Static Analysis of Framework-Based Applications via Synthetic Request Transformation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Static analysis techniques are ineffective in detecting defects such as security vulnerabilities and memory leaks in framework-based applications that utilize dynamic language constructs, as the behavior of these constructs only becomes evident at runtime, making it difficult to statically analyze method calls when method names are based on strings manipulated at runtime.
Innovation Solution
A method and system that extract framework object registrations and requests from application code, derive synthetic requests, transform the code by replacing original requests with synthetic ones, and perform static analysis on the transformed code to detect defects like taint flows and security-sensitive operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If static analysis techniques are applied to framework-based applications using dynamic language constructs, then analysis coverage is attempted, but detection effectiveness deteriorates because behavior only becomes evident at runtime
Solution Approach 1:
The patent performs preliminary actions by extracting framework object registrations and requests from application code before static analysis, transforming the code to replace dynamic requests with synthetic requests that expose implicit flows. This preliminary transformation enables subsequent static analysis to effectively detect defects that would otherwise only be evident at runtime.
Solution Approach 2:
The patent introduces an intermediary transformation process that acts as a bridge between the original framework-based code and static analysis. By deriving synthetic requests from framework registrations and replacing original requests, the transformation creates an intermediate representation that makes implicit framework flows explicit and analyzable by static analysis tools.
2Adaptability or versatility
If dynamic language constructs are used in framework-based applications, then flexibility and inversion of control are achieved, but static analysis capability deteriorates because method names are based on strings manipulated at runtime
Solution Approach 1:
The patent creates synthetic requests as copies of the original dynamic requests, but in a form that is suitable for static analysis. By copying the request structure and replacing it with a version that uses the framework object registration information, the patent preserves the original dynamic behavior while creating an analyzable representation for defect detection.
3Measurement precision
If code transformation is performed to replace requests with synthetic requests, then defect detection capability is improved, but processing complexity increases
Solution Approach 1:
The patent segments the analysis process into distinct phases: extracting framework object registrations, extracting requests, deriving synthetic requests, transforming code by replacing requests, and performing static analysis. This segmentation breaks down the complex task into manageable steps, making the overall process more tractable and systematic.
Data Source
AI summary
A method for detecting a defect may include extracting, from application code, a registration of a framework object and a request for the framework object, deriving a synthetic request using the registration and the request, transforming the application code by replacing, by a computer processor, the request with the synthetic request, and detecting the defect by performing a static analysis on the transformed application code.