KR101479516B1 - Source code security weakness detection apparatus and method - Google Patents

Abstract

A source code security weakness detection apparatus and method are disclosed. Embodiments of the present invention can accurately detect security weaknesses present in the source code of a program and provide the results to the program developer so that a program developer can easily correct security weaknesses in the source code.

Description

FIELD OF THE INVENTION [0001] The present invention relates to a source code security weakness detection apparatus and method,

Embodiments of the present invention are directed to a technique for detecting a vulnerable portion inherent in a source code of a program and providing a detection result to the user.

[0002] Recently, various kinds of programs that can be used in these devices are emerging as a variety of devices including a microprocessor such as a desktop PC, a smart phone, and a tablet PC are popularized.

In addition, since various programming languages for program production have recently appeared, the choice of program developers has been increased, and the quality of the program has been increasing not only in quantity but also in quantity.

Normally, programs are made of source code which is a text file in which a computer program is recorded, and program developers can develop a program by expressing a predetermined program operation algorithm in source code according to a programming language selected by the user .

In general, program developers are developing a program to check whether there is an error in their source code, correct errors in the source code, and correct errors in the source code. We try to develop high-quality programs.

However, in recent years, security issues such as information disclosure have been strengthened. Therefore, when developing a program, program developers do not merely check whether the source code is erroneous, There is an increasing need to identify whether or not there is.

For example, when a specific instruction used in the source code of a program refers to predetermined data as a variable, the specific instruction refers to external data, which is input from an external system other than the system on which the program is driven, as a variable, If the specific instruction is written in the source code so as to refer to external data in spite of the fact that the main information in the system can be easily exposed according to the execution of the specific instruction, The user of the program can be seriously damaged.

Therefore, it is necessary to study a technique for supporting the program developer to remove the security weakness in the source code by accurately detecting the security weakness in the source code of the program and providing the result to the program developer .

Embodiments of the present invention allow a program developer to easily correct security weaknesses present in the source code by accurately detecting security weaknesses present in the source code of the program and providing the results to the program developer I want to support.

A source code security weakness detection device according to an embodiment of the present invention may include attribute information for reference data previously designated as a security weakness for each of a plurality of instructions available in the program source code based on the first programming language A weak weak point database in which at least one instruction contained in the source code of the first program is inputted, and a weak weak point detection instruction for the first program prepared based on the first programming language, A security weak point database, and a security weak point database, the security weak point database including at least one item of reference data having reference attribute data designated in advance as the security weak point, 1 < / RTI > Extracting positional information of a line on which the at least one first instruction is written from the source code of the graphic and displaying positional information of the line on which the at least one first instruction is recorded as a result of weakness detection And a security weakness display unit.

Also, the method for detecting a source code security weakness according to an embodiment of the present invention is characterized in that, for each of a plurality of commands available in the program source code based on the first programming language, attribute information for reference data previously designated as a security weak point is stored The method comprising the steps of: maintaining a security vulnerability database in which the first vulnerability is detected, when the security weakness detection command for the first program based on the first programming language is input, Identifying at least one of the at least one of the at least one instruction as the variable with reference to the reference data having the attribute information pre-specified as the weak point, with reference to the security weakness database, A step of extracting a command and a step of extracting Extracting position information on a line on which the at least one first command is recorded from the scan code and displaying position information on the line on which the at least one first command is recorded as a result of detecting the weakness .

Embodiments of the present invention allow a program developer to easily correct security weaknesses present in the source code by accurately detecting security weaknesses present in the source code of the program and providing the results to the program developer .

In the embodiments of the present invention, when a developer designates that a certain portion of the source code is not detected as a security weakness, when the security weakness detection process is re-executed in the future, the portion designated by the developer is no longer detected as a security weakness Thereby enabling the developer to easily grasp and correct security weaknesses present in the source code when performing a repeated security weakness verification process and at the same time reduce the possibility of false positives that may occur during the security weakness detection process .

1 is a diagram illustrating a structure of a source code security weakness detection apparatus according to an embodiment of the present invention.
2 is a flowchart illustrating a source code security weakness detection method according to an embodiment of the present invention.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention. Like reference numerals are used for like elements in describing each drawing.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, . On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between.

