Functional Language Vulnerability Scanner Using AST and Function Lists
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security-analysis techniques fail to adequately identify impure functions in functional programming languages that may change underlying proprietary data or contain input/output calls outside the business product environment, leaving data vulnerable to security risks.
Innovation Solution
A code scanning system that generates an abstract syntax tree from source code and uses a white list of permitted pure functions and a black list of prohibited impure functions to perform static analysis, classifying functions as pure or impure, thereby identifying and flagging potential data vulnerabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional static testing is used to analyze source code for security vulnerabilities, then security weaknesses in the application itself can be identified, but impure functions that change underlying proprietary data or contain I/O calls outside the business product environment cannot be adequately identified
Solution Approach 1:
The analysis is divided into two distinct segments: traditional static testing for application-level security vulnerabilities, and pure function analysis for detecting impure functions that access external I/O or modify proprietary data. Each segment targets specific types of vulnerabilities with specialized analysis techniques, allowing both security aspects to be thoroughly addressed without compromising detection accuracy in either area.
Solution Approach 2:
Pure function analysis serves as an intermediary layer between traditional static testing and the actual source code execution. It first identifies and analyzes impure functions (those with I/O calls or data modifications) separately, then integrates this analysis with traditional security scanning to provide comprehensive vulnerability detection. This intermediary approach enables precise detection of impure functions while maintaining overall security analysis effectiveness.
2Productivity
If employees manually create calculation instructions via computer programs using functional programming languages, then proprietary data analysis can be performed, but the programs may contain impure functions that leave proprietary data vulnerable to security risks
Solution Approach 1:
The system performs preliminary analysis of source code before execution to identify impure functions that may compromise proprietary data security. By detecting functions with I/O calls or data modification capabilities in advance, the system can flag potential security risks before they are executed, allowing preventive measures to be taken while maintaining the productivity benefits of functional programming for data analysis tasks.
Solution Approach 2:
The system provides feedback to employees about impure functions detected in their code, enabling them to revise and improve their programs. This feedback mechanism allows employees to continue using functional programming languages for productive data analysis while being informed of security vulnerabilities, creating a continuous improvement cycle that enhances both productivity and data security.
Data Source
AI summary
A code scanning system has a syntax generation component that receives source code and generates an abstract syntax tree file. The system includes a white list of permitted pure functions, and a black list of prohibited impure functions. In addition, the system includes a static code analyzer for performing static analysis of the source code. The static code analyzer includes a function analyzer that receives the AST file and identifies the functions. Each function is compared to the white list, and if it is present, marked as permitted in a static analysis file. If the function is not on the white list, it is compared to the black list. If it is present on the black list, it is marked as prohibited in the static analysis file. If the function is not on the white or black list, it is marked as “unknown” and subjected to manual analysis.