Static Analysis of Build Files to Identify Orphaned and Hardcoded Strings
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern software complexity and staged development can lead to vulnerabilities in final software builds, including data leakage and poor design issues, making maintenance and patching difficult, especially when code from multiple vendors is integrated.
Innovation Solution
A method and device for identifying vulnerabilities by scanning build files to label and output hardcoded and orphaned strings, which are potential data leakage points, and determining a build quality score based on their count relative to total strings or file size, using a computing device with processors and memory storing software vulnerability analysis applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If software packages include code from multiple vendors with staged development, then functionality and complexity increase, but vulnerabilities and data leakage risks increase
Solution Approach 1:
The patent performs static analysis on build files before software release to identify hardcoded and orphaned strings that could indicate vulnerabilities. This preliminary detection allows developers to fix issues before the software is deployed, preventing vulnerabilities from reaching production environments.
Solution Approach 2:
The patent introduces an intermediate analysis layer between development and release by examining build files (AndroidManifest.xml, string resources, etc.) to detect potential security issues. This intermediary step identifies hardcoded strings and orphaned resources without requiring full software execution or user interaction.
2Measurement precision
If manual review methods are used to identify vulnerabilities, then detection accuracy may be high, but time consumption and costs increase
Solution Approach 1:
The patent implements automated static analysis that performs vulnerability detection without human intervention. The system automatically scans build files, identifies hardcoded and orphaned strings, and generates reports, eliminating the need for manual review while maintaining consistent detection accuracy across all software packages.
Solution Approach 2:
The patent replaces manual review processes with automated computational analysis. Instead of human experts manually examining build files, the system uses algorithms to parse AndroidManifest.xml, string resources, and other build files, efficiently identifying vulnerabilities at scale without human time investment.
3Reliability
If thorough vulnerability scanning is performed on all build files, then vulnerability detection improves, but processing time and computational resources increase
Solution Approach 1:
The patent extracts only the critical elements needed for vulnerability detection from build files, such as hardcoded strings, orphaned resources, and permission declarations. By focusing analysis on these specific elements rather than processing entire software binaries, the system achieves thorough vulnerability scanning with reduced computational overhead and faster processing.
Data Source
AI summary
Described are methods and devices to identify vulnerabilities in a software package that includes two or more build files. The build files include at least an application file and one or more resource files. The method includes scanning the build files to identify strings. Strings that appear in one of the resource files and are not referenced in the application file are labelled orphaned. Strings that appear in the application file and are node defined in any of the resources files are labelled hardcoded. The identity of hardcoded and orphaned strings is output as potential vulnerabilities or data leakage points.