String sanitizer modeling

Patent metadata

Field	Value
Publication number	US-12182273-B2
Application number	US-202217665319-A
Country	US
Kind code	B2
Filing date	Feb 4, 2022
Priority date	Feb 4, 2022
Publication date	Dec 31, 2024
Grant date	Dec 31, 2024

Abstract

Code injection is a type of security vulnerability in which an attacker injects client-side scripts modifying the content being delivered. A sanitizer function may provide defense against such attacks by removing certain characters (e.g., characters causing state transitions in HTML). A string sanitizer may be modeled in order to determine its effectiveness by obtaining data flow information indicating string operations that used an input string or information derived therefrom, including a string sanitizer function. A deterministic finite automata representing string values of the output parameter may be generated based on a graph generated from the data flow information, where the automata accepts possible output string values of the sanitizer. It can be determined whether there is a non-empty intersection between the automata for the sanitizer output and an automata representing a security exploit, which would indicate that the sanitizer function is vulnerable to the exploit.

First claim

What is claimed is:

1. A computer system, comprising:
one or more processors;
one or more machine-readable medium coupled to the one or more processors and storing computer program code comprising sets instructions executable by the one or more processors to:
obtain data flow information indicating one or more string operations in source code that used an input string or information derived from the input string as a parameter when executing the source code, the one or more string operations including a string sanitizer function, the string sanitizer function including an input parameter and an output parameter;
generate a graph representing the input parameter and the output parameter of the string sanitizer function;
generate, based on the graph, a deterministic finite automata representing string values of the output parameter, the deterministic finite automata accepting possible output string values of the string sanitizer function;
determine that there is a non-empty intersection between the deterministic finite automata and an exploit automata for a security exploit, the non-empty intersection indicating that the string sanitizer function is vulnerable to a code injection exploit,
wherein the string sanitizer function includes at least one of: a replace-once string operation, the replace-once string operation replacing a first instance of matching string matching a target string but not later instances of the matching string, a first substring string operation that returns a first portion of the input string, a slice string operation that returns a second portion of the input string from a start index to a stop index, or a second substring string operation that returns a third portion of the input string from a first index to a second index.

2. The computer storage system of claim 1 , wherein the deterministic finite automata sets an accept status or a reject status such that it marks the first occurrence of matching strings in the input string.

3. The computer storage system of claim 1 , wherein the computer program code further comprises sets instructions executable by the one or more processors to:
execute the source code using a taint tracking mechanism to obtain the obtain data flow information.

4. The computer storage system of claim 3 , wherein the source code is executed using a web browser.

5. The computer storage system of claim 1 , wherein the source code is in JavaScript format.

6. One or more non-transitory computer-readable medium storing computer program code comprising sets of instructions to:
obtain data flow information indicating one or more string operations in source code that used an input string or information derived from the input string as a parameter when executing the source code, the one or more string operations including a string sanitizer function, the string sanitizer function including an input parameter and an output parameter;
generate a graph representing the input parameter and the output parameter of the string sanitizer function;
generate, based on the graph, a deterministic finite automata representing string values of the output parameter, the deterministic finite automata accepting possible output string values of the string sanitizer function;
determine that there is a non-empty intersection between the deterministic finite automata and an exploit automata for a security exploit, the non-empty intersection indicating that the string sanitizer function is vulnerable to a code injection exploit,
wherein the string sanitizer function includes at least one of: a replace-once string operation, the replace-once string operation replacing a first instance of matching string matching a target string but not later instances of the matching string, a first substring string operation that returns a first portion of the input string, a slice string operation that returns a second portion of the input string from a start index to a stop index, or a second substring string operation that returns a third portion of the input string from a first index to a second index.

7. The non-transitory computer-readable medium of claim 6 , wherein the deterministic finite automata sets an accept status or a reject status such that it marks the first occurrence of matching strings in the input string.

8. The non-transitory computer-readable medium of claim 6 , wherein the computer program code further comprises sets instructions to:
execute the source code using a taint tracking mechanism to obtain the obtain data flow information.

9. The non-transitory computer-readable medium of claim 8 , wherein the source code is executed using a web browser.

10. The non-transitory computer-readable medium of claim 6 , wherein the source code is in JavaScript format.

11. A computer-implemented method, comprising:
obtaining data flow information indicating one or more string operations in source code that used an input string or information derived from the input string as a parameter when executing the source code, the one or more string operations including a string sanitizer function, the string sanitizer function including an input parameter and an output parameter;
generating a graph representing the input parameter and the output parameter of the string sanitizer function;
generating a deterministic finite automata for the string sanitizer function based on the graph, the deterministic finite automata accepting possible output string values of the string sanitizer function;
determining that there is a non-empty intersection between the deterministic finite automata and an exploit automata for a security exploit, the non-empty intersection indicating that the string sanitizer function is vulnerable to a code injection exploit,
wherein the deterministic finite automata sets an accept status or a reject status such that it marks the first occurrence of matching strings in the input string.

12. The computer-implemented method of claim 11 , wherein the string sanitizer function includes a replace-once string operation, the replace-once string operation replacing a first instance of matching string matching a target string but not later instances of the matching string.

13. The computer-implemented method of claim 11 , further comprising:
executing the source code using a taint tracking mechanism to obtain the obtain data flow information.

14. The computer-implemented method of claim 11 , wherein the source code is in JavaScript format.

Assignees

• Sap Se

Inventors

• Barber Thomas
• Klein David
• Johns Martin

Classifications

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F21/563

  by source code analysis · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title