Java static taint analysis method and related equipment

Abstract

The invention provides a Java static taint analysis method and related equipment. The method specifically comprises the steps of obtaining a to-be-analyzed source code; wherein the source code comprises at least one application program interface; determining the type of the application program interface based on the function of the application program interface; marking the application program interface associated with the dynamic characteristic as a dynamic characteristic associated interface based on the relationship between the application program interface and the dynamic characteristic; constructing a control flow graph, a function call graph and a first graph intermediate representation based on the source code and the dynamic characteristic association interface; obtaining a polluted variable, and determining a taint data stream according to the polluted variable, the type of the application program interface and the first graph intermediate representation; and determining a pollution path according to the taint data flow and the function call graph. By adopting the technical scheme, source codes do not need to be compiled, so that the analysis cost is saved, and the readability of an analysis result is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of security technology, and in particular to a Java static taint analysis method and related equipment. Background Art

[0002] As one of the mainstream languages ​​today, Java is widely used in software development and system design. With the development of technologies such as Internet+, cloud computing, and mobile smart terminals, software systems have increasingly higher requirements for information security. Two important characteristics of software system information security are confidentiality and integrity. Confidentiality means that sensitive data of the system will not be leaked to the outside world during use, and integrity means that important data of the system will not be maliciously tampered with or deleted during use. However, with the gradual increase in business needs, the programs written are becoming larger and more complex. In the process of program application development, it is inevitable that some unsafe behaviors will be introduced, resulting in the risk of leakage of user sensitive data. Summary of the invention

[0003] In view of this, the purpose of the present disclosure is to provide a Java static taint analysis method and related equipment.

[0004] Based on the above objectives, the present disclosure provides a Java static taint analysis method, including: Obtaining source code to be analyzed; wherein the source code includes at least one application program interface; Based on the function of the application program interface, determining the type of the application program interface; based on the relationship between the application program interface and the dynamic characteristic, marking the application program interface associated with the dynamic characteristic as a dynamic characteristic associated interface; Based on the source code and the dynamic characteristic association interface, a control flow graph, a function call graph and a first graph intermediate representation are constructed; wherein the control flow graph is used to construct the first graph intermediate representation; Obtaining a contaminated variable, and determining a tainted data flow according to the contaminated variable, the type of the application program interface, and the first graph intermediate representation; A contamination path is determined according to the tainted data flow and the function call graph.

[0005] Based on the same inventive concept, an embodiment of the present disclosure also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, a static stain analysis method as described in any one of the above is implemented.

[0006] Based on the same inventive concept, an embodiment of the present disclosure further provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute any of the static stain analysis methods described above.

[0007] From the above, it can be seen that the Java static taint analysis method and related equipment provided by the embodiment of the present disclosure obtain the source code to be analyzed; wherein, the source code includes at least one application program interface; based on the function of the application program interface, the type of the application program interface is determined; based on the relationship between the application program interface and the dynamic characteristics, the application program interface associated with the dynamic characteristics is marked as a dynamic characteristic associated interface; based on the source code and the dynamic characteristic associated interface, a control flow graph, a function call graph and a first graph intermediate representation are constructed; the contaminated variables are obtained, and the tainted data flow is determined according to the contaminated variables, the type of the application program interface and the first graph intermediate representation; the contaminated path is determined according to the tainted data flow and the function call graph. With such a technical solution, there is no need to compile the source code, which helps to save the analysis cost; the implicit dependency caused by the dynamic characteristic associated interface is reflected in the first graph intermediate representation, thereby improving the completeness of the analysis; in addition, the first graph intermediate representation provided by the embodiment of the present disclosure is formed by a control flow graph, a function call graph, etc., which removes temporary variables and increases the readability of the analysis results. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] In order to more clearly illustrate the technical solutions in the present disclosure or related technologies, the drawings required for use in the embodiments or related technical descriptions are briefly introduced below. Obviously, the drawings described below are only embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0009] Figure 1 A schematic diagram showing a flow chart of a Java static taint analysis method provided by an embodiment of the present disclosure; Figure 2 A schematic diagram showing a flow chart of constructing a control flow graph from a source code provided by an embodiment of the present disclosure; Figure 3 A schematic diagram of a process for generating an intermediate representation of a first graph provided by an embodiment of the present disclosure is shown; Figure 4 A schematic diagram of a process of updating a function call graph and an intermediate representation of a first graph provided by an embodiment of the present disclosure is shown; Figure 5 A schematic diagram of a process for constructing a tainted data stream provided by an embodiment of the present disclosure is shown; Figure 6A schematic diagram of a process for generating a stain analysis report provided by an embodiment of the present disclosure is shown; Figure 7 A schematic structural diagram of an electronic device provided by an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0010] In order to make the objectives, technical solutions and advantages of the present disclosure more clearly understood, the present disclosure is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0011] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present disclosure should be understood by people with ordinary skills in the field to which the present disclosure belongs. The "first", "second" and similar words used in the embodiments of the present disclosure do not indicate any order, quantity or importance, but are only used to distinguish different components. "Including" or "comprising" and similar words mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0012] Static taint analysis technology: The analysis object is generally the source code or intermediate representation. First, a call graph is constructed based on the function call relationship; then specific data flow propagation analysis is performed within or between functions based on different program characteristics. Common taint propagation methods include: direct assignment propagation, propagation through function calls (procedures), and propagation through aliases (pointers).

