一句话：提出上下文与分支敏感的静态分析 CoBrA，借助抽象域图与 stretch-relax 算法精确处理 PHP 动态特性，检测污点式漏洞。
PHP 广泛用于 Web 开发，但其动态函数名构造等动态特性使 SQL 注入、XSS 等污点式漏洞的静态检测十分困难。现有最先进方法多采用调用图引导的后向数据流追踪，无法分析可变函数等动态特性与控制结构，导致较高的误报与漏报。本文设计并实现 CoBrA，一种上下文敏感、分支敏感的分析方法，其核心创新是用于高效引导分析的抽象域图（ADG），以及可准确解析 PHP 动态特性并高效进行过程间污点传播的“stretch-relax”算法。作者在真实应用上评估原型，发现 19 个应用中的 54 个零日漏洞并获得 9 个 CVE 编号；在 PHP tarpits 数据集上达到 88.66% 的检测率、误报率低于 0.3%，并在所有测试数据集上以合理的时间与空间开销优于四个最先进工具。
PHP, a widely-used programming language in Web development, contains powerful dynamic features (e.g., dynamic function name construction), making static detection of taint-style vulnerabilities like SQL injection and XSS challenging. State-of-the-art (SoTA) static approaches perform call graph-guided backward dataflow tracking, thus failing to analyze those dynamic PHP features, like variable functions, and control structures, which results in high false positives and negatives. In this paper, we design and implement CoBrA, a context-, branch-sensitive approach to detect taint-style vulnerabilities in PHP-based Web applications. The key innovations are the abstract domain graph (ADG), which is used to efficiently guide the analysis, and a ‘‘stretch-relax’’ algorithm, which enables accurate resolution of PHP dynamic features and efficient inter-procedural taint propagation. Our evaluation of CoBrA’s prototype identified 54 zero-day vulnerabilities in 19 real-world applications with nine CVE identifiers assigned, achieved 88.66% detection rate with under 0.3% false positives on a PHP tarpits dataset, and outperformed four SoTA tools across all test datasets with reasonable time and space consumption.
@inproceedings{paperbot11815,
title = {CoBrA: Context-, Branch-sensitive Static Analysis for Detecting Taint-style Vulnerabilities in PHP Web Applications},
author = {Yichao Xu and Mingqing Kang and Neil Thimmaiah and Rigel Gjomemo and V. N. Venkatakrishnan and Yinzhi Cao},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3744916.3773195}
}