Simulation of Built-in PHP Features for Precise Static Code Analysis

摘要: The World Wide Web grew rapidly during the last decades and is used by millions of people every day for online shopping, banking, networking, other activities. Many these websites are developed with PHP, most popular scripting language on Web. However, PHP code prone to different types critical security vulnerabilities that can lead data leakage, server compromise, or attacks against an application's users. This problem be addressed analyzing source application before deployed a web server. In this paper, we present novel approach precise static analysis detect in applications. As dismissed previous work area, comprehensive configuration simulation over 900 built-in features allows us precisely model highly dynamic language. By performing intra- inter-procedural flow creating block function summaries, able efficiently perform backward-directed taint 20 vulnerabilities. Furthermore, string enables validate sanitization context-sensitive manner. Our method first fine-grained interaction between sanitization, encoding, sources, sinks, markup contexts, settings. We implemented prototype our tool called RIPS. evaluation shows RIPS capable finding severe real-world applications: reported 73 previously unknown five well-known applications such as phpBB, osCommerce, conference management software HotCRP.