一句话：提出统一 AST 的多语言静态污点分析框架 YASA，在蚂蚁集团大规模落地并发现 0-day 漏洞。
现代企业技术栈多样，给静态应用安全测试带来挑战；现有污点分析工具多为单语言，多语言工具在中间表示、精度与可扩展性上难以满足工业级需求。本文提出 YASA，一个面向工业规模部署的统一多语言静态污点分析框架。YASA 引入统一抽象语法树（UAST），为多语言提供统一抽象；在 UAST 上进行指向分析与污点传播，以统一语义模型处理语言无关构造，并用语言特定模型处理特有特性。在行业标准基准上，YASA 在 Java、JavaScript、Python 和 Go 上均优于 6 个单语言与 2 个多语言分析器。在蚂蚁集团部署中，它分析超 1 亿行代码、7.3K 应用，发现 314 条未知污点路径，92 个确认为 0-day 漏洞，76 个已修复。
Modern enterprises increasingly adopt diverse technology stacks with various programming languages, posing significant challenges for static application security testing (SAST). Existing taint analysis tools are predominantly designed for single languages, requiring substantial engineering effort that scales with language diversity. While multi-language tools like CodeQL, Joern, and WALA attempt to address these challenges, they face limitations in intermediate representation design, analysis precision, and extensibility, which make them difficult to scale effectively for large-scale industrial applications at Ant Group. To bridge this gap, we present YASA (Yet Another Static Analyzer), a unified multi-language static taint analysis framework designed for industrial-scale deployment. Specifically, YASA introduces the Unified Abstract Syntax Tree (UAST) that provides a unified abstraction for compatibility across diverse programming languages. Building on the UAST, YASA performs point-to analysis and taint propagation, leveraging a unified semantic model to manage language-agnostic constructs, while incorporating language-specific semantic models to handle other unique language features. When compared to 6 single- and 2 multi-language static analyzers on an industry-standard benchmark, YASA consistently outperformed all baselines across Java, JavaScript, Python, and Go. In real-world deployment within Ant Group, YASA analyzed over 100 million lines of code across 7.3K internal applications. It identified 314 previously unknown taint paths, with 92 of them confirmed as 0-day vulnerabilities. All vulnerabilities were responsibly reported, with 76 already patched by internal development teams, demonstrating YASA's practical effectiveness for securing large-scale industrial software systems.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{abs-2601-17390,
title = {YASA: Scalable Multi-Language Taint Analysis on the Unified AST at Ant Group},
author = {Yayi Wang and Shenao Wang and Jian Zhao and Shaosen Shi and Ting Li and Yan Cheng and Lizhong Bian and Kan Yu and Yanjie Zhao and Haoyu Wang},
booktitle = {FSE},
year = {2026},
doi = {10.1145/3803437.3805225}
}