System and method for dynamic analysis tracking object associations for application dataflow

• US 9,177,137 B2
• Filed: 10/30/2013
• Issued: 11/03/2015
• Est. Priority Date: 12/14/2012
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Gluck, Yoel, Wang, Xiaoran
• Primary Examiner(s): Truong, Thanhnga B
• Application Number:
  US14/067,247
• Publication Number:
  US 20140173743A1
• Time in Patent Office: 734 Days
• Field of Search: 726 22- 25, 717/130, 707/736, 707/800
• US Class Current: 1/1
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Data source information is recorded into a source tracking object embedded in a wrapper object pointing to a data object from the data source. Tracking event information is recorded into a flow tracking object embedded in a wrapper object copy as the tracking event processes the wrapper object copy. Other tracking event information is recorded into another flow tracking object embedded in another wrapper object as the other tracking event processes the other wrapper object. The flow tracking object is associated with the other flow tracking object in response to a field retrieval of the wrapper object copy from the other wrapper object. The wrapper object copy is output to a data sink. Data sink information is recorded into a sink tracking object embedded in the wrapper object copy. The tracking objects are output as dynamic analysis of dataflow in the application program.

Claims

1. An apparatus for dynamic analysis tracking object associations for application dataflow, the apparatus comprising:

a processor; and

one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of;

creating a first wrapper object that points to a data object received from a data source;

creating a source tracking object for the first wrapper object;

recording information associated with the data source into the source tracking object;

creating a copy of the first wrapper object for a first tracking event in an application program;

creating a first flow tracking object for the first tracking event;

recording information associated with the first tracking event into the first flow tracking object as the first tracking event processes the copy of the first wrapper object;

creating a second wrapper object for a second tracking event in the application program;

creating a second flow tracking object for the second tracking event;

recording information associated with the second tracking event into the second flow tracking object as the second tracking event processes the second wrapper object;

associating the first flow tracking object with the second flow tracking object in response to a field retrieval of the copy of the first wrapper object from the second wrapper object;

outputting the copy of the first wrapper object to a data sink for the application program;

creating a sink tracking object for the data sink;

recording information associated with the data sink into the sink tracking object; and

outputting the source tracking object, the first flow tracking object, the associated second flow tracking object, and the sink tracking object as dynamic analysis of dataflow in the application program.

2. The apparatus of claim 1, wherein the steps further comprise:

connecting the source tracking object with the first wrapper object;

connecting the first flow tracking object with the copy of the first wrapper object;

connecting the second flow tracking object with the second wrapper object; and

connecting the sink tracking object with the copy of the first wrapper object.

3. The apparatus of claim 1, wherein the first tracking event comprises a field assignment of the copy of the first wrapper object to a field of the second wrapper object.

4. The apparatus of claim 1, wherein outputting the source tracking object, the first flow tracking object, the associated second flow tracking object, and the sink tracking object comprises outputting the sink tracking object as a first node in a graph, the first flow tracking object as a second node in the graph, the associated second flow tracking object as a third node in the graph, and the sink tracking object as a fourth node in the graph, wherein the second node is linked to the first node, the third node is linked to the second node, and the fourth node is linked to the third node to depict the dataflow sequence of the graph.

5. The apparatus of claim 1, wherein the steps further comprise deleting an out of scope flow tracking object when the application program lacks a subsequent reference to a wrapper object associated with the out of scope flow tracking object.

6. A non-transitory machine-readable medium carrying one or more sequences of instructions for dynamic analysis tracking object associations for application dataflow, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of:

creating a first wrapper object that points to a data object received from a data source;

creating a source tracking object for the first wrapper object;

recording information associated with the data source into the source tracking object;

creating a copy of the first wrapper object for a first tracking event in an application program;

creating a first flow tracking object for the first tracking event;

recording information associated with the first tracking event into the first flow tracking object as the first tracking event processes the copy of the first wrapper object;

creating a second wrapper object for a second tracking event in the application program;

creating a second flow tracking object for the second tracking event;

recording information associated with the second tracking event into the second flow tracking object as the second tracking event processes the second wrapper object;

associating the first flow tracking object with the second flow tracking object in response to a field retrieval of the copy of the first wrapper object from the second wrapper object;

outputting the copy of the first wrapper object to a data sink for the application program;

creating a sink tracking object for the data sink;

recording information associated with the data sink into the sink tracking object; and

outputting the source tracking object, the first flow tracking object, the associated second flow tracking object, and the sink tracking object as dynamic analysis of dataflow in the application program.

7. The non-transitory machine-readable medium of claim 6, wherein the steps further comprise:

connecting the source tracking object with the first wrapper object;

connecting the first flow tracking object with the copy of the first wrapper object;

connecting the second flow tracking object with the second wrapper object; and

connecting the sink tracking object with the copy of the first wrapper object.

8. The non-transitory machine-readable medium of claim 6, wherein the first tracking event comprises a field assignment of the copy of the first wrapper object to a field of the second wrapper object.

9. The non-transitory machine-readable medium of claim 6, wherein outputting the source tracking object, the first flow tracking object, the associated second flow tracking object, and the sink tracking object comprises outputting the sink tracking object as a first node in a graph, the first flow tracking object as a second node in the graph, the associated second flow tracking object as a third node in the graph, and the sink tracking object as a fourth node in the graph, wherein the second node is linked to the first node, the third node is linked to the second node, and the fourth node is linked to the third node to depict the dataflow sequence of the graph.