The terminology used in this application is used only to describe a specific embodiment and is not intended to limit the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In the present application, the terms "comprises" or "having" and the like are used to specify that there is a feature, a number, a step, an operation, an element, a component or a combination thereof described in the specification, But do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the contextual meaning of the related art and are to be interpreted as either ideal or overly formal in the sense of the present application Do not.

Hereinafter, embodiments according to the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram illustrating a structure of a source code security weakness detection apparatus according to an embodiment of the present invention.

1, a source code security weakness detection device 110 according to an exemplary embodiment of the present invention includes a security weakness database 111, an attribute information verification unit 112, a command extraction unit 113, (114).

The security weakness database 111 stores attribute information on reference data previously designated as a security weakness for each of a plurality of instructions available in the program source code based on the first programming language.

For example, assuming that the first programming language is a programming language called Java, the security weakness database 111 may be used in a program source code based on a Java-based programming language as shown in Table 1 below. For each of a plurality of instructions that can be referenced, if the instructions refer to the reference data as variables, the attribute information about the reference data determined to be applicable as a weak point in security may be specified in advance by the developer.

A plurality of instructions Property information of reference data specified as security weakness new File () External Data Properties
null property
... new ServerSocket () External Data Properties Command 1 Attribute 1
Attribute 2
... Command 2 External Data Properties ... ...

When the security weak point detection command for the first program produced on the basis of the first programming language is input, the attribute information confirmation unit 112 determines whether the at least one command included in the source code of the first program is a variable The attribute information of the reference data to be referred to is confirmed.

The command extracting unit 113 extracts at least one first instruction referring to the reference data having the attribute information previously designated as the weak point among the at least one instruction as a variable with reference to the weak point database 111. [

The security weak point display unit 114 extracts location information on a line on which the at least one first command is recorded from the source code of the first program and outputs the extracted location information to the line on which the at least one first command is recorded As a security weakness detection result.

Hereinafter, the operation of the source code security weakness detection device 110 according to an embodiment of the present invention will be described in detail, for example.

First, information is stored in the security vulnerability database 111 as shown in Table 1, and a program developer uses a 'Java' -based programming language to write a first program composed of the program source code shown in Table 2 below .

String name = request.getProperty ("filename");
if (name! = null)
{
File file = new File ("/ usr / local / download /" + name);
if (file! = null)
}

In connection with the source code of the program shown in Table 2, a predetermined client terminal accesses a URL of the form "http://www.softforum.com/download.do?filename=report.hwp" the server requests the download of the file "report.hwp ", the source code for controlling the server to read the file" report.hwp " .

If the developer of the first program generates the source code as shown in Table 2 and then applies the security weakness detection command to the first program, the attribute information verification unit 112 may include the attribute information in the source code of the first program The attribute information of the reference data referenced by each of the at least one instruction is checked.

Then, the command extracting unit 113 refers to the security weakness database 111 and extracts at least one first command referring to the reference data having the attribute information pre-designated as the security weak point among the at least one command as a variable can do.

In the source code shown in Table 2, "filename", which is a file for requesting download from an external client terminal, is specified to a variable "name" through a command "request.getProperty (" filename ")" name "is assigned to a variable named" name "and then the server refers to the data" name "having an external data attribute as a variable through the command" new File ("/ usr / local / download /" + name) , The command extracting unit 113 extracts the attribute "external data attribute" for the command "new File ()" on the security weak point database 111 in view of the fact that the client terminal reads the file requesting downloading Since the information is designated as a security weakness, the command "new File (/ usr / local / download /" + name) "among the commands existing on the source code shown in Table 2 corresponds to the security weakness It may be extracted as a command.

Then, the security weak point display unit 114 displays the location information of the line on which the command "new File (/ usr / local / download /" + name) "extracted from the source code of the first program is recorded And the location information on the extracted line can be displayed as a result of security weakness detection.

The security weak point display unit 114 displays a command "new File (/ usr / local / download /" + name) "on the screen displaying the source code of the first program as shown in Table 3 below It is possible to assist the developer of the first program to easily check the security weakness detection result by displaying the recorded line in bold and changing the line in an italicized manner or the like.

String name = request.getProperty ("filename");
if (name! = null)
{
File file = new File ("/ usr / local / download /" + name );
if (file! = null)
}

In this case, according to an embodiment of the present invention, the source code security weakness detection device 110 may further include a security weakness exception specification part 115.

