关键词: 抽象解析树, 控制流图, 污点型漏洞, 路径遍历, 污点分析

Abstract: This paper proposes a method based on static code analysis to detect vulnerabilities for PHP tainted-style vulnerability caused by Web Apps. Firstly, the paper provides the control flow graph generating algorithm. By employing the PHP built-in function, it analyzes the PHP program to construct the abstract parse tree, and then it generates the control flow graph. Secondly, it models the built-in features, the entry point and the sensitive point, and presents the data flow analysis approach. Then, it proposes the effective paths analysis approach based on taint analysis to improve the accuracy of the analysis and gives the variable backtracking algorithm. Finally, the paper implements the prototype of the approach, and tests on two widely used PHP applications and finds 6 undisclosed vulnerabilities and 11 disclosed vulnerabilities.

Key words: abstract parse tree, Control Flow Graph（CFG）, tainted-style vulnerability, path traversal, taint analysis