[0013] The program input analyzed by Java static taint analysis is divided into two types: source code files and bytecode files. The standard static analysis method is to convert the program input into an intermediate representation first, and then perform subsequent analysis. However, the more famous intermediate representations today, such as the three-address code format provided by Soot (such as Jimple), mostly support bytecode files better, but do not support source code files or support lower language versions. For example, Soot only supports Java 1.8 for source code. Bytecode files are compiled from source code files. During the compilation process, the compiler requires the code to be compilable, which requires the analyst to configure the program running environment and compile successfully when analyzing Java source code programs. Obviously, this method is not convenient for analyzing and testing Java source programs. In addition, considering that in the process of converting and generating Jimple intermediate representation, a large number of temporary variable names will appear to replace the variable names in the source code, the intermediate results and final results of the analysis will contain these variable names, which are poorly readable and inconvenient for program debugging and result analysis.

[0014] In view of this, the embodiment of the present disclosure provides a Java static taint analysis method and related equipment. Specifically, the source code to be analyzed is obtained; wherein the source code includes at least one application program interface; based on the function of the application program interface, the type of the application program interface is determined; based on the relationship between the application program interface and the dynamic characteristics, the application program interface associated with the dynamic characteristics is marked as a dynamic characteristic associated interface; based on the source code and the dynamic characteristic associated interface, a control flow graph, a function call graph and a first graph intermediate representation are constructed; the contaminated variables are obtained, and the tainted data flow is determined according to the contaminated variables, the type of the application program interface and the first graph intermediate representation; the contamination path is determined according to the tainted data flow and the function call graph. The adoption of such a technical solution does not require the compilation of the source code, which helps to save the analysis cost; the implicit dependency caused by the dynamic characteristic associated interface is reflected in the first graph intermediate representation, thereby improving the completeness of the analysis; in addition, the first graph intermediate representation provided by the embodiment of the present disclosure is formed by a control flow graph, a function call graph, etc., which removes temporary variables and increases the readability of the analysis results.

[0015] In order to make the technical solution of the present disclosure clearer and easier to understand, the Java static taint analysis method provided by the embodiment of the present disclosure is introduced below with reference to the accompanying drawings.

[0016] First, the analysis object of the static taint analysis method of the embodiment of the present disclosure is the source code. Generally, the source code includes at least one application programming interface (API). It should be noted that according to the function of the API, the API can be divided into a source type API for collecting data or a sink type API for transmitting data.

[0017] Exemplarily, the type of each API in the source code, such as a Source type API or a Sink type API, is determined by referring to Java developer documentation or the like.

[0018] In some embodiments, based on the association between the API and the dynamic characteristics of the language, the API can be marked. Specifically, the API associated with the dynamic characteristics is marked as a dynamic characteristic associated API. Here, the dynamic characteristics can be reflection, dynamic proxy, dynamic class loading, etc., which is not limited in this disclosure.

[0019] Next, ENRE-JAVA is called to perform entity dependency analysis on the source code to obtain entity dependency information. Optionally, the entity dependency information includes entity information (entity) and dependency information (cell); Exemplarily, entity dependency information includes: entity index number id, entity unique index name qualifiedName, entity name name, entity type category, entity parameters (method entity) params, dependency type type, dependency source entity src, dependency target entity dest, dependency location information location, function call instance object object (Call type dependency), function call actual parameter args (Call type dependency).

[0020] Then, Eclipse JDT (Java Development Tools, JDT for short) is used to parse the source code into an Abstract Syntax Tree (AST for short). It should be noted that those skilled in the art may also use other methods to obtain AST, which is not limited in the present disclosure.

[0021] Next, traverse each AST node, analyze each method definition (MethodDeclaration) type AST node, and construct the control flow graph (cfg) of the corresponding method. It should be noted that when the AST includes multiple method definition type nodes, a matching number of control flow graphs can be constructed.