The security weakness exception assigning unit 115 generates a security weak weakness exception specifying command for at least one of the at least one first command and a security weak weakness exception specifying command for the at least one second command The security weakness exception is specified for the attribute information of the reference data that the at least one second command refers to as a variable among the attribute information previously specified as the security weak point.

According to an embodiment of the present invention, after the security weakness exception is designated, the attribute information verification unit 112 may re-input the security weak point detection command for the first program, The attribute information of the reference data referenced by this variable can be reconfirmed.

The instruction extracting unit 113 refers to the security weakness database 111 to extract the at least one second instruction from which the security weakness exception is specified from the at least one first instruction of the at least one instruction And at least one third instruction may be extracted and the weakness weakness display 114 may extract location information for the line on which the at least one third instruction is written from the source code of the first program, The location information of the line in which the third command of the security weak point is recorded can be displayed as the security weak point detection result.

In the embodiment using Table 2, the security weak point display unit 114 displays a screen as shown in Table 3, so that the developer of the first program can read "new File (" / usr / local / download / "+ name)" is a security weakness.

From this, the developer of the first program can change the data referred to by the variable "new File () " as a variable through data in the system instead of the external data through modification of the source code. Is a source code for supporting downloading of a file requested by an external client terminal, the developer will not be able to change the attribute of the data referenced by the variable " new File () "

Therefore, in order for the server to normally support the download of the file requested by the external client terminal while preventing the download of the file that should not be downloaded due to the abnormal access of the client terminal to the client terminal, As shown in Table 4, a predetermined code for preventing downloading of specific external data on the source code of the first program may be additionally created.

String name = request.getProperty ("filename");
if (name! = null)
{
name = name.replaceAll ("/", "") .replaceAll (".", "");

File file = new File ("/ usr / local / download /" + name);
if (file! = null)
}

The source code shown in Table 4 is obtained when an external client terminal accesses a URL of the form "http://www.softforum.com/download.do?filename=../../../password.hwp"Quot; password.hwp "stored in the parent directory with respect to the server, the server sends a special character" ../../../password.hwp " Quot; password.hwp "stored in the upper directory is prevented from being downloaded to the client terminal by deleting all" ../../../ " Source code.

Thus, if the developer of the first program writes the source code as shown in Table 4, the process of detecting the source code security weakness is performed again even though the security weakness in the first program is solved The line with the command "new File (/ usr / local / download /" + name) "will be detected again as a security weakness.

Therefore, in order to prevent a line containing the command "new File (/ usr / local / download /" + name) "from being detected as a security weakness, the security weak point exception designation unit 115 can input a security weak point exception designation command to the command "/ usr / local / download /" + name " Name "referenced by the command" new File (/ usr / local / download / "+ name)" on the source code of the first program among attribute information previously specified as a security weak point for the command " The security weak point exception can be specified for the attribute information "external data attribute"

When the security weakness detection command for the first program is re-inputted after the security weakness exception designation is performed, the attribute information verification unit 112 checks at least one of the at least one Command extracting unit 113 refers to the security weakness database 111 to identify the attribute information of the reference data referenced by each of the commands. The command extracting unit 113 extracts "new File ( it is necessary to extract the command "/ usr / local / download /" + name "in the security weak point database 111, The command extracting unit 113 may not extract the command "new File (/ usr / local / download /" + name) "as a security weak point.

Therefore, the security vulnerability display unit 114 can not further transmit the location information on the line in which the command "new File (/ usr / local / download / It may not be displayed as a result of security weakness detection.

According to an embodiment of the present invention, the source code security weakness detection apparatus 110 may further include an instruction selection unit 116. [

An instruction selector (116), wherein when said at least one third instruction is extracted, said at least one third instruction, in the same scope on the source code to which said at least one second instruction is applied, And selects at least one fourth instruction from which the instruction referring to the same data as the reference data referenced by the second instruction as a variable is excluded.

At this time, the security weak point display unit 114 extracts the position information of the line on which the at least one fourth instruction is written from the source code of the first program, and outputs the position information to the line on which the at least one fourth instruction is written It is possible to display the location information on the security weakness detection result.

For example, in addition to the command "new File (/ usr / local / download /" + name) ", a separate command " command 2 "Quot; command 2 "is used as reference data, and the" instruction 1 "uses the reference data having the attribute information corresponding to the" attribute 1 " .

