Hierarchical runtime analysis framework for defining vulnerabilities

A system for detecting vulnerabilities in a software application operating in a database system, comprising:

• a processor;
• and
• memory storing one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of:
• receiving a hierarchical list of input tags defining a hierarchy of requests received, wherein the hierarchical list of input tags includes a parent hypertext transfer protocol (HTTP) input tag and child sibling page, header, and universal resource locator (URL) input tags;
• receiving a hierarchical list of output tags defining a hierarchy of outputs, wherein the hierarchical list of output tags includes a parent hypertext transfer protocol (HTTP) output tag and child sibling page, header, and universal resource locator (URL) output tags;
• receiving defined vulnerabilities each including an associated input tag and an associated output tag;
• receiving a request by the software application in the database system from a user system;
• assigning an input tag from the hierarchical list of input tags to an object returned by the software application based on the request, the input tag identifying the request as potentially malicious and carrying a security risk and identifying a type of data within object and a particular type of user input, including a URL input;
• assigning an output tag from the hierarchical list of output tags to an output method in the software application generating a response to the request;
• identifying one of the defined vulnerabilities as a candidate vulnerability when the assigned output tag and output tag associated the defined vulnerability are within a same subtree in the hierarchical list of output tags;
• and
• identifying the candidate vulnerability as a potential vulnerability when the assigned input tag and the input tag associated with the candidate vulnerability are within a same subtree in the hierarchical list of input tags.

A method for detecting a vulnerability in a software application in a database system, comprising:

• storing a hierarchical input tree that identifies hierarchical relationships for different input events;
• storing a hierarchical output tree that identifies hierarchical relationships for different output events;
• receive a defined vulnerability that includes an output event, an input event, and a sanitization event;
• receiving by the software application in the database system a request from a user system;
• executing an input rule in the software application that identifies an input event for an object associated with the request;
• executing a sanitization rule in the software application that identifies a sanitization event for a security operation performed on the object;
• executing an output rule in the software application that identifies an output event for a method generating a response to the request;
• and
• executing a vulnerability rule in the software application that identifies a vulnerability in a part of the software application based on a hierarchical relationship between the identified output event and the defined vulnerability output event, a hierarchical relationship between the identified input event and the defined vulnerability input event, and a relationship between the identified sanitization event and the defined vulnerability sanitization event.