A Multi-Language Parser Pipeline for Software Analysis and Verification

Abstract

Complex source code analysis tasks for program understanding, verification, and compliance with regulatory frameworks and standards require appropriate in-memory models of the source code being analyzed. We present a flexible, multi-language pipeline supporting such analyses. By leveraging configurable front-end parsers and corresponding EBNF grammars, the pipeline automatically identifies the source language, provisions the appropriate parsers and AST factories, and dynamically generates in-memory Abstract Syntax Trees (ASTs) tailored for source code analysis rather than traditional compilation. Individual ASTs generated per source file are linked into a unified structure representing the entire application, with semantic linking that resolves references to functions and variables while respecting scoping. We demonstrate the approach on compliance analyses that trace sensitive data across Java and C++ modules and detect violations of NIST 800-53 controls, and show that it is tractable with respect to parsing time and the size of the ASTs generated.