A method and system for detecting injection vulnerabilities in Java Web applications

Abstract

This invention discloses a method and system for detecting injection vulnerabilities in Java Web applications, relating to the field of computer network security. To improve the security of Java Web applications, it performs injection vulnerability detection, providing vulnerability detection services for security analysts and testers in the SDLC (Software as a Service) phase. This invention models the generation principle of injection vulnerabilities and constructs a prior knowledge rule base to mark class methods. A breadth-first taint analysis algorithm is used to analyze the Source method, constructing a local function call graph and storing taint propagation information during function calls in this graph. Branch path pruning is performed based on the taint propagation information in the graph, and finally, the injection vulnerability call chain is output by depth-first traversal of the local function call graph. This method significantly improves the efficiency of vulnerability analysis and the vulnerability detection rate.

Description

Technical Field

[0001] This invention relates to the field of computer network security, and is a system for detecting injection vulnerabilities in Java Web applications. More specifically, it is a method and system for detecting injection vulnerabilities based on code attribute graphs. Background Technology

[0002] With the rapid development of network technology, web applications are widely used in various industries. From enterprise business systems and educational applications to popular short video platforms, food delivery platforms, and online shopping platforms, all utilize web applications. Java was once considered the most widely used programming language, extensively used in server-side programming for web applications. A 2021 statistical report by JetBrains indicated that Java is the most widely used programming language in my country. In web application development, Java, as a server-side programming language, is favored by many developers due to its cross-platform nature (compile once, run anywhere). According to statistics from the 360 ​​Network Space Mapping Engine, Java web applications are widespread in cyberspace, with 528,364 websites in my country using Java for development.

[0003] With the widespread use of web applications, a growing number of security issues have emerged. Forrester's 2021 State of Application Security Report points out that while reliance on applications has steadily increased in recent years, web applications remain the most common target of external attacks, followed by software programs. In the same year, the Open Web Application Security Project (OWASP) released its latest OWASP Top 10 vulnerability list, which records the 10 most serious security vulnerabilities in applications. From 2017 to 2021, injection vulnerabilities have consistently ranked high in the OWASP Top 10. This clearly demonstrates that injection vulnerabilities remain a serious security problem within web applications.

[0004] Information interaction between users and web applications is achieved through external Application Programming Interfaces (APIs). APIs for specific functions parse user input to perform corresponding operations and return data to the user. If user input is not cleaned properly, or if the cleanup is incomplete, malicious data can flow into sensitive functions (such as database operation functions, code execution functions, command execution functions, file read / write functions, etc.), thereby compromising system security. This type of program defect is called an injection vulnerability. Common injection vulnerabilities include SQL injection, command injection, code injection, expression injection, and object injection. Injection vulnerabilities in applications often cause serious security problems. For example, the Log4j2 remote code execution vulnerability announced by the National Internet Emergency Center on December 10, 2021, affected 321,094 software applications released by 60,644 open-source projects on GitHub, impacting various industries in my country.

[0005] Discovering and resolving injection vulnerabilities in web applications is a serious challenge facing the security industry. Forrester's annual "State of Application Security Report" recommends integrating security into the System Development Life Cycle (SDLC) and automating application security testing into DevOps to identify and resolve application risks before deployment. Therefore, this invention aims to propose a general method for detecting injection vulnerabilities in Java Web applications, based on an in-depth analysis of their underlying mechanisms. It also designs a framework for detecting injection vulnerabilities in Java Web applications, providing vulnerability detection services for security analysts and testers in the SDLC process, thereby ensuring the security of web applications. Summary of the Invention

[0006] To address the aforementioned problems, this invention proposes a method and system for detecting injection vulnerabilities in Java Web applications. This invention utilizes the taint propagation path characteristics of injection vulnerabilities, performing taint analysis based on code attribute graphs to detect both known and unknown injection vulnerabilities.

