Detecting second-order security vulnerabilities via modelling information flow through persistent storage

A system, comprising:

• a memory coupled to a computer processor;
• a repository configured to store a table and code comprising a first source statement and a first sink statement;
• and
• a code analyzer, executing on the computer processor and using the memory, configured to:
• determine that a first source variable in the code receives a first source value from a first source function specified by a target analysis,
• determine that the first source statement writes, using the first source variable, the first source value to a column in a table,
• obtain, for the first sink statement, a first set of influenced variables influenced by the first source variable, wherein the first set of influenced variables is further influenced by a set of source variables comprising the first source variable,
• obtain, for a second sink statement in the code, a second set of influenced variables influenced by the first set of influenced variables,
• add, to a trace graph, a plurality of nodes comprising:
• a plurality of source nodes corresponding to the set of source variables,
• a first plurality of influenced variable nodes corresponding to the first set of influenced variables, and
• a second plurality of influenced variable nodes corresponding to the second set of influenced variables,
• determine that the first sink statement reads the first source value into a first sink variable comprising an identifier of the column,
• generate a modified first set of influenced variables by adding the first sink variable to the first set of influenced variables, and
• report (i) a first defect at the first sink statement, and (ii) a defect trace using the trace graph.

A non-transitory computer readable medium comprising instructions that, when executed by a computer processor, perform:

• determining that a first source variable in code receives a first source value from a first source function specified by a target analysis;
• determining that a first source statement in the code writes, using the first source variable, the first source value to a column in a table;
• obtaining, for a first sink statement in the code, a first set of influenced variables influenced by the first source variable, wherein the first set of influenced variables is further influenced by a set of source variables comprising the first source variable;
• obtaining, for a second sink statement in the code, a second set of influenced variables influenced by the first set of influenced variables;
• adding, to a trace graph, a plurality of nodes comprising:
• a plurality of source nodes corresponding to the set of source variables,
• a first plurality of influenced variable nodes corresponding to the first set of influenced variables, and
• a second plurality of influenced variable nodes corresponding to the second set of influenced variables;
• determining that the first sink statement reads the first source value into a first sink variable comprising an identifier of the column;
• generating a modified first set of influenced variables by adding the first sink variable to the first set of influenced variables;
• and
• reporting (i) a first defect at the first sink statement, and (ii) a defect trace using the trace graph.