JP2013134573A - Software correction device, software correction system, software correction method and software correction program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a software correction device which automatically generates a candidate for a source file correction code for resolving problems such as security vulnerability or the like of software.SOLUTION: A software correction device comprises: a problem information storage unit which stores a problem type including a name of an illegal function in which a problem included in a source code of software exists and a problem information record including an argument name of the illegal function related to the problem; a correction information storage unit which stores the problem type and a correction record associated with a correction general purpose code including an argument name for correcting the problem; and a correction candidate generation unit which retrieves the correction information record having the same problem type as the problem information record, replaces the argument name in the correction general purpose code in the retrieved correction record with the argument name in the retrieved problem information record and generates a correction actual code.

Description

  The present invention relates to a software correction apparatus, a software correction system, a software correction method, and a software correction program for solving problems including software security vulnerabilities.

  In the modern society where the IT environment is highly developed, it is indispensable to quickly solve various problems existing in the software used in the system. Particularly recently, the effects of cyber attacks and other computer crimes have become more serious, and it is becoming increasingly important to make software security vulnerabilities as small as possible.

  An example of a security vulnerability is a buffer overflow that occurs when software misprocesses input data from the outside. There are also cross-site scripting and SQL injection that occur when input data is erroneously processed or output to other software without processing.

  As a technique for eliminating such security vulnerabilities, Patent Document 1 discloses that a portion having a vulnerability can be accurately obtained by constructing an analysis tree for parsing in security vulnerability inspection of software source code. Devices for detection are publicly available.

  Further, Patent Document 2 discloses a program that improves the vulnerability detection system by detecting only portions that are not used appropriately, rather than detecting all vulnerable libraries.

JP 2007-052625 A JP 2011-150716 A

  In the techniques described in Patent Document 1 and Patent Document 2 described above, how to correct the source code of the software is not presented with respect to the detection result of the security vulnerability. Entrusted to the developer.

  Therefore, when a software developer who is not familiar with the security area makes corrections to the source code, there is a problem that it takes a long time to complete the correction.

  An object of the present invention is to provide a software correction apparatus, a software correction system, a software correction method, and a software correction program that solve these problems.

  A software correction apparatus according to an embodiment of the present invention includes a problem type including a problem type including a name of an illegal function having a problem included in a software source code and an argument name of the incorrect function related to the problem. A problem information storage means for storing; a problem record; a correction record in which a correction general-purpose code including an argument name for correcting the problem is associated; a correction information storage means for storing; a problem information record; Search for the correction information record that matches the problem type, and replace the argument name in the correction general-purpose code in the searched correction record with the argument name in the searched problem information record. Correction candidate generation means for generating a correction actual code.

  A software correction method according to an embodiment of the present invention includes: a problem type including a name of an illegal function in which a problem included in a software source code exists; and a problem information record including an argument name of the illegal function related to the problem. Storing and storing the problem type and a correction record in which a correction general-purpose code including an argument name is associated to correct the problem, and the problem information record and the problem type match. A record is searched, and the argument name in the correction general-purpose code in the searched correction record is replaced with the argument name in the searched problem information record to generate a correction actual code.

  A software correction program according to an embodiment of the present invention includes a problem type including a problem type including a name of an illegal function having a problem included in a software source code and an argument name of the incorrect function related to the problem. A problem information storage process for storing; a problem record; a modification record in which a modification general-purpose code including an argument name for correcting the problem is associated; a modification information storage process for storing; a problem information record; Search for the correction information record that matches the problem type, and replace the argument name in the correction general-purpose code in the searched correction record with the argument name in the searched problem information record. Then, a correction candidate generation process for generating a correction actual code is executed by the computer.

  The present invention realizes automatic generation of source file correction code candidates that solve problems such as software security vulnerabilities.