[0007] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0008] A method for detecting injection vulnerabilities in Java Web applications includes the following steps:

[0009] 1) Parse the Java Web application package into a Jimple intermediate representation, extract the inheritance relationship and interface implementation relationship between class objects, as well as the alias relationship between class methods, and mark the class methods Source, Sink, and irrelevant functions. Construct a class relationship graph based on the extracted relationships and marked functions;

[0010] 2) For the class relationship graph, a breadth-first taint analysis is performed starting from the Source function. The taint propagation is performed based on the statement type, the return type of the called function, and the function type. The taint propagation information between function calls is stored in the Call edge. The Call edge points from the calling function to the called function and the function with the alias relationship with it. The taint analysis continues for the pointed-to function until all functions are analyzed, and finally a local function call graph is constructed.

[0011] 3) After taint analysis, obtain all Sink nodes in the local function call graph and perform stack building operations on the Sink nodes. Then, perform call chain mining based on the stack structure. During the call chain mining process, use the initial taint information recorded in the Sink node and the taint propagation information recorded in the Call edge pointing to the Sink node to perform pruning operations, obtain controllable Call edges and the taint parameter information of the starting node in the Call edge. Continue tracing backward based on the taint parameter information of the starting node to obtain controllable Call edges pointing to the starting node, and continue tracing backward until the Source node is reached. Then, output the mined call chain, i.e., the injection vulnerability information.

[0012] Preferably, in step 1), before marking class methods, a prior knowledge rule base is constructed, which includes Source rules, Sink rules, and pruning rules; Source functions are marked according to Source rules, Sink functions are marked according to Sink rules, and irrelevant functions are marked according to pruning rules.

[0013] Preferably, step 1) involves extracting the interface implementation relationships and inheritance relationships between class objects, including:

[0014] Retrieve all SootClass objects within the Java Web application;

[0015] Parse the SootClass object to obtain the class's attribute information, parent class information, and interface information, and store them in the ClassReference class object;

[0016] Based on the parent class information and interface information of the ClassReference class object, the inheritance relationship and interface implementation relationship are extracted sequentially.

[0017] Preferably, step 1) involves extracting alias relationships between class methods by recursively searching for methods with the same name in the parent class using the target method signature to determine the alias relationships between class methods.

[0018] Preferably, the step of constructing the class relationship graph in step 1) includes:

[0019] Extract the code semantic information of each SootMethod object stored in the SootClass object, store the information in the MethodReference class object, and construct the Has edge between the ClassReference class object and the MethodReference class object;

[0020] Establish an Extend edge between the two classes based on the extracted inheritance relationship;

[0021] Establish an Extend edge between the two class objects based on the extracted interface implementation relationship;

[0022] Based on the alias relationship between class methods, establish an Alias ​​edge between two methods;

[0023] A class relationship graph is constructed using the Has edge, Extend edge, and Alias ​​edge mentioned above.

[0024] Preferably, in step 1), after marking is completed, the Source function is stored in the WorkList list, and then in step 2), breadth-first taint analysis is performed with the Source function in the WorkList list as the starting node, and data flow analysis is performed on the Source node.

[0025] Preferably, step 2) of propagating taints based on statement type includes:

[0026] For each statement in the code snippet, first determine the type of the statement;

[0027] If the statement is not a call type, taint propagation is performed directly by analyzing the expression evaluation, and the taint source information of the taint parameter is recorded.

[0028] If the statement is a call type, check if there are any tainted parameters. If there are no tainted parameters, continue analyzing the next statement.

[0029] Preferably, step 2) involves propagating taints based on the return type and function type of the called function, including:

[0030] For statements of the call type, if there are tainted parameters and the function is not a sink function or a filter function, then taint propagation is performed based on the return type of the called function and the function type.

[0031] If the return value is a string, a class object, or a byte array, a new taint is introduced;

[0032] If the return value is of a different type, no new taint is introduced.

[0033] Preferably, step 2) of storing taint propagation information between function calls into the Call edge includes:

[0034] Determine if the called function is an irrelevant function; if it is, continue analyzing the next statement.

[0035] If the called function is not an unrelated function and does not exist as a starting node in the Call edge of the local function call graph, then a Call edge is established between the calling function and the called function and functions that have an alias relationship with the called function.

[0036] Preferably, the stack building operation in step 3) includes the following steps:

[0037] Get the set of Call edges pointing to the Sink node;

[0038] Initialize the pathStack, callStack, and pollutedPositionStack stack structures;

[0039] Push the Sink node onto the pathStack stack, push the set of Call edges pointing to the Sink node onto the callStack stack, and push the initial taint information in the Sink node onto the pollutedPositionStack stack to complete the stack building operation.

