type division

[0007] Step S101: By consulting the developer manual and other means, the platform-related API used by the applet is summarized, and according to the function type it realizes, it is judged whether it belongs to the Source type API for collecting data or the Sink type API for transmitting data, and it is divided into Source type API (i.e. Source API) or Sink type API (i.e. Sink API);

[0008] 2) Abstract syntax tree analysis and lexical scope construction:

[0009] Step S102: For the analysis target applet M, use the syntax analysis tool to parse its source code into the abstract syntax tree A in json format;

[0010] Step S103: Objectize the abstract syntax tree A in json format obtained in step S101, supplement the parent-child relationship of each node at the syntax tree level, and form the syntax tree A';

[0011] Step S104: For all source code files, depth-first, pre-order traversal of the syntax tree A' obtained in step S102, construct the scope chain and fill the symbol table;

[0012] 3) Construction of dependency relationship based on symbol table

[0013] Step S105: For all source code files, according to the program evaluation order, traverse the syntax tree A' obtained in step S102, when the syntax tree node representing the variable is accessed, according to certain rules, search the symbol corresponding to the variable in the constructed symbol table, record the access record and related syntax context information;

[0014] Step S106: For the cross-file data reference and function reference that may be generated in step S105, the dependency relationship from the reference to the reference source is constructed;

[0015] 4) Construction of tainted data flow based on access record

[0016] Step S107: According to the Source type API divided in the applet step S101, search the corresponding symbol S_source in the symbol table of each source code file, add S_source to the taint set TC, and search the access record of S_source. According to the information return result obtained from the recorded syntax context information, construct the data dependency of the access record of the information return result, analyze according to a certain taint propagation rule, and construct the taint data flow corresponding to the applet Source API.

[0017] Further, the step S104 adds predefined special symbols to the symbol table in the global scope of the file in advance, because these symbols can be directly used in the source code without the need for the user to explicitly define. Specifically, these symbols include:

[0018] Special APIs and global variables provided by the programming language, that is, JSON.parse, Object.assign, and module.export in JavaScript;

[0019] Special APIs and global variables provided by the applet running platform, that is, wx.login and wx.getSystemInfo in the WeChat applet.

[0020] Further, in the step S104, when the scope chain is traversed and constructed, the specific steps are as follows:

[0021] Step S201: Initialize the current lexical scope ScopeCur as the global scope, and the current access node V as the root node of the syntax tree of the current file;

[0022] Step S202: Check the syntax tree node type of the current access node V. If the syntax tree node generates a new lexical scope ScopeNew, go to step S203, otherwise go to step S205;

[0023] Step S203: Set the parent scope of the newly generated lexical scope ScopeNew as the current lexical scope ScopeCur, that is, ScopeCur contains ScopeNew;

[0024] Step S204: Set the current lexical scope ScopeCur as ScopeNew;

[0025] Step S205: Access the next node VNext from the child nodes of the current access node V according to the expression evaluation order of the programming language;

[0026] Step S206: If VNext exists, set the current visiting node V as VNext, and go to step S202.

[0027] Further, in step S104, when traversing the filler symbol table, the specific steps performed are as follows:

[0028] Step S301: Initialize the current visiting node V as the root node of the current file syntax tree;

[0029] Step S302: Check the syntax tree node type of the current visiting node V. If the syntax tree node declares a new variable, go to step S303; otherwise, go to step S304;

[0030] Step S303: Add the new symbol S generated by the current visiting node V to the symbol table of the current lexical scope ScopeCur;

[0031] Step S304: Access the next node VNext from the child nodes of the current visiting node V according to the expression evaluation order of the programming language;

[0032] Step S305: If VNext exists, set the current visiting node V as VNext, and go to step S302.

[0033] Further, in step S104, for the cross-file data symbol reference D and function symbol reference F, record the corresponding reference statement ImportS, and create proxy symbols D' and F' for the references D and F in the current file, respectively, and add them to the symbol table of the corresponding lexical scope.