[0022] Combine the following Figure 2 The method of constructing a control flow graph is illustrated by way of example. Figure 2 FIG. 1 is a flow chart showing a source code construction control flow graph provided by an embodiment of the present disclosure. Figure 2 As shown, the method for constructing a control flow graph includes: Step S201: determining the AST node list body of the method body statement based on the method definition type AST node; Step S202: construct a method start (Start) node start_node and add it to cfg; for example, the start node of the method method includes a statement index number of 0, a statement code string of "method start", a statement type of start, and the method entity of method; Step S203: Determine whether body is empty. If not, go to step S204; otherwise, go to step S208. It should be noted that, as step S204 is executed, the number of nodes in body decreases until it is empty. Step S204: parse the current syntax tree node v, generate a basic statement data structure (statement index number id, statement code string string, statement type type, and method entity parent) and construct a control flow graph node and add it to cfg; Further, if the syntax tree node does not contain branches and loop bodies, a control flow graph node node of type seq is constructed; if the syntax tree node contains branches, a control flow graph node of type cond is constructed; if the syntax tree node contains loop bodies, a control flow graph node of type loop is constructed; Step S205: Check the syntax tree node type of the current syntax tree node v. If the syntax tree node does not contain branches and loop bodies, go to step S203. If the syntax tree node contains branches, go to step S206. If the syntax tree node contains loop bodies, go to step S207. Step S206: construct a control flow graph node for the syntax tree node in each branch of the syntax tree node v, and add it to branches, where branches is a Map with branch conditions as keys and the set of control flow graph nodes corresponding to the branches as values, and then go to step S203; Step S207: construct a control flow graph node for the syntax tree node in the loop body of the syntax tree node v, and add it to loop_body, where loop_body is of List type, and go to step S203; Step S208: construct a method end (End) node end_node and add it to cfg, and return cfg. For example, the end node of method method includes a statement index number of body.size+1, a statement code string of "method end", a statement type of end, and the method entity of method.

[0023] Then, according to the aforementioned entity dependency information, by analyzing the dependency information of the Call type, the source entity src and the target entity dest are connected to form a function call edge, and the function call instance object information object and the function call actual parameter args information are recorded on the edge, and finally the function call graph (call graph, abbreviated as cg) of the entire program is constructed; it should be noted that cg is a graph representing the calling relationship between methods (functions) in the entire program, the nodes in the graph are methods, and the edges represent calling relationships.

[0024] Next, based on the entity dependency information, the constructed control flow graph cfg, and the function call graph cg, a single method graph intermediate representation (Method Graph Intermediate Representation, mgir for short) is constructed for each method that may be executed starting from the entry function, and all mgirs are connected to form the program graph intermediate representation (Programme Graph Intermediate Representation, pgir for short) of the entire program.

[0025] Figure 3 A schematic diagram of a process for generating a first graph intermediate representation (corresponding to the graph intermediate representation of the entire program) provided by an embodiment of the present disclosure is shown. Figure 3 As shown, the process includes: Step S301: Input is a control flow graph set cfgs of methods that may be executed from the entry function and dependency information cells; Step S302: Determine whether cfgs is empty, if not, go to step S303, otherwise go to step S306; Optionally, if cfgs is not empty, a control flow graph is determined in cfgs as the control flow graph analyzed in step S303, and the target control flow graph is deleted in cfgs; Step S303: for the analyzed control flow graph in cfgs, match and retrieve the dependency information cell corresponding to the control flow graph node node according to the position information, store the dependency information into the corresponding control flow graph node, and obtain the graph intermediate representation mgir of a single method; Here, the nodes of mgir are exemplarily described as follows: the public attributes of the nodes in the graph intermediate representation include but are not limited to the method id where the graph node is located, the corresponding source program statement, the predecessor and successor nodes, the node type, the variable data information def defined or reassigned by the current statement, and the variable data information use used; in addition, the Start type node of the graph intermediate representation of a single method contains the parameter list params of the method, and the End type node contains the return value information return of the method, which shares the same entity id and name with the method, except that the entity type is a variable and the variable type is the function return value type; Step S304: for the node node in mgir that contains function call dependencies, construct a call (Call) node and a return value (Ret) node for each function call relationship and add them to mgir, and update the node data information; The relevant information of adding Call node, Ret node and updating node node is illustrated as follows: Call node also contains called method entity dest_method and function call actual parameter list; Ret node also contains called method entity dest_method and function call return value; the use set of node is updated to variables not used as function call parameters and function call return value variable data information; in addition, the formal parameters of Call node, the return value of Ret node and the function call-related parts in node node are all represented by called method entity id, and the return value type is determined according to the return value type of the called method; Step S305: according to the original control flow graph sequence and the sequence of function call execution, the newly added nodes (such as Call nodes and Ret nodes) are connected with the original nodes (such as node nodes) to improve the control flow information within the process; Specifically, according to the execution sequence and inclusion relationship of function calls, the predecessor node of the first executed Call node is the predecessor node of the node node, the successor node of the last Ret node is node, and the successor node of the Call node in the middle process is the corresponding Ret node. The predecessor and successor relationship from Ret to the Call node is determined according to the execution sequence and inclusion relationship of the function calls; Step S306: According to the function call information (such as caller, called, callee), connect the Call node, the Ret node and the graph intermediate representation mgir of the corresponding called method, improve the inter-procedural control flow information, and generate the graph intermediate representation pgir of the entire program; here, caller and callee are object attributes; for example, caller is an attribute of all function objects, and callee is an attribute of the arguments object.

[0026] Exemplarily, according to the dependency information, the call node is connected to the start node of the dependent target entity to construct a call to start edge, and the data information stored on the edge is the correspondence between the actual parameter and the formal parameter; the end node of the dependent target entity is connected to the return value node to construct an end to return edge, and the data information stored on the edge is the correspondence between the return value of the end node and the function return value variable of the return value node.