It is a block diagram which shows the structure of the 1st Embodiment of this invention. It is a flowchart which shows operation | movement of the 1st Embodiment of this invention. It is Example 1 of the original source file 11 in 1st Embodiment of this invention. It is Example 2 of the original source file 11 in 1st Embodiment of this invention. It is the detail of the security vulnerability classification information 1020 and the security vulnerability detailed information 1021 in the first embodiment of the present invention. It is the detail of the security vulnerability classification information 1010 and the security vulnerability correction information 1011 in 1st Embodiment of this invention. It is the screen (in the case of Example 1) of the user console 15 at the time of the process execution of the security vulnerability correction content reflection part 106 in 1st Embodiment of this invention. It is Example 1 of the source file 14 after correction in the 1st Embodiment of this invention. It is Example 2 of the source file 14 after correction | amendment in 1st Embodiment of this invention. It is a block diagram which shows the structure of 2nd Embodiment of this invention. It is a flowchart which shows the operation | movement of 2nd Embodiment of this invention.

  A first embodiment of the present invention will be described in detail with reference to the drawings.

  FIG. 1 shows a security vulnerability composed of a security vulnerability correcting device 10, an original source file 11, a security vulnerability verification tool 12, a verification tool verification result 13, a corrected source file 14, and a user console 15. The configuration of the correction system is shown.

  The original source file 11 is a source file of software to be verified and corrected for security vulnerabilities, and two examples thereof are shown as Example 1 (SampleXSS.java) and Example 2 (SQLInjection.java), respectively, as shown in FIGS. 4 shows. Example 1 and Example 2 use JAVA (registered trademark) as a programming language, but may be a source file written in another programming language such as C language or html.

  In the case of the source file of Example 1, since the data acquired from the request parameter on the 24th line is used as it is in the sendError method on the 26th line, there is a cross-site scripting vulnerability.

  In the case of the source file of Example 2, since the data acquired from the request parameter on the 15th line is used as it is in the prepareStatement method on the 22nd line, there is an SQL injection vulnerability.

  The security vulnerability verification tool 12 is package software for analyzing the security vulnerability of the original source file 11, and several tools are known. The verification tool verification result 13 output by the security vulnerability verification tool 12 necessarily includes the security vulnerability type information 1020 and the security vulnerability detailed information 1021 shown in FIG. The verification tool verification result 13 includes various analysis information such as the importance level of the security vulnerability category, the description of the vulnerability category and the outline of the response method, and the program flow from input to output of illegal data. May be included.

  The corrected source file 14 is a file that is output by the security vulnerability correcting apparatus 10 by correcting the code of the location where the security vulnerability exists in the original source file 11. FIGS. 8 and 9 show modified source files 14 obtained by modifying the original source files 11 of Examples 1 and 2 and outputting them, respectively.

  As shown in FIG. 8, in the case of the source file of Example 1, the security vulnerability correcting apparatus 10 adds the sanitization process on the 26th line, thereby eliminating the cross-site scripting vulnerability existing in the original source file 11.

  As shown in FIG. 9, in the case of the source file of Example 2, the security vulnerability correcting apparatus 10 adds the sanitization process on the 22nd line, thereby eliminating the vulnerability of the SQL injection existing in the original source file 11.

  The user console 15 is a screen, a keyboard, and a mouse that serve as a user interface when the software developer uses the security vulnerability correcting apparatus 10.

  The security vulnerability correction apparatus 10 includes a security vulnerability verification result information acquisition unit 100, a security vulnerability correction rule storage unit 101, a security vulnerability verification result information storage unit 102, a security vulnerability correction candidate presentation unit 103, A security vulnerability correction code 104, a security vulnerability correction location 105, and a security vulnerability correction content reflection unit 106 are provided.

  The security vulnerability verification result information acquisition unit 100 extracts the security vulnerability type information 1020 and the security vulnerability detailed information 1021 from the verification tool verification result 13 and stores them in the security vulnerability verification result information storage unit 102.

