# VulPathsFinder: A Static Method for Finding Vulnerable Paths in PHP Applications Based on CPG
## 3 Background and Motivation
### Running Example
On the other hand, the encapsulation feature of object-oriented programming obscures data dependencies, making it difficult for us to discover defects by retracing the data flow. **Performance. ** In many contemporary applications, numerous features necessitate a series of interdependent steps, typically completed using distinct modules. If a security-sensitive function resides deep within these modules, the crossing of intermediate data flow nodes can generate many data flow paths. Additionally, to accurately identify the data flow path from user input to a security-sensitive function/method, it is essential to recognize the name of the security-sensitive method and analyze the instantiation of the variable calling it. Directly integrating these tasks into the vulnerability path discovery algorithm would inevitably amplify its complexity and diminish its efficiency. **Scalability. ** Besides utilizing security-sensitive functions, modern applications also encapsulate security-sensitive methods, as exemplified by the _$sSQL.WHERE_and($4foo, $sSQL.WHERE_and($5!~fobbar'), or even $sSQL.WHERE_and($6(\")=barfoo(). You do not have to worry about identifying all the different syntaxes from the token stream. In addition to the parser itself, this package also bundles support for several other related functionalities:

* Pretty-printing support, which is the action of transforming the AST into PHP code;
* Support for serializing and deserializing node trees to JSON;
* Support for dumping node trees in a human-readable form;
* Basic infrastructure for traversing and modifying the AST (node traversers and node visitors);
* Node visitors for parsing namespace names. ### PHPtoTAC

In addition to introducing a new PHP parser, we have modified the intermediate model's construction to accommodate object-oriented features and alias analysis. As we have introduced a new PHP parser to construct the Abstract Syntax Tree (AST), we leverage the node traversal functionality of PHP-Parser based on this AST to inspect each node. This module [39] tracks various types of expressions (assignments, function calls, method calls, actual parameters, formal parameters, etc.) and monitors function definitions, class definitions, object references, method definitions, variables, namespaces, and interfaces. PHP-Parser transforms these expressions and statement nodes into a three-address code format through traversal tracking, which allows us to perform alias analysis and variable data tracking on the transformed code. Consequently, we can perform inter-procedural data flow analysis when conducting taint analysis. ### Code Property Graph

After transforming the PHP source code into a three-address code format based on PHP-Parser, we use it as the source code input for Joern-PHP to construct the Code Property Graph (CPG). First, we parse the transformed three-address code into an AST, and then each file in the AST is traversed to construct the control flow graph. This control flow graph is then traversed to analyze alias to obtain variable alias information. Based on comments and instance creation statements, we infer instance types of variables, parse method call points, and create method call edges to improve the call graph. On top of Joern-PHP, we add alias analysis and variable instance type inference to create method call edges. The pseudocode of this process is shown in Algorithms 1 and 2:

Algorithms 1 and 2 show the process of type inference and call graph construction that we added based on Joern-PHP. In Algorithm 1, the process of traversing is called the Abstract Syntax Tree (AST) (line 4). Lines 5-22 in Algorithm 1 show the process of traversing the control flow graph to perform context-sensitive alias analysis. This procedure traverses the control flow graph and parses the statement's assignment, store, and load operations. By this parsing procedure, on the one hand, we can infer the directional information of the variables, which is the type information. On the other hand, we can construct access paths for variables.