String name = request.getProperty ("filename");
if (name! = null)
{
name = name.replaceAll ("/", "") .replaceAll (".", "");

File file = new File ("/ usr / local / download /" + name);
if (file! = null)
Command 2 (name);
}
...
Command 1 (data with attribute 1)

The source code is configured as shown in Table 5. Here, the developer performs security weak point detection only for the command "new File (/ usr / local / download /" + name) The attribute information confirmation unit 112 can confirm the attribute information of the reference data that each of at least one command included in the source code of the first program refers to as a variable.

Then, the command extracting unit 113 refers to the security weakness database 111 and selects a new file (/ usr / local / download / "+ name)" as a command corresponding to a security weak point among the at least one command The command "new File ()" on the security weakness database 111 can identify "command 2" and "command 1" because the attribute information on the "external data attribute" The extraction unit 113 extracts only the "command 2" and the "command 1" as the security weak points among the "new File (" / usr / local / download / "+ name)", "command 2" You can.

In this way, "Command 2" and "Command 1" are extracted as security weaknesses, and "Command 2" is the "New File (" / usr / local / download "/ usr / local / download /" + name) "and reference data referenced by" command 2 " / usr / local / download / "+ name)", which is the same as the reference data referenced by this variable. , The command selecting unit 116 can finally select only the "command 1" excluding the "command 2" extracted as the security weak point and the "command 2" out of the "command 1" as the command corresponding to the security weak point.

When the " command 1 "is finally selected as a security weak point, the security weak point display unit 114 extracts the location information on the line in which the" command 1 "is recorded from the source code of the first program, 1 "can be displayed as a result of security weakness detection.

2 is a flowchart illustrating a source code security weakness detection method according to an embodiment of the present invention.

In step S210, for each of a plurality of instructions usable in the program source code based on the first programming language, a security weakness database in which attribute information on reference data previously designated as a security weak point is stored.

In step S220, when a security weak point detection command for the first program produced on the basis of the first programming language is inputted, each of at least one command included in the source code of the first program is referred to as a variable Check the attribute information of the reference data.

In step S230, the at least one first instruction referring to the reference data having the attribute information previously designated as the weak point among the at least one instruction is referred to as a variable by referring to the weak point database.

In step S240, location information on the line on which the at least one first command is written is extracted from the source code of the first program, and position information on the line on which the at least one first command is recorded is secured Displayed as weakness detection result.

According to an embodiment of the present invention, when the security weakness exception designation command for at least one of the at least one first command is input after step S240, A security weakness exception designation is performed on attribute information of reference data referred to as a variable by the at least one second instruction among attribute information previously designated as a security weakness for the at least one second instruction on the security weakness database Step < / RTI >

According to an embodiment of the present invention, when the security weak point detection command for the first program is re-inputted after the security weak point exception is specified, the source code security weak point detection method further comprises: Redefining attribute information of the reference data referenced by the variable; referring to the security weakness database to determine whether the security weakness exception specification is performed from the at least one first instruction of the at least one instruction, Extracting from the source code of the first program at least one third instruction from which the at least one third instruction is excluded and extracting position information for the line in which the at least one third instruction is recorded, The position information of the recorded line is displayed as the result of security weakness detection. And the like.

According to an embodiment of the present invention, when the at least one third instruction is extracted, the source code security weak point detection method may further include, when the at least one third instruction is extracted, Selecting at least one fourth instruction in the same scope on the code from which the instruction referring to the same data as the reference data referenced by the at least one second instruction as a variable is excluded; Further comprising the step of extracting positional information on a line on which the at least one fourth command is written and displaying positional information on the line on which the at least one fourth command is written as a result of detecting weakness have.

The method for detecting a source code security weakness according to an embodiment of the present invention has been described above with reference to FIG. Here, the source code security weakness detection method according to an embodiment of the present invention can correspond to the configuration of the operation of the source code security weakness detection device 110 described with reference to FIG. 1, .

The source code security weakness detection method according to an embodiment of the present invention may be implemented in the form of a program command which can be executed through various computer means and recorded in a computer readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions recorded on the medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

As described above, the present invention has been described with reference to particular embodiments, such as specific elements, and specific embodiments and drawings. However, it should be understood that the present invention is not limited to the above- And various modifications and changes may be made thereto by those skilled in the art to which the present invention pertains.

