AST Taint Tracking via Check Nodes for Vulnerability Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current taint analysis methods, particularly dynamic taint tracking, face challenges in efficiently identifying vulnerabilities in source code across multiple programming languages, as they often require binary-level or source-code-level analysis, lacking a language-independent representation that can effectively track tainted data flows.
Innovation Solution
Instrumenting an abstract syntax tree (AST) with check taint nodes and set taint nodes to determine tainted values and propagate taint status, enabling taint analysis at the AST level, which enhances vulnerability detection and runtime efficiency by using a language-independent representation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If dynamic taint tracking is performed at binary level or source code level, then vulnerability detection capability is improved, but analysis efficiency and runtime performance deteriorate
Solution Approach 1:
The patent introduces an intermediate representation (IR) as a mediator between source code and binary execution. The IR serves as a language-independent abstraction layer that enables taint tracking without requiring direct analysis of source code syntax or binary machine code, thus improving both detection capability and analysis efficiency by operating at an optimal abstraction level.
Solution Approach 2:
The patent changes the parameter of analysis level from binary level or source code level to intermediate representation level. This parameter change enables taint tracking to operate at an abstraction level that preserves semantic information for vulnerability detection while avoiding the overhead of source code parsing and the loss of semantic detail in binary analysis.
2Adaptability or versatility
If taint tracking is performed across multiple programming languages, then versatility and language coverage are improved, but system complexity increases
Solution Approach 1:
The patent creates a universal intermediate representation that can represent multiple programming languages (e.g., Java, JavaScript, Python) in a unified format. This universal IR enables the same taint tracking infrastructure to analyze code from different languages without requiring language-specific analysis components, thus achieving multi-language support while maintaining system simplicity.
3Productivity
If instrumented abstract syntax tree is used for taint analysis, then runtime efficiency is improved, but implementation complexity increases
Solution Approach 1:
The patent performs preliminary instrumentation of the abstract syntax tree during code loading or compilation, before runtime execution. Taint tracking checkpoints are pre-inserted at critical locations in the AST, allowing runtime taint analysis to proceed efficiently without adding overhead to the main execution path. This preliminary action separates the complexity of instrumentation from runtime performance.
Data Source
AI summary
A method may include determining that a non-constant value of a variable corresponding to a variable node of the abstract syntax tree flows into an operator node in the abstract syntax tree. The method may further include adding, to the abstract syntax tree, a check taint node including functionality to: make a taint status determination that the non-constant value is tainted, and return the non-constant value to the operator node. The operator node generates a result value by executing an operator using the non-constant value. The method may further include adding, to the abstract syntax tree, a set taint node that stores, based on the taint status determination, the result value in a second tainted object, and performing, using the abstract syntax tree, a taint analysis of the source code to identify a vulnerability in the source code.