Facebook has open-source Pysa, an internal tool used on Instagram to find and fix bugs in the app's huge Python codebase. Pysa can automatically identify vulnerable snippets written by Facebook engineers before they are integrated into social network systems.
It is a static analysis tool, which means that it works by scanning code in a "static" form before the code is compiled. It searches for common patterns typically seen in bugs and reports potential issues in the code.
Facebook developed Pysa in-house and claims the tool has now reached maturity through continuous improvement. He says that in the first half of 2020, Pysa was able to detect 44% of all security bugs in Instagram's server-side Python code.
Pysa was designed exclusively to analyze code written in the Python programming language. So this creates some limits as to where the tool can be used, but given that Python's popularity has increased in recent years, it is very useful.
Read also: PyOxidizer can turn Python code into applications for Windows, MacOS, LinuxHow does Pysa detect security issues in the Python code base?
Pysa detects security issues by tracking the flow of data through an app and checks if it ends up somewhere it isn't supposed to.
For example, developers can use this tool to verify whether the input that a user enters in a public website form is sent directly to the back-end database without being parsed. This helps identify vulnerabilities that hackers can manipulate to inject malicious code into the application's database.
While it looks pretty, in reality, it's not because data doesn't always take a direct path inside an app. Any input entered into a website form may have to go through multiple components before reaching the vulnerable backend database. In such cases, finding the weak spots in security can be quite difficult. This usually happens in the complex code base of large platforms with a large number of components.
To solve this problem, Pysa analyzes the code layer by layer. He is doing "Iterative analysis cycles to create summaries to determine which functions return data from a source and which functions have parameters that ultimately reach a sink."
Image: Facebook This open-source tool for Python has refined itself after months of internal testing to find vulnerable code specific to common security issues like cross-site scripting, remote code executions, SQL injections, and more.
You can read more about Pysa here.
Read also: Piranha is an open source tool that automatically removes obsolete codePysa is fast and works well on a large codebase
The Python tool was designed for the speed and the ability to traverse millions of lines of code between 30 minutes and hours. That's why Pysa can identify bugs almost in real time. It also helps Facebook's developer teams to feel secure and confident about using this tool in their regular workflows and routines without worrying about whether it will delay the timelines for the shipping code.