Accordingly, the spirit of the present invention should not be construed as being limited to the embodiments described, and all of the equivalents or equivalents of the claims, as well as the following claims, belong to the scope of the present invention .

110: Source code security weakness detection
111: Security weak point database 112: Property information verification unit
113: command extracting unit 114: security weak point display unit
115: Security weakness exception specification part 116: Command selection part

Claims (9)

A security weakness database in which attribute information for reference data previously designated as a security weakness is stored for each of a plurality of instructions usable in program source code based on a first programming language;
When a security weak point detection command for a first program produced on the basis of the first programming language is inputted, each of at least one instruction included in the source code of the first program is used as attribute information An attribute information confirmation unit for confirming the attribute information;
A command extracting unit for extracting at least one first instruction referring to the security weakness database as a variable, with reference data having attribute information previously designated as the security weak point among the at least one instruction;
Extracting positional information on a line on which the at least one first command is written from the source code of the first program to detect positional information on the line on which the at least one first command is recorded, A security weakness display unit displaying the result; And
Wherein when a security weakness exception designation command for at least one of the at least one first command is input, the security weakness database designates, as the security weak point for the at least one second command, A security weak point exception specifying unit for designating a security weak point exception to attribute information of reference data referenced by at least one second instruction word as a variable;
Lt; / RTI >
The attribute information checking unit
When the security weak point detection instruction for the first program is re-input after the security weak point exception designation is performed, the at least one instruction word reaffirms attribute information of the reference data referred to as a variable,
The instruction extracting unit
Extracting at least one third instruction from the at least one first instruction among the at least one instruction, excluding the at least one second instruction for which the security weakness exception is specified, by referring to the security weakness database,
The security vulnerability display unit
Extracting positional information on a line on which the at least one third instruction is written from the source code of the first program and displaying positional information on the line on which the at least one third instruction is written as a result of detecting a weakness Source code security weakness detection device. delete delete The method according to claim 1,
If the at least one third instruction is extracted, the at least one second instruction in the same scope on the source code to which the at least one second instruction is applied is a variable And selects at least one fourth instruction from which the instruction for referring to the same data as reference data as a variable is excluded,
Further comprising:
The security vulnerability display unit
Extracting positional information on a line on which the at least one fourth command is written from the source code of the first program and displaying positional information on the line on which the at least one fourth command is written as a result of weakness detection Source code security weakness detection device. Maintaining a security weakness database in which, for each of a plurality of instructions available in program source code based on a first programming language, attribute information for reference data previously designated as a security weakness is stored;
When a security weak point detection command for a first program produced on the basis of the first programming language is inputted, each of at least one instruction included in the source code of the first program is used as attribute information ;
Extracting at least one first instruction referring to the security weakness database as a variable with reference data having attribute information previously designated as the security weakness among the at least one instruction;
Extracting positional information on a line on which the at least one first command is written from the source code of the first program to detect positional information on the line on which the at least one first command is recorded, Displaying as a result;
Wherein when a security weakness exception designation command for at least one of the at least one first command is input, the security weakness database designates, as the security weak point for the at least one second command, Performing security weakness exception designation on attribute information of reference data that at least one second instruction refers to as a variable;
Reconfiguring attribute information of reference data referred to as a variable by each of the at least one instruction when the security weak point detection instruction for the first program is re-inputted after the security weak point exception specification is performed;
Extracting at least one third instruction from the at least one first instruction among the at least one instruction, the at least one second instruction having the security weakness exception designation removed, by referring to the security weakness database; And
Extracting positional information on a line on which the at least one third instruction is written from the source code of the first program and displaying positional information on the line on which the at least one third instruction is written as a result of detecting a weakness Step
A source code security weakness detection method. delete delete 6. The method of claim 5,
If the at least one third instruction is extracted, the at least one second instruction in the same scope on the source code to which the at least one second instruction is applied is a variable Selecting at least one fourth instruction excluding an instruction referring to the same data as reference data to be referred as a variable; And
Extracting positional information on a line on which the at least one fourth command is written from the source code of the first program and displaying positional information on the line on which the at least one fourth command is written as a result of weakness detection Step
The method comprising the steps of: A computer-readable recording medium recording a program for performing the method according to any one of claims 5 to 8.

Images