F4F: Taint analysis of framework-based web applications

Proceedings of the Conference on Object-Oriented Programming Systems, Languages, and Applications, OOPSLA

Volumn , Issue , 2011, Pages 1053-1067

  Sridharan, Manu ^a   Artzi, Shay ^a   Pistoia, Marco ^a   Guarnieri, Salvatore ^b   Tripp, Omer ^b,c   Berg, Ryan ^b  

^a IBM T J WATSON RESEARCH CENTER   (United States)

^b IBM   (United States)

^c TEL AVIV UNIVERSITY   (Israel)

Author keywords

Languages; Security

Indexed keywords

APPLICATION CODES; CONFIGURATION FILES; ENGINEERING STANDPOINT; EXPERIMENTAL EVALUATION; HARMONIC MEAN; LANGUAGE CONSTRUCTS; MANUAL INSPECTION; PRECISE ANALYSIS; SECURITY; SECURITY PRACTICE; SPECIFICATION GENERATORS; WEB APPLICATION;

OBJECT ORIENTED PROGRAMMING; QUERY LANGUAGES; SPECIFICATION LANGUAGES; SPECIFICATIONS; WORLD WIDE WEB;

COMPUTER SYSTEMS PROGRAMMING;

EID: 81455159309     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2048066.2048145     Document Type: Conference Paper

References (24)

1. J. Aldrich, J. Sunshine, D. Saini, and Z. Sparks. Typestateoriented programming. InOOPSLAOnward! 2009.
2. T. Ball, V. Levin, and F. Xie. Automatic creation of environment models via training. In TACAS, 2004.
3. Java SE Desktop Technologies - Java Beans. http://www.oracle.com/ technetwork/java/javase/tech/indexjsp138795.html.
4. M. Bravenboer and Y. Smaragdakis. Strictly declarative specification of sophisticated points-to analyses. In OOPSLA, 2009.
5. S. Burbeck. Applications programming in Smalltalk-80: How to use model-view-controller (MVC). http://stwww.cs.illinois.edu/users/smarch/stdocs/ mvc.html, 1992.
6. P. Centonze, G. Naumovich, S. J. Fink, and M. Pistoia. Role- Based Access Control Consistency Validation. In ISSTA, 2006.
7. The Unified Expression Language. http://java.sun.com/products/jsp/ reference/techart/unifiedEL.html.
8. S. Guarnieri, M. Pistoia, O. Tripp, J. Dolby, S. Teilhet, and R. Berg. Saving the World Wide Web from vulnerable JavaScript. In Proceedings of the 2011 International Symposium on Software Testing and Analysis, 2011.
9. C. Jaspan and J. Aldrich. Checking framework interactions with relationships. In ECOOP, 2009.
10. Java EE at a Glance. http://www.oracle.com/technetwork/java/javaee/.
11. JavaServer Pages Technology. http://java.sun.com/products/jsp/.
12. B. Livshits, J. Whaley, and M. S. Lam. Reflection analysis for Java. In K. Yi, editor, Proceedings of the 3rd Asian Symposium on Programming Languages and Systems, Nov. 2005.
13. V. B. Livshits and M. S. Lam. Finding security errors in Java programs with static analysis. In Proceedings of the 14th Usenix Security Symposium, Aug. 2005.
14. V. B. Livshits, A. V. Nori, S. K. Rajamani, and A. Banerjee. Merlin: specification inference for explicit information flow problems. In PLDI, 2009.
15. A. C. Myers. JFlow: practical mostly-static information flow control. In POPL, 1999.
16. R. O'Callahan. Generalized Aliasing as a Basis for Program Analysis Tools. PhD thesis, CarnegieMellon University, November 2000.
17. OWASP. Cross-site scripting. http://www.owasp.org/index.php/Crosssite- Scripting-(XSS. Accessed 16- August-2011.
18. U. Shankar, K. Talwar, J. S. Foster, and D. Wagner. Detecting format string vulnerabilities with type qualifiers. In USENIX Security Symposium, 2001.
19. T. Tateishi, M. Pistoia, and O. Tripp. Path- and index-sensitive string analysis based on monadic second-order logic. In Proceedings of the 2011 International Symposium on Software Testing and Analysis, ISSTA'11, 2011.
20. O. Tripp, M. Pistoia, S. J. Fink, M. Sridharan, and O. Weisman. TAJ: effective taint analysis of web applications. In PLDI, 2009.
21. R. Vallée-Rai, L. Hendren, V. Sundaresan, P. Lam, E. Gagnon, and P. Co. Soot - a Java optimization framework. In Proceedings of CASCON, 1999.
22. T.J. Watson Libraries for Analysis (WALA). http://wala.sourceforge.net.
23. Wikipedia. Comparison of web application frameworks. http://en.wikipedia. org/wiki/Comparison-of-web-application-frameworks. Accessed 16-August-2011.
24. X. Zhang, L. Koved, M. Pistoia, S. Weber, T. Jaeger, G. Marceau, and L. Zeng. The case for analysis preserving language transformation. In ISSTA, 2006.