PINPOINTING SECURITY VULNERABILITIES IN COMPUTER SOFTWARE APPLICATIONS

    公开(公告)号:US20120266246A1

    公开(公告)日:2012-10-18

    申请号:US13085902

    申请日:2011-04-13

    IPC分类号: G06F21/00

    摘要: A build process management system can acquire data pertaining to a software build process that is currently being executed by an automated software build system. The software build process can include executable process steps, metadata, and/or environmental parameter values. An executable process step can utilize a build artifact, representing an electronic document that supports the software build process. The acquired data can then be synthesized into an immutable baseline build process and associated baseline artifact library. The baseline artifact library can store copies of the build artifacts. The immutable baseline build process can include baseline objects that represent data values and dependencies indicated in the software build process. In response to a user-specified command, an operation can be performed upon the baseline build process and associated baseline artifact library.

    INJECTION CONTEXT BASED STATIC ANALYSIS OF COMPUTER SOFTWARE APPLICATIONS
    2.
    发明申请
    INJECTION CONTEXT BASED STATIC ANALYSIS OF COMPUTER SOFTWARE APPLICATIONS 有权
    基于注入上下文的计算机软件应用的静态分析

    公开(公告)号:US20110321016A1

    公开(公告)日:2011-12-29

    申请号:US12825293

    申请日:2010-06-28

    IPC分类号: G06F11/36 G06F9/44

    摘要: Embodiments of the invention generally relate to injection context based static analysis of computer software applications. Embodiments of the invention may include selecting a sink within a computer software application, tracing a character output stream leading to the sink within the computer software application, determining an injection context of the character output stream at the sink, where the injection context is predefined in association with a state of the character output stream at the sink, identifying any actions that have been predefined in association with the identified injection context, and providing a report of the actions.

    摘要翻译: 本发明的实施例一般涉及计算机软件应用的基于注入上下文的静态分析。 本发明的实施例可以包括选择计算机软件应用程序内的汇点,跟踪通向计算机软件应用程序内的汇点的字符输出流,确定汇点处的字符输出流的注入上下文,其中注入上下文在 与汇点处的字符输出流的状态相关联,识别已经与所识别的注入上下文相关联地预定义的任何动作,以及提供动作的报告。