Patent ID: 8646087
Filing Date: 2014-02-04
Classification: G06F

Abstract:
1. A method, comprising: accessing a security query comprising one or more indications of a plurality of sources in a software program; selecting a selected source as one of the plurality of sources in the security query; analyzing the software program while the software program is executed by a computer system, the software program having sources returning values, sinks that perform security-sensitive operations on those returned values or modified versions of the returned values, and flows of the returned values from the sources, through methods, and to the sinks, the analyzing determining a first set of methods having access to a value returned from the selected source; performing a static analysis on the software program, the static analysis using the first set of methods to determine a second set of methods having calling relationships with the selected source, the static analysis further determining whether the returned value from the selected source can flow through a flow to a sink in the second set of methods that performs a security-sensitive operation without the flow to the sink being endorsed by an endorser, in response to determining the returned value from the selected source can flow through the flow to the sink in the second set of methods that performs a security-sensitive operation, indicating a security violation for the selected source, and in response to determining the returned value from the selected source cannot flow through the flow to the sink in the second set of methods that performs the security-sensitive operation, indicating there is no security violation for the selected source; and selecting another of the plurality of sources in the security query as a newly selected source, performing the analyzing execution using the newly selected source, performing the static analysis using the newly selected source, and performing the selecting another of the plurality of sources, performing the analyzing execution, and performing the static analysis until all of the plurality of sources in the security query have been selected.