Sap Se

Florian Loch

Martin Johns

Benny Rolle

Disclosed herein are system, method, and computer program product embodiments for conducting taint analysis on inputted data from a user to a process, where based on pre-defined rules, input data may be marked as tainted. In a passive mode, logging or deletion actions may be taken on the tainted data. In an active mode, the process may be interrupted and a user prompt may be displayed each time a taint point is reached.

Content-driven debugging by taint tracking along data flows

Disclosed herein are system, method, and computer program product embodiments for propagating taint information for strings using metadata. Taint information for a string is encoded using taint ranges. When an operation is performed on the string, the operation and any additional taint information corresponding to the operation is encoded into a delta layer of the metadata. Rather than immediately obtaining taint information for a result string when the operation is performed on the string, the delta layer stores the taint information for the operation, and any subsequent operation, until it is needed. Once the taint information is needed, then the delta layers are collapsed into base layer taint information in order to resolve taint information for a result string.

Management of taint information attached to strings

Systems and methods are provided herein for dynamic, non-invasive taint tracking using auto-generated datatypes. A proxy entry point component of a taint-aware environment continuously monitors for a request to initiate an application. The application has an associated runtime environment and profile parameters specific to the application. Upon identifying the request, a core component of the taint-aware environment generates a set of augmented classes based on the profile parameters. The set of augmented classes contains taint-tracking functionality. The proxy entry point component modifies an initiation pathway of the application to force the runtime environment to retrieve the set of augmented classes prior to execution of the application. The runtime environment continuously monitors for tainted data or tainted code passed through or contained within the application based on the taint-tracking functionality of the set of augmented classes.

Dynamic, non-invasive taint tracking using auto-generated datatypes

In an example embodiment, a proxy server receives a request from a web browser operated on a client device, the request including a call for computer code written in a scripting language. The request is forwarded to a web server to obtain the computer code written in the scripting language. The computer code written in the scripting language is automatically instrumented by adding instrumentation code to the computer code written in the scripting language, the instrumentation code configured to, when executed, measure one or more metrics and report the resultant measurements. Then the instrumented computer code written in the scripting language is sent to the web browser for execution.

Growing community of inventors

Karlsruhe, Germany

Florian Loch