[0040] Preferably, in step 3), when performing call chain mining based on the stack structure, the pathStack is used to determine whether the call chain mining of the current Sink node has been completed. If it has not been completed, the call chain mining continues; otherwise, the analysis continues to the next Sink node.

[0041] Preferably, in step 3), when mining the call chain based on the stack structure, the top element callNodes in the callStack is obtained. If callNodes is an empty set, pathStack, callStack, and pollutedPositionStack are popped from the stack and the previous step is repeated. Otherwise, the call chain mining of the current Sink node continues.

[0042] Preferably, the pruning operation in step 3) includes: obtaining the first Call edge in the callNodes set, and extracting the tainted parameter list of the starting node in the Call edge using the transferPollutedPosition function based on the tainted parameter list stored in the top element of the pollutedPositionStack stack.

[0043] Preferably, step 3) of obtaining the controllable Call edge pointing to the starting node includes:

[0044] Determine whether the starting node of the first Call edge has been traversed. If it has, start the analysis again; otherwise, continue the call chain mining.

[0045] Get the set of controllable Call edges pointing to the starting node of the Call edge, push the tainted parameter list onto the pollutedPositionStack stack, and push the starting node of the Call edge onto the pathStack stack.

[0046] Preferably, step 3) up to tracing back to the Source node includes: determining whether the Source node has been traversed; if it has been traversed, writing the path information stored in the pathStack into the result file and performing a pop operation to restart the analysis; if it has not been traversed, continuing to mine the call chain.

[0047] An injection vulnerability detection system for Java Web applications includes:

[0048] A relation extraction module is used to parse Java Web application packages into Jimple intermediate representation, extract inheritance relationships and interface implementation relationships between class objects, as well as alias relationships between class methods, and mark class methods Source, Sink, and irrelevant functions. Based on the extracted relationships and marked functions, a class relationship graph is constructed.

[0049] A taint analysis module is used to perform breadth-first taint analysis on the class relationship graph, starting with the Source function. It propagates taints based on statement type, return type of the called function, and function type, and stores the taint propagation information between function calls in Call edges. These Call edges point from the calling function to the called function and functions with aliases, and taint analysis continues for the pointed-to functions until all functions are analyzed, ultimately constructing a local function call graph.

[0050] A call chain mining module is used to obtain all Sink nodes in the local function call graph after taint analysis, perform stack building operations on the Sink nodes, and then mine the call chain based on the stack structure. During the call chain mining process, the initial taint information recorded in the Sink nodes and the taint propagation information recorded in the Call edges pointing to the Sink nodes are used for pruning operations to obtain controllable Call edges and the taint parameter information of the starting node in the Call edge. Based on the taint parameter information of the starting node, the module continues to trace backward to obtain controllable Call edges pointing to the starting node, and continues to trace backward until the Source node is reached. Then, the mined call chain, i.e., the injection vulnerability information, is output.

[0051] Compared with existing vulnerability detection systems, this invention has the following advantages:

[0052] 1. Based on previous research on code attribute graph technology, the code attribute graph construction method was optimized. The class relationship graph was constructed to solve the analysis problem of Java polymorphism. The taint analysis algorithm was used to construct a local function call graph to represent the possible flow of taint data within the application, thereby improving the efficiency of vulnerability analysis.

[0053] 2. A breadth-first taint analysis algorithm was designed to solve the path depth explosion problem and to implement multi-threaded synchronous analysis, thereby improving analysis efficiency.

[0054] 3. Design an extensible vulnerability detection rule base to support the analysis of more development frameworks and the detection of more types of injection vulnerabilities. Users can customize detection rules based on experience to achieve higher detection accuracy.

[0055] 4. By combining controllability analysis techniques and utilizing taint propagation information between function calls to prune branch paths, we can better analyze large-scale Java Web applications and further improve the accuracy and efficiency of the results.

