一句话：提出首个针对 Graph API 的静态与动态污点分析系统方法，用图变换与临界对分析系统性检测访问控制失效。
Graph API（如 GraphQL）中访问控制失效是常见且危险的安全缺陷，但此前缺乏系统化的污点分析手段。本文将 Graph API 中需要特定权限才能读取或操作的数据所对应的节点标记为污点，并识别与 source 和 sink 相关的 API 调用；随后用图变换规则建模 API 调用，借助临界对分析（Critical Pair Analysis）自动分析 source 规则与 sink 规则之间的潜在依赖，区分直接与间接的污点信息流，并讨论了临界对分析能够检测间接流的条件。静态污点分析一方面识别出需人工复核的流（污点节点由一个 API 调用创建、后被另一个调用在无必要权限下使用或篡改），另一方面可系统化地指导动态安全测试的设计；动态污点分析则验证静态阶段发现的潜在风险是否真实发生。作者将该方法应用于 GitHub GraphQL API 的一部分，结果表明其能系统检测两类访问控制失效：用户本应能访问或操作却被拒绝，以及用户或攻击者能够访问或篡改其不应触及的信息。
We present the first systematic approach to static and dynamic taint analysis for Graph APIs focusing on broken access control. The approach comprises the following. We taint nodes of the Graph API if they represent data requiring specific privileges in order to be retrieved or manipulated, and identify API calls which are related to sources and sinks. Then, we statically analyze whether a tainted information flow between API source and sink calls occurs. To this end, we model the API calls using graph transformation rules. We subsequently use Critical Pair Analysis to automatically analyze potential dependencies between rules representing source calls and rules representing sink calls. We distinguish direct from indirect tainted information flow and argue under which conditions the Critical Pair Analysis is able to detect not only direct, but also indirect tainted flow. The static taint analysis (i) identifies flows that need to be further reviewed, since tainted nodes may be created by an API call and used or manipulated by another API call later without having the necessary privileges, and (ii) can be used to systematically design dynamic security tests for broken access control. The dynamic taint analysis checks if potential broken access control risks detected during the static taint analysis really occur. We apply the approach to a part of the GitHub GraphQL API. The application illustrates that our analysis supports the detection of two types of broken access control systematically: the case where users of the API may not be able to access or manipulate information, although they should be able to do so; and the case where users (or attackers) of the API may be able to access/manipulate information that they should not.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@article{LambersSKO26,
title = {Taint Analysis for Graph APIs Focusing on Broken Access Control},
author = {Leen Lambers and Lucas Sakizloglou and Taisiya Khakharova and Fernando Orejas},
journal = {Logical Methods in Computer Science},
volume = {Volume 22, Issue 1},
year = {2026},
doi = {10.46298/lmcs-22(1:18)2026}
}