A method, system, device and storage medium for searching a stain path

Abstract

The application belongs to the field of taint path search, and particularly relates to a taint path search method, system, device and storage medium, the method comprising: according to a marking rule, marking all Source basic blocks and Sink basic blocks to generate a Source point list; creating a search instance, marking a Source point variable as a preset state, adding a hash value of the Source point variable to a path hash chain, analyzing a variable identifier in an instruction in a basic block to perform pollution state analysis, and performing path splitting according to an updated dynamic hash table and a global variable pollution abstract table; according to the global variable pollution abstract table and the path hash chain, performing search optimization on the search instance and the split instance to obtain an optimized instance; and verifying the optimized instance to obtain a taint path search result. The application can effectively reduce the space-time complexity of a path space under the premise of guaranteeing core vulnerability path coverage, and can provide a feasible optimized path effect for static taint analysis.

Description

Technical Field

[0001] This invention belongs to the field of taint path search, and specifically relates to a taint path search method, system, device and storage medium. Background Technology

[0002] In the field of software security testing, especially for detecting injection vulnerabilities (such as SQL injection, cross-site scripting (XSS), command injection, etc.), taint path searching is a crucial technique. Its core idea is to determine whether security vulnerabilities exist by tracing data from untrusted sources (taint sources) within the program and ensuring it hasn't undergone sufficient cleanup before flowing into sensitive operation points (taint convergence points).

[0003] Currently, techniques for taint path finding mainly fall into two categories: static analysis methods and dynamic analysis methods. Static taint analysis directly analyzes the data flow of a program's source code, bytecode, or intermediate representation without actually running the program. It simulates all possible propagation paths of tainted data within the program by constructing the program's control flow graph and data flow graph. The advantage of static analysis lies in its comprehensive coverage; theoretically, it can discover all potential paths.

[0004] However, traditional static analysis suffers from search space explosion when searching for contamination paths, requiring a large amount of resources for computation and consuming a lot of time. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to provide a taint path search method, system, device and storage medium that, while ensuring the coverage of core vulnerability paths, effectively reduces the time and space complexity of the path space and provides a feasible optimized path for static taint analysis.

[0006] A taint path search method includes:

[0007] Obtain the CPG file and generate basic blocks based on the CPG file;

[0008] Set the labeling rules for Source and Sink points;

[0009] According to the annotation rules, mark all Source basic blocks and Sink basic blocks, and record the position information of all Source basic blocks in the Source point list;

[0010] Initialize the dynamic hash table, path hash chain, and global variable pollution summary table;

[0011] Based on the Source point list, create a search instance for each Source point, mark the Source point variable as a preset state, and add the hash value of the Source basic block corresponding to the Source point to the path hash chain;

[0012] Analyze the instructions within the Source basic block, extract variable identifiers based on the instructions and preset states, perform pollution state analysis based on the variable identifiers to update the initialized dynamic hash table, and obtain the updated dynamic hash table;

[0013] Path splitting is performed based on the updated dynamic hash table and the global variable pollution summary table to obtain split instances and the global variable pollution summary table.

[0014] Based on the global variable pollution summary table and the path hash chain, the search instance and split instance are optimized to obtain the optimized instance;

[0015] The optimized instance was verified to obtain effective taint propagation paths, and all effective taint propagation paths were used as taint path search results.

[0016] Optionally, the step of creating a search instance for each Source point, marking the Source point variable as a preset state, and adding the hash value of the Source basic block corresponding to the Source point to the path hash chain includes:

[0017] Create a search instance for each Source basic block in the Source point list;

[0018] In each search instance, the variable identifier corresponding to the Source basic block is marked as a preset state in the polluted state hash table, and the hash value of the Source basic block is added to the path hash chain. The preset states include Tainted state and Uncertain state.

[0019] Optionally, the analysis of instructions within the Source basic block, extraction of variable identifiers based on instructions and preset states, and performance of pollution state analysis based on the variable identifiers to update the initialized dynamic hash table, resulting in an updated dynamic hash table, includes:

[0020] Analyze each instruction and preset state within the Source basic block to obtain variable identifiers and instruction types. All the variable identifiers of the instructions form a variable identifier list.

[0021] Based on the variable identifier, obtain the current state of each variable in the initialized dynamic hash table;

[0022] Based on the instruction type, the propagation method is obtained, which includes explicit data stream and implicit data stream;

[0023] Based on the propagation method and the current state, the initial dynamic hash table is updated to obtain the updated dynamic hash table.