[0056] The purpose of this invention is to improve the security of Java Web applications by detecting injection vulnerabilities, providing vulnerability detection services for security analysts and testers in the SDLC (Software as a Service) phase, and protecting enterprise data and property security. The intended effects of this invention are as follows: By modeling the generation principle of injection vulnerabilities, a prior knowledge rule base is constructed to mark class methods. A breadth-first taint analysis algorithm is used to analyze the Source method, constructing a local function call graph and storing taint propagation information during function calls in this graph. Branch path pruning is performed based on the taint propagation information in the graph, and finally, the injection vulnerability call chain is output by depth-first traversal of the local function call graph. This method greatly improves the efficiency of vulnerability analysis and the vulnerability detection rate. Attached Figure Description

[0057] Figure 1 This is a schematic diagram of an injection vulnerability detection system for Java Web applications according to one embodiment of the present invention.

[0058] Figure 2 This is a flowchart of the class relationship module analysis in one embodiment of the present invention.

[0059] Figure 3 This is a flowchart of the stain analysis module in one embodiment of the present invention.

[0060] Figure 4 This is a flowchart of the chain mining module analysis process in the embodiment.

[0061] Figure 5 This is the code attribute diagram structure used in this invention.

[0062] Figure 6 This is a schematic diagram of the pruning process using the controllability analysis technology employed in this invention. Detailed Implementation

[0063] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, and to make the objectives, features and advantages of the present invention more apparent and understandable, the core technology of the present invention will be further described in detail below with reference to the accompanying drawings and examples.

[0064] This implementation proposes a method for detecting injection vulnerabilities in Java Web applications, including the following steps:

[0065] 1) The static analysis framework Soot is used to parse the input Java application package into a Jimple intermediate representation. Jimple is an intermediate representation of Java bytecode used by the Soot framework. After converting Java bytecode to Jimple, program analysis tools can more easily analyze the structure and behavior of Java programs. Specifically, Jimple is a form similar to three-address code, where each statement contains only one operation and two operands. This simple form makes it easier for the analyzer to understand the structure and semantics of Java programs and facilitates program optimization.

[0066] Then, based on Java's language features, the inheritance relationships and interface implementation relationships between class objects, as well as the alias relationships between class methods, are extracted, ultimately constructing a class relationship graph. In Java, alias relationships between class methods refer to a parent class and multiple subclass methods sharing the same method signature; this alias relationship is also known as method overriding. When multiple subclasses implement a method in the parent class, the Java compiler distinguishes these methods at runtime based on the specific object type. When calling these methods, the compiler selects which method to call based on the specific object type. Therefore, method overriding provides a simple and flexible way to use the same method name, making the code more concise, easier to read, and easier to maintain.

[0067] When constructing the class relationship graph, specific class methods are marked according to the rule set in the prior knowledge rule base, and the Source methods are stored in the WorkList list. This method summarizes and constructs a prior knowledge rule base based on the generation principle of injection vulnerabilities and the development mode of current mainstream Java Web frameworks. This prior knowledge rule base includes rule sets such as Source rules, Sink rules, and pruning rules.

[0068] 2) Starting with the Source node in the WorkList, perform breadth-first taint analysis. When processing function call statements, taint propagation is performed based on the function return value, and the taint propagation information between function calls is stored in the Call edge. The Call edge points from the calling function to the called function and functions with aliases, and the pointed-to functions are also added to the WorkList for further taint analysis until the WorkList is empty, thus constructing a local function call graph.

[0069] 3) After taint analysis, vulnerability call chain mining needs to be performed based on the local function call graph. First, all Sink methods are obtained. Then, pruning operations are performed using the initial taint information recorded in the Sink methods and the taint propagation information recorded in the Call edges pointing to the Sink methods. Controllable Call edges are selected, and the taint parameter information of the starting node in the Call edge is extracted. Subsequently, based on the taint parameter information of the starting node, tracing continues backward to select controllable Call edges pointing to the starting node. Based on the taint parameter information of the starting node, tracing continues backward until the Source method is reached. Finally, the vulnerability call chain stored in the path information is output.

