访问路径的IFDS污点分析
IFDS Taint Analysis with Access Paths
摘要：
多年来，静态污点分析成为检测一些最常见的Web应用程序漏洞的首选分析，例如SQL注入（SQLi）和跨站脚本（XSS）~ \cite{OWASP}。此外，从实现的角度来看，IFDS Jumlow框架是为真实世界的Java应用程序实现静态污点分析的最成功的工具之一。虽然现有的方法可以合理地扩展到中等规模的应用程序（例如，对于少于10万行的代码，分析时间长达一小时），但我们的经验表明，没有现有的解决方案可以扩展到非常大的工业代码库（例如，超过100万行的代码）。在本文中，我们提出了我们的新的IFDS为基础的解决方案，执行快速和精确的静态污点分析非常大的工业Java Web应用程序。与最先进的污点分析方法类似，我们的基于IFDS的污点分析使用\textit{access paths}来抽象程序中的对象和字段。然而，与现有方法相反，我们的分析是需求驱动的，这限制了要分析的代码量，并且不依赖于计算上昂贵的别名分析，从而显着提高了可扩展性。
英文摘要：
Over the years, static taint analysis emerged as the analysis of choice to detect some of the most common web application vulnerabilities, such as SQL injection (SQLi) and cross-site scripting (XSS)~\cite{OWASP}. Furthermore, from an implementation perspective, the IFDS dataflow framework stood out as one of the most successful vehicles to implement static taint analysis for real-world Java applications. While existing approaches scale reasonably to medium-size applications (e.g. up to one hour analysis time for less than 100K lines of code), our experience suggests that no existing solution can scale to very large industrial code bases (e.g. more than 1M lines of code). In this paper, we present our novel IFDS-based solution to perform fast and precise static taint analysis of very large industrial Java web applications. Similar to state-of-the-art approaches to taint analysis, our IFDS-based taint analysis uses \textit{access paths} to abstract objects and fields in a program. However, contrary to existing approaches, our analysis is demand-driven, which restricts the amount of code to be analyzed, and does not rely on a computationally expensive alias analysis, thereby significantly improving scalability.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