[0024] Optionally, the step of performing path splitting based on the updated dynamic hash table and the global variable pollution digest table to obtain split instances and the global variable pollution digest table includes:

[0025] Based on the updated dynamic hash table, the successor basic block information in the CPG structure, and the global variable pollution summary table, branch importance assessment and pollution state dependency analysis are performed.

[0026] Based on the pollution state dependency analysis results, perform the path state update operation for the current search instance, and generate the corresponding set of sub-search instances through the instance replication mechanism, while simultaneously updating the global variable pollution summary table.

[0027] Based on path state updates, instance replication mechanisms, and global state synchronization operations, the output includes the current instance after the state update, the newly generated split instance, and the updated global variable pollution summary table. The current instance and the newly generated split instance are used as the search instance set.

[0028] Optionally, the step of optimizing the search instance and split instance based on the global variable pollution summary table and the path hash chain to obtain optimized instances includes:

[0029] Based on the search instance and the global variable pollution summary table, the loop suppression check, equivalent path elimination and function pollution prediction optimization strategies are applied sequentially to each search instance.

[0030] Based on the results of the optimization strategy check, the search instance set is filtered, instances that do not meet the optimization conditions are terminated, and instances that pass the check are retained to obtain the filtering results;

[0031] Based on the filtering results, the updated status fingerprint registry and the filtered set of valid search instances are output as optimization instances.

[0032] Optionally, the step of verifying the optimized instance to obtain valid paths, and using all valid paths as tainted path search results, includes:

[0033] Based on the optimized instance and the predefined list of Sink basic blocks, perform Sink point arrival verification and contamination propagation effectiveness checks on each search instance;

[0034] Based on the verification results, identify valid taint propagation paths and perform path recording and instance lifecycle management.

[0035] Based on path records and instance lifecycle management, output tainted path search results.

[0036] Optionally, the variable refers to the data carrier used to store and transmit data during program execution.

[0037] A taint path search system, comprising:

[0038] The acquisition module is used to acquire CPG files and generate basic blocks based on the CPG files.

[0039] The settings module is used to set the annotation rules for Source and Sink points;

[0040] The recording module is used to mark all Source basic blocks and Sink basic blocks according to the annotation rules, and record the position information of all Source basic blocks to the Source point list;

[0041] The initialization module is used to initialize the dynamic hash table, path hash chain, and global variable pollution summary table.

[0042] The marking module is used to create a search instance for each Source point according to the Source point list, mark the Source point variable as a preset state, and add the hash value of the Source basic block corresponding to the Source point to the path hash chain.

[0043] The update module is used to analyze the instructions within the Source basic block, extract variable identifiers based on the instructions and preset states, perform pollution state analysis based on the variable identifiers to update the initialized dynamic hash table, and obtain the updated dynamic hash table.

[0044] The splitting module is used to perform path splitting based on the updated dynamic hash table and the global variable pollution summary table to obtain splitting instances and the global variable pollution summary table.

[0045] The optimization module is used to optimize the search instances and split instances based on the global variable pollution summary table and the path hash chain to obtain optimized instances;

[0046] The verification module is used to verify the optimized instance, obtain valid taint propagation paths, and use all valid taint propagation paths as taint path search results.

[0047] A terminal device includes a memory and a processor. The memory stores a computer program that can run on the processor. When the processor loads and executes the computer program, it employs a tainted path search method.

[0048] A computer-readable storage medium storing a computer program that, when loaded and executed by a processor, employs a tainted path search method.

[0049] The beneficial effects of this invention are:

[0050] Dynamic pollution propagation tracking is achieved through a three-color labeling model, and a lightweight hash chain is used to store path sequences. Combined with depth-first search and path splitting mechanisms, it supports global variable pollution status synchronization and cross-module function call analysis.

[0051] To address the path search space explosion problem, this solution utilizes function path memoization search to reduce the overhead of repeatedly traversing the same function structure, and designs a pruning strategy to control the generation of redundant paths, using path state fingerprints to eliminate the redundancy of equivalent paths at branch convergence points.