[0027] It should be understood that function call information, function dependency, etc. can be determined based on entity dependency information.

[0028] Then, the dynamic feature association API is used to update the function call graph cg and the graph intermediate representation pgir (i.e., the first graph intermediate representation). For example, the method dest_method called by the dynamic feature association API during actual runtime and the passed parameter args are parsed, and the function call graph cg and the graph intermediate representation pgir are updated using dest_method and the parameter list.

[0029] Combine the following Figure 4 The updating method is described by way of example. Figure 4 A schematic diagram of a process of updating a function call graph and an intermediate representation of the first graph provided by an embodiment of the present disclosure is shown; Figure 4 As shown, the updating method includes: Step S401: input is a set d_nodes consisting of Call nodes that call dynamic feature associated APIs, a function call graph cg, and a graph intermediate representation pgir; Step S402: Determine whether the set d_nodes is empty. If it is not empty, go to step S403, otherwise go to step S409; here, if it is not empty, select a call node as the analysis object of step S403, and delete the corresponding node in the set d_nodes; Step S403: for the Call node to be analyzed, obtain the instance object m and the actual parameter list args of the API associated with the dynamic feature; Step S404: Find the node def_node that defines the instance object m based on the aforementioned dependency information; Step S405: perform string analysis. If the actual runtime method dest_method is successfully determined, go to step S407; otherwise, go to step S406; Step S406: inferring the actual running method through the actual parameter list, for example: analyzing the parameter type of the actual parameter list args, inferring the parameter list of the actual calling method dest_method and its class according to the explanation of the API parameter list in the development document, and inferring the actual calling method dest_method; Step S407: updating the function call graph cg; illustratively, deleting the function call edge originally pointing to the dynamic feature associated API in the function call graph cg, and adding an edge pointing to the actual calling method dest_method; Step S408: Update the graph intermediate representation pgir. Exemplarily, according to the function call edge in step S407, modify the data information in the Call node and the Ret node in the graph intermediate representation, delete the error edge, connect the Call node, the Ret node and the graph intermediate representation of the actual calling method, and go to step S402; Step S409: Return the updated function call graph cg and the graph intermediate representation pgir of the entire program.

[0030] Through such a technical solution, the implicit dependencies caused by dynamic characteristics are parsed, and the function call graph cg and graph intermediate representation pgir are updated using implicit dependencies, thereby ensuring that the function call graph cg and graph intermediate representation pgir used for Java static taint analysis can fully reflect the characteristics of the source code and improve the completeness and accuracy of the analysis.

[0031] In addition, an independent graph intermediate representation containing source code program control flow and data flow information is formed through the extracted dependency information, control flow graph and function call graph. Compared with Jimple, users no longer need to map temporary variables generated by the intermediate representation with variables in the source code. The intermediate and final results of the analysis are more readable. At the same time, the generated graph intermediate representation is adapted to the entity dependency extraction function provided by the ENRE framework, which facilitates the extension of the analysis method to multiple languages ​​supported by the ENRE framework.

[0032] Next, Java static taint analysis is performed using the graph intermediate representation pgir, the control flow graph cfg, and the function call graph cg.

[0033] In some embodiments, based on graph reachability, the IFDS (Interprocedural, Finite, Distributive, Subset Problem, IFDS for short) algorithm is used to construct the tainted data flow. According to the Source type API and the graph intermediate representation pgir, the Source node (the node that calls the Source type API) in the graph intermediate representation pgir and the tainted variable taint are used to<source,taint> The format is added to the taint set TC, and the taint propagation rules are applied to the pgir in the middle of the figure for analysis to construct the tainted data flow corresponding to the Source type API of the program. Here, the tainted variable taint can be specified by the analyst based on the source code, or it can be automatically identified by the computer, and the present disclosure does not limit this; illustratively, the tainted variable taint is controllable data, and the attacker can modify the data to maliciously attack the application.

[0034] Figure 5 FIG. 2 is a flow chart of constructing a tainted data stream provided by an embodiment of the present disclosure. Figure 5 As shown, the process of constructing the tainted data stream specifically includes: Step S501: Input is a set TC consisting of Source nodes (Call nodes that call Source type APIs) and corresponding tainted variables taint and a graph intermediate representation pgir of the entire program; Step S502: Determine whether the set TC is empty. If it is not empty, the element to be analyzed is<source,taint> Add it to the worklist to be analyzed (delete the element in TC), and go to step S503, otherwise go to step S506; Step S503: Determine whether the worklist is empty. If not, go to step S504; otherwise, go to step S502. Step S504: For the current element to be analyzed<node,taintVar> (Here, node can be source or succ, taintVar represents at least one of taint and var; illustratively, the element to be analyzed can be<source,taint> , or<succ,var> ), for node node and edges with node as source node<node,succ> Apply the taint propagation rule to obtain the polluted element var of the current node and the successor node succ,<succ,var> Add to the worklist and the reachable node pathedge, determine the types of succ and var, if succ is a Sink node (Call node that calls the Sink type API) and var is an actual parameter, go to step S505, otherwise go to step 503; Specifically, the taint propagation rules include one or more of the following rules: For the call to start edge: the param corresponding to taintVar in the succ node will be polluted. When taintVar is a global variable, taintVar in the succ node remains polluted. For call to return edge: when taintVar is a local variable, taintVar in succ will be tainted; For the end to return edge: when taintVar is the method return value, the corresponding return value variable var in succ will be polluted. When taintVar is a global variable, taintVar in the succ node remains polluted. For other types of edges: the taintVar in the succ node remains tainted; For nodes in the intermediate representation of a graph of a common type: taintVar is a variable in the use set, the variable var in def will be polluted, and when var is a variable pointing to a heap object, the variable alias_var that also points to the same heap object will be polluted; here, using alias analysis to use the heap object as a propagation analysis point helps improve the speed and completeness of the analysis; For other types of nodes: All variables retain the state they had when they were entered.