[0034] Further, in step S105, when constructing the dependency by traversing the nodes of the syntax tree A' and filling the access records of the corresponding symbols in the symbol tables, the specific steps performed are as follows:

[0035] Step S401: Check the node type of the current visiting node V. If its node type is Identifier or Literal, go to step S402; otherwise, go to step S403;

[0036] Step S402: Start from the lexical scope to which the current visiting node V belongs, and query the symbol tables of the lexical scopes along the lexical scope chain from inside to outside until the corresponding symbol S of the current visiting node V is found or the outermost file global scope is accessed. If the corresponding symbol S exists, add the access record to the item corresponding to the symbol S;

[0037] Step S403: Access the next node VNext from the child nodes of the current visiting node V according to the expression evaluation order of the programming language;

[0038] Step S404: If VNext exists, set the current access node V as VNext, and go to step S401.

[0039] Further, the specific processing performed when processing the cross-file data reference and function reference in step S106 is as follows:

[0040] 1) For the cross-file data reference, the path referenced in the recorded reference statement ImportS and the specific symbol referenced are analyzed, the proxy symbol D' at the reference is constructed in reference relationship with the reference source data symbol D, and the access records of D and D' are merged;

[0041] 2) For the cross-file function reference, the path referenced in the recorded reference statement ImportS and the specific symbol referenced are analyzed, the function symbol F' at the reference is constructed in reference relationship with the reference source function symbol F, and subsequent analysis of the function symbol F' can obtain the corresponding function body definition by analyzing F.

[0042] Further, in step S107, the access records of the symbol S_target are , , ,…, , and the specific steps for constructing data dependency are:

[0043] Step S501: If n = 1, go to step S502; otherwise, construct a read-type data dependency , ,read> indicating that the access record corresponds to a read dependency on the source code at the access record ;

[0044] Step S502: If the syntax context information recorded in shows that the syntax tree node corresponding to the record belongs to the right value of the assignment statement, the access record of the symbol corresponding to the left value at this point is obtained from the syntax context information , an assign-type data dependency , , assign> is constructed, indicating that the access record corresponds to an assignment dependency on the source code at the access record ; otherwise, go to step S503;

[0045] Step S503: If The syntax context information of the record shows that the syntax tree node corresponding to the record belongs to the parameter of the function call statement, and the access record of the corresponding symbol S callee of the called function is obtained from the syntax context information , the to callee type data dependency , , to callee> is constructed, indicating that the source code at and the source code at generate a data dependency between the called function and the parameter, and all access records of S callee are queried to find the function body definition, and if the function body definition exists, the to param type data dependency , , , to param> is constructed between S_target and the access record of the corresponding position declaration parameter symbol S_param at its definition , indicating that the source code at generates a dependency from the parameter at the function call to the parameter at the function definition, that is, the dependency from the actual parameter to the formal parameter.

[0046] Further, in step S107, before all the tainted symbols in the TC are applied to the data flow constructed by the taint propagation rule, the data flow is constructed by applying the taint propagation rule, wherein the taint propagation rule specifically includes:

[0047] assignment propagation: if the corresponding symbol T is in the taint set TC, for the data dependency , , , assign>, the corresponding symbol of is added to the taint set TC;

[0048] assignment elimination: if the corresponding symbol of is in the taint set TC, for the data dependency , , assign>, the corresponding symbol of is deleted from the taint set TC;

[0049] call propagation: if the corresponding symbol T is in the taint set TC, for the data dependency , , , toparam>, the corresponding symbol of is added to the taint set TC.

[0050] Compared with the prior art, the application provides a method for analyzing a tainted data flow in a small program scene. BRIEF DESCRIPTION OF DRAWINGS

[0051] Figure 1 A flowchart of the whole method for analyzing a static tainted data flow in a small program according to the application;

[0052] Figure 2 A flowchart of the method for constructing a scope chain according to the application;

[0053] Figure 3 A flowchart of the method for constructing a symbol table according to the application;

[0054] Figure 4 A flowchart of the method for constructing a node access record according to the application;

[0055] Figure 5 A flowchart of the method for constructing a data dependency according to the application; DETAILED DESCRIPTION

[0056] The specific implementation of the method for analyzing a static tainted data flow in a small program according to the application is described in detail below with reference to the accompanying drawings.

[0057] Figure 1 A flowchart of the whole method for analyzing a static tainted data flow in a small program according to the application;

[0058] The application discloses a method for analyzing a static tainted data flow in a small program, which comprises the following steps:

[0059] In step S101, the platform-related APIs used by the small program are summarized by referring to a developer manual or the like, and it is determined whether the platform-related APIs belong to a Source type API for collecting data or a Sink type API for transmitting data according to the function types implemented by the platform-related APIs, so that the platform-related APIs are divided into the Source type API (i.e., a Source API) or the Sink type API (i.e., a Sink API).

