Generalized intermediate and lower level source code representations for static application security testing

A computing system comprising:

• a storage device storing:
• lower level representation conversion executable program code that directly converts a generalized intermediate level representation of source code to a generalized lower level representation of the source code, neither the generalized intermediate level representation nor the generalized lower level representation being specific to any programming language, the generalized lower level representation adapted to a dataflow analysis portion of static application security testing (SAST);
• programming language conversion executable program code that converts the source code directly from a programming language of the source code to a programming language-specific intermediate level representation of the source code, the programming language-specific intermediate level representation adapted to a structural analysis portion of the SAST;
• intermediate level representation conversion executable program code that directly converts the programming language-specific intermediate level representation of the source code to the generalized intermediate level representation of the source code;
• a processor;
• and
• a memory storing program code executable by the processor to:
• receive the source code in the programming language;
• execute the programming language conversion executable program code on the source code in the programming language to generate the programming language-specific intermediate level representation of the source code;
• execute the intermediate level representation conversion executable program code on the programming language-specific intermediate level representation of the source code to generate the generalized intermediate level representation of the source code;
• and
• execute the lower level representation conversion executable code on the generalized intermediate level representation of the source code to generate the generalized lower level representation of the source code.

A method comprising:

• receiving, by a processor, source code in a first programming language;
• directly converting, by the processor, the source code from the first programming language to a first programming language-specific intermediate level representation adapted to a structural analysis portion of static application security testing (SAST);
• directly converting, by the processor, the first programming language-specific intermediate level representation to a generalized intermediate level representation of the source code, the generalized intermediate level representation not specific to any programming language;
• directly converting, by the processor, the generalized intermediate level representation of the source code to a generalized lower level representation of the source code adapted to a dataflow portion of the SAST, the generalized lower level representation not specific to any programming language;
• executing, by the processor, generalized dataflow analysis executable code on the generalized lower level representation of the source code using a lattice product of lattices corresponding to dataflow-oriented static analyses specified by a superlattice for the SAST;
• and
• executing, by the processor, generalized structural analysis executable code on the first programming language-specific intermediate level representation of the source code to perform queries corresponding to structure-oriented static analyses specified by the SAST.