Taint analysis vizualization (adding additional locations to TaintAnalyzer) #276
Conversation
|
Interesting! I'll take a look. Thanks! |
|
I think it will be a great addition to Security-Code-Scan(SCS). Regarding a "hacky way" it is questionable what is better - hacky, but external to the analysis engine itself, or internal. Although there is a potential for infinite recursion or CPU consuming path finding while the work was already done. I'll investigate how many changes would it take to add it into the engine itself. One blocker I need to solve before moving forward is that I'm contemplating changing SCS licensing a bit. But licensing is tricky, so it takes time. It came to my attention that some companies provide paid Dev Sec Ops services relying partially on SCS which is allowed under current LGPL 3.0 license. To make it clear SCS if free for personal usage and for companies that use it internally in CI. I also don't mind if security researchers or companies provide commercial audit services using SCS as a tool. However including SCS into commercial Dev Sec Ops solutions without contributing back or sponsoring the project is simply exploitation of OSS. SCS started as a fork of LGPL licensed https://github.com/dotnet-security-guard/roslyn-security-guard which was abandoned at that time. If I wanted to change the license of SCS I would probably need to collect approvals of all past contributors. However nobody except me has contributed to the Roslyn subfolder which was under Apache License and recently switched to MIT. I see it as an opportunity to release it under a different license that would prevent the abuse. My next steps plan is:
Please let me know if you have any concerns. |
|
Sounds good to me but with a couple of suggestions / observations:
|
Thank you for reminding it. I'll drop the support.
The purpose of the AuditMode at first was to mark all the sinks without taint tracking. Some non taint analyzers use it like a flag for verbosity. Overall I think it is worth to keep the flag to have a grep on steroids for sinks. |
It is a new experimental feature that can be extremely helpful while reviewing any vulnerability found with taint analysis (aka all injections and not a single line item).
End goal: To be able to properly populate the SARIF file with all additional locations to visualize the code flow.
How:
A new flag
TaintFlowVisualizationEnabledwas introduced. It isdisabled by defaultand works only with AuditMode=off.Implementation is a bit hacky; instead of modifying a taint flow analysis logic (Roslyn stuff), I do additional post-processing to recreate the data flow. This way, I won't decrease performance significantly, and analyzers still produce the same results.
Due to internal limitations, the solution may not be ideal in its current state.
If it is something that you find interesting, please review the PR and provide feedback. I tried not to change too much
Example of code flow - Code Scanning with Github - I want to produce something similar at the end; this one is the first step:
