Developing applications using precise static security analysis

A security analysis of an application is performed by encoding predicates during a first operation by asserting a set of data flow facts comprising a mapping from a variable to a security-relevant substring of a string of the application. A respective truth value is associated with each data flow fact of the set of data flow facts. The set of data flow facts and each truth value are stored in a tangible computer-readable memory device. The truth value of at least one data flow fact of the set of data flow facts is updated in at least one subsequent operation using a set of abstract transformers to eliminate or reduce a security vulnerability in the application.

FIELD

The present disclosure relates generally to application development and analysis tools and, more specifically, to developing applications using precise static security analysis.

BACKGROUND

One challenge in performing static security analysis is to account for operations that sanitize and validate user-provided inputs in a sound and accurate manner. Consider the following example where input data is received from a user. The input data, which is initially considered untrusted, undergoes manipulations in the form of inline string operations:

The foregoing inline string operations do not present security vulnerabilities if the inline replace calls preceding the call to write suffice to block all forms of cross-site scripting (XSS) attacks, by removing all the tokens that could be used for an XSS attack. However, as a practical matter, it is difficult to verify that all forms of XSS attacks have, indeed, been blocked.

One way of verifying that security vulnerabilities do not exist is by performing string analysis, where string values and their flow within the program are approximated statically. This approach has two fundamental limitations: lack of scalability, and lack of remediation. String-analysis solutions typically exhibit poor scalability. This is mainly because the cost of modeling string values as well as string transformations—which form a very rich abstract domain—is extremely high. In terms of remediation, string analysis provides little if any feedback on the steps that must be taken to fix the unsecure code. For example, a software developer may become aware that there is a flow of untrusted data from a statement reading user input to a security-sensitive statement, but it is very difficult for the developer to pinpoint the problem and propose a practical solution.

Unfortunately, in many real-world applications, the defense measures used to ensure the safety of the application involve complicated logic. Applications involving industry-grade codes are quite large, and so string-analysis technologies are impractical. One practical solution used in the context of some commercial products is known as taint analysis Taint analysis allows a user to manually specify methods for sanitizing and validating the code. Considering the exemplary set of string operations discussed previously, the user could refactor the code so that all the string operations are packaged as a single sanitize method, and specify this method as a sanitizer as follows:

This sanitize method solution is problematic in terms of generating false positives, generating false negatives, providing little guidance in terms of remediation, and requiring high annotation overhead. In terms of false negatives, the user's specification is assumed—rather than verified—to be correct. If the user states that a sanitizer is correct, but the sanitizer in fact is not correct, then the analysis might suffer from false negatives (i.e., true vulnerabilities not being reported). Moreover, false positives are also problematic because the analysis cannot account for inline validation and sanitization logic. False positives may also arise in situations where the user provides an incomplete specification, where the user forgot to mention certain sanitizers or validators.

If the sanitize method does locate a vulnerability, then the user is given little information as to the missing sanitization or validation steps. This lack of information complicates remediation of the problem, and increases the probability of an incorrect remediation being applied. High annotation overhead is needed because the user is required to specify sanitizer and validator methods manually. This manual process is both burdensome and error prone. Moreover, as demonstrated previously, in some cases the user needs to first refactor the code to organize input transformations into a single method. Thus, there exists a need to overcome at least one of the preceding deficiencies and limitations of the related art.

SUMMARY

A method for performing a security analysis of an application, the method comprising: encoding a respective set of one or more predicates during a first operation by asserting a corresponding set of data flow facts each comprising a mapping from a variable to a security-relevant substring of the application; associating a respective truth value with each data flow fact of the corresponding set of data flow facts; storing the corresponding set of data flow facts and each respective truth value; and updating the respective truth value of at least one data flow fact of the corresponding set of data flow facts in at least one subsequent operation using a set of abstract transformers to eliminate or reduce a security vulnerability in the application.

A computer program product for performing a security analysis of an application, in another aspect, comprises a computer-readable storage medium having a computer-readable program stored therein, wherein the computer-readable program, when executed on a computing device including at least one processor, causes the at least one processor to encode a respective set of one or more predicates during a first operation by asserting a corresponding set of data flow facts each comprising a mapping from a variable to a security-relevant substring of the application; associate a respective truth value with each data flow fact of the corresponding set of data flow facts; store the corresponding set of data flow facts and each respective truth value; and update the respective truth value of at least one data flow fact of the corresponding set of data flow facts in at least one subsequent operation using a set of abstract transformers to eliminate or reduce a security vulnerability in the application.

An apparatus for performing a security analysis of an application, in another aspect, comprises a processor and a non-transitory computer-readable memory coupled to the processor, wherein the memory comprises instructions which, when executed by the processor, cause the processor to encode a respective set of one or more predicates during a first operation by asserting a corresponding set of data flow facts each comprising a mapping from a variable to a security-relevant substring of the application; associate a respective truth value with each data flow fact of the corresponding set of data flow facts; store the corresponding set of data flow facts and each respective truth value; and update the respective truth value of at least one data flow fact of the corresponding set of data flow facts in at least one subsequent operation using a set of abstract transformers to eliminate or reduce a security vulnerability in the application.

DETAILED DESCRIPTION

FIG. 1illustrates an exemplary method for performing a security analysis of an application in accordance with one or more embodiments of the present invention. The method commences at block101where a respective set of one or more predicates is encoded during a first operation by asserting a corresponding set of data flow facts each comprising a mapping from a variable to a security-relevant substring of the application. Thus, encoding refers to a process of representing the predicate using a sequence of characters, such as letters, numbers, punctuation, binary code, or symbols, where the predicate represents a set of data flow facts.

