Device, method, and program for diagnosing possibility of confidential information being exposed

Abstract

To provide a device, a method, and a program for diagnosing the possibility of confidential information being exposed in a web application.SOLUTION: A device receives a URL of a web application to be diagnosed from a user terminal (S201). Next, the device accesses a web page identified using the URL (S202) and obtains source codes and related data for the web page from a web server (S203). Next, the device extracts a first set of text data and a second set of dynamic text data included in a web page displayed by the obtained source codes (S204-S205). The device detects at least some of one or more pieces of text data that are not included in the first set of text data from the second set of dynamic text data (S206) and transmits at least some of the detected pieces of the text data to the user terminal (S207).SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to an apparatus, a method, and a program for diagnosing the possibility of confidential information being exposed. [Background technology]

[0002] As the amount of software provided over the Internet increases, the number of cases where software defects cause unintended behavior is also increasing. Such defects are called "vulnerabilities" and come in a variety of forms, including improper input validation, SQL injection, cross-site scripting, and more.

[0003] One of the many vulnerabilities is information exposure. This means that confidential information is exposed to those who are not authorized to access it, and it undermines the confidentiality of information required in cybersecurity. There are various types of software defects that can cause confidential information to be exposed, and measures to address them are required. Summary of the Invention [Problem to be solved by the invention]

[0004] Through the development of numerous applications, the inventors have discovered that a common vulnerability in web applications is a defect that exposes information that should be kept confidential to web page viewers, and that it is possible to efficiently diagnose the presence or absence of such a defect. For example, an example of such a defect is when personal information is sent to a device used by someone who is not the subject of the information and is not authorized to access the information.

[0005] The present invention has been made in view of the above points, and an object of the present invention is to provide an apparatus, a method, and a program for diagnosing the possibility of confidential information being exposed in a web application. [Means for solving the problem]

[0006] To achieve this objective, a first aspect of the present invention is a method for diagnosing the possibility of confidential information being exposed in a web application, comprising the steps of: an apparatus obtaining source code of a web page for the web application and related data other than the source code associated with the web page; extracting a first set of text data included in the web page displayed by the source code; extracting a second set of dynamic text data included in the source code and the related data; and detecting at least a portion of one or more pieces of text data from the second set that are not included in the first set of text data as one or more detection results that may be exposed.

[0007] A second aspect of the present invention is the method of the first aspect, wherein the web page is a web page identified by a URL of the web application received as a target for diagnosis.

[0008] Furthermore, a third aspect of the present invention is a method of the first aspect, wherein the web page is included in a plurality of web pages included in a website determined by the URL of the web application received as the target for diagnosis.

[0009] Also, a fourth aspect of the present invention is a method of the first aspect, wherein the second set of dynamic text data includes variable text data in a response to a request specifying the URL of the web page.

[0010] Furthermore, a fifth aspect of the present invention is a method of the first or fourth aspect, wherein the second set of dynamic text data includes one or more character strings extracted from the source code on the condition that they match a predetermined regular expression.

[0011] A sixth aspect of the present invention is the method according to the fifth aspect, wherein said regular expression represents at least one of a telephone number, an email address, and an IP address.

[0012] Furthermore, a seventh aspect of the present invention is a method of the first or fourth aspect, wherein the related data includes at least one of an API response, data stored in local storage or session storage, and data stored in a cookie.

[0013] An eighth aspect of the present invention is the method of the seventh aspect, wherein the API response includes one received by the device after the web page is displayed.

[0014] A ninth aspect of the present invention is a program for causing an apparatus to execute a method for diagnosing the possibility of confidential information being exposed in a web application, the method including the steps of: the apparatus acquiring source code of a web page for the web application and related data other than the source code associated with the web page; extracting a first set of text data included in the web page displayed by the source code; extracting a second set of dynamic text data included in the source code and the related data; and detecting at least a portion of one or more pieces of text data from the second set that are not included in the first set of text data as one or more detection results that may be exposed.

[0015] In addition, a tenth aspect of the present invention is an apparatus for diagnosing the possibility of confidential information being exposed in a web application, which obtains source code of a web page for the web application and related data other than the source code associated with the web page, extracts a first set of text data included in the web page displayed by the source code and a second set of dynamic text data included in the source code and the related data, and detects at least a portion of one or more text data of the second set of text data that are not included in the first set of text data as one or more detection results that may be exposed. [Effects of the Invention]

[0016] According to one aspect of the present invention, by comparing one or more text data included in a displayed web page with one or more dynamic text data included in the source code for displaying the web page and the related data associated with the web page, and detecting at least a portion of the differences as one or more detection results that may be exposed, it is possible to efficiently diagnose whether or not confidential information may be exposed during the development of a web application. [Brief explanation of the drawings]

