Web Developers, Beware of the Tarpits for SAST in Your Code
summary
Claims that static analyzers miss widespread “tarpits” called testability patterns and shows concrete evidence: uses code property graphs to find 120 PHP patterns and ~115 JavaScript patterns across 3,340 projects, refactors patterns automatically on 1,170 repos, and runs research and commercial SAST engines. Results show ~32,000 pattern occurrences, about 9,000 new alerts after transformations and 370 confirmed vulnerabilities in 43 apps (55 in popular projects). A patterns catalog and transformation tooling are built and validated via responsible disclosure.
AI-written summary · about
chapters (17)
- 0:00Intro
- 2:50Context: SAST and testability
- 7:05CVE-2011-3357: File inclusion in mantis bug tracker
- 9:37Toward testability patterns
- 14:46Research methodology: overview
- 15:28Phase 1: Pattern creation and SAST measurement
- 18:07Dataset
- 19:03Prevalence
- 22:22Pattern discovery: advantages
- 24:15MANUAL PATTERN TRANSFORMATION
- 25:38Semantic-preserving Transformations
- 25:59Over-approximations
- 27:04Developer-Assisted Transformations
- 28:49Results upon transformations
- 31:03AUTOMATED PATTERN TRANSFORMATION
- 34:01Conclusion and next steps
- 39:56Contact and credits
related talks
53mTestability Patterns For Web Apps - A New OWASP Project
42mContemporary Automatic Program Analysis
33mBattle Tested Application Security
45mEradicating Vulnerability Classes by Shelving SAST and Embracing Secure Defaults and Invariants
39mPractical Static Analysis for Continuous Application Security
44mApplication Security: Everything we know is wrong
43mSecurity Testing Tools: Can I Touch You There?
43mDo Certain Types Of Developers Or Teams Write More Secure Code?