Micro Focus Lcc

Entit Software LLC

Alvaro Munoz

Yekaterina O'Neil

Sasi Siddharth Muthurajan

Ming Sum Sam Ng

Oleksandr Mirosh

Examples disclosed herein relate to modifying a web page. In one example, in response to beginning execution of a process initiating generation of a web page of a web application at a server, a runtime agent is executed. In this example, the runtime agent modifies code of the web page to inject code to protect output of the web page. In the example, the process can be executed using the modified code to generate a modified web page.

Modifying web page code to include code to protect output

In one implementation, a static analysis system can include an operator engine to identify a modification operation on a string based on a structural comparison of program code to a static analysis rule, a label engine to maintain a label with the string based on the static analysis rule, and a sink engine to identify that the label denotes a string property and provide an analysis message associated with the string property based on the label.

String property labels for static analysis

Example implementations relate to static program analysis. For example, an apparatus includes a processor to perform static program analysis on a set of processor executable instructions associated with an object-relational mapping (ORM) framework. The first set of processor executable instructions includes an object. The processor is also to generate a propagation path of the object based on an execution flow of the object. The propagation path includes a first node and a second node. The first node corresponds to a first ORM operation to store the object in a database. The second node corresponds to a second ORM operation to retrieve the object from the database. The second node is linked to the first node based on a common attribute of the object. In response to a determination that the propagation path includes a sink, the processor is to output a security risk warning.

Static program analysis in an object-relational mapping framework

Example embodiments disclosed herein relate to determination of vulnerability of an application under test using a runtime agent and network sniffer during a security test. A runtime agent monitors execution of an application under test. A network sniffer is used to identify a probe value for determination of the vulnerability.

Growing community of inventors

Las Rozas, Spain

Alvaro Munoz