[0035] It should be noted that, based on the difference in source code, the middle representation pgir of the graph includes one or more of the above-mentioned various types of edges. According to the characteristics of taint propagation, the taint propagation rules can be flexibly adjusted, and the present disclosure does not limit this.

[0036] Step S505:<source,taint> -><succ,var> Add it to the sensitive path set SPC, and go to step S503; here, the tainted data flow can be represented by a sensitive path; Step S506: Output the SPC corresponding to each element in TC.

[0037] Finally, based on the tainted data flow, the tainted data flow that can be propagated to the Sink node is screened out, and the path it passes through is output according to the method granularity and statement granularity to obtain the taint analysis report.

[0038] Figure 6 FIG. 1 is a flow chart of generating a stain analysis report provided by an embodiment of the present disclosure. Figure 6 As shown, the step of generating a stain analysis report includes: Step S601: input the function call graph and the sensitive path set SPC outputted in step S506; Step S602: Determine whether SPC is empty, if not, go to step S603, otherwise go to step S606; Step S603: For the current object to be analyzed in SPC, for example<source,s_var> -><sink,t_var> , get the method entity from to which the source node belongs and the method entity to to which the sink node belongs; Step S604: find a path m_path from from to to according to the function call graph, add the source method as the starting point and the sink method as the end point, and the path is a propagation path of method granularity; Step S605: fill in the code statements according to the method entities from from to to, generate a statement-sized taint propagation path s_path, and go to step S602; Step S606: Output a taint analysis report, which includes the number of risky propagation paths and the propagation paths at two granularities: statement and method.

[0039] It can be seen that the static taint analysis method provided by the embodiment of the present disclosure directly uses source code as the analysis object, eliminating the process of compiling the source code, making it easier for analysts to analyze Java source programs, saving analysis costs and having a wide range of applications.

[0040] It should be noted that the static taint analysis method of the embodiment of the present disclosure can be executed by a single device, such as a computer or server. The static taint analysis method of the embodiment of the present disclosure can also be applied in a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only execute one or more steps in the static taint analysis method of the embodiment of the present disclosure, and the multiple devices will interact with each other to complete the static taint analysis method.

[0041] It should be noted that the above describes some embodiments of the present disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0042] Based on the same inventive concept, the exemplary embodiments of the present disclosure also provide a Java static taint analysis method. Figure 1 A flow chart of a Java static taint analysis method provided by an embodiment of the present disclosure is shown; Figure 1 , the Java static taint analysis method comprises: Step S101: Acquire source code to be analyzed; wherein the source code includes at least one application program interface (API); here, the source code may be Java code; Step S103: based on the function of the application program interface, determining the type of the application program interface; based on the relationship between the application program interface and the dynamic characteristic, marking the application program interface associated with the dynamic characteristic as a dynamic characteristic associated interface; here, the type of the application program interface can be a source type or a sink type; Step S105: Based on the source code and the dynamic characteristic association interface, a control flow graph, a function call graph and a first graph intermediate representation (i.e., a graph intermediate representation pgir of the entire program) are constructed; wherein the control flow graph is used to construct the first graph intermediate representation; here, the steps of constructing the control flow graph, the function call graph and the first graph intermediate representation can refer to the aforementioned Figure 2 Steps S201 to S208, Figure 3 Steps S301 to S306 in Figure 4 Steps S401 to S409 in the above are not described in detail. Step S107: Obtain a tainted variable (taint), and determine a tainted data flow according to the tainted variable, the type of the application program interface, and the first graph intermediate representation; here, an embodiment of step S107 may be reference Figure 5 Steps S501 to S506 in the embodiment; Step S109: Determine the contamination path according to the tainted data flow and the function call graph; here, step S109 can refer to Figure 6 Steps S601~S606 in .

[0043] In some embodiments, constructing a control flow graph, a function call graph, and a first graph intermediate representation based on the source code and the dynamic characteristic association interface includes: Parsing the source code to obtain an abstract syntax tree; wherein the abstract syntax tree includes at least one method definition node; refer to Figure 2 , according to the method definition node, determine the control flow graph of the corresponding method.