[0060] In step S102, the source code of the analysis target small program M is parsed into a json format abstract syntax tree A by using a syntax analysis tool.

[0061] In step S103, the json format abstract syntax tree A obtained in step S101 is objectized, and the parent-child relationship of each node at the syntax tree level is supplemented to form a syntax tree A'.

[0062] Step S104: For all source code files, depth-first, pre-order traversal of the syntax tree A' obtained in step S102 is performed to construct the scope chain and fill the symbol table;

[0063] Step S105: For all source code files, the syntax tree A' obtained in step S102 is traversed according to the program evaluation order, and when a syntax tree node representing a variable is accessed, the corresponding symbol of the variable is searched in the constructed symbol table according to certain rules, and the access record and related syntax context information are recorded;

[0064] Step S106: For the cross-file data reference and function reference that may be generated in step S105, a dependency relationship from the reference to the reference source is constructed;

[0065] Step S107: According to the Source type API divided in the small program step S101, the corresponding symbol S_source in the symbol table of each source code file is searched, S_source is added to the taint set TC, the access record of S_source is searched, the information return result is obtained according to the recorded syntax context information, the data dependency of the access record of the information return result is constructed, and certain taint propagation rules are applied for analysis, and the taint data flow corresponding to the small program Source API is constructed.

[0066] Figure 2 The method flowchart for constructing the scope chain in the application.

[0067] Specifically, it can be divided into the following steps:

[0068] Step S201: The current lexical scope ScopeCur is initialized as the global scope, and the current access node V is the root node of the syntax tree of the current file;

[0069] Step S202: The syntax tree node type of the current access node V is checked, and if the syntax tree node generates a new lexical scope ScopeNew, step S203 is transferred, otherwise step S205 is transferred;

[0070] Step S203: The parent scope of the newly generated lexical scope ScopeNew is set as the current lexical scope ScopeCur, that is, ScopeCur contains ScopeNew;

[0071] Step S204: The current lexical scope ScopeCur is set as ScopeNew;

[0072] Step S205: The next node VNext is accessed from the child nodes of the current access node V according to the expression evaluation order of the programming language;

[0073] Step S206: If VNext exists, set the current visiting node V as VNext, and go to step S202.

[0074] Figure 3 The flow chart of the method for constructing the symbol table in the present application.

[0075] Specifically, the method can be divided into the following steps:

[0076] Step S301: Initialize the current visiting node V as the root node of the syntax tree of the current file;

[0077] Step S302: Check the syntax tree node type of the current visiting node V, if the syntax tree node declares a new variable, go to step S303, otherwise go to step S304;

[0078] Step S303: Add the new symbol S generated by the current visiting node V to the symbol table of the current lexical scope ScopeCur;

[0079] Step S304: Access the next node VNext from the child nodes of the current visiting node V according to the expression evaluation order of the programming language;

[0080] Step S305: If VNext exists, set the current visiting node V as VNext, and go to step S302.

[0081] Figure 4 The flow chart of the method for traversing the syntax tree according to the evaluation order in the present application.

[0082] Specifically, the method can be divided into the following steps:

[0083] Step S401: Check the node type of the current visiting node V, if the node type is Identifier or Literal, go to step S402; otherwise go to step S403;

[0084] Step S402: Start from the lexical scope to which the current visiting node V belongs, and query the symbol table of each lexical scope along the lexical scope chain from inside to outside until the corresponding symbol S of the current visiting node V is queried or the outermost file global scope is accessed, if the corresponding symbol S exists, add the visiting record to the item corresponding to the symbol S;

[0085] Step S403: Access the next node VNext from the child nodes of the current visiting node V according to the expression evaluation order of the programming language;

[0086] Step S404: If VNext exists, set the current visiting node V as VNext, and go to step S401.

[0087] Figure 5 The method flowchart for constructing data dependency based on access records of the present application.