[0070] To achieve the above method, this embodiment proposes an injection vulnerability detection system for Java Web applications, which can effectively solve the problem of difficulty in detecting injection-type Java Web vulnerabilities. Figure 1The diagram shows the module structure of the system, which consists of three modules: a class relationship extraction module, a taint analysis module, and a call chain mining module. The main function of the class relationship extraction module is to extract the code semantic information of class objects and methods in the Java Web application. Based on this semantic information, it constructs a class relationship graph to provide the necessary analysis data for the subsequent taint analysis module. The taint analysis module implements a breadth-first taint analysis algorithm. It first performs taint analysis on the methods in the WorkList, tracing the propagation process of tainted data between function calls. Then, the called functions are added to the WorkList to be analyzed. The taint analysis ends when the WorkList is empty, and a local function call graph is finally constructed. This graph represents the propagation path of tainted data in the application, storing taint propagation information between function calls for subsequent analysis by the call chain mining module. The main function of the call chain mining module is to discover injection vulnerability call chains within the local function call graph. It implements depth-first traversal of the local function call graph through a multi-stack structure, and combines controllability analysis to prune branch paths using taint propagation information between function calls. Finally, the retrieved injection vulnerability call chains are stored in the results file.

[0071] like Figure 2 As shown, the specific processing flow of the class relationship extraction module includes the following steps:

[0072] Step 110: This module needs to analyze all SootClass objects within the application one by one. After obtaining the SootClass object of a certain type of object in the program, this module will first call the corresponding interface to obtain the attribute information, parent class information, and interface information of the class and store them in the ClassReference class object. Then, this module will extract the code semantic information of all SootMethod objects stored in the SootClass object one by one, store the information in the MethodReference class object, and mark the methods with type according to the rule set in the prior knowledge rule base. Finally, a Has edge is constructed between the ClassReference class object and the MethodReference class object.

[0073] Step 120: This module needs to analyze each of the ClassReference class objects constructed in the first part. After obtaining the ClassReference class objects, this module will first find the corresponding ClassReference class objects based on the parent class information stored in the class objects, extract the inheritance relationship, and establish an Extend edge between the two classes. Then, this module will find the corresponding ClassReference class objects based on the interface information stored in the class objects, extract the interface implementation relationship, and establish an Extend edge between the two class objects. Finally, this module will, based on the polymorphism characteristics of the Java language, recursively search for methods with the same name in the parent class through the target method signature, extract the alias relationship, and then establish an Alias ​​edge between the two methods. The recursive search for methods with the same name in the parent class through the target method signature is one method to determine the alias relationship between class methods; this method is called method overriding resolution, which obtains all subclass implementations of a method in the parent class. During method overriding resolution in program development, the Java compiler will search downwards along the class inheritance hierarchy based on the target method signature to find a suitable subclass method with the same method name and parameter list. If such a method is found, it will be called. This rewrite resolution behavior is defined by the Java language specification, which guarantees that the same method name and parameter list can be used in different contexts, and that the compiler can correctly select the most appropriate method.

[0074] like Figure 3 As shown, the specific processing flow of the stain analysis module includes the following steps:

[0075] Step 210: The input to this module is an initial WorkList consisting of Source functions. Before performing data flow analysis, the method to be analyzed, i.e. the Source function, is first obtained from the WorkList, and then data flow analysis is performed on the method.

[0076] Step 220: When processing a line of code in a code snippet during data flow analysis, first determine the type of the statement. If it is not a call type, taint propagation is performed directly through expression analysis, and the taint source information of the tainted parameter is recorded. If it is a call type, check whether there is a tainted parameter among the parameters. If there is no tainted parameter, continue analyzing the next statement.

[0077] Step 230: If there are tainted parameters and the function is neither a sink function nor a filter function, then taint propagation is performed based on the return type of the called function and the function type. If the return type is a string, class object, byte array, etc., a new taint is introduced; otherwise, no new taint is introduced. Then, it continues to determine if the called function is an irrelevant function. If it is, the next statement is analyzed. If it is not an irrelevant function and does not exist as a starting node in the Call edge of the local function call graph, then Call edges are established between the calling function and the called function, as well as functions with aliases to the called function, and added to the local function call graph. Finally, the called function and functions with aliases to the called function are added to the pending WorkList.

[0078] like Figure 4 As shown, the specific processing flow of calling the chain mining module includes the following steps:

[0079] Step 310: First, obtain the set of all Sink nodes in the local function call graph, and then traverse and analyze the Sink nodes in the set.

