Eliminating False Reports of Security Vulnerabilities when Testing Computer Software

A method for eliminating false reports of security vulnerabilities when testing computer software, the method comprising:

• a) identifying a tainted variable v in a computer application;
• b) identifying a variable x within said application that holds data derived from v, wherein x is in a different format than v;
• c) identifying an AddData operation within said application that is performed on x;
• d) identifying a Sign operation within said application that is performed on the results of said AddData operation on x;
• e) identifying an operation within said application that compares the results of said Sign operation with another value;
• and
• f) reporting said tainted variable v as a security vulnerability if not all of the following conditions 1)-4) are true
• 1) x is identified within said application that holds the content of v in a different format than v,
• 2) at least one AddData operation is identified within said application that is performed on x,
• 3) at least one Sign operation is identified within said application that is performed on the results of said AddData operation on x, and
• 4) at least one operation is identified within said application that compares the results of said Sign operation with another value,
• wherein said steps a)-f) are implemented in either of computer hardware and computer software and embodied in a tangible computer-readable medium.

A computer program product for eliminating false reports of security vulnerabilities when testing computer software, the computer program product comprising:

• a computer readable medium;
• computer program instructions operative to
• a) identify a tainted variable v in a computer application;
• b) identify a variable x within said application that holds data derived from v, wherein x is in a different format than v;
• c) identify an AddData operation within said application that is performed on x;
• d) identify a Sign operation within said application that is performed on the results of said AddData operation on x;
• e) identify an operation within said application that compares the results of said Sign operation with another value;
• and
• f) report said tainted variable v as a security vulnerability if not all of the following conditions 1)-4) are true
• 1) x is identified within said application that holds the content of v in a different format than v,
• 2) at least one AddData operation is identified within said application that is performed on x,
• 3) at least one Sign operation is identified within said application that is performed on the results of said AddData operation on x, and
• 4) at least one operation is identified within said application that compares the results of said Sign operation with another value,
• wherein said program instructions are stored on said computer readable medium.