[0017] [Figure 1] 1 is a diagram showing a diagnostic device according to an embodiment of the present invention; [Figure 2] FIG. 1 is a diagram showing a diagnostic method according to one embodiment of the present invention. [Figure 3] FIG. 2 is a diagram illustrating an example of a web page identified as a diagnostic target according to an embodiment of the present invention. [Figure 4] FIG. 4 is a diagram showing some of the data items included in the source code corresponding to the example in FIG. 3. [Figure 5] FIG. 4 is a diagram showing some of the associated data associated with the web page of FIG. 3. DETAILED DESCRIPTION OF THE INVENTION

[0018] Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

[0019] 1 shows an apparatus for diagnosing the possibility of confidential information being exposed in a web application according to one embodiment of the present invention. The apparatus 100 receives a URL of a web application to be diagnosed from a user terminal 110 of a user who uses a diagnostic service provided by the apparatus 100, and accesses the web page identified by the URL using a web browser running on the apparatus 100. The apparatus 100 receives data for displaying the web page from a web server 120 that provides the web application. The apparatus 100 is capable of communicating with the user terminal 110 and the web server 120 via an IP network such as the Internet.

[0020] The device 100 includes a communication unit 101 such as a communication interface, a processing unit 102 such as a processor or CPU, and a storage unit 103 including a storage device or storage medium such as a memory or hard disk, and can be configured by executing a program for performing each process or operation. The device 100 may include one or more devices, computers, or servers. The program may include one or more programs and may be recorded on a computer-readable storage medium to form a non-transitory program product. The program may be stored in a storage device or storage medium such as the storage unit 103 or a database 104 accessible from the device 100 via an IP network, and instructions included in the program may be executed by the processing unit 102. Data described below as being stored in the storage unit 103 may also be stored in the database 104, and vice versa.

[0021] First, the device 100 receives the URL of a web application to be diagnosed from the user terminal 110 (S201). In addition to cases where the received URL directly identifies a single web page as the diagnosis target, there are also cases where multiple web pages included in a website defined by the URL are identified as the diagnosis target. More specifically, multiple URLs associated with the URL may be scanned to list the URLs of the web pages to be diagnosed.

[0022] Next, the device 100 accesses the identified web page using a web browser running on the device 100 (S202), and obtains the source code for the web page and related data other than the source code associated with the web page from the web server 120 that provides the web application (S203). The related data may be received simultaneously with the source code, or may be received separately after receiving the source code depending on the content of the source code. Details of the related data will be described later.

[0023] Next, the device 100 extracts one or more pieces of text data (also referred to as a "first set of text data") included in the web page displayed on the user interface on the browser according to the acquired source code (S204).

[0024] FIG. 3 shows an example of a web page identified as a diagnostic target according to one embodiment of the present invention. Web page 300 displays the names and avatar images of multiple people, and for example, the name of each person and the file name of the avatar image can be extracted as a set of text data. Note that for images such as avatar images, the image itself is displayed on the web page, but the file name of the image is not necessarily displayed. In one embodiment of the present invention, however, text data corresponding to an image displayed on the web page is also considered to be "one or more text data included on the web page."

[0025] Then, the device 100 extracts one or more pieces of text data (also referred to as a "second set of text data") included in the acquired source code and related data (S205).

[0026] FIG. 4 shows a portion of the text data included in the source code corresponding to the example shown in FIG. 3 . The source code 400 includes, as attributes of the div element, the name 311 of the first person 310, “Matsuda Kaede,” and the file name 312 of the first person 310’s avatar image, as shown in FIG. 3 . It also includes the first person 310’s phone number and IP address. This dynamic text data is not necessarily required for viewing the web page 300 and is information that should be kept confidential from anyone other than the first person 310. However, it is exposed by displaying the source code of the web page 300. In this specification, at least a portion of the text data constituting the second set of text data is dynamic text data. “Dynamic text data” refers to variable text data in a response to a request specifying the URL of the web page being diagnosed. An example of such text data is text data that changes depending on data stored in a database referenced by the web server 120, such as the values ​​of data items having keys and their values ​​shown in FIG. 4 . In addition, in this specification, the "second set of text data" may be expressed as "second set of dynamic text data" in the sense that it at least partially includes dynamic text data.

[0027] FIG. 5 shows some of the associated data associated with the web page of FIG. 3 . The associated data 500 is a response to an API called when the web page 300 is displayed on the device 100, and includes person data for each person in JSON format. The associated data includes the name 311 of the first person 310, "Matsuda Kaede," as shown in FIG. 3 , as well as the phone number, IP address, and authentication code of the first person 310. The API response is generally stored at least temporarily on the device 100. The API response may be received before the web page 300 is displayed on the device 100, for example, along with the source code of the web page 300. Alternatively, the API response may be received as a response to a request sent by the device 100 after the web page 300 is displayed, with the URL of the web page 300 and required request parameters specified. For example, the device 100 behaves in this manner when programmed using a technique known as Ajax.