[0044] In some embodiments, the source code includes at least one entry function; Step S105: constructing a control flow graph, a function call graph and a first graph intermediate representation based on the source code and the dynamic characteristic association interface, including: Perform entity dependency analysis on the source code to determine entity dependency information; here, the entity dependency information is as described above and will not be repeated here; According to the source code, a control flow graph and a function call graph are constructed; here, the method of constructing a control flow graph can refer to Figure 2 Methods; According to the entity dependency information and the control flow graph of at least one executed method, determine a second graph intermediate representation (a graph intermediate representation mgir corresponding to a single method) corresponding to each of the executed methods, and connect at least part of the second graph intermediate representation to obtain a first graph intermediate representation; wherein the at least one executed method is determined based on the at least one entry function; Based on the dynamic characteristic association interface, the function call graph and the first graph intermediate representation are updated.

[0045] In some embodiments, the entity dependency information includes entity and dependency information; the control flow graph includes a third node; the second graph intermediate representation includes a second node; like Figure 3 As shown, the determining, according to the entity dependency information and the control flow graph of at least one executed method, a second graph intermediate representation corresponding to each of the executed methods, and connecting at least part of the second graph intermediate representation to obtain a first graph intermediate representation, comprises: According to the position information of the third node in the control flow graph, the corresponding dependency information is retrieved and the dependency information is stored in the third node to obtain the intermediate representation of the second graph (refer to step S303); here, the third node refers to a node in the control flow graph, and its role is to distinguish from the nodes in the intermediate representation of the second graph and the nodes in the middle of the function call graph; In response to determining that the dependency information of any second node in the intermediate representation of the second graph includes a function call, construct a corresponding call node (corresponding to the Call node) and a return node (corresponding to the Ret node) and add them to the intermediate representation of the second graph, and update the data information of the second node (refer to step S304); here, the second node refers to a node in the intermediate representation of the second graph; According to the order of the control flow graph and the order of execution of the function call, a connection is established between the call node, the return node and the corresponding second node in the same second graph intermediate representation (refer to step S305); Based on the dependency information, connections are established between the call node, the return node and the corresponding second graph intermediate representation to obtain a first graph intermediate representation (see step S306 ).

[0046] In some embodiments, reference Figure 4 , the updating of the function call graph and the first graph intermediate representation based on the dynamic characteristic association interface includes: In response to determining that any of the calling nodes (corresponding to the Call node) calls at least one of the dynamic characteristic associated interfaces, a first object and a first parameter list of the dynamic characteristic associated interface are obtained (refer to S403); here, the first object refers to the instance object m, and the first parameter list refers to the actual parameter list args; Determine a definition node of the first object according to the dependency information (refer to S404); here, the definition node refers to a node that defines the first object; Analyze the string defining the node to determine the first method; here, the first method refers to the method dest_method implemented at runtime; here, those skilled in the art can flexibly select the method for analyzing the string, and the present disclosure does not limit this; In response to determining that the first method is successful, updating the function call graph according to the first method (see S407 ); In response to determining that the first method fails, determining the first method according to the first parameter list (refer to S406), and updating the function call graph according to the first method; According to the updated function call graph, the first graph intermediate representation is updated (see S408 ).

[0047] In some embodiments, the application program interface includes a first type interface; here, the first type interface refers to a Source type interface; the first graph intermediate representation includes a first node; refer to Figure 5 Step S107: the step of obtaining the polluted variable and determining the tainted data flow according to the polluted variable, the type of the application program interface and the first graph intermediate representation includes: Add the first node in the intermediate representation of the first graph that calls the first type of interface and its corresponding contaminated variable as taint sources to the taint set (refer to S501); here, the first node refers to a node in the intermediate representation of the first graph, which is distinguished from the second node and the third node mentioned above; In response to determining that the taint set is not empty, selecting one of the taint sources to add to the to-be-analyzed list; In response to determining that the to-be-analyzed list is not empty, determining a target analysis object (eg<node,taintVar> ); According to the target analysis object, the first graph intermediate representation and the taint propagation rule, determine the contaminated variable (such as var) and its corresponding first node (such as succ) and add them to the list to be analyzed (refer to S504); For example, the contaminated variable (such as var) and its corresponding first node (such as succ) can be<succ,var> The form is added to the list to be analyzed; here, the five-point propagation rules are as mentioned above and will not be repeated; In response to determining that the contaminated variable and its corresponding first node meet the preset condition, the path from the target analysis object to the contaminated variable and its corresponding first node is added to the tainted data flow set (refer to S505), and the step of determining whether the to-be-analyzed list is empty is performed; here, the preset condition may be that the contaminated variable is an actual parameter and the corresponding first node is a Sink node; In response to determining that the contaminated variable and the first node corresponding to it do not satisfy the first condition, executing a step of determining whether the to-be-analyzed list is empty (S503); In response to determining that the to-be-analyzed list is empty, executing a step of determining whether the stain set is empty; In response to determining that the taint set is empty, outputting the tainted data stream set (see S506 ).