A predicate is a statement comprising one or more variables that may be true or false depending on the values of the one or more variables. The predicate may be conceptualized as an operator or function that returns a value that is either true or false. For example, predicates are used to indicate set membership. When talking about sets, it is sometimes inconvenient or impossible to describe a set by listing all of its elements. Thus, a predicate P(x) will be true or false, depending on whether x belongs to the set.

Predicates are used to characterize the properties of objects by defining the set of all objects that have some property in common. So, for example, when P is a predicate on X, it is said that P is a property of X. Similarly, the notation P(x) is used to denote a sentence or statement P concerning the variable object x. The set defined by P(x) is written as {x|P(x)}, and is just a collection of all the objects for which P is true. For instance, {x|x is a natural number less than 4} is the set {1,2,3}. If t is an element of the set {x|P(x)}, then the statement P(t) is true. Here, P(x) is referred to as the predicate, and x is a subject of a proposition. Sometimes, P(x) is also called a propositional function, as each choice of x produces a proposition. One exemplary form of a predicate is a Boolean expression, in which case the inputs to the expression are themselves Boolean values, combined using Boolean operations.

The first operation of block101may comprise a static analysis where the set of data flow facts comprise one or more assertions about one or more substrings contained within the string of the application. Alternatively or additionally, the first operation of block101may comprise a dynamic analysis within an instrumented interpreter, where the set of data flow facts comprise one or more assertions about one or more substrings contained within the string of the application. Alternatively or additionally, the first operation of block101may comprise a static and dynamic analysis within an instrumented interpreter, where the set of data flow facts comprise one or more assertions indicative of whether or not each of one or more substrings contained within the string of the application are untrusted.

The procedure ofFIG. 1proceeds to block103where a respective truth value is associated with each data flow fact of the corresponding set of data flow facts. Next, at block105, the corresponding set of data flow facts is stored with each respective truth value in a tangible computer-readable memory device. Then, at block107, the respective truth value of at least one data flow fact of the corresponding set of data flow facts is updated in at least one subsequent operation using a set of abstract transformers to eliminate or reduce a security vulnerability in the application. The subsequent operation occurs subsequently to the first operation. The abstract transformers comprise one or more replace operations for deleting a substring, such that a set of one or more undeleted substrings remains.

The procedure then advances to block109where the set of one or more undeleted substrings is joined by performing a union operation on the set of one or more undeleted substrings to generate a joined set of substrings. Next, at block111, a differencing operation is performed on the joined set of substrings to provide an intersected joined set of substrings.

The procedure ofFIG. 1provides technical features, effects, and enhancements in terms of reduced annotation overhead, accuracy, remediation, and scalability. With regard to reduced annotation overhead, the security analysis no longer requires a user specification. Sanitization and validation operations are accounted for automatically by virtue of the abstract transformers. Similarly, there is no need for refactoring steps for grouping string operations into a single method. Considering accuracy, the procedure ofFIG. 1addresses false negatives due to incorrect specifications, as well as false positives due to inline sanitization and validation. In terms of remediation, if the security analysis discovers a vulnerable data flow, then the user is provided with exact information on the offending illegal characters or substrings that flowed into the security-sensitive operation. This enables quick comprehension of the security problem, and highlights which remediation steps need to be employed to fix the problem. In contrast to string analysis where the abstract domain is extremely rich due to the need to account for string values, rather than the question of whether the string contains specific security-related substrings, the abstract domain utilized by the procedure ofFIG. 1is finite and small, thereby enabling fast and scalable static security analysis to be performed.

FIG. 2illustrates an exemplary portion of an application on which the method ofFIG. 1is performed in accordance with one or more embodiments of the present invention. Sets of square brackets [ ] are used to denote the tracked data flow facts previously discussed in connection with block101ofFIG. 1. Returning toFIG. 2, at block201, a set of empty brackets [ ] is used to denote that, prior to a call to a getParameter subroutine, there is no untrusted data flowing within the application. Then, at block203, the call to the getParameter subroutine takes place. After this call, at block205, a parameter name is assigned to a value input by a user. The mapping of the parameter name to a set {‘<’, ‘>’, “script”} denotes that these substrings need to be eliminated from name before name can safely flow into a security-sensitive operation.

The subsequent replace calls of blocks207-215achieve this elimination, and thus the set is updated moving from one replace call to the next, until finally at block217, there is no untrusted data flowing within the application. Then, at block219, data flowing into a security-sensitive write operation is safe, and a false issue is suppressed.

FIG. 3illustrates an exemplary apparatus on which the method ofFIG. 1may be performed in accordance with one or more embodiments of the present invention. This computer system is only one example of a suitable processing system and is not intended to suggest any limitation as to the scope of use or functionality of embodiments of the methodology described herein. The processing system shown may be operational with numerous other general-purpose or special-purpose computing system environments or configurations. Examples of well-known computing systems, environments, and/or configurations that may be suitable for use with the processing system shown inFIG. 3may include, but are not limited to, personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, multiprocessor systems, microprocessor-based systems, neural networks, set top boxes, programmable consumer electronics, network PCs, minicomputer systems, mainframe computer systems, and distributed cloud computing environments that include any of the above systems or devices, and the like.

The computer system may also communicate with one or more external devices26such as a keyboard, a pointing device, a display28, etc.; one or more devices that enable a user to interact with the computer system; and/or any devices (e.g., network card, modem, etc.) that enable the computer system to communicate with one or more other computing devices. Such communication can occur via Input/Output (I/O) interfaces20.