[0080] Step 320: When performing call chain mining on a specific Sink node, first obtain the set of Call edges pointing to that Sink node, and then initialize the stack structures such as pathStack, callStack, and pollutedPositionStack. Next, push the Sink node onto the pathStack, push the set of Call edges pointing to that Sink node onto the callStack, and push the initial taint information of the Sink node onto the pollutedPositionStack, completing the initial stack building operation.

[0081] Step 330: Determine if the pathStack is empty. If it is empty, the call chain mining process for this Sink node ends, and the analysis continues to the next Sink node. If it is not empty, call chain mining continues.

[0082] Step 340: First, obtain the top element of the callStack, denoted as callNodes. Then, determine if callNodes is an empty set. If it is, pop elements from the three stack structures and restart the analysis from step 330. If it is not an empty set, continue mining the call chain of the Sink node.

[0083] Step 350: First, obtain the first Call edge in the callNodes set. Then, use the transferPollutedPosition function to perform a pruning operation based on the tainted parameter list stored in the top element of the pollutedPositionStack stack, and extract the tainted parameter list pp of the starting node in the Call edge. This pruning operation removes paths that do not meet the conditions from the call chain by judging the tainted parameter list, thereby reducing the length of the call chain and improving mining efficiency and accuracy.

[0084] Step 360: Determine if the pathStack contains the starting node of the Call edge. If it does, delete the first Call edge from the callNodes set, pop the callStack, push the callNodes back onto the stack, update the top element of the callStack, and then start the analysis again from step 330. If it does not contain the starting node, continue mining the call chain of the Sink node.

[0085] Step 370: First, the `getCallsByPollutedPosition` function retrieves the set of controllable Call edges pointing to the starting node of the Call edge based on the tainted parameter list `pp`. Then, the tainted parameter list `pp` is pushed onto the `pollutedPositionStack`, and the starting node of the Call edge is pushed onto the `pathStack`. Next, the first Call edge is removed from the `callNodes` set, the top element of the `callStack` is updated, and the set of controllable Call edges is pushed onto the `callStack`.

[0086] Step 380: Finally, determine whether the top element of the pathStack is a Source node. If it is not a Source node, start the analysis again from step 3. If it is a Source node, write the path information stored in the pathStack to the result file, then perform the pop operation of the three stack structures, and then continue the analysis from step 330.

[0087] like Figure 5 As shown, the code attribute graph structure used in this invention consists of class nodes and method nodes, including a class relationship graph and a local function call graph. The class relationship graph represents the inheritance and interface implementation relationships (Extend edges) between class nodes, the ownership relationship (Has edges) between class nodes and method nodes, and the alias relationship (Alias ​​edges) between method nodes. The local function call graph represents the propagation path of tainted data between method nodes (Call edges).

[0088] like Figure 6As shown, controllability analysis technology prunes branch paths using taint propagation information recorded in the Call edge. First, the key elements need to be defined:

[0089] To implement branch path pruning, the positions of controllable parameters during function calls must first be clearly defined. Parameters such as Obj, arg1, and arg2 may all be controllable parameters.

[0090] Obj.Func(arg1,arg2)(3-1)

[0091] Next, we define the taint propagation information list P recorded in the Call edge. This structure represents the source information of the taint parameters in the called function during the function call. Taking Formula 3-1 above as an example, we can obtain the following taint propagation information list:

[0092] [0,-2,0](3-2)

[0093] The taint propagation information list P has the following two meanings:

[0094] a) The meaning of the elements in the list: indicates whether the parameter at the corresponding position is controllable; if controllable, which parameter of the called function affects the parameter.

[0095] b) The meaning of the list subscripts: They identify the corresponding function parameters. P[0] represents Obj, P[1] represents arg1, and P[2] represents arg2.

[0096] Finally, define the controllability information represented by the numbers in the list:

[0097] -2: Indicates that the parameters corresponding to the current position are uncontrollable.

[0098] -1-n: indicates the taint source information of the parameter corresponding to the current position. This parameter is affected by the parameter at position P2[n+1] of the taint propagation information list of the called function.