[0088] Specifically, the access records of symbol S_target are in turn , , , , and the specific steps for constructing data dependency are as follows:

[0089] Step S501: If n = 1, go to step S502; otherwise, construct read type data dependency , , read> representing that the access record corresponds to a read dependency of the source code at the access record ;

[0090] Step S502: If the syntax context information recorded in indicates that the syntax tree node corresponding to the record belongs to the right value of an assignment statement, obtain the access record of the symbol corresponding to the left value at this place from the syntax context information, and construct assign type data dependency , , assign> representing that the access record corresponds to an assignment dependency of the source code at the access record ; otherwise, go to step S503;

[0091] Step S503: If the syntax context information recorded in indicates that the syntax tree node corresponding to the record belongs to the parameter of a function call statement, obtain the access record of the symbol S_callee corresponding to the called function at this place from the syntax context information, and construct to_callee type data dependency , , to callee> representing that the source code at the access record has data dependency with , and simultaneously query all access records of S_callee to find the function body definition, and if the function body definition exists, construct to_param type data dependency , , to param> between the access record of S_target and the access record of the parameter symbol S_param declared at the corresponding position at the definition thereof, representing that the source code at the access record has data dependency with .The source code of the function call generates a dependence from the argument at the function call to the argument at the function definition, i.e., an actual to formal argument dependence.

[0092] Specifically, before all the tainted symbols in the TC are applied to build the data flow by the taint propagation rules, the data flow is built by applying the taint propagation rules. The taint propagation rules specifically include:

[0093] Assignment propagation: if the corresponding symbol T is in the TC, for data dependence , , assign>, add the corresponding symbol to the TC;

[0094] Assignment elimination: if the corresponding symbol is in the TC, for data dependence , , assign>, remove the corresponding symbol from the TC;

[0095] Call propagation: if the corresponding symbol T is in the TC, for data dependence , , toparam>, add the corresponding symbol to the TC.

Claims

1. A static taint data flow analysis method for small programs, characterized in that, Comprising the following steps: 1) Mini-program characteristic analysis and API type division Step S101: By consulting the developer manual, the platform-related API used by the mini-program is summarized, and according to the function type it implements, it is judged whether it belongs to the Source type API for collecting data or the Sink type API for transmitting data, and it is divided into Source type API, namely Source API, or Sink type API, namely Sink API; 2) Abstract syntax tree parsing and lexical scope construction: Step S102: For the analysis target mini-program M, use a syntax analysis tool to parse its source code into a json format abstract syntax tree A; Step S103: Objectize the json format abstract syntax tree A obtained in step S101, supplement the parent-child relationship of each node at the syntax tree level, and form a syntax tree A'; Step S104: For all source code files, depth-first, pre-order traverse the syntax tree A' obtained in step S102, construct a scope chain and fill in the symbol table; The specific steps are as follows: Step S201: Initialize the current lexical scope ScopeCur to the global scope, and the current access node V to the root node of the current file syntax tree; Step S202: Check the syntax tree node type of the current access node V, if the syntax tree node generates a new lexical scope ScopeNew, go to step S203, otherwise go to step S205; Step S203: Set the parent scope of the newly generated lexical scope ScopeNew to the current lexical scope ScopeCur, that is, ScopeCur contains ScopeNew; Step S204: Set the current lexical scope ScopeCur to ScopeNew; Step S205: From the child nodes of the current access node V, access the next node VNext according to the expression evaluation order of the programming language; Step S206: If VNext exists, set the current access node V to VNext, and go to step S202; 3) Dependency relationship construction based on symbol table Step S105: For all source code files, traverse the syntax tree A' obtained in step S102 according to the program evaluation order, when a syntax tree node representing a variable is accessed, search for the corresponding symbol of the variable in the constructed symbol table according to the predetermined rule, and record the access record and related syntax context information; Step S106: For the cross-file data reference and function reference that may be generated in step S105, build the dependency relationship from the reference to the reference source; 4) Construction of tainted data flow based on access record Step S107: According to the Source type API divided in the applet step S101, search the corresponding symbol S_source in the symbol table of each source code file, add S_source to the taint set TC, search the access record of S_source, obtain the information return result according to the recorded syntax context information, construct the data dependency of the access record of the information return result, and analyze according to a certain taint propagation rule, and construct the taint data flow corresponding to the Source API of the applet.

2. The method of claim 1, wherein, The step S104 adds predefined special symbols in the global scope of the file to the symbol table of the global scope in advance, and these symbols include: Special APIs and global variables provided by the programming language, that is, JSON.parse, Object.assign, and module.export in JavaScript; Special APIs and global variables provided by the applet running platform, that is, wx.login and wx.getSystemInfo in the WeChat applet.

