TaintRadar: Semantic-Aware Taint-Style Vulnerability Detection via Augmented Code Property Graphs
Cryptography and Security
Summary
The authors identify three major problems with current static vulnerability analysis: overly simple handling of input checks, losing track of data stored in databases, and missing detailed object data flows. They introduce TaintRadar, which improves analysis by adding semantic layers that better model input sanitization, database interactions, and object field changes. Tested on benchmarks and real applications, TaintRadar reduced false alarms and found many known and new security flaws. This shows that adding deeper context to analysis graphs helps detect vulnerabilities more accurately.
Authors
Elie Rizk, Firas Ben Hmida, Birhanu Eshete
Abstract
Despite significant advances, static vulnerability analysis suffers from three critical limitations: coarse sanitization modeling, which treats validation as a binary barrier; database blindness, which breaks taint tracking across persistence layers; and shallow object-oriented analysis, which misses field-level and interprocedural data flows. These flaws stem from a common root cause: Code Property Graph (CPG)-based taint analyses lack a compositional semantic layer to jointly model sanitization, persistence, and object aliasing. Consequently, existing tools generate excessive false positives or miss critical attack paths entirely. To address these limitations, we present TaintRadar, an approach that systematically augments CPGs with three semantic analysis layers. First, vulnerability-typed sanitization computes node-level safety guarantees using transfer functions and context-sensitive parameter binding. Second, persistence-aware propagation integrates database schema constraints and query safety analysis to track multi-script attack paths traversing shared database states. Finally, object-aware reaching definitions combine calling and bounded variable alias contexts to precisely model object-field mutations across method boundaries. We evaluate TaintRadar on both synthetic benchmarks and real-world systems. On the SARD benchmark, TaintRadar drastically reduces false positives while maintaining 80% overall accuracy. Deployed across 19 real-world PHP applications, it rediscovered the majority of known CVEs and uncovered 29 confirmed zero-day vulnerabilities, including 26 SQL injection and 3 stored XSS vulnerabilities, that have already received CVE identifiers. These results demonstrate that semantic-aware graph augmentation significantly improves the precision, coverage, and practical utility of static taint analysis.