[0048] In some embodiments, the application interface includes a second type interface; here, the second type interface corresponds to a sink interface; the preset conditions include that the contaminated variable is an actual parameter and the first node calls the second type interface.

[0049] In some embodiments, the taint propagation rule includes that when the polluted variable is a variable pointing to a heap object, a variable pointing to the same heap object will be polluted.

[0050] In some embodiments, step S109, Figure 6 As shown, determining the contaminated path according to the tainted data flow and the function call graph includes: Obtain method entities to which the source node (e.g., source node) and the target node (e.g., sink node) of the tainted data flow respectively belong, and determine a first propagation path from the method entity of the source node to the method entity of the target node according to the function call graph (refer to S603 and S604); here, the first propagation path corresponds to a propagation path of method granularity; According to the method entities in the first propagation path (the number of method entities may be multiple), code statements are filled to obtain a second propagation path (refer to S605 ); here, the second propagation path corresponds to a propagation path of statement granularity.

[0051] The analysis method of the above embodiment has the beneficial effects of the above corresponding analysis method embodiments, which will not be described in detail here.

[0052] Based on the same inventive concept, corresponding to the static taint analysis method of any of the above embodiments, the present disclosure also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the static taint analysis method described in any of the above embodiments when executing the program.

[0053] Figure 7 A more specific schematic diagram of the hardware structure of an electronic device provided in this embodiment is shown, and the device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are connected to each other through the bus 1050 in the device.

[0054] The processor 1010 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0055] The memory 1020 may be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 may store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 1020 and are called and executed by the processor 1010.

[0056] The input / output interface 1030 is used to connect the input / output module to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

[0057] The communication interface 1040 is used to connect a communication module (not shown) to realize communication interaction between the device and other devices. The communication module can realize communication through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0058] The bus 1050 includes a path that transmits information between the various components of the device (eg, the processor 1010 , the memory 1020 , the input / output interface 1030 , and the communication interface 1040 ).

[0059] It should be noted that, although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040 and the bus 1050, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiments of the present specification, and does not necessarily include all the components shown in the figure.

[0060] The electronic device of the above embodiment is used to implement the corresponding static stain analysis method in any of the above embodiments, and has the beneficial effects of the corresponding static stain analysis method embodiment, which will not be described in detail here.

[0061] Based on the same inventive concept, corresponding to the static stain analysis method of any of the above embodiments, the present disclosure also provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the static stain analysis method as described in any of the above embodiments.

[0062] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and any static taint analysis method or technology can be used to implement information storage. The information can be a computer-readable instruction, a data structure, a module of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0063] The computer instructions stored in the storage medium of the above embodiment are used to enable the computer to execute the static stain analysis method described in any of the above embodiments, and have the beneficial effects of the corresponding static stain analysis method embodiments, which will not be repeated here.

[0064] Based on the same inventive concept, corresponding to the static stain analysis method described in any of the above embodiments, the present disclosure also provides a computer program product, which includes computer program instructions. In some embodiments, the computer program instructions can be executed by one or more processors of a computer so that the computer and / or the processor execute the color correction static stain analysis method. Corresponding to the execution subject corresponding to each step in each embodiment of the color correction static stain analysis method, the processor that executes the corresponding step can belong to the corresponding execution subject.

[0065] The computer program product of the above embodiment is used to enable the computer and / or the processor to execute the static stain analysis method described in any of the above embodiments, and has the beneficial effects of the corresponding static stain analysis method embodiment, which will not be repeated here.

[0066] It should be understood by those skilled in the art that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present disclosure (including the claims) is limited to these examples; based on the concept of the present disclosure, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of different aspects of the embodiments of the present disclosure as described above, which are not provided in detail for the sake of simplicity.

[0067] In addition, to simplify the description and discussion, and in order not to obscure the embodiments of the present disclosure, known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided figures. In addition, devices may be shown in the form of block diagrams to avoid obscuring the embodiments of the present disclosure, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform on which the embodiments of the present disclosure are to be implemented (i.e., these details should be fully within the scope of understanding of those skilled in the art). Where specific details (e.g., circuits) are set forth to describe exemplary embodiments of the present disclosure, it is apparent to those skilled in the art that the embodiments of the present disclosure may be implemented without these specific details or with variations in these specific details. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0068] Although the present disclosure has been described in conjunction with specific embodiments of the present disclosure, many alternatives, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the discussed embodiments.

[0069] The embodiments of the present disclosure are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present disclosure should be included in the scope of protection of the present disclosure.

Claims

1. A Java static taint analysis method, characterized in that: include: Obtaining source code to be analyzed; wherein the source code includes at least one application program interface; Based on the function of the application program interface, determining the type of the application program interface; based on the relationship between the application program interface and the dynamic characteristic, marking the application program interface associated with the dynamic characteristic as a dynamic characteristic associated interface; Based on the source code and the dynamic characteristic association interface, a control flow graph, a function call graph and a first graph intermediate representation are constructed; wherein the control flow graph is used to construct the first graph intermediate representation; Obtaining a contaminated variable, and determining a tainted data flow according to the contaminated variable, the type of the application program interface, and the first graph intermediate representation; A contamination path is determined according to the tainted data flow and the function call graph.

