Scalable Language Agnostic Taint Tracking using Explicit Data Dependencies
summary
Implements a language-agnostic, whole-program data-dependence graph on top of Joern/CPG that initially over-approximates all call-site flows so libraries can be omitted and later refined with simple semantic annotations without recomputing the graph. Queries run as K-limited task-based backward analyses across input/output argument edges (receiver = 0, return = -1) so annotations prune false positives at query time. Evaluated on Java, Python, JavaScript versus CodeQL and SimGrip: higher recall and faster than CodeQL, precision varies, memory/runtime tradeoffs noted.
AI-written summary · about
chapters (14)
- 0:00Taint tracking basics
- 1:03Motivation for whole-program analysis
- 2:47Handling external call sites
- 4:12System dependence graph
- 5:16Over-approximation and refinement
- 6:41Annotation language
- 8:03Query algorithm overview
- 10:53Task generation and caching
- 12:41Evaluation setup
- 13:43Results: Java Python JavaScript
- 15:29Whole program analysis with libraries
- 16:32Limitations
- 17:14Conclusion and related work
- 17:57Q&A
related talks
57mVariant analysis
26mType-directed Program Transformation for Constant-Time Enforcement
38mStatic Code Analysis - A Behind-the-scenes Look
22mCompilers should get over themselves and respect semantic dependencies!
41mGoing Beyond Metadata: Why We Need to Think of Adopting Static Analysis in Dependency Tools
37mA Static Tainting Analysis Method for Aspect-Oriented Programs
22mReconciling Progress-Intensive Noninterference and Declassification
18mScalable Bug Detection for Internally Unsafe Libraries: A Logical Approach to Type(…)