Due to its ability to detect many frequently occurring security vulnerabilities, taint analysis is one of the core static analyses used by many static application security testing (SAST) tools. Previous studies have identified issues that software developers face with SAST tools. This paper reports on our experience in building a configurable taint analysis tool, named SECUCHECK, that runs in multiple integrated development environments. SECUCHECK is built on top of multiple existing components and comes with a Java-internal domain-specific language fluentTQL for specifying taint-flows, designed for software developers. We evaluate the applicability of SECUCHECK in detecting eleven taint-style vulnerabilities in microbench programs and three real-world Java applications with known vulnerabilities. Empirically, we identify factors that impact the runtime of SECUCHECK.

SecuCheck: Engineering configurable taint analysis for software developers

Welcome to the 21st IEEE International Working Conference on Source Code Analysis and Manipulation (SCAM 2021)! 

We hope that you enjoy the conference and that it will inspire you in your future research.

Should you require a certificate of participation please contact Alexander Serebrenik, the general chair of SCAM, at a.serebrenik@tue.nl.

For questions related to the Morressier virtual platform please contact support@morressier.com.