3. The method of claim 1, wherein, In the step S104, when the symbol table is filled, the specific steps are as follows: Step S301: Initialize the current access node V as the root node of the syntax tree of the current file; Step S302: Check the syntax tree node type of the current access node V, if the syntax tree node declares a new variable, go to step S303, otherwise go to step S304; Step S303: Add the new symbol S generated by the current access node V to the symbol table of the current lexical scope ScopeCur; Step S304: Access the next node VNext from the child nodes of the current access node V according to the expression evaluation order of the programming language; Step S305: If VNext exists, set the current access node V as VNext, and go to step S302.

4. The method of claim 1, wherein, In the step S104, for the data symbol reference D and the function symbol reference F across files, record the corresponding reference statement ImportS, and create proxy symbols D' and F' for the references D and F respectively in the current file and add them to the symbol table of the corresponding lexical scope.

5. The method of claim 1, wherein, In the step S105, when the dependency is constructed by filling the access records of the corresponding symbols in the symbol table by traversing the nodes of the syntax tree A', the specific steps are as follows: Step S401: Check the node type of the current access node V, if it is Identifier or Literal, go to step S402; otherwise go to step S403; Step S402: From the lexical scope to which the current access node V belongs, query the symbol table of each lexical scope along the lexical scope chain from inside to outside, until the symbol S corresponding to the current access node V is queried or the outermost file global scope is accessed, if the corresponding symbol S exists, add the access record to the item corresponding to the symbol S; Step S403: Access the next node VNext from the child nodes of the current access node V according to the expression evaluation order of the programming language; Step S403: Access the next node VNext from the child nodes of the current access node V according to the expression evaluation order of the programming language; Step S404: If VNext exists, set the current access node V as VNext, and go to step S401.

6. The method according to claim 1 or 5, characterized in that, The specific processing performed when processing the cross-file data reference and function reference in step S106 is as follows: 1) For the cross-file data reference, the path referenced in the recorded reference statement ImportS and the specific symbol referenced are analyzed, a reference relationship between the proxy symbol D' at the reference place and the reference source data symbol D is constructed, and the access records of D and D' are merged; 2) For the cross-file function reference, the path referenced in the recorded reference statement ImportS and the specific symbol referenced are analyzed, a reference relationship between the function symbol F' at the reference place and the reference source function symbol F is constructed, and subsequent analysis of the function symbol F' is performed by analyzing F to obtain the corresponding function body definition.

7. The method of claim 1, wherein, In the step S107, the access records of the symbol S_target are sequentially set as , , ,…, , and the specific steps for constructing the data dependency are as follows: Step S501: If n = 1, go to step S502; otherwise, construct a read type data dependency , , read> indicates an access record The corresponding source code generates a read dependency on the source code at the access record ; Step S502: If the syntax context information recorded shows that the syntax tree node corresponding to the record belongs to the right value of the assignment statement, the access record of the symbol corresponding to the left value is obtained from the syntax context information at this point , build assign type data dependency , , assign> to indicate that the access record corresponding to the source code generates an assignment dependency on the source code at the access record ; otherwise, go to step S503; Step S503: If the syntax context information recorded shows that the syntax tree node corresponding to the record belongs to the parameter of the function call statement, the symbol S_callee corresponding to the called function is obtained from the access record in the syntax context information at this point , and a to_callee type data dependency , , to callee> is constructed, indicating that the source code at corresponding to the access record has generated a data dependency between the called function and the parameter, and all access records of S_callee are queried to find the function body definition, and if the function body definition exists, a to_param type data dependency , , , to param> is constructed between S_target and the access record of the parameter symbol S_param declared at the corresponding position at its definition , indicating that the source code at corresponds to the source code at has generated a dependency from the parameter at the function call to the parameter at the function definition, i.e., the dependency from the actual parameter to the formal parameter.

8. The method of claim 1, wherein, In step S107, before all the tainted symbols in the TC are applied to the construction of the data flow by the taint propagation rule, the data flow is constructed by applying the taint propagation rule, wherein the taint propagation rule specifically includes: Assignment propagation: If The corresponding symbol T is in the taint set TC, for data dependencies < , assign>, will Corresponding symbols Add to the taint set TC; Assignment elimination: if Corresponding notation In the set of taints TC, for data dependencies , , assign>, remove from the set of taints TC Corresponding notation from the set of taints TC; Call propagation: if The corresponding symbol T is in the set of taints TC, for the data dependency , , toparam>, the The corresponding symbol is added to the set of taints TC.

Images