SQL Injection Attacks and Defense - 2009

Reviewing Code for SQL Injection • Chapter 3 125
lexical analyzers. Lexical analysis is necessary to reliably distinguish variables from functions
and to identify function arguments.
Some source code analyzers, such as those that operate as plug-ins to an IDE, often
make use of an abstract syntax tree (AST). An AST is a tree representation of the simplified
syntactic structure of source code. You can use an AST to perform a deeper analysis of the
source elements to help track data flows and identify sinks and sink sources.
Another method that some source code analyzers implement is data flow analysis,
a process for collecting information about the use, definition, and dependencies of data in
programs. The data flow analysis algorithm operates on a control flow graph (CFG) generated
from the AST. You can use a CFG to determine the parts of a program to which a particular
value assigned to a variable might propagate. A CFG is a representation, using graph notation,
of all paths that might be traversed through a program during its execution.
At the time of this writing, automated tools incorporate three distinct methods of
analysis: string-based pattern matching, lexical token matching, and data flow analysis via
an AST and/or a CFG. Automated static code analysis tools can be very useful in helping
security consultants identify dangerous coding behaviors that incorporate security-sensitive
functions or sinks, and make the task of identifying sink sources by tracing tainted data back
to its origin (entry point) much simpler. However, you should not rely blindly on their
results. Although in some ways they are an improvement over manual techniques, they should
be used by security-conscientious developers or skilled and knowledgeable security consultants
who can contextualize their findings and make an informed decision on their validity.
I also recommend that you use any automated tool in conjunction with at least one other
tool as well as a manual investigation of the code utilizing the techniques presented in this
chapter. This combined approach will give you the highest level of confidence in your
findings and allow you to eradicate the majority of false positives as well as help you identify
false negatives. These tools don’t eliminate the need for a human reviewer; a certain level of
security acumen is required to use the tools correctly. Web application programming languages
are rich, expressive languages that you can use to build anything, and analyzing arbitrary
code is a difficult job that requires a lot of context. These tools are more like spell checkers
or grammar checkers; they don’t understand the context of the code or the application and
can miss many important security issues.
Yet Another Source
Code Analyzer (YASCA)
YASCA is an open source program which looks for security vulnerabilities and code-quality
issues in program source code. It analyses PHP, Java, C/C++, and JavaScript (by default) for
security and code-quality issues. YASCA is extensible via a plug-in-based architecture.
It integrates other open source programs such as FindBugs (http://findbugs.sourceforge.net),
PMD (http://pmd.sourceforge.net), and Jlint (http://artho.com/jlint). You can use the tool