2. The Java static taint analysis method according to claim 1, characterized in that: The step of constructing a control flow graph, a function call graph, and a first graph intermediate representation based on the source code and the dynamic characteristic association interface includes: Parsing the source code to obtain an abstract syntax tree; wherein the abstract syntax tree includes at least one method definition node; According to the method definition node, a control flow graph of the corresponding method is determined.

3. The Java static taint analysis method according to claim 1, characterized in that: The source code includes at least one entry function; The step of constructing a control flow graph, a function call graph, and a first graph intermediate representation based on the source code and the dynamic characteristic association interface includes: Performing entity dependency analysis on the source code to determine entity dependency information; Constructing a control flow graph and a function call graph according to the source code; Determine a second graph intermediate representation corresponding to each of the executed methods according to the entity dependency information and the control flow graph of at least one executed method, and connect at least part of the second graph intermediate representation to obtain a first graph intermediate representation; wherein the at least one executed method is determined based on the at least one entry function; Based on the dynamic characteristic association interface, the function call graph and the first graph intermediate representation are updated.

4. The Java static taint analysis method according to claim 3, characterized in that: The entity dependency information includes dependency information; the control flow graph includes a third node; the second graph intermediate representation includes a second node; The determining, according to the entity dependency information and the control flow graph of at least one executed method, a second graph intermediate representation corresponding to each of the executed methods, and connecting at least part of the second graph intermediate representation to obtain a first graph intermediate representation, comprises: According to the position information of the third node in the control flow graph, the corresponding dependency information is retrieved and the dependency information is stored in the third node to obtain the intermediate representation of the second graph; In response to determining that the dependency information of any second node in the intermediate representation of the second graph includes a function call, constructing a corresponding call node and a return node and adding them to the intermediate representation of the second graph, and updating the data information of the second node; According to the order of the control flow graph and the execution order of the function call, establishing a connection between the call node, the return node and the corresponding second node in the same second graph intermediate representation; Based on the dependency information, a connection is established between the call node, the return node and the corresponding second graph intermediate representation to obtain a first graph intermediate representation.

5. The Java static taint analysis method according to claim 4, characterized in that: The updating of the function call graph and the first graph intermediate representation based on the dynamic characteristic association interface includes: In response to determining that any of the calling nodes calls at least one of the dynamic characteristic associated interfaces, obtaining a first object and a first parameter list of the dynamic characteristic associated interface; Determine a definition node of the first object according to the dependency information; Analyze the character string defining the node to determine the first method; In response to determining that the first method is successful, updating the function call graph according to the first method; In response to determining that the first method fails, determining the first method according to the first parameter list, and updating the function call graph according to the first method; The first graph intermediate representation is updated according to the updated function call graph.

6. The Java static taint analysis method according to claim 1, characterized in that: The application program interface includes a first type interface; the first graph intermediate representation includes a first node; The obtaining of the contaminated variable and determining the tainted data flow according to the contaminated variable, the type of the application program interface and the first graph intermediate representation include: Adding the first node that calls the first type of interface in the intermediate representation of the first graph and its corresponding contaminated variable as contamination sources to the contamination set; In response to determining that the taint set is not empty, selecting one of the taint sources to add to the to-be-analyzed list; In response to determining that the list to be analyzed is not empty, determining a target analysis object; determining a contaminated variable and its corresponding first node according to the target analysis object, the first graph intermediate representation and the taint propagation rule, and adding the contaminated variable and its corresponding first node to the list to be analyzed; In response to determining that the contaminated variable and the first node corresponding thereto satisfy a preset condition, adding a path from the target analysis object to the contaminated variable and the first node corresponding thereto to a tainted data flow set, and executing a step of determining whether the to-be-analyzed list is empty; In response to determining that the contaminated variable and the first node corresponding to it do not satisfy the first condition, executing the step of determining whether the to-be-analyzed list is empty; In response to determining that the to-be-analyzed list is empty, executing a step of determining whether the stain set is empty; In response to determining that the tainted set is empty, outputting the tainted data stream set.

7. The Java static taint analysis method according to claim 6, characterized in that: The taint propagation rule includes: when the polluted variable is a variable pointing to a heap object, the variable pointing to the same heap object will be polluted.

8. The Java static taint analysis method according to claim 6, characterized in that: The step of determining the contamination path according to the tainted data flow and the function call graph includes: Obtain method entities to which the source node and the target node of the tainted data flow respectively belong, and determine a first propagation path from the method entity of the source node to the method entity of the target node according to the function call graph; According to the method entity in the first propagation path, the code statements are filled in to obtain the second propagation path.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable by the processor, characterized in that: The processor implements the Java static taint analysis method according to any one of claims 1 to 8 when executing the computer program.

10. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the Java static taint analysis method according to any one of claims 1 to 8.

Images