TaintRadar: Semantic-Aware Taint-Style Vulnerability Detection via Augmented Code Property Graphs

2026-07-17

AI Summary

Static taint analysis often suffers from high false positives or false negatives due to coarse-grained sanitization modeling, blind spots in database propagation, and insufficient handling of object-level data flows. This work proposes an enhanced code property graph approach that jointly models sanitization logic, persistent propagation, and object field–level name semantics for the first time. It introduces vulnerability-type-aware sanitization analysis, a database-state-aware cross-script propagation mechanism, and object-aware reaching definitions, further integrating context-sensitive parameter binding, database schema constraints, and query safety verification. Evaluated on the SARD benchmark, the method maintains 80% accuracy while significantly reducing false positives. In experiments on 19 real-world PHP applications, it successfully reproduces most known CVEs and uncovers 29 previously undisclosed zero-day vulnerabilities—26 SQL injections and 3 stored XSS flaws.

Abstract

Despite significant advances, static vulnerability analysis suffers from three critical limitations: coarse sanitization modeling, which treats validation as a binary barrier; database blindness, which breaks taint tracking across persistence layers; and shallow object-oriented analysis, which misses field-level and interprocedural data flows. These flaws stem from a common root cause: Code Property Graph (CPG)-based taint analyses lack a compositional semantic layer to jointly model sanitization, persistence, and object aliasing. Consequently, existing tools generate excessive false positives or miss critical attack paths entirely. To address these limitations, we present TaintRadar, an approach that systematically augments CPGs with three semantic analysis layers. First, vulnerability-typed sanitization computes node-level safety guarantees using transfer functions and context-sensitive parameter binding. Second, persistence-aware propagation integrates database schema constraints and query safety analysis to track multi-script attack paths traversing shared database states. Finally, object-aware reaching definitions combine calling and bounded variable alias contexts to precisely model object-field mutations across method boundaries. We evaluate TaintRadar on both synthetic benchmarks and real-world systems. On the SARD benchmark, TaintRadar drastically reduces false positives while maintaining 80% overall accuracy. Deployed across 19 real-world PHP applications, it rediscovered the majority of known CVEs and uncovered 29 confirmed zero-day vulnerabilities, including 26 SQL injection and 3 stored XSS vulnerabilities, that have already received CVE identifiers. These results demonstrate that semantic-aware graph augmentation significantly improves the precision, coverage, and practical utility of static taint analysis.

Problem

• taint analysis
• Code Property Graph
• sanitization modeling
• database blindness
• object-oriented analysis

Innovation

• semantic-aware taint analysis
• augmented Code Property Graph
• persistence-aware propagation
• object-aware reaching definitions
• vulnerability-typed sanitization