Automatic integrity vulnerability detection in an integrated development environment

Patent metadata

Field	Value
Publication number	US-2022012335-A1
Application number	US-202016923169-A
Country	US
Kind code	A1
Filing date	Jul 8, 2020
Priority date	Jul 8, 2020
Publication date	Jan 13, 2022
Grant date	—

Abstract

Aspects of the invention include receiving, by a processor, source code for a software program written in a first programming language. The received source code is converted into abstracted source code that is in a generic format that is different than a format of the first programming language. The abstracted source code is compared to known source code patterns. Based on determining that at least a subset of the abstracted source code matches a pattern in the known source code patterns, sending an alert to the user indicating that the received source code matches the pattern.

First claim

What is claimed is:

1 . A method comprising:
receiving, by a processor, source code for a software program written in a first programming language; converting, by the processor, the received source code into abstracted source code, the abstracted source code in a generic format different than a format of the first programming language; comparing, by the processor, the abstracted source code to known source code patterns; and based on determining that at least a portion of the abstracted source code matches a pattern in the known source code patterns, sending, by the processor, an alert to a user indicating that the received source code matches the pattern.

2 . The method of claim 1 , wherein the receiving, converting, comparing, and sending an alert overlap in time with the user editing the received source code in an integrated development environment (IDE).

3 . The method of claim 2 , wherein the sending an alert comprises requesting a user interface of the IDE to highlight the at least a portion of the received source code that matches the pattern.

4 . The method of claim 3 , where the sending an alert further comprises requesting the user interface of the IDE to output one or both of a degree of confidence associated with the match and a proposed action to eliminate the match.

5 . The method of claim 4 , further comprising:
receiving a request from the user to perform the proposed action; and performing the proposed action based on receiving the request.

6 . The method of claim 1 , wherein the alert comprises at least a portion of the received source code that matches the pattern, and one or both of a degree of confidence associated with the match and a proposed action to eliminate the match.

7 . The method of claim 1 , wherein the abstracted source code comprises JavaScript Object Notation (JSON) objects and the generic format is a JSON format.

8 . The method of claim 1 , wherein the known source code patterns are stored as JSON objects.

9 . The method of claim 1 , wherein the known source code patterns include an over reading pattern that indicates that the software program is reading from a location outside of a specified read location.

10 . The method of claim 1 , wherein the known source code patterns include an over writing pattern that indicates that the software program is writing to a location outside of a specified write location.

11 . The method of claim 1 , further comprising:
receiving second source code written in a second programming language; converting the received second source code into second abstracted source code, the second abstracted source code in the generic format; comparing the second abstracted source code to the known source code patterns; and based on determining that at least a portion of the second abstracted source code matches a pattern in the known source code patterns, sending an alert to the user.

12 . A system comprising:
one or more processors for executing computer readable instructions, the computer readable instructions controlling the one or more processors to perform operations comprising: receiving source code for a software program written in a first programming language; converting the received source code into abstracted source code, the abstracted source code in a generic format different than a format of the first programming language; comparing the abstracted source code to known source code patterns; and based on determining that at least a portion of the abstracted source code matches a pattern in the known source code patterns, sending an alert to a user indicating that the received source code matches the pattern.

13 . The system of claim 12 , wherein the receiving, converting, comparing, and sending an alert overlap in time with the user editing the received source code in an integrated development environment (IDE).

14 . The system of claim 13 , wherein the sending an alert comprises requesting a user interface of the IDE to highlight the at least a portion of the received source code that matches the pattern.

15 . The system of claim 14 , where the sending an alert further comprises requesting the user interface of the IDE to output one or both of a degree of confidence associated with the match and a proposed action to eliminate the match.

16 . The system of claim 15 , wherein the operations further comprise:
receiving a request from the user to perform the proposed action; and performing the proposed action based on receiving the request.

17 . The system of claim 12 , wherein the alert comprises at least a portion of the received source code that matches the pattern, and one or both of a degree of confidence associated with the match and a proposed action to eliminate the match.

18 . The system of claim 12 , wherein the known source code patterns include one or both of an over reading pattern that indicates that the software program is reading from a location outside of a specified read location and an over writing pattern that indicates that the software program is writing to a location outside of a specified write location.

19 . A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by one or more processors to cause the one or more processors to perform operations comprising:
receiving source code for a software program written in a first programming language; converting the received source code into abstracted source code, the abstracted source code in a generic format different than a format of the first programming language; comparing the abstracted source code to known source code patterns; and based on determining that at least a portion of the abstracted source code matches a pattern in the known source code patterns, sending an alert to a user indicating that the received source code matches the pattern.

20 . The computer program product of claim 19 , wherein the receiving, converting, comparing, and sending an alert overlap in time with the user editing the received source code in an integrated development environment (IDE).

Assignees

• IBM

Inventors

• Hicks Andrew C M
• Stamboni Diane Marie
• Conti Thomas William
• Arquero Gregg
• Steen Joshua David
• Kasper Michael Page

Classifications

• G06F21/563 Primary

  by source code analysis · CPC title

• G06F21/554

  involving event detection and direct action · CPC title

• G06F8/20

  Software design · CPC title

• G06F8/40

  Transformation of program code · CPC title

• G06F8/30 Primary

  Creation or generation of source code · CPC title