Do You Speak My Language? Make Static Analysis Engines Understand Each Other

This presentation will introduce a novel but generic framework to exchange taint information between two or more static analysis systems and how that can be used to perform cross-language, cross-repo taint-flow analysis. It will showcase how this has been implemented inside Facebook and used at scale by Facebook’s security team to detect critical security vulnerabilities spanning multiple codebases. During the presentation, we will show examples of the actual vulnerabilities where the data flow crosses from one language to another.... By: Ibrahim Elsayed & Manuel Fahndrich Full Abstract & Presentation Materials: #do-you-speak-my-language-make-static-analysis-engines-understand-each-other-22797