Abstract:

The injection vulnerabilities of Web applications such as SQL injections and Cross Site Scripting (XSS) are mainly caused by external inputs which are not verified, while taint analysis can effectively locate these vulnerabilities. A dynamic analysis approach was presented by tracking all potentially tainted Java objects, which is different from existing approaches that only track characters or string objects. The approach used the hash code to represent the tainted object, defined the method node and method coordinates to record the location of the taint propagation, supported tracing the taint propagation path. The approach put forward a specific taint propagation analysis for stream-family objects according to the decorative pattern of Java stream objects. A language specification was also given to model Java libraries and user-defined methods related to taint propagation. The approach designed and formalized the taint propagation semantics of the methods according to the classification by taint introduction, taint propagation, taint sanitization and taint usage. The prototype system which implemented on SOOT used static analysis to collect reachable methods and instruments Java byte-code of the real Web sites, and the experimental results demonstrated the effect on detecting injection vulnerabilities.

Key words: dynamic taint analysis, taint propagation, instrument, SOOT, vulnerability analysis

摘要：

Web程序的安全威胁主要是由外部输入未验证引发的安全漏洞,如数据库注入漏洞和跨站脚本漏洞,动态污点分析可有效定位此类漏洞。提出一种基于对象跟踪的动态分析方法,与现有动态方法跟踪字符和字符串对象不同,追踪所有可能被污染的Java对象。方法应用对象哈希值表示污点对象,定义方法节点和方法坐标记录污点传播时的程序位置,支持污点传播路径追踪,针对Java流对象装饰模式提出流家族污点传播分析。方法设计一种语言规范对Java类库中污点传播相关的方法集合以及用户自定义方法建模,按照污点引入、传播、验证和使用,对方法集分类后设计和形式化定义各类方法的污点传播语义。在SOOT平台实现对J2EE源码或字节码插桩框架,使用静态分析计算可达方法集以减少插桩规模,应用原型系统对真实网站的测试结果表明该方法可有效发现注入漏洞。

关键词: 动态污点分析, 污点传播, 插桩, SOOT, 漏洞分析