Metadata-Scoped Static Source Code Scanner
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current static source code scanning methods scan all source code files, including those not deployed, resulting in unnecessary findings and manual filtering by developers, which distracts from real software issues.
Innovation Solution
A metadata-scoped code scanner identifies assemblies generated from source code files, extracts file paths from assembly metadata, and scans only the deployed source code files to detect potential vulnerabilities, omitting non-deployed files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all source code files are scanned, then comprehensive vulnerability detection is achieved, but scanning time and computational resources increase significantly
Solution Approach 1:
The patent extracts only the deployed source code files from the complete code repository using assembly metadata (PDB files) as a reference. By taking out only the necessary files that are actually deployed and scanned, the system avoids wasting time on extraneous files while maintaining comprehensive vulnerability detection for the deployed codebase.
Solution Approach 2:
The system performs preliminary action by generating and storing assembly metadata (PDB files) during the build process, which contains information about which source code files are deployed. This preliminary preparation enables the scanner to quickly identify and scan only the relevant deployed files without having to analyze the entire code repository during the scanning phase.
2Reliability
If all source code files are scanned, then all potential vulnerabilities are identified, but unnecessary findings from non-deployed files increase manual filtering workload
Solution Approach 1:
The patent extracts and scans only the deployed source code files by using assembly metadata to identify which files are actually deployed. This extraction approach eliminates findings from non-deployed files, thereby reducing the manual filtering workload while maintaining complete vulnerability identification for the deployed codebase.
3Productivity
If the scope of source code scanning is limited to deployed files, then scanning efficiency improves, but the system complexity increases due to metadata processing
Solution Approach 1:
The patent introduces assembly metadata (PDB files) as an intermediary that bridges the code repository and the scanner. This intermediary contains pre-processed information about deployed files, allowing the scanner to efficiently identify and scan only relevant files without directly analyzing the entire code repository, thus improving efficiency while managing complexity through a dedicated metadata layer.
4Productivity
If assembly metadata is used to identify deployed files, then scanning scope is automatically limited, but additional processing steps are required
Solution Approach 1:
The system performs preliminary action by generating assembly metadata (PDB files) during the build process, which automatically captures information about deployed source code files. This preliminary preparation enables automatic limitation of the scanning scope without requiring complex processing during the scan itself, as the metadata is already prepared and ready for the scanner to use.
Data Source
AI summary
A computer implemented method for scanning source code files included in an application. A source code scanner identifies an assembly generated from a set of source code files. The assembly comprises assembly code and assembly metadata. The source code scanner identifies a file path for each source code file identified from the assembly. The file path is identified within the assembly metadata. Responsive to identifying the file paths from the assembly metadata, the source code scanner identifies the set of source code files within a code repository. The source code scanner scans the set of source code files to identify potential code vulnerabilities in the set of source code files. The scan omits files in the code repository that were not identified within the assembly metadata.