Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>It's theoretically possible, but not likely. In essence what you're doing is asking a static analysis to use some auxiliary data to verify some claim. This is generally possible, but static analyses in general suffer from a degree of imprecision. For example if I have the code block:</p> <pre><code>If(getResultFromDB() == someResult) { do this; } else { do that; } </code></pre> <p>You essentially would like the analysis to complain at you if you write code in the first block of the if, because the database can never return someResult. This is possible in the theoretical sense, I mean it just needs to examine all possible return values for the function getResultFromDB() for a given database then conclude on an answer.</p> <p>The problem is this number can be absolutely massive. And this is a problem in general with static analyses, to get precise results, we need to consider ALL possible execution paths, inputs, contexts, etc. In practice that is simply not doable, so a static analysis will usually make concessions where it reduces the size of it's current set of possibilities.</p> <p>Edit: If you're interested in advanced static analysis in general, here's a fun analysis I read about done the other day. It tries to find possible XSS attacks in PHP source code. To find XSS attacks involving databases it actually simulates the effects of database queries in a sort of abstract database. <a href="http://www.cs.washington.edu/homes/mernst/pubs/create-attacks-tr054.pdf" rel="nofollow noreferrer">http://www.cs.washington.edu/homes/mernst/pubs/create-attacks-tr054.pdf</a></p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload