Static detection of security vulnerabilities in scripting languages
Published 31 July 2006
Yichen Xie, Alex Aiken
Citations370
Generate an AI Snapshot to get a quick, structured summary of this paper.
Study Snapshot
ObjectiveStudy objective
MethodsResearch methodology
PopulationPopulation studied
Sample sizeSample sizes
OutcomesStudy outcomes here
ResultsStudy results comes here
LimitationsResearch study limitations comes here
A concise AI-generated summary of the paper will appear here once you click Generate AI Snapshot.
TL;DR
A static analysis algorithm for detecting security vulnerabilities in PHP, a popular server-side scripting language for building web applications, is presented, finding 105 previously unknown security vulnerabilities, most of which it believes are remotely exploitable.
Abstract
We present a static analysis algorithm for detecting security vulnerabilities in PHP, a popular server-side scripting language for building web applications. Our analysis employs a novel three-tier architecture to capture information at decreasing levels of granularity at the intrablock, intraprocedural, and interprocedural level. This architecture enables us to handle dynamic features of scripting languages that have not been adequately addressed by previous techniques. We demonstrate the effectiveness of our approach on six popular open source PHP code bases, finding 105 previously unknown security vulnerabilities, most of which we believe are remotely exploitable. 1
Keywords
Computer Science
Cloning-based context-sensitive pointer alias analysis using binary decision diagrams
593 Citations2004John Whaley, Monica S. Lam
This paper presents the first scalable context-sensitive, inclusion-based pointer alias analysis for Java programs, and develops a system called bddbddb that automatically translates Datalog programs into highly efficient BDD implementations.
Finding security vulnerabilities in java applications with static analysis
582 Citations2005V. Benjamin Livshits, Monica S. Lam
This paper proposes a static analysis technique for detecting many recently discovered application vulnerabilities such as SQL injections, cross-site scripting, and HTTP splitting attacks based on a scalable and precise points-to analysis.
Securing web application code by static analysis and runtime protection
562 Citations2004Yao‐Wen Huang, Fang Yu +4 more
A lattice-based static analysis algorithm derived from type systems and typestate is created, and its soundness is addressed, thus securing Web applications in the absence of user intervention and reducing potential runtime overhead by 98.4%.
IFIP advances in information and communication technologyAutomatically Hardening Web Applications Using Precise Tainting
390 Citations2005Anh Nguyen‐Tuong, Salvatore Guarnieri +3 more
This paper presents a fully automated approach to securely hardening web applications based on precisely tracking taintedness of data and checking specifically for dangerous content only in parts of commands and output that came from untrustworthy sources.
Flow-sensitive type qualifiers
377 Citations2002Jeffrey S. Foster, Tachio Terauchi +1 more
An efficient constraint-based inference algorithm is obtained that integrates flow-insensitive alias analysis, effect inference, and ideas from linear type systems to support strong updates.
A system and language for building system-specific, static analyses
352 Citations2002Seth Hallem, Benjamin Chelf +2 more
A flexible, easy-to-use extension language for specifying analyses and an efficent algorithm for executing these extensions, which believe is an effective framework for deploying new bug-finding analyses quickly and easily.
Abstracting application-level web security
247 Citations2002David Scott, Richard R. Sharp
A scalable structuring mechanism facilitating the abstraction of security policies from large web-applications developed in heterogenous multi-platform environments is described and a tool which assists programmers develop secure applications which are resilient to a wide range of common attacks is presented.
Soft typing with conditional types
212 Citations1994Alex Aiken, Edward L. Wimmers +1 more
A simple and powerful type inference method for dynamically typed languages where no type information is supplied by the user, and conditional types enable us to analyze control flow using type inference, thus facilitating computation of accurate types.
Using programmer-written compiler extensions to catch security holes
204 Citations2005Ken Ashcraft, Dawson Engler
Static checking of dynamically generated queries in database applications
173 Citations2004Carl Gould, Zhendong Su +1 more
ACM Transactions on Programming Languages and SystemsA practical soft type system for scheme
105 Citations1997Andrew K. Wright, Robert Cartwright
Soft Scheme is a practical soft type checker for R4RS Scheme that accommodates all of R4 RS Scheme including uncurried procedures of fixed and variable arity, assignment, and continuations.
ACM Transactions on Software Engineering and MethodologyStatic checking of dynamically generated queries in database applications
98 Citations2007Gary Wassermann, Carl Gould +2 more
A sound, static, program analysis technique to verify the correctness of dynamically generated query strings and describes the details of a prototype tool based on the algorithm and presents several illustrative defects found in senior software-engineering student-team projects, online tutorial examples, and a real-world purchase order system.
MECA
43 Citations2003Junfeng Yang, Ted Kremenek +2 more
A system and annotation language, MECA, for checking security rules, which provides a variety of practical constructs to effectively annotate large bodies of code and frees programmers from the heavy manual effort required by most past systems.