Ispitivanje alata za statičku analizu koda pisanog u programskom jeziku PHP

undergraduate thesis

• Title (english): Testing Tools for Static Code Analysis of Applications Written in PHP Programming Language
• Author: Anđelo Kandić
• Mentor: Stjepan Groš (mentor)
• Committee member: Stjepan Groš (predsjednik povjerenstva)
• Committee member: Miljenko Mikuc (član povjerenstva)
• Committee member: Mladen Karan (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2017-09-13, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Computing
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Electrical Engineering

Abstract

U ovom radu proučene su tehnike te načini na koji općenito rade alati za statičku analizu koda koji pronalaze sigurnosne propuste. Pri tome je bio naglasak na programskom jeziku PHP i načinu na koji dolazi do sigurnosnih propusta unutar PHP-a. Pronađeni su alati za statičku analizu koda pisanog u programskom jeziku PHP te su izdvojeni i objašnjeni najkorisniji od njih. Nakon toga je pronađena baza s izvornim kodovima ispitnih slučajeva uz pomoću koje se napravila struktura repozitorija na kojoj se mogu vršiti testiranja alata za statičku analizu koda. Na kraju je napravljena skripta pomoću koje se mogu pokrenuti svi statički analizatori koda odjednom nad ispitnim slučajevima unutar repozitorija.

Abstract (english)

This paper describes techniques and ways that have been studied in which generic static code analysis tools are used to find security vulnerabilities. There was an emphasis on PHP programming language and the way PHP vulnerabilities occur. Then, static code analysis tools for the code that was written in the PHP programming language were found and explained the most useful of them. Afterwards, a base with the source code of the test cases was found, which was used to create a repository that could be used to test the static code analysis tools. At the end, a script was created by which all static analyzers could be run at once on test cases within the repository.

• Keywords: računalna sigurnost; PHP; statička analiza koda; sigurnosni propusti
• Keywords (english): computer security; PHP; static code analysis; security flaws
• Language: croatian
• URN:NBN: urn:nbn:hr:168:506561
• Study programme: Title: Computing; Study programme type: university; Study level: undergraduate; Academic / professional title: sveučilišni/a prvostupnik/ prvostupnica (baccalaureus/baccalaurea) inženjer/inženjerka računarstva (sveučilišni/a prvostupnik/ prvostupnica (baccalaureus/baccalaurea) inženjer/inženjerka računarstva)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2019-03-13 21:25:41