面向Java EE程序的SQLIA漏洞分析和验证方法

doi:10.3778/j.issn.1673-9418.2004027

摘要/Abstract

摘要：

SQLIA漏洞破坏Web后台数据库的完整性，一直是Web应用安全的主要威胁。提出一种检测和验证Java Web程序的SQLIA漏洞的解决方案，将静态分析与动态验证相结合，并且形式化定义指令级污点传播操作语义，能够有效跟踪跨文件和跨页面的污点传播。静态分析首先对Source进行预处理和分类得到真实可靠的Source集合，然后应用方法、请求、会话、方法调用等多重关系匹配潜在的Source和Sink对，使得分析过程可以过滤无关Source和Sink，最后结合静态污点分析和活跃变量分析排除不可能存在污点传播路径的Source和Sink。动态验证首先对程序插桩，然后在执行程序的同时进行动态污点传播并生成Trace，基于Trace验证静态分析结果的正确性，获得真实污点传播路径的漏洞集合。原型系统基于Soot框架实现，对若干开源程序的实验结果表明了方法的有效性。

关键词: SQL注入, 污点传播语义, 静态分析, 活跃变量分析, 插桩, 动态验证

Abstract:

SQLIA vulnerabilities undermine the integrity of the Web background database, and have always been a major threat to Web application security. This paper proposes a solution to detect and verify SQLIA vulnerabilities in Java Web programs. It combines static analysis and dynamic verification, and formalizes the definition of instruction- level taint propagation semantics, which can effectively track the spread of taint information across files and pages. Static analysis first handles and classifies Sources to obtain a true and reliable Source collection, and then applies the multiple-fold relationship of methods, requests, sessions, method calls, etc. to match the potential Source and Sink pair, so that the analysis process can filter the unrelated Sources and Sinks. Finally, this paper combines static taint analysis and live variables analysis to eliminate Sources and Sinks where there is no taint propagation paths. Dynamic verification first instruments the program, then performs dynamic taint propagation and produces a trace while executing it. After that, it verifies the correctness of the results of static analysis by analyzing the trace, and obtains real bugs with taint propagation paths. A prototype system is implemented on top of Soot, and experimental results of several open source programs show the effectiveness of the approach.

Key words: structured query language (SQL) injection, taint propagation semantics, static analysis, live variable analysis, instrumentation, dynamic verification

郭帆, 范威威. 面向Java EE程序的SQLIA漏洞分析和验证方法[J]. 计算机科学与探索, 2021, 15(2): 270-283.

GUO Fan, FAN Weiwei. Analysis and Verification on SQLIA Vulnerability for Java EE Programs[J]. Journal of Frontiers of Computer Science and Technology, 2021, 15(2): 270-283.

参考文献

[1] OWASP. Top ten project[EB/OL]. [2020-02-11]. http://www.owasp.org/.
[2] VON MALTITZ M, DIEKMANN C, GEORG C. Privacy assessment using static taint analysis[C]//LNCS 10321: Pro-ceedings of the 37th IFIP WG 6.1 International Conference on Formal Techniques for Distributed Objects, Components, and Systems, Neuchatel, Jun 19-22, 2017. Berlin, Heidelberg: Springer, 2017: 225-235.
[3] HUANG Q, ZENG Q K. Analysis and dynamic verification of stain propagation based on information flow strategy[J]. Journal of Software, 2011, 22(9): 2036-2048.
黄强, 曾庆凯. 基于信息流策略的污点传播分析及动态验证[J]. 软件学报, 2011, 22(9): 2036-2048.
[4] MEDEIROS I, NEVES N, CORREIA M. Detecting and re-moving Web application vulnerabilities with static analysis and data mining[J]. IEEE Transactions on Reliability, 2015, 65(1): 1-16.
[5] DAHSE J, HOLZ T. Static detection of second-order vuln-erabilities in Web applications[C]//Proceedings of the 23rd USENIX Security Symposium, San Diego, Aug 20-22, 2014. Berkeley: USENIX Association, 2014: 989-1003.
[6] HAUZAR D, KOFRON J. Framework for static analysis of PHP applications[C]//Proceedings of the 29th European Conference on Object-Oriented Programming,?Jul 5-10, 2015. Dagstuhl: Zentrum für Informatik, 2015: 689-711.
[7] STIéVENART Q, VANDERCAMMEN M, MEUTER W D, et al. Scala-AM: a modular static analysis framework[C]// Proceedings of the 16th IEEE International Working Con-ference on Source Code Analysis and Manipulation, Raleigh, Oct 2-3, 2016. Washington: IEEE Computer Society, 2016: 85-90.
[8] WANG L, HE D J, LI L, et al. Optimization technology of static stain analysis based on sparse framework[J]. Journal of Computer Research and Development, 2019, 56(3): 30-45.
王蕾, 何冬杰, 李炼, 等. 基于稀疏框架的静态污点分析优化技术[J]. 计算机研究与发展, 2019, 56(3): 30-45.
[9] MA J X, LI Z J, ZHANG T, et al. Research on stain analy-sis method based on offline index of execution trace[J]. Jour-nal of Software, 2017, 28(9): 2388-2401.
马金鑫, 李舟军, 张涛, 等. 基于执行踪迹离线索引的污点分析方法研究[J]. 软件学报, 2017, 28(9): 2388-2401.
[10] TRIPP O, PISTOIA M, COUSOT P, et al. Andromeda: accu-rate and scalable security analysis of Web applications[C]//LNCS 7793: Proceedings of the 16th International Confer-ence on Fundamental Approaches to Software Engineering, Rome, Mar 16-24, 2013. Berlin, Heidelberg: Springer, 2013: 210-225.
[11] AMIR-MOHAMMADIAN S, SKALKA C. Indepth enforce-ment of dynamic integrity taint analysis[C]//Proceedings of the 2016 ACM Workshop on Programming Languages and Analysis for Security, Vienna, Oct 24, 2016. New York: ACM, 2016: 43-56.
[12] CAI J, ZOU P, MA J, et al. SwordDTA: a dynamic taint analysis tool for software vulnerability detection[J]. Wuhan University Journal of Natural Sciences, 2016, 21(1): 10-20.
[13] KARIM R, TIP F, SOCHURKOVA A, et al. Platform-inde-pendent dynamic taint analysis for JavaScript[J]. IEEE Tran-sactions on Software Engineering, 2020, 46(12): 1364-1379.
[14] BALZAROTTI D, COVA M, FELMETSGER V, et al. Multi-module vulnerability analysis of Web-based applications[C]// Proceedings of the 2007 ACM Conference on Computer and Communications Security, Alexandria, Oct 28-31, 2007. New York: ACM, 2007: 25-35.
[15] LI Y, HUANG Z Q, FANG B W, et al. Using cost-sensitive classification for software defects prediction[J]. Journal of Frontiers of Computer Science and Technology, 2014, 8(12): 1442-1451.
李勇, 黄志球, 房丙午, 等. 代价敏感分类的软件缺陷预测方法[J]. 计算机科学与探索, 2014, 8(12): 1442-1451.