Path-Based Rule Matching for Untyped Language Taint Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In languages without a strong type system, such as JavaScript, it is difficult to accurately identify objects as sources, sinks, or sanitizers for taint analysis, making it challenging to detect security vulnerabilities like XSS, SQL injection, and information leakage, as traditional rule-based taint analysis relies heavily on type information which is not available.
Innovation Solution
The approach involves specifying complete paths for retrieving sources, sinks, and sanitizers in rules, allowing for the identification of objects of interest without relying on type information, enabling taint analysis to track tainted flows and report vulnerabilities effectively.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional type-based rules are used for taint analysis, then the analysis is simple to implement, but it cannot accurately identify sources, sinks, or sanitizers in languages without strong type systems
Solution Approach 1:
The patent segments the rule matching process into two distinct phases: type-based matching for typed languages and path-based matching for untyped languages. This segmentation allows each matching strategy to be optimized for its appropriate context, improving accuracy without unnecessarily complicating the overall system.
Solution Approach 2:
The patent implements a dynamic rule matching system that automatically selects between type-based and path-based matching approaches based on the language characteristics of the code being analyzed. This dynamic adaptation allows the system to maintain high accuracy across different programming languages without requiring manual configuration.
2Reliability
If path-based rules are implemented for untyped languages, then accurate identification of security objects is achieved, but the rule matching process becomes more complex
Solution Approach 1:
The patent introduces an intermediary component that translates path-based rules into executable matching logic. This intermediary layer handles the complexity of path-based matching internally, allowing the rest of the system to interact with a simplified interface while still achieving reliable identification of security objects in untyped languages.
3Adaptability or versatility
If comprehensive rule sets are created to cover all security vulnerabilities, then detection capability is improved, but the difficulty of configuring and maintaining rules increases
Solution Approach 1:
The patent creates a universal rule matching framework that handles both typed and untyped languages through a single unified system. This multi-functional approach allows comprehensive security vulnerability detection across different language types without requiring separate rule configuration systems, thereby improving versatility while maintaining ease of operation.
Data Source
AI summary
A method includes reading by a computing system a rule file including one or more rules having specified paths to methods, each method corresponding to one of a sink, source, or sanitizer. The method includes matching by the computing system the methods to corresponding ones of sinks, sources, or sanitizers determined through a static analysis of an application. The static analysis determines at least flows from sources of information to sinks that use the information. The method includes performing by the computing system, using the sinks, sources, and sanitizers found by the matching, a taint analysis to determine at least tainted flows from sources to sinks, wherein the tainted flows are flows passing information to sinks without the information being endorsed by a sanitizer. Apparatus and program products are also disclosed.