US 2020/0349259 A1 · Identifying hard-coded secret vulnerability inside application source code

Abstract

A source code analysis tool is augmented to support rule-based analysis of code to attempt to identify certain lexical information indicative of hard-coded secret (e.g., password) support in the code. The tool takes the source code as input, parses the content with a lexical analyzer based on language grammar, and processes the resulting data through preferably a pair of rule-based engines. Preferably, one engine is configured to identify variables explicitly intended to be used as a hard-coded secret, and the other engine is configured to identify data strings that could potentially support such a secret. The outputs of these rules engines are consolidated and evaluated to identify a likelihood that the code under examination includes support for a hard-coded secret. The result is then provided to the developer for further action to address any potential security vulnerability identified by the analysis.

Claims21

Dependent claims

A method to detect and mitigate a hard-coded secret vulnerability in source code, comprising:

applying a lexical analysis to the source code to generate given information;
applying the given information against a rule set, at least a first rule in the rule set being configured to identify a data string that, based on its initial value and a specified function with which it is associated, is indicated for use in the source code as a hard-coded secret, at least a second rule in the rule set being configured to identify a data string that, based on its specified value or characteristic, is indicated for potential use in the source code as a hard-coded secret;
processing results of applying the given information against the respective first and second rules to identify a likelihood and location in the source code of the hard-coded secret vulnerability;
and
outputting an indication of the hard-code secret vulnerability to enable a subsequent action.

2 more elements

Apparatus, comprising:

a processor;
computer memory holding computer program instructions executed by one or more processors to detect and mitigate a hard-coded secret vulnerability in source code, the computer program instructions configured to:
apply a lexical analysis to the source code to generate given information;
apply the given information against a rule set, at least a first rule in the rule set being configured to identify a data string that, based on its initial value and a specified function with which it is associated, is indicated for use in the source code as a hard-coded secret, at least a second rule in the rule set being configured to identify a data string that, based on its specified value or characteristic, is indicated for potential use in the source code as a hard-coded secret;
process results of applying the given information against the respective first and second rules to identify a likelihood and location in the source code of the hard-coded secret vulnerability;
and
output an indication of the hard-code secret vulnerability to enable a subsequent action.

4 more elements

A computer program product in a non-transitory computer readable medium for use a data processing system, the computer program product holding computer program instructions executed by the data processing system to detect and mitigate a hard-coded secret vulnerability in source code, the computer program instructions configured to:

apply a lexical analysis to the source code to generate given information;
apply the given information against a rule set, at least a first rule in the rule set being configured to identify a data string that, based on its initial value and a specified function with which it is associated, is indicated for use in the source code as a hard-coded secret, at least a second rule in the rule set being configured to identify a data string that, based on its specified value or characteristic, is indicated for potential use in the source code as a hard-coded secret;
process results of applying the given information against the respective first and second rules to identify a likelihood and location in the source code of the hard-coded secret vulnerability;
and
output an indication of the hard-code secret vulnerability to enable a subsequent action.

2 more elements

Dependencies are inferred from the claim text.

Identifying hard-coded secret vulnerability inside application source code

Life of this patent

Identifying hard-coded secret vulnerability inside application source code

Life of this patent

Abstract

Claims21