Looking at web security vulnerabilities from the programming language perspective: A field study

Proceedings - International Symposium on Software Reliability Engineering, ISSRE

Volumn , Issue , 2009, Pages 129-135

  Seixas, Nuno ^a   Fonseca, José ^a   Vieira, Marco ^a   Madeira, Henrique ^a  

^a UNIVERSITY OF COIMBRA   (Portugal)

Author keywords

Field study; Programming languages; Security vulnerabilities; Software faults

Indexed keywords

FAULT TYPES; FIELD STUDIES; PROGRAMMING LANGUAGE; SECURITY PATCHES; SECURITY VULNERABILITIES; SOFTWARE FAULT; SQL INJECTION; TYPE SYSTEMS; WEB APPLICATION; WEB SECURITY;

ADA (PROGRAMMING LANGUAGE); C (PROGRAMMING LANGUAGE); COMPUTER SOFTWARE SELECTION AND EVALUATION; LINGUISTICS; QUALITY ASSURANCE; QUERY LANGUAGES; SECURITY OF DATA; SOFTWARE RELIABILITY; WORLD WIDE WEB;

JAVA PROGRAMMING LANGUAGE;

EID: 77951455398     PISSN: 10719458     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ISSRE.2009.30     Document Type: Conference Paper

References (28)

1. Fonseca, J., Vieira, M.: "Mapping Software Faults with Web Security Vulnerabilities", IEEE/IFIP International Conference on Dependable Systems and Networks (DSN 2008), Anchorage, Alaska, USA, June, 2008
2. Stock, A., Williams, J., Wichers, D., "OWASP top 10", OWASP Foundation, July, 2007
3. Tomatis, N., Brega, R., Rivera, G., Siegwart, R., "May you have a strong (-typed) foundation, Why strong-typed programming languages do matter", IEEE International Conference on Robotics and Automation, New Orleans, LA, USA, April 26-May 1, 2004
4. Open Source Software in Java, December, 2008, http://javasource.net
5. Security Focus, December, 2008, http://www.securityfocus.com
6. OSVDB: The Open Source Vulnerability Database, December, 2008, http://osvdb.org
7. Secunia, December, 2008, http://secunia.com
8. Open Source Software in C#, December, 2008, http://csharpsource.net
9. JForum, December, 2008, http://www.jforum.net
10. OpenCMS from Alkacon Software, December 10th, 2008, http://www.opencms. org
11. BlojSom, December, 2008, http://wiki.blojsom.com/wiki/display/blojsom3/ About+blojsom
12. The Roller WebLogger, December, 2008, http://rollerweblogger.org/project
13. JSPWiki, December, 2008, http://www.jspwiki.org
14. SubText, December, 2008, http://subtextproject.com
15. DotNetNuke, December, 2008, http://www.dotnetnuke.com
16. YetAnotherForum, December, 2008, http://www.yetanotherforum.net
17. BugTracker .NET, December, 2008, http://www.ifdefined.com/bugtrackernet. html
18. Deki Wiki, December, 2008, http://wiki.developer.mindtouch.com
19. ScrewTurn Wiki, December, 2008, http://www.screwturn.eu/Default.aspx? AspxAutoDetectCookieSupport=1
20. Steve, C., Martin, R., " Vulnerability Type Distributions in CVE", Mitre report, May, 2007
21. C# Coding Standards and Best Practices, December 2008, http://www.codeproject.com/KB/cs/c-coding-standards.aspx
22. C# Coding Standards and Best Programming Practices, December 2008, http://www.dotnetspider.com/tutorials/BestPractices.aspx
23. Valeur, F., Mutz, D., Vigna, G.: "A Learning-Based Approach to the Detection of SQL Attacks", IEEE Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA 2005), Vienna, Austria, July, 2005
24. Christey, S., "Unforgivable Vulnerabilities", Black Hat Briefings, 2007
25. Zanero, S., Carettoni, L., Zanchetta, M., "Automatic Detection of Web Application Security Flaws", Black Hat Briefings, 2005
26. David, P., Stroud, R., "Conceptual Model and Architecture of MAFTIA", LAAS-CNRS, 2003
27. Jovanovic, N., Kruegel, C., Kirda, E., "Precise Alias Analysis for Static Detection of Web Application Vulnerabilities", IEEE Symposium on Security and Privacy, 2006
28. Nagy, C., Mancoridis, S., "Static security analysis based on inputrelated software faults", 13th European Conference on Software Maintenance and Reengineering (CSMR'09), Kaiserslautern, Germany, March, 2009