  As shown in FIG. 5, the security vulnerability type information 1020 includes a security vulnerability category and illegal function name information. When the original source file 11 is Example 1, the security vulnerability verification result information acquisition unit 100 stores “Cross Site Scripting” in the category and “sendError” in the illegal function name. When the original source file 11 is Example 2, the security vulnerability verification result information acquisition unit 100 stores “SQL Injection” in the category and “preparationStatement” in the illegal function name.

  As shown in FIG. 5, the security vulnerability detailed information 1021 includes the file name where the security vulnerability exists, the line number of the location where the security vulnerability exists in the file, and invalid function argument information. . When the original source file 11 is in Example 1, the security vulnerability verification result information acquisition unit 100 stores “SampleXSS.java” as the file name, “26” as the line number, and information shown in FIG. 5 as the invalid function argument information. To do. When the original source file 11 is Example 2, the security vulnerability verification result information acquisition unit 100 stores “SampleSQL.java” as the file name, “22” as the line number, and information shown in FIG. 5 as the invalid function argument information. To do.

  The security vulnerability verification result information storage unit 102 outputs the security vulnerability type information 1020 and the security vulnerability detailed information 1021 to the security vulnerability correction candidate presentation unit 103.

  The security vulnerability correction rule storage unit 101 stores security vulnerability type information 1010 and security vulnerability correction information 1011. The security vulnerability type information 1010 and the security vulnerability correction information 1011 are registered as security vulnerability correction rules from the user console 15 by the software developer. As shown in FIG. 6, the security vulnerability type information 1010 includes a security vulnerability category and illegal function name information. The security vulnerability correction information 1011 includes the correction process classification and the correction general-purpose code information. The modified generic code includes a generic description of the argument.

  As shown in FIG. 6, the software developer, as described in FIG. 6, as a vulnerability correction rule for the cross-site scripting vulnerability, the category is “Cross Site Scripting”, the illegal function name is “sendError”, and the correction processing category is “Insert”, correction The code sentence shown in FIG. 6 is registered in the general-purpose code. As a vulnerability correction rule for the SQL injection vulnerability, the software developer sets the category “SQL Injection”, the illegal function name “prepareStatement”, the correction processing classification “Insert”, and the correction general-purpose code shown in FIG. Register. In the case of security vulnerabilities in the categories of cross-site scripting and SQL injection, one is registered as an invalid function name for each category, and only one modified general-purpose code for each illegal function is required.

  In the case of the vulnerability correction rule for the buffer overflow vulnerability, as shown in FIG. 6, there are two illegal function names “strcpy” and “gets”. It is necessary to register two things as

  The security vulnerability correction rule storage unit 101 outputs the security vulnerability type information 1010 and the security vulnerability correction information 1011 to the security vulnerability correction candidate presentation unit 103.

  The security vulnerability correction candidate presentation unit 103 searches for a record in which the security vulnerability type information 1020 and the security vulnerability type information 1010 match. If there is a match as a result of the search, the security vulnerability correction candidate presentation unit 103 describes the description of the argument in the correction general-purpose code in the security vulnerability detailed information 1011 for the matched record in the security vulnerability detailed information 1021. A modified actual code is generated by replacing with the description of the illegal function argument information, and is output as the security vulnerability modified code 104. The security vulnerability correction code 104 also includes correction processing classification information in the security vulnerability correction information 1011 of the corresponding record.

  The security vulnerability correction candidate presentation unit 103 outputs the file name and line number information of the security vulnerability detailed information 1021 as the security vulnerability correction location 105 for the matched record.

  The operation of the security vulnerability correction candidate presentation unit 103 will be described in the case where the original source file 11 is Example 1. The security vulnerability type information 1020 and the security vulnerability type information 1010 match in a record whose category is “Cross Site Scripting” and whose illegal function name is “sendError”. The security vulnerability correction candidate presentation unit 103 replaces the notation of “% TaintArg%” in the modified general-purpose code with “name” from “TaintArg = name” of the invalid function argument information of this record, and “Sanizer.sanitizeHTML ( name); ”is generated and output as the security vulnerability correction code 104. The security vulnerability correction code 104 also includes information of “Insert” of the correction processing classification of this record.