[0052] The taint path search mechanism implemented in this application effectively reduces the temporal and spatial complexity of the path space while ensuring the coverage of core vulnerability paths through the generation of constraints and state-aware compression, providing a feasible optimized path for static taint analysis. Attached Figure Description

[0053] Figure 1 This is an overall framework diagram of a taint path search method according to the present invention;

[0054] Figure 2 This is a flowchart illustrating a taint path search method according to the present invention.

[0055] Figure 3 This is a schematic diagram of the taint path pruning and compression strategy of a taint path search method according to the present invention.

[0056] Figure 4 This is a Lua code snippet of a while loop for a taint path search method according to the present invention, along with a schematic diagram of the generated CPG. Figure 4 (a) is the Lua code. Figure 4 (b) is a single-file CPG generated by a;

[0057] Figure 5 This is a code scenario for a taint path search method of the present invention using a function taint propagation prediction mechanism, wherein... Figure 5 (a) is a diagram showing that global variables are not used inside the function. Figure 5 (b) is a diagram illustrating the use of global variables within a function;

[0058] Figure 6 This is a schematic diagram of the equivalent path for taint path search method of the present invention, wherein, Figure 6 (a) is the Lua code. Figure 6(b) is a single file CPG generated by a. Detailed Implementation

[0059] A taint path search method, such as Figure 1 and Figure 2 As shown, it includes:

[0060] S1. Obtain the CPG file and generate basic blocks based on the CPG file;

[0061] Specifically, a code parser (such as a Tree-sitter) is used to perform lexical and syntactic analysis on the source code to generate an abstract syntax tree (AST). Based on the AST, control flow analysis is performed to identify jump targets, function boundaries, and basic block partitioning points in the program. The AST nodes are then grouped into basic blocks according to the basic block partitioning rules (program entry point, jump target, and instructions after the jump).

[0062] Construct a Code Property Graph (CPG), where nodes are basic blocks and edges represent control flow relationships. The CPG contains a list of all basic blocks, each containing an instruction sequence and predecessor / successor information.

[0063] S2. Set the labeling rules for Source and Sink points;

[0064] Specifically, security analysts predefine labeling rules for Source and Sink points based on experience. These rules are loaded during framework initialization to label the matching basic blocks in the CPG and record the location information of all Source points as the starting point for the search.

[0065] The contamination propagation process uses a three-color labeling method, which tracks the variable state through a dynamic hash table: when a variable is contaminated through explicit data streams (such as assignment statements, function parameter passing), it is marked as Tainted; if the contamination depends on implicit data streams (such as branch or loop conditions that result in taint markings), it is marked as Uncertain.

[0066] Iterate through all basic blocks in the CPG structure. For each instruction in each basic block, apply the Source point annotation rule set for pattern matching. For each instruction in each basic block, apply the Sink point annotation rule set for pattern matching. Mark the basic blocks that match successfully as Source basic blocks or Sink basic blocks. Record the position information of all marked Source basic blocks in the Source point list.

[0067] The path storage adopts a lightweight design, using the SHA256 algorithm to generate unique hash values ​​for basic blocks in the CPG. The path sequence only stores the hash chain rather than the complete content. The polluted state is also stored in a compressed hash table. When the path splits, the state snapshot is quickly generated by copying the hash pointer, avoiding the performance loss caused by deep copy.

[0068] S3. According to the annotation rules, mark all the Source basic blocks and Sink basic blocks, and record the position information of all Source basic blocks into the Source point list;

[0069] S4. Initialize the dynamic hash table, path hash chain, and global variable pollution summary table;

[0070] Specifically, an empty, dynamic contamination state hash table is created to track the contamination state of each variable.

[0071] Initialize the hash table structure: the key is the variable identifier, and the value is the pollution state record (state enumeration, pollution source path, pollution chain).

[0072] Create an empty path hash chain to record the hash sequence of the basic blocks that have been traversed.

[0073] Create an empty global variable pollution summary table to record information about the spread of pollution from global variables.

[0074] S5. Create a search instance for each Source point according to the Source point list, mark the Source point variable as a preset state, and add the hash value of the Source basic block corresponding to the Source point to the path hash chain.

[0075] Specifically, each Source basic block in the Source basic block list creates an independent search instance. In each search instance, the variable identifier corresponding to the Source basic block is marked as Status.TAINTED in the polluted state hash table, and the hash value of the Source basic block is added to the path hash chain of that instance. The basic block access counter for this search instance is initialized for cyclic detection, and the search instance is added to the active instance queue in preparation for traversal.

