SQL Injection Attacks and Defense - 2009

134 Chapter 3 • Reviewing Code for SQL Injection
˛˛ To perform an effective source code review and identify all potential SQL injection
vulnerabilities, you need to be able to recognize dangerous coding behaviors,
identify security-sensitive functions, locate all potential methods for handling
user-controlled input, and trace tainted data back to its origin via its execution
path or data flow.
˛˛ Armed with a comprehensive list of search strings, the simplest and most
straightforward approach to conducting a manual source code review is to use
the UNIX utility grep (also available for Windows systems).
Automated Source Code Review
˛˛ At the time of this writing, automated tools incorporate three distinct methods
of analysis: string-based pattern matching, lexical token matching, and data flow
analysis via an abstract syntax tree (AST) and/or a control flow graph (CFG).
˛˛ Some automated tools use regular expression string matching to identify sinks that
pass tainted data as a parameter, as well as sink sources (points in the application
where untrusted data originates).
˛˛ Lexical analysis is the process of taking an input string of characters and producing
a sequence of symbols called lexical tokens. Some tools preprocess and tokenize
source files and then match the lexical tokens against a library of sinks.
˛˛ An AST is a tree representation of the simplified syntactic structure of source
code. You can use an AST to perform a deeper analysis of the source elements to
help track data flows and identify sinks and sink sources.
˛˛ Data flow analysis is a process for collecting information about the use, definition,
and dependencies of data in programs. The data flow analysis algorithm operates
on a CFG generated from an AST.
˛˛ You can use a CFG to determine the parts of a program to which a particular
value assigned to a variable might propagate. A CFG is a representation, using
graph notation, of all paths that might be traversed through a program during
its execution.