Static Analyser for Insecure Code Patterns
A static analysis tool that parses source code into an abstract syntax tree and finds a defined set of security flaws, using data flow analysis rather than regular expressions. Building a real taint tracker is a proper computer science project.
Advanced
Needs a team, real planning, and a supervisor who knows the area.1 semester, 2 to 3 students
5 to ship
3 optional extrasSuggested stack
What you should ship
- Parser producing an abstract syntax tree for one language using an established parsing library
- Data flow analysis tracking untrusted input from defined sources to dangerous sinks
- At least 6 implemented rules, including injection, unsafe deserialisation and hardcoded secrets
- Sanitiser recognition so a properly escaped path is not reported
- Evaluation against a deliberately vulnerable benchmark application, with precision and recall reported
If you have time left
- Interprocedural analysis following taint across function boundaries
- Automatic fix suggestions as a diff
- A second supported language reusing the analysis core
The problem
Most security linting is pattern matching over text, which produces both false positives on safe code and false negatives on anything written slightly unusually. Real analysis requires understanding the structure and the flow of data.
What you build
An abstract syntax tree, a taint analysis tracking values from untrusted sources to dangerous sinks, a rule set, and sanitiser recognition.
Why taint analysis is the right core
It is the difference between finding the word query near a plus sign and knowing that this particular string was built from a request parameter and reaches a database call without escaping. Implementing it is a genuine programme analysis exercise and it is achievable at intraprocedural scope in a semester.
The feature that determines whether anyone would use it
Sanitiser recognition. A tool that reports every string reaching a query, including correctly parameterised ones, is noise and gets switched off. Modelling which functions neutralise taint is what makes the output trustworthy.
How to evaluate it
Use an established deliberately vulnerable application as your benchmark, where the flaws are documented, and report precision and recall against that ground truth. Then run it on a real open source project and report the false positive rate honestly.
Scope warning
One language, intraprocedural analysis, six rules done properly. Interprocedural analysis across a whole codebase is a research project.
Ideas and guidance, not finished projects
These are project ideas and scoping guidance, published free for students to use as a starting point. I do not build, write, or sell final-year projects, and I do not complete coursework for anyone. Take an idea, make it yours, and build it.
Not sure this one fits you?
I help students pick an idea that matches their skills and their deadline, then scope it down until it is finishable. Guidance only, never done for you.
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Every session is free; a few slots open each week.
Follow along
New writing, resources and project ideas land here first.