Year: 2025
Type: conference-paper
Abstract: Static Application Security Testing (SAST) is a cornerstone of modern vulnerability discovery, enabling tools like GitHub’s CodeQL to identify security flaws in code repositories. However, our large-scale analysis of open-source repositories reveals that SAST’s detection performance is limited by three main factors: (1) incomplete source and sink coverage in built-in propagation rules, (2) failure to recognize sanitization functions, and (3) disruptions in data flow due to insufficient support for certain language features. In this work, we demonstrate how Large Language Models (LLMs) can improve the identification of taint sources and sinks, as well as the recognition of sanitization functions. Using CodeQL as an example, we also introduce the implementation principles of SAST's Data Flow Analysis (DFA). Furthermore, we propose enhancing Java thread support to improve the accuracy of DFA.
Authors: Yuan Luo, Zhaojun Chen, Yuxin Dong, Haiquan Zhang, Yi Sun, Fei Xie, Zhiqiang Dong
Institutions: Tencent (China), Peking University
Language: English
Subfield: Software
Field: Computer Science
Domain: Physical Sciences
Open Access status: gold
Funder: Tencent
OpenAlex ID: W4415002696