Static Analyser for Insecure Code Patterns Using Taint Analysis
A static analysis tool for Python web projects that parses code into a syntax tree and uses taint analysis to track untrusted input to dangerous sinks, reporting injection, unsafe deserialisation and hardcoded secrets. An advanced security final year project in real program analysis, measured by precision and recall on a benchmark.
Advanced
Needs a team, real planning, and a supervisor who knows the area.2 semesters · 2 to 3 students
6 to ship
3 optional extrasSuggested stack
What you should ship
- A parser front end for one language (Python recommended) producing a syntax tree and a control flow graph per function
- Intraprocedural taint analysis that tracks untrusted input from defined sources (request parameters, files, environment) to dangerous sinks
- At least six rules, including SQL injection, command injection, path traversal, unsafe deserialisation, server-side template injection and hardcoded secrets
- Sanitiser modelling so parameterised queries and escaping functions stop taint, configurable in a rules file
- SARIF output so results appear in GitHub code scanning and editors, plus a simple web viewer with the source to sink path
- A labelled benchmark of at least 60 small vulnerable and safe code samples, and precision and recall reported against it and against Bandit and Semgrep
If you have time left
- Interprocedural analysis following taint across function calls within a file
- Automatic fix suggestions as a diff for common patterns
- A second language reusing the analysis core
The problem: pattern matching produces noise
Small software houses and startups rarely have a security team, so the only security check on most code is a linter or nothing. Much security linting is pattern matching: find a call to execute near a string concatenation. That produces false positives on safe code and misses anything written slightly differently. Developers learn to ignore the output, and real injection bugs ship.
Real analysis needs to understand structure and data flow: this particular string came from a request parameter, passed through two assignments, and reached a database call without being parameterised.
What already exists and the gap
- Bandit is an open source Python security linter that checks syntax tree patterns, with limited data flow.
- Semgrep Community Edition supports structural rules and taint rules within a function; deeper cross-file analysis is in its commercial tier.
- CodeQL from GitHub is a powerful query-based analyser, free for open source projects and part of a paid offering for private code.
- SonarQube combines code quality and security rules for many languages.
The strong analysers are either paid for private code or complex to extend, and the free ones are mostly pattern-based. For a student, the gap is educational as much as commercial: building a small taint analyser end to end, with sanitiser modelling and honest precision and recall, teaches program analysis that almost no portfolio shows. For small teams, a free, explainable tool with a short rules file is useful in its own right.
What you build
- Developer: runs the tool locally or in CI and gets findings with the path from source to sink.
- Security reviewer: reads SARIF results in GitHub or the web viewer and marks false positives.
- Rule author: adds sources, sinks and sanitisers in a rules file without touching the engine.
The technically interesting part
Taint analysis over a control flow graph. Build a control flow graph per function, then run a data flow analysis that propagates a "tainted" label through assignments, string operations, containers and returns until it reaches a fixed point. This is textbook compiler technique applied to security, and it is achievable within one function in the time available.
Sanitiser recognition. A tool that reports every string reaching a query, including correctly parameterised ones, is noise and gets switched off. Modelling which calls neutralise taint for which sink (escaping for HTML is not escaping for SQL) is what makes output trustworthy.
Explaining a finding. Report the exact path: line where input entered, each step it moved through, and the sink. Developers fix what they can follow.
How to evaluate it
- Benchmark: at least 60 labelled samples (vulnerable and safe variants per rule). Report precision and recall per rule.
- Comparison: run Bandit and Semgrep's free rules on the same benchmark and compare.
- Real code: run on three deliberately vulnerable apps such as OWASP PyGoat and on two real open source projects; report findings and the false positive rate after manual review.
- Performance: analysis time per thousand lines.
Suggested plan
- Weeks 1 to 4: read on data flow analysis, choose language and rules, build the benchmark first.
- Weeks 5 to 9: parser front end, control flow graph, first taint propagation.
- Weeks 10 to 14: six rules, sanitisers, rules file.
- Weeks 15 to 18: SARIF output, viewer, CI integration.
- Weeks 19 to 24: evaluation, comparison, tuning.
- Weeks 25 to 28: stretch goal if time allows, report and demo.
Path to a product
The realistic path is open source adoption: a small, well-documented analyser for Python web frameworks that teams add to CI in five minutes. From there, paid rule packs for specific frameworks or a hosted dashboard for small software houses are options. It is also a strong portfolio centrepiece for application security and developer tooling roles.
Scope warning
One language, intraprocedural analysis, six rules done properly. Whole-program interprocedural analysis and alias analysis are research projects. Do not build a general linter or an IDE plugin in the core scope.
Learn what you need on Sefism
- Crafting Interpreters : parsing, syntax trees and tree walking, explained clearly.
- Semgrep Community Edition : study how taint rules and sanitisers are expressed.
- GitHub Docs: Security and code quality : SARIF uploads and code scanning alerts.
- OWASP ASVS : which vulnerability classes matter and what correct code looks like.
- DSA roadmap : graphs and fixed-point iteration underpin the analysis.
Get help with this idea
This is a real program analysis project, and scope control is everything. Tauseef can help you pick the language and rules, plan the benchmark, and present precision and recall in a way examiners respect. If you are new here, create a free account first.
Ideas and guidance, not finished projects
These are project ideas and scoping guidance, published free for students to use as a starting point. I do not build, write, or sell final-year projects, and I do not complete coursework for anyone. Take an idea, make it yours, and build it.
Not sure this one fits you?
I help students pick an idea that matches their skills and their deadline, then scope it down until it is finishable. Guidance only, never done for you.
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
Follow along
New writing, resources and project ideas land here first.