[0099] If, during taint propagation, the right-hand side of an expression contains multiple tainted parameters, the taint source information for all tainted parameters will be selected and stored in a one-dimensional array to propagate to the tainted parameters of the left-hand side. The final taint propagation information list, as shown in Formula 3-3, is a two-dimensional array.

[0100] [0],[-2],[0,1](3-3)

[0101] Controllability analysis technology pruning process as follows Figure 6As shown, the initial taint information of Sink is [0]. According to the definition of the taint propagation information list, the taint parameter list [0] corresponding to MethodB is extracted from the taint information list [-2,0] of the Call edge pointing to Sink from MethodB. This taint parameter list represents that the parameter at position P[1] in the taint propagation information list recorded in the Call edge pointing to the function should be controllable. Then, the Call edge pointing to MethodB is filtered according to the taint source recorded in the list. As long as the taint information list P[1] of the Call edge is not -2, the Call edge can be added to the path, such as the Call edge pointing to MethodB shown in the figure.

[0102] In this invention, the Source function and Sink function can also be referred to as the Source method and Sink method, respectively, and in the diagram, they are represented by the Source node and Sink node.

[0103] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail using examples, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for detecting injection vulnerabilities in Java Web applications, characterized in that, Includes the following steps: 1) Parse the Java Web application package into a Jimple intermediate representation, extract the inheritance relationship and interface implementation relationship between class objects, as well as the alias relationship between class methods, and mark the class methods Source, Sink, and irrelevant functions. Construct a class relationship graph based on the extracted relationships and marked functions; 2) For the class relationship graph, perform breadth-first taint analysis starting from the Source function. Propagate taints based on statement type, return type of the called function, and function type, and store the taint propagation information between function calls in the Call edge. The Call edge points from the calling function to the called function and functions with aliases, and taint analysis is performed on the pointed-to functions until all functions are analyzed, ultimately constructing a local function call graph; 3) After taint analysis, obtain all Sink nodes in the local function call graph and perform stack building operations on the Sink nodes. Then, perform call chain mining based on the stack structure. During the call chain mining process, use the initial taint information recorded in the Sink node and the taint propagation information recorded in the Call edge pointing to the Sink node to perform pruning operations, obtain controllable Call edges and the taint parameter information of the starting node in the Call edge. Continue tracing backward based on the taint parameter information of the starting node to obtain controllable Call edges pointing to the starting node, and continue tracing backward until the Source node is reached. Then, output the mined call chain, i.e., the injection vulnerability information.

2. The method as described in claim 1, characterized in that, Step 1) Before marking class methods, construct a prior knowledge rule base, which includes Source rules, Sink rules, and pruning rules; mark Source functions according to Source rules, mark Sink functions according to Sink rules, and mark irrelevant functions according to pruning rules.

3. The method as described in claim 1, characterized in that, In step 1), The steps to extract interface implementation relationships and inheritance relationships between class objects include: Retrieve all SootClass objects within the Java Web application; Parse the SootClass object to obtain the class's attribute information, parent class information, and interface information, and store them in the ClassReference class object; Extract the inheritance relationship and interface implementation relationship sequentially based on the parent class information and interface information of the ClassReference class object; and / or The steps to extract alias relationships between class methods include: By recursively searching for methods with the same name in the parent class using the target method signature, the alias relationship between class methods can be determined.

4. The method as described in claim 3, characterized in that, Step 1) involves constructing the class relationship graph, which includes: Extract the code semantic information of each SootMethod object stored in the SootClass object, store the information in the MethodReference class object, and construct the Has edge between the ClassReference class object and the MethodReference class object; Establish an Extend edge between the two classes based on the extracted inheritance relationship; Establish an Extend edge between the two class objects based on the extracted interface implementation relationship; Based on the alias relationship between class methods, establish an Alias ​​edge between two methods; A class relationship graph is constructed using the Has edge, Extend edge, and Alias ​​edge mentioned above.

5. The method as described in claim 1, characterized in that, In step 1), after marking is completed, the Source function is stored in the WorkList list. Then, in step 2), breadth-first taint analysis is performed with the Source function in the WorkList list as the starting node, and data flow analysis is performed on the Source node.

