Google Code Search for Security Vulnerabilities
Stephen de Vries sent an email to SecurityFocus's web application security mailing list earlier today to comment on the new Google Code Search:
Google's code search provides an easy way to find obvious software flaws in open source and example applications.
He provided a few example queries to illustrate his point:
There is certainly some potential for abuse. Here are a few queries for PHP and MySQL vulnerabilities off the top of my head:
- XSS due to echoing raw input: lang:php echo.*\$_(GET|POST)
- XSS due to echoing
$_SERVER['PHP_SELF']: lang:php echo.*\$_SERVER\['PHP_SELF'] - SQL injection due to using raw input directly in
mysql_query(): lang:php mysql_query\(.*\$_(GET|POST).*\) - SQL injection due to using raw input directly in a
WHEREclause: lang:php "WHERE username='$_" - Vulnerabilities due to a misplaced trust in
$_SERVER['HTTP_REFERER']: lang:php \$_SERVER\['HTTP_REFERER']
There are a few false positives in these results, but hopefully it's clear that with a little bit of effort, it's easy to create a collection of queries to search for common web application security vulnerabilities.
Maybe I'm being naive, but I see a silver lining. With this tool that Google has created, it seems possible to develop a useful static analysis tool for the source code that's in the index. As easily as vulnerabilities can be discovered by the bad guys, they can also be discovered by the good guys.
Can you think of some good queries to add to this list? Please share!
del.icio.us
Digg
Reddit
Newsvine
19 Comments
1.
fett said:
2.
Chris Shiflett said:
3.
Peter said:
4.
Pierre said:
5.
Chris Shiflett said:
6.
Tim said:
7.
Chris Shiflett said:
8.
metapundit said:
9.
Chris Shiflett said:
10.
Pure-PHP said:
11.
Chris Shiflett said:
12.
Aubrey Kilian said:
13.
kae verens said:
14.
Chris Shiflett said:
15.
nobody said:
16.
nobody said:
17.
Ivan Markovic said:
18.
Chris Shiflett said:
19.
Chris Shiflett said: