Static source code scanner

Patent metadata

Field	Value
Publication number	US-11386209-B2
Application number	US-201916657198-A
Country	US
Kind code	B2
Filing date	Oct 18, 2019
Priority date	Oct 18, 2019
Publication date	Jul 12, 2022
Grant date	Jul 12, 2022

Abstract

A computer implemented method for scanning source code files included in an application. A source code scanner identifies an assembly generated from a set of source code files. The assembly comprises assembly code and assembly metadata. The source code scanner identifies a file path for each source code file identified from the assembly. The file path is identified within the assembly metadata. Responsive to identifying the file paths from the assembly metadata, the source code scanner identifies the set of source code files within a code repository. The source code scanner scans the set of source code files to identify potential code vulnerabilities in the set of source code files. The scan omits files in the code repository that were not identified within the assembly metadata.

First claim

What is claimed is:

1. A computer implemented method for scanning source code files included in an application, the method comprising:
compiling a set of source code files to generate an assembly, wherein the assembly further contains assembly code and assembly metadata;
deploying the assembly and a second set of source code files directly to a production environment, wherein the second set of source code files are direct-deploy files that are not compiled;
building the application, by the production environment, from the assembly and the second set of source code files;
subsequent to the building, identify potential code vulnerabilities within the application build that could affect the functionality of the production environment by:
identifying assembly for the application build within the production environment;
identifying a file path for each source code file of a plurality of source code files identified from the assembly metadata of the assembly;
responsive to identifying the file paths from the assembly metadata, identifying the set of source code files within a code repository based on their respective file path identified from the assembly metadata, wherein the code repository comprises the set of source code files that contribute to the assembly output of the compiler and direct-deploy files that are not compiled; and
scanning the set of source code files to identify potential code vulnerabilities in the set of source code files, wherein a functionality of the production environment is improved by omitting others of the second set of source code files that were deployed directly outside of compiling process to provide functionality for the application.

2. The method of claim 1 , further comprising:
wherein compiling the set of source code files to generate the assembly further comprises generating a symbol file that is associated with the assembly,
wherein the symbol file is not deployed into the production environment.

3. The method of claim 2 , wherein the set of source code files is a first set of source code files, the method further comprising:
creating a hash of the second set of source code files; and
creating a hash of the build.

4. The method of claim 1 , further comprising:
generating a file list of the set of source code files based on the file paths identified from the assembly metadata.

5. The method of claim 4 , wherein the step of identifying the set of source code files further comprises:
identifying the identifying the set of source code files based on the file list.

6. The method of claim 4 , further comprising:
performing a valuation of the assembly, wherein the valuation is based on the set of source code files identified from the assembly metadata, and wherein the valuation omits files in the code repository that were not identified within the assembly metadata.

7. The method of claim 4 , further comprising:
performing an audit of the assembly, wherein the audit is based on the set of source code files identified from the assembly metadata, and wherein the audit omits files in the code repository that were not identified within the assembly metadata.

8. A computer system for scanning source code files included in an application, the computer system comprising:
a code scan system comprising a hardware processor and memory to perform the steps of:
compiling a set of source code files to generate an assembly, wherein the assembly further contains assembly code and assembly metadata;
deploying the assembly and a second set of source code files directly to a production environment, wherein the second set of source code files are direct-deploy files that are not compiled;
building the application, by the production environment, from the assembly and the second set of source code files;
subsequent to the building, identify potential code vulnerabilities within the application build that could affect the functionality of the production environment by:
identifying assembly for the application build within the production environment;
identifying a file path for each source code file of a plurality of source code files identified from the assembly metadata of the assembly;
responsive to identifying the file paths from the assembly metadata, identifying the set of source code files within a code repository based on their respective file path identified from the assembly metadata, wherein the code repository comprises the set of source code files that contribute to assembly output of the compiler and direct-deploy files that are not compiled; and
scanning the set of source code files to identify potential code vulnerabilities in the set of source code files, wherein a functionality of the production environment is improved by omitting others of the second set of source code files that were deployed directly outside of compiling process to provide functionality for the application.

9. The computer system of claim 8 , wherein the code scan system further comprises:
wherein the compiling the set of source code files to generate the assembly further comprises generating a symbol file that is associated with the assembly,
wherein the symbol file is not deployed into the production environment.

10. The computer system of claim 9 , wherein the set of source code files is a first set of source code files, wherein the code scan system further comprises steps to:
generate a hash of the second set of source code files; and
generate a hash of the build.

11. The computer system of claim 8 , wherein the code scan system further comprises steps to:
generate a file list of the set of source code files based on the file paths identified from the assembly metadata.

12. The computer system of claim 11 , wherein the step of identifying the set of source code files further comprises:
identifying the identifying the set of source code files based on the file list.

13. The computer system of claim 12 , wherein the code scan system further comprises steps to:
perform a valuation of the assembly, wherein the valuation is based on the set of source code files identified from the assembly metadata, and wherein the valuation omits files in the code repository that were not identified within the assembly metadata.

14. The computer system of claim 12 , wherein the code scan system further comprises steps to:
perform an audit of the assembly, wherein the audit is based on the set of source code files identified from the assembly metadata, and wherein the audit omits files in the code repository that were not identified within the assembly metadata.

15. A computer program product for scanning source code files included in an application, the computer program product comprising:
a computer-readable storage media having program code stored thereon;
program code, stored on the computer-readable storage media, for compiling a set of source code files to generate an assembly, wherein the assembly further contains assembly code and assembly metadata;
program code, stored on the computer-readable storage media, for deploying the assembly and a second set of source code files directly to a production environment, wherein the second set of source code files are direct-deploy files that are not compiled;
program code, stored on the computer-readable storage media, for building the application, by the production environment, from the assembly and the second set of source code files;
program code, stored on the computer-readable storage media, for subsequent to the building, identifying potential code vulnerabilities within the application build that could affect the functionality of

Assignees

• Adp Inc

Inventors

• Roberts Aaron

Classifications

• G06F21/563

  by source code analysis · CPC title

• G06F8/60

  Software deployment · CPC title

• G06F2221/033

  Test or assess software · CPC title

• G06F8/75 Primary

  Structural analysis for program understanding · CPC title

• G06F8/70

  Software maintenance or management · CPC title