  The security vulnerability correction candidate presentation unit 103 outputs the information of the file name “SampleXSS.java” and the line number “26” of the record as the security vulnerability correction portion 105.

  The operation of the security vulnerability correction candidate presentation unit 103 when the original source file 11 is Example 2 is the same as that of Example 1. In the case of Example 2, the security vulnerability type information 1020 and the security vulnerability type information 1010 match in a record having a category “SQL Injection” and an illegal function name “prepareStatement”, and “Sanizer.sanitizeSQL (str);” A correction actual code is generated, and the information of “Insert” of the correction process classification is included and output as the security vulnerability correction code 104. At the same time, the file name “SampleSQL.java” of the record and the information of the line number “22” are output as the security vulnerability correction portion 105.

  The security vulnerability correction content reflection unit 106 displays information on the security vulnerability correction code 104 and the security vulnerability correction portion 105 on the screen of the user console 15 as candidates for correction content for the original source file 11.

  FIG. 7 is a screen of the user console 15 when the original source file 11 is Example 1. The security vulnerability correction content reflection unit 106 displays the file name of the original source file 11 at the upper right of the screen from the information of the file name at the security vulnerability correction location 105, and displays the source code of the original source file 11 below it. .

  The security vulnerability correction content reflection unit 106 displays the 26th line in which the security vulnerability exists from the line number information in the security vulnerability correction location 105 in a character color different from the other lines. When the software developer moves the mouse cursor above the 26th line, the security vulnerability correction content reflection unit 106 displays “Insert” of the correction processing classification in the Modification column on the left side of the screen and “Sanizer. sanitizeHTML (name); "is displayed.

  The software developer checks the displayed correction contents, moves the mouse cursor to the vicinity of the display section of the corrected actual code, and double-clicks. Upon receiving a double click, the security vulnerability correction content reflecting unit 106 reflects the correction content in the original source file 11 and generates a corrected source file 14.

  When the original source file 11 is Example 1 or Example 2, there is only one candidate for the correction contents as shown in FIG. 6, but the security vulnerability category of the original source file 11 is “Buffer Overflow” and the invalid function name is “ In the case of “strcpy”, there are two correction candidates. In this case, the security vulnerability correction content reflection unit 106 displays two correction candidates on the screen, the software developer selects one of the correction candidates, and a mouse cursor near the selected correction actual code display unit. Move and double-click. The security vulnerability correction content reflecting unit 106 reflects the correction content selected by the software developer in the original source file 11.

  Next, the operation of this embodiment will be described in detail with reference to the flowchart of FIG.

  The security vulnerability verification tool 12 analyzes the security vulnerability of the original source file 11 and outputs a verification tool verification result 13 (S101). If no security vulnerability exists in the verification tool verification result 13 (No in S102), the entire process ends.

  If the security vulnerability exists in the verification tool verification result 13 (Yes in S102), the verification result information acquisition unit 100 extracts the security vulnerability type information 1020 and the security vulnerability detailed information 1021 from the verification tool verification result 13, It is stored in the security vulnerability verification result information storage unit 102 (S103).

  The security vulnerability correction candidate presentation unit 103 searches for a match between the security vulnerability type information 1020 and the security vulnerability type information 1010 (S104). If there is no matching record (No in S105), the security vulnerability correction candidate presenting unit 103 displays a message “security vulnerability correction information is not defined” on the screen of the user console 15 (S107). The entire process ends.

  If there is a matched record in the search result (Yes in S105), the security vulnerability correction candidate presenting unit 103 uses the argument name of the correction general-purpose code of the security vulnerability correction information 1011 as an illegal function of the security vulnerability detailed information 1021. A correction actual code is generated by substituting the argument information, and the security vulnerability correction code 104 is generated by attaching the correction processing classification in the security vulnerability correction information 1011. At the same time, the security vulnerability correction candidate presentation unit 103 generates a security vulnerability correction portion 105 from the file name and line number data of the security vulnerability detailed information 1021 (S106).

