首页>
外国专利>
Automatic Inference Of Whitelist-Based Validation As Part Of Static Analysis For Security
Automatic Inference Of Whitelist-Based Validation As Part Of Static Analysis For Security
展开▼
机译:基于白名单的验证的自动推断是安全性静态分析的一部分
展开▼
页面导航
摘要
著录项
相似文献
摘要
A method includes performing taint analysis of a computer program and determining an original set of paths from sources to sinks. Each path corresponds to a vulnerability. The method includes determining for each variable whose type is a collection and is accessed in one of the paths in the original set of paths whether the variable points to a concrete value whose internal state is not tainted according to the taint analysis. The method further includes, for each of the variables whose type is a collection found not to be tainted according to the taint analysis, determining all points in the computer program where a membership check against the collection is performed. The method also includes, for each of the points, determining corresponding paths and removing those paths from the original set of paths to create a reduced set of paths. Apparatus and computer readable program products are also disclosed.
展开▼