10. The non-transitory machine-readable medium of claim 6, wherein the steps further comprise deleting an out of scope flow tracking object when the application program lacks a subsequent reference to a wrapper object associated with the out of scope flow tracking object.

11. A method for dynamic analysis tracking object associations for application dataflow, the method comprising:

creating, by a computing system having at least one processor, a first wrapper object that points to a data object received from a data source;

creating, by the computing system, a source tracking object for the first wrapper object;

recording, by the computing system, information associated with the data source into the source tracking object;

creating, by the computing system, a copy of the first wrapper object for a first tracking event in an application program;

creating, by the computing system, a first flow tracking object for the first tracking event;

recording, by the computing system, information associated with the first tracking event into the first flow tracking object as the first tracking event processes the copy of the first wrapper object;

creating, by the computing system, a second wrapper object for a second tracking event in the application program;

creating, by the computing system, a second flow tracking object for the second tracking event;

recording, by the computing system, information associated with the second tracking event into the second flow tracking object as the second tracking event processes the second wrapper object;

associating, by the computing system, the first flow tracking object with the second flow tracking object in response to a field retrieval of the copy of the first wrapper object from the second wrapper object;

outputting, by the computing system, the copy of the first wrapper object to a data sink for the application program;

creating, by the computing system, a sink tracking object for the data sink;

recording, by the computing system, information associated with the data sink into the sink tracking object; and

outputting, by the computing system, the source tracking object, the first flow tracking object, the associated second flow tracking object, and the sink tracking object as dynamic analysis of dataflow in the application program.

12. The method of claim 11, wherein the method further comprises:

connecting, by the computing system, the source tracking object with the first wrapper object;

connecting, by the computing system, the first flow tracking object with the copy of the first wrapper object;

connecting, by the computing system, the second flow tracking object with the second wrapper object; and

connecting, by the computing system, the sink tracking object with the copy of the first wrapper object.

13. The method of claim 11, wherein the first tracking event comprises a field assignment of the copy of the first wrapper object to a field of the second wrapper object.

14. The method of claim 11, wherein outputting the source tracking object, the first flow tracking object, the associated second flow tracking object, and the sink tracking object comprises outputting the sink tracking object as a first node in a graph, the first flow tracking object as a second node in the graph, the associated second flow tracking object as a third node in the graph, and the sink tracking object as a fourth node in the graph, wherein the second node is linked to the first node, the third node is linked to the second node, and the fourth node is linked to the third node to depict the dataflow sequence of the graph.

15. The method of claim 11, wherein the method further comprises deleting, by the computing system, an out of scope flow tracking object when the application program lacks a subsequent reference to a wrapper object associated with the out of scope flow tracking object.

16. A method for transmitting code for dynamic analysis tracking object associations for application dataflow, the method comprising:

transmitting code, by at least one processor, to create a first wrapper object that points to a data object received from a data source;

transmitting code, by the at least one processor, to create a source tracking object for the first wrapper object;

transmitting code, by the at least one processor, to record information associated with the data source into the source tracking object;

transmitting code, by the at least one processor, to create a copy of the first wrapper object for a first tracking event in an application program;

transmitting code, by the at least one processor, to create a first flow tracking object for the first tracking event;

transmitting code, by the at least one processor, to record information associated with the first tracking event into the first flow tracking object as the first tracking event processes the copy of the first wrapper object;

transmitting code, by the at least one processor, to create a second wrapper object for a second tracking event in the application program;

transmitting code, by the at least one processor, to create a second flow tracking object for the second tracking event;

transmitting code, by the at least one processor, to record information associated with the second tracking event into the second flow tracking object as the second tracking event processes the second wrapper object;

transmitting code, by the at least one processor, to associate the first flow tracking object with the second flow tracking object in response to a field retrieval of the copy of the first wrapper object from the second wrapper object;

transmitting code, by the at least one processor, to output the copy of the first wrapper object to a data sink for the application program;

transmitting code, by the at least one processor, to create a sink tracking object for the data sink;

transmitting code, by the at least one processor, to record information associated with the data sink into the sink tracking object; and

transmitting code, by the at least one processor, to output the source tracking object, the first flow tracking object, the associated second flow tracking object, and the sink tracking object as dynamic analysis of dataflow in the application program.

17. The method for transmitting code of claim 16, wherein the method further comprises:

transmitting code, by the at least one processor, to connect the source tracking object with the first wrapper object;

transmitting code, by the at least one processor, to connect the first flow tracking object with the copy of the first wrapper object;

transmitting code, by the at least one processor, to connect the second flow tracking object with the second wrapper object; and

transmitting code, by the at least one processor, to connect the sink tracking object with the copy of the first wrapper object.

18. The method for transmitting code of claim 16, wherein the first tracking event comprises a field assignment of the copy of the first wrapper object to a field of the second wrapper object.

19. The method for transmitting code of claim 16, wherein transmitting code to output the source tracking object, the first flow tracking object, the associated second flow tracking object, and the sink tracking object comprises transmitting code to output the sink tracking object as a first node in a graph, the first flow tracking object as a second node in the graph, the associated second flow tracking object as a third node in the graph, and the sink tracking object as a fourth node in the graph, wherein the second node is linked to the first node, the third node is linked to the second node, and the fourth node is linked to the third node to depict the dataflow sequence of the graph.

20. The method for transmitting code of claim 16, wherein the method further comprises transmitting code, by the at least one processor, to delete an out of scope flow tracking object when the application program lacks a subsequent reference to a wrapper object associated with the out of scope flow tracking object.