[0076] Create a search instance for each Source point, mark the Source point variable to a preset state, and add the hash value of the Source basic block corresponding to the Source point to the path hash chain, including:

[0077] Create a search instance for each Source basic block in the Source point list;

[0078] In each search instance, the variable identifier corresponding to the Source basic block is marked as a preset state in the polluted state hash table, and the hash value of the Source basic block is added to the path hash chain. The preset states include Tainted state and Uncertain state.

[0079] Specifically, each instruction within the basic block is parsed, the instruction type (assignment, function call, control flow, etc.) is identified, and all variable identifiers are extracted from each instruction: assignment statements: extract variables from lvalue variables and rvalue expressions; function calls: extract parameter variables and return value receiving variables; control flow statements: extract variables from conditional expressions. The extracted variable identifiers are then normalized (handling scope, aliases, etc.) and organized into a list of variables to be analyzed.

[0080] For each variable in the variable identifier list, query its current state in the pollution state hash table. Based on the instruction type of the variable, analyze the pollution propagation logic: Explicit data flow analysis: For assignment operations, analyze how rvalue variable pollution propagates to lvalue variables; Implicit data flow analysis: For control flow operations, analyze how condition pollution affects variables within the branch, determine the new pollution state (TAINTED / UNCERTAIN / UNTAINTED) of each variable, and update the corresponding record in the pollution state hash table if the state changes.

[0081] S6. Analyze the instructions within the Source basic block, extract variable identifiers based on the instructions and preset states, perform pollution state analysis based on the variable identifiers to update the initialized dynamic hash table, and obtain the updated dynamic hash table.

[0082] Analyze the instructions within the Source basic block, extract variable identifiers based on the instructions and preset states, and perform pollution state analysis based on the variable identifiers to update the initialized dynamic hash table. The updated dynamic hash table includes:

[0083] Analyze each instruction within the Source basic block to obtain the variable identifier and instruction type. The variable identifiers of all instructions are combined to form a variable identifier list.

[0084] Based on the variable identifier, obtain the current state of each variable in the initialized dynamic hash table;

[0085] Based on the instruction type, the propagation method is determined, which includes explicit data streams and implicit data streams;

[0086] Based on the propagation method and the current state, the initial dynamic hash table is updated to obtain the updated dynamic hash table.

[0087] S7. Perform path splitting based on the updated dynamic hash table and global variable pollution summary table to obtain split instances and global variable pollution summary table.

[0088] Path splitting is performed based on the updated dynamic hash table and the global variable pollution digest table, resulting in split instances and a global variable pollution digest table, including:

[0089] Based on the updated dynamic hash table, the successor basic block information in the CPG structure, and the global variable pollution summary table, branch importance assessment and pollution state dependency analysis are performed.

[0090] Based on the pollution state dependency analysis results, perform the path state update operation for the current search instance, and generate the corresponding set of sub-search instances through the instance replication mechanism, while simultaneously updating the global variable pollution summary table.

[0091] Based on path state updates, instance replication mechanisms, and global state synchronization operations, the output includes the current instance after the state update, the newly generated split instance, and the updated global variable pollution summary table. The current instance and the newly generated split instance are used as the search instance set.

[0092] Specifically, based on the dependencies between modules (between basic blocks), the framework initiates search instances for each file subgraph in the order of dependencies. Starting from the labeled Source point, it performs a depth-first traversal along the control flow edges, maintaining the hash sequence and pollution state table of the current path.

[0093] When encountering basic blocks with branching structures or loop control, the system quickly generates independent sub-instances by copying the current path hash chain pointer and the polluted state table pointer, thus achieving parallel tracing of multiple paths.

[0094] Global variable pollution status management is achieved through a pre-built global variable summary table, which records variable pollution markers and their corresponding path hash sequences in real time. When a global variable is polluted, the path hash sequence from the current Source point to the basic block is stored in the summary table; when a variable is overwritten or updated, the associated data in the summary table is refreshed synchronously; when a polluted global variable is referenced, the corresponding path hash sequence is directly extracted from the summary table to generate an independent tracking instance.

[0095] Function call processing is implemented by querying the exported function table of the CPG subgraph. Two types of critical paths are analyzed for function definitions in dependent modules: paths involving parameter pollution affecting return values, and sink point paths within functions triggered by parameter pollution. For the former, multiple tracking sub-instances are generated after aligning the current path with the internal paths of the function using parameter states. For the latter, the merged path is associated with the pollution state and stored based on parameter alignment. For function calls whose definitions cannot be found, it is conservatively assumed that their return values ​​are affected by the taint states of the parameter list.

