Analyze code that uses web framework using local parameter model

A method for performing software security testing of a web application to identify a security vulnerability of the web application, the method comprising:

• loading, by a security testing system, code of the web application, the web application associated with a framework and using data objects of the framework including a request object of the framework and a response object of the framework;
• determining, by the security testing system, a model for the framework, wherein the model uses local parameters defining explicit control flow for the request object of the framework and the response object of the framework based on a specification of the framework, wherein the request object and the response object comprise global objects of the framework;
• loading, by the security testing system, the code of the web application that uses the framework;
• determining, by the security testing system, data objects including the request object and the response object of the framework used by the code;
• replacing, by the security testing system, in the code of the web application, the request object with the local parameters defining the explicit control flow for the request object and the response object with the local parameters defining the explicit control flow for the response object;
• and
• analyzing, by the security testing system, the code using the model to identify the security vulnerability by analyzing one or more execution paths of the code using the explicit control flow defined in the local parameters.

A computing system comprising:

• a processor;
• and
• a memory coupled with and readable by the processor and storing instructions which, when executed by the processor, cause the processor to perform software security testing of a web application to identify a security vulnerability of the web application by:
• loading code of the web application that uses a framework;
• determining a plurality of data objects of the framework used by the code, the plurality of data objects including a request object and a response object used by the code, wherein the request object and the response object are global objects of the framework;
• replacing the request object with local parameters of a model defining explicit control flow for the request object and the response object with local parameters of the model defining explicit control flow for the response object, wherein the model uses the local parameters with explicit control flow based on a specification of the framework;
• and
• identifying the security vulnerability by analyzing one or more execution paths of the code using the explicit control flow defined in the local parameters of the model.