  The security vulnerability correction content reflection unit 106 outputs the security vulnerability correction code 104 and the security vulnerability correction portion 105 to the screen of the user console 15, and the software developer selects an optimal correction code on the screen (S108). ).

  The security vulnerability correction content reflection unit 106 reflects the correction code selected by the software developer in the original source file 11 and outputs the corrected source file 14 (S109).

  If there is only one security vulnerability correction code 104, the processing of S108 is not essential, and the security vulnerability correction content reflection unit 106 does not output it to the screen of the user console 15, and the security vulnerability correction code 104 and A method of reflecting the security vulnerability correction portion 105 in the original source file 11 may be used.

  This embodiment has an effect of automatically generating correction code candidates that solve a software problem in which a security vulnerability exists. This is because the security vulnerability correction candidate presentation unit 103 is based on the security vulnerability analysis result stored in the security vulnerability verification result information storage unit 102 and the correction rule stored in the security vulnerability correction rule storage unit 101. This is because a correction part and a correction code for the software source file are generated and presented.

By automatically generating correction code candidates, even software developers who are not familiar with the security domain can quickly correct source codes related to security vulnerabilities.
<Second Embodiment>
Next, a second embodiment of the present invention will be described in detail with reference to the drawings.

  FIG. 10 is a block diagram showing the configuration of the software correction device 20 of this embodiment.

  The correction information storage unit 201 stores problem type information 2010 including one or more records, and a correction record 2011 associated with each record of the problem type information 2010. Each record of the problem type information 2010 includes information on illegal functions. Each record of the correction record 2011 includes information on the correction general-purpose code including the argument name. The problem type information 2010 and the correction record 2011 are input as a software correction rule by the software developer.

  The corrected problem information storage unit 202 stores problem type information 2020 including one or more records, and a problem information record 2021 associated with each record of the problem type information 2020. Each record of the problem type information 2020 includes information on illegal functions. Each record of the problem information record 2021 includes information on illegal function arguments. In this embodiment, since the software developer examines the correction part, the problem information record 2021 does not have to include the file name and line number information described in the first embodiment. The problem type information 2020 and the problem information record 2021 may be those obtained by editing the output of the software problem analysis tool, or may be the result of inputting the software analysis result of the software developer.

  The correction candidate generation unit 203 searches for a record in which the problem type information 2020 and the problem type information 2010 match. If there is a match, the correction candidate generation unit 203 generates a correction actual code 204 by replacing the argument name of the general correction code in the correction record 2011 with the invalid function argument in the problem information record 2021 for the matched record. The modified actual code 204 is applied to the source file by the software developer.

  Next, the operation of this embodiment will be described in detail with reference to the flowchart of FIG.

  The correction candidate generation unit 203 searches for a record in which the problem type information 2020 and the problem-specific information 2010 match (S201). If there is no matching record (No in S202), the entire process ends. If there is a matching record (Yes in S202), the correction candidate generation unit 203 replaces the argument name of the correction general-purpose code in the correction record 2011 with the invalid function argument information in the problem information record 2021, and the correction actual code 204 is displayed. Generate (S203).

  As in the first embodiment, this embodiment has an effect of automatically generating correction code candidates that solve a software problem. This is because the correction candidate generation unit 203 generates and presents a correction code in the software source file based on the problem analysis information stored in the correction problem information storage unit 202 and the correction rules stored in the correction information storage unit 201. Because it does.