[0096] The search terminates when the sink point is reached. If the variable at that point is affected by a taint, the path hash sequence and the taint propagation chain are considered valid results. The result is recorded in the database according to the taint status (Tainted or Uncertain) for further analysis.

[0097] Based on the global variable pollution summary table and the path hash chain, the search instances and split instances are optimized to obtain the following optimized instances:

[0098] Based on the search instance and the global variable pollution summary table, the loop suppression check, equivalent path elimination and function pollution prediction optimization strategies are applied sequentially to each search instance;

[0099] Based on the results of the optimization strategy check, the search instance set is filtered, instances that do not meet the optimization conditions are terminated, and instances that pass the check are retained to obtain the filtering results;

[0100] Based on the filtering results, the updated status fingerprint registry and the filtered set of valid search instances are output as optimization instances.

[0101] Specifically, the core of memoized search lies in building a path summary library for functions. When a function is traversed for the first time, the function is fully traversed, collecting the paths from the basic block defining the function to the basic block of the return value affected by the formal parameter taints, as well as the paths from the basic block defining the function to the sink point inside the function triggered by formal parameter taints.

[0102] The system encodes and saves the hash sequences and taint status information of these two types of paths as digests in the function's path digest library. When the function is called subsequently, the system first checks the two types of paths retrieved from the path digest library for taint by aligning the call parameter list and formal parameter list. It then extracts copies of the hash value fragments of paths tainted by the call parameters from the final return value or sink point and merges these paths according to the traversal logic, avoiding the heavy computational time and space overhead caused by repeatedly traversing the same function.

[0103] S8. Based on the global variable pollution summary table and the path hash chain, perform search optimization on the search instance and split instance to obtain the optimized instance;

[0104] Specifically, branch processing: if the current basic block has multiple successor basic blocks, copy the polluted state hash table pointer and create a child instance for each branch; function call processing: query the function path summary library to decide whether to enter the function body analysis or use the summary result; loop processing: check the basic block access counter, and terminate the current path if the threshold is exceeded; global variable processing: synchronously update the global variable pollution summary table during read and write operations, and add the newly created sub-search instance to the active instance queue.

[0105] Based on the global variable pollution summary table and the path hash chain, the search instances and split instances are optimized to obtain the following optimized instances:

[0106] Based on the search instance and the global variable pollution summary table, the loop suppression check, equivalent path elimination and function pollution prediction optimization strategies are applied sequentially to each search instance;

[0107] Based on the results of the optimization strategy check, the search instance set is filtered, instances that do not meet the optimization conditions are terminated, and instances that pass the check are retained to obtain the filtering results;

[0108] Based on the filtering results, the updated status fingerprint registry and the filtered set of valid search instances are output as optimization instances.

[0109] Specifically, such as Figure 3 As shown, to address the severe path explosion problem caused by loop structures and function calls in taint analysis, this scheme proposes three pruning strategies to control the generation of redundant paths, thereby reducing the time and space overhead of the search process.

[0110] 1. Cyclic redundancy path generation mechanism.

[0111] Based on the in-degree characteristics of the control flow graph, a single-path access constraint is set for basic blocks with an in-degree of 1 outside the function entry point. When repeated access to such basic blocks is detected in the same traversal path, it is determined to be a loop structure or multiple expansion of a recursive function, and the system immediately terminates the continuous traversal of the current path. By blocking the re-entrant expansion of loop structures and recursive functions, the generation of paths is reduced while achieving maximum coverage, greatly mitigating the path explosion problem caused by loop structures.

[0112] like Figure 4 In the loop structure shown, if the number of visits to the basic block is not limited, DFS will expand the loop structure indefinitely. During path traversal, a limit is placed on the number of visits to the basic block "local a = 10". When the number of visits exceeds the threshold, this path is no longer traversed.

[0113] 2. Function pollution propagation prediction mechanism.

[0114] During the CPG generation phase of function body definition, every pair of assignments, aliases, and call relationships within the function body is tracked. Variables that can affect the taint marking of assignment lvalues ​​or call relationships need to be collected as influencing factors of the function and stored in the basic block of the function definition. Before taint analysis needs to traverse the function, it first checks whether the variable names in the function's influencing factors appear in the taint status table of the current path. If not, the traversal request for the function body subgraph is rejected to avoid consuming computational resources by traversing paths to untainted functions.

