Dynamic taint tracking in abstract syntax tree interpreters

A system comprising:

• a computer processor;
• a repository configured to store source code and an abstract syntax tree generated from the source code;
• and
• a taint propagation instrumenter, executing on the computer processor and configured to:
• determine that a first value of a first non-constant variable corresponding to a first variable node of the abstract syntax tree flows into a first operator node in the abstract syntax tree,
• add, to the abstract syntax tree, a first check taint node comprising functionality to:
• make a first taint status determination that the first non-constant value is tainted, and
• return the first non-constant value to the first operator node, wherein the first operator node generates a first result value by executing a first operator using the first non-constant value,
• add, to the abstract syntax tree, a first set taint node that based on the first taint status determination, the first result value in a first tainted object, and
• perform, using the abstract syntax tree, a taint analysis of the source code to identify a vulnerability in the source code.

A method for performing a taint analysis of source code, comprising:

• generating an abstract syntax tree for the source code;
• sending the abstract syntax tree to a taint propagation instrumenter configured to generate an instrumented abstract syntax tree by:
• determining that a first non-constant value of a first variable corresponding to a first variable node of the abstract syntax tree flows into a first operator node in the abstract syntax tree,
• adding, to the abstract syntax tree, a first check taint node comprising functionality to:
• make a first taint status determination that the first non-constant value is tainted, and
• return the first non-constant value to the first operator node, wherein the first operator node generates a first result value by executing a first operator using the first non-constant value, and
• adding, to the abstract syntax tree, a first set taint node that stores, based on the first taint status determination, the first result value in a first tainted object;
• and
• receiving, from the taint propagation instrumenter, the instrumented abstract syntax tree,
• wherein the taint analysis is performed using the instrumented abstract syntax tree to identify a vulnerability in the source code.