6. The method as described in claim 1, characterized in that, Step 2) involves propagating taints based on statement type, including: For each statement in the code snippet, first determine the type of the statement; If the statement is not a call type, taint propagation is performed directly by analyzing the expression evaluation, and the taint source information of the taint parameter is recorded. If the statement is a call type, check if there are any tainted parameters. If there are no tainted parameters, continue analyzing the next statement.

7. The method as described in claim 6, characterized in that, In step 2), The steps for taint propagation based on the return type of the called function and the function type include: For statements of the call type, if there are tainted parameters and the function is not a sink function or a filter function, then taint propagation is performed based on the return type of the called function and the function type. If the return value is a string, a class object, or a byte array, a new taint is introduced; If the return value is of a different type, no new taint is introduced; and / or The steps to store taint propagation information between function calls into the Call edge include: Determine if the called function is an irrelevant function; if it is, continue analyzing the next statement. If the called function is not an unrelated function and does not exist as a starting node in the Call edge of the local function call graph, then a Call edge is established between the calling function and the called function and functions that have an alias relationship with the called function.

8. The method as described in claim 1, characterized in that, Step 3) includes the following steps for stack building: Get the set of Call edges pointing to the Sink node; Initialize the pathStack, callStack, and pollutedPositionStack stack structures; Push the Sink node onto the pathStack stack, push the set of Call edges pointing to the Sink node onto the callStack stack, and push the initial taint information in the Sink node onto the pollutedPositionStack stack to complete the stack building operation.

9. The method as described in claim 8, characterized in that, In step 3), When performing call chain mining based on a stack structure, the pathStack is used to determine whether the call chain mining of the current Sink node has been completed. If not, the mining continues; otherwise, the analysis continues to the next Sink node. When performing call chain mining based on the stack structure, the top element of the callStack, callNodes, is obtained. If callNodes is an empty set, pathStack, callStack, and pollutedPositionStack are popped from the stack and the previous operation is repeated. Otherwise, the call chain mining of the current Sink node continues. and / or The pruning operation includes the following steps: obtaining the first Call edge in the callNodes set, extracting the tainted parameter list of the starting node in the Call edge using the transferPollutedPosition function based on the tainted parameter list stored in the top element of the pollutedPositionStack stack; and / or The steps to obtain a controllable Call edge pointing to the starting node include: Determine whether the starting node of the first Call edge has been traversed. If it has, start the analysis again; otherwise, continue the call chain mining. Obtain the set of controllable Call edges pointing to the starting node of the Call edge, push the tainted parameter list onto the pollutedPositionStack stack, and push the starting node of the Call edge onto the pathStack stack; and / or The steps until the Source node is reached include: determining whether the Source node has been traversed; if it has been traversed, writing the path information stored in the pathStack to the result file, performing a pop operation, and restarting the analysis; if it has not been traversed, continuing to mine the call chain.

10. A system for detecting injection vulnerabilities in Java Web applications, characterized in that, include: A relation extraction module is used to parse Java Web application packages into Jimple intermediate representation, extract inheritance relationships and interface implementation relationships between class objects, as well as alias relationships between class methods, and mark class methods Source, Sink, and irrelevant functions. Based on the extracted relationships and marked functions, a class relationship graph is constructed. A taint analysis module is used to perform breadth-first taint analysis on the class relationship graph, starting with the Source function as the node. It propagates taints based on statement type, return type of the called function, and function type, and stores the taint propagation information between function calls in the Call edge. The Call edge points from the calling function to the called function and functions with aliases, and taint analysis is performed on the pointed-to functions until all functions are analyzed, ultimately constructing a local function call graph; A call chain mining module is used to obtain all Sink nodes in the local function call graph after taint analysis, perform stack building operations on the Sink nodes, and then mine the call chain based on the stack structure. During the call chain mining process, the initial taint information recorded in the Sink nodes and the taint propagation information recorded in the Call edges pointing to the Sink nodes are used for pruning operations to obtain controllable Call edges and the taint parameter information of the starting node in the Call edge. Based on the taint parameter information of the starting node, the module continues to trace backward to obtain controllable Call edges pointing to the starting node, and continues to trace backward until the Source node is reached. Then, the mined call chain, i.e., the injection vulnerability information, is output.

Images