[0115] like Figure 5 The two Lua global functions shown have their own implementations. `func2` references the global variable `Global_Var` within its function body. When `func2` is called for the first time, if `Global_Var` appears in the current path's taint status list, the CPG subgraph of `func2` needs to be traversed further to determine the impact of `Global_Var`. However, for the first call to `func1`, since there are no variables in `func1` that can affect the taint status of the current path, it is pruned, and its CPG subgraph is not traversed.

[0116] 3. Path masking for non-filtered functions.

[0117] During the project-level CPG merging phase, a global symbol table containing all function names from all Lua module exported function tables is generated. Semantic reasoning is performed on the global symbol representations of function names based on a large language model. For function names that explicitly lack user input filtering functionality, the system marks them as low-risk taint propagation functions and adds them to a blacklist. During the depth-first search of taint paths, the internal logic expansion of blacklisted functions is automatically skipped, retaining only their interface-level taint status propagation records.

[0118] Equivalence path elimination mechanism based on state fingerprinting:

[0119] This study focuses on the state resolution problem at branch convergence points in the control flow graph. During depth-first traversal, whenever a convergence block (a block with an in-degree greater than 1) of the CPG is reached, the system dynamically calculates the characteristic hash value of the current path. This value is jointly generated by the path hash sequence and the taint propagation state. By establishing a mapping relationship between hash values ​​and path states, when it is detected that sub-instances of different traversal paths generate completely identical hash fingerprints upon reaching the same block, the exploration of equivalent paths is immediately terminated, and only the first complete path with that state fingerprint is retained.

[0120] for Figure 6 , Figure 6 (a) CPG generated by code Figure 6 (b) The path splits when traversing the branch structure, resulting in two different traversal instances. However, these two different instances do not change their polluted state after traversing the branch structure; they are equivalent paths. Therefore, at the branch convergence point ( Figure 6 The `Sink(tainted_var)` basic block performs hash fingerprint checks. First, the traversal instances arriving at the sink calculate the hash value of the path and store it; then, the instances arriving at the sink calculate the hash value and find that the current path has been traversed, so they stop and release resources immediately.

[0121] This state fingerprint-based equivalent path elimination mechanism is particularly suitable for handling conditional branch convergence scenarios with multiple predecessor basic blocks. It can effectively eliminate the redundancy of equivalent paths caused by the arrangement and combination of branch structures, while ensuring that the core semantic features of taint propagation are still completely preserved after compression, thus achieving linear control over the exponential growth of the path space.

[0122] S9. Verify the optimized instance to obtain effective taint propagation paths, and use all effective taint propagation paths as taint path search results.

[0123] The optimized instance was verified to obtain effective taint propagation paths. All effective taint propagation paths were used as taint path search results, including:

[0124] Based on the optimized instance and the predefined list of Sink basic blocks, perform Sink point arrival verification and contamination propagation effectiveness checks on each search instance;

[0125] Based on the verification and inspection results, identify valid taint propagation paths and perform path result recording and instance lifecycle management.

[0126] Based on path records and instance lifecycle management, output tainted path search results.

[0127] A taint path search system, comprising:

[0128] The acquisition module is used to acquire CPG files and generate basic blocks based on the CPG files.

[0129] The settings module is used to set the annotation rules for Source and Sink points;

[0130] The recording module is used to mark all Source basic blocks and Sink basic blocks according to the annotation rules, and record the position information of all Source basic blocks to the Source point list;

[0131] The initialization module is used to initialize the dynamic hash table, path hash chain, and global variable pollution summary table.

[0132] The marking module is used to create a search instance for each Source point according to the Source point list, mark the Source point variable as a preset state, add the hash value of the Source basic block corresponding to the Source point to the path hash chain, and add the search instance to the active instance queue.

[0133] The update module is used to analyze the instructions within the Source basic block, extract variable identifiers based on the instructions and preset states, perform pollution state analysis based on the variable identifiers to update the initialized dynamic hash table, and obtain the updated dynamic hash table.

[0134] The splitting module is used to perform path splitting based on the updated dynamic hash table and the global variable pollution summary table to obtain splitting instances and the global variable pollution summary table.