  While the present invention has been described with reference to the embodiments, the present invention is not limited to the above embodiments. Various changes that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

DESCRIPTION OF SYMBOLS 10 Security vulnerability correction apparatus 100 Security vulnerability verification result information acquisition part 101 Security vulnerability correction rule storage part 1010 Security vulnerability classification information 1011 Security vulnerability correction information 102 Security vulnerability verification result information storage part 1020 Security vulnerability classification information 1021 Detailed information on security vulnerabilities 103 Security vulnerability correction candidate presentation unit 104 Security vulnerability correction code 105 Security vulnerability correction location 106 Security vulnerability correction content reflection unit 11 Original source file 12 Security vulnerability verification tool 13 Verification result of verification tool 14 Source file after correction 15 User console 20 Software correction device 201 Correction information storage unit 2010 Problem type information 2011 Correction record De 202 issues information storage unit 2020 issues type information 2021 issue information record 203 fixes candidate generating unit 204 fixes the actual code

Claims (9)

Problem information storage means for storing a problem type including a name of an illegal function having a problem included in a software source code, and a problem information record including an argument name of the incorrect function related to the problem;
Correction information storage means for storing the problem type and a correction record that correlates a correction general-purpose code including an argument name for correcting the problem;
The problem information record and the problem type match are searched for the correction information record, and the argument name in the correction general-purpose code in the searched correction record is changed to the argument name in the searched problem information record. Correction candidate generation means for generating a correction actual code by replacing with an argument name;
A software correction device comprising: The problem information record further includes illegal function position information indicating the position of the illegal function in the source code,
The correction information record further includes correction processing information indicating the distinction of replacement or insertion,
Based on the incorrect function position information in the searched problem information record and the correction processing information included in the searched correction information record, the incorrect function of the source code is replaced with the corrected actual code, Or a correction reflecting means for inserting the corrected actual code before the illegal function of the source code,
The software correction device according to claim 1, further comprising: The problem type includes a software problem category in addition to the name of the unauthorized function.
The software correction apparatus according to claim 1. The correction information storage means includes a plurality of the correction information records having the same problem type and different correction general codes,
The correction candidate generation means searches the plurality of correction information records in which the problem type matches the problem type, generates the plurality of correction actual codes, and outputs them to a display device.
The software correction apparatus according to claim 1.   A software correction system including the software correction device according to claim 1 and a software problem analysis tool. A problem type record including the name of an illegal function in which the problem included in the software source code exists, and a problem information record including an argument name of the incorrect function related to the problem are stored in a storage area;
Storing the problem type and a correction record in which a correction general-purpose code including an argument name for correcting the problem is associated;
The problem information record and the problem type match are searched for the correction information record, and the argument name in the correction general-purpose code in the searched correction record is changed to the argument name in the searched problem information record. Replace with argument name to generate modified actual code,
Software correction method. The problem information record further includes illegal function position information indicating the position of the illegal function in the source code,
The correction information record further includes correction processing information indicating the distinction of replacement or insertion,
Based on the incorrect function position information in the searched problem information record and the correction processing information included in the searched correction information record, the incorrect function of the source code is replaced with the corrected actual code, Or the modified actual code is inserted before the illegal function in the source code,
The software correction method according to claim 6. A problem type including a name of an illegal function in which a problem included in a software source code exists, and a problem information storage process for storing a problem information record including an argument name of the incorrect function related to the problem in a storage area;
Correction information storage processing for storing the problem type and a correction record in which a correction general-purpose code including an argument name for correcting the problem is associated in a storage area;
The problem information record and the problem type match are searched for the correction information record, and the argument name in the correction general-purpose code in the searched correction record is changed to the argument name in the searched problem information record. Correction candidate generation processing for generating a correction actual code by replacing with an argument name,
Software modification program that causes a computer to execute. The problem information record further includes illegal function position information indicating the position of the illegal function in the source code,
The correction information record further includes correction processing information indicating the distinction of replacement or insertion,
Based on the incorrect function position information in the searched problem information record and the correction processing information included in the searched correction information record, the incorrect function of the source code is replaced with the corrected actual code, Alternatively, a modification reflection process for inserting the modified actual code before the illegal function of the source code,
The software correction program according to claim 8, further executed by a computer.

Images