Back to results
US 10,379,993 B2Granted
Techniques for traversing representations of source code
AssigneeWhiteHat Security, Inc.
InventorEric Sheridan
Life of this patent
Estimating the term…
Abstract
Methods, apparatus, and systems for traversing a representation of an application source code, such as an abstract syntax tree (AST), are disclosed. Steps for traversing the AST include specifying a plurality of runtime binding rules which are associated with one or more locations within the AST, beginning to traverse the AST, monitoring a history of the traverse, continuing to traverse the AST based on the history of the traverse, and updating the history of the traverse. Continuing to traverse the AST may include identifying a plurality of concrete implementations of a method invocation and traversing less than all of the concrete implementations based at least in part on the runtime binding rules, the concrete implementations being traversed being selected based on the history of the traverse.
Claims16
A method of traversing a representation of an application source code, the method comprising:
- identifying, using at least one processor, a plurality of concrete implementations of a method invocation of the representation of the application source code;
- selecting, based at least in part on a history of a traverse of the representation of the application source code, a set of concrete implementations from the plurality of concrete implementations of the method invocation, wherein each concrete implementation of the set of concrete implementations is associated with a location within the representation of the application source code;
- traversing, one or more concrete implementations of the set of concrete implementations, where a concrete implementation of the one or more concrete implementations is visited before the method invocation when an associated location of the concrete implementation is before the method innovation and the concrete implementation is visited after the method invocation when the associated location is after the method innovation;
- storing metadata, wherein the metadata comprises one or more class names associated with the one or more traversed concrete implementations;
- identifying whether any of the one or more class names are an instances of at least one class which the concrete implementations are a part of;
- searching the one or more identified classes for the concrete implementations of the method invocation;
- traversing the one or more identified classes where the concrete implementation of the method invocation is found;
- updating the history of the traverse;
- and
- providing a set of identified vulnerabilities, the set of identified vulnerabilities based at least in part on the updated history of the traverse.
7 more elements
A system, comprising:
- at least one storage device storing a representation of an application source code;
- at least one processor;
- and
- at least one memory storing instructions, which when executed by the at least one processor, cause the at least one processor to:
- identify a plurality of concrete implementations of a method invocation of the representation of the application source code;
- select, based at least in part on a history of a traverse of the representation of the application source code, a set of concrete implementations from the plurality of concrete implementations of the method invocation, wherein each concrete implementation of the set of concrete implementations is associated with a location within the representation of the application source code;
- traverse, one or more concrete implementations of the set of concrete implementations, where a concrete implementation of the one or more concrete implementations is visited before the method invocation when an associated location of the concrete implementation is before the method innovation and the concrete implementation is visited after the method invocation when the associated location is after the method innovation;
- store metadata, wherein the metadata comprises one or more class names associated with the one or more traversed concrete implementations;
- identify whether any of the one or more class names are an instances of at least one class which the concrete implementations are a part of;
- search the one or more identified classes for the concrete implementations of the method invocation;
- traverse the one or more identified classes where the concrete implementation of the method invocation is found;
- update the history of the traverse;
- and
- provide a set of identified vulnerabilities, the set of identified vulnerabilities based at least in part on the updated history of the traverse.
11 more elements
A non-transitory computer readable storage medium having instructions stored thereon that, when executed by at least one processor, causes the at least on processor to:
- identify a plurality of concrete implementations of a method invocation of a representation of an application source code;
- select, based at least in part on a history of a traverse of the representation of the application source code, a set of concrete implementations from the plurality of concrete implementations of the method invocation, wherein each concrete implementation of the set of concrete implementations is associated with a location within the representation of the application source code;
- traverse, one or more concrete implementations of the set of concrete implementations, where a concrete implementation of the one or more concrete implementations is visited before the method invocation when an associated location of the concrete implementation is before the method innovation and the concrete implementation is visited after the method invocation when the associated location is after the method innovation;
- store metadata, wherein the metadata comprises one or more class names associated with the one or more traversed concrete implementations;
- identify whether any of the one or more class names are an instances of at least one class which the concrete implementations are a part of;
- search the one or more identified classes for the concrete implementations of the method invocation;
- traverse the one or more identified classes where the concrete implementation of the method invocation is found;
- update the history of the traverse;
- and
- provide a set of identified vulnerabilities, the set of identified vulnerabilities based at least in part on the updated history of the traverse.
7 more elements
Dependencies are inferred from the claim text.