[0135] The optimization module is used to optimize the search instances and split instances based on the global variable pollution summary table and the path hash chain to obtain optimized instances;

[0136] The verification module is used to verify the optimized instance, obtain valid taint propagation paths, and use all valid taint propagation paths as taint path search results.

[0137] This application also discloses a terminal device, including a memory and a processor. The memory stores a computer program that can run on the processor. When the processor loads and executes the computer program, it employs a tainted path search method.

[0138] The terminal device can be a computer device such as a desktop computer, a laptop computer, or a cloud server. The terminal device includes, but is not limited to, a processor and a memory. For example, the terminal device may also include input / output devices, network access devices, and buses.

[0139] The processor can be a central processing unit (CPU). Of course, depending on the actual use, it can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), off-the-shelf programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc., and this application does not limit it.

[0140] The memory can be an internal storage unit of the terminal device, such as a hard disk or RAM of the terminal device, or an external storage device of the terminal device, such as a plug-in hard disk, smart memory card (SMC), secure digital card (SD), or flash memory card (FC) equipped on the terminal device. Furthermore, the memory can be a combination of internal storage units and external storage devices of the terminal device. The memory is used to store computer programs and other programs and data required by the terminal device. The memory can also be used to temporarily store data that has been output or will be output. This application does not limit this.

[0141] In this terminal device, a taint path search method from the above embodiments is stored in the terminal device's memory and loaded and executed on the terminal device's processor for convenient use.

[0142] This application also discloses a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, it employs a taint path search method described in the above embodiments.

[0143] The computer program can be stored in a computer-readable medium. The computer program includes computer program code, which can be in the form of source code, object code, executable file, or certain middleware. The computer-readable medium includes any entity or device capable of carrying computer program code, recording media, USB flash drive, portable hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the computer-readable medium includes, but is not limited to, the above-mentioned components.

[0144] The above-described tainted path search method is stored in the computer-readable storage medium and loaded and executed on the processor to facilitate the storage and application of the method.

[0145] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of protection of this application is limited to these examples; under the concept of this application, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of one or more embodiments of this application as described above, which are not provided in detail for the sake of brevity.

[0146] One or more embodiments in this application are intended to cover all such substitutions, modifications, and variations that fall within the broad scope of this application. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of one or more embodiments in this application should be included within the protection scope of this application.

Claims

1. A method of searching for a stain path, characterized by, The method comprises the following steps: acquiring a CPG file, and generating basic blocks according to the CPG file; setting a marking rule of a Source point and a Sink point; according to the marking rule, marking all Source basic blocks and Sink basic blocks, and recording position information of all Source basic blocks to a Source point list; initializing a dynamic hash table, a path hash chain and a global variable pollution abstract table; according to the Source point list, creating a search instance for each Source point, marking a variable of the Source point as a preset state, and adding a hash value of a Source basic block corresponding to the Source point to the path hash chain; analyzing instructions in the Source basic block, extracting a variable identifier according to the instructions and the preset state, and performing pollution state analysis according to the variable identifier to update the initialized dynamic hash table, to obtain an updated dynamic hash table; performing path splitting according to the updated dynamic hash table and the global variable pollution abstract table, to obtain a split instance and the global variable pollution abstract table; performing search optimization on the search instance and the split instance according to the global variable pollution abstract table and the path hash chain, to obtain an optimized instance; verifying the optimized instance, to obtain an effective pollution propagation path, and taking all effective pollution propagation paths as a pollution path search result; the path splitting according to the updated dynamic hash table and the global variable pollution abstract table, to obtain the split instance and the global variable pollution abstract table, comprises the following steps: performing branch importance evaluation and pollution state dependence analysis according to the updated dynamic hash table, successor basic block information in a CPG structure and the global variable pollution abstract table; performing path state update operation of the current search instance according to a result of the pollution state dependence analysis, and generating a corresponding sub-search instance set through an instance replication mechanism, and simultaneously updating the global variable pollution abstract table; outputting the current instance after state update, the newly generated split instance and the updated global variable pollution abstract table according to the path state update, the instance replication mechanism and the global state synchronization operation, and taking the current instance and the newly generated split instance as a search instance set.

2. The method of claim 1, wherein the search for the path of the stain is performed by a user. the creating of the search instance for each Source point, the marking of the variable of the Source point as the preset state, and the adding of the hash value of the Source basic block corresponding to the Source point to the path hash chain, comprises the following steps: creating a search instance for each Source basic block in the Source point list; in each search instance, marking a variable identifier corresponding to the Source basic block as a preset state in a pollution state hash table, and adding a hash value of the Source basic block to the path hash chain, the preset state comprising a Tainted state and an Uncertain state.

