Trace view

AppScan® Source performs input/output analysis and identifies and displays these vulnerabilities. An icon appears in the findings list to identify the row that contains an AppScan® Source trace graph.

In the Trace view, you see the root node, where the input and output stacks meet. The input stack is a series of calls that lead to a source known to provide tainted data. The output stack is a series of calls that lead to a sink. An AppScan® Source trace is generated when the code analyzed can track the use of an unprotected source to an unprotected sink.

• Source: A source is an input to the program, such as a file, servlet request, console input, or socket. For most input sources, the data returned is unbounded in terms of content and length. When an input is unchecked, it is considered tainted. Sources are listed in any findings table in the Source column.
• Sink: A sink can be any external format to which data can be written out. Sink examples include databases, files, console output, and sockets. Writing data to a sink without checking it may indicate a serious security vulnerability.
• Lost Sink A lost sink is an API method that can no longer be traced.

This diagram illustrates the call sequence from the root through the input stack and the output stack.

In the diagram:

• Unfilled arrows show a call that does not have a known tainted data flow.
• Filled arrows have potentially tainted data. Dashed lines show a return path.
• Solid® lines represent a method call.