[0028] After extracting these text data, the device 100 detects at least a portion of one or more pieces of text data from the second set of text data that are not included in the first set of text data as one or more detection results that may be exposed (S206). In the example of FIGS. 3 to 5, the phone number, IP address, and authentication code of each person may be detected. At least a portion of the one or more detected results is transmitted from the device 100 to the user terminal 110 (S207).

[0029] In this way, by comparing one or more pieces of text data included in the displayed web page with one or more pieces of dynamic text data included in the source code for displaying the web page and the related data associated with the web page, and detecting at least a portion of the differences as one or more detection results that may be exposed, it is possible to efficiently diagnose whether or not confidential information may be exposed during the development of a web application.

[0030] Extract First Set of Text Data Details The extraction of the first set of text data can be performed using, for example, a program for automatically operating a web browser, such as Cypress, Selenium, or Puppeteer.

[0031] Extract Second Set of Text Data Details The second set of text data can be extracted from the source code or API response of the web page being assessed by extracting strings that match predetermined conditions. For example, values ​​of data items with item names containing predetermined strings, such as "password," "pwd," "auth_code," "phone," and "ip," can be extracted. Also, strings that match predetermined regular expressions can be extracted, such as the regular expressions shown in the table below.

[0032] [Table 1]

[0033] In addition to API responses, data associated with the web page to be diagnosed can also be data stored in the browser. Data stored in the browser can be stored in cookies, session storage, local storage, and the like. To read data from these storage locations, the device 100 can use, for example, the browser's API. Similar to API responses, this data can be data received before the web page 300 is displayed on the device 100, or data received after the web page 300 is displayed.

[0034] It should be noted that in the above-mentioned embodiments, unless there is a description of "only," such as "based on XX only," "depending only on XX," or "in the case of XX only," this specification assumes that additional information may also be taken into consideration. Also, as an example, it should be noted that the description "do b in the case of a" does not necessarily mean "always do b in the case of a" or "do b immediately after a" unless explicitly stated. Furthermore, the description "each a constituting A" does not necessarily mean that A is composed of multiple components, but includes the case where the component is singular.

[0035] Also, just to be clear, even if there is an aspect of a method, program, terminal, device, server, or system (hereinafter referred to as a "method, etc.") that performs an operation different from that described in this specification, each aspect of the present invention is directed to an operation that is identical to one of the operations described in this specification, and the existence of an operation different from that described in this specification does not make the method, etc. outside the scope of each aspect of the present invention. [Explanation of symbols]

[0036] 100 devices 101 Communications Department 102 Processing section 103 Storage section 104 databases 300 web pages 310 First Person 311 Name of the first person 312 Avatar image of the first person 400 Source Code

Claims

1. 1. A method for diagnosing potential exposure of sensitive information in a web application, comprising: obtaining source code for a web page for the web application and associated data other than the source code associated with the web page; extracting a first set of text data contained in the web page represented by the source code; extracting a second set of dynamic text data contained in the source code and the associated data; detecting at least a portion of one or more pieces of text data in the second set of text data that is not included in the first set of text data as one or more detection results that may be exposed; Includes.

2. 10. The method of claim 1, The web page is a web page specified by the URL of the web application received as a target for diagnosis.

3. 10. The method of claim 1, The web page is included in a plurality of web pages included in a website determined by the URL of the web application received as the target of diagnosis.

4. 10. The method of claim 1, The second set of dynamic text data includes variable text data in a response to a request specifying the URL of the web page.

5. 5. The method of claim 1 or 4, The second set of dynamic text data includes one or more character strings extracted from the source code on the condition that they match a predetermined regular expression.

6. 6. The method of claim 5, The regular expression represents at least one of a telephone number, an email address, and an IP address.

7. 5. The method of claim 1 or 4, The related data is API response, Data stored in local storage or session storage, and Data stored in cookies It includes at least one of the following.

8. 8. The method of claim 7, The API response includes what the device receives after the web page is displayed.

9. 1. A program for causing an apparatus to execute a method for diagnosing a possibility of confidential information being exposed in a web application, the method comprising: obtaining source code for a web page for the web application and associated data other than the source code associated with the web page; extracting a first set of text data contained in the web page represented by the source code; extracting a second set of dynamic text data contained in the source code and the associated data; detecting at least a portion of one or more pieces of text data in the second set of text data that is not included in the first set of text data as one or more detection results that may be exposed; Includes.

10. 1. An apparatus for diagnosing potential exposure of sensitive information in a web application, comprising: obtaining source code for a web page for the web application and associated data other than the source code associated with the web page; extracting a first set of text data contained in the web page represented by the source code and a second set of dynamic text data contained in the source code and the associated data; At least a portion of one or more pieces of text data in the second set that are not included in the first set of text data is detected as one or more detection results that may be exposed.

Images