3. The taint path search method as described in claim 1, characterized in that, the analyzing of the instructions in the Source basic block, the extracting of the variable identifier according to the instructions and the preset state, and the performing of the pollution state analysis according to the variable identifier to update the initialized dynamic hash table, to obtain the updated dynamic hash table, comprises the following steps: The variable identifier and the instruction type are obtained by analyzing each instruction in the Source basic block and a preset state, and the variable identifiers of all instructions form a variable identifier list; According to the variable identifier, the current state of each variable in the initialization dynamic hash table is obtained; According to the instruction type, the propagation mode is obtained, and the propagation mode includes an explicit data flow and an implicit data flow; According to the propagation mode and the current state, the initialization dynamic hash table is updated to obtain an updated dynamic hash table.

4. The taint path search method as described in claim 1, characterized in that, According to the search instance and the global variable pollution summary table, the search optimization is performed on the search instance and the split instance to obtain an optimized instance, including: According to the search instance and the global variable pollution summary table, the loop suppression check, the equivalent path elimination and the function pollution pre-judgment optimization strategy are applied to each search instance in sequence; According to the optimization strategy check result, the search instance set is filtered, the instance that does not meet the optimization condition is terminated, the instance that passes the check is retained, and a filtering result is obtained; According to the filtering processing result, the updated state fingerprint register and the filtered effective search instance set are output as the optimized instance.

5. The method of stain path search according to Claim 4, wherein According to the search instance and the predefined Sink basic block list, the Sink point arrival verification and the pollution propagation validity check are performed on each search instance. According to the verification check result, the effective pollution propagation path is identified, and the path record and the instance life cycle management are performed. According to the path record and the instance life cycle management, the pollution path search result is output. The variable refers to a data carrier used for storing and transmitting data in a program execution process.

6. The method of stain path search according to Claim 1, wherein The method comprises the steps of:

7. A stain path search system characterized by comprising: An acquisition module is configured to acquire a CPG file and generate basic blocks according to the CPG file; A setting module is configured to set a marking rule of a Source point and a Sink point; A recording module is configured to mark all Source basic blocks and Sink basic blocks according to the marking rule and record position information of all Source basic blocks in a Source point list; An initialization module is configured to initialize a dynamic hash table, a path hash chain and a global variable pollution summary table; A marking module is configured to create a search instance for each Source point according to the Source point list, mark a Source point variable as a preset state and add a hash value of a Source basic block corresponding to the Source point to the path hash chain; An updating module is configured to analyze instructions in a Source basic block, extract a variable identifier according to the instructions and the preset state, perform pollution state analysis according to the variable identifier to update the initialization dynamic hash table and obtain an updated dynamic hash table; A splitting module is configured to perform path splitting according to the updated dynamic hash table and the global variable pollution summary table to obtain a split instance and the global variable pollution summary table; An optimization module is configured to perform search optimization on the search instance and the split instance according to the global variable pollution summary table and the path hash chain to obtain an optimized instance. ​ A verification module is configured to verify the optimization instance to obtain valid taint propagation paths, and all the valid taint propagation paths are taken as taint path search results. The path splitting according to the updated dynamic hash table and the global variable pollution abstract table comprises: According to the updated dynamic hash table, the successor basic block information in the CPG structure and the global variable pollution abstract table, branch importance evaluation and pollution state dependence analysis are performed; According to the pollution state dependence analysis result, a path state update operation of the current search instance is performed, a corresponding sub-search instance set is generated through an instance replication mechanism, and the global variable pollution abstract table is synchronously updated; According to the path state update, the instance replication mechanism and the global state synchronization operation, a current instance after state update, a newly generated split instance and an updated global variable pollution abstract table are output, and the current instance and the newly generated split instance are taken as a search instance set.

8. A terminal device comprising a memory and a processor, characterized in that, The memory stores a computer program capable of running on the processor, and when the processor loads and executes the computer program, the method in any one of claims 1 to 6 is adopted.

9. A computer-readable storage medium having stored therein a computer program, characterized in that, The computer program is loaded and executed by the processor, and the method in any one of claims 1 to 6 is adopted.

Images